Function at 0x416580
Capabilities:
Get disk information
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0x458]
sub esp, 0x458
push 0xffffffffffffffff
push 0x4bb029
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4f2008]
xor eax, ebp
mov dword [ebp + 0x454], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x18], esi
mov ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x38], ebx
lea ecx, [ebp + 0x24]
mov dword [ebp - 0x30], 0
call fcn.00401bd5
mov dword [ebp - 4], 1
test esi, esi
jne 0x4165f3
lea eax, [ebp + 0x24]
mov ecx, ebx
push eax
call fcn.0040266f
jmp 0x416e6b
push str.Kernel32.dll
lea ecx, [ebp - 0x68]
call fcn.00401931
mov byte [ebp - 4], 2
lea eax, [ebp - 0x68]
push eax
call fcn.00414c50
mov ecx, eax
call fcn.00414d10
mov edi, eax
mov dword [ebp - 0x2c], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x68]
call fcn.0040192c
push str.Psapi.dll
lea ecx, [ebp - 0x50]
call fcn.00401931
mov byte [ebp - 4], 3
lea eax, [ebp - 0x50]
push eax
call fcn.00414c50
mov ecx, eax
call fcn.00414d10
mov esi, eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.0040192c
test esi, esi
je 0x416e60
test edi, edi
je 0x416e60
lea ecx, [ebp + 0x334]
call fcn.0040a010
cmp dword [ebp + 0x338], 6
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jb 0x416880
push str.QueryFullProcessImageNameW
push edi
call ebx
mov esi, eax
test esi, esi
je 0x41687d
push 0x412
lea eax, [ebp + 0x40]
push 0
push eax
call fcn.00497aa0
add esp, 0xc
mov dword [ebp + 0x3c], 0x208
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x40]
push eax
push 0
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x41687d
mov eax, dword [ebp + 0x3c]
cmp eax, 0x208
jae 0x4166e6
add eax, eax
cmp eax, 0x412
jae 0x416ea3
xor ecx, ecx
mov word [ebp + eax + 0x40], cx
lea eax, [ebp + 0x40]
push eax
call fcn.00401a44
add esp, 4
lea ecx, [ebp + 0x24]
mov ebx, eax
call fcn.00401970
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x14], eax
cmp ebx, eax
ja 0x41673b
mov esi, edi
cmp eax, 8
jb 0x416711
mov esi, dword [edi]
push ebx
lea eax, [ebp + 0x40]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.00401a12
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.00401a01
add esp, 0x14
jmp 0x416874
lea ecx, [ebp + 0x24]
call fcn.00401b82
cmp ebx, eax
ja 0x416ea8
lea ecx, [ebp + 0x24]
call fcn.00401b82
lea ecx, [ebp + 0x24]
mov esi, eax
call fcn.00401970
mov ecx, ebx
or ecx, 7
mov dword [ebp - 0x24], ecx
cmp ecx, esi
ja 0x416790
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x416790
lea eax, [edx + ecx]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004019ef
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x4167a2
or ecx, 0xffffffff
jmp 0x4167aa
cmp ecx, 0x1000
jb 0x4167d5
lea eax, [ecx + 0x23]
cmp eax, ecx
mov ecx, 0xffffffff
cmovbe eax, ecx
push eax
call fcn.00495cb6
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x416ead
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4167e6
test ecx, ecx
je 0x4167e4
push ecx
call fcn.00495cb6
add esp, 4
jmp 0x4167e6
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x40]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [ebp - 0x10]
push eax
push esi
call fcn.00401a2b
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.00401a01
mov ecx, dword [ebp - 0x14]
add esp, 0x14
cmp ecx, 8
jb 0x416854
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x416843
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416ead
mov eax, edx
push ecx
push eax
call fcn.00495ce6
mov eax, dword [ebp - 0x10]
add esp, 8
mov dword [edi], eax
jmp 0x416874
push edi
call fcn.00401a5f
push eax
push 4
call fcn.00401880
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.00401a5f
add esp, 0x10
mov ecx, dword [eax]
mov dword [esi], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp + 0x24]
call fcn.00402620
test al, al
je 0x416c0a
