Function at 0x10004f40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cbadb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1564
call fcn.100b7e70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1574], ecx
push str.CFusionFileSpy::Run_____Loading_Driver
call fcn.10010cb0
add esp, 4
mov ecx, dword [ebp - 0x1574]
call fcn.10004f10
movzx eax, al
test eax, eax
jne 0x10004fa8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Still_attempting_to_load_driver
call fcn.10010cb0
add esp, 4
jmp 0x10004f7c
push str.CFusionFileSpy::Run_____Loading_logger
call fcn.10010cb0
add esp, 4
push str.FileMonitorDrvEvent
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x458], eax
mov ecx, dword [ebp - 0x458]
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x52c], 0
push 0x400
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x14fc], eax
mov edx, dword [ebp - 0x14fc]
mov dword [ebp - 0x454], edx
push 0x400
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x1500], eax
mov eax, dword [ebp - 0x1500]
mov dword [ebp - 0x21c], eax
mov ecx, 0x41
mov word [ebp - 0x224], cx
mov edx, 0x3a
mov word [ebp - 0x222], dx
xor eax, eax
mov word [ebp - 0x220], ax
mov dword [ebp - 0x534], 0
jmp 0x1000505d
mov ecx, dword [ebp - 0x534]
add ecx, 1
mov dword [ebp - 0x534], ecx
cmp dword [ebp - 0x534], 0x1a
jge 0x10005195
push 0x80
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x1504], eax
mov edx, dword [ebp - 0x534]
mov eax, dword [ebp - 0x1504]
mov dword [ebp + edx*4 - 0x528], eax
push 0x80
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x1508], eax
mov ecx, dword [ebp - 0x534]
mov edx, dword [ebp - 0x1508]
mov dword [ebp + ecx*4 - 0x4c0], edx
push 0x80
push 0
mov eax, dword [ebp - 0x534]
mov ecx, dword [ebp + eax*4 - 0x528]
push ecx
call fcn.1009eb40
add esp, 0xc
push 0x80
push 0
mov edx, dword [ebp - 0x534]
mov eax, dword [ebp + edx*4 - 0x4c0]
push eax
call fcn.1009eb40
add esp, 0xc
mov ecx, dword [ebp - 0x534]
add ecx, 0x41
mov word [ebp - 0x224], cx
mov edx, dword [ebp - 0x534]
mov eax, dword [ebp + edx*4 - 0x4c0]
mov dword [ebp - 0x1510], eax
push bind
push 0
push 0x40
mov ecx, dword [ebp - 0x1510]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x150c], eax
cmp dword [ebp - 0x150c], 0
jl 0x10005159
push bind
lea edx, [ebp - 0x224]
push edx
push 0
push 0x40
mov eax, dword [ebp - 0x1510]
push eax
call fcn.1009db9f
mov dword [ebp - 0x150c], eax
push 0x100d7d64
push 0x40
mov ecx, dword [ebp - 0x534]
mov edx, dword [ebp + ecx*4 - 0x4c0]
push edx
call fcn.10001ec0
push 0x40
mov eax, dword [ebp - 0x534]
mov ecx, dword [ebp + eax*4 - 0x528]
push ecx
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x1000504e
mov eax, 1
test eax, eax
je 0x10005d7d
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x530]
push ecx
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0
jne 0x10005d78
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x540], 0
lea edx, [ebp - 0x540]
push edx
push 0x400
mov eax, dword [ebp - 0x454]
push eax
push 8
lea ecx, [ebp - 0x548]
push ecx
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xd8]
push eax
call sub.FLTLIB.DLL_FilterSendMessage
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x540], 0
jbe 0x10005d78
movzx ecx, byte [0x100f5256]
test ecx, ecx
je 0x10005d78
mov edx, dword [ebp - 0x540]
push edx
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.100042e0
add esp, 0xc
mov dword [ebp - 0x550], 0
xor edx, edx
mov word [ebp - 0x218], dx
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x55c], eax
jmp 0x10005279
mov ecx, dword [ebp - 0x55c]
add ecx, 2
mov dword [ebp - 0x55c], ecx
mov edx, dword [ebp - 0x55c]
movzx eax, word [edx]
test eax, eax
je 0x100052e8
mov ecx, dword [ebp - 0x550]
mov edx, dword [ebp - 0x55c]
mov ax, word [edx]
mov word [ebp + ecx*2 - 0x218], ax
xor ecx, ecx
mov edx, dword [ebp - 0x550]
mov word [ebp + edx*2 - 0x216], cx
mov eax, dword [ebp - 0x550]
add eax, 2
cmp eax, 0x104
jle 0x100052bf
jmp 0x100052e8
mov ecx, dword [ebp - 0x550]
add ecx, 1
mov dword [ebp - 0x550], ecx
mov edx, dword [ebp - 0x55c]
movzx eax, word [edx]
cmp eax, 0x2e
jne 0x100052e6
mov dword [ebp - 0x550], 0
jmp 0x1000526a
mov byte [ebp - 0x549], 0
movzx ecx, word [ebp - 0x218]
push ecx
call fcn.1009ee8f
add esp, 4
mov esi, eax
shl esi, 0x10
movzx edx, word [ebp - 0x216]
push edx
call fcn.1009ee8f
add esp, 4
shl eax, 8
add esi, eax
movzx eax, word [ebp - 0x214]
push eax
call fcn.1009ee8f
add esp, 4
add esi, eax
mov dword [ebp - 0x554], esi
cmp dword [ebp - 0x554], 0x6c6f67
jne 0x10005342
jmp 0x10005195
cmp dword [ebp - 0x554], 0x737973
jne 0x10005353
jmp 0x10005195
cmp dword [ebp - 0x554], 0x657865
jne 0x10005364
jmp 0x10005195
cmp dword [ebp - 0x554], 0x696e69
jne 0x10005375
jmp 0x10005195
cmp dword [ebp - 0x554], 0x6d616e
jne 0x10005386
jmp 0x10005195
movzx ecx, word [ebp - 0x218]
cmp ecx, 0x5c
jne 0x10005397
jmp 0x10005195
mov dword [ebp - 0x560], 0
jmp 0x100053b2
mov edx, dword [ebp - 0x560]
add edx, 1
mov dword [ebp - 0x560], edx
mov eax, dword [ebp - 0x1574]
mov ecx, dword [ebp - 0x560]
cmp ecx, dword [eax + 0xd4]
jge 0x100053e7
mov edx, dword [ebp - 0x560]
mov eax, dword [ebp - 0x1574]
mov ecx, dword [eax + edx*4 + 0xc]
cmp ecx, dword [ebp - 0x554]
jne 0x100053e5
mov byte [ebp - 0x549], 1
jmp 0x100053a3
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx]
cmp eax, dword [ebp - 0x234]
jne 0x10005414
mov ecx, dword [ebp - 0x1574]
cmp dword [ecx + 4], 0
je 0x10005414
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 4]
mov dword [ebp - 0x558], eax
jmp 0x1000542c
mov ecx, dword [ebp - 0x234]
push ecx
mov ecx, dword [0x100f4c50]
call fcn.10019b20
mov dword [ebp - 0x558], eax
mov edx, dword [ebp - 0x1574]
mov eax, dword [ebp - 0x234]
mov dword [edx], eax
mov ecx, dword [ebp - 0x1574]
mov edx, dword [ebp - 0x558]
mov dword [ecx + 4], edx
cmp dword [ebp - 0x558], 0
jne 0x10005457
jmp 0x10005195
mov eax, dword [ebp - 0x558]
movzx ecx, byte [eax + 0x4d]
test ecx, ecx
jne 0x1000546a
jmp 0x10005195
movzx edx, byte [ebp - 0x549]
test edx, edx
je 0x10005d56
mov dword [ebp - 0x570], 0x100
mov dword [ebp - 4], 0
lea eax, [ebp - 0x56c]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call sub.ADVAPI32.dll_ConvertStringSidToSidW
cmp eax, 1
jne 0x100054e3
lea edx, [ebp - 0x568]
push edx
lea eax, [ebp - 0x570]
push eax
lea ecx, [ebp - 0xed0]
push ecx
lea edx, [ebp - 0x570]
push edx
lea eax, [ebp - 0x10d0]
push eax
mov ecx, dword [ebp - 0x56c]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov edx, dword [ebp - 0x56c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1000552d
push bind
push 0
push 0x100
lea eax, [ebp - 0x10d0]
push eax
call fcn.1009da4e
mov dword [ebp - 0x151c], eax
cmp dword [ebp - 0x151c], 0
jl 0x1000552d
push bind
push 0x100d7d68
push 0
push 0x100
lea ecx, [ebp - 0x10d0]
push ecx
call fcn.1009db9f
mov dword [ebp - 0x151c], eax
jmp 0x10005586
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x550], 0
push 0x208
push 0
lea ecx, [ebp - 0x450]
push ecx
call fcn.1009eb40
add esp, 0xc
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x10d4], edx
jmp 0x100055ca
mov eax, dword [ebp - 0x10d4]
add eax, 2
mov dword [ebp - 0x10d4], eax
mov ecx, dword [ebp - 0x10d4]
movzx edx, word [ecx]
test edx, edx
je 0x1000564b
mov eax, dword [ebp - 0x550]
mov ecx, dword [ebp - 0x10d4]
mov dx, word [ecx]
mov word [ebp + eax*2 - 0x450], dx
xor eax, eax
mov ecx, dword [ebp - 0x550]
mov word [ebp + ecx*2 - 0x44e], ax
mov edx, dword [ebp - 0x550]
add edx, 2
cmp edx, 0x104
jle 0x10005611
jmp 0x1000564b
mov eax, dword [ebp - 0x550]
add eax, 1
mov dword [ebp - 0x550], eax
mov ecx, dword [ebp - 0x10d4]
movzx edx, word [ecx]
cmp edx, 0x2f
je 0x1000563c
mov eax, dword [ebp - 0x10d4]
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x10005646
mov dword [ebp - 0x550], 0
