Function at 0x1000c8cc
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0x30c
mov eax, 0x100450a2
call fcn.1002a6aa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28c], eax
movsx ax, byte [ebp + 8]
movzx eax, ax
push eax
push 0x10048ebc
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x2ac], eax
call fcn.1001418c
pop ecx
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
xor eax, eax
cmp dword [ebp - 0x234], 8
lea edi, [ebp - 0x298]
mov dword [ebp - 0x29c], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x2f8]
mov dword [ebp - 0x2fc], ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x248]
jae 0x1000c94d
lea eax, [ebp - 0x248]
lea ecx, [ebp - 0x2fc]
push ecx
lea ecx, [ebp - 0x29c]
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x29c]
or eax, dword [ebp - 0x298]
je 0x1000ca47
cmp dword [ebp - 0x298], ebx
ja 0x1000ca47
jb 0x1000c993
cmp dword [ebp - 0x29c], 0x40000000
jae 0x1000ca47
push str.ignoreSmallUsbStore
lea ecx, [ebp - 0x2d4]
call fcn.10001ad2
push str.usbRuleCfg
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 1
call fcn.10001ad2
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x2ec]
push eax
mov byte [ebp - 4], 2
call fcn.10003a36
xor edi, edi
inc edi
lea ecx, [ebp - 0x2d4]
push edi
push ecx
mov byte [ebp - 4], 3
call fcn.1000310c
add esp, 0x10
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
lea esi, [ebp - 0x2ec]
inc bl
mov byte [ebp - 4], 2
call fcn.1001a924
xor esi, esi
push esi
push edi
lea ecx, [ebp - 0x318]
call fcn.10001d94
push esi
push edi
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 0
call fcn.10001d94
push dword [ebp - 0x2ac]
test bl, bl
je 0x1000ca39
push str.usb_drive__c_too_small__ignore_it
call fcn.10011b00
pop ecx
pop ecx
push esi
jmp 0x1000d1b1
push str.small_usb_storage_managed_on_config:__c
call fcn.10011995
pop ecx
pop ecx
xor ebx, ebx
mov dword [ebp - 0x2a0], ebx
xor esi, esi
push dword [ebp + 8]
lea edi, [ebp - 0x2a0]
call fcn.10023c3c
pop ecx
test al, al
jne 0x1000ca7f
push str.GetUsbStorageUnique_failed__retry_later
call fcn.10011c6b
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x1000ca4f
cmp dword [ebp - 0x2a0], ebx
jne 0x1000ca9a
push str.USB_unique_is_0x00000000_
call fcn.10011b00
pop ecx
push ebx
push 1
jmp 0x1000d1b2
push dword [ebp - 0x2a0]
lea esi, [ebp - 0x268]
push str._08x
call fcn.100141ea
xor eax, eax
mov esi, 0xfe
mov byte [ebp - 4], 4
push esi
mov word [ebp - 0x114], ax
lea eax, [ebp - 0x112]
push ebx
push eax
call fcn.1002bdc0
add esp, 0x14
xor eax, eax
push esi
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.1002bdc0
mov ecx, dword [ebp - 0x248]
add esp, 0xc
cmp dword [ebp - 0x234], 8
jae 0x1000cb02
lea ecx, [ebp - 0x248]
mov eax, 0x80
push eax
lea edx, [ebp - 0x214]
push edx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x114]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push dword [ebp + 8]
lea ecx, [ebp - 0x284]
call fcn.1000c776
pop ecx
mov eax, 0x10058988
push eax
mov dword [ebp - 0x2a8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 6
mov eax, dword [0x100590bc]
mov dword [ebp - 0x2b4], eax
mov eax, dword [0x100590a4]
mov dword [ebp - 0x2b8], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x2a4]
push eax
mov ebx, 0x100590a4
call fcn.1000521c
lea edi, [ebp - 0x2b8]
mov esi, eax
call fcn.10015150
mov bl, al
neg bl
sbb bl, bl
push 0x10058988
inc bl
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x2a0]
xor edi, edi
push eax
lea ecx, [ebp - 0x2b4]
lea edx, [ebp - 0x268]
mov dword [ebp - 0x2b4], edi
mov dword [ebp - 0x2a0], edi
call fcn.1000b452
lea esi, [ebp - 0x230]
mov dword [ebp - 0x2a8], eax
