Function at 0x4c6d70
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1170
call fcn.004f23a0
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xa
xor edi, edi
push edi
mov dword [ebp - 0x1134], ecx
push edi
lea ecx, [ebp - 0x10e4]
push ecx
mov dword [ebp - 0x1144], eax
mov dword [ebp - 0x10e4], 0x4d36e967
mov dword [ebp - 0x10e0], 0x11cee325
mov dword [ebp - 0x10dc], 0x8c1bf
mov dword [ebp - 0x10d8], 0x1803e12b
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov ebx, eax
mov dword [ebp - 0x114c], ebx
cmp ebx, edi
je 0x4c71ac
xor eax, eax
lea edx, [ebp - 0x1118]
push edx
push edi
push ebx
mov dword [ebp - 0x1114], eax
mov dword [ebp - 0x1110], eax
mov dword [ebp - 0x110c], eax
mov dword [ebp - 0x1108], eax
mov dword [ebp - 0x1104], eax
mov dword [ebp - 0x1100], eax
mov dword [ebp - 0x1118], 0x1c
mov dword [ebp - 0x1124], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x4c71a5
push 0xfe
lea ecx, [ebp - 0x142]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x144], ax
call fcn.004e8ba0
mov esi, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
add esp, 0xc
push edi
push 0x7f
lea edx, [ebp - 0x144]
push edx
push edi
push 0xc
lea eax, [ebp - 0x1118]
push eax
push ebx
call esi
test eax, eax
jne 0x4c6e86
push edi
push 0x7f
lea ecx, [ebp - 0x144]
push ecx
push edi
push edi
lea edx, [ebp - 0x1118]
push edx
push ebx
call esi
push 0x1fe
lea ecx, [ebp - 0x10d2]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x10d4], ax
call fcn.004e8ba0
add esp, 0xc
push edi
push 0x100
lea edx, [ebp - 0x10d4]
push edx
lea eax, [ebp - 0x1118]
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
jne 0x4c6ece
inc dword [ebp - 0x1124]
jmp 0x4c7188
push 0x7e
lea edx, [ebp - 0x1c2]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x1c4], cx
call fcn.004e8ba0
lea eax, [ebp - 0x10d4]
push eax
lea ecx, [ebp - 0x1c4]
push ecx
lea ecx, [ebp - 0x1128]
mov dword [ebp - 0x1128], edi
call fcn.004c6b40
add esp, 0x14
xor ebx, ebx
test eax, eax
je 0x4c71bd
lea edi, [ebp - 0x1c4]
mov edx, edi
push 9
push edx
mov dword [ebp - 0x116c], ebx
mov dword [ebp - 0x1168], ebx
mov dword [ebp - 0x1154], ebx
mov dword [ebp - 0x1150], ebx
mov dword [ebp - 0x115c], ebx
mov dword [ebp - 0x1164], ebx
mov dword [ebp - 0x1160], ebx
call fcn.004e53f9
mov esi, eax
add esp, 8
test esi, esi
je 0x4c6fc3
mov ecx, esi
sub ecx, edi
sar ecx, 1
add ecx, ecx
xor eax, eax
push ecx
lea edx, [ebp - 0x20]
push edi
push edx
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
call fcn.004ebc70
add esp, 0xc
lea eax, [ebp - 0x1164]
push eax
lea ecx, [ebp - 0x1154]
push ecx
lea edx, [ebp - 0x116c]
push edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 0x1154]
add dword [ebp - 0x115c], ecx
lea edi, [esi + 2]
push 9
adc ebx, dword [ebp - 0x1150]
push edi
call fcn.004e53f9
mov esi, eax
add esp, 8
test esi, esi
jne 0x4c6f55
mov eax, dword [ebp - 0x115c]
mov ecx, eax
or ecx, ebx
je 0x4c717a
shl ebx, 0x16
shr eax, 0xa
add ebx, eax
xor eax, eax
ja 0x4c7091
jb 0x4c6ff1
cmp ebx, 0x800
jae 0x4c7091
push eax
push ebx
lea edx, [ebp - 0xccc]
push 0x526cc8
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xccc]
add esp, 0x10
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c7011
mov ecx, dword [0x54bdb0]
mov dx, word [0x54bdb4]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [ebp - 0x144]
mov edx, eax
jmp 0x4c7040
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c7040
lea edi, [ebp - 0xccc]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4c7056
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xccc]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x4c7080
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c7080
jmp 0x4c7131
shrd ebx, eax, 0xa
shr eax, 0xa
push eax
push ebx
lea eax, [ebp - 0xccc]
push 0x526cd8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xccc]
add esp, 0x10
add eax, 0xfffffffe
jmp 0x4c70c0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c70c0
mov ecx, dword [0x54bdb0]
mov dx, word [0x54bdb4]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [ebp - 0x144]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c70e7
lea edi, [ebp - 0xccc]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4c7100
