Function at 0x1000df9f
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov eax, 0x1005d1fa
call fcn.1005c4f8
sub esp, 0x90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x40], ecx
mov esi, edx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], esi
cmp byte [ebp + 0x18], bl
je 0x1000e575
cmp byte [ebp + 0x14], bl
je 0x1000e0da
mov dword [ebp - 0x20], 0x4c83
cmp dword [ebp - 0x20], 0x4f72
jle 0x1000e042
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0x8aa
mov edi, ebx
mov esi, ebx
mov ebx, dword [ebp - 0x18]
lea eax, [esi + edi]
mov ecx, 0x10078fb8
or eax, ebx
cdq
push edx
push eax
call fcn.10001d2f
inc esi
cmp esi, 0xb85
jl 0x1000dff7
inc edi
push 0
pop ebx
cmp edi, 0x64c3
jl 0x1000dff2
dec dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x1000dff0
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x6384
jl 0x1000dfe6
push 1
push 0x87
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x4a34
jge 0x1000e05d
mov edx, str.txurq_aidslibr_ihl
mov ecx, 0x10078fb8
call fcn.10003c4d
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 0x3c]
mov dword [esi], ebx
jmp 0x1000e0c4
mov ecx, dword [ebp + 0x2c]
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x38]
mov dword [ebp - 0x44], 0xe07ad46d
xor dl, dl
push 0x7576
push dword [ebp + 0x20]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x34]
push dword [ebp + 0xc]
push 0x4833
call fcn.1000f265
mov eax, dword [ebp - 0x44]
add esp, 0x28
dec dword [esi]
cmp dword [esi], 0xfffffff2
jg 0x1000e08a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x6c], 7
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], ax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x14], 0xb110c93b
mov dword [ebp - 0x20], 0xfffffffc
push 3
call fcn.10001eb9
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 3
push eax
push ecx
push ebx
lea edx, [ebp - 0x84]
mov ecx, 0x4c84
call fcn.1000cc48
add esp, 0xc
mov dword [ebp - 0x14], 8
jmp 0x1000e25b
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x1c], 0xfffffffe
jmp 0x1000e24e
mov dword [ebp - 0x28], 0x12d2c87
imul eax, dword [ebp - 0x28], 7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xa6c9cd49
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
sbb esi, esi
sub edx, dword [ebp - 0x14]
inc esi
imul esi, eax
neg edx
mov eax, dword [ebp - 0x5c]
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [eax + 8], esi
mov eax, dword [ebp - 0x28]
cmp eax, esi
mov eax, dword [ebp - 0x28]
setge cl
add edx, ecx
imul ecx, edx, 0xb1a7
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
imul eax, edx
test eax, eax
jne 0x1000e1cf
cmp dword [ebp - 0x28], ebx
jne 0x1000e1cf
push ecx
push 0x19e2
push 0x7bfc
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], 0x4ddc8777
push ebx
push eax
lea edx, [ebp - 0x5c]
call fcn.1000ef58
mov eax, dword [ebp - 0x1c]
add esp, 0x18
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
jmp 0x1000e248
push 1
lea ecx, [ebp - 0x68]
call fcn.10001eb9
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], ebx
jmp 0x1000e1ef
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x68]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1000e1e2
mov dword [ebp - 0x28], ebx
jmp 0x1000e236
push 0x270c
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x80090ae7
push eax
push 0x67ab
push 0x57d5
push ecx
lea eax, [ebp - 0x68]
push eax
push ecx
push 0x2619
push 0x6a30
push 0x58e0
xor cl, cl
call fcn.1000ca01
add esp, 0x28
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1000e1fa
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.10001f3c
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x10
jle 0x1000e145
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
jl 0x1000e132
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.10001f3c
lea eax, [ebp - 0x80]
xor dl, dl
push eax
push 0x4c5c
push 0x7ca3
lea ecx, [ebp - 0x40]
call fcn.1000f051
mov dword [ebp - 0x30], 0x39b642c7
add esp, 0xc
mov byte [ebp + 0x1b], bl
mov dword [ebp - 0x14], 0x47ce
cmp dword [ebp - 0x14], 0x4bab
jle 0x1000e307
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov ecx, esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], ebx
shl edi, cl
mov esi, ebx
mov ebx, dword [ebp - 0x20]
lea eax, [esi + ebx]
mov ecx, 0x10078fb8
and eax, edi
cdq
push edx
push eax
call fcn.10001d2f
inc esi
cmp esi, 0x2cfa
jl 0x1000e2bf
inc ebx
push 0
mov dword [ebp - 0x20], ebx
cmp ebx, 0x1e3
pop ebx
jl 0x1000e2ba
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x28e8
jl 0x1000e2b0
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0xda9
jl 0x1000e2ab
push 0x5659
lea eax, [ebp + 0x1b]
mov edx, 0x7845
push eax
push ecx
push ecx
push ebx
push ecx
push ecx
call fcn.1000c88f
