Function at 0x101793c6
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push 0x64
mov eax, 0x10197a80
call fcn.1015e434
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp byte [ebp + 0x14], bl
mov esi, ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], eax
jne 0x1017940b
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [0x101cec50]
je 0x101793fa
cmp ecx, dword [0x101cec54]
jne 0x1017940b
push 1
push str.SeManageVolumePrivilege
mov ecx, esi
call fcn.10178e6b
mov eax, dword [ebp - 0x54]
cmp edi, ebx
mov cl, byte [ebp + 0x14]
mov byte [esi + 0x2c], cl
jne 0x10179422
mov dword [eax], 0x57
xor al, al
jmp 0x101795e1
push eax
mov ecx, esi
mov byte [ebp - 0x49], 1
call fcn.10179072
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.10029900
push edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.10006620
push 0xffffffffffffffff
push ebx
lea edi, [esi + 0x30]
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.10005470
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.10003eb0
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.100f0d69
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
pop ecx
jae 0x10179482
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10179497
test ax, 0x200
jne 0x10179497
mov byte [ebp + 0x14], bl
cmp dword [ebp - 0x18], ebx
jne 0x101794c3
mov eax, dword [ebp + 0xc]
xor ecx, ecx
cmp eax, dword [0x101cec4c]
push ebx
setne cl
push 0x10000080
add ecx, 3
push ecx
push ebx
push 7
push eax
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x101794f2
cmp dword [ebp - 0x14], 8
mov edi, dword [ebp - 0x28]
jae 0x101794cf
lea edi, [ebp - 0x28]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
cmp eax, dword [0x101cec4c]
push ebx
setne cl
push 0x10000080
add ecx, 3
push ecx
push ebx
push 7
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x24], eax
jne 0x1017950d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x54]
mov dword [ecx], eax
mov byte [ebp - 0x49], bl
jmp 0x101795d3
cmp byte [ebp + 0x14], bl
je 0x101795cd
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
call fcn.10002d40
push ebx
mov edi, 0x1019cc24
push edi
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.100357b0
cmp eax, 0xffffffff
mov dword [ebp - 0x50], eax
jne 0x10179551
push eax
push ebx
lea eax, [esi + 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.10005470
jmp 0x10179584
push edi
call fcn.1015e340
add eax, dword [ebp - 0x50]
pop ecx
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
lea ecx, [esi + 0x30]
call fcn.1002a800
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.10005470
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.10003eb0
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x10179590
lea eax, [ebp - 0x44]
push ebx
push ebx
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x101795c2
test byte [ebp - 0x54], 0x40
je 0x101795c2
push ebx
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x900c4
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.10003eb0
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10029930
mov al, byte [ebp - 0x49]
call fcn.1015e4b7
ret 0x10