Function at 0x1001025f
Capabilities:
Get disk information
Get disk size
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x938
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x1004d9b8
mov dword [ebp - 0x1c], edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x5c
mov ecx, 0x1ff
movsd dword es:[edi], dword [esi]
pop eax
xor esi, esi
mov word [ebp - 0xc], ax
mov word [ebp - 0x3c], ax
mov word [ebp - 0x3a], ax
mov word [ebp - 0x36], ax
xor eax, eax
lea edi, [ebp - 0x936]
mov word [ebp - 0x938], si
mov word [ebp - 0x18], 0x20
rep stosd dword es:[edi], eax
mov word [ebp - 0x16], 0x3a
mov word [ebp - 0x14], si
mov word [ebp - 0x10], 0x20
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xa], si
mov word [ebp - 0x38], 0x3f
mov word [ebp - 0x34], 0x20
mov word [ebp - 0x32], 0x3a
mov word [ebp - 0x30], si
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x32
mov dword [ebp - 0x48], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x130]
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], esi
push 0x41
rep stosd dword es:[edi], eax
pop edi
lea eax, [ebp - 0x138]
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], esi
mov ebx, 0x227
mov ecx, dword [ebp - 8]
push 1
pop eax
shl eax, cl
mov ecx, dword [ebp - 0x48]
test ecx, eax
je 0x10010449
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], di
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x10010449
push 0x800
lea eax, [ebp - 0x938]
push esi
push eax
mov word [ebp - 0x18], di
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x938]
push 0x400
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jbe 0x10010391
lea eax, [ebp - 0x938]
push str.DeviceHarddiskVolume
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
pop ecx
test eax, eax
pop ecx
je 0x10010449
push esi
push esi
push 3
push esi
push 3
lea eax, [ebp - 0x3c]
push esi
push eax
mov dword [ebp - 0x20], esi
mov word [ebp - 0x34], di
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x2c], eax
je 0x10010405
push ebx
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call sub.MFC42u.DLL_operatornew
pop ecx
mov edi, eax
lea eax, [ebp - 0x5c]
push esi
push eax
push ebx
push edi
lea eax, [ebp - 0x68]
push 0xc
push eax
push 0x2d1400
mov dword [edi + 4], ebx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100103f0
cmp dword [edi + 0x1c], 7
jne 0x100103f0
mov dword [ebp - 0x20], 1
push edi
call sub.MFC42u.DLL_operatordelete
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], esi
jne 0x10010449
xor eax, eax
lea edi, [ebp - 0x54]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x44], esi
stosd dword es:[edi], eax
lea edi, [ebp - 0x40]
mov dword [ebp - 0x50], esi
stosd dword es:[edi], eax
lea edi, [ebp - 0x4c]
stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x44]
inc dword [ebp - 4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x40]
mov dword [eax + 4], ecx
add eax, 8
mov dword [ebp - 0x28], eax
mov edi, dword [ebp - 0x24]
inc edi
inc dword [ebp - 8]
cmp di, 0x5a
mov dword [ebp - 0x24], edi
jbe 0x10010318
mov eax, dword [ebp - 4]
shl eax, 3
push eax
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x1c]
call fcn.1000f8c0
mov eax, dword [ebp - 0x1c]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret