Function at 0x512d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov eax, 0x1844
mov ebp, esp
push edi
push esi
push ebx
call fcn.0057e5f0
sub esp, eax
mov esi, dword [0x850174]
mov dword [ebp - 0x181c], 0x44005c
mov dword [ebp - 0x1818], 0x760065
mov dword [ebp - 0x1814], 0x630069
mov dword [ebp - 0x1810], 0x65
test esi, esi
je 0x5141dc
mov eax, 0x7e5
lea esi, [ebp - 0x80c]
call fcn.0050dc60
lea eax, [ebp - 0x180c]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], str.GetModuleFileNameW_NULL__...__failed_n
call fcn.0050e8b0
lea eax, [ebp - 0x1820]
mov dword [ebp - 0x1820], 0x400
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call dword [0x850174]
sub esp, 0x10
mov ebx, eax
mov eax, 0x7e9
call fcn.0050dc60
xor eax, eax
cmp ebx, 1
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], 1
mov dword [esp], eax
mov dword [esp + 4], str.Expected_pQueryFullProcessImageNameW_GetCurrentProcess____0__buf__size__to_be__d__TRUE__is__d_n
call fcn.0050e8b0
mov eax, 0x7ea
mov ebx, dword [ebp - 0x1820]
call fcn.0050dc60
cmp word [ebp - 0x80c], 0
je 0x5142e1
mov edx, esi
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x512e50
sub edx, esi
mov eax, esi
sar edx, 1
nop
add eax, 2
cmp word [eax], 0
jne 0x512e60
sub eax, esi
sar eax, 1
cmp ebx, eax
mov dword [esp + 8], edx
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp + 4], str.Expected_size_to_be__d__lstrlenW_buf___is__d_n
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x7eb
call fcn.0050dc60
lea eax, [ebp - 0x180c]
shr eax, 0x10
mov dword [ebp - 0x183c], eax
je 0x514164
lea eax, [ebp - 0x180c]
mov dword [esp + 4], 0xffffffff
mov ebx, 0x5efcf8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x512edc
lea eax, [ebp - 0x180c]
call fcn.0050dc80
mov ebx, eax
mov eax, esi
shr eax, 0x10
mov dword [ebp - 0x1834], eax
je 0x5140d3
mov dword [esp + 4], 0xffffffff
mov edi, 0x5efcf8
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x512f13
mov eax, esi
call fcn.0050dc80
mov edi, eax
lea eax, [ebp - 0x180c]
mov dword [esp], esi
mov dword [esp + 4], eax
mov eax, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [ebp - 0x1838], eax
call eax
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Expected_module_name_to_be_L__s___buf__is_L__s__n
call fcn.0050e8b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp + 4], 0
mov dword [esp], 0x1000
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenProcess]
lea ecx, [ebp - 0x1820]
mov dword [ebp - 0x1820], 0x400
sub esp, 0xc
mov dword [ebp - 0x1824], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [0x850174]
sub esp, 0x10
mov ebx, eax
mov eax, 0x7f0
call fcn.0050dc60
xor eax, eax
cmp ebx, 1
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], 1
mov dword [esp], eax
mov dword [esp + 4], str.Expected_pQueryFullProcessImageNameW_hSelf__0__buf__size__to_be__d__TRUE__is__d_n
call fcn.0050e8b0
mov eax, 0x7f1
mov ebx, dword [ebp - 0x1820]
call fcn.0050dc60
cmp word [ebp - 0x80c], 0
je 0x5142f3
mov edx, esi
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x513000
sub edx, esi
mov eax, esi
sar edx, 1
nop
add eax, 2
cmp word [eax], 0
jne 0x513010
sub eax, esi
sar eax, 1
cmp ebx, eax
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], edx
movzx eax, al
mov dword [esp + 4], str.Expected_size_to_be__d__lstrlenW_buf___is__d_n
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x7f2
call fcn.0050dc60
mov ebx, dword [ebp - 0x183c]
test ebx, ebx
je 0x5140ed
lea eax, [ebp - 0x180c]
mov dword [esp + 4], 0xffffffff
mov ebx, 0x5efcf8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x513085
lea eax, [ebp - 0x180c]
call fcn.0050dc80
mov ebx, eax
mov ecx, dword [ebp - 0x1834]
test ecx, ecx
je 0x5140b9
mov dword [esp + 4], 0xffffffff
mov edi, 0x5efcf8
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x5130b9
mov eax, esi
call fcn.0050dc80
mov edi, eax
lea eax, [ebp - 0x180c]
mov dword [esp], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1838]
call eax
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp + 8], edi
mov dword [esp + 4], str.Expected_module_name_to_be_L__s___buf__is_L__s__n
mov dword [esp], eax
call fcn.0050e8b0
cmp word [ebp - 0x180c], 0
je 0x51432d
lea eax, [ebp - 0x180c]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x513108
lea ecx, [ebp - 0x180c]
sub eax, ecx
mov edx, eax
shr eax, 0x1f
sar edx, 1
add eax, edx
sar eax, 1
mov dword [ebp - 0x1820], eax
xor eax, eax
lea esi, [esi]
movzx edx, word [ebp + eax - 0x181c]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x513130
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xdeadbeef
lea eax, [ebp - 0x1820]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1824]
mov dword [esp], eax
call dword [0x850174]
sub esp, 0x10
mov ebx, eax
mov eax, 0x7f8
call fcn.0050dc60
xor eax, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 4], str.Expected_pQueryFullProcessImageNameW_hSelf__0__buf__size__to_be__d__FALSE__is__d_n
call fcn.0050e8b0
mov eax, 0x7f9
mov ebx, dword [ebp - 0x1820]
call fcn.0050dc60
cmp word [ebp - 0x180c], 0
je 0x514334
lea eax, [ebp - 0x180c]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x5131d0
lea ecx, [ebp - 0x180c]
sub eax, ecx
mov ecx, eax
shr eax, 0x1f
sar ecx, 1
lea edx, [eax + ecx]
lea eax, [ebp - 0x180c]
sar edx, 1
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x5131f8
lea ecx, [ebp - 0x180c]
sub eax, ecx
mov ecx, eax
shr eax, 0x1f
sar ecx, 1
add eax, ecx
sar eax, 1
cmp ebx, eax
mov dword [esp + 8], edx
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp + 4], str.Expected_size_to_be__d__lstrlenW_module_name__2__is__d_n
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, 0x7fa
call fcn.0050dc60
xor eax, eax
mov dword [esp + 8], 0x7a
cmp ebx, 0x7a
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 4], str.Expected_GetLastError___to_be__d__ERROR_INSUFFICIENT_BUFFER__is__d_n
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x7fb
call fcn.0050dc60
mov edx, dword [ebp - 0x1834]
test edx, edx
je 0x51418e
mov dword [esp + 4], 0xffffffff
mov ebx, 0x5efcf8
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x5132a9
mov eax, esi
call fcn.0050dc80
mov ebx, eax
lea eax, [ebp - 0x181c]
shr eax, 0x10
je 0x5141b2
lea eax, [ebp - 0x181c]
mov dword [esp + 4], 0xffffffff
mov edi, 0x5efcf8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x5132e8
lea eax, [ebp - 0x181c]
call fcn.0050dc80
mov edi, eax
lea eax, [ebp - 0x181c]
mov dword [esp + 4], esi
mov dword [esp], eax
mov eax, dword [ebp - 0x1838]
call eax
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp + 8], edi
mov dword [esp + 4], str.Expected_buf_to_be_L__s___deviceW__is_L__s__n
mov dword [esp], eax
call fcn.0050e8b0
cmp word [ebp - 0x180c], 0
je 0x514316
lea eax, [ebp - 0x180c]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x513338
lea ecx, [ebp - 0x180c]
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x1820], eax
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xdeadbeef
lea eax, [ebp - 0x1820]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1824]
mov dword [esp], eax
call dword [0x850174]
sub esp, 0x10
mov ebx, eax
mov eax, 0x800
call fcn.0050dc60
xor eax, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 4], str.Expected_pQueryFullProcessImageNameW_hSelf__0__buf__size__to_be__d__FALSE__is__d_n
call fcn.0050e8b0
mov eax, 0x801
mov ebx, dword [ebp - 0x1820]
call fcn.0050dc60
cmp word [ebp - 0x180c], 0
je 0x51431d
lea edx, [ebp - 0x180c]
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x5133e0
lea eax, [ebp - 0x180c]
sub edx, eax
sar edx, 1
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x5133f8
lea ecx, [ebp - 0x180c]
sub eax, ecx
sar eax, 1
cmp ebx, eax
mov dword [esp + 8], edx
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp + 4], str.Expected_size_to_be__d__lstrlenW_module_name___is__d_n
mov dword [esp], eax
mov edi, dword fs:[0x18]
call fcn.0050e8b0
mov ebx, dword [edi + 0x34]
mov eax, 0x802
call fcn.0050dc60
xor eax, eax
mov dword [esp + 8], 0x7a
cmp ebx, 0x7a
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 4], str.Expected_GetLastError___to_be__d__ERROR_INSUFFICIENT_BUFFER__is__d_n
mov dword [esp], eax
call fcn.0050e8b0
lea eax, [ebp - 0x1820]
mov dword [ebp - 0x1820], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1824]
mov dword [esp], eax
call dword [0x850174]
sub esp, 0x10
mov ebx, eax
mov eax, 0x806
call fcn.0050dc60
xor eax, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 4], str.Expected_pQueryFullProcessImageNameW_hSelf__0__NULL__size__to_be__d__FALSE__is__d_n
call fcn.0050e8b0
mov ebx, dword [ebp - 0x1820]
mov eax, 0x807
call fcn.0050dc60
xor eax, eax
mov dword [esp + 8], 0
test ebx, ebx
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 4], str.Expected_size_to_be__d__0__is__d_n
mov dword [esp], eax
call fcn.0050e8b0
mov ebx, dword [edi + 0x34]
mov eax, 0x808
call fcn.0050dc60
xor eax, eax
mov dword [esp + 8], 0x7a
cmp ebx, 0x7a
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 4], str.Expected_GetLastError___to_be__d__ERROR_INSUFFICIENT_BUFFER__is__d_n
mov dword [esp], eax
call fcn.0050e8b0
cmp word [ebp - 0x180c], 0
je 0x514326
lea eax, [ebp - 0x180c]
add eax, 2
cmp word [eax], 0
jne 0x513540
lea ecx, [ebp - 0x180c]
sub eax, ecx
mov edx, eax
shr eax, 0x1f
sar edx, 1
add eax, edx
sar eax, 1
mov dword [ebp - 0x1820], eax
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xdeadbeef
xor eax, eax
lea esi, [esi]
movzx edx, word [ebp + eax - 0x180c]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x513578
lea eax, [ebp - 0x1820]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1824]
mov dword [esp], eax
call dword [0x850174]
sub esp, 0x10
mov ebx, eax
mov eax, 0x80e
call fcn.0050dc60
xor eax, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 4], str.Expected_pQueryFullProcessImageNameW_hSelf__0__buf__size__to_be__d__FALSE__is__d_n
call fcn.0050e8b0
mov eax, 0x80f
mov ebx, dword [ebp - 0x1820]
call fcn.0050dc60
cmp word [ebp - 0x180c], 0
je 0x5142ea
lea eax, [ebp - 0x180c]
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x513610
lea ecx, [ebp - 0x180c]
sub eax, ecx
mov ecx, eax
shr eax, 0x1f
sar ecx, 1
lea edx, [eax + ecx]
lea eax, [ebp - 0x180c]
sar edx, 1
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x513638
lea ecx, [ebp - 0x180c]
sub eax, ecx
mov ecx, eax
shr eax, 0x1f
sar ecx, 1
add eax, ecx
sar eax, 1
cmp ebx, eax
mov dword [esp + 8], edx
sete al
mov dword [esp + 0xc], ebx
movzx eax, al
mov dword [esp + 4], str.Expected_size_to_be__d__lstrlenW_module_name__2__is__d_n
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, 0x810
call fcn.0050dc60
xor eax, eax
mov dword [esp + 8], 0x7a
cmp ebx, 0x7a
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 4], str.Expected_GetLastError___to_be__d__ERROR_INSUFFICIENT_BUFFER__is__d_n
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x811
call fcn.0050dc60
mov eax, dword [ebp - 0x1834]
test eax, eax
je 0x514117
mov dword [esp + 4], 0xffffffff
mov ebx, 0x5efcf8
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x5136e9
mov eax, esi
call fcn.0050dc80
mov ebx, eax
mov eax, dword [ebp - 0x183c]
test eax, eax
je 0x51413a
lea eax, [ebp - 0x180c]
mov dword [esp + 4], 0xffffffff
mov edi, 0x5efcf8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x513727
lea eax, [ebp - 0x180c]
call fcn.0050dc80
mov edi, eax
lea eax, [ebp - 0x180c]
mov dword [esp + 4], esi
mov dword [esp], eax
mov eax, dword [ebp - 0x1838]
call eax
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], ebx
mov ebx, 2
movzx eax, al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Expected_buf_to_be_L__s___module_name__is_L__s__n
call fcn.0050e8b0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1828], eax
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xdeadbeef
mov ecx, dword [0x8f0770]
mov dword [ebp - 0x1820], 0x400
mov dword [ebp - 0x182c], ecx
mov dword [ebp - 0x80c], 0x13579acf
call fcn.0057d110
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea edx, [ecx + ecx]
mov ecx, dword [ebp - 0x182c]
test ecx, ecx
setne cl
movzx ecx, cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x5138f0
lea eax, [ebp - 0x1820]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x1824]
mov dword [esp], eax
call dword [0x850174]
sub esp, 0x10
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x81b
xor eax, eax
test edi, edi
sete al
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Expected_pQueryFullProcessImageNameW_hSelf__flags__buf__size__to_be__d__FALSE__is__d_n
call fcn.0050e8b0
mov edi, dword [ebp - 0x1820]
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x81c
xor eax, eax
cmp edi, 0x400
sete al
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], str.Expected_size_to_be__d___DWORD_ARRAY_SIZE_buf___is__d_n
call fcn.0050e8b0
mov eax, dword [ebp - 0x1828]
mov edi, dword [eax + 0x34]
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x81d
xor eax, eax
cmp edi, 0x57
sete al
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 8], 0x57
mov dword [esp + 4], str.Expected_GetLastError___to_be__d__ERROR_INVALID_PARAMETER__is__d_n
call fcn.0050e8b0
mov edi, dword [ebp - 0x80c]
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x81e
xor eax, eax
cmp edi, 0x13579acf
sete al
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 8], 0x13579acf
mov dword [esp + 4], str.Expected__DWORD_buf_to_be__d__0x13579acf__is__d_n
call fcn.0050e8b0
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x5137d0
add ebx, 1
cmp ebx, 0x10
jne 0x513770
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1830], 0x1c
mov dword [ebp - 0x1828], eax
lea esi, [esi]
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xdeadbeef
mov ecx, dword [0x8f0770]
mov dword [ebp - 0x1820], 0x400
mov dword [ebp - 0x182c], ecx
mov dword [ebp - 0x80c], 0x13579acf
call fcn.0057d110
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea edx, [ecx + ecx]
mov ecx, dword [ebp - 0x182c]
test ecx, ecx
setne cl
movzx ecx, cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x513ab0
lea eax, [ebp - 0x1820]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x1824]
mov dword [esp], eax
call dword [0x850174]
sub esp, 0x10
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x828
xor eax, eax
test edi, edi
sete al
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Expected_pQueryFullProcessImageNameW_hSelf__flags__buf__size__to_be__d__FALSE__is__d_n
call fcn.0050e8b0
mov edi, dword [ebp - 0x1820]
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x829
xor eax, eax
cmp edi, 0x400
sete al
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], str.Expected_size_to_be__d___DWORD_ARRAY_SIZE_buf___is__d_n
call fcn.0050e8b0
mov eax, dword [ebp - 0x1828]
mov edi, dword [eax + 0x34]
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x82a
xor eax, eax
cmp edi, 0x57
sete al
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 8], 0x57
mov dword [esp + 4], str.Expected_GetLastError___to_be__d__ERROR_INVALID_PARAMETER__is__d_n
call fcn.0050e8b0
mov edi, dword [ebp - 0x80c]
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x82b
xor eax, eax
cmp edi, 0x13579acf
sete al
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 8], 0x13579acf
mov dword [esp + 4], str.Expected__DWORD_buf_to_be__d__0x13579acf__is__d_n
call fcn.0050e8b0
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x513990
add ebx, ebx
sub dword [ebp - 0x1830], 1
jne 0x513930
lea eax, [ebp - 0x1820]
mov dword [ebp - 0x1828], edx
mov dword [ebp - 0x1820], 0x400
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x1824]
mov dword [esp], eax
call dword [0x850174]
sub esp, 0x10
mov ebx, eax
mov eax, 0x831
call fcn.0050dc60
xor eax, eax
cmp ebx, 1
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], 1
mov dword [esp], eax
mov dword [esp + 4], str.Expected_pQueryFullProcessImageNameW_hSelf__PROCESS_NAME_NATIVE__buf__size__to_be__d__TRUE__is__d_n
call fcn.0050e8b0
mov eax, 0x832
mov ebx, dword [ebp - 0x1820]
call fcn.0050dc60
cmp word [ebp - 0x80c], 0
mov edx, dword [ebp - 0x1828]
je 0x51430d
mov ecx, esi
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x513b68
sub ecx, esi
mov eax, esi
sar ecx, 1
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x513b80
sub eax, esi
sar eax, 1
cmp ebx, eax
mov dword [ebp - 0x1828], edx
sete al
mov dword [esp + 8], ecx
movzx eax, al
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 4], str.Expected_size_to_be__d__lstrlenW_buf___is__d_n
call fcn.0050e8b0
mov eax, 0x833
call fcn.0050dc60
mov dword [esp + 4], str.NT_path_should_begin_with__n
xor eax, eax
cmp word [ebp - 0x80c], 0x5c
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x834
call fcn.0050dc60
cmp word [ebp - 0x181c], 0
mov edx, dword [ebp - 0x1828]
je 0x5142fc
lea eax, [ebp - 0x181c]
nop
add eax, 2
cmp word [eax], 0
jne 0x513c00
lea ecx, [ebp - 0x181c]
sub eax, ecx
mov dword [ebp - 0x1828], edx
lea edi, [ebp - 0x100c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x181c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_memcmp
mov dword [esp + 4], str.NT_path_should_begin_with_Device_n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
xor eax, eax
mov word [ebp - 0x1808], ax
xor eax, eax
mov word [ebp - 0x100c], ax
lea eax, [ebp - 0x180c]
mov dword [esp + 8], 0x400
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_QueryDosDeviceW]
sub esp, 0xc
mov dword [ebp - 0x1820], eax
mov eax, 0x839
call fcn.0050dc60
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.QueryDosDeviceW_failed:_le_lu_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1820]
mov dword [esp], eax
call fcn.0050e8b0
cmp word [ebp - 0x100c], 0
mov edx, dword [ebp - 0x1828]
je 0x514303
mov edx, edi
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x513cc8
sub edx, edi
mov eax, edx
sar eax, 1
mov dword [ebp - 0x1830], eax
lea ebx, [eax + 2]
mov eax, 0x83b
mov dword [ebp - 0x182c], edx
call fcn.0050dc60
mov eax, edi
mov edx, dword [ebp - 0x182c]
shr eax, 0x10
mov dword [ebp - 0x1828], eax
je 0x51409b
mov dword [ebp - 0x182c], edx
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x182c]
mov ecx, eax
sub esp, 8
mov eax, 0x5efcf8
test ecx, ecx
jne 0x513d3f
mov eax, edi
call fcn.0050dc80
mov edx, dword [ebp - 0x182c]
mov ecx, dword [ebp - 0x1820]
mov dword [ebp - 0x182c], edx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1830]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
xor eax, eax
cmp ecx, ebx
setae al
mov dword [esp + 4], str.expected__ld_to_be_greater_than__ld2__strlen__s__n
mov dword [esp], eax
call fcn.0050e8b0
cmp word [ebp - 0x80c], 0
je 0x513ff3
mov edx, dword [ebp - 0x182c]
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x513d90
sub eax, esi
sar eax, 1
cmp dword [ebp - 0x1820], eax
jae 0x513ff3
mov eax, 0x843
mov dword [ebp - 0x182c], edx
call fcn.0050dc60
mov ebx, dword [ebp - 0x183c]
mov edx, dword [ebp - 0x182c]
test ebx, ebx
je 0x51426f
lea eax, [ebp - 0x180c]
mov dword [ebp - 0x182c], edx
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x182c]
mov ecx, eax
sub esp, 8
mov eax, 0x5efcf8
test ecx, ecx
jne 0x513e0f
lea eax, [ebp - 0x180c]
call fcn.0050dc80
mov edx, dword [ebp - 0x182c]
mov ebx, dword [ebp - 0x1830]
mov dword [ebp - 0x182c], edx
movzx ecx, word [ebp + ebx*2 - 0x80c]
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.expected__c_to_be_a__in__s_n
movzx eax, cx
mov dword [esp + 8], eax
xor eax, eax
cmp cx, 0x5c
sete al
mov dword [esp], eax
call fcn.0050e8b0
xor edx, edx
mov eax, 0x845
mov word [ebp + ebx*2 - 0x80c], dx
call fcn.0050dc60
mov ecx, dword [ebp - 0x1834]
mov edx, dword [ebp - 0x182c]
test ecx, ecx
je 0x5142a3
mov dword [ebp - 0x182c], edx
mov ebx, 0x5efcf8
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x182c]
sub esp, 8
test eax, eax
jne 0x513ea7
mov eax, esi
call fcn.0050dc80
mov edx, dword [ebp - 0x182c]
mov ebx, eax
mov eax, dword [ebp - 0x1828]
mov dword [ebp - 0x1828], edx
test eax, eax
je 0x514214
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x1828]
mov ecx, 0x5efcf8
sub esp, 8
test eax, eax
jne 0x513eed
mov eax, edi
call fcn.0050dc80
mov edx, dword [ebp - 0x1828]
mov ecx, eax
mov dword [ebp - 0x182c], edx
mov dword [ebp - 0x1828], ecx
mov dword [esp + 4], esi
mov dword [esp], edi
mov eax, dword [ebp - 0x1838]
call eax
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], ebx
mov ecx, dword [ebp - 0x1828]
movzx eax, al
mov dword [esp + 4], 0x5f02bd
mov dword [esp + 8], ecx
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x846
call fcn.0050dc60
mov edx, dword [ebp - 0x182c]
lea esi, [esi + edx + 2]
mov eax, esi
shr eax, 0x10
je 0x5142c3
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x1828], 0x5efcf8
sub esp, 8
test eax, eax
jne 0x513f7f
mov eax, esi
call fcn.0050dc80
mov dword [ebp - 0x1828], eax
lea ebx, [ebp - 0x1806]
mov eax, ebx
shr eax, 0x10
je 0x5141fa
mov dword [esp + 4], 0xffffffff
mov edi, 0x5efcf8
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x513fb6
mov eax, ebx
call fcn.0050dc80
mov edi, eax
mov dword [esp + 4], esi
mov dword [esp], ebx
mov eax, dword [ebp - 0x1838]
call eax
