Function at 0x43f8a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
push 0x18
xor esi, esi
mov dword [ebp - 0x20], ebx
pop ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x28], esi
call fcn.00437b16
lea ecx, [ebp - 0x3c]
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x2c], eax
call fcn.00431146
push ecx
push 8
push str.RootPath
mov ecx, ebx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
call fcn.0043b6e0
mov esi, eax
call fcn.0043d5bb
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043bbe8
mov esi, dword [esi + 4]
mov edx, 0x4934ec
test esi, esi
jne 0x43f912
mov esi, edx
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, esp
push edx
call fcn.0043c2b8
mov edx, esi
mov ecx, edi
call fcn.0043eb33
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x43fe76
call fcn.0043d5bb
push eax
lea ecx, [ebp - 8]
call fcn.0043bbe8
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], edi
jl 0x43fea2
movzx edx, word [eax]
push 3
pop ebx
mov dword [ebp - 0x14], ebx
push 0x5c
pop edi
cmp edx, 0x2a
jne 0x43fa0b
cmp dword [eax - 0xc], 1
jl 0x43fea2
lea edi, [eax + 2]
movzx ecx, word [edi]
mov dword [ebp - 0x18], edi
test cx, cx
je 0x43f989
mov eax, ecx
push 0x5c
pop ecx
cmp ax, cx
jne 0x43fa47
mov esi, 0x49af24
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp - 8]
call fcn.0043c867
mov esi, dword [ebp - 8]
cmp dword [esi - 4], 1
jle 0x43f9fe
push dword [esi - 0xc]
lea ecx, [ebp - 8]
call fcn.0043d715
mov esi, dword [ebp - 8]
jmp 0x43f9fe
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, ebx
jne 0x43f9fb
xor eax, eax
lea edx, [ebp - 8]
push eax
push edi
lea ecx, [ebp - 0xc]
call fcn.0043baed
mov ecx, esp
push 0x4934ec
mov edi, dword [eax]
call fcn.0043c2b8
lea edx, [ebp - 0x3c]
mov ecx, edi
call fcn.0044b695
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov edi, dword [ebp - 0x18]
inc word [esi]
push 0x5a
pop eax
cmp word [esi], ax
jbe 0x43f9b9
jmp 0x43facc
cmp edx, 0x25
jne 0x43fa4a
lea ecx, [ebp - 0xc]
xor ebx, ebx
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
call sym.Dismx86.exe_DismExpandEnvironmentStrings
push dword [ebp - 0xc]
test eax, eax
je 0x43fa34
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [ebp - 8]
jmp 0x43fa62
lea ecx, [ebp - 8]
call fcn.0043c8e4
push dword [ebp - 0xc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x43fa58
push 0x5c
pop edi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 8]
call fcn.0043c5cb
xor ebx, ebx
mov esi, dword [ebp - 8]
mov eax, dword [esi - 0xc]
test eax, eax
jne 0x43fa6c
mov edi, 0x80004005
jmp 0x43fe6e
dec eax
lea ecx, [ebp - 8]
push eax
call fcn.0043b8a7
cmp ax, di
je 0x43fa87
push edi
lea ecx, [ebp - 8]
call fcn.0043c971
mov esi, dword [ebp - 8]
push 0x208
lea eax, [ebp - 0x26c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x26c]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
push ebx
push ecx
mov ecx, esp
lea edi, [ebp - 0x3c]
push 0x4934ec
lea ebx, [ebp - 0x26c]
call fcn.0043c2b8
mov edx, edi
mov ecx, ebx
call fcn.0044b695
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
call fcn.0044316c
xor ebx, ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x40], ebx
call fcn.0044316c
mov dword [ebp - 0x4c], ebx
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebx + 0x1c]
test edi, edi
je 0x43fb5c
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpW]
cmp dword [edi + 0x18], 1
jne 0x43fb52
mov eax, dword [edi]
test eax, eax
jne 0x43fb05
mov eax, 0x4934ec
push str.Query
push eax
call ebx
test eax, eax
jne 0x43fb22
mov eax, dword [edi + 4]
test eax, eax
jne 0x43fb1d
mov eax, 0x4934ec
lea ecx, [ebp - 0x48]
jmp 0x43fb4c
mov eax, dword [edi]
test eax, eax
jne 0x43fb2d
mov eax, 0x4934ec
push str.Excluded
push eax
call ebx
test eax, eax
jne 0x43fcc6
mov eax, dword [edi + 4]
test eax, eax
jne 0x43fb49
mov eax, 0x4934ec
lea ecx, [ebp - 0x54]
push eax
call fcn.0043db3f
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x43faf4
mov ebx, dword [ebp - 0x20]
cmp dword [ebp - 0x44], 0
jne 0x43fb6f
push 0x48f330
lea ecx, [ebp - 0x48]
call fcn.0043db3f
push ecx
push 5
xor edi, edi
mov ecx, ebx
push str.Flags
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call fcn.0043b6e0
test eax, eax
je 0x43fc15
mov dword [ebp - 0x14], edi
mov edi, dword [eax + 4]
test edi, edi
jne 0x43fb9d
mov edi, 0x4934ec
xor eax, eax
cmp word [edi], ax
je 0x43fc15
push 0x7c
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ebx, eax
test ebx, ebx
je 0x43fbb9
sub eax, edi
sar eax, 1
jmp 0x43fbc0
mov ecx, edi
call fcn.0044ccce
cmp eax, 4
jne 0x43fbdd
push eax
push edi
push str.File
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x43fcc6
inc eax
jmp 0x43fbfe
cmp eax, 9
jne 0x43fcc6
push eax
push edi
push str.Directory
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x43fcc6
push 2
pop eax
or eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
test ebx, ebx
je 0x43fc15
lea edi, [ebx + 2]
xor ecx, ecx
cmp word [edi], cx
jne 0x43fba4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax + 0xd], 0
jne 0x43fcd0
mov esi, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
sub ecx, 0x10
call fcn.0043cad2
lea ecx, [ebp - 0xc]
lea edi, [eax + 0x10]
mov eax, dword [edi - 0xc]
dec eax
mov dword [ebp - 0xc], edi
push eax
call fcn.0043b8a7
push 0x5c
pop ecx
cmp ax, cx
je 0x43fc5c
push ecx
lea ecx, [ebp - 0xc]
call fcn.0043c971
mov edi, dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x54]
neg eax
push esi
sbb eax, eax
and eax, ecx
push ecx
lea ecx, [edi - 0x10]
mov dword [ebp - 0x18], eax
mov ebx, esp
call fcn.0043cad2
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x48]
add eax, 0x10
mov dword [ebx], eax
call fcn.0043f78a
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43fca4
mov eax, dword [ebp - 0x34]
add dword [ebx], eax
mov eax, dword [ebp - 0x30]
adc dword [ebx + 4], eax
lea ecx, [edi - 0x10]
call fcn.0043d912
lea ecx, [ebp - 0x20]
call fcn.00430288
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0xd], 0
je 0x43fc2a
mov esi, dword [ebp - 8]
jmp 0x43fcd3
mov edi, 0x80004005
jmp 0x43fe5e
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 0x2c]
mov edi, dword [edi]
test ebx, ebx
je 0x43fd84
cmp byte [edi + 0xd], 0
mov dword [ebp - 0x10], edi
jne 0x43fe5a
xor eax, eax
mov esi, eax
mov ecx, dword [edi + 0x10]
sub ecx, 0x10
call fcn.0043cad2
add eax, 0x10
mov edi, dword [edi + 0x14]
push 0x5a
mov dword [ebp + 8], eax
xor edx, edx
pop eax
push dword [ebp + 0x10]
add esi, eax
xor eax, eax
push eax
mov eax, esi
div dword [ebp - 0x28]
add eax, 0xa
push eax
push 0x9478
call dword [ebp + 0xc]
push dword [ebp + 0x10]
xor eax, eax
push eax
push dword [ebp + 8]
push 0x9479
call dword [ebp + 0xc]
push dword [ebp + 0x10]
xor eax, eax
push dword [ebp + 8]
push eax
push 0x9089
call dword [ebp + 0xc]
cmp edi, 2
jne 0x43fd5f
mov ecx, dword [ebp + 8]
call fcn.0044d1ca
add eax, 4
push 0
pop ecx
adc edx, ecx
add dword [ebx], eax
adc dword [ebx + 4], edx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea ecx, [ebp - 0x10]
call fcn.00430288
mov edi, dword [ebp - 0x10]
cmp byte [edi + 0xd], 0
je 0x43fcf1
jmp 0x43fe57
cmp byte [edi + 0xd], 0
mov dword [ebp + 8], edi
jne 0x43fe5a
xor eax, eax
mov esi, eax
mov ecx, dword [edi + 0x10]
sub ecx, 0x10
call fcn.0043cad2
push 0x5a
xor edx, edx
lea ebx, [eax + 0x10]
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x20], eax
xor edi, edi
pop eax
add esi, eax
mov dword [ebp - 0x24], ebx
mov eax, esi
div dword [ebp - 0x28]
push dword [ebp + 0x10]
add eax, 0xa
push edi
push eax
push 0x9478
call dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
push ebx
push 0x9479
call dword [ebp + 0xc]
mov ecx, ebx
call fcn.0044d546
test eax, eax
je 0x43fe3a
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
lea eax, [ebp - 0x10]
push 0x49af60
push eax
call fcn.0044af44
add esp, 0xc
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x18]
push eax
call fcn.00431d91
pop ecx
push dword [eax]
push 0x49af80
push 1
call dword [sym.imp.CBSHost.dll_DismWriteLog]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push dword [ebp + 0x10]
push ebx
push edi
push 0x9089
call dword [ebp + 0xc]
lea ecx, [ebx - 0x10]
call fcn.0043d912
lea ecx, [ebp + 8]
call fcn.00430288
mov edi, dword [ebp + 8]
cmp byte [edi + 0xd], 0
je 0x43fd95
mov esi, dword [ebp - 8]
xor eax, eax
mov edi, eax
lea ecx, [ebp - 0x54]
call fcn.0043dbd5
lea ecx, [ebp - 0x48]
call fcn.0043dbd5
lea ecx, [esi - 0x10]
call fcn.0043d912
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0043d912
lea ecx, [ebp - 0x60]
call fcn.004316fe
lea ecx, [ebp - 0x3c]
call fcn.00430407
lea ecx, [ebp - 0x2c]
call fcn.0043b4fb
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0x80070057
call fcn.0043d861
int3