Function at 0x40950b
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
push ebx
mov edx, 0x44
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x409512
call fcn.00428890
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
lea eax, [esp + 0xa0]
mov edx, 0x42c02e
push edx
push 3
push eax
call fcn.004287c0
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push 0x28
call fcn.00426490
lea eax, [esp + 0xac]
push 0x28
push eax
call fcn.00428780
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push 0
push 0
push dword [esp + 0x130]
call fcn.00418c0d
call fcn.00415372
add dword [esp], edx
call fcn.004264e0
call fcn.00415390
mov ebx, eax
and ebx, ebx
jle 0x409a56
mov dword [esp + 0x94], 0
jmp 0x4095d5
push dword [esp + 0x120]
call fcn.00418f6f
mov ebx, eax
dec ebx
cmp ebx, dword [esp + 0x94]
jl 0x409a56
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push 0
push 0
push dword [esp + 0x12c]
call fcn.00418c0d
call fcn.00428950
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push 0
push dword [esp + 0xa4]
push dword [esp + 0x134]
call fcn.00418c0d
call fcn.004153a0
mov edx, eax
call fcn.004153a0
mov ecx, eax
call fcn.004153b0
je 0x409a49
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push 0
push 0
push dword [esp + 0x12c]
call fcn.00418c0d
mov edx, 0x42cc7c
push edx
call fcn.004287f0
lea eax, [esp + 0xa4]
push 3
push eax
call fcn.00428780
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push 0x104
call fcn.00426490
lea eax, [esp + 0x9c]
push eax
call fcn.004286f0
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push 0x104
call fcn.00426490
lea eax, [esp + 0xa0]
push eax
call fcn.004286f0
push edx
call fcn.004286b0
pop edx
push eax
push 0x104
mov eax, dword [esp + 0xa4]
push eax
push 0
push 0
push 0
push 0x104
mov eax, dword [esp + 0xb4]
push eax
lea edx, [esp + 0xc0]
push edx
call fcn.004286b0
pop edx
push eax
push 3
push edx
call fcn.00428980
call fcn.00415372
add dword [esp], edx
call sub.KERNEL32.dll_GetVolumeInformationW
call fcn.00415390
mov dword [esp + 0x90], eax
push edx
call fcn.004286b0
pop edx
push eax
lea eax, [esp + 0x10c]
push eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x104]
push eax
lea edx, [esp + 0xb0]
push edx
call fcn.004286b0
pop edx
push eax
push 3
push edx
call fcn.00428980
call fcn.00415372
add dword [esp], edx
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
call fcn.00415390
mov dword [esp + 0x90], eax
push edx
call fcn.004286b0
pop edx
push eax
lea eax, [esp + 4]
push eax
lea edx, [esp + 0xa8]
push edx
call fcn.004286b0
pop edx
push eax
push 3
push edx
call fcn.00428980
call fcn.00415372
add dword [esp], edx
call fcn.0040acfd
call fcn.00415390
and eax, eax
je 0x4098c4
lea ebp, [esp]
mov ebx, dword [ebp]
cmp ebx, 1
jne 0x4098c4
push 6
mov eax, 0x42d442
push eax
push dword [esp + 0x9c]
push dword [esp + 0x12c]
call fcn.0041916f
push 0x28
lea eax, [esp + 0xac]
push eax
lea ebp, [esp + 8]
lea eax, [ebp + 0x20]
push eax
call sub.ole32.dll_StringFromGUID2
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
lea edx, [esp + 0xb0]
push edx
call fcn.004286b0
pop edx
push eax
push 0x28
push edx
call fcn.00428980
call fcn.00415372
add dword [esp], edx
call fcn.00426510
call fcn.00428950
mov edx, str.C12A7328_F81F_11D2_BA4B_00A0C93EC93B
call fcn.004153a0
mov ecx, eax
call fcn.004153b0
je 0x4098c4
push 7
mov eax, 0x42eb52
push eax
push dword [esp + 0x9c]
push dword [esp + 0x12c]
call fcn.0041916f
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
lea ebp, [esp + 8]
lea eax, [ebp + 0x48]
push eax
call fcn.004277c0
lea eax, [esp + 0x9c]
push eax
call fcn.004286f0
push edx
call fcn.004286b0
pop edx
push eax
push 3
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push dword [esp + 0xa8]
call fcn.00426280
call fcn.00428950
push dword [esp + 0xa0]
push dword [esp + 0x130]
call fcn.00415372
add dword [esp + 8], edx
call fcn.0041916f
call fcn.00415390
push edx
call fcn.004286b0
pop edx
push eax
push 5
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push dword [esp + 0xac]
call fcn.00426280
call fcn.00428950
push dword [esp + 0xa0]
push dword [esp + 0x130]
call fcn.00415372
add dword [esp + 8], edx
call fcn.0041916f
call fcn.00415390
push edx
call fcn.004286b0
pop edx
push eax
push 9
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push dword [esp + 0x114]
push dword [esp + 0x114]
lea eax, [esp + 0x120]
mov edx, dword [eax]
sub dword [esp], edx
mov edx, dword [eax + 4]
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
call fcn.00426080
call fcn.00428950
push dword [esp + 0xa0]
push dword [esp + 0x130]
call fcn.00415372
add dword [esp + 8], edx
call fcn.0041916f
call fcn.00415390
push edx
call fcn.004286b0
pop edx
push eax
push 0xa
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push dword [esp + 0x11c]
push dword [esp + 0x11c]
call fcn.00426080
call fcn.00428950
push dword [esp + 0xa0]
push dword [esp + 0x130]
call fcn.00415372
add dword [esp + 8], edx
call fcn.0041916f
call fcn.00415390
xor eax, eax
push eax
push 0
push dword [esp + 0x124]
push dword [esp + 0xa0]
push dword [esp + 0x130]
call fcn.00403ab2
jmp 0x409a56
inc dword [esp + 0x94]
jno 0x4095d5
xor eax, eax
push dword [esp + 0x9c]
call fcn.00428920
push dword [esp + 0x98]
call fcn.00428920
add esp, 0x110
pop ebx
pop ebp
ret 8