Function at 0x100117ad
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x26f]
mov byte [ebp - 0x270], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x270]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x1001199b
push esi
push 0x13
pop ecx
xor eax, eax
lea edi, [ebp - 0x8b]
mov byte [ebp - 0x8c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x3b]
mov byte [ebp - 0x3c], bl
push 0x37
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
cmp byte [ebp - 0x270], bl
lea edi, [ebp - 0x168]
lea esi, [ebp - 0x270]
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 4], esi
je 0x10011997
jmp 0x10011848
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x1001197f
push 0x50
lea eax, [ebp - 0x8c]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x3c]
push 0x10
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x8c]
push 0x50
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
xor eax, eax
lea edi, [ebp - 0x28]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
push 0xe0
lea eax, [ebp - 0x16c]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, edi
add esp, 0xc
or edx, esi
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x168], esi
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], ecx
je 0x10011925
mov edx, edi
push ebx
sub edx, eax
mov eax, esi
sbb eax, ecx
push 0x3e8
push eax
push edx
call fcn.10013d80
push esi
push edi
push edx
push eax
call fcn.10013f30
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x158]
push 4
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
call fcn.1000759c
lea eax, [ebp - 0x150]
push 0x50
push eax
lea eax, [ebp - 0x8c]
push 0xffffffffffffffff
push eax
call fcn.1000759c
lea eax, [ebp - 0xb0]
push 0x10
push eax
lea eax, [ebp - 0x3c]
push 0xffffffffffffffff
push eax
call fcn.1000759c
mov ecx, dword [ebp + 8]
add esp, 0x30
lea eax, [ebp - 0x16c]
push eax
call fcn.10011ddc
mov esi, dword [ebp - 4]
mov dword [ebp - 8], 1
push esi
call sub.MSVCRT.dll_strlen
cmp byte [esi + eax + 1], bl
lea eax, [esi + eax + 1]
pop ecx
mov dword [ebp - 4], eax
jne 0x10011845
mov eax, dword [ebp - 8]
pop esi
pop edi
pop ebx
leave
ret