Function at 0x1020f9e0
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102a91bb
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x10560040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a0], 0
mov ecx, 0x108c9974
call fcn.10296940
push 0x105
push 0
lea eax, [ebp - 0x220]
push eax
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
push 0x105
push 0
lea ecx, [ebp - 0x118]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x240], 1
mov dword [ebp - 0x23c], 1
cmp dword [ebp + 0xc], 1
jne 0x1020fd29
push 0x105
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 0x105
lea eax, [ebp - 0x220]
push eax
push 0x104b90e4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1020fd29
xor ecx, ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], ecx
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x108bd2f0
call fcn.10149ed0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2ac]
push ecx
mov ecx, 0x108bd2f0
call fcn.10149fe0
mov dword [ebp - 0x278], eax
mov edx, dword [ebp - 0x278]
push edx
lea ecx, [ebp - 0x238]
call fcn.1014a340
movzx eax, al
test eax, eax
jne 0x1020fb22
mov dword [ebp - 0x270], 1
jmp 0x1020fb2c
mov dword [ebp - 0x270], 0
mov cl, byte [ebp - 0x270]
mov byte [ebp - 0x261], cl
mov dl, byte [ebp - 0x261]
mov byte [ebp - 0x262], dl
push 3
lea ecx, [ebp - 0x244]
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::_Lockit::constructor_int_]
lea ecx, [ebp - 0x2ac]
call fcn.1003faf0
lea ecx, [ebp - 0x244]
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
nop
movzx eax, byte [ebp - 0x262]
test eax, eax
je 0x1020fd16
mov dword [ebp - 0x27c], 0x108bd2f0
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov edx, dword [ebp - 0x27c]
mov dword [ebp - 0x280], edx
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x284]
mov edx, dword [ecx + 4]
mov eax, dword [edx]
mov dword [ebp - 0x288], eax
mov ecx, dword [ebp - 0x288]
mov dword [ebp - 0x228], ecx
xor edx, edx
mov byte [ebp - 0x221], dl
jmp 0x1020fbd6
lea ecx, [ebp - 0x228]
call fcn.1014a250
nop
mov al, byte [ebp - 0x221]
mov byte [ebp - 0x268], al
mov ecx, dword [ebp - 0x228]
movsx edx, byte [ecx + 0xd]
test edx, edx
jne 0x1020fbfc
mov dword [ebp - 0x274], 1
jmp 0x1020fc06
mov dword [ebp - 0x274], 0
mov al, byte [ebp - 0x274]
mov byte [ebp - 0x263], al
movzx ecx, byte [ebp - 0x263]
test ecx, ecx
je 0x1020fccd
mov edx, dword [ebp - 0x228]
add edx, 0x10
mov dword [ebp - 0x28c], edx
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x290]
mov dword [ebp - 0x26c], ecx
mov edx, dword [ebp - 0x26c]
mov eax, dword [edx]
mov dword [ebp - 0x294], eax
mov ecx, dword [ebp - 0x26c]
add ecx, 4
push ecx
lea ecx, [ebp - 0x260]
call fcn.1004d1c0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x294]
cmp edx, dword [ebp - 0x22c]
jne 0x1020fcb8
lea eax, [ebp - 0x260]
push eax
mov ecx, 0x10790bb0
call fcn.1008bc80
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ecx]
mov dword [0x10790bd0], edx
mov byte [0x10790bcc], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
call fcn.1004cfa0
nop
jmp 0x1020fbca
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
call fcn.1004cfa0
nop
jmp 0x1020fbca
push 0
push 0
push 0
push 0x101cb500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jne 0x1020fd16
mov dword [ebp - 0x29c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.10149cd0
nop
mov eax, dword [ebp - 0x29c]
jmp 0x1020fd2f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.10149cd0
nop
jmp 0x1020fd2d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101906c0
mov esp, ebp
pop ebp
ret 0xc