Function at 0x105d1a9
Capabilities:
Get disk size

Disassembly:
mov eax, reloc.ADVAPI32.dll_AddAccessAllowedAce
call fcn.01077798
sub esp, 0x4c
mov eax, dword [0x10de03c]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
xor esi, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], esi
call fcn.01075e60
mov eax, dword [edi + 0xac]
cmp dword [eax - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], 0x41
jne 0x105d211
call fcn.010591a5
cmp ax, si
mov dword [ebp - 0x28], eax
je 0x105d225
movzx eax, ax
push eax
push 0x100c9f8
push 0x10e5758
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
jmp 0x105d21f
push eax
push 0x10e5758
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
cmp word [ebp - 0x28], si
jne 0x105d23f
push 1
push esi
push 0x30
push esi
push 0x1212
push 0xfa6
call fcn.01054be3
jmp 0x105d38f
cmp dword [edi + 0x5c], esi
jne 0x105d2d0
movzx eax, word [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push 0x11
push eax
call fcn.01076214
add esp, 0xc
push 1
push esi
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push esi
push dword [ebp - 0x2c]
push 0x17
call fcn.01054b83
mov ax, word [ebp - 0x28]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov word [ebp - 0x22], 0x3a
mov word [ebp - 0x20], 0x5c
mov word [ebp - 0x1e], si
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x105d2d0
mov eax, dword [ebp - 0x34]
or eax, dword [ebp - 0x30]
je 0x105d2b9
cmp dword [ebp - 0x30], esi
ja 0x105d2b9
cmp dword [ebp - 0x34], 0xe4e1c0
jbe 0x105d2d0
push 1
push esi
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push esi
push 0x4e85
push 0x17
call fcn.01054be3
jmp 0x105d23f
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.010770d8
mov edi, eax
cmp edi, esi
je 0x105d38f
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x20]
cmp ecx, esi
je 0x105d38f
push esi
call fcn.01075fb0
mov edi, dword [edi + 0x20]
call fcn.01075ed8
mov eax, dword [eax + 8]
push esi
push 0x10592e7
push edi
push 0x8de4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov edi, eax
push edi
call fcn.0105a10a
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push 1
push 0x10e5758
call fcn.0103abda
push edi
mov dword [ebp - 0x44], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x20]
xor edi, edi
inc edi
push edi
call fcn.01075fb0
cmp word [ebp - 0x44], si
je 0x105d389
call fcn.01039ebf
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x5c], esi
jne 0x105d37b
push esi
push esi
push reloc.KERNEL32.dll_LoadLibraryW
push 5
push eax
push 0x17
call fcn.01054be3
cmp eax, 2
je 0x105d38c
mov edi, dword [ebp - 0x38]
jmp 0x105d23f
push eax
push edi
push edi
push esi
call fcn.01050ebf
add esp, 0x10
jmp 0x105d38c
mov dword [ebp - 0x40], edi
mov esi, dword [ebp - 0x40]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.01075e24
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
call fcn.01075aef
leave
ret 4