Function at 0x414770
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x3a74]
mov eax, 0x3a74
call fcn.0046a9e0
push 0xffffffffffffffff
push 0x4898a1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x3864
call fcn.0046a9e0
mov eax, dword [0x4b38b4]
xor eax, ebp
mov dword [ebp + 0x3a70], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x3a7c]
xor esi, esi
push esi
push esi
push 0x1027
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x4b89d4]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x200]
push eax
mov dword [ebp - 0x164], 0x48fb00
mov dword [ebp - 0x160], 0x48fafc
mov dword [ebp - 0x15c], 0x48faf8
mov dword [ebp - 0x158], 0x48faf4
mov dword [ebp - 0x154], 0x48faf0
mov dword [ebp - 0x150], 0x48faec
mov dword [ebp - 0x14c], 0x48fae8
mov dword [ebp - 0x148], 0x48fae4
mov dword [ebp - 0x144], 0x48fae0
mov dword [ebp - 0x140], 0x48fadc
mov dword [ebp - 0x13c], 0x48fad8
mov dword [ebp - 0x138], 0x48fad4
mov dword [ebp - 0x134], 0x48fad0
mov dword [ebp - 0x130], 0x48facc
mov dword [ebp - 0x12c], 0x48fac8
mov dword [ebp - 0x128], 0x48fac4
mov dword [ebp - 0x124], 0x48fac0
mov dword [ebp - 0x120], 0x48fabc
mov dword [ebp - 0x11c], 0x48fab8
mov dword [ebp - 0x118], 0x48fab4
mov dword [ebp - 0x114], 0x48fab0
mov dword [ebp - 0x110], 0x48faac
mov dword [ebp - 0x10c], 0x48faa8
mov dword [ebp - 0x108], 0x48faa4
mov dword [ebp - 0x104], 0x48faa0
mov dword [ebp - 0x100], 0x48fa9c
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
call fcn.00423cd0
mov esi, eax
mov ecx, 0x17
mov edi, 0x4b8798
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x4b879e]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x414925
lea ecx, [ebp]
push ecx
mov ecx, dword [0x4b89d4]
call fcn.00423cf0
mov dword [ebp - 4], 0xffffffff
jmp 0x414945
push 0x3674
xor edi, edi
lea edx, [ebp - 0x3874]
push edi
push edx
call fcn.0046a470
add esp, 0xc
push edi
lea eax, [ebp - 0x184]
push eax
mov eax, dword [0x4b118c]
push 0x3674
lea ecx, [ebp - 0x3874]
push ecx
push 0x3674
mov edx, ecx
push edx
push 0x222018
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x3674
lea ecx, [ebp - 0x3874]
push ecx
push 0x4b4f58
mov esi, eax
call fcn.0046b7c0
add esp, 0xc
cmp esi, edi
jne 0x4149c8
mov edx, dword [0x4dc364]
push 0xff
push edx
call dword [sym.imp.USER32.dll_KillTimer]
push ebx
call fcn.00433e20
add esp, 4
call fcn.0042fd50
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x84], eax
mov dword [0x4b8664], eax
cmp eax, edi
jne 0x4149ea
push str.DRIVELETTERS
call fcn.00432f40
add esp, 4
cmp dword [ebp + 0x3a80], edi
jne 0x414a00
push edi
push edi
push 0x1009
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 0x3c], edi
je 0x414d41
push 1
call fcn.0040a650
mov esi, eax
add esp, 4
mov dword [ebp - 0x80], esi
call fcn.00432e70
mov byte [ebp - 0x19], al
cmp esi, edi
je 0x414d41
mov esi, dword [ebp + 0x3a80]
cmp esi, edi
jle 0x414a68
push 0x34
lea eax, [ebp - 0x1d8]
push edi
push eax
call fcn.0046a470
add esp, 0xc
lea ecx, [ebp - 0x1d8]
push ecx
push edi
push 0x1005
push ebx
mov dword [ebp - 0x1d8], 4
mov dword [ebp - 0x1d4], edi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x34
lea edx, [ebp - 0x74]
push edi
push edx
call fcn.0046a470
add esp, 0xc
lea eax, [ebp + 0x2670]
mov ecx, 0x20
mov dword [ebp - 0x74], 7
mov dword [ebp - 0x58], 2
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x60], eax
mov word [ebp + 0x2670], cx
mov dword [ebp - 0x54], 0x400003
cmp esi, edi
jne 0x414abb
lea edx, [ebp - 0x74]
push edx
push edi
push 0x1007
jmp 0x414ac5
lea eax, [ebp - 0x74]
push eax
push edi
push 0x1006
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
mov dword [ebp - 0x74], 1
call fcn.0040a4c0
add esp, 4
test eax, eax
je 0x414b0a
push str.SYSTEM_DRIVE
call fcn.0044ab30
add esp, 4
lea edx, [ebp + 0x2a70]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
cmp cx, di
jne 0x414af4
jmp 0x414ca9
push 1
cmp dword [0x4b87d6], edi
je 0x414c26
cmp dword [0x4b87da], 2
je 0x414ba5
call fcn.0040a7d0
mov dword [ebp - 0x18], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
and eax, 0x80000000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
fild qword [ebp - 0x18]
push 1
fchs
faddp st(1)
fstp qword [ebp - 0x38]
call fcn.0040a730
mov dword [ebp - 0x18], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
and eax, 0x80000000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
fild qword [ebp - 0x18]
fchs
faddp st(1)
fdivr qword [ebp - 0x38]
fmul qword [0x48f490]
fstp qword [esp]
push str.SYSTEM_DRIVE_ENCRYPTING
call fcn.0044ab30
add esp, 4
push eax
push 0x400
lea ecx, [ebp + 0x2a70]
push ecx
jmp 0x414ca1
call fcn.0040a7d0
mov dword [ebp - 0x18], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
and eax, 0x80000000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
fild qword [ebp - 0x18]
push 1
fchs
faddp st(1)
fstp qword [ebp - 0x38]
call fcn.0040a730
mov dword [ebp - 0x18], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
and eax, 0x80000000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
fild qword [ebp - 0x18]
fchs
faddp st(1)
fdivr qword [ebp - 0x38]
fld qword [0x48f490]
fmul st(1), st(0)
fsubrp st(1)
fstp qword [esp]
push str.SYSTEM_DRIVE_DECRYPTING
call fcn.0044ab30
add esp, 4
push eax
push 0x400
lea edx, [ebp + 0x2a70]
push edx
jmp 0x414ca1
call fcn.0040a7d0
mov dword [ebp - 0x18], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
and eax, 0x80000000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
fild qword [ebp - 0x18]
push 1
fchs
faddp st(1)
fstp qword [ebp - 0x38]
call fcn.0040a730
mov dword [ebp - 0x18], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
and eax, 0x80000000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
fild qword [ebp - 0x18]
fchs
faddp st(1)
fdivr qword [ebp - 0x38]
fmul qword [0x48f490]
fstp qword [esp]
push str.SYSTEM_DRIVE_PARTIALLY_ENCRYPTED
call fcn.0044ab30
add esp, 4
push eax
push 0x400
lea eax, [ebp + 0x2a70]
push eax
call fcn.0046b572
add esp, 0x14
mov edx, dword [ebp - 0x70]
lea ecx, [ebp + 0x2a70]
push ecx
push 1
push edx
push ebx
call fcn.00432d10
add esp, 0x10
lea eax, [ebp + 0x2a70]
push eax
push 1
call fcn.0040a730
add esp, 4
push edx
push eax
call fcn.00431240
mov edx, dword [ebp - 0x70]
lea ecx, [ebp + 0x2a70]
push ecx
push 2
push edx
push ebx
call fcn.00432d10
mov eax, dword [ebp + 0x218]
push eax
lea ecx, [ebp + 0x2670]
push ecx
call fcn.0042bf40
add esp, 0x24
lea edx, [ebp - 0x74]
push edx
push edi
push 0x1006
push ebx
mov dword [ebp - 0x6c], 3
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.00433520
test eax, eax
mov eax, str.HIDDEN
jne 0x414d2b
mov eax, str.SYSTEM_VOLUME_TYPE_ADJECTIVE
push eax
call fcn.0044ab30
push eax
mov eax, dword [ebp - 0x70]
push 4
push eax
push ebx
call fcn.00432d10
add esp, 0x14
lea ecx, [ebp - 0x390]
lea edx, [ebp - 0x3460]
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], 0x18
xor esi, esi
cmp dword [ebp - 0x3c], edi