add esp, 0x1c
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], 0x46f6
jge 0x1000e35c
mov edx, str.hzfw_idmcyc_aeqcf_ujmh_rltptqvjw_spdqd_ycbqd_mymrphx_jeqdyxs_slfcemfiy_yzlf
mov ecx, 0x10078fb8
call fcn.10003c4d
jmp 0x1000e35c
push 1
push 0x7ad3
push ebx
mov dl, 1
mov dword [ebp - 4], 2
mov ecx, 0x6699
call fcn.1000d7e8
mov eax, dword [0x1013d844]
add esp, 0xc
test al, 1
jne 0x1000e3a4
or eax, 1
mov dword [0x1013d844], eax
push 0x15602
mov byte [ebp - 4], 7
call fcn.1001c41a
pop ecx
mov word [0x1013ebe8], ax
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x1c], 0xf1448112
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1000e3cc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3c], 0x99244325
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000e3be
mov dword [ebp - 0x14], ebx
jmp 0x1000e3e5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000e3d7
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
neg eax
je 0x1000e40b
cmp dword [ebp - 0x34], ebx
je 0x1000e40b
xor eax, eax
inc eax
jmp 0x1000e40d
mov eax, ebx
mov ecx, 0xf29c8dda
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
sub ecx, 3
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
inc edx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x14], 0x54f8d36f
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2c], 0x364f2ca1
jle 0x1000e47d
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x18], eax
je 0x1000e48a
cmp dword [ebp - 0x1c], ebx
jne 0x1000e491
mov eax, ebx
cmp dword [ebp - 0x3c], ebx
je 0x1000e493
mov eax, edx
xor ecx, ecx
shl eax, 3
cmp eax, 0x39bb
setle cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1000e4e9
mov dword [ebp - 0x2c], 0x6bbbd28a
mov dword [ebp - 0x18], 0x33dc28bf
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x1000e4d7
mov eax, dword [ebp - 0x14]
mov esi, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
jmp 0x1000e4d9
mov esi, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp esi, eax
sete cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x19
jle 0x1000e4a8
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1000e504
push ebx
mov ecx, 0x2bdd
call fcn.1000c9d4
pop ecx
mov eax, dword [0x1013d844]
test al, 2
jne 0x1000e52e
or eax, 2
mov dword [0x1013d844], eax
push 0xab0b
mov byte [ebp - 4], 9
call fcn.1001c41a
pop ecx
mov word [0x1013ebf4], ax
mov byte [ebp - 4], 2
push 1
push 0x1013ebf4
push ecx
push 0x3bf7
sub esp, 0x20
lea eax, [ebp - 0x40]
lea edx, [ebp - 0x80]
push eax
push 0x1013ebe8
call fcn.1000d64d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x80]
add esp, 0x38
cmp ecx, eax
je 0x1000e565
push 0xffffffffffffffff
push ebx
push eax
call fcn.100022dc
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.100023b6
jmp 0x1000e0c9
mov dword [ebp - 0x1c], 0x3be
cmp dword [ebp - 0x1c], 0x480
jle 0x1000e60f
push 0x174e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], edi
and edi, esi
mov esi, ebx
mov eax, esi
lea ecx, [ebp - 0x9c]
xor eax, edi
cdq
push edx
push eax
call fcn.10001a85
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e5c3
mov eax, dword [eax]
push eax
call fcn.10045794
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000224a
inc esi
cmp esi, 0x4f4b
jl 0x1000e5a7
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x7efa
jl 0x1000e5a0
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3447
jl 0x1000e59b
push 0x2545
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x246
jge 0x1000e623
push str.lwiwnlrta_fadcdxk_abfwbb_onsrequ_hxxtvaj_sebph_rdhqgcs_rqvi
call fcn.10045794
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x24], 0
je 0x1000e64b
mov edx, dword [ebp + 0x28]
mov dword [edx], ebx
jmp 0x1000e641
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x30c9
inc dword [edx]
cmp dword [edx], 3
jl 0x1000e634
jmp 0x1000e0c9
mov esi, dword [ebp + 0x30]
mov dword [ebp - 0x30], esi
mov eax, dword [esi]
mov dword [eax + 8], 0xffffffe5
mov eax, dword [esi]
cmp dword [eax + 8], 0xffffffe7
jne 0x1000e0c9
mov dword [ebp - 0x20], 0x3cac
cmp dword [ebp - 0x20], 0x3f76
jle 0x1000e6a0
mov edi, ebx
mov esi, ebx
mov eax, esi
mov ecx, 0x10078fb8
or eax, edi
cdq
push edx
push eax
call fcn.10001d2f
inc esi
cmp esi, 0x505e
jl 0x1000e67a
inc edi
cmp edi, 0x6121
jl 0x1000e678
mov esi, dword [ebp + 0x30]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1000e6b5
mov edx, 0x2155
xor cl, cl
call fcn.1000c9a8
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x20], 0x3aa5
jge 0x1000e6d4
mov edx, str.osbo_ndhrhwi_evetvm_qsmntwv_mfxiuoi_wftsagvc_kuxgpbu_upauop_hcxkfsqr
mov ecx, 0x10078fb8
call fcn.10003c4d
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
inc dword [eax + 8]
jmp 0x1000e65a