Function at 0x1002df00
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x10037f3f
mov eax, dword fs:[0]
push eax
mov eax, 0x2b40
call fcn.10035030
mov eax, dword [0x1005a018]
xor eax, esp
mov dword [esp + 0x2b3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1005a018]
xor eax, esp
push eax
lea eax, [esp + 0x2b54]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2b64]
push 1
xor ebx, ebx
push 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_int_]
mov dword [esp + 0x2b5c], 1
call dword [sym.imp.MSVCP90.dll_public:_static_class_std::locale_const____cdecl_std::locale::classic_void_]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + 4]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + ecx + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_class_std::locale___thiscall_std::basic_ios_char__struct_std::char_traits_char__::imbue_class_std::locale_const__]
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::locale::destructor_void_]
push 0x104
lea edx, [esp + 0x2948]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
lea ecx, [esp + 0x28]
push ecx
push 0x104
lea edx, [esp + 0x2a60]
push edx
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x2954], 0x5a
mov byte [esp + 0x2955], 0x50
mov byte [esp + 0x2956], 0x45
mov byte [esp + 0x2957], 0x4a
mov byte [esp + 0x2958], 0x6c
mov byte [esp + 0x2959], 0x2d
mov byte [esp + 0x295a], 0x2a
mov byte [esp + 0x295b], 0x5b
mov byte [esp + 0x295c], 0x41
mov byte [esp + 0x295d], 0x78
mov byte [esp + 0x295e], 0x57
mov byte [esp + 0x295f], 0x37
mov byte [esp + 0x2960], 0x34
mov byte [esp + 0x2961], 0x23
mov byte [esp + 0x2962], 0x32
mov byte [esp + 0x2963], 0x55
mov dword [esp + 0x40], 0x5c3a43
mov edi, 0x9a758634
mov byte [esp + 0x294c], 0xcb
mov byte [esp + 0x294d], 0x80
mov byte [esp + 0x294e], 0xf4
mov byte [esp + 0x294f], 0x6e
mov byte [esp + 0x2950], 0xdc
mov byte [esp + 0x2951], 0x48
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1002e093
mov edi, dword [esp + 0x18]
xor edi, 0x9a758634
mov esi, 0x1005a4e4
call fcn.1002f3d0
cmp eax, ebx
je 0x1002e114
push str.GetAdaptersInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1002e114
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xb0]
push edx
mov dword [esp + 0x1c], 0x2880
call eax
mov al, byte [esp + 0x240]
mov cl, al
xor cl, 0xcb
mov byte [esp + 0x292c], cl
mov dl, al
xor dl, 0x80
mov cl, al
xor cl, 0xf4
mov byte [esp + 0x292d], dl
mov byte [esp + 0x292e], cl
mov dl, al
mov cl, al
xor dl, 0x6e
xor cl, 0xdc
xor al, 0x48
mov byte [esp + 0x292f], dl
mov byte [esp + 0x2930], cl
mov byte [esp + 0x2931], al
push 0x1004bf88
push edi
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.10025600
add esp, 8
xor edi, edi
nop
movzx esi, byte [esp + edi + 0x292c]
mov edx, esi
shr edx, 4
movzx eax, byte [esp + edx + 0x2934]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.1002e5e0
and esi, 0xf
movzx edx, byte [esp + esi + 0x293c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.1002e5e0
inc edi
add esp, 0x10
cmp edi, 6
jl 0x1002e130
push ebp
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::str_void_]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 1
mov byte [esp + 0x2b5c], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::vbase_dtor_void_]
mov eax, ebp
mov ecx, dword [esp + 0x2b54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2b3c]
xor ecx, esp
call fcn.100344d1
add esp, 0x2b4c
ret