Function at 0x403d46
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
mov eax, dword [0x4d8300]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
or dword [ebp - 0x368], 0xffffffff
or dword [ebp - 0x370], 0xffffffff
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x378], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
push 0x80
mov dword [ebp - 0x37c], eax
lea eax, [ebp - 0x29c]
push ebx
push eax
mov dword [ebp - 0x380], edx
mov dword [ebp - 0x390], esi
mov dword [ebp - 0x374], 1
call fcn.00478bc0
add esp, 0xc
lea ecx, [ebp - 0x39c]
push 0x10
pop edx
call fcn.0042dc5c
test esi, esi
js 0x40425e
cmp esi, 0x80
jb 0x403dd4
cmp esi, 0xc0
jbe 0x403deb
push 0x10a
push str.C:UsersGauravDownloads_formatusb_master_1__formatusb_master_srcdrive.c
push str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
call fcn.00486ba7
add esp, 0xc
lea eax, [esi - 0x80]
mov dword [ebp - 0x38c], eax
cmp eax, 0x40
ja 0x40425e
mov eax, ebx
mov dword [ebp - 0x36c], ebx
test eax, eax
lea eax, [ebp - 0x114]
push 0x104
push eax
jne 0x403e45
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov dword [ebp - 0x370], eax
cmp eax, 0xffffffff
jne 0x403e59
test edi, edi
jne 0x40425e
call fcn.0042fc51
push eax
push str.Could_not_access_first_GUID_volume:__s
call fcn.0042ed57
pop ecx
pop ecx
jmp 0x40425e
push dword [ebp - 0x370]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
test eax, eax
je 0x4041ac
lea eax, [ebp - 0x114]
push eax
call fcn.004816f0
mov esi, eax
mov dword [ebp - 0x384], esi
pop ecx
cmp esi, 4
ja 0x403e8a
push 0x11e
push str.C:UsersGauravDownloads_formatusb_master_1__formatusb_master_srcdrive.c
push str.len___4
call fcn.00486ba7
add esp, 0xc
push 4
lea eax, [ebp - 0x114]
push 0x4b4728
push eax
call fcn.004873d4
add esp, 0xc
test eax, eax
je 0x403ebb
push 0x11f
push str.C:UsersGauravDownloads_formatusb_master_1__formatusb_master_srcdrive.c
push str.safe_strnicmp_volume_name__volume_start__4___0
call fcn.00486ba7
add esp, 0xc
cmp byte [ebp + esi - 0x115], 0x5c
je 0x403edc
push 0x120
push str.C:UsersGauravDownloads_formatusb_master_1__formatusb_master_srcdrive.c
push str.volume_name_len___1___
call fcn.00486ba7
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x403ef3
cmp eax, 3
jne 0x403f41
lea eax, [esi - 1]
mov ecx, 0x104
cmp eax, ecx
jae 0x40427a
mov byte [ebp + eax - 0x114], bl
lea eax, [ebp - 0x21c]
push ecx
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x403f62
test edi, edi
jne 0x403f41
call fcn.0042fc51
push eax
lea eax, [ebp - 0x114]
push eax
push str.Failed_to_get_device_path_for_GUID_volume__s:__s
call fcn.0042ed57
add esp, 0xc
mov esi, dword [ebp - 0x368]
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp esi, 0xffffffff
je 0x403e05
jmp 0x4041cd
mov esi, ebx
mov eax, dword [esi*4 + 0x4b07cc]
test eax, eax
jne 0x403f73
mov eax, ebx
jmp 0x403f7a
push eax
call fcn.004816f0
pop ecx
push eax
push dword [esi*4 + 0x4b07cc]
lea eax, [ebp - 0x21c]
push eax
call fcn.004873d4
add esp, 0xc
test eax, eax
je 0x403f9b
inc esi
cmp esi, 2
jb 0x403f64
cmp esi, 2
jae 0x403fb9
test edi, edi
jne 0x403f41
lea eax, [ebp - 0x21c]
push eax
push str.Skipping_GUID_volume_for__s
call fcn.0042ed57
pop ecx
pop ecx
jmp 0x403f41
push ebx
push 0x80
push 3
push ebx
push 3
push SHChangeNotifyRegister
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x368], esi
cmp esi, 0xffffffff
jne 0x404013
test edi, edi
jne 0x404001
call fcn.0042fc51
push eax
lea eax, [ebp - 0x114]
push eax
push str.Could_not_open_GUID_volume__s:__s
call fcn.0042ed57
add esp, 0xc
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
jmp 0x403e05
push ebx
lea eax, [ebp - 0x388]
push eax
push 0xc8
lea eax, [ebp - 0x364]
push eax
push ebx
push ebx
push 0x560000
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x404167
cmp dword [ebp - 0x388], ebx
jbe 0x404167
test esi, esi
je 0x40405d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov dword [ebp - 0x368], esi
cmp dword [ebp - 0x364], ebx
jne 0x404085
test edi, edi
jne 0x403f47
lea eax, [ebp - 0x114]
push eax
push str.Ignoring_volume__s_because_it_has_no_extents...
call fcn.0042ed57
pop ecx
pop ecx
jmp 0x403f47
cmp dword [ebp - 0x364], 1
je 0x4040a4
test edi, edi
jne 0x403f47
lea eax, [ebp - 0x114]
push eax
push str.Ignoring_volume__s_because_it_has_more_than_one_extent__RAID__...
jmp 0x404079
mov eax, dword [ebp - 0x38c]
cmp dword [ebp - 0x35c], eax
jne 0x403f47
mov edx, dword [ebp - 0x398]
cmp edx, 0x10
je 0x40419a
cmp dword [ebp - 0x380], ebx
je 0x4040db
mov eax, dword [ebp - 0x384]
mov byte [ebp + eax - 0x115], 0x5c
mov eax, dword [ebp - 0x354]
mov ecx, dword [ebp - 0x350]
mov dword [ebp + edx*8 - 0x29c], eax
mov dword [ebp + edx*8 - 0x298], ecx
lea edx, [ebp - 0x114]
push 1
lea ecx, [ebp - 0x39c]
call fcn.0042dc87
pop ecx
test edi, edi
jne 0x403f47
cmp dword [ebp - 0x374], ebx
je 0x404136
mov dword [ebp - 0x374], ebx
cmp dword [0x5223d8], ebx
je 0x403f47
push str.Windows_volumes_from_this_device:
call fcn.0042ed57
pop ecx
cmp dword [0x5223d8], ebx
je 0x403f47
push dword [ebp - 0x350]
lea eax, [ebp - 0x114]
push dword [ebp - 0x354]
push eax
push str.__s___lld
call fcn.0042ed57
add esp, 0x10
jmp 0x403f47
test edi, edi
jne 0x40417d
call fcn.0042fc51
push eax
push str.Could_not_get_Disk_Extents:__s
call fcn.0042ed57
pop ecx
pop ecx
test esi, esi
je 0x403f47
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov dword [ebp - 0x368], esi
jmp 0x403f47
push 0x10
push str.Error:_Trying_to_process_a_disk_with_more_than__d_partitions_
call fcn.0042ed57
pop ecx
jmp 0x40424b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x4041cd
test edi, edi
jne 0x4041cd
call fcn.0042fc51
push eax
push str.Could_not_access_next_GUID_volume:__s
call fcn.0042ed57
pop ecx
pop ecx
mov ecx, dword [ebp - 0x398]
test ecx, ecx
je 0x40424c
mov edx, dword [ebp - 0x378]
mov eax, edx
mov esi, dword [ebp - 0x37c]
or eax, esi
je 0x404200
cmp edx, dword [ebp + ebx*8 - 0x29c]
jne 0x4041fb
cmp esi, dword [ebp + ebx*8 - 0x298]
je 0x404200
inc ebx
cmp ebx, ecx
jb 0x4041e9
cmp ebx, ecx
jae 0x404216
mov eax, dword [ebp - 0x39c]
push dword [eax + ebx*4]
call fcn.00487101
mov ebx, eax
jmp 0x40424b
mov ecx, dword [ebp - 0x390]
push edi
push esi
push edx
mov edx, dword [ebp - 0x380]
call fcn.00404280
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40424c
push 0x20
push ebx
call fcn.00478d20
pop ecx
pop ecx
test eax, eax
je 0x40424c
push str.Warning:_Using_physical_device_to_access_partition_data
call fcn.0042ed57
pop ecx
mov eax, dword [ebp - 0x370]
cmp eax, 0xffffffff
je 0x40425e
push eax
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
lea ecx, [ebp - 0x39c]
call fcn.0042dd56
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475c80
leave
ret
call fcn.00475db1
int3