Function at 0x100ebd50
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x101042d0]
xor eax, esp
mov dword [esp + 0x20], eax
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
test ecx, ecx
jne 0x100ebe1e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x101042e0]
mov esi, eax
call fcn.100290c0
mov ecx, dword [0x101042e4]
xor edi, edi
mov dword [esp + 0x10], eax
cmp ecx, 0xffffffff
je 0x100ebee9
call fcn.100290c0
mov ebx, eax
test ebx, ebx
je 0x100ebee3
cmp ebx, 0xffffffff
je 0x100ebdf6
jmp 0x100ebdec
xor edx, edx
call fcn.1003b000
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100ebdf6
mov edx, ebx
call fcn.1003b000
test eax, eax
jne 0x100ebddd
mov ecx, dword [0x101042e4]
xor edx, edx
call fcn.1003b000
push ebx
jmp 0x100ebdba
mov ecx, ebx
call fcn.1003e545
push 0
call sym.ucrtbase.dll__free_base
pop ecx
imul edi, dword [esp + 0x10], 0x364
add edi, ebx
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
jne 0x100ebe08
mov edi, 0x101049f4
jmp 0x100ebe0b
add edi, 0x10
mov dword [edi], 0x16
call sym.ucrtbase.dll__invalid_parameter_noinfo
push 0x57
pop eax
jmp 0x100ebfaf
mov edx, dword [ebp + 8]
cmp edx, 0x1a
ja 0x100ebd74
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
lea esi, [esp + 0x1c]
push 0x5f
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ecx
pop eax
push 0x3a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [esp + 0x20], ax
mov esi, edx
pop eax
mov word [esp + 0x1e], ax
push 0x5c
pop eax
mov word [esp + 0x20], ax
xor eax, eax
neg esi
mov word [esp + 0x22], ax
lea eax, [esp + 0x1c]
sbb esi, esi
and esi, eax
test edx, edx
je 0x100ebe75
lea eax, [edx + 0x40]
mov word [esp + 0x1c], ax
push ecx
lea eax, [ecx + 4]
push eax
lea eax, [ecx + 0xc]
push eax
lea eax, [ecx + 8]
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x100ebfad
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
mov dword [esp + 0x18], eax
call fcn.10042a2d
mov dword [esp + 0x14], eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x101042e0]
mov esi, eax
call fcn.100290c0
mov ecx, dword [0x101042e4]
xor edi, edi
mov dword [esp + 0x10], eax
cmp ecx, 0xffffffff
je 0x100ebf22
call fcn.100290c0
mov ebx, eax
test ebx, ebx
je 0x100ebf1c
cmp ebx, 0xffffffff
je 0x100ebf8c
jmp 0x100ebf82
mov ecx, dword [0x101042e4]
or edx, 0xffffffff
call fcn.1003b000
test eax, eax
je 0x100ebdf6
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov ebx, eax
pop ecx
mov ecx, dword [0x101042e4]
test ebx, ebx
je 0x100ebdb2
jmp 0x100ebdc2
mov ecx, dword [0x101042e4]
or edx, 0xffffffff
call fcn.1003b000
test eax, eax
je 0x100ebf8c
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov ebx, eax
pop ecx
mov ecx, dword [0x101042e4]
test ebx, ebx
jne 0x100ebf58
xor edx, edx
call fcn.1003b000
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100ebf8c
mov edx, ebx
call fcn.1003b000
test eax, eax
jne 0x100ebf73
mov ecx, dword [0x101042e4]
xor edx, edx
call fcn.1003b000
push ebx
jmp 0x100ebf50
mov ecx, ebx
call fcn.1003e545
push 0
call sym.ucrtbase.dll__free_base
pop ecx
imul edi, dword [esp + 0x10], 0x364
add edi, ebx
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
jne 0x100ebf9e
mov edi, 0x101049f4
jmp 0x100ebfa1
add edi, 0x10
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov eax, dword [esp + 0x18]
jmp 0x100ebfaf
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10068820
mov esp, ebp
pop ebp
ret