mov esi, dword [ebp - 0x1828]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], esi
movzx eax, al
mov dword [esp + 8], edi
mov dword [esp + 4], str.expected__s_to_match__s_n
mov dword [esp], eax
call fcn.0050e8b0
jmp 0x514081
mov eax, 0x83f
call fcn.0050dc60
mov eax, dword [ebp - 0x1834]
test eax, eax
je 0x514234
mov dword [esp + 4], 0xffffffff
mov ebx, 0x5efcf8
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x514031
mov eax, esi
call fcn.0050dc80
mov ebx, eax
mov esi, dword [ebp - 0x1828]
test esi, esi
je 0x514257
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x5efcf8
test edx, edx
jne 0x514065
mov eax, edi
call fcn.0050dc80
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.expected__s_to_match_the_start_of__s_n
mov dword [esp], 0
call fcn.0050e8b0
mov eax, dword [ebp - 0x1824]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, di
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov edx, dword [ebp - 0x182c]
jmp 0x513d3f
movzx eax, si
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov edi, eax
jmp 0x5130b9
movzx eax, si
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov edi, eax
jmp 0x512f13
lea eax, [ebp - 0x180c]
mov dword [ebp - 0x1828], eax
movzx eax, word [ebp - 0x1828]
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov ebx, eax
jmp 0x513085
movzx eax, si
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov ebx, eax
mov eax, dword [ebp - 0x183c]
test eax, eax
jne 0x5136f7
lea eax, [ebp - 0x180c]
mov dword [ebp - 0x1828], eax
movzx eax, word [ebp - 0x1828]
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov edi, eax
jmp 0x513727
lea eax, [ebp - 0x180c]
mov dword [ebp - 0x1824], eax
movzx eax, word [ebp - 0x1824]
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov ebx, eax
jmp 0x512edc
movzx eax, si
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov ebx, eax
lea eax, [ebp - 0x181c]
shr eax, 0x10
jne 0x5132b8
lea eax, [ebp - 0x181c]
mov dword [ebp - 0x1828], eax
movzx eax, word [ebp - 0x1828]
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov edi, eax
jmp 0x5132e8
mov eax, 0x7e1
call fcn.0050dc60
mov dword [esp], str.QueryFullProcessImageNameW_unavailable__added_in_Windows_Vista__n
call fcn.0050e770
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, bx
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov edi, eax
jmp 0x513fb6
movzx eax, di
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov edx, dword [ebp - 0x1828]
mov ecx, eax
jmp 0x513eed
movzx eax, si
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov esi, dword [ebp - 0x1828]
mov ebx, eax
test esi, esi
jne 0x51403f
movzx eax, di
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
jmp 0x514065
lea eax, [ebp - 0x180c]
mov dword [ebp - 0x183c], edx
mov dword [ebp - 0x182c], eax
movzx eax, word [ebp - 0x182c]
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov edx, dword [ebp - 0x183c]
jmp 0x513e0f
movzx eax, si
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov edx, dword [ebp - 0x182c]
mov ebx, eax
jmp 0x513ea7
movzx eax, si
mov dword [esp], 0x5efdfe
mov dword [esp + 4], eax
call fcn.0050da50
mov dword [ebp - 0x1828], eax
jmp 0x513f7f
xor eax, eax
xor edx, edx
jmp 0x512e6d
xor eax, eax
xor edx, edx
jmp 0x513654
xor eax, eax
xor edx, edx
jmp 0x51301d
xor eax, eax
jmp 0x513c11
mov ebx, 2
jmp 0x513ce0
xor eax, eax
xor ecx, ecx
jmp 0x513b8d
xor eax, eax
jmp 0x51334b
xor eax, eax
xor edx, edx
jmp 0x51340b
xor eax, eax
jmp 0x51355c
xor eax, eax
jmp 0x513124
xor eax, eax
xor edx, edx
jmp 0x513214