Function at 0x435f18
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4361eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x24]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xc]
call fcn.00405d4c
mov eax, dword [ebp - 0xc]
call fcn.00403670
test eax, eax
jne 0x435f68
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402738
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx]
call fcn.0040360c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, 0x436204
call fcn.004036bc
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x436210
call fcn.00434d90
pop ecx
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xc]
call fcn.00405d4c
mov byte [0x441794], 1
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov al, byte [eax + edx - 1]
sub al, 0x46
je 0x436084
sub al, 8
je 0x436129
sub al, 5
je 0x436084
dec al
jne 0x4361b4
mov eax, dword [ebp - 8]
call fcn.00403834
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x435ff1.0
jmp dword [eax*4 + 0x435ff8]
mov eax, dword [ebp + 8]
push eax
mov eax, 0x43621c
call fcn.00434e20
pop ecx
jmp 0x4361b4
mov eax, dword [ebp + 8]
push eax
mov eax, 0x436230
call fcn.00434e20
pop ecx
jmp 0x4361b4
mov eax, dword [ebp + 8]
push eax
mov eax, 0x436240
call fcn.00434e20
pop ecx
jmp 0x4361b4
mov eax, dword [ebp + 8]
push eax
mov eax, 0x436250
call fcn.00434e20
pop ecx
jmp 0x4361b4
mov eax, dword [ebp + 8]
push eax
mov eax, 0x436260
call fcn.00434e20
pop ecx
jmp 0x4361b4
mov byte [0x441794], 0
jmp 0x4361b4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00403834
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb eax, eax
neg eax
mov byte [0x441794], al
cmp byte [0x441794], 0
je 0x4361b4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x46
jne 0x4360f8
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
test eax, eax
jns 0x4360e2
add eax, 0x3ff
sar eax, 0xa
call fcn.004329b0
mov eax, dword [ebp - 0x24]
call fcn.00434e20
pop ecx
jmp 0x4361b4
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
test eax, eax
jns 0x436113
add eax, 0x3ff
sar eax, 0xa
call fcn.004329b0
mov eax, dword [ebp - 0x24]
call fcn.00434e20
pop ecx
jmp 0x4361b4
mov eax, pe_nt_image_headers32
call fcn.00402620
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4361ad
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00403834
push eax
call sub.kernel32.dll_GetVolumeInformationA
neg eax
sbb eax, eax
neg eax
mov byte [0x441794], al
cmp byte [0x441794], 0
je 0x436197
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
call fcn.00403628
mov eax, dword [ebp - 0x24]
call fcn.00434e20
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4361b4
mov eax, dword [ebp - 0x10]
call fcn.00402638
ret
inc dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00403670
cmp eax, dword [ebp - 4]
jge 0x435fb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4361f2
lea eax, [ebp - 0x24]
call fcn.004034fc
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040351c
ret