Function at 0x41aafc
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41af39
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x118
call fcn.0040286c
mov dword [ebp - 0xc], eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406824
mov esi, 0x41af48
lea edi, [ebp - 0x10c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0040697c
xor eax, eax
push ebp
push 0x41aefe
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0x42
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x118
call fcn.00402f54
lea eax, [ebp - 0x110]
mov dl, byte [ebp - 5]
call fcn.00403ecc
lea eax, [ebp - 0x110]
mov edx, 0x41af5c
call fcn.00403f5c
mov eax, dword [ebp - 0x110]
call fcn.00404154
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
mov eax, ebx
sub eax, 2
je 0x41ad4c
dec eax
je 0x41abef
sub eax, 2
je 0x41ad4c
jmp 0x41aee7
mov eax, dword [ebp - 0xc]
mov byte [eax], 1
lea eax, [ebp - 0x114]
mov dl, byte [ebp - 5]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x118]
call fcn.00402ebc
mov edx, 0x41af60
lea eax, [ebp - 0x118]
mov cl, 2
call fcn.00402e8c
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0xc]
inc eax
mov cl, 2
call fcn.00402ec8
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x100], 3
xor eax, eax
push ebp
push 0x41acf8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x220]
mov dl, byte [ebp - 5]
call fcn.00403ecc
lea eax, [ebp - 0x220]
mov edx, 0x41af5c
call fcn.00403f5c
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0041aa14
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
mov ecx, 0xff
call fcn.00403f30
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 0xc]
add eax, 4
mov cl, 0xf8
call fcn.00402ec8
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x108
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x110
push eax
lea eax, [ebp - 0x224]
mov dl, byte [ebp - 5]
call fcn.00403ecc
lea eax, [ebp - 0x224]
mov edx, 0x41af5c
call fcn.00403f5c
mov eax, dword [ebp - 0x224]
call fcn.00404154
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41ad37
mov edx, dword [ebp - 0xc]
mov ecx, 0x118
mov eax, dword [ebp - 4]
call fcn.0040697c
jmp 0x41aee7
mov eax, dword [ebp - 0xc]
mov byte [eax], 1
lea eax, [ebp - 0x114]
mov dl, byte [ebp - 5]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x118]
call fcn.00402ebc
mov edx, 0x41af60
lea eax, [ebp - 0x118]
mov cl, 2
call fcn.00402e8c
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0xc]
inc eax
mov cl, 2
call fcn.00402ec8
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x100], ebx
mov al, byte [ebp - 5]
call fcn.0041aa98
test al, al
je 0x41aea2
xor eax, eax
push ebp
push 0x41ae61
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22c]
mov dl, byte [ebp - 5]
call fcn.00403ecc
lea eax, [ebp - 0x22c]
mov edx, 0x41af5c
call fcn.00403f5c
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.0041aa14
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x218]
mov ecx, 0xff
call fcn.00403f30
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 0xc]
add eax, 4
mov cl, 0xf8
call fcn.00402ec8
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x108
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x110
push eax
lea eax, [ebp - 0x230]
mov dl, byte [ebp - 5]
call fcn.00403ecc
lea eax, [ebp - 0x230]
mov edx, 0x41af5c
call fcn.00403f5c
mov eax, dword [ebp - 0x230]
call fcn.00404154
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41aed7
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x108], 0
mov dword [eax + 0x10c], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x110], 0
mov dword [eax + 0x114], 0
mov edx, dword [ebp - 0xc]
mov ecx, 0x118
mov eax, dword [ebp - 4]
call fcn.0040697c
inc byte [ebp - 5]
cmp byte [ebp - 5], 0x5b
jne 0x41ab93
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41af08
mov eax, dword [ebp - 0xc]
call fcn.0040289c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41af40
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.00403dd0
lea eax, [ebp - 0x110]
call fcn.00403dac
ret