je 0x414d88
cmp dword [ebp - 0x80], edi
jne 0x414d88
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax - 0x15c]
mov dl, byte [ebp - 0x19]
mov dword [ebp - 0x28], 1
cmp dl, byte [ecx]
je 0x414d8b
mov dword [ebp - 0x28], edi
cmp dword [ebp + 0x3a80], edi
jle 0x414dd9
push 0x34
lea eax, [ebp - 0x1d8]
push edi
push eax
call fcn.0046a470
mov ecx, dword [ebp - 0x24]
add esp, 0xc
lea edx, [ebp - 0x1d8]
push edx
push edi
push 0x1005
push ebx
mov dword [ebp - 0x1d8], 4
mov dword [ebp - 0x1d4], ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x414dd9
mov esi, dword [ebp - 0x1b8]
shr esi, 0x10
mov ecx, dword [ebp - 0x2c]
mov eax, 1
shl eax, cl
test dword [ebp - 0x3874], eax
jne 0x414ef9
cmp dword [ebp - 0x28], edi
jne 0x414ef9
mov edx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x4b8670], edi
test edx, eax
jne 0x41556a
cmp dword [ebp + 0x3a80], edi
jle 0x414e33
push ebx
call fcn.0040c9d0
shr eax, 0x10
add esp, 4
cmp dword [ebp + 0x3a80], eax
je 0x414e33
inc dword [ebp - 0x24]
jmp 0x41556a
push 0x34
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.0046a470
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp + ecx - 0x15c]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x70], eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x41
movzx ecx, ax
shl ecx, 0x10
add esp, 0xc
mov dword [ebp - 0x74], 7
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x54], ecx
cmp dword [ebp + 0x3a80], edi
jne 0x414e8c
lea edx, [ebp - 0x74]
push edx
push edi
push 0x1007
jmp 0x414e96
lea eax, [ebp - 0x74]
push eax
push edi
push 0x1006
push ebx
call esi
lea ecx, [ebp - 0x74]
push ecx
push edi
mov eax, 1
push 0x1006
push ebx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x60], 0x48e35a
mov dword [ebp - 0x6c], eax
call esi
lea edx, [ebp - 0x74]
push edx
push edi
push 0x1006
push ebx
mov dword [ebp - 0x6c], 2
call esi
lea eax, [ebp - 0x74]
push eax
push edi
push 0x1006
push ebx
mov dword [ebp - 0x6c], 3
call esi
lea ecx, [ebp - 0x74]
push ecx
push edi
push 0x1006
push ebx
mov dword [ebp - 0x6c], 4
call esi
jmp 0x41556a
push 0x34
lea edx, [ebp - 0x74]
push edi
push edx
call fcn.0046a470
mov ecx, dword [ebp - 0x24]
xor eax, eax
add esp, 0xc
cmp dword [ebp - 0x28], edi
mov dword [ebp - 0x70], ecx
setne al
inc ecx
mov dword [ebp - 0x74], 7
mov dword [ebp - 0x24], ecx
inc eax
cmp dword [ebp + 0x3a80], edi
mov dword [ebp - 0x58], eax
jle 0x414f39
cmp dword [ebp + 0x3a80], esi
jne 0x41556a
mov ecx, dword [ebp - 0x2c]
add ecx, 0x41
movzx edx, cx
shl edx, 0x10
or edx, eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax - 0x15c]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x60], ecx
cmp dword [ebp + 0x3a80], edi
jne 0x414f6b
lea edx, [ebp - 0x74]
push edx
push edi
push 0x1007
jmp 0x414f75
lea eax, [ebp - 0x74]
push eax
push edi
push 0x1006
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp + 0x2270]
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x28], edi
je 0x415205
push 1
call fcn.0040a4c0
add esp, 4
test eax, eax
je 0x414fdb
call fcn.00433520
test eax, eax
mov eax, str.HIDDEN_SYSTEM_PARTITION
jne 0x414fb6
mov eax, str.SYSTEM_PARTITION
push eax
call fcn.0044ab30
add esp, 4
lea edx, [ebp + 0x3270]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
cmp cx, di
jne 0x414fc5
jmp 0x4151e0
push 1
cmp dword [0x4b87d6], edi
je 0x415142
cmp dword [0x4b87da], 2
je 0x41509a
call fcn.0040a7d0
mov dword [ebp - 0xb8], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0xb4], edx
fild qword [ebp - 0xb8]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb0], edi
fild qword [ebp - 0xb0]
push 1
fchs
faddp st(1)
fstp qword [ebp - 0x7c]
call fcn.0040a730
mov dword [ebp - 0xc8], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0xc4], edx
fild qword [ebp - 0xc8]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], edi
fild qword [ebp - 0x98]
fchs
faddp st(1)
fdivr qword [ebp - 0x7c]
fmul qword [0x48f490]
fstp qword [esp]
push str.SYSTEM_PARTITION_ENCRYPTING
call fcn.0044ab30
add esp, 4
push eax
push 0x400
lea edx, [ebp + 0x3270]
push edx
jmp 0x4151d8
call fcn.0040a7d0
mov dword [ebp - 0xd0], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0xcc], edx
fild qword [ebp - 0xd0]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe0], edi
fild qword [ebp - 0xe0]
push 1
fchs
faddp st(1)
fstp qword [ebp - 0x7c]
call fcn.0040a730
mov dword [ebp - 0x90], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x8c], edx
fild qword [ebp - 0x90]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd8], edi
fild qword [ebp - 0xd8]
fchs
faddp st(1)
fdivr qword [ebp - 0x7c]
fld qword [0x48f490]
fmul st(1), st(0)
fsubrp st(1)
fstp qword [esp]
push str.SYSTEM_PARTITION_DECRYPTING
call fcn.0044ab30
add esp, 4
push eax
push 0x400
lea eax, [ebp + 0x3270]
push eax
jmp 0x4151d8
call fcn.0040a7d0
mov dword [ebp - 0xc0], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0xbc], edx
fild qword [ebp - 0xc0]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], edi
fild qword [ebp - 0xa0]
push 1
fchs
faddp st(1)
fstp qword [ebp - 0x7c]
call fcn.0040a730
mov dword [ebp - 0xa8], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0xa4], edx
fild qword [ebp - 0xa8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edi
fild qword [ebp - 0x38]
fchs
faddp st(1)
fdivr qword [ebp - 0x7c]
fmul qword [0x48f490]
fstp qword [esp]
push str.SYSTEM_PARTITION_PARTIALLY_ENCRYPTED
call fcn.0044ab30
add esp, 4
push eax
push 0x400
lea ecx, [ebp + 0x3270]
push ecx
call fcn.0046b572
add esp, 0x14
mov eax, dword [ebp - 0x70]
lea edx, [ebp + 0x3270]
push edx
push 1
push eax
push ebx
call fcn.00432d10
add esp, 0x10
push 1
call fcn.0040a730
add esp, 4
jmp 0x4153f7
mov esi, dword [ebp - 0x30]
push esi
call fcn.00430360
mov ecx, esi
add esp, 4
cmp dword [ecx], 0x5c3f3f5c
jne 0x41521e
add esi, 4
mov eax, esi
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0xe4], 0xf
mov dword [ebp - 0xe8], edi
mov byte [ebp - 0xf8], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415241
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0xfc]
call fcn.00402150
lea edx, [ebp - 0xfc]
push edx
lea eax, [ebp + 0x254]
push eax
mov dword [ebp - 4], 2
call fcn.00404fd0
add esp, 8
cmp dword [ebp - 0xe4], 0x10
mov byte [ebp - 4], 4
jb 0x415290
mov ecx, dword [ebp - 0xf8]
push ecx
call fcn.00469789
add esp, 4
mov dword [ebp - 0xe4], 0xf
mov dword [ebp - 0xe8], edi
mov byte [ebp - 0xf8], 0
cmp dword [ebp + 0x268], edi
je 0x4152d9
cmp dword [ebp + 0x26c], 8
mov eax, dword [ebp + 0x258]
jae 0x4152c4
lea eax, [ebp + 0x258]
mov edx, dword [ebp - 0x70]
push eax
push 1
push edx
push ebx
call fcn.00432d10
add esp, 0x10
jmp 0x4153ce
mov eax, esi
mov dword [ebp - 0x168], 0xf
mov dword [ebp - 0x16c], 0
mov byte [ebp - 0x17c], 0
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415300
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x180]
call fcn.00402150
invalid
invalid
push esp