Function at 0x1002f327
Capabilities:
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10060698
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [esp + 0x54], ecx
je 0x1002f99d
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x1002f995
lea eax, [esp + 0x40]
xor ebx, ebx
push eax
push 0x1000
lea ecx, [esp + 0x4c]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
call fcn.100305db
mov dword [esp + 0x12c], ebx
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x44]
push dword [esp + 0x44]
sar eax, 1
push eax
push 0x50bb
push 0xd734
call fcn.10014513
pop ecx
pop ecx
call eax
mov dword [esp + 0x1c], 0x3b93
cmp dword [esp + 0x1c], 0x3f1a
jle 0x1002f45d
mov dword [esp + 0x10], ebx
mov esi, ebx
mov dword [esp + 0x18], ebx
mov edi, ebx
mov ecx, esi
mov dword [esp + 0x40], 0x7514
mov esi, dword [esp + 0x10]
mov dword [esp + 0x50], ecx
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x108]
cdq
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002f406
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push ebx
push 1
lea ecx, [esp + 0x110]
call fcn.10015918
mov ecx, dword [esp + 0x50]
add ecx, edi
dec dword [esp + 0x40]
mov dword [esp + 0x50], ecx
jne 0x1002f3e9
mov esi, dword [esp + 0x18]
dec edi
cmp edi, 0xffff8d2f
jg 0x1002f3d7
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x705a
jl 0x1002f3d5
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x62a4
jl 0x1002f3cf
mov esi, dword [ebp + 0x10]
push dword [esp + 0x44]
lea ecx, [esp + 0x78]
call fcn.100151d3
cmp dword [esp + 0x1c], 0x394d
jge 0x1002f47f
push str.sjsj_wqaziugz_rtaia_qpna
call fcn.1004881f
pop ecx
push 0xc1b0
mov dword [esp + 0x130], 1
call fcn.100401ce
mov dword [esp], 0x4d58
lea ecx, [esp + 0x1c]
movzx eax, ax
mov edx, 0x45ff
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x78]
push eax
push 0x14ef
push 1
push 0x7b22
push 1
push ebx
push 0x129e
push 0x61ff
push 0x7374
call fcn.1002eb47
push 0x34cb
push 0x4fa0
lea eax, [esp + 0xa4]
mov dl, 1
push eax
push 1
mov cl, dl
call fcn.1002e847
add esp, 0x38
lea eax, [esp + 0x74]
cmp dword [esp + 0x88], 8
cmovae eax, dword [esp + 0x74]
push ebx
push eax
push 0x50bb
push 0x8685
call fcn.10014513
pop ecx
pop ecx
call eax
lea eax, [esp + 0x74]
mov edx, 0x6aaa
push eax
push 0x13a3
push 0x61ec
push 1
push 0x2707
push 1
push 1
push 0x7e6d
lea eax, [esp + 0x38]
mov ecx, 0x4226
push eax
push 0x6ca0
call fcn.1002eb47
add esp, 0x28
mov dword [esp + 0x58], ebx
lea eax, [esp + 0x58]
push 0xe13
push 0x6565
push eax
push ecx
push esi
push 1
call fcn.1002ef06
add esp, 0x18
mov byte [esp + 0x17], bl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], 0x1d03c902
mov dword [esp + 0x30], 0x4b014b00
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x90]
call fcn.100151ab
push 0x10
pop edx
lea ecx, [esp + 0xf0]
mov byte [esp + 0x12c], 4
call fcn.1001b66a
push 1
push ecx
lea edx, [esp + 0x94]
mov byte [esp + 0x134], 5
lea ecx, [esp + 0xf8]
call fcn.1002eea9
pop ecx
pop ecx
push 0x78
pop eax
push 2
mov word [esp + 0x70], ax
pop esi
movzx eax, byte [esp + esi + 0x2a]
movzx ecx, byte [esp + esi + 0x2d]
movzx eax, word [esp + eax*2 + 0x68]
mov edx, eax
and eax, ecx
or edx, ecx
sub edx, eax
movzx eax, byte [esp + esi + 0x2c]
add esi, 2
mov word [esp + eax*2 + 0x68], dx
cmp esi, 8
jb 0x1002f5de
xor eax, eax
mov dword [esp + 0xd0], 7
mov word [esp + 0x70], ax
lea ecx, [esp + 0xbc]
mov word [esp + 0xbc], ax
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0xd0], ebx
call fcn.10015b99
push ecx
push ecx
lea eax, [esp + 0xc4]
mov byte [esp + 0x134], 6
push eax
lea ecx, [esp + 0x98]
call fcn.10030617
push ebx
push 1
lea ecx, [esp + 0xc4]
mov byte [esp + 0x134], 5
call fcn.10015c21
xor eax, eax
lea edi, [esp + 0x68]
cmp dword [esp + 0xa0], 8
stosd dword es:[edi], eax
