Function at 0x1000f7af
Capabilities:
Get disk size

Disassembly:
push 0x58
mov eax, 0x1003d39a
call fcn.1001d244
mov dword [ebp - 0x14], ecx
push str.Kvkcual
lea ecx, [ebp - 0x3c]
call fcn.10001fd7
cmp dword [ebp - 0x28], 0xf
lea eax, [ebp - 0x3c]
push 0x1829c0e2
cmova eax, dword [ebp - 0x3c]
push eax
push str._s:__d
call fcn.10007d3a
add esp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.10002037
mov ebx, dword [sym.imp.WINMM.dll_timeGetDevCaps]
lea eax, [ebp - 0x1c]
push 8
push eax
call ebx
mov esi, dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov edi, dword [sym.imp.WINMM.dll_timeEndPeriod]
test eax, eax
jne 0x1000f817
push 1
call esi
push 1
call edi
push 8
lea eax, [ebp - 0x1c]
push eax
call ebx
test eax, eax
jne 0x1000f82b
push 1
call esi
push 1
call edi
push str.CcqpdP
lea ecx, [ebp - 0x3c]
call fcn.10001fd7
and dword [ebp - 4], 0
lea edx, [ebp - 0x3c]
push 0x15bbf094
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3c]
call fcn.10002037
push 8
lea eax, [ebp - 0x1c]
push eax
call ebx
test eax, eax
jne 0x1000f87c
push 1
call esi
push 1
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov edi, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1000f8b8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
push edi
call ebx
push edi
call esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.p1.txt
call edi
cmp eax, 0xffffffff
je 0x1000f8e9
push eax
call esi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1004774c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.BKy273
lea ecx, [ebp - 0x3c]
call fcn.10001fd7
push 0xa3db227
lea edx, [ebp - 0x3c]
mov dword [ebp - 4], 1
mov ecx, 0x10051b50
call fcn.1000d771
mov ecx, eax
call fcn.1000c683
push eax
call fcn.1000d789
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x3c]
call fcn.10002037
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1000f973
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push eax
call ebx
push dword [ebp - 0x20]
call esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.s9geRIqnfh.txt
call edi
cmp eax, 0xffffffff
je 0x1000f994
push eax
call esi
mov esi, 0x100528e8
mov ecx, esi
mov dword [ebp - 0x20], esi
call fcn.1000500f
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.10010c8a
push dword [eax + 8]
call fcn.10010ccf
test al, al
je 0x1000fa18
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x54]
movlpd qword [ebp - 0x1c], xmm0
push eax
call fcn.10010bdf
lea ecx, [ebp - 0x1c]
mov eax, dword [eax]
add eax, 0x14
push eax
call fcn.100014c2
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.10010bdf
mov eax, dword [eax]
add eax, 0x14
push eax
call fcn.10010ced
lea eax, [ebp - 0x14]
push eax
call fcn.10010aa3
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1000fa18
call fcn.10001270
push esi
call fcn.1001ad7b
pop ecx
call fcn.1001d1f3
ret