Function at 0x4518e2
Capabilities:
Enumerate disk volumes
Enumerate process modules
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c0], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x4f0], edi
test eax, eax
jne 0x451946
push eax
push eax
push 0x8e
push 0x49b2a0
lea eax, [ebp - 0x450]
push 0x4aa658
push eax
call fcn.00407235
add esp, 0x14
mov ecx, edi
push eax
call fcn.0043641b
lea ecx, [ebp - 0x450]
call fcn.0043645f
mov eax, edi
jmp 0x4522dd
push ebx
xor ebx, ebx
lea eax, [ebp - 0x4dc]
push ebx
push eax
lea eax, [ebp - 0x4b8]
mov dword [ebp - 0x4b8], ebx
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 0x4dc], ebx
push eax
call fcn.004517ba
add esp, 0xc
lea ecx, [ebp - 0x43c]
push eax
call fcn.0043641b
lea ecx, [ebp - 0x450]
call fcn.0043645f
lea ecx, [ebp - 0x43c]
call fcn.0043ff50
cmp eax, 0x7d1
jl 0x4519ef
push ebx
push ebx
push 0x93
push 0x49b2a0
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.00406ae7
add esp, 0x14
mov ecx, edi
push eax
call fcn.0043641b
lea ecx, [ebp - 0x450]
call fcn.0043645f
lea ecx, [ebp - 0x43c]
call fcn.0043645f
push dword [ebp - 0x4b8]
call fcn.0046b30d
pop ecx
mov eax, edi
jmp 0x4522dc
push esi
lea ecx, [ebp - 0x43c]
call fcn.0043645f
push 0x4a46ac
lea ecx, [ebp - 0x4d4]
call fcn.004363fb
mov edi, dword [ebp - 0x4b8]
mov eax, ebx
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4dc], eax
jbe 0x4522b0
cmp byte [ebp + 0x10], 0
mov esi, dword [edi + eax*4]
mov dword [ebp - 0x4b8], esi
je 0x451a4b
lea eax, [ebp - 0x4d4]
push eax
push esi
call fcn.004526a2
pop ecx
pop ecx
test al, al
je 0x452263
lea ecx, [ebp - 0x428]
call fcn.00438b2f
push 1
call fcn.0044535f
pop ecx
test al, al
je 0x451bc9
push esi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
jne 0x451a99
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push 0x4a85e4
push eax
call fcn.00451706
add esp, 0xc
push ebx
jmp 0x452252
call fcn.00452701
mov dword [ebp - 0x4bc], eax
cmp byte [eax + 0x18], 0
jne 0x451ac9
push dword [ebp - 0x4b8]
push str.CKernel32_Dll_VistaOrLater::load
lea eax, [ebp - 0x4d4]
push eax
call fcn.00451706
add esp, 0xc
jmp 0x45224c
lea eax, [ebp - 0x4e8]
mov ecx, 0x104
push eax
mov dword [ebp - 0x4e8], ecx
push ecx
lea ecx, [ebp - 0x428]
call fcn.0043ae7d
push eax
mov eax, dword [ebp - 0x4bc]
push ebx
push esi
call dword [eax + 0x34]
push 0xffffffffffffffff
lea ecx, [ebp - 0x428]
mov ebx, eax
call fcn.0043b17d
test ebx, ebx
jne 0x451b13
push dword [ebp - 0x4b8]
push str.QueryFullProcessImageName
jmp 0x451ab5
mov ebx, dword [ebp - 0x4c0]
lea ecx, [ebp - 0x428]
push 0
push dword [ebp - 0x4b8]
mov ebx, dword [ebx]
call fcn.0043fdec
push eax
push 0xffffffffffffffff
push 0
push 0x4a3e50
lea ecx, [ebp - 0x428]
call fcn.0043a4c9
inc eax
lea ecx, [ebp - 0x428]
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.0043b7cf
mov ecx, eax
call fcn.0043fdec
mov ecx, dword [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x450]
push eax
call dword [ebx]
push eax
lea ecx, [ebp - 0x43c]
call fcn.0043641b
lea ecx, [ebp - 0x450]
call fcn.0043645f
lea ecx, [ebp - 0x4b4]
call fcn.00438dea
cmp dword [ebp - 0x430], 0x7de
lea ecx, [ebp - 0x43c]
jne 0x452247
call fcn.0043645f
cmp esi, 0xffffffff
je 0x451bb7
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x428]
call fcn.00438dea
xor ebx, ebx
jmp 0x4522b0
push ebx
call fcn.004452d4
pop ecx
test al, al
je 0x45210f
call fcn.0044544d
test al, al
je 0x45210f
push esi
push ebx
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x451a79
call fcn.00452727
mov dword [ebp - 0x4bc], eax
cmp byte [eax + 0x18], 0
jne 0x451c1d
push dword [ebp - 0x4b8]
push str.CPSAPI_Dll_XPOrLater::load
jmp 0x451ab5
mov eax, 0x104
lea ecx, [ebp - 0x428]
push eax
push eax
call fcn.0043ae7d
push eax
mov eax, dword [ebp - 0x4bc]
push esi
call dword [eax + 0x34]
push 0xffffffffffffffff
lea ecx, [ebp - 0x428]
call fcn.0043b17d
push str.Device_
lea ecx, [ebp - 0x43c]
call fcn.00438ae2
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x428]
call fcn.0043b712
cmp eax, 0x3e9
jne 0x452072
lea ecx, [ebp - 0x43c]
call fcn.0043b147
push eax
push 0x4a3e50
lea ecx, [ebp - 0x428]
call fcn.0043a4c0
push eax
push ebx
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x428]
call fcn.0043b7cf
lea ecx, [ebp - 0x4a0]
call fcn.0043af83
cmp eax, 0x3e9
jne 0x451ceb
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push str.GetProcessImageFileName
push eax
call fcn.00451706
add esp, 0xc
lea ecx, [ebp - 0x4a0]
call fcn.00438dea
lea ecx, [ebp - 0x43c]
call fcn.00438dea
jmp 0x45224c
lea ecx, [ebp - 0x478]
call fcn.00438b2f
mov eax, 0x104
lea ecx, [ebp - 0x478]
push eax
push eax
call fcn.0043ae7d
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeW]
mov ebx, eax
lea ecx, [ebp - 0x478]
push 0xffffffffffffffff
mov dword [ebp - 0x4bc], ebx
call fcn.0043b17d
cmp ebx, 0xffffffff
jne 0x451d50
push dword [ebp - 0x4b8]
push str.FindFirstVolume
lea eax, [ebp - 0x4d4]
push eax
call fcn.00451706
add esp, 0xc
lea ecx, [ebp - 0x478]
call fcn.00438dea
jmp 0x451cd0
mov dword [ebp - 0x4d8], 1
push 0x498fa0
lea ecx, [ebp - 0x478]
call fcn.0043b76a
cmp eax, 0x3e8
jne 0x451d90
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push str.FindFirstVolumeFindNextVolume
push eax
call fcn.00451706
add esp, 0xc
jmp 0x451f3c
push 0x4a3dbc
lea ecx, [ebp - 0x450]
call fcn.00438ae2
push 0x4a3e50
lea ecx, [ebp - 0x4b4]
call fcn.00438ae2
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x478]
call fcn.0043b496
lea ecx, [ebp - 0x464]
call fcn.0043645f
lea ecx, [ebp - 0x4b4]
call fcn.00438dea
lea ecx, [ebp - 0x450]
call fcn.00438dea
lea ecx, [ebp - 0x48c]
call fcn.00438b2f
mov eax, 0x104
lea ecx, [ebp - 0x48c]
push eax
push eax
call fcn.0043ae7d
push eax
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x478]
call fcn.0043b7cf
mov ecx, eax
call fcn.0043fdec
push eax
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceW]
lea ecx, [ebp - 0x464]
mov ebx, eax
call fcn.00438dea
push 0xffffffffffffffff
lea ecx, [ebp - 0x48c]
call fcn.0043b17d
test ebx, ebx
je 0x45204b
push 0xffffffffffffffff
push 0x4a3e50
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x478]
call fcn.0043a192
lea ecx, [ebp - 0x464]
call fcn.0043645f
push 0xffffffffffffffff
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x4a0]
call fcn.0043a286
lea ecx, [ebp - 0x464]
cmp dword [eax + 0xc], 0x3ec
sete bl
call fcn.0043645f
test bl, bl
je 0x451eff
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0046e6d0
and dword [ebp - 0x4ec], 0
add esp, 0xc
call fcn.004454a4
mov ebx, eax
cmp byte [ebx + 0x18], 0
jne 0x451f82
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push str.CKernel32_Dll_XPOrLater::load
push eax
call fcn.00451706
add esp, 0xc
jmp 0x451f31
mov eax, 0x104
lea ecx, [ebp - 0x478]
push eax
push eax
call fcn.0043ae7d
push eax
push dword [ebp - 0x4bc]
call dword [sym.imp.KERNEL32.DLL_FindNextVolumeW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x4d8], eax
call fcn.0043b17d
lea ecx, [ebp - 0x48c]
call fcn.00438dea
cmp dword [ebp - 0x4d8], 0
jne 0x451d5a
mov ebx, dword [ebp - 0x4b8]
push dword [ebp - 0x4bc]
call dword [sym.imp.KERNEL32.DLL_FindVolumeClose]
cmp dword [ebp - 0x4d8], 0
jne 0x45205c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
je 0x45205c
push ebx
push str.FindFirstVolumeFindNextVolume
jmp 0x451d34
