Function at 0x100c4676
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push 0x48c
mov eax, 0x101134ec
call fcn.10062c32
mov dword [ebp - 0x498], edx
mov edi, ecx
mov dword [ebp - 0x484], edi
push 0x100
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.kernel32.dll_FindFirstVolumeW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100c4886
push 0xc
call fcn.100e5537
mov dword [ebp - 0x480], eax
pop ecx
mov ecx, dword [sym.imp.kernel32.dll_FindVolumeClose]
mov dword [eax], 0x1000544c
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [ebp - 0x494], eax
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x100c46e6
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jb 0x100c4860
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x434]
call fcn.100e5537
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.100802b8
cmp dword [ebp - 0x420], 8
lea eax, [ebp - 0x434]
jb 0x100c4734
mov eax, dword [ebp - 0x434]
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
push eax
call dword [sym.imp.kernel32.dll_QueryDosDeviceW]
test eax, eax
jne 0x100c4760
xor eax, eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], al
call fcn.1006af06
jmp 0x100c485e
lea esi, [ebp - 0x41c]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x100c476b
sub esi, ecx
mov eax, edi
sar esi, 1
cmp dword [edi + 0x14], 8
jb 0x100c4784
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x41c]
push ecx
push eax
call fcn.100e5537
add esp, 0xc
test eax, eax
jne 0x100c474b
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x488], eax
push 0x104
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 2
call fcn.100e5537
mov edi, dword [ebp - 0x490]
lea ecx, [ebp - 0x480]
xor eax, eax
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x48c]
sub eax, edi
push ecx
sar eax, 1
push eax
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.kernel32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x100c488e
call dword [sym.imp.kernel32.dll_GetLastError]
lea ecx, [ebp - 0x490]
cmp eax, 0xea
jne 0x100c4843
push dword [ebp - 0x480]
call fcn.100e5537
mov eax, dword [ebp - 0x48c]
lea ecx, [ebp - 0x480]
mov edi, dword [ebp - 0x490]
sub eax, edi
push ecx
sar eax, 1
push eax
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.kernel32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x100c488e
lea ecx, [ebp - 0x490]
call fcn.10075865
xor eax, eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], al
call fcn.1006af06
mov edi, dword [ebp - 0x484]
xor esi, esi
push 0x100
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindNextVolumeW]
test eax, eax
jne 0x100c46dd
lea ecx, [ebp - 0x494]
call fcn.100e5537
xor al, al
call fcn.10062bca
ret
mov ecx, dword [ebp - 0x484]
lea eax, [ebp - 0x47c]
push 0xffffffffffffffff
push esi
push eax
call fcn.100e5537
mov esi, eax
push edi
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 3
call fcn.100e5537
push esi
lea edx, [ebp - 0x44c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x464]
call fcn.10080ccb
mov ecx, dword [ebp - 0x498]
push eax
call fcn.100e5537
lea ecx, [ebp - 0x464]
call fcn.1006af06
lea ecx, [ebp - 0x44c]
call fcn.1006af06
lea ecx, [ebp - 0x47c]
call fcn.1006af06
lea ecx, [ebp - 0x490]
call fcn.10075865
lea ecx, [ebp - 0x434]
call fcn.1006af06
lea ecx, [ebp - 0x494]
call fcn.100e5537
mov al, 1
jmp 0x100c4888