Function at 0x105d1bc
Capabilities:
Get disk size

Disassembly:
mov eax, reloc.ADVAPI32.dll_AddAccessAllowedAce
call fcn.01077868
sub esp, 0x4c
mov eax, dword [0x10de03c]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
xor esi, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], esi
call fcn.01075f2c
mov eax, dword [edi + 0xac]
cmp dword [eax - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], 0x41
jne 0x105d224
call fcn.010591b8
cmp ax, si
mov dword [ebp - 0x28], eax
je 0x105d238
movzx eax, ax
push eax
push 0x100ca00
push 0x10e5758
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
jmp 0x105d232
push eax
push 0x10e5758
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
cmp word [ebp - 0x28], si
jne 0x105d252
push 1
push esi
push 0x30
push esi
push 0x1212
push 0xfa6
call fcn.01054bf6
jmp 0x105d3a2
cmp dword [edi + 0x5c], esi
jne 0x105d2e3
movzx eax, word [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push 0x11
push eax
call fcn.010762e0
add esp, 0xc
push 1
push esi
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push esi
push dword [ebp - 0x2c]
push 0x17
call fcn.01054b96
mov ax, word [ebp - 0x28]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov word [ebp - 0x22], 0x3a
mov word [ebp - 0x20], 0x5c
mov word [ebp - 0x1e], si
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x105d2e3
mov eax, dword [ebp - 0x34]
or eax, dword [ebp - 0x30]
je 0x105d2cc
cmp dword [ebp - 0x30], esi
ja 0x105d2cc
cmp dword [ebp - 0x34], 0xe4e1c0
jbe 0x105d2e3
push 1
push esi
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push esi
push 0x4e85
push 0x17
call fcn.01054bf6
jmp 0x105d252
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.010771a4
mov edi, eax
cmp edi, esi
je 0x105d3a2
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x20]
cmp ecx, esi
je 0x105d3a2
push esi
call fcn.0107607c
mov edi, dword [edi + 0x20]
call fcn.01075fa4
mov eax, dword [eax + 8]
push esi
push 0x10592fa
push edi
push 0x8de4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov edi, eax
push edi
call fcn.0105a11d
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push 1
push 0x10e5758
call fcn.0103ac20
push edi
mov dword [ebp - 0x44], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x20]
xor edi, edi
inc edi
push edi
call fcn.0107607c
cmp word [ebp - 0x44], si
je 0x105d39c
call fcn.01039f05
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x5c], esi
jne 0x105d38e
push esi
push esi
push reloc.KERNEL32.dll_LoadLibraryW
push 5
push eax
push 0x17
call fcn.01054bf6
cmp eax, 2
je 0x105d39f
mov edi, dword [ebp - 0x38]
jmp 0x105d252
push eax
push edi
push edi
push esi
call fcn.01050ed2
add esp, 0x10
jmp 0x105d39f
mov dword [ebp - 0x40], edi
mov esi, dword [ebp - 0x40]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.01075ef0
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
call fcn.01075bbb
leave
ret 4