Function at 0x108fafa
Capabilities:
Get disk information

Disassembly:
mov eax, 0x10d8612
call fcn.0107a498
sub esp, 0x484
mov eax, dword [0x10e607c]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], eax
push 0x18
xor esi, esi
mov word [ebp - 0x74], si
pop ecx
xor eax, eax
lea edi, [ebp - 0x72]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x488]
mov dword [ebp - 0x48c], esi
stosw word es:[edi], ax
call sub.MFC42u.dll_CString::CString_2
mov eax, dword [ebx + 0x14]
cmp eax, esi
mov dword [ebp - 4], esi
je 0x108fb96
test byte [eax + 0x9f], 8
je 0x108fb96
mov eax, dword [ebx + 4]
push dword [eax + 0x34]
lea ecx, [ebp - 0x488]
call sub.MFC42u.dll_CString::operator
push 0x1003824
lea ecx, [ebp - 0x488]
call sub.MFC42u.dll_CString::operator_1
push 0x32
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x488]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, esi
je 0x108fb96
cmp dword [0x10f5628], esi
je 0x108fb96
lea eax, [ebp - 0x74]
push eax
call fcn.0108d24d
mov esi, dword [ebx + 4]
call fcn.0108d544
push 0x830
push 1
call dword [sym.imp.msvcrt.dll_calloc]
mov esi, eax
xor edi, edi
cmp esi, edi
pop ecx
pop ecx
je 0x108fbc9
push esi
push ebx
call fcn.010ac535
test ax, ax
je 0x108fbb5
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push ebx
call fcn.010a9b16
mov esi, dword [ebx + 0x34]
cmp esi, edi
je 0x108fd81
push ebx
call fcn.010aba9e
push dword [esi + 0x20]
jmp 0x108fbec
mov ecx, dword [eax + 0xc]
mov dword [esi + 0x78], ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [esi + 0x78]
cmp eax, edi
pop ecx
jne 0x108fbe5
jmp 0x108fc1c
mov eax, dword [esi + 0x5c]
mov ecx, dword [eax + 0x20c]
push eax
mov dword [ebp - 0x490], ecx
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x490]
pop ecx
mov dword [esi + 0x5c], eax
cmp dword [esi + 0x5c], edi
jne 0x108fbfc
push ebx
call fcn.0108d2f4
cmp word [esi + 0x96], di
je 0x108fc36
push ebx
call fcn.0108f6a7
cmp word [esi + 0x92], di
je 0x108fc52
cmp dword [0x10f4678], edi
jne 0x108fc4c
call fcn.0108db73
mov dword [ebp - 0x48c], edi
cmp word [esi + 0x90], di
je 0x108fc60
call fcn.0107ac09
mov eax, dword [ebx + 0x14]
test byte [eax + 0x9e], 0x80
je 0x108fcd8
cmp word [esi + 0x8e], di
je 0x108fcd8
push 0x104
lea eax, [ebp - 0x484]
push eax
mov word [ebp - 0x484], di
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x27c]
push 0x101119c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push edi
push edi
lea eax, [ebp - 0x27c]
push eax
call sub.CLUSAPI.dll_RestoreClusterDatabase
cmp eax, 0x13c0
jne 0x108fcce
push edi
push 1
lea eax, [ebp - 0x27c]
push eax
call sub.CLUSAPI.dll_RestoreClusterDatabase
cmp eax, edi
je 0x108fcd8
push ebx
call fcn.0109d93c
push dword [esi + 0x14f0]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push ebx
call fcn.010aaf8e
push dword [esi + 0x14f4]
call fcn.010aa419
mov ecx, dword [esi + 0x14f8]
cmp ecx, edi
je 0x108fd30
lea eax, [esi + 0x14fc]
cmp word [eax], di
je 0x108fd30
lea edx, [ebp - 0x490]
push edx
push ecx
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx + 0x54]
add ecx, 4
push ecx
push eax
call sub.query.dll_SetCatalogState
mov dword [esi + 0x14f8], edi
mov word [esi + 0x14fc], di
cmp word [esi + 0x88], di
je 0x108fd53
push 1
push edi
push 0x23f
push edi
push edi
push ebx
call fcn.0108db9e
mov dword [ebp - 0x48c], 0xfffffe40
cmp word [esi + 0x8a], di
je 0x108fd81
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x5c]
cmp dword [eax + 0x38], edi
jne 0x108fd81
push 1
push edi
push 0x240
push edi
push edi
push ebx
call fcn.0108db9e
mov dword [ebp - 0x48c], 0xfffffe40
push ebx
call fcn.010a9d4c
push dword [ebx + 0x3c]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
push dword [ebx + 0x34]
call esi
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x488]
call sub.MFC42u.dll_CString::CString
mov ecx, dword [ebp - 0xc]
mov ax, word [ebp - 0x48c]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01078836
leave
ret 4