Function at 0x10051fa
Capabilities:
Get disk information

Disassembly:
push 0x37c
push 0x1001b08
call fcn.010058f0
mov eax, dword [0x100704c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x180], eax
mov edi, ecx
mov dword [ebp - 0x190], edi
xor ebx, ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x17c], ebx
mov esi, dword [sym.imp.msvcrt.dll_wcscpy]
cmp eax, ebx
je 0x100525c
push 0x1001584
push eax
call esi
pop ecx
pop ecx
cmp edi, ebx
je 0x100526a
push 0x1001584
push edi
call esi
pop ecx
pop ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x178]
push eax
push 0x10c
call fcn.01001cc0
test eax, eax
jne 0x100529f
push 0x6b
push 0x1001a3c
push 0x1001ab8
call fcn.010046c6
jmp 0x1005456
mov dword [ebp - 0x1a4], ebx
xor eax, eax
lea edi, [ebp - 0x1a0]
stosd dword es:[edi], eax
push 4
push 0x3a
push dword [ebp - 0x17c]
lea eax, [ebp - 0x1a4]
push eax
push dword [ebp - 0x188]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov dword [ebp - 0x1a8], eax
cmp eax, ebx
jl 0x1005456
mov eax, dword [ebp - 0x17c]
test byte [eax + 4], 0x1a
jne 0x1005456
cmp dword [ebp + 0xc], 2
jne 0x100537f
mov dword [ebp - 0x184], ebx
push ebx
lea eax, [ebp - 0x198]
push eax
push 0x1e0
lea eax, [ebp - 0x38c]
push eax
push ebx
push ebx
push 0x2d0c00
push dword [ebp - 0x188]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1005379
mov eax, dword [ebp - 0x198]
xor edx, edx
push 0x18
pop ecx
div ecx
mov dword [ebp - 0x184], eax
xor eax, eax
mov dword [ebp - 0x194], eax
cmp eax, dword [ebp - 0x184]
jae 0x100537f
lea ecx, [eax + eax*2]
mov ecx, dword [ebp + ecx*8 - 0x384]
cmp ecx, 4
je 0x1005376
cmp ecx, 0xb
jle 0x1005456
cmp ecx, 0xd
jle 0x1005376
cmp ecx, 0x13
jle 0x1005456
cmp ecx, 0x15
jg 0x1005456
inc eax
jmp 0x1005339
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x19c]
push edi
lea eax, [ebp - 0xac]
push eax
call esi
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0xc
cmp word [edi + eax*2 - 2], 0x5c
je 0x10053bb
push 0x10011fc
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
push 0x14
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push ebx
push 0x64
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [ebp - 0x1ac], eax
cmp eax, ebx
je 0x1005456
cmp dword [ebp - 0x180], ebx
je 0x10053fd
lea eax, [ebp - 0x174]
push eax
push dword [ebp - 0x180]
call esi
pop ecx
pop ecx
cmp dword [ebp - 0x190], ebx
je 0x1005413
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x190]
call esi
pop ecx
pop ecx
push 0x1001534
lea eax, [ebp - 0x44]
push eax
mov esi, dword [sym.imp.msvcrt.dll_wcscmp]
call esi
pop ecx
pop ecx
test eax, eax
je 0x100544c
push 0x1001518
lea eax, [ebp - 0x44]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x100544c
push 0x100150c
lea eax, [ebp - 0x44]
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1005456
mov dword [ebp - 0x18c], 1
or dword [ebp - 4], 0xffffffff
call fcn.01005477
mov eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x1c]
call fcn.01005656
call fcn.0100592b
ret 0x10