Function at 0x972170
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc38
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0xc34], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc44]
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.00a7ffb0
add esp, 0xc
xor edx, edx
push 0x81e
push edx
lea eax, [esp + 0x42a]
push eax
mov word [esp + 0x42c], dx
call fcn.00a7ffb0
add esp, 0xc
test ebp, ebp
je 0x972459
cmp word [ebp], 0
je 0x972459
push 0xaec36c
push ebp
call fcn.0095c9e0
add esp, 8
cmp eax, 0xffffffff
je 0x9721f6
mov ebx, ebp
call fcn.009813a0
push 0xc
push str.devicemup_
push ebp
call fcn.00a7c368
add esp, 0xc
test eax, eax
jne 0x97221d
push 0xabd360
push str.devicemup
push ebp
call fcn.0095e290
add esp, 0xc
cmp word [ebp], 0x5c
jne 0x97223a
cmp word [ebp + 2], 0x5c
jne 0x97223a
push ebp
call fcn.00981e40
cmp eax, 1
je 0x972459
push 8
push str.device_
push ebp
call fcn.00a7c368
add esp, 0xc
test eax, eax
jne 0x972459
push str.PhysicalDmVolumes_
push ebp
call fcn.0095c9e0
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x972369
cmp dword [0xbfda7c], 0
jne 0x972298
push str.GetVolumePathNameW
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0xbfda7c], eax
test eax, eax
je 0x972369
lea ecx, [ebp + esi*2 + 0x26]
push 0x5c
push ecx
call fcn.00a7c9c2
mov esi, eax
add esp, 8
test esi, esi
je 0x972369
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x222]
push eax
mov word [esp + 0x224], dx
call fcn.00a7ffb0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x21c]
push ecx
push ebp
call dword [0xbfda7c]
test eax, eax
je 0x972369
lea eax, [esp + 0x218]
call fcn.00972cd0
lea eax, [esi + 2]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x972300
lea edi, [esp + 0x218]
sub eax, edx
add edi, 0xfffffffe
jmp 0x972320
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x972320
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x218]
and ecx, 3
mov edx, eax
rep movsb byte es:[edi], byte [esi]
sub ebp, edx
jmp 0x972350
movzx ecx, word [eax]
mov word [eax + ebp], cx
add eax, 2
test cx, cx
jne 0x972350
mov eax, 1
jmp 0x97245b
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, 0x3a
xor ecx, ecx
mov word [esp + 0x12], ax
mov word [esp + 0x14], cx
mov esi, 0x61
jmp 0x972390
push 0x410
lea eax, [esp + 0x424]
push eax
lea ecx, [esp + 0x18]
xor edx, edx
push ecx
mov word [esp + 0x1c], si
mov word [esp + 0x42c], dx
call edi
test eax, eax
je 0x972418
lea edx, [esp + 0x420]
push 0xaec36c
push edx
call fcn.0095c9e0
add esp, 8
cmp eax, 0xffffffff
je 0x9723dd
lea ebx, [esp + 0x420]
call fcn.009813a0
lea eax, [esp + 0x420]
call fcn.00972cd0
lea eax, [esp + 0x420]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x9723f3
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x424]
push eax
push ebp
call fcn.00a7c368
add esp, 0xc
test eax, eax
je 0x972476
inc esi
cmp si, 0x7a
jbe 0x972390
push 0xabd360
push str.DeviceLanmanRedirector
push ebp
call fcn.0095e290
add esp, 0xc
test eax, eax
jne 0x97235f
push 0xabd360
push str.DeviceNetwareRedirector
push ebp
call fcn.0095e290
add esp, 0xc
test eax, eax
jne 0x97235f
xor eax, eax
mov ecx, dword [esp + 0xc44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0xc38
ret 4
lea esi, [esp + 0x420]
call fcn.00972c70
lea ecx, [esp + 0x10]
push ecx
mov edx, esi
push edx
push ebp
call fcn.0095e290
add esp, 0xc
mov eax, 1
jmp 0x97245b