Function at 0x1003cda0
Capabilities:
Get disk information
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1010a950
mov eax, dword fs:[0]
push eax
sub esp, 0x5c4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x5c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x5d8]
mov dword fs:[0], eax
mov edi, edx
mov dword [esp + 0x40], edi
mov ebx, ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x18], 0
xor eax, eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x64], ebx
mov dword [esp + 0x7c], 7
mov dword [esp + 0x78], 0
mov word [esp + 0x68], ax
mov dword [esp + 0x5e0], 1
test edi, edi
jne 0x1003ce38
lea eax, [esp + 0x68]
push eax
call fcn.10005f30
jmp 0x1003d409
push str.Kernel32.dll
lea ecx, [esp + 0x50]
call fcn.10008b50
mov byte [esp + 0x5e0], 2
mov eax, dword [0x1016a4b4]
test al, 1
jne 0x1003ce8b
or eax, 1
mov dword [0x1016a4b4], eax
mov byte [esp + 0x5e0], 3
mov dword [0x1016a4b0], 0
call fcn.100272e0
push 0x1011a780
call fcn.1005d78f
add esp, 4
mov byte [esp + 0x5e0], 2
lea eax, [esp + 0x4c]
mov ecx, 0x1016a4b0
push eax
call fcn.100274a0
mov ebp, eax
mov dword [esp + 0x48], ebp
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x60], 8
jb 0x1003cebb
push dword [esp + 0x4c]
call fcn.1005d7c6
add esp, 4
xor eax, eax
mov dword [esp + 0x60], 7
push str.Psapi.dll
lea ecx, [esp + 0x2c]
mov dword [esp + 0x60], 0
mov word [esp + 0x50], ax
call fcn.10008b50
mov byte [esp + 0x5e0], 4
mov eax, dword [0x1016a4b4]
test al, 1
jne 0x1003cf25
or eax, 1
mov dword [0x1016a4b4], eax
mov byte [esp + 0x5e0], 5
mov dword [0x1016a4b0], 0
call fcn.100272e0
push 0x1011a780
call fcn.1005d78f
add esp, 4
mov byte [esp + 0x5e0], 4
lea eax, [esp + 0x28]
mov ecx, 0x1016a4b0
push eax
call fcn.100274a0
mov esi, eax
mov dword [esp + 0x14], esi
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x3c], 8
jb 0x1003cf55
push dword [esp + 0x28]
call fcn.1005d7c6
add esp, 4
xor eax, eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
test esi, esi
je 0x1003d3fd
test ebp, ebp
je 0x1003d3fd
lea ecx, [esp + 0x9c]
call fcn.1001e640
cmp dword [esp + 0xa0], 6
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jb 0x1003d028
push str.QueryFullProcessImageNameW
push ebp
call ebx
mov esi, eax
test esi, esi
je 0x1003d024
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.100639b0
add esp, 0xc
mov dword [esp + 0x80], 0x208
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x1c0]
push eax
push 0
push edi
call esi
test eax, eax
je 0x1003d024
mov eax, dword [esp + 0x80]
cmp eax, 0x208
jae 0x1003d013
add eax, eax
cmp eax, 0x412
jae 0x1003d152
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x6c]
call fcn.10006010
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x78], 0
jne 0x1003d32a
push str.GetProcessImageFileNameW
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x1003d04f
push str.GetProcessImageFileNameW
push ebp
call ebx
mov esi, eax
test esi, esi
je 0x1003d0b2
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.100639b0
add esp, 0xc
lea eax, [esp + 0x1bc]
push 0x208
push eax
push edi
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x1003d0b2
add eax, eax
cmp eax, 0x412
jae 0x1003d152
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x6c]
call fcn.10006010
cmp dword [esp + 0x78], 0
je 0x1003d2a6
push 0x410
call fcn.1005d9bc
add esp, 4
mov ebx, eax
push 0x410
push 0
push ebx
call fcn.100639b0
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
movq qword [esp + 0x28], xmm0
add esp, 0xc
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x5e0], 6
lea ecx, [esp + 0x1c]
call fcn.10040b50
mov ecx, dword [esp + 0x20]
mov eax, 0x2aaaaaab
mov edi, dword [esp + 0x1c]
xor ebp, ebp
