Function at 0x10005710
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xce8
mov eax, dword [0x100180ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xcdc], ecx
mov dword [ebp - 0x54], 0
mov byte [ebp - 0xc], 0
push 0
lea eax, [ebp - 0x58]
push eax
push 0x48
lea ecx, [ebp - 0x50]
push ecx
push 0x48
lea edx, [ebp - 0x50]
push edx
push 0x222004
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1000576a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10005dd6
movzx edx, byte [ebp - 0xb]
cmp edx, 0x10
jle 0x1000577f
mov dword [ebp - 0xce0], 0x10
jmp 0x10005789
movzx eax, byte [ebp - 0xb]
mov dword [ebp - 0xce0], eax
mov ecx, dword [ebp - 0xcdc]
mov edx, dword [ebp - 0xce0]
mov dword [ecx + 0x100], edx
mov dword [ebp - 0x5c], 0
jmp 0x100057ad
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0xcdc]
mov edx, dword [ebp - 0x5c]
cmp edx, dword [ecx + 0x100]
jae 0x10005dca
cmp dword [0x10019154], 4
ja 0x10005807
mov al, byte [ebp - 0x5c]
mov byte [ebp - 0xc], al
push 0
lea ecx, [ebp - 0x58]
push ecx
push 0x48
lea edx, [ebp - 0x50]
push edx
push 0x48
lea eax, [ebp - 0x50]
push eax
push 0x222004
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x100057fb
jmp 0x10005dca
movzx edx, byte [ebp - 0xa]
mov dword [ebp - 0x60], edx
jmp 0x100058a1
push 0x3c
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.10007a40
add esp, 0xc
mov cl, byte [ebp - 0x5c]
mov byte [ebp - 0x9a], cl
push 0
lea edx, [ebp - 0x58]
push edx
push 0x3c
lea eax, [ebp - 0x9c]
push eax
push 0x3c
lea ecx, [ebp - 0x9c]
push ecx
push 0x22200c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10005853
jmp 0x10005dca
movzx eax, byte [ebp - 0x6f]
mov ecx, dword [ebp - 0x5c]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 0xcdc]
mov dword [edx + ecx + 0x48], eax
movzx eax, word [ebp - 0x72]
mov ecx, dword [ebp - 0x5c]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 0xcdc]
mov dword [edx + ecx + 0x40], eax
mov eax, dword [ebp - 0x5c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0xcdc]
mov edx, dword [ebp - 0x6e]
mov dword [ecx + eax + 0x44], edx
mov eax, dword [ebp - 0x5c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0xcdc]
mov edx, dword [ecx + eax + 0x48]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0xa0], 0
jmp 0x100058bc
mov eax, dword [ebp - 0xa0]
add eax, 1
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xa0]
cmp ecx, dword [ebp - 0x60]
jae 0x10005dc5
push 0x40
push 0
lea edx, [ebp - 0x8f0]
push edx
call fcn.10007a40
add esp, 0xc
mov byte [ebp - 0x8ee], 1
mov al, byte [ebp - 0x5c]
mov byte [ebp - 0x8eb], al
mov cl, byte [ebp - 0xa0]
mov byte [ebp - 0x8ea], cl
push 0
lea edx, [ebp - 0x58]
push edx
push 0x40
lea eax, [ebp - 0x8f0]
push eax
push 0x40
lea ecx, [ebp - 0x8f0]
push ecx
push 0x222008
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10005927
jmp 0x100058ad
movzx eax, byte [ebp - 0x8ed]
cmp eax, 8
jne 0x10005938
jmp 0x100058ad
mov cl, byte [ebp - 0x5c]
mov byte [ebp - 0x8a8], cl
mov dl, byte [ebp - 0xa0]
mov byte [ebp - 0x8a7], dl
mov byte [ebp - 0x8a6], 0
push 0
lea eax, [ebp - 0x58]
push eax
push 0x804
lea ecx, [ebp - 0x8a8]
push ecx
push 0x804
lea edx, [ebp - 0x8a8]
push edx
push 0x222010
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1000598a
jmp 0x100058ad
push 0x50
push 0
lea ecx, [ebp - 0x940]
push ecx
call fcn.10007a40
add esp, 0xc
cmp dword [0x10019154], 4
ja 0x100059b2
mov dword [ebp - 0xce4], str..GEARAspiSysDevice
jmp 0x100059bc
mov dword [ebp - 0xce4], str..GEARAspiWDMDevice
push 0
push 0x4000000
push 3
push 0
push 3
push 0xc0000000
mov edx, dword [ebp - 0xce4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x930], eax
movzx eax, byte [ebp - 0x8ec]
mov dword [ebp - 0x938], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x940], ecx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x93c], edx
mov dword [ebp - 0x934], 0
cmp dword [0x10019154], 4
jbe 0x10005a21
movsx eax, byte [ebp - 0x8a5]
test eax, eax
je 0x10005a30
movsx ecx, byte [ebp - 0x8a5]
mov dword [ebp - 0x920], ecx
