Function at 0x41f490
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c011b
mov eax, dword fs:[0]
push eax
sub esp, 0x960
mov eax, dword [0x515e20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x968], ebx
mov dword [ebp - 0x954], eax
mov dword [ebp - 0x96c], 0
call fcn.0041f870
test al, al
jne 0x41f4f3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x95c]
push ecx
push 0x18
push eax
call fcn.00419be0
push eax
call fcn.00420fe0
test eax, eax
je 0x41f80c
call fcn.0041f870
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x964]
push eax
push 0
push 0
push 0x19
push dword [ebp - 0x95c]
call edi
test eax, eax
jne 0x41f7d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0041f840
test al, al
jne 0x41f555
dec dword [0x517cb0]
cmp esi, 0x7a
jne 0x41f7d0
push dword [ebp - 0x964]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x41f7a5
lea eax, [ebp - 0x964]
push eax
push dword [ebp - 0x964]
push esi
push 0x19
push dword [ebp - 0x95c]
call edi
test eax, eax
je 0x41f79e
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov al, byte [eax]
dec al
movzx eax, al
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov eax, dword [eax]
cmp eax, 0x2000
jae 0x41f678
mov eax, dword [ebp - 0x954]
mov esi, 0xc
mov dword [eax], 1
mov ecx, dword [0x517280]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
idiv esi
cmp edx, 0xa
jne 0x41f667
xor ebx, ebx
lea eax, [ebp - 0x280]
mov edi, edi
xor edx, edx
mov dword [ebp - 0x954], edx
mov dword [ebp - 0x950], eax
mov edi, edi
lea edi, [edx + 1]
mov eax, ecx
cdq
lea esi, [ebx + 1]
idiv esi
mov eax, ecx
sub eax, ebx
mov esi, edx
imul esi, eax
mov eax, ecx
cdq
idiv edi
add esi, eax
sub esi, dword [ebp - 0x954]
push esi
push 0x4d1b10
call fcn.0049f507
mov eax, dword [ebp - 0x950]
mov edx, edi
add eax, 4
add esp, 8
mov dword [ebp - 0x954], edi
mov dword [ebp - 0x950], eax
cmp edx, 0xd
jge 0x41f653
mov ecx, dword [0x517280]
jmp 0x41f600
inc ebx
cmp ebx, 0xc
jge 0x41f661
mov ecx, dword [0x517280]
jmp 0x41f5f0
mov ebx, dword [ebp - 0x968]
push str.Low_Integrity
mov ecx, ebx
call fcn.00401bb0
jmp 0x41f818
cmp eax, 0x3000
jae 0x41f784
mov ebx, dword [0x517280]
mov ecx, 3
lea eax, [ebx + 1]
imul eax, ebx
cdq
idiv ecx
cmp edx, 1
jne 0x41f73a
xor eax, eax
mov dword [ebp - 0x950], eax
lea ecx, [ebp - 0x94c]
mov edi, edi
xor edx, edx
mov dword [ebp - 0x958], edx
mov dword [ebp - 0x960], ecx
mov edi, edi
lea ecx, [eax + 1]
lea edi, [edx + 1]
mov eax, ebx
cdq
idiv ecx
mov eax, ebx
mov ecx, ebx
sub ecx, dword [ebp - 0x950]
mov ebx, dword [ebp - 0x960]
mov esi, edx
cdq
imul esi, ecx
idiv edi
add esi, eax
sub esi, dword [ebp - 0x958]
push esi
push 0x4d1b10
call fcn.0049f507
mov eax, dword [ebp - 0x950]
mov edx, edi
add ebx, 4
add esp, 8
mov dword [ebp - 0x958], edx
mov dword [ebp - 0x960], ebx
cmp edx, 0x1d
jge 0x41f71d
mov ebx, dword [0x517280]
jmp 0x41f6c0
inc eax
mov dword [ebp - 0x950], eax
cmp eax, 0xf
jge 0x41f73a
mov ebx, dword [0x517280]
mov ecx, dword [ebp - 0x960]
jmp 0x41f6b0
mov eax, dword [ebp - 0x954]
push str.Mediu
lea ecx, [ebp - 0x958]
mov dword [eax], 2
call fcn.00401c40
mov esi, dword [ebp - 0x968]
push str.m_Integrity
push eax
push esi
mov dword [ebp - 4], 0
call fcn.00402ae0
add esp, 0xc
lea ecx, [ebp - 0x958]
call fcn.00402090
mov eax, esi
jmp 0x41f81a
mov eax, dword [ebp - 0x954]
push str.High_Integrity
mov ecx, ebx
mov dword [eax], 3
call fcn.00401bb0
jmp 0x41f818
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [0x517280]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x18
idiv ecx
cmp edx, 0x10
jne 0x41f7d0
push 4
call fcn.0049dabd
mov ecx, dword [0x517280]
add esp, 4
mov dword [eax], ecx
push dword [ebp - 0x95c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x517280]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 4
jne 0x41f80c
push 0x88
push 0x87
push str._d__d_n
call fcn.0049f507
add esp, 0xc
push 0x4d398c
mov ecx, ebx
call fcn.00401c40
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e294
mov esp, ebp
pop ebp
ret