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xccc]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c7125
mov ecx, dword [0x54bdb8]
mov dx, word [0x54bdbc]
mov dword [eax], ecx
mov word [eax + 4], dx
mov eax, dword [ebp - 0x1128]
cmp eax, 2
jne 0x4c7156
push 0xd5
jmp 0x4c7160
cmp eax, 3
jne 0x4c717a
push 0xd8
mov esi, dword [ebp - 0x1134]
mov ebx, dword [ebp - 0x1144]
lea edi, [ebp - 0xccc]
call fcn.004c2ef0
add esp, 4
inc dword [ebp - 0x1124]
mov ebx, dword [ebp - 0x114c]
xor edi, edi
mov edx, dword [ebp - 0x1124]
lea ecx, [ebp - 0x1118]
push ecx
push edx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x4c6e31
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x112c]
push ecx
xor eax, eax
push 0x201
push edi
push str.SYSTEMCurrentControlSet_servicesDiskEnum
push reloc.WS2_32.dll_bind
mov word [ebp - 0x40], ax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov word [ebp - 0x22], ax
xor esi, esi
mov dword [ebp - 0x112c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c74a9
xor edx, edx
push 0x206
push edx
lea ecx, [ebp - 0xed2]
push ecx
mov word [ebp - 0x10], dx
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov word [ebp - 0xed4], ax
call fcn.004e8ba0
mov ecx, dword [ebp - 0x112c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea edx, [ebp - 0x111c]
push edx
lea eax, [ebp - 0x1128]
push eax
push esi
push esi
push str.Count
push ecx
mov dword [ebp - 0x1128], ebx
mov dword [ebp - 0x111c], 4
call edi
mov dword [ebp - 0x1120], ebx
cmp dword [ebp - 0x1128], ebx
jle 0x4c749a
xor eax, eax
push 0x208
push eax
lea edx, [ebp - 0xed4]
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call fcn.004e8ba0
mov ecx, dword [ebp - 0x1120]
push 0xa
lea eax, [ebp - 0x10]
push eax
push ecx
call fcn.004e534f
add esp, 0x18
lea edx, [ebp - 0x111c]
push edx
mov edx, dword [ebp - 0x112c]
lea eax, [ebp - 0xed4]
push eax
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
push edx
mov dword [ebp - 0x111c], 0x104
call edi
test eax, eax
jne 0x4c73fd
push 0x206
push eax
lea ecx, [ebp - 0x4ca]
push ecx
mov word [ebp - 0x4cc], ax
call fcn.004e8ba0
lea edx, [ebp - 0xed4]
push edx
lea eax, [ebp - 0x4cc]
push str.SYSTEMCurrentControlSetEnum_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [ebp - 0x1148]
push ecx
push 0x201
push 0
lea edx, [ebp - 0x4cc]
push edx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x1148], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c73fd
push 0xfe
push eax
lea ecx, [ebp - 0x2c2]
push ecx
mov dword [ebp - 0x111c], 0x80
mov word [ebp - 0x2c4], ax
call fcn.004e8ba0
mov ecx, dword [ebp - 0x1148]
add esp, 0xc
lea edx, [ebp - 0x111c]
push edx
lea eax, [ebp - 0x2c4]
push eax
push 0
push 0
push str.FriendlyName
push ecx
call edi
lea eax, [ebp - 0x2c4]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c7390
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x2c4]
push edx
lea eax, [ebp - 0x144]
push eax
call fcn.004e5007
add esp, 0xc
test eax, eax
jne 0x4c73f0
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x10fc]
mov dword [ebp - 0x10fc], eax
mov dword [ebp - 0x10f8], eax
mov dword [ebp - 0x10f4], eax
mov dword [ebp - 0x10f0], eax
mov dword [ebp - 0x10ec], eax
mov dword [ebp - 0x10e8], eax
call fcn.004c7880
test eax, eax
jne 0x4c741b
mov ecx, dword [ebp - 0x1148]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1120]
inc eax
mov dword [ebp - 0x1120], eax
cmp eax, dword [ebp - 0x1128]
jl 0x4c7278
jmp 0x4c749a
push 3
lea edx, [ebp - 0x490]
push 0x5261d8
push edx
call fcn.004e5007
add esp, 0xc
test eax, eax
je 0x4c744f
push 7
lea eax, [ebp - 0x490]
push str.USBSTOR
push eax
call fcn.004e5007
add esp, 0xc
test eax, eax
jne 0x4c7465
xor eax, eax
movzx ecx, word [eax + 0x5261d8]
mov word [ebp + eax - 0x40], cx
add eax, 2
test cx, cx
jne 0x4c7451
mov eax, dword [ebp - 0x10e8]
mul dword [ebp - 0x10ec]
mov ecx, dword [ebp - 0x10f0]
push 0
push ecx
push edx
push eax
call fcn.004f1b60
mov ecx, dword [ebp - 0x10f8]
push ecx
mov ecx, dword [ebp - 0x10fc]
push ecx
push edx
push eax
call fcn.004f1b60
mov ebx, eax
mov esi, edx
mov edx, dword [ebp - 0x112c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov eax, ebx
or eax, esi
