Function at 0x4c75d8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x140
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x24], 0x105
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], 2
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4c7671
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50f154
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x5f2
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror_exit
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x24]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
call eax
sub esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4c7712
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xea
je 0x4c76ee
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.GetVolumePathNamesForVolumeNameW___u__s
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x5fe
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._mwarn
jmp 0x4c7713
cmp dword [ebp - 0x14], 0
je 0x4c7706
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0
jmp 0x4c760d
nop
cmp dword [ebp - 0x18], 0
je 0x4c7b8f
mov dword [ebp - 0x128], 0
lea edx, [ebp - 0x124]
mov eax, 0
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jmp 0x4c7b80
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._wcslen
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym._wcstombs
lea eax, [ebp - 0x128]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6303_:_Device__s_associated_with_the_mounting_point__s
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x60d
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._mdebug1
mov eax, dword [0x58a358]
test eax, eax
je 0x4c79c0
mov dword [ebp - 0x10], 0
jmp 0x4c77bf
add dword [ebp - 0x10], 1
mov eax, dword [0x58a358]
mov edx, dword [ebp - 0x10]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x4c77bb
mov eax, dword [ebp - 0x10]
add eax, 2
lea edx, [eax*4]
mov eax, dword [0x58a358]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._realloc
mov dword [0x58a358], eax
mov eax, dword [0x58a358]
test eax, eax
jne 0x4c7846
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50f154
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x616
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror_exit
mov eax, dword [0x58a358]
mov edx, dword [ebp - 0x10]
shl edx, 2
lea ebx, [eax + edx]
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strdup
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x4c78af
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50f154
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x619
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror_exit
mov eax, dword [0x58a358]
mov edx, dword [ebp - 0x10]
add edx, 1
shl edx, 2
add eax, edx
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
add eax, 2
lea edx, [eax*4]
mov eax, dword [0x58a35c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._realloc
mov dword [0x58a35c], eax
mov eax, dword [0x58a35c]
test eax, eax
jne 0x4c7939
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50f154
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x61c
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror_exit
mov eax, dword [0x58a35c]
mov edx, dword [ebp - 0x10]
shl edx, 2
lea ebx, [eax + edx]
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym._strdup
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x4c79a5
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50f154
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x61f
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror_exit
mov eax, dword [0x58a35c]
mov edx, dword [ebp - 0x10]
add edx, 1
shl edx, 2
add eax, edx
mov dword [eax], 0
jmp 0x4c7b75
mov dword [esp + 4], 4
mov dword [esp], 2
call sym._calloc
mov dword [0x58a358], eax
mov eax, dword [0x58a358]
test eax, eax
jne 0x4c7a2a
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50f154
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x623
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror_exit
mov ebx, dword [0x58a358]
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strdup
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x4c7a8b
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50f154
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x624
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror_exit
mov eax, dword [0x58a358]
add eax, 4
mov dword [eax], 0
mov dword [esp + 4], 4
mov dword [esp], 2
call sym._calloc
mov dword [0x58a35c], eax
mov eax, dword [0x58a35c]
test eax, eax
jne 0x4c7b03
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50f154
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x627
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror_exit
mov ebx, dword [0x58a35c]
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym._strdup
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x4c7b67
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50f154
mov dword [esp + 8], str.get_drive_names
mov dword [esp + 4], 0x628
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror_exit
mov eax, dword [0x58a35c]
add eax, 4
mov dword [eax], 0
mov eax, dword [ebp - 0x20]
add eax, 1
add eax, eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
test ax, ax
jne 0x4c7746
cmp dword [ebp - 0x14], 0
je 0x4c7ba7
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x14], 0
mov eax, 0
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret