Function at 0x64c4b4
Capabilities:
Get disk information
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x48
push 0
push 0
dec ecx
jne 0x64c4bc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x64c843
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x64c854
call sub.KERNEL32.DLL_OutputDebugStringW
mov dl, 1
mov eax, dword [0x57b914]
call fcn.0057c614
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x64c7fb
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x64c7bb
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
xor edx, edx
call fcn.0057c024
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00479f18
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 8]
mov ecx, 0x64c888
call fcn.004072b0
push 0x64c8b4
call sub.KERNEL32.DLL_OutputDebugStringW
push 0x64c8dc
call sub.KERNEL32.DLL_OutputDebugStringW
push 0
push 0x7800000
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00471d98
mov edx, dword [ebp - 0x21c]
mov eax, ebx
call fcn.0064fea4
test al, al
je 0x64c662
lea eax, [ebp - 0x214]
push eax
push 0x103
call sub.KERNEL32.DLL_GetLogicalDriveStringsW
xor esi, esi
lea eax, [ebp - 4]
lea edx, [ebp - 0x214]
mov ecx, esi
add ecx, ecx
add ecx, ecx
add ecx, ecx
add edx, ecx
call fcn.00407088
mov eax, dword [ebp - 4]
test eax, eax
je 0x64c5b7
sub eax, 4
mov eax, dword [eax]
dec eax
jl 0x64c662
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 4]
call fcn.00471d98
mov eax, dword [ebp - 0x220]
call fcn.00406f68
push eax
call sub.KERNEL32.DLL_GetDriveTypeW
cmp eax, 3
jne 0x64c658
push 0
push 0x7800000
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0064fea4
test al, al
jne 0x64c649
movzx eax, byte [0x64c900]
push eax
lea eax, [ebp - 0x224]
push eax
lea edx, [ebp - 0x228]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00471d98
lea eax, [ebp - 0x228]
mov edx, 0x64c910
call fcn.00407230
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
call fcn.0047a998
mov edx, dword [ebp - 0x224]
mov eax, dword [ebp - 8]
call fcn.00406edc
jmp 0x64c662
mov eax, dword [ebp - 4]
test eax, eax
je 0x64c655
sub eax, 4
mov eax, dword [eax]
dec eax
jl 0x64c662
inc esi
cmp esi, 0x42
jne 0x64c593
push 0x64c914
call sub.KERNEL32.DLL_OutputDebugStringW
push 0
push 0x7800000
lea edx, [ebp - 0x22c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00471d98
mov edx, dword [ebp - 0x22c]
mov eax, ebx
call fcn.0064fea4
test al, al
je 0x64c769
mov dword [ebx + 0x65c], 3
push 0
lea edx, [ebp - 0x230]
mov eax, dword [ebx + 0x460]
call fcn.004f8a4c
mov eax, dword [ebp - 0x230]
call fcn.00406f68
push eax
lea eax, [ebp - 0x234]
push eax
mov ecx, 0x64c948
mov edx, 0x64ca7c
mov eax, ebx
call fcn.006532c0
mov eax, dword [ebp - 0x234]
call fcn.00406f68
push eax
mov eax, ebx
call fcn.00501360
push eax
call sub.user32.dll_MessageBoxW
mov eax, dword [ebx + 0x410]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x64caa4
push 0x64caa4
lea edx, [ebp - 0x238]
mov eax, 3
call fcn.00471048
mov eax, dword [ebp - 0x238]
push eax
push 0x64caa4
push 0x64cab4
push 0x64caa4
mov eax, dword [ebx + 0x630]
push eax
push 0
mov edx, dword [ebx + 0x658]
mov ecx, 0x64caa4
mov eax, ebx
call fcn.0065fb80
push 0
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00405750
jmp 0x64c802
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
lea eax, [ebp - 0x23c]
mov edx, 0x64cacc
call fcn.004072b0
mov eax, dword [ebp - 0x23c]
call fcn.00406f68
push eax
call sub.KERNEL32.DLL_OutputDebugStringW
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004717dc
test al, al
jne 0x64c7a7
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00471800
push 0x64cb04
call sub.KERNEL32.DLL_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64c7e5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64c802
mov eax, dword [ebp - 0xc]
call fcn.004047c4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64c84a
lea eax, [ebp - 0x240]
mov edx, 4
call fcn.00406ed4
lea eax, [ebp - 0x230]
call fcn.00406ecc
lea eax, [ebp - 0x22c]
mov edx, 6
call fcn.00406ed4
lea eax, [ebp - 4]
call fcn.00406ecc
ret