Function at 0x40fca0
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push str.GetDiskFreeSpaceExA
mov esi, ecx
push str.kernel32.dll
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov cl, byte [esi + 0x251]
mov ebp, eax
mov eax, dword [0x437348]
cmp cl, bl
mov dword [esp + 0x10], eax
je 0x40ffc2
mov ecx, esi
call fcn.00410160
test eax, eax
je 0x40fd08
mov ecx, esi
call fcn.00410080
test eax, eax
jne 0x40ffbe
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x40]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x40]
push 0x5c
push ecx
call fcn.0042a800
add esp, 8
cmp ebp, ebx
mov byte [eax], bl
je 0x40fd6d
lea edx, [esp + 0x30]
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x48]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x2c]
mov esi, eax
mov eax, dword [esp + 0x28]
mov ecx, 0x14
call fcn.0042abb0
jmp 0x40fd9f
lea eax, [esp + 0x24]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x4c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov esi, eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x18]
shr eax, 0x14
cmp esi, ebx
je 0x40feb9
cmp eax, 1
jae 0x40feb9
push 0xffffffffffffffff
lea edx, [esp + 0x18]
push 0x13e
push edx
call fcn.004249d0
mov edi, eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov esi, dword [edi]
cmp eax, esi
je 0x40fe35
cmp dword [eax - 0xc], ebx
jge 0x40fde2
mov ecx, dword [0x43734c]
add eax, 0xfffffff4
cmp eax, ecx
jne 0x40fde7
cmp dword [esi - 0xc], ebx
jge 0x40fe1c
mov ebp, dword [esi - 8]
lea ecx, [esp + 0x10]
push ebp
call fcn.00402440
test eax, eax
je 0x40fe35
mov edi, dword [esp + 0x10]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], ebp
mov edx, dword [esp + 0x10]
mov byte [edx + ebp], bl
jmp 0x40fe35
lea ecx, [esp + 0x10]
call fcn.00402400
mov edi, dword [edi]
mov dword [esp + 0x10], edi
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x14]
mov edx, dword [0x43734c]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40fe66
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x40fe66
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.004292c0
add esp, 4
mov eax, dword [esp + 0x10]
push ebx
push 0x40010
push eax
call fcn.00424c50
mov eax, dword [esp + 0x1c]
mov edx, dword [0x43734c]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40ffb1
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x40ffb1
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004292c0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push 0x71
push eax
call fcn.004249d0
mov edi, eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov esi, dword [edi]
cmp eax, esi
je 0x40ff3b
cmp dword [eax - 0xc], ebx
jge 0x40fee8
mov ecx, dword [0x43734c]
add eax, 0xfffffff4
cmp eax, ecx
jne 0x40feed
cmp dword [esi - 0xc], ebx
jge 0x40ff22
mov ebp, dword [esi - 8]
lea ecx, [esp + 0x10]
push ebp
call fcn.00402440
test eax, eax
je 0x40ff3b
mov edi, dword [esp + 0x10]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov dword [eax - 8], ebp
mov ecx, dword [esp + 0x10]
mov byte [ecx + ebp], bl
jmp 0x40ff3b
lea ecx, [esp + 0x10]
call fcn.00402400
mov edi, dword [edi]
mov dword [esp + 0x10], edi
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x43734c]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x40ff6a
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40ff6a
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.004292c0
add esp, 4
mov ecx, dword [esp + 0x10]
push ebx
push 0x40021
push ecx
call fcn.00424c50
add esp, 0xc
cmp eax, 2
jne 0x40ffbe
mov eax, dword [esp + 0x10]
mov ecx, dword [0x43734c]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x40ffb1
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40ffb1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.004292c0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x134
ret
mov eax, dword [esp + 0x10]
mov edx, dword [0x43734c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40ffed
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40ffed
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004292c0
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x134
ret