Function at 0x100526a0
Capabilities:
Link many functions at runtime

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x101075cc], eax
jne 0x100529c8
cmp byte [0x101075c8], 0
je 0x100529c8
cmp dword [0x10102548], 0
je 0x10052709
cmp dword [0x1010254c], 0x10
mov eax, 0x10102538
cmovae eax, dword [0x10102538]
push eax
push str.last_probe_miss:__s
call fcn.10081660
add esp, 8
mov dword [0x10102548], 0
cmp dword [0x1010254c], 0x10
mov eax, 0x10102538
cmovae eax, dword [0x10102538]
mov byte [eax], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push edi
push str.kernelbase.dll
mov byte [0x101075c8], 0
mov dword [0x101075cc], 0
call ebx
push dword [0x10107570]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100cfdd4
push eax
call edi
push eax
call fcn.1006f190
add esp, 8
push 0x100cfe10
call ebx
push dword [0x1010756c]
mov esi, eax
push 0x100cfdd4
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x10107574]
push 0x100cfe44
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x10107578]
push 0x100cfe50
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x1010757c]
push str.GetVolumeInformationByHandleW
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x101075a0]
push str.GetFinalPathNameByHandleW
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x1010759c]
push str.GetFileInformationByHandle
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x101075a8]
push str.EnumSystemFirmwareTables
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x101075ac]
push str.GetSystemFirmwareTable
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push str.advapi32.dll
call ebx
mov esi, eax
test esi, esi
je 0x1005285a
push dword [0x10107580]
push str.RegCreateKeyExW
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x10107584]
push 0x100cff08
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x10107588]
push 0x100cff18
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push str.ntdll.dll
call ebx
mov esi, eax
test esi, esi
je 0x100528c3
push dword [0x10107590]
push str.NtQueryInformationFile
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x10107594]
push str.NtQueryDirectoryFile
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x10107598]
push str.NtQueryVolumeInformationFile
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
push dword [0x1010758c]
push str.NtCreateFile
push esi
call edi
push eax
call fcn.1006f190
add esp, 8
cmp byte [0x101075c9], 0
jne 0x100528f3
cmp dword [0x101075b4], 0
je 0x100528f3
cmp dword [0x10102534], 0x10
mov eax, 0x10102520
push 1
cmovae eax, dword [0x10102520]
push eax
call fcn.10056f20
add esp, 8
push dword [0x101075b8]
push 0x101075b8
call fcn.10051510
mov eax, dword [0x101075b8]
add esp, 8
mov ecx, 0x101075b0
mov dword [eax], eax
mov eax, dword [0x101075b8]
mov dword [eax + 4], eax
mov esi, dword [0x101075b0]
mov dword [0x101075bc], 0
push dword [esi + 4]
push 0x101075b0
call fcn.10051420
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov edi, dword [0x101075c0]
mov dword [0x101075b4], 0
mov esi, dword [edi + 4]
cmp byte [esi + 0xd], 0
jne 0x10052987
jmp 0x10052960
push dword [esi + 8]
mov ecx, 0x101075c0
push 0x101075c0
call fcn.1004f750
mov eax, esi
mov esi, dword [esi]
push 0x18
push eax
call fcn.100a1a2e
add esp, 8
cmp byte [esi + 0xd], 0
je 0x10052960
mov dword [edi + 4], edi
mov dword [edi], edi
mov dword [edi + 8], edi
push dword [0x10107568]
mov dword [0x101075c4], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10102534], 0x10
mov eax, 0x10102520
pop edi
cmovae eax, dword [0x10102520]
pop esi
mov dword [0x10102530], 0
pop ebx
mov byte [eax], 0
ret