push str.GetProcessImageFileNameW
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x4168b0
push str.GetProcessImageFileNameW
push edi
call ebx
mov esi, eax
test esi, esi
je 0x416a82
push 0x412
lea eax, [ebp + 0x40]
push 0
push eax
call fcn.00497aa0
add esp, 0xc
lea eax, [ebp + 0x40]
push 0x208
push eax
push dword [ebp - 0x18]
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x416a82
add eax, eax
cmp eax, 0x412
jae 0x416ea3
xor ecx, ecx
mov word [ebp + eax + 0x40], cx
lea eax, [ebp + 0x40]
push eax
call fcn.00401a44
add esp, 4
lea ecx, [ebp + 0x24]
mov ebx, eax
call fcn.00401970
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x20], eax
cmp ebx, eax
ja 0x416949
mov esi, edi
cmp eax, 8
jb 0x41691f
mov esi, dword [edi]
push ebx
lea eax, [ebp + 0x40]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.00401a12
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.00401a01
add esp, 0x14
jmp 0x416a82
lea ecx, [ebp + 0x24]
call fcn.00401b82
cmp ebx, eax
ja 0x416eb2
lea ecx, [ebp + 0x24]
call fcn.00401b82
lea ecx, [ebp + 0x24]
mov esi, eax
call fcn.00401970
mov ecx, ebx
or ecx, 7
mov dword [ebp - 0x28], ecx
cmp ecx, esi
ja 0x41699e
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x41699e
lea eax, [edx + ecx]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004019ef
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x4169b0
or ecx, 0xffffffff
jmp 0x4169b8
cmp ecx, 0x1000
jb 0x4169e3
lea eax, [ecx + 0x23]
cmp eax, ecx
mov ecx, 0xffffffff
cmovbe eax, ecx
push eax
call fcn.00495cb6
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x416ead
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4169f4
test ecx, ecx
je 0x4169f2
push ecx
call fcn.00495cb6
add esp, 4
jmp 0x4169f4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x40]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [ebp - 0x10]
push eax
push esi
call fcn.00401a2b
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.00401a01
mov ecx, dword [ebp - 0x20]
add esp, 0x14
cmp ecx, 8
jb 0x416a62
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x416a51
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416ead
mov eax, edx
push ecx
push eax
call fcn.00495ce6
mov eax, dword [ebp - 0x10]
add esp, 8
mov dword [edi], eax
jmp 0x416a82
push edi
call fcn.00401a5f
push eax
push 4
call fcn.00401880
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.00401a5f
add esp, 0x10
mov ecx, dword [eax]
mov dword [esi], ecx
lea ecx, [ebp + 0x24]
call fcn.00402620
test al, al
jne 0x416c0a
push 0x410
call fcn.004963de
push 0x410
mov edi, eax
push 0
push edi
call fcn.00497aa0
xorps xmm0, xmm0
mov dword [ebp + 0x20], 0
movq qword [ebp + 0x18], xmm0
add esp, 0x10
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x18]
call fcn.0041ace0
lea ecx, [ebp + 0x18]
mov dword [ebp + 0x3c], 0
call fcn.004025a5
test eax, eax
je 0x416bf5
xor ebx, ebx
mov dword [ebp - 0x10], ebx
nop word [eax + eax]
add ebx, dword [ebp + 0x18]
mov ecx, ebx
call fcn.00402630
cmp eax, 3
jb 0x416b36
mov ecx, ebx
call fcn.00401970
mov ecx, eax
mov edx, dword [eax + 0x14]
cmp edx, 8
jb 0x416b22
mov ecx, dword [eax]
cmp word [ecx + 4], 0x5c
jne 0x416b36
cmp edx, 8
jb 0x416b30
mov eax, dword [eax]
xor ecx, ecx
mov word [eax + 4], cx
push 0x208
push edi
mov ecx, ebx
call fcn.00401921
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x416b51
mov word [edi], ax
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x416b56
sub esi, ecx
sar esi, 1
je 0x416b8a
lea ecx, [ebp + 0x24]
call fcn.00402630
cmp esi, eax
jae 0x416b8a
push esi
push edi
lea ecx, [ebp + 0x24]
call fcn.00401921
push eax
call fcn.0049dad8
add esp, 0xc
test eax, eax
je 0x416bac
mov esi, dword [ebp + 0x3c]
lea ecx, [ebp + 0x18]
mov ebx, dword [ebp - 0x10]
inc esi
add ebx, 0x18
mov dword [ebp + 0x3c], esi
mov dword [ebp - 0x10], ebx
call fcn.004025a5
cmp esi, eax
