Function at 0x100f99e
Capabilities:
Get disk information

Disassembly:
push 0x37c
push 0x1002b60
call fcn.01017f40
mov eax, dword [0x101ac60]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x180], eax
mov edi, ecx
mov dword [ebp - 0x190], edi
xor ebx, ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x17c], ebx
mov esi, dword [sym.imp.msvcrt.dll_wcscpy]
cmp eax, ebx
je 0x100fa00
push 0x1002278
push eax
call esi
pop ecx
pop ecx
cmp edi, ebx
je 0x100fa0e
push 0x1002278
push edi
call esi
pop ecx
pop ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x178]
push eax
push 0x10c
call fcn.01005205
test eax, eax
jne 0x100fa43
push 0x6b
push 0x1002a7c
push 0x1002b10
call fcn.01007320
jmp 0x100fbfa
mov dword [ebp - 0x1a4], ebx
xor eax, eax
lea edi, [ebp - 0x1a0]
stosd dword es:[edi], eax
push 4
push 0x3a
push dword [ebp - 0x17c]
lea eax, [ebp - 0x1a4]
push eax
push dword [ebp - 0x188]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov dword [ebp - 0x1a8], eax
cmp eax, ebx
jl 0x100fbfa
mov eax, dword [ebp - 0x17c]
test byte [eax + 4], 0x1a
jne 0x100fbfa
cmp dword [ebp + 0xc], 2
jne 0x100fb23
mov dword [ebp - 0x184], ebx
push ebx
lea eax, [ebp - 0x198]
push eax
push 0x1e0
lea eax, [ebp - 0x38c]
push eax
push ebx
push ebx
push 0x2d0c00
push dword [ebp - 0x188]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100fb1d
mov eax, dword [ebp - 0x198]
xor edx, edx
push 0x18
pop ecx
div ecx
mov dword [ebp - 0x184], eax
xor eax, eax
mov dword [ebp - 0x194], eax
cmp eax, dword [ebp - 0x184]
jae 0x100fb23
lea ecx, [eax + eax*2]
mov ecx, dword [ebp + ecx*8 - 0x384]
cmp ecx, 4
je 0x100fb1a
cmp ecx, 0xb
jle 0x100fbfa
cmp ecx, 0xd
jle 0x100fb1a
cmp ecx, 0x13
jle 0x100fbfa
cmp ecx, 0x15
jg 0x100fbfa
inc eax
jmp 0x100fadd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x19c]
push edi
lea eax, [ebp - 0xac]
push eax
call esi
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0xc
cmp word [edi + eax*2 - 2], 0x5c
je 0x100fb5f
push 0x100130c
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
push 0x14
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push ebx
push 0x64
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [ebp - 0x1ac], eax
cmp eax, ebx
je 0x100fbfa
cmp dword [ebp - 0x180], ebx
je 0x100fba1
lea eax, [ebp - 0x174]
push eax
push dword [ebp - 0x180]
call esi
pop ecx
pop ecx
cmp dword [ebp - 0x190], ebx
je 0x100fbb7
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x190]
call esi
pop ecx
pop ecx
push 0x1002120
lea eax, [ebp - 0x44]
push eax
mov esi, dword [sym.imp.msvcrt.dll_wcscmp]
call esi
pop ecx
pop ecx
test eax, eax
je 0x100fbf0
push 0x1002118
lea eax, [ebp - 0x44]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x100fbf0
push 0x100210c
lea eax, [ebp - 0x44]
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x100fbfa
mov dword [ebp - 0x18c], 1
or dword [ebp - 4], 0xffffffff
call fcn.0100fc1b
mov eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x1c]
call fcn.01017c5b
call fcn.01017f7b
ret 0x10