Function at 0x7cf7367b
Capabilities:
Check if file exists
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x654]
push edi
xor ebx, ebx
push eax
push esi
mov dword [ebp - 0x28], 0x104
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], ebx
call fcn.7cf71c16
lea eax, [ebp - 0x244]
push eax
push esi
call fcn.7cf71c3a
lea eax, [ebp - 0x244]
push 0x7cf32094
push eax
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp esi, 0x1a
jne 0x7cf736df
mov eax, dword [0x7d04c770]
mov eax, dword [eax + 0x14]
jmp 0x7cf736e9
mov eax, dword [esi*4 + 0x7d04c708]
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44c]
push eax
mov dword [ebp - 8], 4
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7cf7374c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 0x7cf32214
push dword [ebp - 4]
call edi
test eax, eax
jne 0x7cf7374c
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
push ebx
lea eax, [ebp - 0x654]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x7cf7374c
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jne 0x7cf7374c
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], ebx
je 0x7cf73791
cmp esi, 0x1a
jne 0x7cf7378c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x85c]
push eax
push ebx
push ebx
push 0x7cf32208
push dword [ebp - 4]
call edi
test eax, eax
jne 0x7cf73789
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x85c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x7cf7378c
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jne 0x7cf73799
push esi
call fcn.7cf739c8
jmp 0x7cf737bf
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
mov eax, dword [esi*4 + 0x7d04c708]
add eax, 0x18
push eax
push ebx
push ebx
push 0x7cf321f4
push dword [ebp - 4]
call edi
test eax, eax
je 0x7cf737c5
push esi
call fcn.7cf7287c
push esi
call fcn.7cf72595
test eax, eax
je 0x7cf739bf
push esi
call fcn.7cf72ac6
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x44c]
push 0x7cf320d0
push eax
call esi
lea eax, [ebp - 0x438]
push eax
push dword [ebp + 8]
call fcn.7cf71c99
lea eax, [ebp - 0x436]
push 0x7cf321d8
push eax
call esi
mov eax, dword [ebp + 8]
push dword [ebp - 0xc]
lea esi, [eax*4 + 0x7d04c708]
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_423]
mov ecx, dword [esi]
mov dword [ecx + 4], eax
mov eax, dword [esi]
cmp dword [eax + 4], 0xffffffff
je 0x7cf739bf
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x7cf3218c
push dword [0x7d04c778]
call edi
cmp dword [ebp - 0x18], ebx
je 0x7cf73862
mov eax, dword [0x7d04c778]
jmp 0x7cf73867
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push 4
mov dword [ebp - 4], eax
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
add eax, 0x1c
push eax
push ebx
push ebx
push 0x7cf3217c
push dword [ebp - 4]
call edi
test eax, eax
jne 0x7cf738a7
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [esi]
add eax, 0x30
push eax
push ebx
push ebx
push 0x7cf32160
push dword [ebp - 4]
call edi
test eax, eax
je 0x7cf738b7
mov eax, dword [0x7d04c778]
cmp dword [ebp - 4], eax
je 0x7cf739bf
jmp 0x7cf73867
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 8]
call fcn.7cf71bf3
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x244]
push eax
call sym.SHELL32.dll_SHGetDiskFreeSpaceExW
test eax, eax
je 0x7cf7394f
lea eax, [ebp - 0x244]
push eax
call fcn.7cfc05e4
mov ecx, dword [esi]
push ebx
push 0x64
mov dword [ecx + 0x24], eax
mov eax, dword [esi]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x28], ecx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x2c], ecx
push dword [ebp - 0x10]
mov esi, dword [esi]
push dword [ebp - 0x14]
call fcn.7d041a10
mov ecx, eax
mov eax, dword [esi + 0x1c]
mov edi, edx
cdq
push edx
push eax
push edi
push ecx
call fcn.7d0419d0
cmp edx, ebx
ja 0x7cf73932
jb 0x7cf7392d
cmp eax, 0xffffffff
jae 0x7cf73932
mov dword [ebp - 0x1c], edx
jmp 0x7cf73938
or eax, 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x7cf739ba
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
jmp 0x7cf739ba
cmp dword [ebp + 8], 0x1a
jne 0x7cf7399c
mov eax, dword [0x7d04c770]
push 0x64
pop esi
mov dword [eax + 0x24], 0x800
mov ecx, dword [0x7d04c770]
mov eax, dword [ecx + 0x1c]
shl eax, 0xa
cdq
idiv esi
imul eax, eax, 0x1fffff
mov dword [ecx + 0x20], eax
mov eax, dword [0x7d04c770]
or dword [eax + 0x28], 0xffffffff
mov eax, dword [0x7d04c770]
mov dword [eax + 0x2c], ebx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x7cf739ba
mov dword [eax], ParseURLA
jmp 0x7cf739b7
mov eax, dword [esi]
mov dword [eax + 0x20], ebx
mov eax, dword [esi]
mov dword [eax + 0x24], ebx
mov eax, dword [esi]
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x7cf739ba
mov dword [eax], ebx
mov dword [eax + 4], ebx
push 1
pop eax
jmp 0x7cf739c1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8