jb 0x416b00
jmp 0x416bf5
lea ecx, [ebp]
call fcn.00401bd5
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x24]
call fcn.00401921
mov ecx, ebx
lea eax, [eax + esi*2]
push eax
call fcn.00401921
push eax
lea eax, [ebp]
push str._s_s
push eax
call fcn.00405d70
add esp, 0x10
lea eax, [ebp]
lea ecx, [ebp + 0x24]
push eax
call fcn.004134c0
mov byte [ebp - 4], 4
lea ecx, [ebp]
call fcn.0040192c
push edi
call fcn.004963d9
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.00404f80
lea ecx, [ebp + 0x24]
call fcn.00402620
test al, al
je 0x416e18
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetModuleFileNameExW
push dword [ebp - 0x1c]
call edi
mov esi, eax
test esi, esi
jne 0x416c44
push str.GetModuleFileNameExW
push dword [ebp - 0x2c]
call edi
mov esi, eax
test esi, esi
je 0x416e18
push 0x412
lea eax, [ebp + 0x40]
push 0
push eax
call fcn.00497aa0
add esp, 0xc
lea eax, [ebp + 0x40]
push 0x208
push eax
push 0
push dword [ebp - 0x18]
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x416e18
add eax, eax
cmp eax, 0x412
jae 0x416ea3
xor ecx, ecx
mov word [ebp + eax + 0x40], cx
lea eax, [ebp + 0x40]
push eax
call fcn.00401a44
add esp, 4
lea ecx, [ebp + 0x24]
mov ebx, eax
call fcn.00401970
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x20], eax
cmp ebx, eax
ja 0x416cdf
mov esi, edi
cmp eax, 8
jb 0x416cb5
mov esi, dword [edi]
push ebx
lea eax, [ebp + 0x40]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.00401a12
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.00401a01
add esp, 0x14
jmp 0x416e18
lea ecx, [ebp + 0x24]
call fcn.00401b82
cmp ebx, eax
ja 0x416eb7
lea ecx, [ebp + 0x24]
call fcn.00401b82
lea ecx, [ebp + 0x24]
mov esi, eax
call fcn.00401970
mov ecx, ebx
or ecx, 7
mov dword [ebp - 0x28], ecx
cmp ecx, esi
ja 0x416d34
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x416d34
lea eax, [edx + ecx]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004019ef
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x416d46
or ecx, 0xffffffff
jmp 0x416d4e
cmp ecx, 0x1000
jb 0x416d79
lea eax, [ecx + 0x23]
cmp eax, ecx
mov ecx, 0xffffffff
cmovbe eax, ecx
push eax
call fcn.00495cb6
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x416ead
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x416d8a
test ecx, ecx
je 0x416d88
push ecx
call fcn.00495cb6
add esp, 4
jmp 0x416d8a
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x40]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [ebp - 0x18]
push eax
push esi
call fcn.00401a2b
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.00401a01
mov ecx, dword [ebp - 0x20]
add esp, 0x14
cmp ecx, 8
jb 0x416df8
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x416de7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416ead
mov eax, edx
push ecx
push eax
call fcn.00495ce6
mov eax, dword [ebp - 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x416e18
push edi
call fcn.00401a5f
push eax
push 4
call fcn.00401880
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call fcn.00401a5f
add esp, 0x10
mov ecx, dword [eax]
mov dword [esi], ecx
lea edx, [ebp + 0x24]
lea ecx, [ebp - 0x50]
call fcn.0040de20
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x24]
push eax
call fcn.00402646
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.0040192c
mov ecx, dword [ebp - 0x34]
lea eax, [ebp + 0x24]
push eax
call fcn.0040266f
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
call fcn.0040192c
mov eax, dword [ebp - 0x34]
jmp 0x416e80
lea eax, [ebp + 0x24]
mov ecx, ebx
push eax
call fcn.0040266f
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
call fcn.0040192c
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x454]
xor ecx, ebp
call fcn.00495ca5
lea esp, [ebp + 0x458]
pop ebp
ret
call fcn.00495e15
call fcn.00401b40
call fcn.00499d54
call fcn.00401b40
call fcn.00401b40
int3