mov dword [esp], 0x10049c24
call fcn.10001b24
lea eax, [ebp - 0x28d]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x285]
mov byte [ebp - 0x285], 0
mov byte [ebp - 0x28d], 0
call fcn.1002417b
mov byte [ebp - 0x285], al
mov eax, dword [ebp - 0x2a8]
cmp eax, 2
jne 0x1000cc58
push 4
pop eax
mov ecx, 0x10049c30
call fcn.10002141
push dword [ebp + 8]
test bl, bl
je 0x1000cc30
call fcn.1000c27a
pop ecx
mov ecx, dword [ebp - 0x2b0]
jmp 0x1000cca8
call fcn.1000b512
pop ecx
test eax, eax
je 0x1000cc48
mov eax, dword [ebp - 0x2b0]
mov byte [eax], 1
jmp 0x1000ccd8
push 0x10049c3c
call fcn.10011c6b
pop ecx
jmp 0x1000ccd8
cmp eax, 1
jne 0x1000cc81
push 5
pop eax
mov ecx, 0x10049c4c
lea esi, [ebp - 0x230]
call fcn.10002141
push dword [ebp + 8]
call fcn.1000c3da
pop ecx
mov ecx, dword [ebp - 0x2f0]
jmp 0x1000cca8
cmp eax, 3
jne 0x1000ccac
push 5
pop eax
mov ecx, 0x10049c58
lea esi, [ebp - 0x230]
call fcn.10002141
push dword [ebp + 8]
call fcn.1000c558
pop ecx
mov ecx, dword [ebp - 0x28c]
mov byte [ecx], al
jmp 0x1000ccd8
cmp eax, edi
jne 0x1000ccd8
cmp dword [ebp - 0x2b4], edi
je 0x1000ccd8
push 0xa
lea esi, [ebp - 0x230]
pop eax
mov ecx, 0x10049c64
cmp dword [ebp - 0x2a0], edi
jne 0x1000ccd3
mov ecx, 0x10049c7c
call fcn.10002141
push dword [ebp - 0x2a8]
lea eax, [ebp - 0x114]
push dword [ebp - 0x298]
push dword [ebp - 0x29c]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.1000afe5
add esp, 0x14
test bl, bl
je 0x1000cd0d
push dword [ebp + 8]
call fcn.1000bee1
pop ecx
push edi
push edi
lea eax, [ebp - 0x2ec]
call fcn.1001b5c1
movsx eax, byte [ebp + 8]
push eax
push str._c:_
lea esi, [ebp - 0x2d4]
mov byte [ebp - 4], 0xa
call fcn.100141ea
sub esp, 0x10
mov byte [ebp - 4], 0xb
mov edx, eax
mov esi, esp
mov dword [ebp - 0x28c], esp
call fcn.1001a754
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.us_drive
mov byte [ebp - 4], 0xc
call fcn.1001b85f
mov edi, eax
mov byte [ebp - 4], 0xb
call fcn.1001a9a7
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 0xa
call fcn.10001d94
lea esi, [ebp - 0x2d4]
cmp word [ebp - 0x114], bx
je 0x1000cddc
lea eax, [ebp - 0x114]
push eax
call fcn.10001b24
mov eax, esi
push eax
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0xd
call fcn.1000303a
sub esp, 0x10
mov byte [ebp - 4], 0xe
mov edx, eax
mov esi, esp
mov dword [ebp - 0x28c], esp
call fcn.1001a754
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.us_label
mov byte [ebp - 4], 0xf
call fcn.1001b85f
mov byte [ebp - 4], 0xe
jmp 0x1000ce2c
push 0x10049cb4
call fcn.10001b24
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x10
call fcn.1000303a
sub esp, 0x10
mov byte [ebp - 4], 0x11
mov edx, eax
mov esi, esp
mov dword [ebp - 0x28c], esp
call fcn.1001a754
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.us_label
mov byte [ebp - 4], 0x12
call fcn.1001b85f
mov byte [ebp - 4], 0x11
mov edi, eax
call fcn.1001a9a7
push ebx
push 1
lea ecx, [ebp - 0x318]
call fcn.10001d94
push ebx
push 1
lea esi, [ebp - 0x2d4]
mov byte [ebp - 4], 0xa
call fcn.10001e8c
cmp dword [ebp - 0x298], ebx
ja 0x1000ce63
cmp dword [ebp - 0x29c], ebx
jbe 0x1000cec3
push dword [ebp - 0x298]
lea ebx, [ebp - 0x2d4]
push dword [ebp - 0x29c]
call fcn.10013429
sub esp, 0x10
mov byte [ebp - 4], 0x13
mov edx, eax
mov esi, esp
mov dword [ebp - 0x28c], esp
call fcn.1001a754
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.us_capacity
mov byte [ebp - 4], 0x14
call fcn.1001b85f
mov edi, eax
mov byte [ebp - 4], 0x13
call fcn.1001a9a7
push 0
push 1
mov ecx, ebx
mov byte [ebp - 4], 0xa
call fcn.10001d94
xor ebx, ebx
jmp 0x1000cf3c
push 0x10049cc8
lea esi, [ebp - 0x2d4]
call fcn.10001b24
mov eax, esi