jne 0x4c76e0
mov eax, dword [0x56628c]
mov esi, dword [eax + 0x20]
cmp dword [eax + 0x18], edi
jbe 0x4c717a
test esi, esi
je 0x4c717a
xor ebx, ebx
cmp dword [eax + 0x2c], ebx
jle 0x4c717a
xor edi, edi
lea esp, [esp]
mov ecx, dword [esi + 0x14]
lea edx, [ebp - 0x1140]
push edx
add ecx, esi
mov dword [esi + 0x20], ecx
push 0x90
push esi
mov dword [ebp - 0x1140], edi
mov dword [ebp - 0x1138], edi
mov dword [ebp - 0x1130], edi
call dword [0x566344]
lea eax, [ebp - 0x1138]
push eax
push 0x80
push esi
call dword [0x566344]
lea ecx, [ebp - 0x1130]
push ecx
push 0xa0
push esi
call dword [0x566344]
add esp, 0x24
cmp dword [ebp - 0x1140], edi
jbe 0x4c75d1
mov eax, dword [ebp - 0x1138]
cmp eax, edi
jbe 0x4c75d1
cmp dword [ebp - 0x1130], edi
jbe 0x4c75d1
push eax
lea edx, [ebp - 0x1120]
push edx
mov dword [ebp - 0x1120], edi
call dword [0x566370]
mov eax, dword [ebp - 0x1120]
push eax
push 0x80
push esi
call dword [0x566348]
lea eax, [ebp - 0x144]
add esp, 0x14
lea edx, [eax + 2]
jmp 0x4c7590
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4c7590
sub eax, edx
mov edx, dword [ebp - 0x1120]
sar eax, 1
push eax
lea ecx, [ebp - 0x144]
push ecx
push edx
call fcn.004e5007
add esp, 0xc
test eax, eax
je 0x4c75e9
mov eax, dword [ebp - 0x1138]
push eax
lea ecx, [ebp - 0x1120]
push ecx
call dword [0x566378]
add esp, 8
mov edx, dword [0x56628c]
add esi, dword [esi + 0x10]
inc ebx
cmp ebx, dword [edx + 0x2c]
jl 0x4c74e0
jmp 0x4c717a
mov eax, dword [ebp - 0x1140]
push eax
lea ecx, [ebp - 0x111c]
push ecx
mov dword [ebp - 0x111c], edi
call dword [0x566370]
mov edx, dword [ebp - 0x111c]
push edx
push 0x90
push esi
call dword [0x566348]
mov eax, dword [ebp - 0x111c]
push 3
push 0x5261d8
push eax
call fcn.004e5007
add esp, 0x20
test eax, eax
je 0x4c764a
mov ecx, dword [ebp - 0x111c]
push 7
push str.USBSTOR
push ecx
call fcn.004e5007
add esp, 0xc
test eax, eax
jne 0x4c7664
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x5261d8]
mov word [ebp + eax - 0x40], cx
add eax, 2
cmp cx, di
jne 0x4c7650
mov edx, dword [ebp - 0x1130]
push edx
lea eax, [ebp - 0x113c]
push eax
mov dword [ebp - 0x113c], edi
call dword [0x566370]
mov ecx, dword [ebp - 0x113c]
push ecx
push 0xa0
push esi
call dword [0x566348]
mov edx, dword [ebp - 0x113c]
push edx
call fcn.004e5185
mov ebx, eax
mov eax, dword [ebp - 0x1140]
push eax
lea ecx, [ebp - 0x111c]
push ecx
mov esi, edx
call dword [0x566378]
mov edx, dword [ebp - 0x1130]
push edx
lea eax, [ebp - 0x113c]
push eax
call dword [0x566378]
mov ecx, dword [ebp - 0x1138]
push ecx
lea edx, [ebp - 0x1120]
push edx
call dword [0x566378]
add esp, 0x30
cmp esi, edi
ja 0x4c77a6
cmp ebx, edi
jbe 0x4c717a
xor edi, edi
cmp esi, edi
ja 0x4c77a6
jb 0x4c7708
cmp ebx, 0x800
jae 0x4c77a6
shrd ebx, esi, 0xa
shr esi, 0xa
push esi
push ebx
lea eax, [ebp - 0xccc]
push 0x526cc8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xccc]
add esp, 0x10
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x4c7730
mov ecx, dword [0x54bdb0]
mov dx, word [0x54bdb4]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [ebp - 0x144]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4c7757
lea edi, [ebp - 0xccc]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4c7770
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xccc]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c7795
jmp 0x4c7841
shrd ebx, esi, 0x14
shr esi, 0x14
push esi
push ebx
lea eax, [ebp - 0xccc]
push 0x526cd8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xccc]
add esp, 0x10
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x4c77d0
mov ecx, dword [0x54bdb0]
mov dx, word [0x54bdb4]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [ebp - 0x144]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4c77f7
lea edi, [ebp - 0xccc]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4c7810
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xccc]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c7835
mov ecx, dword [0x54bdb8]
mov dx, word [0x54bdbc]
mov dword [eax], ecx
push 3
mov word [eax + 4], dx
lea eax, [ebp - 0x40]
push 0x5261d8
push eax
call fcn.004e5007
add esp, 0xc
test eax, eax
jne 0x4c715b
push 0xd5
jmp 0x4c7160