jmp 0x10005a45
lea edx, [ebp - 0x8a8]
push edx
call fcn.100053e0
add esp, 4
mov dword [ebp - 0x920], eax
mov dword [ebp - 0x910], 8
mov dword [ebp - 0x90c], 0x10000
cmp dword [ebp - 0x920], 0x41
jb 0x10005c53
cmp dword [ebp - 0x920], 0x5a
ja 0x10005c53
mov eax, dword [ebp - 0x920]
sub eax, 0x41
mov dword [ebp - 0xb4c], eax
mov ecx, dword [ebp - 0xb4c]
movzx edx, byte [ecx + 0x100191e4]
test edx, edx
je 0x10005aa5
mov eax, dword [ebp - 0x930]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100058ad
mov ecx, dword [ebp - 0xb4c]
mov byte [ecx + 0x100191e4], 1
mov edx, dword [ebp - 0x920]
push edx
push 0x100142f4
push 0xa
lea eax, [ebp - 0xb58]
push eax
call fcn.100084e6
add esp, 0x10
lea ecx, [ebp - 0xb58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x10005c53
push 0x104
lea edx, [ebp - 0xc60]
push edx
lea eax, [ebp - 0xb58]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x10005c53
push str.CdRom
lea ecx, [ebp - 0xc60]
push ecx
call fcn.10008460
add esp, 8
mov dword [ebp - 0xc64], eax
cmp dword [ebp - 0xc64], 0
je 0x10005c53
mov edx, dword [ebp - 0xc64]
push edx
push str.._s
push 0x14
lea eax, [ebp - 0x908]
push eax
call fcn.100084e6
add esp, 0x10
push 0
push 0xa0000000
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 0x908]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 0xffffffff
jne 0x10005b9d
push 0
push 0xa0000000
push 3
push 0
push 3
push 0x80000000
lea edx, [ebp - 0xb58]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 0xffffffff
je 0x10005c49
mov dword [ebp - 0xc7c], 0x18
push 0
lea eax, [ebp - 0xc80]
push eax
push 0x18
lea ecx, [ebp - 0xc7c]
push ecx
push 0x18
lea edx, [ebp - 0xc7c]
push edx
push 0x41010
mov eax, dword [ebp - 0x92c]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10005c30
mov ecx, dword [ebp - 0xc6c]
add ecx, 1
mov dword [ebp - 0xc6c], ecx
mov edx, dword [ebp - 0xc6c]
mov dword [ebp - 0x910], edx
cmp dword [ebp - 0xc78], 0x10000
jbe 0x10005c18
mov dword [ebp - 0xce8], 0x10000
jmp 0x10005c24
mov eax, dword [ebp - 0xc78]
mov dword [ebp - 0xce8], eax
mov ecx, dword [ebp - 0xce8]
mov dword [ebp - 0x90c], ecx
mov edx, dword [ebp - 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x92c], 0
jmp 0x10005c53
mov dword [ebp - 0x92c], 0
push 0x10014204
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x918], 0
jne 0x10005ca2
cmp dword [ebp - 0x930], 0
je 0x10005c87
mov eax, dword [ebp - 0x930]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x92c], 0
je 0x10005c9d
mov ecx, dword [ebp - 0x92c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100058ad
mov dword [ebp - 0x944], 0
mov edx, dword [ebp - 0x920]
push edx
push str.DosDevices_C:
push 0x100
lea eax, [ebp - 0xb48]
push eax
call fcn.10006de0
add esp, 0x10
lea ecx, [ebp - 0x8ac]
push ecx
push 1
push 0
push str.SYSTEMMountedDevices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0x944]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0xb48]
push eax
mov ecx, dword [ebp - 0x8ac]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 1
mov edx, dword [ebp - 0x944]
add edx, 2
push edx
call fcn.10008654
add esp, 8
mov dword [ebp - 0x8f4], eax
lea eax, [ebp - 0x944]
push eax
mov ecx, dword [ebp - 0x8f4]
push ecx
push 0
push 0
lea edx, [ebp - 0xb48]
push edx
mov eax, dword [ebp - 0x8ac]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 0x5c
mov edx, dword [ebp - 0x8f4]
mov word [edx + 2], cx
push 0x9c
call fcn.1000858a
add esp, 4
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x924], 0
je 0x10005dc0
mov dword [ebp - 0x914], 0x258
lea eax, [ebp - 0x940]
push eax
mov ecx, dword [ebp - 0xcdc]
add ecx, 0x118
call fcn.10003b70
mov edx, 1
mov ecx, dword [ebp - 0x93c]
shl edx, cl
mov eax, dword [ebp - 0x940]
mov ecx, dword [ebp - 0xcdc]
or edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x940]
mov ecx, dword [ebp - 0xcdc]
mov dword [ecx + eax*4], edx
jmp 0x100058ad
jmp 0x100057a4
mov edx, dword [ebp - 0xcdc]
mov eax, dword [edx + 0x100]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006f5c
mov esp, ebp
pop ebp
ret 4