Function at 0x10005900
Capabilities:
Get disk size
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x798
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x100014b8
mov dword [ebp - 0x30], ecx
push 0x100013d4
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x100014a0
push 0x100013d4
mov dword [ebp - 0x34], eax
call esi
push eax
call edi
push 0x10001490
push 0x100013d4
mov ebx, eax
call esi
push eax
call edi
mov dword [ebp - 0x2c], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x10001484
push 0x100013d4
call esi
push eax
call edi
mov dword [ebp - 0x18], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x238]
mov byte [ebp - 0x798], 0x67
push eax
push pe_nt_image_headers32
call ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
lea ebx, [ebp - 0x238]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov al, byte [ebp - 0x238]
mov esi, 1
test al, al
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
je 0x10005bbe
jmp 0x100059e1
xor edx, edx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x138]
rep stosd dword es:[edi], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x138]
push 0x104
push ecx
push edx
push edx
push edx
push edx
push edx
push ebx
call dword [ebp - 0x34]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x410
lea edx, [ebp - 0x398]
push 0x160
push edx
push 0x80
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x288]
push eax
call dword [ebp - 0x18]
mov edi, eax
inc edi
mov dword [ebp - 0x24], edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x138]
push ecx
call dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x28], eax
mov al, byte [ebx]
cmp al, 0x41
je 0x10005acf
cmp al, 0x42
je 0x10005acf
lea edx, [ebp - 0x10]
push 0
lea eax, [ebp - 8]
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x10005acf
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, 0x14
call fcn.10012570
mov dword [ebp - 0x20], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, 0x14
call fcn.10012570
jmp 0x10005ae3
xor eax, eax
mov dword [ebp - 0x20], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov cl, byte [ebx]
mov dword [ebp - 0x1c], eax
mov byte [ebp + esi - 0x798], cl
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
call dword [ebp - 0x2c]
mov byte [ebp + esi - 0x797], al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x20]
mov dword [ebp + esi - 0x796], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x1c]
mov ecx, edi
mov dword [ebp + esi - 0x792], eax
mov eax, dword [ebp - 0x14]
mov edx, ecx
lea esi, [ebp - 0x288]
lea edi, [ebp + eax - 0x78e]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
add edx, eax
lea esi, [ebp - 0x138]
lea edi, [ebp + edx - 0x78e]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
mov edx, dword [ebp - 0x24]
add ecx, edx
push ebx
lea eax, [eax + ecx + 0xa]
mov dword [ebp - 0x14], eax
call dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
lea ebx, [ebx + eax + 1]
cmp byte [ebx], 0
jne 0x100059df
lea ecx, [ebp - 0x798]
push esi
push ecx
mov ecx, dword [ebp - 0x30]
call fcn.10008df0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret