Function at 0x10010b840
Capabilities:
Get disk size
Get memory capacity
Query environment variable
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5a8
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov rbp, r9
mov qword [rsp + 0x60], r9
mov r12, r8
mov qword [rsp + 0x68], r8
mov ebx, edx
mov rsi, rcx
call fcn.10010c1fc
xor r14d, r14d
cmp eax, r14d
je 0x10010b9aa
mov rax, qword [0x100157bb0]
mov qword [rsp + 0x58], rax
mov rdi, rax
cmp rax, r14
jne 0x10010b971
cmp qword [0x100157ba0], r14
je 0x10010b9aa
mov rax, qword [0x100157ba8]
cmp rax, r14
je 0x10010b9aa
lea rdx, [0x10002ef58]
lea rcx, [rsp + 0xb0]
call rax
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x58]
mov edx, 0x100001
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], r14
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov dword [rsp + 0x20], 7
call qword [0x100157ba0]
cmp eax, r14d
jl 0x10010b9aa
mov rcx, qword [rsp + 0x58]
xor eax, eax
lock cmpxchg qword [0x100157bb0], rcx
mov rdi, rax
je 0x10010b96c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], rdi
jmp 0x10010b971
mov rdi, qword [rsp + 0x58]
mov eax, dword [rbp]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov r9d, ebx
mov r8, rsi
mov edx, 0x390008
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r14d
je 0x10010b9aa
mov eax, 1
jmp 0x10010c1cf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0xe04
xor edx, edx
mov rcx, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
cmp rax, r14
jne 0x10010b9d2
xor eax, eax
jmp 0x10010c1cf
mov rcx, rdi
cmp ebx, ecx
ja 0x10010c043
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea r11d, [rbx + 8]
mov r13d, 0xfffffff8
and r11d, r13d
mov rax, rdi
cmp r11d, eax
jbe 0x10010ba08
mov edi, r14d
jmp 0x10010c043
mov ebx, r11d
sub edi, r11d
add rbx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx], eax
cmp edi, 8
jb 0x10010ba00
add edi, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 8], eax
cmp edi, 8
jb 0x10010ba00
add edi, r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x10], eax
cmp edi, 8
jb 0x10010ba00
add edi, r13d
add rbx, 0x18
cmp edi, 0x10
jb 0x10010c043
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, 0x18
cmp edi, esi
jb 0x10010ba00
add edi, 0xffffffe8
add rbx, rsi
cmp edi, 8
jb 0x10010c043
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp edi, 0x10
jb 0x10010ba00
add edi, 0xfffffff0
cmp edi, 0x38
jb 0x10010c043
lea rcx, [rbx + 0x10]
mov dword [rbx + 0x10], 0x38
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp edi, 0x40
jb 0x10010ba00
add edi, 0xffffffc0
add rbx, 0x50
cmp edi, 0x10
jb 0x10010c043
lea rax, [rbx + 0xc]
lea r9, [rbx + 8]
lea r8, [rbx + 4]
mov rdx, rbx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp edi, esi
jb 0x10010ba00
add rbx, rsi
add edi, 0xffffffe8
cmp dword [0x100154cbc], r14d
jne 0x10010bbcb
mov r13d, r14d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, rax
cmp rax, r14
jne 0x10010bb15
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov r13d, 1
mov rsi, rax
cmp rax, r14
je 0x10010bbb6
lea rcx, [rsp + 0xd0]
call fcn.10011fcfc
mov r12, rsi
mov ebp, r14d
mov eax, ebp
test r13d, r13d
jne 0x10010bb43
lea r12, [r12 + rax + 2]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
add ebp, ebp
jmp 0x10010bb53
lea r12, [r12 + rax + 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
lea r8, [rsp + 0xd0]
mov edx, ebp
mov rcx, r12
call fcn.10011fd40
test ebp, ebp
jne 0x10010bb28
lea rdx, [rsp + 0x12c]
lea rcx, [rsp + 0xd0]
call fcn.10011ffe4
lea rcx, [0x100154f58]
lea rdx, [rsp + 0x12c]
lea r8d, [rbp + 0x14]
call sub.msvcrt.dll_memcpy
mov rcx, rsi
cmp r13d, r14d
jne 0x10010bba6
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x10010bbac
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov dword [0x100154cbc], 1
mov esi, 0x18
mov r13d, 0xfffffff8
cmp edi, 0x14
jb 0x10010c043
mov rax, qword [0x100154f58]
mov qword [rbx], rax
mov rax, qword [0x100154f60]
mov qword [rbx + 8], rax
mov eax, dword [0x100154f68]
mov dword [rbx + 0x10], eax
cmp edi, esi
jb 0x10010ba00
add rbx, rsi
add edi, 0xffffffe8
call fcn.10010c1fc
cmp eax, r14d
je 0x10010c043
cmp edi, 0x40
jb 0x10010c043
mov rax, qword [0x100157b98]
cmp rax, r14
je 0x10010c043
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
lea ecx, [r9 + 5]
mov dword [rsp + 0x50], edi
call rax
cmp edi, 0x14
jb 0x10010c043
lea rcx, [rsp + 0x140]
call fcn.10011fcfc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x140]
mov rcx, rbx
call fcn.10011fd40
lea rcx, [rsp + 0x140]
mov rdx, rbx
call fcn.10011ffe4
cmp edi, esi
jb 0x10010ba00
add edi, 0xffffffe8
add rbx, rsi
cmp edi, 0x30
jb 0x10010c043
mov r8d, 0x30
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 - 0x2d]
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010bcc1
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010ba00
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, esi
jb 0x10010c043
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, rbx
mov ecx, 7
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010bcfd
