Function at 0x1001ef90
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1034526d
mov eax, dword fs:[0]
push eax
sub esp, 0x7a4
mov eax, dword [0x1040706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x7ac], edi
mov dword [ebp - 0x728], 0
mov dword [ebp - 0x724], 0xf
mov byte [ebp - 0x738], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x710], 0
mov dword [ebp - 0x70c], 0xf
mov byte [ebp - 0x720], 0
mov dword [ebp - 0x6f8], 0
mov dword [ebp - 0x6f4], 0xf
mov byte [ebp - 0x708], 0
mov dword [ebp - 0x6e0], 0
mov dword [ebp - 0x6dc], 0xf
mov byte [ebp - 0x6f0], 0
push 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x738]
push 0x103d28b0
mov dword [ebp - 0x6d8], 1
call fcn.10006700
push 0
push 0x103d28b0
lea ecx, [ebp - 0x720]
call fcn.10006700
push 0
push 0x103d28b0
lea ecx, [ebp - 0x708]
call fcn.10006700
push 0
push 0x103d28b0
lea ecx, [ebp - 0x6f0]
call fcn.10006700
lea eax, [ebp - 0x6bc]
mov dword [ebp - 4], 4
push eax
call fcn.1001eda0
mov esi, eax
lea eax, [ebp - 0x738]
cmp eax, esi
je 0x1001f0dd
mov ecx, eax
call fcn.10002730
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x738], xmm0
movq xmm0, qword [esi + 0x10]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
movq qword [ebp - 0x728], xmm0
mov byte [esi], 0
mov edx, dword [ebp - 0x6a8]
cmp edx, 0x10
jb 0x1001f117
mov ecx, dword [ebp - 0x6bc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f10d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f511
push edx
push ecx
call fcn.100f99db
add esp, 8
lea eax, [ebp - 0x6bc]
push eax
call fcn.1001ee30
mov esi, eax
lea eax, [ebp - 0x720]
cmp eax, esi
je 0x1001f15e
mov ecx, eax
call fcn.10002730
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x720], xmm0
movq xmm0, qword [esi + 0x10]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
movq qword [ebp - 0x710], xmm0
mov byte [esi], 0
mov edx, dword [ebp - 0x6a8]
cmp edx, 0x10
jb 0x1001f198
mov ecx, dword [ebp - 0x6bc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f18e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f516
push edx
push ecx
call fcn.100f99db
add esp, 8
lea eax, [ebp - 0x6bc]
push eax
call fcn.1001ead0
lea ecx, [ebp - 0x708]
call fcn.10002730
movups xmm0, xmmword [ebp - 0x6bc]
push 0x208
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x6c0], 0
movups xmmword [ebp - 0x708], xmm0
push 0
movq xmm0, qword [ebp - 0x6ac]
movq qword [ebp - 0x6f8], xmm0
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x6d0], xmm0
call fcn.101d2900
add esp, 0xc
lea eax, [ebp - 0x27c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 3
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x6d0]
push 0xa
push eax
call fcn.101e51bd
push 0x208
lea eax, [ebp - 0x68c]
push 0
push eax
call fcn.101d2900
push 0x208
lea eax, [ebp - 0x484]
push 0
push eax
call fcn.101d2900
push 0x64
lea eax, [ebp - 0x74]
mov dword [ebp - 0x7a8], 0
push 0
push eax
mov dword [ebp - 0x7ac], 0
mov dword [ebp - 0x7b0], 0
call fcn.101d2900
add esp, 0x34
lea eax, [ebp - 0x484]
push 0x104
push eax
lea eax, [ebp - 0x7b0]
push eax
lea eax, [ebp - 0x7ac]
push eax
lea eax, [ebp - 0x7a8]
push eax
push 0x104
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x6d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1001f2cb
push dword [ebp - 0x7a8]
lea eax, [ebp - 0x74]
push str._08X
push 0x64
push eax
call fcn.1001ea00
add esp, 0x10
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x6bc], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001f2f0
sub ecx, edx
lea eax, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x6bc]
call fcn.10006700
lea ecx, [ebp - 0x6f0]
call fcn.10002730
movups xmm0, xmmword [ebp - 0x6bc]
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x690], 0xf
movups xmmword [ebp - 0x6f0], xmm0
mov byte [ebp - 0x6a4], 0
movq xmm0, qword [ebp - 0x6ac]
movq qword [ebp - 0x6e0], xmm0
lea eax, [ebp - 0x720]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x6a4]
call fcn.10004bc0
push 0x103daf84
lea ecx, [ebp - 0x6a4]
call fcn.10006a80
lea eax, [ebp - 0x738]
push eax
lea ecx, [ebp - 0x6a4]
call fcn.10004bc0
push 0x103daf84
lea ecx, [ebp - 0x6a4]
call fcn.10006a80
lea eax, [ebp - 0x708]
push eax
lea ecx, [ebp - 0x6a4]
call fcn.10004bc0
push 0x103daf84
lea ecx, [ebp - 0x6a4]
call fcn.10006a80
lea eax, [ebp - 0x6f0]
push eax
lea ecx, [ebp - 0x6a4]
call fcn.10004bc0
push 0x103daf84
lea ecx, [ebp - 0x6a4]
call fcn.10006a80
push str.CCYS
lea ecx, [ebp - 0x6a4]
call fcn.10006a80
cmp dword [ebp - 0x690], 0x10
lea edx, [ebp - 0x6a4]
mov dword [ebp - 0x6c4], 0
cmovae edx, dword [ebp - 0x6a4]
mov ecx, edx
mov dword [ebp - 0x6c0], 0xf
mov byte [ebp - 0x6d4], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001f420
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x6d4]
call fcn.10006700
lea eax, [ebp - 0x6d4]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x7a4]
call fcn.1019cb69
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x6c0]
cmp edx, 0x10
jb 0x1001f48a
mov ecx, dword [ebp - 0x6d4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f480
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f51b
push edx
push ecx
call fcn.100f99db
add esp, 8
push edi
lea ecx, [ebp - 0x7a4]
call fcn.1019cd71
mov edx, dword [ebp - 0x690]
cmp edx, 0x10
jb 0x1001f4cc
mov ecx, dword [ebp - 0x6a4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f4c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f520
push edx
push ecx
call fcn.100f99db
add esp, 8
lea ecx, [ebp - 0x738]
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x690], 0xf
mov byte [ebp - 0x6a4], 0
call fcn.1001f530
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f99ca
mov esp, ebp
pop ebp
ret 4
call fcn.101d6583
call fcn.101d6583
call fcn.101d6583
call fcn.101d6583
int3