Function at 0x495350
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2bc
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov dword [esp], eax
push ebx
push esi
push edi
test eax, eax
jne 0x49538a
lea edx, [esp + 0xb8]
call fcn.00495160
test eax, eax
jne 0x4955e3
lea ecx, [esp + 0xb8]
mov dword [esp + 0xc], ecx
call fcn.00495090
mov edx, eax
mov dword [esp + 0x18], edx
test edx, edx
jne 0x4953a3
lea eax, [edx + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0x14]
mov eax, ebx
and eax, 2
mov esi, eax
mov dword [esp + 0x10], eax
neg esi
sbb esi, esi
and esi, 0x40000000
add esi, 0x80000000
test bl, 0x10
je 0x4953cd
mov edi, 1
jmp 0x4953e1
test bl, 4
mov ecx, 0
setne cl
add ecx, 3
mov dword [esp + 0x14], ecx
mov edi, ecx
mov ecx, dword [0x544530]
mov eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
and al, 8
movzx eax, al
neg eax
mov dword [esp + 0x14], ebx
mov ebx, dword [ebp + 0x14]
sbb eax, eax
and eax, 0x4000082
sub eax, 0xffffff80
mov dword [esp + 0x1c], eax
test ecx, ecx
jne 0x495439
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x94
push eax
call dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp dword [esp + 0x30], 2
mov edx, dword [esp + 0x18]
sete cl
inc ecx
mov dword [0x544530], ecx
push 0
push eax
push edi
push 0
push 3
push esi
push edx
cmp ecx, 2
jne 0x495450
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x495456
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
jne 0x49549e
push dword [esp + 0x18]
call fcn.004edd96
add esp, 4
cmp dword [esp + 0x10], 0
je 0x495492
push dword [ebp + 0x18]
and ebx, 0xfffffffd
or ebx, 1
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00495350
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x4954b1
xor eax, eax
cmp dword [esp + 0x10], eax
setne al
inc eax
mov dword [ecx], eax
mov ebx, dword [ebp + 0x10]
lea eax, [esp + 0x1c0]
push eax
push 0x104
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
push dword [esp + 0x14]
mov dword [ebx], 0x526004
push dword [ebp + 8]
mov dword [ebx + 4], edx
mov dword [ebx + 0xc], 0
mov dword [esp + 0x20], 0x200
call fcn.004957a0
add esp, 0x10
test eax, eax
jne 0x4955ce
lea ecx, [esp + 0x1c0]
call fcn.00495090
mov esi, eax
test esi, esi
je 0x4955c7
mov ecx, dword [0x544530]
test ecx, ecx
jne 0x495540
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x94
push eax
call dword [esp + 0x18]
xor ecx, ecx
cmp dword [esp + 0x30], 2
sete cl
inc ecx
mov dword [0x544530], ecx
cmp ecx, 2
mov ecx, esi
jne 0x495585
movzx eax, word [esi]
test ax, ax
je 0x49556c
mov edx, eax
cmp dx, 0x5c
je 0x495567
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x495551
jmp 0x49556c
xor eax, eax
mov word [ecx], ax
lea eax, [esp + 0xc]
push eax
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x4955b8
mov al, byte [esi]
test al, al
je 0x4955a1
jmp 0x495590
cmp al, 0x5c
je 0x49559e
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x495590
jmp 0x4955a1
mov byte [ecx], 0
lea eax, [esp + 0xc]
push eax
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.004edd96
add esp, 4
test edi, edi
jne 0x4955ce
mov eax, 0x200
jmp 0x4955d2
mov eax, dword [esp + 0x10]
push dword [esp + 0x18]
mov dword [ebx + 0x10], eax
call fcn.004edd96
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret