Function at 0x104953d
Capabilities:
Get disk information
Get file system object information

Disassembly:
mov eax, reloc.ADVAPI32.dll_AddAccessAllowedAce
call fcn.01077868
mov eax, 0x24cc
call fcn.01077a20
mov eax, dword [0x10de03c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
movzx eax, byte [esi + 0x30]
push edi
and eax, 0xffffff7f
dec eax
push 0x29
pop edi
je 0x1049641
dec eax
je 0x1049612
dec eax
je 0x10495d7
dec eax
je 0x104959d
dec eax
dec eax
je 0x1049596
sub eax, 0x51
je 0x1049641
push 5
jmp 0x1049693
push 0xa
jmp 0x1049693
movzx eax, byte [esi + 0x31]
sub eax, 0
je 0x10495d0
dec eax
je 0x10495c9
sub eax, 6
je 0x10495c2
dec eax
je 0x10495bb
dec eax
jne 0x10495d0
push 0x19
jmp 0x1049693
push 0x18
jmp 0x1049693
push 0x1a
jmp 0x1049693
push reloc.KERNEL32.dll_GetLocaleInfoW
jmp 0x1049693
push GetLocaleInfoW
jmp 0x1049693
movzx eax, byte [esi + 0x31]
dec eax
je 0x104960b
dec eax
je 0x1049604
dec eax
je 0x10495fd
dec eax
dec eax
je 0x10495f6
dec eax
jne 0x1049694
push 0x17
jmp 0x1049693
push 0x16
jmp 0x1049693
push 0x15
jmp 0x1049693
push 0x14
jmp 0x1049693
push 0x13
jmp 0x1049693
test byte [esi + 0x60], 2
je 0x1049691
movzx eax, byte [esi + 0x31]
sub eax, 0
je 0x104963d
dec eax
je 0x1049639
dec eax
je 0x1049635
dec eax
je 0x1049631
dec eax
jne 0x1049694
push LoadLibraryW
jmp 0x1049693
push 0xe
jmp 0x1049693
push reloc.KERNEL32.dll_LoadLibraryW
jmp 0x1049693
push 0xd
jmp 0x1049693
push 0xc
jmp 0x1049693
mov al, byte [esi + 0x31]
cmp al, 1
je 0x1049691
cmp al, 2
je 0x1049691
mov eax, dword [0x1004ba0]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1004ba4]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x34]
mov ax, word [eax]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
dec eax
je 0x104968d
dec eax
je 0x1049689
dec eax
je 0x104958f
dec eax
jne 0x104958f
push 4
jmp 0x1049693
push 3
jmp 0x1049693
push 2
jmp 0x1049693
push 0x11
pop edi
lea eax, [edi - 2]
cmp eax, 0x1a
ja case.0x10496a7.6
movzx eax, byte [eax + 0x1049d02]
jmp dword [eax*4 + 0x1049cbe]
lea ecx, [ebp - 0x24d8]
call fcn.01075f2c
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 3
je 0x104979d
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
lea ecx, [ebp - 0x220]
push ecx
push esi
call dword [eax + 0x10e6ca4]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x24d8]
call fcn.01075f20
push 0x5c
lea ecx, [ebp - 0x24d8]
call fcn.01076964
push 0x200
push 0x2b4
lea eax, [ebp - 0x24d4]
push eax
push 0
push dword [ebp - 0x24d8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x104973f
push 0x104
lea eax, [ebp - 0x24c8]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x104975e
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 0
push CompareStringW
lea ecx, [ebp - 0x220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x70
call fcn.010760ac
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x1049797
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push esi
call dword [eax + 0x10e6dc0]
mov ecx, dword [ebp - 0x14]
push eax
push esi
push ebx
lea eax, [ebp - 0x220]
push eax
push edi
call fcn.010478eb
jmp 0x1049799
xor eax, eax
mov esi, eax
jmp 0x104979f
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24d8]
call fcn.01075ef0
mov eax, esi
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x70
call fcn.010760ac
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov dword [ebp - 4], 2
je case.0x10496a7.6
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push esi
call dword [eax + 0x10e6dc0]
mov ecx, dword [ebp - 0x14]
push eax
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
push edi
call fcn.010478eb
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x50
call fcn.010760ac
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov dword [ebp - 4], 3
je case.0x10496a7.6
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push esi
call dword [eax + 0x10e6dc0]
mov ecx, dword [ebp - 0x14]
push eax
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
push edi
call fcn.01047527
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x50
call fcn.010760ac
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov dword [ebp - 4], 4
je case.0x10496a7.6
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push esi
call dword [eax + 0x10e6dc0]
mov ecx, dword [ebp - 0x14]
push eax
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
push edi
call fcn.01047565
jmp 0x1049ca5
cmp dword [ebp + 0x10], 1
jne case.0x10496a7.6
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x50
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 5
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.010474b0
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x50
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 6
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.010477df
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x50
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 7
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.0104780b
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x50
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 8
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047837
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x50
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 9
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047863
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x50
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 0xa
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.0104788f
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x58
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], LoadLibraryW
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047db3
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
cmp eax, 0x18
push 0x58
jne 0x1049b61
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], LoadLibraryW
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047ddf
jmp 0x1049ca5
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], LoadLibraryW
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047ddf
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
cmp eax, 0x19
push 0x58
jne 0x1049be8
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], LoadLibraryW
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047e0b
jmp 0x1049ca5
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], LoadLibraryW
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047e0b
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x58
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], reloc.KERNEL32.dll_LoadLibraryW
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047e37
jmp 0x1049ca5
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6ca0]
push 0x58
call fcn.010760ac
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 0x11
je case.0x10496a7.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047e63
jmp 0x1049ca5
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01075bbb
leave
ret 0xc