Function at 0x403d20
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4775af
mov eax, dword fs:[0]
push eax
sub esp, 0x358
mov eax, dword [0x48300c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x328], ebx
push 0x100
mov dword [ebp - 4], 0
lea eax, [ebp - 0x318]
push 0
mov dword [ebp - 0x364], ebx
push eax
mov dword [ebp - 0x338], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x318]
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call fcn.004018e0
mov ecx, eax
test ecx, ecx
je 0x40432e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x324], eax
mov eax, 0x47bdf9
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x324]
test eax, 0xffff0000
jne 0x403ddc
movzx eax, ax
push eax
call fcn.004052f0
jmp 0x403de8
push 0
push 0x47bdf9
call fcn.00405420
mov dword [ebp - 4], 2
xorps xmm0, xmm0
movq qword [ebx], xmm0
push 0x10
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.00475be2
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebx], eax
mov dword [ebp - 0x338], 1
call fcn.004018e0
mov ecx, eax
test ecx, ecx
je 0x404338
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x31c], eax
push 0
mov byte [ebp - 4], 3
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
call edi
mov esi, eax
lea ecx, [esi + 2]
push ecx
call fcn.00475c20
add esp, 4
mov dword [ebp - 0x334], eax
mov ebx, eax
push eax
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x330], eax
test eax, eax
je 0x4042ae
nop word [eax + eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x403e93
jmp dword [eax*4 + 0x404344]
test ebx, ebx
jne 0x403ea2
xor ecx, ecx
jmp 0x403eb0
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403ea7
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x31c]
call fcn.00405420
mov edi, dword [ebp - 0x32c]
mov dword [ebp - 0x320], 1
cmp dword [edi + 4], 0xfffffff
mov eax, dword [edi]
mov dword [ebp - 0x328], eax
je 0x404323
mov dword [ebp - 0x340], edi
mov byte [ebp - 4], 4
push 0x10
mov dword [ebp - 0x33c], 0
call fcn.00475be2
mov esi, eax
add esp, 4
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x33c], esi
push eax
lea ecx, [esi + 0xc]
mov dword [esi + 8], 1
call fcn.004036b0
mov ecx, dword [ebp - 0x328]
mov byte [ebp - 4], 3
inc dword [edi + 4]
mov dword [ebp - 0x33c], 0
mov eax, dword [ecx + 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [ecx + 4], esi
mov dword [eax], esi
jmp case.default.0x403e93
cmp dword [0x484140], 0
jne case.default.0x403e93
test ebx, ebx
jne 0x403f5c
xor ecx, ecx
jmp 0x403f6a
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403f61
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x31c]
call fcn.00405420
push 1
lea eax, [ebp - 0x318]
mov dword [ebp - 0x320], 0
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x404138
push 0x104
push eax
lea eax, [ebp - 0x114]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0
push 5
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403fd0
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x31c]
call fcn.00405420
mov edi, dword [ebp - 0x32c]
cmp dword [edi + 4], 0xfffffff
mov eax, dword [edi]
mov dword [ebp - 0x328], eax
je 0x404323
mov dword [ebp - 0x348], edi
mov byte [ebp - 4], 5
push 0x10
mov dword [ebp - 0x344], 0
call fcn.00475be2
mov ecx, dword [ebp - 0x320]
mov esi, eax
add esp, 4
mov dword [ebp - 0x344], esi
lea eax, [ebp - 0x31c]
mov dword [esi + 8], ecx
lea ecx, [esi + 0xc]
push eax
call fcn.004036b0
mov ecx, dword [ebp - 0x328]
mov byte [ebp - 4], 3
inc dword [edi + 4]
push 0x104
mov eax, dword [ecx + 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [ecx + 4], esi
mov dword [eax], esi
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x344], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4040a0
sub ecx, edx
lea eax, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x31c]
call fcn.00405420
cmp dword [edi + 4], 0xfffffff
mov eax, dword [edi]
mov dword [ebp - 0x328], eax
je 0x404323
mov dword [ebp - 0x350], edi
mov byte [ebp - 4], 6
push 0x10
mov dword [ebp - 0x34c], 0
call fcn.00475be2
mov ecx, dword [ebp - 0x320]
mov esi, eax
add esp, 4
mov dword [ebp - 0x34c], esi
lea eax, [ebp - 0x31c]
mov dword [esi + 8], ecx
lea ecx, [esi + 0xc]
push eax
call fcn.004036b0
mov ecx, dword [ebp - 0x328]
mov byte [ebp - 4], 3
inc dword [edi + 4]
mov dword [ebp - 0x34c], 0
mov eax, dword [ecx + 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [ecx + 4], esi
mov dword [eax], esi
jmp case.default.0x403e93
mov edi, dword [ebp - 0x32c]
cmp dword [edi + 4], 0xfffffff
mov eax, dword [edi]
mov dword [ebp - 0x328], eax
je 0x404323
mov dword [ebp - 0x358], edi
mov byte [ebp - 4], 7
push 0x10
mov dword [ebp - 0x354], 0
call fcn.00475be2
mov esi, eax
add esp, 4
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x354], esi
push eax
lea ecx, [esi + 0xc]
mov dword [esi + 8], 0
call fcn.004036b0
mov ecx, dword [ebp - 0x328]
mov byte [ebp - 4], 3
inc dword [edi + 4]
mov dword [ebp - 0x354], 0
mov eax, dword [ecx + 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [ecx + 4], esi
mov dword [eax], esi
jmp case.default.0x403e93
test ebx, ebx
jne 0x4041c0
xor ecx, ecx
jmp 0x4041ce
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4041c5
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x31c]
call fcn.00405420
mov edi, dword [ebp - 0x32c]
mov dword [ebp - 0x320], 3
cmp dword [edi + 4], 0xfffffff
mov eax, dword [edi]
mov dword [ebp - 0x328], eax
je 0x404323
mov dword [ebp - 0x360], edi
mov byte [ebp - 4], 8
push 0x10
mov dword [ebp - 0x35c], 0
call fcn.00475be2
mov esi, eax
add esp, 4
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x35c], esi
push eax
lea ecx, [esi + 0xc]
mov dword [esi + 8], 3
call fcn.004036b0
mov ecx, dword [ebp - 0x328]
mov byte [ebp - 4], 3
inc dword [edi + 4]
mov dword [ebp - 0x35c], 0
mov eax, dword [ecx + 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [ecx + 4], esi
mov dword [eax], esi
jmp case.default.0x403e93
test ebx, ebx
jne 0x40426a
xor ecx, ecx
jmp 0x404279
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404270
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x31c]
call fcn.00405420
mov dword [ebp - 0x320], 2
mov eax, dword [ebp - 0x330]
inc eax
add ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x330], eax
test eax, eax
jne 0x403e80
push 1
push dword [ebp - 0x334]
call fcn.00475c12
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x31c]
add esp, 8
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4042e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x324]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x404301
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x32c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475bd4
mov esp, ebp
pop ebp
ret
push str.list_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
push 0x80004005
call fcn.00403360
push 0x80004005
call fcn.00403360
nop
lcall 0x403f, 0x4700403e
add byte [eax + 1644183617], bh
inc edx
inc eax
add ah, cl
int3