push ebx
push 0x80
push 2
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x98]
cmovae eax, dword [esp + 0x98]
pop edi
push edi
push ebx
push ebx
push 0x40000000
push eax
push 0x50bb
push 0xb6ee
call fcn.10014513
pop ecx
pop ecx
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x1002f700
push ebx
lea eax, [esp + 0xf0]
push eax
push dword [esp + 0x60]
mov eax, dword [ebp + 0x10]
push dword [eax]
push esi
push 0x50bb
push 0xe757
call fcn.10014513
pop ecx
pop ecx
call eax
push esi
test eax, eax
push 0x50bb
push 0xac2c
setne bl
call fcn.10014513
pop ecx
pop ecx
call eax
test bl, bl
jne 0x1002f74a
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0xf8]
call fcn.10015c21
push ebx
push 1
lea ecx, [esp + 0x94]
mov byte [esp + 0x134], 1
call fcn.10015c21
mov edi, dword [esp + 0x1c]
inc edi
mov dword [esp + 0x1c], edi
cmp edi, 0x12c
jb 0x1002f58b
mov ecx, dword [esp + 0x54]
mov dword [ecx], 2
jmp 0x1002f97e
xor ebx, ebx
mov dword [esp + 0x24], 0x83047600
push 0x22
pop eax
mov ecx, ebx
mov word [esp + 0x28], 0xa6ed
mov byte [esp + 0x2a], 0xa6
mov esi, edi
mov word [esp + 0x20], ax
mov dword [esp + 0x10], ecx
cmp esi, edi
jne 0x1002f77f
push 5
pop ecx
push ecx
mov dword [esp + 0x14], ecx
pop esi
jmp 0x1002f7bc
movzx edx, byte [esp + esi + 0x25]
mov eax, esi
sub eax, ecx
movzx eax, byte [esp + eax + 0x22]
movzx eax, word [esp + eax*2 + 0x20]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [esp + esi + 0x24]
push ecx
push 0xe76
push 1
mov word [esp + eax*2 + 0x2c], cx
lea ecx, [esp + 0x1c]
call fcn.1002fb04
mov ecx, dword [esp + 0x1c]
add esp, 0xc
add esi, edi
cmp esi, 7
jb 0x1002f770
xor eax, eax
mov dword [esp + 0xb8], 7
mov word [esp + 0x22], ax
lea ecx, [esp + 0xa4]
mov word [esp + 0xa4], ax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0xb8], ebx
call fcn.10015b99
push 1
push ecx
push ecx
lea eax, [esp + 0x98]
mov byte [esp + 0x138], 7
push 0x51
push eax
lea edx, [esp + 0xb8]
mov dword [esp + 0x34], ebx
call fcn.1002f253
add esp, 0x14
mov dword [esp + 0x34], 0x2006101
mov dword [esp + 0x38], 0x9fc72703
mov ecx, ebx
mov dword [esp + 0x3c], 0x7c027103
push 0x20
pop eax
push 2
mov word [esp + 0x62], ax
pop esi
cmp esi, 4
jne 0x1002f84f
push esi
pop ecx
push 6
pop esi
jmp 0x1002f878
movzx edx, byte [esp + esi + 0x35]
mov eax, esi
sub eax, ecx
movzx eax, byte [esp + eax + 0x32]
movzx ecx, word [esp + eax*2 + 0x5c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [esp + esi + 0x34]
add ecx, edx
mov word [esp + eax*2 + 0x5c], cx
mov ecx, ebx
add esi, 2
cmp esi, 0xc
jb 0x1002f843
xor eax, eax
mov dword [esp + 0xe8], 7
mov word [esp + 0x64], ax
lea ecx, [esp + 0xd4]
mov word [esp + 0xd4], ax
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0xe8], ebx
call fcn.10015b99
push ecx
push ecx
lea eax, [esp + 0xdc]
mov byte [esp + 0x134], 8
push eax
lea ecx, [esp + 0xb0]
call fcn.10030617
push ebx
push 1
lea ecx, [esp + 0xdc]
mov byte [esp + 0x134], 7
call fcn.10015c21
push 1
xor eax, eax
lea edi, [esp + 0x60]
push 0x6101
stosd dword es:[edi], eax
mov dl, 1
push 0x29ab
push 0x2db5
push 1
stosd dword es:[edi], eax
mov ecx, 0x36e2
stosw word es:[edi], ax
lea eax, [esp + 0x2b]
push eax
push 0x504a
push 0x16b4
push 0x2eb5
push 0x56de
push 0x393
push 0x7be6
push 0x5327
call fcn.1002f070
add esp, 0x34
lea edx, [esp + 0x74]
lea ecx, [esp + 0xa4]
call fcn.1002d9f7
mov ecx, dword [esp + 0x54]
push ebx
push 1
mov dword [ecx], eax
lea ecx, [esp + 0xac]
call fcn.10015c21
push ebx
push 1
lea ecx, [esp + 0xf8]
call fcn.10015c21
push ebx
push 1
lea ecx, [esp + 0x94]
call fcn.10015c21
push ebx
push 1
lea ecx, [esp + 0x7c]
call fcn.10015c21
lea ecx, [esp + 0x44]
call fcn.10021c0f
jmp 0x1002f9a8
mov dword [ecx], 1
jmp 0x1002f9a8
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret