Function at 0x4154d9
Capabilities:
Get common file path
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x298
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x415502
xor eax, eax
jmp 0x415706
push 2
pop edi
push 0x1da
push 8
push dword [0x4420ec]
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4154fb
xor ecx, ecx
lea eax, [esp + 0x98]
push eax
push ecx
push ecx
push 0x6024
push ecx
mov byte [esi], 1
mov dword [esp + 0x30], ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x415557
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
mov dword [esp + 0x1c], eax
push 0x407800
lea eax, [esp + 0x26]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [esp + 0x50]
mov ecx, 0xb5
call fcn.0041c8a9
and dword [esp + 0x38], 0
xor bh, bh
lea eax, [esp + 0x50]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x30], 0x23
mov dword [esp + 0x34], eax
mov byte [esp + 0x17], bh
xor ebp, ebp
xor eax, eax
inc eax
mov ecx, ebp
shl eax, cl
test dword [esp + 0x3c], eax
je 0x4156e5
add dword [esp + 0x18], 0x12
movzx eax, bh
add edi, esi
inc byte [esi + 1]
add ax, 0x41
mov byte [edi], bh
mov word [esp + 0x20], ax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x1a], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
dec eax
je 0x4155fe
dec eax
je 0x4155f5
dec eax
je 0x4155ee
dec eax
je 0x4155e7
dec eax
jne 0x415603
mov byte [esp + 0x16], 5
jmp 0x4155fa
mov byte [esp + 0x16], 4
jmp 0x415603
mov byte [esp + 0x16], 3
jmp 0x415603
mov byte [esp + 0x16], 2
mov al, 1
jmp 0x415605
mov byte [esp + 0x16], 1
xor al, al
xor bl, bl
test al, al
je 0x4156ce
push 0x105
lea eax, [esp + 0x9c]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x415697
xor eax, eax
mov word [esp + 0x2a0], ax
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
and dword [esp + 0x38], 0
xor bh, bh
lea ecx, [esp + 0x2c]
call fcn.00409f7b
test eax, eax
je 0x415693
push eax
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41568f
test bh, bh
je 0x41568d
cmp bh, 1
je 0x415689
mov al, bh
sub al, 2
cmp al, 3
ja 0x41568f
mov bl, 0x10
jmp 0x41568f
mov bl, 0x30
jmp 0x41568f
mov bl, 0x20
inc bh
jmp 0x415654
mov bh, byte [esp + 0x17]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4156ce
mov eax, dword [esp + 0x48]
mov dword [edi + 2], eax
mov eax, dword [esp + 0x4c]
mov dword [edi + 6], eax
mov eax, dword [esp + 0x40]
mov dword [edi + 0xa], eax
mov eax, dword [esp + 0x44]
mov dword [edi + 0xe], eax
or bl, byte [esp + 0x16]
mov byte [edi + 1], bl
cmp dword [esp + 0x1c], ebp
jne 0x4156e1
or bl, 0x80
mov byte [edi + 1], bl
mov edi, dword [esp + 0x18]
inc bh
inc ebp
mov byte [esp + 0x17], bh
cmp bh, 0x1a
jb 0x415597
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
mov dword [eax], edi
call fcn.00409f5c
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret