Function at 0x10007d80
Capabilities:
Get common file path
Get disk information
Get disk size
Get file system object information
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1100
call fcn.10021ad0
mov eax, dword [0x10038654]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0xc14]
push eax
push 0x200
mov dword [ebp - 0x10f8], ebx
mov dword [ebp - 0x10fc], 0x100
mov byte [ebp - 0xa14], 7
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor edi, edi
lea ecx, [ebp - 0x10fc]
push ecx
lea edx, [ebp - 0xe1c]
push edx
lea esi, [ebp - 0xc14]
mov dword [ebp - 0x10ec], edi
mov dword [ebp - 0x10e8], edi
mov dword [ebp - 0x10f4], edi
mov dword [ebp - 0x10f0], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, str.SYSTEM
lea eax, [ebp - 0xe1c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10007e2b
cmp dx, di
je 0x10007e27
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10007e2b
add eax, 4
add ecx, 4
cmp dx, di
jne 0x10007e05
xor eax, eax
jmp 0x10007e30
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
sete al
mov byte [ebp - 0xa13], al
call fcn.10007ba0
lea ecx, [ebp - 0xa12]
push ecx
push 0
mov edi, eax
push edi
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0xa12]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp - 0xc14], 0
lea edi, [eax + eax + 4]
je 0x10007ff8
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.1001caf0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x214]
push ecx
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push 0x410
push 0x2b4
lea edx, [ebp - 0x10d4]
push edx
push 0x80
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0xec0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x214]
push ecx
lea ebx, [eax + eax + 2]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
movzx eax, word [esi]
mov dword [ebp - 0x10dc], edx
cmp eax, 0x41
je 0x10007f4a
cmp eax, 0x42
je 0x10007f4a
push 0
lea eax, [ebp - 0x10ec]
push eax
lea ecx, [ebp - 0x10f4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x10007f4a
mov eax, dword [ebp - 0x10ec]
mov edx, dword [ebp - 0x10e8]
mov ecx, dword [ebp - 0x10f0]
shrd eax, edx, 0x14
mov dword [ebp - 0x10d8], eax
mov eax, dword [ebp - 0x10f4]
shrd eax, ecx, 0x14
shr edx, 0x14
shr ecx, 0x14
jmp 0x10007f52
xor eax, eax
mov dword [ebp - 0x10d8], eax
mov dl, byte [esi]
push esi
mov dword [ebp - 0x10e0], eax
mov byte [ebp + edi - 0xa14], dl
mov byte [ebp + edi - 0xa13], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp - 0x10e0]
mov byte [ebp + edi - 0xa12], al
mov eax, dword [ebp - 0x10d8]
push ebx
lea edx, [ebp - 0xec0]
mov dword [ebp + edi - 0xa10], eax
push edx
lea eax, [ebp + edi - 0xa08]
push eax
mov byte [ebp + edi - 0xa11], 0
mov dword [ebp + edi - 0xa0c], ecx
call fcn.1001add0
mov ecx, dword [ebp - 0x10dc]
push ecx
lea edx, [ebp - 0x214]
lea eax, [ebx + edi]
push edx
lea ecx, [ebp + eax - 0xa08]
push ecx
call fcn.1001add0
mov edx, dword [ebp - 0x10dc]
add esp, 0x18
add edx, ebx
push esi
lea edi, [edi + edx + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 + 2], 0
lea esi, [esi + eax*2 + 2]
jne 0x10007e7c
mov ebx, dword [ebp - 0x10f8]
xor eax, eax
cmp dword [ebx + 8], eax
jne 0x10008011
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
push edi
lea edx, [ebp - 0xa14]
push edx
call eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100180fb
mov esp, ebp
pop ebp
ret 4