lea eax, [ebp - 0x4ec]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x478]
call fcn.0043fdec
push eax
call dword [ebx + 0x30]
test eax, eax
jne 0x451fd3
mov ebx, dword [ebp - 0x4b8]
push ebx
push str.GetVolumePathNamesForVolumeName
lea eax, [ebp - 0x4d4]
push eax
call fcn.00451706
add esp, 0xc
lea ecx, [ebp - 0x48c]
call fcn.00438dea
jmp 0x451f4f
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x450]
call fcn.00438ae2
lea eax, [ebp - 0x450]
push eax
push 0x4a3e50
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.00438f74
add esp, 0xc
lea ecx, [ebp - 0x428]
push eax
lea eax, [ebp - 0x464]
push eax
call fcn.0043b391
lea ecx, [ebp - 0x464]
call fcn.0043645f
lea ecx, [ebp - 0x4b4]
call fcn.00438dea
lea ecx, [ebp - 0x450]
call fcn.00438dea
lea ecx, [ebp - 0x48c]
call fcn.00438dea
jmp 0x451f49
mov ebx, dword [ebp - 0x4b8]
push ebx
push str.QueryDosDevice
jmp 0x451fb4
lea ecx, [ebp - 0x478]
call fcn.00438dea
lea ecx, [ebp - 0x4a0]
call fcn.00438dea
mov eax, dword [ebp - 0x4c0]
lea ecx, [ebp - 0x428]
push 0
push dword [ebp - 0x4b8]
mov ebx, dword [eax]
call fcn.0043fdec
push eax
push 0xffffffffffffffff
push 0
push 0x4a3e50
lea ecx, [ebp - 0x428]
call fcn.0043a4c9
inc eax
lea ecx, [ebp - 0x428]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.0043b7cf
mov ecx, eax
call fcn.0043fdec
mov ecx, dword [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x464]
push eax
call dword [ebx]
push eax
lea ecx, [ebp - 0x504]
call fcn.0043641b
lea ecx, [ebp - 0x464]
call fcn.0043645f
lea ecx, [ebp - 0x450]
call fcn.00438dea
cmp dword [ebp - 0x4f8], 0x7de
lea ecx, [ebp - 0x504]
je 0x45227f
call fcn.0043645f
jmp 0x451cdb
push esi
push ebx
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x451a79
lea eax, [ebp - 0x508]
push eax
push 4
lea eax, [ebp - 0x4e4]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x452150
push dword [ebp - 0x4b8]
push 0x49b4c8
jmp 0x451ab5
xor eax, eax
push 0x206
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.0046e6d0
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
push dword [ebp - 0x4e4]
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
jne 0x4521a4
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push str.GetModuleBaseName
push eax
call fcn.00451706
add esp, 0xc
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0046e6d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [ebp - 0x4e4]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x4521f8
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push str.GetModuleFileNameEx
push eax
call fcn.00451706
add esp, 0xc
mov ecx, dword [ebp - 0x4c0]
lea edx, [ebp - 0x20c]
push ebx
push dword [ebp - 0x4b8]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x414]
push edx
lea edx, [ebp - 0x464]
push edx
call dword [eax]
push eax
lea ecx, [ebp - 0x504]
call fcn.0043641b
lea ecx, [ebp - 0x464]
call fcn.0043645f
cmp dword [ebp - 0x4f8], 0x7de
lea ecx, [ebp - 0x504]
je 0x452294
call fcn.0043645f
cmp esi, 0xffffffff
je 0x452258
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x428]
call fcn.00438dea
mov eax, dword [ebp - 0x4e0]
xor ebx, ebx
inc eax
mov dword [ebp - 0x4e0], eax
cmp eax, dword [ebp - 0x4dc]
jae 0x4522b0
jmp 0x451a25
call fcn.0043645f
lea ecx, [ebp - 0x43c]
call fcn.00438dea
jmp 0x451bab
call fcn.0043645f
cmp esi, 0xffffffff
je 0x4522a5
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x428]
call fcn.00438dea
mov ecx, dword [ebp - 0x4f0]
lea eax, [ebp - 0x4d4]
push ebx
push eax
call fcn.0043641b
lea ecx, [ebp - 0x4d4]
call fcn.0043645f
push edi
call fcn.0046b30d
mov eax, dword [ebp - 0x4f0]
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0046a7e5
mov esp, ebp
pop ebp
ret