Function at 0x41c2b0
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.0041d6f0
mov dword [esp + 0x10], eax
mov dword [esp], eax
call fcn.0041ddb0
mov dword [esp + 0x14], eax
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [esp + 0x34]
mov ebp, eax
mov esi, dword [edx + 0xc]
mov ebx, dword [edx + 8]
mov eax, esi
or eax, ebx
je 0x41c4a0
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 4
je 0x41c4a0
mov edx, dword [esp + 0x34]
mov edi, dword [edx + 0x14]
mov ebp, dword [edx + 0x10]
mov ecx, edi
or ecx, ebp
jne 0x41c341
mov ebp, dword [esp + 0x14]
xor esi, esi
xor edi, edi
test ebp, ebp
je 0x41c333
movzx ebx, byte [ebp]
test bl, bl
mov cl, bl
jne 0x41c450
xor eax, eax
xor edx, edx
mov esi, dword [esp + 0x34]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov edi, dword [esp + 0x10]
xor ebp, ebp
test edi, edi
je 0x41c3f0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
mov dword [esp + 4], edx
mov dword [esp], ecx
call sub.KERNEL32.dll_GetBinaryTypeA
sub esp, 8
test eax, eax
jne 0x41c410
mov ebx, dword [0x425440]
test ebx, ebx
je 0x41c436
mov dword [esp + 4], 0x2e
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_strrchr
test eax, eax
mov esi, eax
jne 0x41c3f4
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x41c3f0
mov dword [esp + 4], 0x2e
mov edx, dword [esp + 0x10]
mov dword [esp], edx
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x41c3f0
cld
mov ebx, 0x41bd0a
mov esi, eax
mov edi, ebx
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
sete bl
movzx eax, bl
lea esi, [esi]
test eax, eax
je 0x41c3da
or ebp, 0xa000
mov edi, dword [esp + 0x34]
xor eax, eax
or dword [edi], ebp
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x41c3d0
mov dword [esp + 4], eax
mov edi, dword [0x425440]
mov dword [esp], edi
call sub.msvcrt.dll_strstr
test eax, eax
je 0x41c41a
lea esi, [esi]
mov ebp, 0x49
jmp 0x41c396
mov dword [esp + 4], esi
mov esi, dword [0x424060]
mov dword [esp], esi
call sub.msvcrt.dll_strstr
test eax, eax
je 0x41c396
jmp 0x41c410
mov dword [esp], 0x41bd64
call sub.msvcrt.dll_getenv
mov dword [0x425440], eax
jmp 0x41c37c
shld edi, esi, 8
movsx eax, cl
shl esi, 8
cdq
add esi, eax
adc edi, edx
mov edx, edi
xor ebx, ebx
and edx, 0xff000000
mov eax, edx
or eax, ebx
je 0x41c488
mov ecx, edx
xor eax, eax
shr ecx, 0x10
mov edx, esi
xor edx, ecx
mov ecx, edi
xor ecx, eax
mov esi, edx
mov edi, ecx
and edi, 0xffffff
inc ebp
movzx ebx, byte [ebp]
test bl, bl
mov cl, bl
jne 0x41c450
mov eax, esi
mov edx, edi
jmp 0x41c337
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x41c4d0
mov ebp, dword [esp + 0x34]
mov dword [ebp + 8], 5
mov dword [ebp + 0xc], 0x50000
jmp 0x41c309
xor esi, esi
xor edi, edi
add ebp, dword [esp + 0x10]
je 0x41c4e2
movzx ecx, byte [ebp]
test cl, cl
jne 0x41c4f5
xor eax, eax
xor edx, edx
mov esi, dword [esp + 0x34]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
jmp 0x41c309
shld edi, esi, 8
movsx eax, cl
shl esi, 8
cdq
add esi, eax
adc edi, edx
mov edx, edi
xor ebx, ebx
and edx, 0xff000000
mov eax, edx
or eax, ebx
je 0x41c52d
mov ecx, edx
xor eax, eax
shr ecx, 0x10
mov edx, esi
xor edx, ecx
mov ecx, edi
xor ecx, eax
mov esi, edx
mov edi, ecx
and edi, 0xffffff
inc ebp
movzx ebx, byte [ebp]
test bl, bl
mov cl, bl
jne 0x41c4f5
mov eax, esi
mov edx, edi
jmp 0x41c4e6