Function at 0x4024b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x41e4d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 8]
push esi
push eax
push str.NTFSInfo
call fcn.00401050
push esi
lea eax, [ebp + 8]
push eax
push str.NTFSInfo
call fcn.00401cd0
add esp, 0x18
test eax, eax
jne 0x4024fd
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403360
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 2
jne 0x4027f6
call fcn.00402390
test al, al
je 0x4027ff
mov ecx, dword [ebp + 8]
push ebx
cmp ecx, 1
jle 0x4025a8
mov edx, dword [esi + 4]
mov al, byte [edx]
cmp al, 0x2d
je 0x402556
cmp al, 0x2f
je 0x402556
cmp al, 0x61
jl 0x40253e
cmp al, 0x7a
jg 0x40253e
movsx ebx, al
sub ebx, 0x61
jmp 0x4025ab
cmp al, 0x41
jl 0x402813
cmp al, 0x5a
jg 0x402813
movsx ebx, al
sub ebx, 0x41
jmp 0x4025ab
lea eax, [edx + 1]
push str.help
push eax
call fcn.00404369
add esp, 8
test eax, eax
je 0x402834
mov eax, dword [esi + 4]
inc eax
push 0x4188e8
push eax
call fcn.00404369
add esp, 8
test eax, eax
je 0x402834
mov eax, dword [esi + 4]
inc eax
push 0x4188ec
push eax
call fcn.00404369
add esp, 8
test eax, eax
jne 0x40282b
jmp 0x402834
mov ebx, dword [ebp - 0x68]
cmp ecx, 1
je 0x40283d
lea eax, [ebp - 0x64]
push eax
push ebx
call fcn.004022e0
add esp, 8
test al, al
je 0x4027e1
push edi
push str._nVolume_Size_n
call fcn.004038e7
push str.____________n
call fcn.004038e7
add esp, 8
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 0
push dword [ebp - 0x3c]
call fcn.00404500
push 0
push 0x100000
push edx
push eax
call fcn.00404450
push edx
push eax
push str.Volume_size____________:__I64d_MB_n
call fcn.004038e7
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push str.Total_sectors__________:__I64d_n
call fcn.004038e7
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push str.Total_clusters_________:__I64d_n
call fcn.004038e7
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push str.Free_clusters__________:__I64d_n
call fcn.004038e7
mov edi, dword [ebp - 0x48]
add esp, 0x30
mov esi, dword [ebp - 0x4c]
push 0
push 0x64
push edi
push esi
call fcn.00404500
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push edx
push eax
call fcn.00404450
push edx
push eax
push edi
push esi
push 0
push dword [ebp - 0x38]
call fcn.00404500
push 0
push 0x100000
push edx
push eax
call fcn.00404450
push edx
push eax
push str.Free_space_____________:__I64d_MB___I64d___of_drive__n
call fcn.004038e7
push str._nAllocation_Size_n
call fcn.004038e7
push str._________________n
call fcn.004038e7
push dword [ebp - 0x3c]
push str.Bytes_per_sector_______:__d_n
call fcn.004038e7
push dword [ebp - 0x38]
push str.Bytes_per_cluster______:__d_n
call fcn.004038e7
push dword [ebp - 0x30]
push str.Bytes_per_MFT_record___:__d_n
call fcn.004038e7
push dword [ebp - 0x30]
push str.Clusters_per_MFT_record:__d_n
call fcn.004038e7
push str._nMFT_Information_n
call fcn.004038e7
add esp, 0x40
push str.________________n
call fcn.004038e7
mov edi, dword [ebp - 0x28]
add esp, 4
mov esi, dword [ebp - 0x2c]
push 0
push 0x64
push edi
push esi
call fcn.00404500
push 0
push dword [ebp - 0x38]
push edx
push eax
call fcn.00404450
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push edx
push eax
call fcn.00404450
push edx
push eax
push 0
push 0x100000
push edi
push esi
call fcn.00404450
push edx
push eax
push str.MFT_size_______________:__I64d_MB___I64d___of_drive__n
call fcn.004038e7
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push str.MFT_start_cluster______:__I64d_n
call fcn.004038e7
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push str.MFT_zone_clusters______:__I64d____I64d_n
call fcn.004038e7
mov edi, dword [ebp - 0xc]
add esp, 0x34
sub edi, dword [ebp - 0x14]
mov esi, dword [ebp - 8]
sbb esi, dword [ebp - 0x10]
push 0
push 0x64
push esi
push edi
call fcn.00404500
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push edx
push eax
call fcn.00404450
push edx
push eax
push esi
push edi
push 0
push dword [ebp - 0x38]
call fcn.00404500
push 0
push 0x100000
push edx
push eax
call fcn.00404450
push edx
push eax
push str.MFT_zone_size__________:__I64d_MB___I64d___of_drive__n
call fcn.004038e7
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push str.MFT_mirror_start_______:__I64d_n
call fcn.004038e7
push str._nMeta_Data_files_n
call fcn.004038e7
push str.________________n
call fcn.004038e7
push ebx
call fcn.00402210
add esp, 0x2c
xor eax, eax
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403360
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop ebx
xor ecx, ebp
pop esi
call fcn.00403360
mov esp, ebp
pop ebp
ret
push 1
push dword [esi]
call fcn.00402440
push str.Not_running_on_supported_version_of_Windows_NT._n
call fcn.004038e7
add esp, 4
push 1
call fcn.00403886
movsx eax, al
push eax
push str.illegal_drive:__c_n
call fcn.004038e7
add esp, 8
push 1
call fcn.00403886
push 1
push dword [esi]
call fcn.00402440
push 0
push dword [esi]
call fcn.00402440
push 1
push dword [esi]
call fcn.00402440
int3