jmp 0x100055bb
lea ecx, [ebp - 0xcd0]
call fcn.10073e10
mov dword [ebp - 4], 2
mov dword [ebp - 0x564], 3
movzx edx, byte [ebp - 0x240]
test edx, edx
jne 0x10005d2a
push 0
push str.Documents
lea ecx, [ebp - 0xcd0]
call fcn.10073fb0
movzx eax, word [ebp - 0x218]
push eax
call fcn.1009ee8f
add esp, 4
mov word [ebp - 0x218], ax
movzx ecx, word [ebp - 0x216]
push ecx
call fcn.1009ee8f
add esp, 4
mov word [ebp - 0x216], ax
movzx edx, word [ebp - 0x214]
push edx
call fcn.1009ee8f
add esp, 4
mov word [ebp - 0x214], ax
movzx eax, word [ebp - 0x212]
push eax
call fcn.1009ee8f
add esp, 4
mov word [ebp - 0x212], ax
mov ecx, dword [ebp - 0x558]
call fcn.100190f0
push 0
lea ecx, [ebp - 0x12e0]
push ecx
push 0x104
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
movzx eax, byte [0x100f5250]
test eax, eax
je 0x1000576d
push str.torrent
lea ecx, [ebp - 0x218]
push ecx
call fcn.1009ebf1
add esp, 8
test eax, eax
jne 0x1000576d
mov edx, dword [ebp - 0x558]
mov eax, dword [edx + 0x12]
push eax
push 0x100d72a0
lea ecx, [ebp - 0x450]
push ecx
push str.BitTorrent
mov ecx, dword [0x100f4c54]
call fcn.1000ca50
push str.Torret_File
mov edx, dword [ebp - 0x558]
mov eax, dword [edx + 0x12]
push eax
mov ecx, dword [0x100f4c54]
call fcn.1000d700
push str.Machine
lea ecx, [ebp - 0xcd0]
call fcn.10074820
push str.OpenTimeStamp
lea ecx, [ebp - 0xcd0]
call fcn.100746a0
push str.CloseTimeStamp
lea ecx, [ebp - 0xcd0]
call fcn.100746a0
lea ecx, [ebp - 0xcd0]
call fcn.10074350
push 0xffffffffffffffff
push str.Unkown
push str.FileChanged
lea ecx, [ebp - 0xcd0]
call fcn.10074400
push 0xffffffffffffffff
lea ecx, [ebp - 0x450]
push ecx
push str.ShortName
lea ecx, [ebp - 0xcd0]
call fcn.10074400
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push str.Extension
lea ecx, [ebp - 0xcd0]
call fcn.10074400
mov eax, dword [ebp - 0x234]
cdq
push edx
push eax
push str.ProcessID
lea ecx, [ebp - 0xcd0]
call fcn.10074500
push 0xffffffffffffffff
lea eax, [ebp - 0x10d0]
push eax
push str.WindowsUser
lea ecx, [ebp - 0xcd0]
call fcn.10074400
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x558]
mov edx, dword [ecx + 0x39]
push edx
push str.AppShortName
lea ecx, [ebp - 0xcd0]
call fcn.10074400
mov eax, dword [ebp - 0x234]
push eax
push str.ImagePath
lea ecx, [ebp - 0xcd0]
call fcn.100747c0
mov dword [ebp - 0x12e4], 0
jmp 0x10005871
mov ecx, dword [ebp - 0x12e4]
add ecx, 1
mov dword [ebp - 0x12e4], ecx
cmp dword [ebp - 0x12e4], 0x1a
jge 0x100059b7
mov edx, dword [ebp - 0x12e4]
mov eax, dword [ebp + edx*4 - 0x528]
movzx ecx, word [eax]
test ecx, ecx
jne 0x10005894
jmp 0x10005862
mov edx, dword [ebp - 0x12e4]
mov eax, dword [ebp + edx*4 - 0x528]
push eax
call fcn.1009ecbb
add esp, 4
mov dword [ebp - 0x12e8], eax
mov ecx, dword [ebp - 0x12e8]
push ecx
lea edx, [ebp - 0x12dc]
push edx
mov eax, dword [ebp - 0x12e4]
mov ecx, dword [ebp + eax*4 - 0x528]
push ecx
call fcn.1009ebba
add esp, 0xc
test eax, eax
jne 0x100059b2
mov edx, dword [ebp - 0x12e8]
lea eax, [ebp + edx*2 - 0x12da]
mov dword [ebp - 0x12ec], eax
mov ecx, dword [ebp - 0x12e4]
mov edx, dword [ebp + ecx*4 - 0x4c0]
mov dword [ebp - 0x1528], edx
push bind
push 0
push 0x104
lea eax, [ebp - 0x14f8]
push eax
call fcn.1009da4e
mov dword [ebp - 0x1524], eax
cmp dword [ebp - 0x1524], 0
jl 0x1000594e
push bind
mov ecx, dword [ebp - 0x1528]
push ecx
push 0
push 0x104
lea edx, [ebp - 0x14f8]
push edx
call fcn.1009db9f
mov dword [ebp - 0x1524], eax
mov eax, dword [ebp - 0x12ec]
push eax
push 0x104
lea ecx, [ebp - 0x14f8]
push ecx
call fcn.10001ec0
push bind
push 0
push 0x104
lea edx, [ebp - 0x12e0]
push edx
call fcn.1009da4e
mov dword [ebp - 0x1534], eax
cmp dword [ebp - 0x1534], 0
jl 0x100059b2
push bind
lea eax, [ebp - 0x14f8]
push eax
push 0
push 0x104
lea ecx, [ebp - 0x12e0]
push ecx
call fcn.1009db9f
mov dword [ebp - 0x1534], eax
jmp 0x10005862
push 0xffffffffffffffff
lea edx, [ebp - 0x12e0]
push edx
push str.Filename
lea ecx, [ebp - 0xcd0]
call fcn.10074400
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1538], eax
push str.eatemp_
mov ecx, dword [ebp - 0x1538]
push ecx
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005a03
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x153c], edx
push str.Cookies_
mov eax, dword [ebp - 0x153c]
push eax
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005a36
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x1540], ecx
push str.ScreenShots
mov edx, dword [ebp - 0x1540]
push edx
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005a69
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1544], eax
push str.Temporary
mov ecx, dword [ebp - 0x1544]
push ecx
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005a9c
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x1548], edx
push str.EATemp_
mov eax, dword [ebp - 0x1548]
push eax
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005acf
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x154c], ecx
push str.WINDOWS_
mov edx, dword [ebp - 0x154c]
push edx
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005b02
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1550], eax
push str.My_Document
mov ecx, dword [ebp - 0x1550]
push ecx
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005b35
mov dword [ebp - 0x564], 5
jmp 0x10005c8f
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x1554], edx
push str.PROGRA1
mov eax, dword [ebp - 0x1554]
push eax
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005b68
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x1558], ecx
push str.Application_Data
mov edx, dword [ebp - 0x1558]
push edx
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005b9b
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x155c], eax
push str.application_data
mov ecx, dword [ebp - 0x155c]
push ecx
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005bce
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x1560], edx
push str.Program_Files
mov eax, dword [ebp - 0x1560]
push eax
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005c01
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x1564], ecx
push str.Local_Settings
mov edx, dword [ebp - 0x1564]
push edx
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005c31
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1568], eax
push str.local_settings
mov ecx, dword [ebp - 0x1568]
push ecx
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005c61
mov dword [ebp - 0x564], 0
jmp 0x10005c8f
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x156c], edx
push str.Desktop
mov eax, dword [ebp - 0x156c]
push eax
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005c8f
mov dword [ebp - 0x564], 4
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x1570], ecx
push str.Recent
mov edx, dword [ebp - 0x1570]
push edx
call fcn.1009eebb
add esp, 8
test eax, eax
je 0x10005cbf
mov dword [ebp - 0x564], 5
jmp 0x10005cd6
mov eax, dword [ebp - 0x564]
push eax
push str.DetailLevel
lea ecx, [ebp - 0xcd0]
call fcn.100745d0
movzx ecx, byte [ebp - 0x23b]
test ecx, ecx
je 0x10005cf8
push 0xffffffffffffffff
push str.Open
push str.Action
lea ecx, [ebp - 0xcd0]
call fcn.10074250
push 0xffffffffffffffff
push str.Access_Denied
push str.Action
lea ecx, [ebp - 0xcd0]
call fcn.10074250
mov edx, dword [ebp - 0x238]
push edx
push str.Filename
push str.Documents
mov ecx, 0x100f57d0
call fcn.10073a00
cmp dword [ebp - 0x564], 0
jle 0x10005d44
lea ecx, [ebp - 0xcd0]
push ecx
mov ecx, 0x100f57d0
call fcn.10073b60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcd0]
call fcn.10073ef0
lea edx, [ebp - 0x248]
push edx
call fcn.10004270
add esp, 4
push 0x24
push 0
lea eax, [ebp - 0x248]
push eax
call fcn.1009eb40
add esp, 0xc
jmp 0x10005195
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret