Function at 0x50a84c
Capabilities:
Get disk information
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x574], ecx
mov dword [ebp - 0x570], ecx
mov ebx, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x50ace3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x16c]
call fcn.0050a69c
test bl, bl
je 0x50a9e7
test byte [ebp - 1], 1
je 0x50ab3d
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x50acf4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x50a93a
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x50ad20
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x50a931
mov bl, 1
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0050a6e4
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x50ad30
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x50a931
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0050a6e4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
test bl, bl
jne 0x50ab3d
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x50ad48
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x50ab3d
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x50ad20
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x50a9d9
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0050a6e4
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x50ad30
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x50a9d9
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0050a6e4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x50ab3d
test byte [ebp - 1], 1
je 0x50ab3d
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x50ad78
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x50aa95
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x50adcc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x50aa8c
mov bl, 1
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0050a6e4
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x50adec
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x50aa8c
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0050a6e4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
test bl, bl
jne 0x50ab3d
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x50ae1c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x50ab3d
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x50adcc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x50ab34
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0050a6e4
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x50adec
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x50ab34
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0050a6e4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
test byte [ebp - 1], 2
je 0x50ab85
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetSystemInfo_1
lea eax, [ebp - 0x56c]
mov edx, dword [ebp - 0x40]
mov dword [eax], edx
movzx eax, word [ebp - 0x54]
lea edx, [ebp - 0x568]
mov dword [edx], eax
movzx eax, word [ebp - 0x32]
lea edx, [ebp - 0x566]
mov dword [edx], eax
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, 8
call fcn.0050a6e4
test byte [ebp - 1], 4
je 0x50ac1f
lea eax, [ebp - 0x20]
push eax
call sub.ole32.dll_CoCreateGuid_1
lea eax, [ebp - 0x30]
push eax
call sub.ole32.dll_CoCreateGuid_1
push 0x50ae78
call sub.kernel32.dll_LoadLibraryW
mov ebx, eax
test ebx, ebx
je 0x50abd6
push 0x50ae90
push ebx
call fcn.0040a004
mov edi, eax
mov esi, edi
test edi, edi
je 0x50abd0
lea eax, [ebp - 0x20]
push eax
call esi
lea eax, [ebp - 0x30]
push eax
call esi
push ebx
call sub.kernel32.dll_FreeLibrary_1
movzx eax, byte [ebp - 0x16]
cmp al, byte [ebp - 0x26]
jne 0x50ac1f
movzx eax, byte [ebp - 0x15]
cmp al, byte [ebp - 0x25]
jne 0x50ac1f
movzx eax, byte [ebp - 0x14]
cmp al, byte [ebp - 0x24]
jne 0x50ac1f
movzx eax, byte [ebp - 0x13]
cmp al, byte [ebp - 0x23]
jne 0x50ac1f
movzx eax, byte [ebp - 0x12]
cmp al, byte [ebp - 0x22]
jne 0x50ac1f
movzx eax, byte [ebp - 0x11]
cmp al, byte [ebp - 0x21]
jne 0x50ac1f
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16c]
mov ecx, 6
call fcn.0050a6e4
test byte [ebp - 1], 8
je 0x50acb2
lea edx, [ebp - 0x570]
xor eax, eax
call fcn.00403728
mov eax, dword [ebp - 0x570]
movzx ebx, word [eax]
lea eax, [ebp - 0x56c]
xor ecx, ecx
mov edx, 0x400
call fcn.00403968
mov byte [ebp - 0x56c], bl
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56b]
push eax
push 0
push 0
lea eax, [ebp - 0x574]
mov edx, ebx
call fcn.00406818
lea eax, [ebp - 0x574]
mov edx, 0x50aec8
call fcn.00406ac0
mov eax, dword [ebp - 0x574]
call fcn.00406738
push eax
call sub.kernel32.dll_GetVolumeInformationW
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, 5
call fcn.0050a6e4
lea edx, [ebp - 8]
lea eax, [ebp - 0x16c]
mov ecx, 4
call fcn.0050a7ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50acea
lea eax, [ebp - 0x574]
mov edx, 2
call fcn.004066a4
ret