push eax
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x15
call fcn.1000303a
sub esp, 0x10
mov byte [ebp - 4], 0x16
mov edx, eax
mov esi, esp
mov dword [ebp - 0x28c], esp
call fcn.1001a754
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.us_capacity
mov byte [ebp - 4], 0x17
call fcn.1001b85f
mov edi, eax
mov byte [ebp - 4], 0x16
call fcn.1001a9a7
push ebx
push 1
lea ecx, [ebp - 0x318]
call fcn.10001d94
push ebx
push 1
lea esi, [ebp - 0x2d4]
mov byte [ebp - 4], 0xa
call fcn.10001e8c
sub esp, 0x18
lea edx, [ebp - 0x268]
mov esi, esp
mov dword [ebp - 0x28c], esp
call fcn.1001a754
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.us_unique
mov byte [ebp - 4], 0x18
call fcn.1001b85f
mov edi, eax
mov byte [ebp - 4], 0xa
call fcn.1001a9a7
push ebx
push str._08x
lea esi, [ebp - 0x2d4]
call fcn.100141ea
sub esp, 0x10
mov byte [ebp - 4], 0x19
mov edx, eax
mov esi, esp
mov dword [ebp - 0x28c], esp
call fcn.1001a754
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.us_searial
mov byte [ebp - 4], 0x1a
call fcn.1001b85f
mov edi, eax
mov byte [ebp - 4], 0x19
call fcn.1001a9a7
push ebx
push 1
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 0xa
call fcn.10001d94
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.1000303a
sub esp, 0x10
mov byte [ebp - 4], 0x1b
mov edx, eax
mov esi, esp
mov dword [ebp - 0x28c], esp
call fcn.1001a754
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.us_action
mov byte [ebp - 4], 0x1c
call fcn.1001b85f
mov edi, eax
mov byte [ebp - 4], 0x1b
call fcn.1001a9a7
push ebx
push 1
lea ecx, [ebp - 0x2d4]
call fcn.10001d94
xor eax, eax
cmp byte [ebp - 0x285], al
setne al
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x28c], esp
push eax
call fcn.1001a675
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.us_encrypted
mov byte [ebp - 4], 0x1d
call fcn.1001b85f
mov edi, eax
mov byte [ebp - 4], 0xa
call fcn.1001a9a7
push 0x10048bd4
call fcn.10001503
xor ecx, ecx
test al, al
setne cl
sub esp, 0x14
mov esi, esp
mov dword [ebp - 0x28c], esp
push ecx
call fcn.1001a675
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.i_audit
mov byte [ebp - 4], 0x1e
call fcn.1001b85f
mov edi, eax
mov byte [ebp - 4], 0xa
call fcn.1001a9a7
sub esp, 0x18
lea edx, [ebp - 0x284]
mov esi, esp
mov dword [ebp - 0x28c], esp
call fcn.1001a754
lea eax, [ebp - 0x2ec]
push eax
mov edx, str.__serial
mov byte [ebp - 4], 0x1f
call fcn.1001b85f
mov edi, eax
mov byte [ebp - 4], 0xa
call fcn.1001a9a7
lea eax, [ebp - 0x2ec]
push eax
mov ecx, str.t_usbstorage_log
call fcn.10024fb0
cmp dword [ebp - 0x218], 8
mov eax, dword [ebp - 0x22c]
jae 0x1000d0fc
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x2ac]
push str.usb_drive__c:_process_result:__s
call fcn.10011995
add esp, 0xc
cmp dword [ebp - 0x2a0], ebx
je 0x1000d177
push 0x1c
call fcn.10029afd
pop ecx
mov dword [ebp - 0x28c], eax
mov byte [ebp - 4], 0x20
cmp eax, ebx
je 0x1000d140
lea ecx, [ebp - 0x268]
push ecx
mov ecx, eax
call fcn.10001af4
mov esi, eax
jmp 0x1000d142
xor esi, esi
mov byte [ebp - 4], 0xa
mov eax, dword [0x100598a0]
cmp eax, ebx
jne 0x1000d169
push str.A0746EA1
call fcn.100116cc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100598a0], eax
cmp eax, ebx
je 0x1000d177
push ebx
push esi
push 0x2710
push 0x1000c6db
call eax
lea esi, [ebp - 0x2ec]
mov byte [ebp - 4], 7
call fcn.1001a924
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x230]
call fcn.10001e8c
push ebx
push edi
lea ecx, [ebp - 0x284]
call fcn.10001d94
push ebx
push edi
lea ecx, [ebp - 0x268]
call fcn.10001d94
push ebx
push edi
lea esi, [ebp - 0x24c]
call fcn.10001e8c
call fcn.1002a72d
ret