Function at 0x1011047
Capabilities:
Get disk information
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x1021480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x404], eax
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x101108c
test dword [eax + 0x1c], 0x20000000
je 0x101108c
push 0x1002b3c
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009101
push ebx
push esi
push edi
push 1
push 0x19d
push 0x1002fc4
lea ecx, [ebp - 0x430]
call fcn.0100c063
or dword [ebp - 0x400], 0xffffffff
mov esi, 0x1003470
lea edi, [ebp - 0x3fc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
xor ebx, ebx
push 0x3e6
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x3ec], ax
lea eax, [ebp - 0x3ea]
push ebx
push eax
mov dword [ebp - 0x43c], 0x1002828
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
mov ecx, dword [ebp - 0x404]
xor eax, eax
add esp, 0xc
lea edi, [ebp - 0x408]
mov dword [ebp - 0x40c], ebx
stosd dword es:[edi], eax
cmp ecx, ebx
je 0x1011110
call fcn.0100e6bb
lea eax, [ebp - 0x3fc]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov dword [ebp - 0x430], eax
cmp eax, ebx
mov eax, 0x1a8
jl 0x10112ed
mov word [ebp - 0x42c], ax
lea eax, [ebp - 0x3ec]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x1011162
call fcn.0100d43e
mov dword [ebp - 0x430], eax
mov eax, 0x1af
jmp 0x10112ed
mov eax, 0x1af
mov dword [ebp - 0x430], ebx
mov word [ebp - 0x42c], ax
lea esi, [ebp - 0x3ec]
cmp word [ebp - 0x3ec], bx
je 0x10112de
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x10112be
lea eax, [ebp - 0x40c]
push eax
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x10112be
cmp dword [ebp - 0x408], ebx
ja 0x10111c7
cmp dword [ebp - 0x40c], 0x19000000
jb 0x10112be
movzx eax, byte [ebp - 0x3ed]
push eax
movzx eax, byte [ebp - 0x3ee]
push eax
movzx eax, byte [ebp - 0x3ef]
push eax
movzx eax, byte [ebp - 0x3f0]
push eax
movzx eax, byte [ebp - 0x3f1]
push eax
movzx eax, byte [ebp - 0x3f2]
push eax
movzx eax, byte [ebp - 0x3f3]
push eax
movzx eax, byte [ebp - 0x3f4]
push eax
movzx eax, word [ebp - 0x3f6]
push eax
movzx eax, word [ebp - 0x3f8]
push eax
push dword [ebp - 0x3fc]
lea eax, [ebp - 0x43c]
push esi
push 0x1002f50
push eax
call fcn.0100ea69
add esp, 0x38
mov dword [ebp - 0x430], eax
cmp eax, ebx
mov eax, 0x1ce
jl 0x10112ed
cmp dword [ebp - 0x400], 0xffffffff
mov word [ebp - 0x42c], ax
je 0x1011270
cmp dword [ebp - 0x400], ebx
je 0x1011270
push dword [ebp - 0x400]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x400], 0xffffffff
push ebx
push 0x4000100
push 2
push ebx
push 3
push 0x12019f
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [ebp - 0x400], 0xffffffff
mov edi, eax
je 0x10112ab
cmp dword [ebp - 0x400], ebx
je 0x10112ab
push dword [ebp - 0x400]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x400], edi
cmp edi, 0xffffffff
je 0x10112be
cmp edi, ebx
jne 0x1011340
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10112c3
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x1011187
mov dword [ebp - 0x430], 0x81000320
mov eax, 0x1e3
mov word [ebp - 0x42a], ax
cmp dword [ebp - 0x400], 0xffffffff
mov esi, dword [ebp - 0x430]
je 0x1011317
cmp dword [ebp - 0x400], ebx
je 0x1011317
push dword [ebp - 0x400]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x43c]
call fcn.0100e697
lea ecx, [ebp - 0x430]
call fcn.0100c22a
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100b7c7
leave
ret 4
mov ecx, dword [ebp - 0x404]
mov edx, esi
call fcn.0100f210
cmp eax, ebx
mov dword [ebp - 0x430], eax
jge 0x101135e
mov eax, 0x1dc
jmp 0x10112ed
mov eax, 0x1dd
mov dword [ebp - 0x430], ebx
mov word [ebp - 0x42c], ax
jmp 0x10112f4