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x80], eax
je 0x1003d273
cmp dword [edi + 0x10], 3
jb 0x1003d171
mov ecx, dword [edi + 0x14]
cmp ecx, 8
jb 0x1003d157
mov eax, dword [edi]
jmp 0x1003d159
call fcn.1005db2e
mov eax, edi
cmp word [eax + 4], 0x5c
jne 0x1003d171
cmp ecx, 8
jb 0x1003d169
mov eax, dword [edi]
jmp 0x1003d16b
mov eax, edi
xor ecx, ecx
mov word [eax + 4], cx
cmp dword [edi + 0x14], 8
jb 0x1003d17b
mov eax, dword [edi]
jmp 0x1003d17d
mov eax, edi
push 0x208
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1003d191
mov word [ebx], ax
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1003d196
sub esi, ecx
sar esi, 1
je 0x1003d1ca
cmp esi, dword [esp + 0x78]
jae 0x1003d1ca
cmp dword [esp + 0x7c], 8
lea eax, [esp + 0x68]
push esi
cmovae eax, dword [esp + 0x6c]
push ebx
push eax
call fcn.1006e5d4
add esp, 0xc
test eax, eax
je 0x1003d1e0
inc ebp
add edi, 0x18
cmp ebp, dword [esp + 0x80]
jb 0x1003d140
jmp 0x1003d273
xor eax, eax
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], 0
mov word [esp + 0x84], ax
mov byte [esp + 0x5e0], 7
lea eax, [esp + 0x68]
cmp dword [esp + 0x7c], 8
cmovae eax, dword [esp + 0x68]
cmp dword [edi + 0x14], 8
jb 0x1003d234
mov edi, dword [edi]
lea eax, [eax + esi*2]
push eax
push edi
lea eax, [esp + 0x8c]
push str._s_s
push eax
call fcn.1001c2e0
add esp, 0x10
lea eax, [esp + 0x84]
lea ecx, [esp + 0x68]
push eax
call fcn.1003bf60
mov byte [esp + 0x5e0], 6
lea ecx, [esp + 0x84]
call fcn.10005fe0
push ebx
call fcn.1005d9b7
add esp, 4
mov byte [esp + 0x5e0], 1
lea ecx, [esp + 0x1c]
call fcn.10008bb0
cmp dword [esp + 0x78], 0
jne 0x1003d32a
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, dword [esp + 0x48]
mov edi, dword [esp + 0x40]
push str.GetModuleFileNameExW
push dword [esp + 0x18]
call ebx
mov esi, eax
test esi, esi
jne 0x1003d2c5
push str.GetModuleFileNameExW
push ebp
call ebx
mov esi, eax
test esi, esi
je 0x1003d32a
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.100639b0
add esp, 0xc
lea eax, [esp + 0x1bc]
push 0x208
push eax
push 0
push edi
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x1003d32a
add eax, eax
cmp eax, 0x412
jae 0x1003d152
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x6c]
call fcn.10006010
lea edx, [esp + 0x68]
lea ecx, [esp + 0x28]
call fcn.10028730
mov esi, eax
mov byte [esp + 0x5e0], 8
lea eax, [esp + 0x68]
cmp eax, esi
je 0x1003d37d
cmp dword [esp + 0x7c], 8
jb 0x1003d35c
push dword [esp + 0x68]
call fcn.1005d7c6
add esp, 4
xor eax, eax
mov dword [esp + 0x7c], 7
push esi
lea ecx, [esp + 0x6c]
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
call fcn.100061e0
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x3c], 8
jb 0x1003d398
push dword [esp + 0x28]
call fcn.1005d7c6
add esp, 4
mov esi, dword [esp + 0x44]
xor eax, eax
mov word [esp + 0x28], ax
mov ecx, esi
lea eax, [esp + 0x68]
mov dword [esp + 0x3c], 7
push eax
mov dword [esp + 0x3c], 0
call fcn.10005f30
mov dword [esp + 0x18], 1
mov byte [esp + 0x5e0], 0
cmp dword [esp + 0x7c], 8
jb 0x1003d3e2
push dword [esp + 0x68]
call fcn.1005d7c6
add esp, 4
xor eax, eax
mov dword [esp + 0x7c], 7
mov dword [esp + 0x78], 0
mov word [esp + 0x68], ax
mov eax, esi
jmp 0x1003d441
lea eax, [esp + 0x68]
mov ecx, ebx
push eax
call fcn.10005f30
mov dword [esp + 0x18], 1
mov byte [esp + 0x5e0], 0
cmp dword [esp + 0x7c], 8
jb 0x1003d42c
push dword [esp + 0x68]
call fcn.1005d7c6
add esp, 4
xor eax, eax
mov dword [esp + 0x7c], 7
mov dword [esp + 0x78], eax
mov word [esp + 0x68], ax
mov eax, ebx
mov ecx, dword [esp + 0x5d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c0]
xor ecx, esp
call fcn.1005d006
add esp, 0x5d0
ret