Function at 0x1000d0b0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x384
push ebx
push esi
push edi
xor esi, esi
push ebp
xor ebx, ebx
lea eax, [esp + 0x188]
mov dword [esp + 0x20], esi
mov ecx, dword [esp + 0x398]
push eax
mov dword [esp + 0x30], esi
push 0x1002be00
mov dword [esp + 0x1c], esi
push ecx
mov dword [esp + 0x28], esi
call fcn.100155f0
add esp, 0xc
cmp word [esp + 0x188], 0x5c
jne 0x1000d1ff
cmp word [esp + 0x18a], 0x5c
jne 0x1000d1ff
mov dword [esp + 0x2c], 1
push 0x1002fd20
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x14], eax
cmp eax, esi
je 0x1000d130
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov ebp, 1
lea edi, [esp + 0x30]
xor eax, eax
mov ecx, 8
push str.mpr.dll
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov esi, eax
je 0x1000d1d4
push str.WNetAddConnection2A
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov edi, eax
je 0x1000d1d4
push str.WNetCancelConnection2A
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x1000d1d4
lea eax, [esp + 0x188]
push 0x1002be20
push eax
call fcn.10018bb0
lea eax, [esp + 0x18]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x48], eax
mov byte [esp + 0x1a], bl
mov dword [esp + 0x4c], 0x1002be20
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x18], 0x5a
mov dword [esp + 0x54], ebx
add esp, 8
lea eax, [esp + 0x30]
push 0
push 0
push 0
push eax
call edi
mov ebp, eax
test ebp, ebp
je 0x1000d1d8
dec byte [esp + 0x10]
cmp byte [esp + 0x10], 0x43
jg 0x1000d1b6
test ebp, ebp
jne 0x1000d1ec
mov dword [esp + 0x20], 1
movsx ax, byte [esp + 0x10]
sub ax, 0x40
jmp 0x1000d228
xor ebx, ebx
mov ebp, 1
mov edi, dword [esp + 0x3a0]
jmp 0x1000d2e6
cmp word [esp + 0x188], 0
je 0x1000d223
cmp word [esp + 0x18a], 0x3a
jne 0x1000d223
mov ax, word [esp + 0x188]
sub ax, 0x40
jmp 0x1000d228
call fcn.1001f8a1
cmp dword [esp + 0x2c], 0
je 0x1000d294
test ebx, ebx
je 0x1000d294
lea eax, [esp + 0x188]
push 0x1002be20
push eax
mov edi, 0x1002be20
call fcn.10018bb0
add esp, 8
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp byte [ecx + 0x1002be1e], 0x5c
je 0x1000d279
mov edi, 0x1002be20
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x1002fd78]
mov word [edi - 1], ax
lea eax, [esp + 0x30]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push ecx
push edx
push eax
push 0x1002be20
jmp 0x1000d2c2
add al, 0x40
lea ecx, [esp + 0x30]
mov byte [esp + 0x18], al
push ecx
lea edx, [esp + 0x30]
lea eax, [esp + 0x28]
lea ecx, [esp + 0x2c]
push edx
lea edx, [esp + 0x20]
push eax
mov byte [esp + 0x25], 0x3a
mov byte [esp + 0x26], 0x5c
mov byte [esp + 0x27], 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x3a0]
sub edx, edx
imul ebx, dword [esp + 0x28]
lea eax, [ecx + edi - 1]
div ecx
mov ebp, eax
cmp dword [esp + 0x20], 0
je 0x1000d2fa
lea eax, [esp + 0x10]
push 1
push 0
push eax
call dword [esp + 0x28]
test esi, esi
je 0x1000d309
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
jmp 0x1000d30f
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esp + 0x14], 0
je 0x1000d31d
mov eax, dword [esp + 0x14]
push eax
call esi
cmp ebp, ebx
jbe 0x1000d367
mov eax, dword [esp + 0x39c]
test eax, eax
je 0x1000d374
push eax
mov eax, dword [esp + 0x18c]
and eax, 0xffff
push eax
push edi
push 0x7e
push 1
call fcn.100186d0
lea ecx, [esp + 0x64]
add esp, 8
push eax
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x64]
add esp, 0x14
push ecx
push 0x7d
push 0x1d
call fcn.10003840
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x384
ret
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x384
ret