Function at 0x467d20
Capabilities:
Get disk information
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3ff
xor ebx, ebx
lea eax, [ebp - 0x407]
push ebx
push eax
mov byte [ebp - 0x408], 0
call fcn.004c5470
add esp, 0xc
lea ecx, [ebp - 0x408]
push ecx
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea ecx, [ebx + 1]
mov dword [ebp - 0x828], eax
call fcn.00458ee0
cmp eax, ebx
je 0x467d88
lea edx, [ebp - 0x840]
mov dword [eax], edx
mov dword [ebp - 0x840], eax
jmp 0x467d8e
mov dword [ebp - 0x840], ebx
xor esi, esi
xor edi, edi
cmp dword [ebp - 0x828], 0x3fc
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], ebx
jbe 0x467dcf
lea esi, [ebp - 0x840]
call fcn.00425480
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x408], bl
je 0x467e5e
jmp 0x467de0
lea ecx, [ebp + edi - 0x408]
mov eax, ecx
mov dword [ebp - 0x80c], 0xf
mov dword [ebp - 0x810], ebx
mov byte [ebp - 0x820], 0
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x467e03
sub eax, esi
push eax
push ecx
lea ecx, [ebp - 0x824]
call fcn.0040b8b0
mov eax, dword [ebp - 0x810]
lea ecx, [ebp - 0x824]
push ecx
lea ebx, [ebp - 0x840]
lea edi, [edi + eax + 1]
call fcn.00452ea0
cmp dword [ebp - 0x80c], 0x10
jb 0x467e4d
mov edx, dword [ebp - 0x820]
push edx
call fcn.004c097a
add esp, 4
xor ebx, ebx
cmp byte [ebp + edi - 0x408], bl
jne 0x467de0
mov esi, dword [ebp - 0x834]
mov ecx, dword [ebp - 0x830]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x828], 0xffffffff
mov dword [ebp - 0x848], ebx
mov dword [ebp - 0x844], ebx
je 0x468084
jmp 0x467ea0
push ebx
lea edi, [ebp - 0x840]
call fcn.004687a0
cmp dword [eax + 0x18], 0x10
jb 0x467eb7
mov eax, dword [eax + 4]
jmp 0x467eba
add eax, 4
mov esi, eax
call fcn.00468630
test eax, eax
je 0x467f09
push ebx
lea edi, [ebp - 0x840]
call fcn.004687a0
cmp dword [eax + 0x18], 0x10
jb 0x467edc
mov eax, dword [eax + 4]
jmp 0x467edf
add eax, 4
push eax
call fcn.00468750
cmp edx, dword [ebp - 0x844]
jl 0x467f09
jg 0x467ef7
cmp eax, dword [ebp - 0x848]
jbe 0x467f09
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x844], edx
mov dword [ebp - 0x828], ebx
mov ecx, dword [ebp - 0x830]
mov esi, dword [ebp - 0x834]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
inc ebx
add ecx, edx
cmp ebx, ecx
jb 0x467ea0
mov edi, dword [ebp - 0x828]
cmp edi, 0xffffffff
je 0x468082
push 0x400
xor esi, esi
lea edx, [ebp - 0x808]
push esi
push edx
call fcn.004c5470
add esp, 0xc
push edi
lea edi, [ebp - 0x840]
call fcn.004687a0
push 0xffffffffffffffff
push esi
mov ebx, 0xf
push eax
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x80c], ebx
mov dword [ebp - 0x810], esi
mov byte [ebp - 0x820], 0
call fcn.00410c40
mov edi, 0x10
push edi
push str.pagefile.sys_0_0
lea eax, [ebp - 0x824]
call fcn.0040db60
mov eax, dword [ebp - 0x820]
cmp dword [ebp - 0x80c], edi
jae 0x467fb6
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x808]
push 0x3ff
push eax
call fcn.004c4adf
mov ecx, dword [ebp - 0x810]
add esp, 0xc
add ecx, 3
push ecx
lea edx, [ebp - 0x808]
push edx
push 7
push str.PagingFiles
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
cmp dword [ebp - 0x80c], edi
jb 0x46800a
mov eax, dword [ebp - 0x820]
push eax
call fcn.004c097a
add esp, 4
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x80c], ebx
mov dword [ebp - 0x810], esi
mov byte [ebp - 0x820], 0
cmp eax, esi
je 0x46804b
mov ecx, dword [ebp - 0x828]
mov edi, dword [ebp - 0x830]
push ecx
call fcn.004267b0
mov edx, dword [ebp - 0x834]
add esp, 4
push edx
call fcn.004c097a
add esp, 4
mov eax, dword [ebp - 0x840]
push eax
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x830], esi
mov dword [ebp - 0x82c], esi
call fcn.004c097a
add esp, 4
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp esi, ebx
je 0x4680ae
mov ecx, dword [ebp - 0x828]
mov edi, dword [ebp - 0x830]
push ecx
mov eax, esi
call fcn.004267b0
mov edx, dword [ebp - 0x834]
add esp, 4
push edx
call fcn.004c097a
add esp, 4
mov eax, dword [ebp - 0x840]
push eax
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], ebx
call fcn.004c097a
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret