Function at 0x471440
Capabilities:
Get disk information
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488e7d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x235c
call fcn.0040f8c0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
cmp eax, ebx
mov dword [0x4e3a64], eax
je 0x47149e
push str.SetFileShortNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x4e3280], eax
je 0x47149e
mov dword [0x4e3a60], 1
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x471618
call fcn.00457af0
test eax, eax
jne 0x471618
mov ecx, 0x2f1
lea edi, [ebp - 0x236c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x236c], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 4], ebx
je 0x4714f2
push eax
push 0x12c
lea ecx, [ebp - 0x2368]
push ecx
call fcn.0040120a
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x47150b
push eax
push 0x12c
lea edx, [ebp - 0x2110]
push edx
call fcn.0040120a
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x471524
push eax
push 0x12c
lea eax, [ebp - 0x1eb8]
push eax
call fcn.0040120a
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x47153d
push eax
push 0x12c
lea ecx, [ebp - 0x1c60]
push ecx
call fcn.0040120a
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x1a04], eax
mov eax, dword [ebp + 0x24]
cmp eax, ebx
mov dword [ebp - 0x1a08], edx
je 0x471568
push eax
push 0x12c
lea ecx, [ebp - 0x1a00]
push ecx
call fcn.0040120a
push 0x70
call sub.MSVCR71.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x4715a2
push 1
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str..pipeRRNovaPipe
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ebx
push ebx
mov ecx, esi
call fcn.00469770
mov esi, eax
jmp 0x4715a4
xor esi, esi
cmp esi, ebx
mov byte [ebp - 4], bl
je 0x4715ec
mov ecx, esi
call fcn.00468470
cmp al, bl
je 0x4715dc
push 0xffffffffffffffff
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x14]
push eax
push 0xbc4
lea ecx, [ebp - 0x236c]
push ecx
push 0x2d
mov ecx, esi
mov dword [ebp - 0x24], 4
call fcn.00468480
mov ecx, esi
call fcn.004687f0
push esi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp - 0x738], bx
mov ecx, 0x95
lea edi, [ebp - 0x736]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x17a8], bx
mov ecx, 0x95
lea edi, [ebp - 0x17a6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0xc84], bx
mov ecx, 0x95
lea edi, [ebp - 0xc82]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x288], bx
mov ecx, 0x95
lea edi, [ebp - 0x286]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0xedc], bx
mov ecx, 0x95
lea edi, [ebp - 0xeda]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [ebp + 0xc]
mov dx, word [esi]
xor eax, eax
mov word [ebp - 0x4e0], bx
mov ecx, 0x95
lea edi, [ebp - 0x4de]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x1348], bx
mov ecx, 0x81
lea edi, [ebp - 0x1346]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x1550], bx
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x154e]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x14], dx
mov dword [ebp - 0x20], 0xffffffff
stosw word es:[edi], ax
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_5]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 3
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_5]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x24]
mov dword [0x4e3a5c], edi
mov ax, word [esi]
mov word [0x4e3270], ax
mov eax, dword [ebp + 0x18]
mov cx, word [eax]
push edx
mov edx, dword [ebp + 0x1c]
mov word [0x4e327c], cx
mov ecx, dword [ebp + 0x20]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
push eax
mov eax, dword [ebp + 0x14]
push eax
push ecx
mov byte [ebp - 4], 4
push esi
push edi
push str.RescueFile_level_d__driveletter_s__destination_s__filename_s__newfilename_s__device_d__loadtoc_d__commondir_s
push str.Uber
call fcn.004572b0
mov edx, dword [ebp + 0x18]
movzx eax, word [edx]
push eax
push str._c:_
lea ecx, [ebp - 0x1550]
push 0x208
push ecx
call fcn.00403fa3
add esp, 0x38
push 0x208
lea edx, [ebp - 0x1348]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1550]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea ecx, [ebp - 0x1348]