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010ba00
mov eax, ecx
add rbx, rax
sub edi, ecx
mov r8d, 0xa8
cmp edi, r8d
jb 0x10010c043
lea r9, [rsp + 0x50]
lea ecx, [r8 - 0x58]
mov rdx, rbx
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010bd3c
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010ba00
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, 0x40
jb 0x10010c043
mov r8d, 0x40
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 - 0x2b]
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010bd7b
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010ba00
mov eax, ecx
add rbx, rax
sub edi, ecx
mov r8d, 0x148
cmp edi, r8d
jb 0x10010c043
lea r9, [rsp + 0x50]
mov rdx, rbx
mov ecx, 2
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010bdbb
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010ba00
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, 0x10
jb 0x10010c043
mov r8d, 0x10
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 + 0x11]
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010bdfa
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010ba00
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, 0x20
jb 0x10010c043
mov r8d, 0x20
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 + 0xd]
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010be39
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010ba00
mov eax, ecx
add rbx, rax
sub edi, ecx
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 8
mov dword [rsp + 0x50], edi
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010bea8
cmp edi, 0x14
jb 0x10010c043
lea rcx, [rsp + 0x290]
call fcn.10011fcfc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x290]
mov rcx, rbx
call fcn.10011fd40
lea rcx, [rsp + 0x290]
mov rdx, rbx
call fcn.10011ffe4
cmp edi, esi
jb 0x10010ba00
mov r13d, 0xffffffe8
add rbx, rsi
add edi, r13d
jmp 0x10010beae
mov r13d, 0xffffffe8
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x3d
mov dword [rsp + 0x50], edi
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010bf15
cmp edi, 0x14
jb 0x10010c043
lea rcx, [rsp + 0x1b0]
call fcn.10011fcfc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x1b0]
mov rcx, rbx
call fcn.10011fd40
lea rcx, [rsp + 0x1b0]
mov rdx, rbx
call fcn.10011ffe4
cmp edi, esi
jb 0x10010ba00
add rbx, rsi
add edi, r13d
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x12
mov dword [rsp + 0x50], edi
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010bf7c
cmp edi, 0x14
jb 0x10010c043
lea rcx, [rsp + 0x220]
call fcn.10011fcfc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x220]
mov rcx, rbx
call fcn.10011fd40
lea rcx, [rsp + 0x220]
mov rdx, rbx
call fcn.10011ffe4
cmp edi, esi
jb 0x10010ba00
add rbx, rsi
add edi, r13d
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x17
mov dword [rsp + 0x50], edi
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010bfe3
cmp edi, 0x14
jb 0x10010c043
lea rcx, [rsp + 0x300]
call fcn.10011fcfc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x300]
mov rcx, rbx
call fcn.10011fd40
lea rcx, [rsp + 0x300]
mov rdx, rbx
call fcn.10011ffe4
cmp edi, esi
jb 0x10010ba00
add rbx, rsi
add edi, r13d
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x2a
mov dword [rsp + 0x50], edi
call qword [0x100157b98]
cmp eax, r14d
jl 0x10010c043
cmp edi, 0x14
jb 0x10010c043
lea rcx, [rsp + 0x370]
call fcn.10011fcfc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x370]
mov rcx, rbx
call fcn.10011fd40
lea rcx, [rsp + 0x370]
mov rdx, rbx
call fcn.10011ffe4
cmp edi, esi
jb 0x10010ba00
add edi, r13d
mov esi, 0x50
lea rcx, [rsp + 0x4f0]
lea rdx, [0x100155240]
mov r8, rsi
call sub.msvcrt.dll_memcpy
lea r8, [rsp + 0x4f0]
lea rcx, [rsp + 0x3e0]
mov edx, esi
call fcn.10011fa50
mov eax, 0xe04
lea r8, [rsp + 0x4f0]
mov edx, eax
mov rcx, r15
sub edx, edi
cmp edx, eax
cmova edx, eax
call fcn.10010c418
lea rcx, [rsp + 0x540]
lea rdx, [rsp + 0x4f0]
mov r8, rsi
mov ebx, eax
call sub.msvcrt.dll_memcpy
lea rcx, [0x100155240]
lea rdx, [rsp + 0x4f0]
mov r8, rsi
call sub.msvcrt.dll_memcpy
lea r8, [rsp + 0x540]
lea rcx, [rsp + 0x3e0]
mov edx, esi
call fcn.10011fca0
lea rdx, [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
lea rdx, [0x10002efe0]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_RegCreateKeyExA]
cmp eax, r14d
jne 0x10010c156
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x540]
lea r9d, [rsi - 0x4d]
lea rdx, [0x10002efd8]
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea rdi, [rsp + 0x540]
mov rcx, rsi
rep stosb byte [rdi], al
lea r8, [rsp + 0x4f0]
lea rcx, [rsp + 0x3e0]
mov edx, esi
call fcn.10011fa50
mov edx, dword [rbp]
xor eax, eax
lea rdi, [rsp + 0x4f0]
mov rcx, rsi
mov r8, r12
rep stosb byte [rdi], al
lea rcx, [rsp + 0x3e0]
call fcn.10011fca0
xor eax, eax
lea rdi, [rsp + 0x3e0]
mov ecx, 0x108
rep stosb byte [rdi], al
mov rdi, r15
mov ecx, 0xe04
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.10011b980
add rsp, 0x5a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret