Function at 0x438bb0
Capabilities:
Get disk information
Get disk size

Disassembly:
mov eax, 0x21ec
call fcn.0046a970
mov eax, dword [0x4c437c]
xor eax, esp
mov dword [esp + 0x21e8], eax
mov eax, dword [esp + 0x21f0]
push ebx
mov ebx, dword [esp + 0x2200]
push ebp
push esi
mov esi, dword [esp + 0x2214]
push edi
mov edi, dword [esp + 0x2208]
xor ebp, ebp
push edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], ebp
call fcn.00425dd0
add esp, 4
test eax, eax
jne 0x4395c5
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [esp + 0x2204]
mov edx, 1
shl edx, cl
test edx, eax
jne 0x4395c5
cmp ebx, ebp
jne 0x438c3c
call fcn.00425da0
test eax, eax
jne 0x439748
push 0x2e0
lea eax, [esp + 0x1e0]
push ebp
push eax
call fcn.00469be0
mov eax, dword [esi + 0x5c]
mov edx, dword [0x4e9ef0]
xor ecx, ecx
add esp, 0xc
cmp dword [esp + 0x2214], ebp
mov dword [esp + 0x4b4], eax
sete cl
lea eax, [esp + 0x1ec]
sub eax, edi
mov dword [esp + 0x464], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x450], ecx
mov ecx, dword [esi + 0x60]
mov dword [esp + 0x4b8], ecx
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2204]
mov eax, dword [esp + 0x2210]
mov dword [esp + 0x440], edx
mov dword [esp + 0x43c], eax
mov dword [esp + 0x45c], ebp
cmp esi, ebp
je 0x438cce
mov ecx, 0x12
lea edi, [esp + 0x3f4]
rep movsd dword es:[edi], dword [esi]
jmp 0x438cd5
mov dword [esp + 0x3f4], ebp
mov edx, dword [esp + 0x24]
mov eax, dword [edx]
cmp eax, ebp
jne 0x438d02
cmp dword [edx + 8], ebp
je 0x438d02
lea esi, [edx + 0x14]
mov ecx, 0x12
lea edi, [esp + 0x46c]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x468], 1
jmp 0x438d09
mov dword [esp + 0x468], ebp
cmp dword [0x4e9ec4], 5
mov ecx, dword [edx + 4]
mov edx, dword [edx + 0xc]
mov dword [esp + 0x448], eax
mov dword [esp + 0x44c], ecx
mov dword [esp + 0x458], edx
mov dword [esp + 0x454], 1
jne 0x438d47
cmp dword [0x4e9ec8], ebp
jne 0x438d47
mov dword [esp + 0x454], ebp
mov esi, dword [esp + 0x14]
mov ebx, 0xf
mov eax, esi
mov dword [esp + 0x1d8], ebx
mov dword [esp + 0x1d4], ebp
mov byte [esp + 0x1c4], 0
lea edx, [eax + 1]
jmp 0x438d70
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x438d70
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x1c8]
call fcn.004110d0
push 4
push ebp
push 0x4a64dc
lea ecx, [esp + 0x1cc]
call fcn.0042b4f0
test eax, eax
jne 0x438e41
push 0xffffffffffffffff
mov byte [esp + 0x94], al
push 4
lea eax, [esp + 0x1c8]
push eax
lea ecx, [esp + 0x98]
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xac], ebp
call fcn.00410ea0
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x94]
push ecx
lea ecx, [esp + 0x1cc]
call fcn.00410ea0
mov edi, 0x10
cmp dword [esp + 0xa4], edi
jb 0x438e05
mov edx, dword [esp + 0x90]
push edx
call fcn.00469bc3
add esp, 4
mov eax, dword [esp + 0x1c4]
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa0], ebp
mov byte [esp + 0x90], 0
cmp dword [esp + 0x1d8], edi
jae 0x438e32
lea eax, [esp + 0x1c4]
push eax
push 0x104
push esi
call fcn.0046ffa1
add esp, 0xc
push 7
push ebp
push str.Volume
lea ecx, [esp + 0x1cc]
call fcn.0042b4f0
test eax, eax
jne 0x43921e
push 2
push 0xffffffffffffffff
push 0x4a5a90
lea ecx, [esp + 0x1cc]
call fcn.0042b5b0
mov ecx, dword [esp + 0x1d4]
lea edx, [ecx - 2]
cmp eax, edx
jne 0x43921e
dec ecx
push ecx
push ebp
lea eax, [esp + 0x1c8]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], ebp
mov byte [esp + 0x50], 0
call fcn.00410ea0
cmp dword [esp + 0x58], 0x10
mov eax, dword [esp + 0x44]
jae 0x438eb4
lea eax, [esp + 0x44]
push 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
mov edi, 0x10
setne bl
cmp dword [esp + 0x58], edi
jb 0x438ede
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00469bc3
add esp, 4
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebp
mov byte [esp + 0x44], 0
test bl, bl
je 0x4391f8
push ebp
push 1
push 1
lea edx, [esp + 0x148]
push 1
push edx
call fcn.00437ad0
add esp, 0x14
push eax
lea ecx, [esp + 0x60]
call fcn.00434570
lea ecx, [esp + 0x13c]
call fcn.00421090
mov eax, dword [esp + 0x13c]
push eax
call fcn.00469bc3
mov edx, dword [esp + 0x60]
mov eax, dword [edx + 4]
add esp, 4
lea ecx, [esp + 0x5c]
call eax
test al, al
je 0x4391d8
lea esp, [esp]
mov eax, dword [esp + 0x84]
mov byte [esp + 0x22], 0
mov byte [esp + 0x23], 0
cmp eax, ebp
jne 0x438f75
call fcn.0046ab95
mov eax, dword [esp + 0x84]
cmp eax, ebp
je 0x438f79
mov eax, dword [eax]
jmp 0x438f7b
xor eax, eax
mov ecx, dword [esp + 0x88]
cmp ecx, dword [eax + 0x10]
jb 0x438f8c
call fcn.0046ab95
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x88]
test bl, 1
je 0x438fbf
and ebx, 0xfffffffe
lea ecx, [esp + 0x154]
mov dword [esp + 0x18], ebx
call fcn.00421090
mov edx, dword [esp + 0x154]
push edx
call fcn.00469bc3
add esp, 4
cmp byte [esp + 0x61], 0
sete al
mov byte [esp + 0x61], al
test al, al
je 0x4391b6
cmp byte [edi + 2], 0
jne 0x439175
lea eax, [edi + 0x40]
push eax
lea ecx, [esp + 0x124]
push ecx
or ebx, 2
call fcn.004317c0
add esp, 8
cmp dword [eax + 0x18], 8
jb 0x438fff
mov eax, dword [eax + 4]
jmp 0x439002
add eax, 4
lea edx, [esp + 0x7f0]
push edx
push eax
call fcn.00426120
add esp, 8
test eax, eax
je 0x4390ad
mov esi, dword [esp + 0x14]
mov eax, esi
mov dword [esp + 0xc0], 0xf
mov dword [esp + 0xbc], ebp
mov byte [esp + 0xac], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439040
sub eax, edx
push eax
push esi
lea ecx, [esp + 0xb0]
call fcn.004110d0
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x108]
push ecx
or ebx, 0xc
call fcn.004317c0
lea edx, [esp + 0x7f8]
add esp, 8
lea ecx, [edx + 2]
lea esp, [esp]
mov si, word [edx]
add edx, 2
cmp si, bp
jne 0x439080
sub edx, ecx
mov ecx, dword [eax + 0x14]
sar edx, 1
push edx
lea edx, [esp + 0x7f4]
push edx
push ecx
push ebp
mov ecx, eax
call fcn.00428ae0
mov byte [esp + 0x13], 1
test eax, eax
je 0x4390b2
mov byte [esp + 0x13], 0
test bl, 8
je 0x4390f0
and ebx, 0xfffffff7
cmp dword [esp + 0x11c], 8
jb 0x4390d4
mov edx, dword [esp + 0x108]
push edx
call fcn.00469bc3
add esp, 4
xor eax, eax
mov dword [esp + 0x11c], 7
mov dword [esp + 0x118], ebp
mov word [esp + 0x108], ax
test bl, 4
je 0x43912c
and ebx, 0xfffffffb
cmp dword [esp + 0xc0], 0x10
jb 0x439112
mov ecx, dword [esp + 0xac]
push ecx
call fcn.00469bc3
add esp, 4
mov dword [esp + 0xc0], 0xf
mov dword [esp + 0xbc], ebp
mov byte [esp + 0xac], 0
test bl, 2
je 0x43916a
and ebx, 0xfffffffd
cmp dword [esp + 0x138], 8
jb 0x43914e
mov edx, dword [esp + 0x124]
push edx
call fcn.00469bc3
add esp, 4
xor eax, eax
mov dword [esp + 0x138], 7
mov dword [esp + 0x134], ebp
mov word [esp + 0x124], ax
cmp byte [esp + 0x13], 0
jne 0x439191
mov al, byte [esp + 0x61]
test al, al
sete al
mov byte [esp + 0x60], 1
mov byte [esp + 0x61], al
test al, al
jne 0x438fd3
mov dword [esp + 0x18], ebx
jmp 0x4391b6
cmp dword [edi + 0x58], 0x10
mov dword [esp + 0x18], ebx
jb 0x4391a0
mov eax, dword [edi + 0x44]
jmp 0x4391a3
lea eax, [edi + 0x44]
mov ecx, dword [esp + 0x14]
push eax
push 0x104
push ecx
call fcn.0046ffa1
add esp, 0xc
mov edx, dword [esp + 0x5c]
mov eax, dword [edx + 8]
lea ecx, [esp + 0x5c]
call eax
mov edx, dword [esp + 0x5c]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x5c]
call eax
test al, al
jne 0x438f50
lea ecx, [esp + 0x64]
call fcn.00421090
mov ecx, dword [esp + 0x64]
push ecx
call fcn.00469bc3
add esp, 4
mov dword [esp + 0x5c], vtable.TrueCrypt::ForEach::Container.0
jmp 0x43921e
mov eax, dword [esp + 0x1c4]
cmp dword [esp + 0x1d8], edi
jae 0x43920f
lea eax, [esp + 0x1c4]
push eax
push 0x104
push esi
call fcn.0046ffa1
add esp, 0xc
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x1ec]
push esi
push edx
call fcn.00424140
add esp, 8
xor ebx, ebx
cmp dword [esp + 0x1ec], 0x5645445c
jne 0x439265
cmp byte [esp + 0x1f0], 0x49
jne 0x439265
cmp byte [esp + 0x1f1], 0x43
jne 0x439265
cmp byte [esp + 0x1f2], 0x45
jne 0x439265
mov ebx, 1
mov edx, dword [esp + 0x34]
mov eax, esi
jmp 0x439270
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x439270
cmp ebx, ebp
jne 0x4393fe
push 2
push ebp
push 0x4a64d8
lea ecx, [esp + 0x1cc]
call fcn.0042b4f0
test eax, eax
jne 0x439379
push 0xffffffffffffffff
mov byte [esp + 0xcc], al
push 1
lea eax, [esp + 0x1c8]
mov esi, 0xf
push eax
lea ecx, [esp + 0xd0]
mov dword [esp + 0xe8], esi
mov dword [esp + 0xe4], ebp
call fcn.00410ea0
lea ecx, [esp + 0xc4]
push ecx
lea edx, [esp + 0xec]
push 0x4a64d4
push edx
call fcn.00430c80
mov edi, 0x10
add esp, 0xc
cmp dword [eax + 0x18], edi
jb 0x4392fc
mov eax, dword [eax + 4]
jmp 0x4392ff
add eax, 4
push eax
lea eax, [esp + 0x1f0]
push 0x104
push eax
call fcn.0046ffa1
add esp, 0xc
cmp dword [esp + 0x100], edi
jb 0x43932e
mov ecx, dword [esp + 0xec]
push ecx
call fcn.00469bc3
add esp, 4
mov dword [esp + 0x100], esi
mov dword [esp + 0xfc], ebp
mov byte [esp + 0xec], 0
cmp dword [esp + 0xdc], edi
jb 0x43935d
mov edx, dword [esp + 0xc8]
push edx
call fcn.00469bc3
add esp, 4
mov dword [esp + 0xdc], esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0xd8], ebp
mov byte [esp + 0xc8], 0
jmp 0x43937e
mov edi, 0x10
push 0x103
lea eax, [esp + 0x6f0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
test eax, eax
je 0x439403
lea ecx, [esp + 0x1c]
push ecx
mov edx, ecx
push edx
lea eax, [esp + 0x40]
push eax
push ecx
lea edx, [esp + 0x6fc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4393c1
mov eax, dword [esp + 0x38]
mov dword [esp + 0x444], eax
cmp dword [esp + 0x448], ebp
jne 0x439403
push ebp
push ebp
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push ebp
lea eax, [esp + 0x708]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x439403
mov ecx, dword [esp + 0x2c]
shr ecx, 0x13
and ecx, 1
mov dword [esp + 0x448], ecx
jmp 0x439403
mov edi, 0x10
lea edx, [esp + 0x1ec]
push edx
call fcn.004246f0
mov eax, dword [esp + 0x28]
add esp, 4
cmp dword [eax + 0x10], ebp
je 0x43944b
push 4
lea ecx, [esp + 0x464]
push ecx
lea edx, [esp + 0x1f4]
push str.DeviceHarddisk_dPartition
push edx
call fcn.0046ff5c
add esp, 0x10
cmp eax, 1
jne 0x4395ac
mov dword [esp + 0x45c], eax
push ebp
lea eax, [esp + 0xe8]
push eax
mov eax, dword [0x4c2cd0]
push 0x2e0
lea ecx, [esp + 0x1e8]
push ecx
push 0x2e0
mov edx, ecx
push edx
push 0x22200c
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea esi, [esp + 0x3f4]
mov edx, 0x48
mov edi, edx
mov ecx, esi
lea ebx, [ebx]
mov byte [ecx], 0
inc ecx
sub edi, 1
jne 0x439490
lea esp, [esp]
dec edx
mov byte [esi], 0
inc esi
cmp edx, ebp
jne 0x4394a0
lea esi, [esp + 0x46c]
mov edx, 0x48
mov edi, edx
mov ecx, esi
lea esp, [esp]
mov byte [ecx], 0
inc ecx
sub edi, 1
jne 0x4394c0
mov edi, 1
mov edi, edi
sub edx, edi
mov byte [esi], 0
add esi, edi
cmp edx, ebp
jne 0x4394d0
cmp eax, ebp
jne 0x439551
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x4395ef
cmp dword [esp + 0x450], ebp
je 0x4395cd
mov dword [esp + 0x450], ebp
cmp dword [esp + 0x221c], ebp
je 0x43952e
cmp dword [esp + 0x1d8], 0x10
jb 0x438c93
mov ecx, dword [esp + 0x1c4]
push ecx
call fcn.00469bc3
add esp, 4
jmp 0x438c93
cmp dword [esp + 0x1d8], 0x10
jb 0x438c93
mov edx, dword [esp + 0x1c4]
push edx
call fcn.00469bc3
add esp, 4
jmp 0x438c93
mov eax, dword [esp + 0x1dc]
cmp eax, ebp
je 0x43979a
cmp eax, 3
jne 0x439763
cmp dword [esp + 0x2220], ebp
je 0x43972e
mov eax, dword [0x4e9f24]
add eax, edi
cmp eax, 2
mov dword [0x4e9f24], eax
jle 0x43960f
cmp dword [esp + 0x4b4], ebp
jne 0x43960f
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x4b4], edi
call fcn.00410e60
jmp 0x438c93
cmp dword [esp + 0x1d8], edi
jb 0x4395c5
mov eax, dword [esp + 0x1c4]
push eax
call fcn.00469bc3
add esp, 4
or eax, 0xffffffff
jmp 0x43997b
cmp dword [esp + 0x1d8], 0x10
jb 0x4395c5
mov ecx, dword [esp + 0x1c4]
push ecx
call fcn.00469bc3
add esp, 4
or eax, 0xffffffff
jmp 0x43997b
cmp dword [esp + 0x221c], ebp
jne 0x439605
mov edx, dword [esp + 0x28]
push edx
call fcn.004293d0
add esp, 4
cmp dword [esp + 0x1d8], 0x10
jmp 0x4395b3
cmp ebx, ebp
je 0x43974f
cmp dword [esp + 0x468], ebp
je 0x43974f
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x3c]
push ecx
push 0x4a6478
push edx
call fcn.0046f4e6
add esp, 0xc
cmp eax, edi
jne 0x43972e
push 0x218
lea eax, [esp + 0x4c0]
push ebp
push eax
call fcn.00469be0
mov ecx, dword [esp + 0x48]
push ecx
push 0x4a643c
lea edx, [esp + 0x4d0]
push 0x104
push edx
mov dword [esp + 0x6e0], edi
call fcn.0046ca0e
add esp, 0x1c
push ebp
lea eax, [esp + 0xe4]
push eax
mov eax, dword [0x4c2cd0]
push 0x218
lea ecx, [esp + 0x4c8]
push ecx
push 0x218
mov edx, ecx
push edx
push 0x222034
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x43974f
cmp dword [esp + 0x6c8], ebp
je 0x43974f
push str.HIDDEN_VOL_PROT_PASSWORD_US_KEYB_LAYOUT
call fcn.004399e0
mov ecx, dword [esp + 0x2c]
add esp, 4
push eax
push 0x4a640c
push ecx
lea edx, [esp + 0x194]
push edx
call fcn.00431320
add esp, 8
push eax
lea eax, [esp + 0x1b0]
push eax
call fcn.00432010
add esp, 0xc
push eax
lea ecx, [esp + 0x174]
push ecx
call fcn.00432010
add esp, 0xc
lea ecx, [esp + 0x16c]
call fcn.004171d0
lea ecx, [esp + 0x1a4]
call fcn.004171d0
lea ecx, [esp + 0x188]
call fcn.004171d0
cmp dword [esp + 0x1d8], 0x10
jb 0x439748
mov edx, dword [esp + 0x1c4]
push edx
call fcn.00469bc3
add esp, 4
xor eax, eax
jmp 0x43997b
lea ecx, [esp + 0x1c0]
call fcn.00410e60
or eax, 0xffffffff
jmp 0x43997b
cmp dword [esp + 0x221c], ebp
jne 0x439779
cmp dword [esp + 0x1d8], 0x10
jmp 0x4395b3
cmp dword [esp + 0x1d8], 0x10
jb 0x439748
mov ecx, dword [esp + 0x1c4]
push ecx
call fcn.00469bc3
add esp, 4
xor eax, eax
jmp 0x43997b
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
cmp dword [esp + 0x1e4], ebp
je 0x43988c
cmp dword [0x4c2cc8], ebp
jne 0x439825
cmp ebx, ebp
jne 0x439825
mov edi, dword [esp + 0x14]
push edi
call fcn.00427a60
add esp, 4
test eax, eax
jne 0x439829
push edi
call fcn.00427a80
add esp, 4
test eax, eax
jne 0x439829
mov edx, dword [esp + 0x2204]
add edx, 0x41
mov word [esp + 0x6e4], dx
lea edx, [esp + 0x6e4]
push edx
mov eax, 0x3a
xor ecx, ecx
push str.MOUNTED_CONTAINER_FORCED_READ_ONLY
mov word [esp + 0x6ee], ax
mov word [esp + 0x6f0], cx
call fcn.004399e0
add esp, 4
push eax
lea eax, [esp + 0x1200]
push eax
call esi
add esp, 0xc
jmp 0x439829
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x1e4], ebp
je 0x439890
cmp dword [0x4c2cc8], ebp
jne 0x439890
cmp ebx, ebp
je 0x439890
mov ecx, dword [esp + 0x2204]
add ecx, 0x41
mov word [esp + 0x6dc], cx
lea ecx, [esp + 0x6dc]
push ecx
mov edx, 0x3a
xor eax, eax
push str.MOUNTED_DEVICE_FORCED_READ_ONLY
mov word [esp + 0x6e6], dx
mov word [esp + 0x6e8], ax
call fcn.004399e0
add esp, 4
push eax
lea edx, [esp + 0xa00]
push edx
call esi
add esp, 0xc
jmp 0x439890
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x1e8], ebp
je 0x439916
cmp dword [0x4c2cc8], ebp
jne 0x439916
push str.DeviceHarddisk
push edi
call fcn.0046d660
add esp, 8
cmp eax, edi
jne 0x439916
mov eax, dword [esp + 0x2204]
add eax, 0x41
mov word [esp + 0x6d4], ax
lea eax, [esp + 0x6d4]
push eax
mov ecx, 0x3a
xor edx, edx
push str.MOUNTED_DEVICE_FORCED_READ_ONLY_WRITE_PROTECTION
mov word [esp + 0x6de], cx
mov word [esp + 0x6e0], dx
call fcn.004399e0
add esp, 4
push eax
lea ecx, [esp + 0x1a00]
push ecx
call esi
add esp, 0xc
cmp dword [0x4e9ec4], 6
jl 0x439916
push str.DeviceHarddiskVolume
push edi
call fcn.0046d660
add esp, 8
mov edx, dword [esp + 0x2204]
push ebp
push edx
push 0x8000
mov dword [0x4e9f24], ebp
call fcn.0042bfb0
add esp, 0xc
cmp dword [esp + 0x450], ebp
jne 0x43995c
cmp dword [esp + 0x1d8], 0x10
jb 0x439955
mov eax, dword [esp + 0x1c4]
push eax
call fcn.00469bc3
add esp, 4
mov eax, 2
jmp 0x43997b
cmp dword [esp + 0x1d8], 0x10
jb 0x439976
mov ecx, dword [esp + 0x1c4]
push ecx
call fcn.00469bc3
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x21f8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046a1be
add esp, 0x21ec
ret