push str.ntfs
push ecx
call dword [sym.imp.MSVCR71.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4717b2
mov dword [0x4e3a88], 1
cmp dword [ebp + 0x1c], 2
jne 0x4718f1
mov edx, dword [ebp + 0x10]
xor eax, eax
mov ax, word [edx]
mov word [0x4e3a74], ax
mov word [0x4e32a4], ax
push eax
call fcn.004598f0
add esp, 4
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_2]
mov eax, dword [ebp - 0x18]
movzx ecx, word [0x4e3a74]
push eax
push ecx
push str._c:_s
push 0x258
push 0x4e3800
call fcn.00403fa3
mov edx, dword [ebp + 0x18]
movzx eax, word [edx]
push eax
push str._c:_
lea ecx, [ebp - 0x288]
push 0x258
push ecx
call fcn.00403fa3
push 0x4e3aa8
lea edx, [ebp - 0x288]
push edx
push 0x4a40f8
lea eax, [ebp - 0xedc]
push 0x258
push eax
call fcn.00403fa3
push 0x4e3eb8
lea ecx, [ebp - 0x288]
push ecx
push 0x4a40f8
lea edx, [ebp - 0x4e0]
push 0x258
push edx
call fcn.00403fa3
movzx esi, word [ebp - 0x14]
add esp, 0x4c
push esi
push 0x4e3800
push str._s_c
push 0x258
push 0x4e3508
call fcn.00403fa3
push edi
push esi
push 0x4e3800
push str._s_c_d
push 0x258
push 0x4e32b0
call fcn.00403fa3
mov eax, dword [ebp + 0x20]
add esp, 0x2c
cmp eax, ebx
je 0x47194f
push 1
push 0x4e3270
push 0x4e3800
push 0x258
lea edx, [ebp - 0x288]
push 0x4e32b0
push edx
call sub.ui.dll_CopyHeadersToTempDir
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x47194f
push edi
push str.Aborting_RescueFile___Could_not_copy_all_the_necessary_header_files_from_CD_to_temp_directory___dwRet__0x_08x
push str.Verbatim
call fcn.004572b0
add esp, 0xc
jmp 0x471e30
mov eax, dword [ebp + 0x10]
push eax
push 0x48c7b8
push 0x258
push 0x4e3800
call fcn.00403fa3
mov cx, word [esi]
movzx esi, word [ebp - 0x14]
push esi
push 0x4e3800
push str._s_c
push 0x258
push 0x4e3508
mov word [0x4e32a4], cx
call fcn.00403fa3
push edi
push esi
push 0x4e3800
push str._s_c_d
push 0x258
push 0x4e32b0
call fcn.00403fa3
add esp, 0x3c
mov eax, dword [0x4e3a5c]
cmp dword [ebp + 0x1c], 2
je 0x4719a5
push 0x4e3aa8
push eax
push 0x4e3508
push str._s_d_s
lea eax, [ebp - 0xedc]
push 0x258
push eax
call fcn.00403fa3
mov ecx, dword [0x4e3a5c]
push 0x4e3eb8
push ecx
push 0x4e3508
push str._s_d_s
lea edx, [ebp - 0x4e0]
push 0x258
push edx
call fcn.00403fa3
add esp, 0x30
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0x1140]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push edx
lea eax, [ebp - 0x4e0]
push eax
lea ecx, [ebp - 0xedc]
push ecx
call fcn.00471fe0
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x471d5b
lea edx, [ebp - 0x1140]
push edx
call fcn.00471f00
add esp, 4
test eax, eax
je 0x471a6b
push 0x4e3aa8
push ebx
push esi
push 0x48d1bc
push 0x4e3800
push str._s_s_c_d_s
lea eax, [ebp - 0xedc]
push 0x258
push eax
call fcn.00403fa3
push 0x4e3eb8
push ebx
push esi
push 0x48d1bc
push 0x4e3800
push str._s_s_c_d_s
lea ecx, [ebp - 0x4e0]
push 0x258
push ecx
call fcn.00403fa3
mov ecx, dword [ebp + 0x14]
add esp, 0x40
lea edx, [ebp - 0x1140]
push edx
lea eax, [ebp - 0x1c]
push eax
push ecx
lea edx, [ebp - 0x4e0]
push edx
lea eax, [ebp - 0xedc]
push eax
call fcn.00471fe0
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x471d6a
lea ecx, [ebp - 0x1140]
push ecx
call fcn.00471ec0
add esp, 4
test eax, eax
jne 0x471aa9
lea edx, [ebp - 0x1140]
push edx
call fcn.00471f00
add esp, 4
test eax, eax
jne 0x471aa9
mov eax, dword [0x4e3a5c]
cmp eax, ebx
jle 0x471d79
dec eax
mov dword [0x4e3a5c], eax
jmp 0x471954
mov esi, dword [ebp + 0x1c]
cmp esi, 2
push str.Info
jne 0x471afa
lea eax, [ebp - 0x288]
push eax
push 0x4a40f8
lea ecx, [ebp - 0x738]
push 0x258
push ecx
call fcn.00403fa3
push str.pu.dat
lea edx, [ebp - 0x288]
push edx
push 0x4a40f8
lea eax, [ebp - 0xc84]
push 0x258
push eax
call fcn.00403fa3
add esp, 0x28
jmp 0x471b72
mov ecx, dword [0x4e3a5c]
movzx edx, word [0x4e32a4]
push ecx
push edx
push 0x4e3800
push str._s_c_d_s
lea eax, [ebp - 0x738]
push 0x258
push eax
call fcn.00403fa3
mov eax, dword [ebp + 0x24]
add esp, 0x1c
cmp eax, ebx
push str.pu.dat
je 0x471b4f
push eax
push 0x48be08
lea ecx, [ebp - 0xc84]
push 0x258
push ecx
call fcn.00403fa3
add esp, 0x14
jmp 0x471b72
push str.common
push 0x4e3800
push str._s_s_s
lea edx, [ebp - 0xc84]
push 0x258
push edx
call fcn.00403fa3
add esp, 0x18
mov eax, dword [ebp + 0x18]
push eax
push 0x12c
lea ecx, [ebp - 0x17a8]
push ecx
call fcn.0040120a
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
lea edx, [ebp - 0x738]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, eax
cmp edx, 0xffffffff
mov dword [ebp - 0x20], edx
je 0x471d99
xor eax, eax
push ebx
mov ecx, 0xbd
lea edi, [ebp - 0xa2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push 0x2f4
lea ecx, [ebp - 0xa2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x471dc1
cmp dword [ebp - 0xa2c], ebx
je 0x471bee
mov dword [0x4e3774], 1
cmp esi, 2
je 0x471c04
mov eax, dword [ebp - 0x73c]
cmp eax, 0x3000100
jne 0x471de9
mov edx, dword [0x4e3a5c]
push edx
push 0x4e3508
push str._s_d
push 0x258
push 0x4e32b0
call fcn.00403fa3
mov eax, dword [ebp - 0x740]
add esp, 0x14
cmp eax, ebx
je 0x471c64
cmp dword [0x4e40d4], ebx
je 0x471df7
mov ecx, 0x20
mov eax, 0xacacacac
mov edi, 0x4e3780
rep stosd dword es:[edi], eax
mov ecx, 8
mov esi, 0x4e3284
mov edi, 0x4e3780
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x1c]
jmp 0x471c69
call fcn.00474820
cmp dword [ebp - 0x7f0], ebx
je 0x471c94
push ecx
lea eax, [ebp - 0xc84]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
call fcn.00401fc2
add esp, 4
cmp eax, ebx
jne 0x471e11
lea ecx, [ebp - 0xa2c]
push ecx
call fcn.00472390
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x471e30
lea edx, [ebp - 0x1140]
push edx
call fcn.00471f00
add esp, 4
test eax, eax
je 0x471d31
push 0x48d1bc
push 0x4e3800
push 0x48be08
push 0x258
push 0x4e3800
call fcn.00403fa3
movzx eax, word [0x4e32a4]
push eax
push 0x4e3800
push str._s_c
push 0x258
push 0x4e3508
call fcn.00403fa3
push 0x4e3508
push str._s0
push 0x258
push 0x4e32b0
call fcn.00403fa3
add esp, 0x38
mov dword [0x4e3a5c], ebx
mov dword [0x4e3a94], 1
mov dword [ebp - 0xa00], ebx
push esi
push 0x258
lea ecx, [ebp - 0x17a8]
push ecx
lea edx, [ebp - 0xa2c]
push edx
lea eax, [ebp - 0x1140]
push eax
call fcn.00470ad0
add esp, 0x14
mov edi, eax
jmp 0x471e30
mov ecx, dword [ebp + 0x14]
push edi
push ecx
push str.RescueFile_failed_for_file__s___unable_to_find_TOC_entry___dwRet__0x_08x
jmp 0x471e23
mov edx, dword [ebp + 0x14]
push edi
push edx
push str.RescueFile_failed_for_file__s___Unable_to_find_TOC_entry_in_the_SIS_folder___dwRet__0x_08x
jmp 0x471e23
mov eax, dword [ebp + 0x14]
push eax
push str.RescueFile_failed___Unable_to_find_backup_data_for__s_in_any_level
push str.Verbatim
call fcn.004572b0
add esp, 0xc
mov edi, 0x548
jmp 0x471e30
mov edi, 0x509
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea ecx, [ebp - 0x738]
push ecx
push str.RescueFile_failed___unable_to_create_header_file__s___dwRet__0x_08x___WinRC__0x_08x
push str.Verbatim
call fcn.004572b0
add esp, 0x14
jmp 0x471e30
mov edi, 0x50a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea edx, [ebp - 0x738]
push edx
push str.RescueFile_failed___unable_to_read_header_file__s___dwRet__0x_08x___WinRC__0x_08x
push str.Verbatim
call fcn.004572b0
add esp, 0x14
jmp 0x471e30
mov edi, 0x588
push edi
push eax
push str.RescueFile_failed___trying_to_rescue_from_a_prior_version_of_backup___version__0x_08x___dwRet___0x_08x
jmp 0x471e23
mov edi, 0x5a7
push edi
push str.Unable_to_rescue_file_on_a_backup_that_is_CSS_encrypted___dwRet__0x_08x
push str.Engine
call fcn.004572b0
add esp, 0xc
jmp 0x471e30
mov edi, 0x570
push edi
lea eax, [ebp - 0xc84]
push eax
push str.RescueFile_failed.__The_UUID_check_for__s_does_not_match_the_machines_UUID_that_was_backed_up___dwRet__0x_08x
push str.Verbatim
call fcn.004572b0
add esp, 0x10
lea ecx, [ebp - 0x20]
push ecx
call fcn.00471f40
push edi
push str.RescueFile_exits_with_dwRet__0x_08x
push str.Uber
call fcn.004572b0
add esp, 0x10
lea ecx, [ebp - 0x30]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [ebp - 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret