Function at 0x101068e0
Capabilities:
Get common file path
Get disk size
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014f1a3
mov eax, dword fs:[0]
push eax
sub esp, 0x680
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x674], ebx
mov dword [ebp - 0x68c], ebx
mov dword [ebp - 0x688], 0
call fcn.10038a00
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x1010694a
push 0x80004005
call fcn.1003dd50
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x66c], eax
push 0
mov dword [ebp - 4], 1
call fcn.1011cfc5
push eax
call fcn.10120ec5
call fcn.10120ea4
push eax
lea eax, [ebp - 0x66c]
push str._05ld
push eax
call fcn.10106810
add esp, 0x14
lea eax, [ebp - 0x554]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x103
lea eax, [ebp - 0x33b]
mov byte [ebp - 0x33c], 0
push 0
push eax
call fcn.1011a400
add esp, 0xc
lea edx, [ebp - 0x554]
mov ecx, 0x101687d0
mov esi, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x101069d3
add ecx, 4
add edx, 4
sub esi, 4
jae 0x101069c0
jmp 0x10106a3d
movzx eax, byte [ebp - 0x545]
push eax
movzx eax, byte [ebp - 0x546]
push eax
movzx eax, byte [ebp - 0x547]
push eax
movzx eax, byte [ebp - 0x548]
push eax
movzx eax, byte [ebp - 0x549]
push eax
movzx eax, byte [ebp - 0x54a]
push eax
movzx eax, byte [ebp - 0x54b]
push eax
movzx eax, byte [ebp - 0x54c]
push eax
movzx eax, word [ebp - 0x54e]
push eax
movzx eax, word [ebp - 0x550]
push eax
push dword [ebp - 0x554]
lea eax, [ebp - 0x33c]
push str._08lX_04X_04x_02X_02X_02X_02X_02X_02X_02X_02X
push eax
call fcn.1011bba1
add esp, 0x34
lea eax, [ebp - 0x664]
mov dword [ebp - 0x668], eax
lea ecx, [ebp - 0x668]
push 3
lea eax, [ebp - 0x33c]
push eax
call fcn.10069910
mov edx, dword [ebp - 0x668]
mov byte [ebp - 4], 2
test edx, edx
jne 0x10106a6f
xor ecx, ecx
jmp 0x10106a83
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10106a74
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x66c]
call fcn.10053a90
mov eax, dword [ebp - 0x668]
lea ecx, [ebp - 0x664]
mov byte [ebp - 4], 1
cmp eax, ecx
je 0x10106aad
push eax
call fcn.1011bc41
add esp, 4
lea eax, [ebp - 0x564]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.10038a00
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x10106ad6
push 0x80004005
call fcn.1003dd50
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x670], eax
movzx eax, word [ebp - 0x562]
push eax
movzx eax, word [ebp - 0x558]
push eax
movzx eax, word [ebp - 0x55c]
push eax
movzx eax, word [ebp - 0x564]
push eax
movzx eax, word [ebp - 0x55e]
push eax
movzx eax, word [ebp - 0x55a]
push eax
movzx eax, word [ebp - 0x556]
push eax
lea eax, [ebp - 0x670]
mov byte [ebp - 4], 3
push str._03d_02d_02d_04d_02d_02d_02d
push eax
call fcn.10068660
mov edi, dword [ebp - 0x670]
lea ecx, [ebp - 0x66c]
add esp, 0x24
push dword [edi - 0xc]
push edi
call fcn.10053a90
push 0x103
lea eax, [ebp - 0x237]
mov byte [ebp - 0x238], 0
push 0
push eax
call fcn.1011a400
add esp, 0xc
mov dword [ebp - 0x684], 0x104
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor eax, eax
mov byte [ebp - 0x30], 0
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10106bb0
sub ecx, edx
lea eax, [ebp - 0x238]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10108b70
add esp, 0xc
call fcn.10038a00
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x10106be9
push 0x80004005
call fcn.1003dd50
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 0x688], 1
xor esi, esi
nop
movzx eax, byte [ebp + esi - 0x30]
push eax
push str._02x
push ebx
call fcn.10106810
inc esi
add esp, 0xc
cmp esi, 0x10
jl 0x10106c00
mov eax, dword [ebx]
lea ecx, [ebp - 0x66c]
push dword [eax - 0xc]
push eax
call fcn.10053a90
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x544], ax
lea eax, [ebp - 0x542]
push eax
call fcn.1011a400
add esp, 0xc
lea eax, [ebp - 0x544]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x67c], 0
push eax
push 0
push 0
lea eax, [ebp - 0x544]
mov dword [ebp - 0x678], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push dword [ebp - 0x67c]
lea eax, [ebp - 0x66c]
push str._010lu
push eax
call fcn.10106810
push 0x103
lea eax, [ebp - 0x133]
mov byte [ebp - 0x134], 0
push 0
push eax
call fcn.1011a400
mov esi, dword [ebp - 0x66c]
lea eax, [ebp - 0x5e4]
add esp, 0x18
mov dword [ebp - 0x5e8], eax
lea ecx, [ebp - 0x5e8]
push 3
push esi
call fcn.10048c20
push dword [ebp - 0x5e8]
lea eax, [ebp - 0x134]
push 0x104
push eax
call fcn.10125757
mov eax, dword [ebp - 0x5e8]
lea ecx, [ebp - 0x5e4]
add esp, 0xc
cmp eax, ecx
je 0x10106d0e
push eax
call fcn.1011bc41
add esp, 4
lea ecx, [ebp - 0x134]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10106d17
sub ecx, edx
lea eax, [ebp - 0x134]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10108b70
mov eax, dword [ebx]
add esp, 0xc
cmp dword [eax - 0xc], 0
lea edx, [eax - 0x10]
mov ecx, dword [edx]
mov dword [ebp - 0x680], ecx
je 0x10106d94
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x10106d70
cmp dword [eax - 8], 0
jge 0x10106d60
push 0x80070057
call fcn.1003dd50
mov dword [eax - 0xc], 0
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax], cx
jmp 0x10106d94
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10106d84
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x680]
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov esi, dword [ebp - 0x674]
xor ebx, ebx
lea esp, [esp]
movzx eax, byte [ebp + ebx - 0x30]
push eax
push str._02x
push esi
call fcn.10106810
inc ebx
add esp, 0xc
cmp ebx, 0x10
jl 0x10106da0
add edi, 0xfffffff0
mov byte [ebp - 4], 1
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
mov esi, dword [ebp - 0x66c]
test ecx, ecx
jg 0x10106de0
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x10106dfb
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x674]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret