Function at 0x1000e5a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002671c
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x10031040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
test byte [0x10034608], 1
mov esi, ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x424], edi
jne 0x1000e612
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
or dword [0x10034608], 1
mov ecx, section..data
call edx
add eax, 0x10
push 0x100273b0
mov dword [0x10034604], eax
call fcn.10017df9
add esp, 4
mov eax, dword [0x10034604]
cmp dword [eax - 0xc], edi
je 0x1000e62e
add eax, 0xfffffff0
call fcn.10001cf0
add eax, 0x10
mov dword [esi], eax
jmp 0x1000e9e6
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x418]
push eax
push pe_nt_image_headers32
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ecx, ecx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ecx
cmp eax, edi
jbe 0x1000e976
jmp 0x1000e670
movzx eax, word [ebp + ecx*2 - 0x418]
cmp eax, 0x61
jb 0x1000e682
cmp eax, 0x7a
jbe 0x1000e694
cmp eax, 0x41
jb 0x1000e957
cmp eax, 0x5a
ja 0x1000e957
mov edx, dword [section..data]
mov word [ebp - 0x24], ax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x420], esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
test ecx, 0xffff0000
jne 0x1000e6e1
mov edx, ecx
movzx edi, dx
call fcn.10014dc0
test eax, eax
je 0x1000e70e
push eax
mov eax, edi
lea edi, [ebp - 0x420]
call fcn.10013570
jmp 0x1000e708
lea eax, [ebp - 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000e6e7
sub eax, edx
lea ecx, [ebp - 0x24]
sar eax, 1
push ecx
lea edx, [ebp - 0x420]
push edx
mov ebx, eax
call fcn.10001be0
mov esi, dword [ebp - 0x420]
push 0x1f0
lea eax, [ebp - 0x214]
push 0
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x218], 0
call fcn.10018f30
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x41c]
push edx
mov ebx, 0x1002a560
call fcn.100019a0
add esp, 0x14
push 0x1f4
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0
push 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x41c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000e780
sub eax, edx
lea edx, [ebp - 0x218]
sar eax, 1
push edx
lea ecx, [ebp - 0x41c]
push ecx
mov ebx, eax
call fcn.10001be0
mov edx, dword [ebp - 0x41c]
mov edi, dword [edx - 0xc]
test edi, edi
js 0x1000e9a2
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, edi
or eax, ecx
jge 0x1000e7d9
mov eax, edi
lea ecx, [ebp - 0x41c]
call fcn.10001c90
mov edx, dword [ebp - 0x41c]
lea eax, [edi + 1]
push eax
push edx
call fcn.100179e0
mov eax, dword [ebp - 0x41c]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x1000e9a2
mov dword [eax - 0xc], edi
mov edx, dword [ebp - 0x41c]
xor ecx, ecx
mov word [edx + edi*2], cx
mov edi, dword [ebp - 0x41c]
mov ecx, str.ntfs
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000e837
test dx, dx
je 0x1000e833
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000e837
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000e811
xor eax, eax
jmp 0x1000e83c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x1000e89c
mov ecx, 0x1002b534
mov eax, edi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000e876
test dx, dx
je 0x1000e872
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000e876
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000e850
xor eax, eax
jmp 0x1000e87b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x1000e89c
lea eax, [ebp - 0x41c]
push eax
mov ecx, str.fat32
call fcn.10011900
add esp, 4
test al, al
je 0x1000e90e
mov ecx, dword [0x10034604]
cmp dword [ecx - 0xc], 0
jne 0x1000e8b9
mov eax, dword [esi - 0xc]
push eax
push esi
mov ebx, 0x10034604
call fcn.10001d60
jmp 0x1000e90e
lea edx, [ebp - 0x42c]
push 0x1002abb0
push edx
lea ecx, [ebp - 0x420]
call fcn.10011820
add esp, 8
mov byte [ebp - 4], 3
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ebx, 0x10034604
call fcn.10001d60
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000e90e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000e934
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000e957
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x428]
inc ecx
mov dword [ebp - 0x428], ecx
cmp ecx, dword [ebp - 0x424]
jb 0x1000e670
mov esi, dword [ebp - 0x430]
mov edi, dword [0x10034604]
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [edi - 4], 0
lea ecx, [edi - 4]
jl 0x1000e9ac
cmp eax, dword [edi - 0x10]
jne 0x1000e9ac
lea ebx, [edi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x1000e9e1
push 0x80070057
call fcn.10001ef0
mov ecx, dword [edi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
jne 0x1000e9c5
call fcn.10001e20
mov eax, dword [edi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [edi - 0xc]
lea eax, [eax + eax + 2]
push eax
push edi
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.10017a68
add esp, 0x10
add ebx, 0x10
mov dword [esi], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017423
mov esp, ebp
pop ebp
ret