Function at 0x102167e0
Capabilities:
Create thread
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102a9b4b
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x10561040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a4], 0
mov ecx, 0x108ce978
call fcn.10297320
push 0x105
push 0
lea eax, [ebp - 0x220]
push eax
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
push 0x105
push 0
lea ecx, [ebp - 0x118]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
cmp dword [ebp + 0xc], 1
jne 0x10216b59
push 0x105
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 0x105
lea eax, [ebp - 0x220]
push eax
push 0x104b9ed4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x10216b59
xor ecx, ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], ecx
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x108bded4
call fcn.1014b180
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2b0]
push ecx
mov ecx, 0x108bded4
call fcn.1014b290
mov dword [ebp - 0x278], eax
mov edx, dword [ebp - 0x278]
push edx
lea ecx, [ebp - 0x238]
call fcn.1014b5f0
movzx eax, al
test eax, eax
jne 0x10216922
mov dword [ebp - 0x270], 1
jmp 0x1021692c
mov dword [ebp - 0x270], 0
mov cl, byte [ebp - 0x270]
mov byte [ebp - 0x261], cl
mov dl, byte [ebp - 0x261]
mov byte [ebp - 0x262], dl
push 3
lea ecx, [ebp - 0x244]
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::_Lockit::constructor_int_]
lea ecx, [ebp - 0x2b0]
call fcn.1003e350
lea ecx, [ebp - 0x244]
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
nop
movzx eax, byte [ebp - 0x262]
test eax, eax
je 0x10216b3d
mov dword [ebp - 0x27c], 0x108bded4
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov edx, dword [ebp - 0x27c]
mov dword [ebp - 0x280], edx
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x284]
mov edx, dword [ecx + 4]
mov eax, dword [edx]
mov dword [ebp - 0x288], eax
mov ecx, dword [ebp - 0x288]
mov dword [ebp - 0x228], ecx
xor edx, edx
mov byte [ebp - 0x221], dl
jmp 0x102169d6
lea ecx, [ebp - 0x228]
call fcn.1014b500
nop
mov al, byte [ebp - 0x221]
mov byte [ebp - 0x268], al
mov ecx, dword [ebp - 0x228]
movsx edx, byte [ecx + 0xd]
test edx, edx
jne 0x102169fc
mov dword [ebp - 0x274], 1
jmp 0x10216a06
mov dword [ebp - 0x274], 0
mov al, byte [ebp - 0x274]
mov byte [ebp - 0x263], al
movzx ecx, byte [ebp - 0x263]
test ecx, ecx
je 0x10216acd
mov edx, dword [ebp - 0x228]
add edx, 0x10
mov dword [ebp - 0x28c], edx
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x290]
mov dword [ebp - 0x26c], ecx
mov edx, dword [ebp - 0x26c]
mov eax, dword [edx]
mov dword [ebp - 0x294], eax
mov ecx, dword [ebp - 0x26c]
add ecx, 4
push ecx
lea ecx, [ebp - 0x260]
call fcn.1004aba0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x294]
cmp edx, dword [ebp - 0x22c]
jne 0x10216ab8
lea eax, [ebp - 0x260]
push eax
mov ecx, 0x10791a20
call fcn.100896c0
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ecx]
mov dword [0x10791a40], edx
mov byte [0x10791a3c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
call fcn.1004a980
nop
jmp 0x102169ca
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
call fcn.1004a980
nop
jmp 0x102169ca
push 0
push 0
push 0
push 0x101d3510
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jne 0x10216b16
mov dword [ebp - 0x29c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.1014af80
nop
mov eax, dword [ebp - 0x29c]
jmp 0x10216b5f
mov dword [ebp - 0x2a0], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.1014af80
nop
mov eax, dword [ebp - 0x2a0]
jmp 0x10216b5f
push 0
call dword [sym.imp.ucrtbased.dll_exit]
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.1014af80
nop
jmp 0x10216b5d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1019a1c0
mov esp, ebp
pop ebp
ret 0xc