Function at 0x11154b00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e7c4b
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
cmp dword [0x1127acf0], ebx
je 0x11154c5a
mov eax, dword [edi]
mov dword [ebp - 0xfc], eax
lea eax, [edi + 0x828]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x11154b50
sub eax, edx
sar eax, 1
jne 0x11154b6e
cmp word [0x1127f0c4], bx
je 0x11154f15
mov esi, dword [ebp + 8]
push esi
push str.DoCaptureNT__d_..._n
call fcn.111bd7b0
add esp, 8
push 0x1127f184
push 2
call fcn.11068bb0
add esp, 4
push eax
push 0x41b
call fcn.111be4c0
mov ebx, eax
add esp, 0xc
mov dword [ebp - 0x100], ebx
mov dword [ebp - 4], 0
mov byte [0x1127f1a4], 0
mov ecx, 0x1127f1a8
test esi, esi
je 0x11154c05
push 0x1127efe0
call fcn.1113dbf0
push 0x1127f0c4
mov ecx, 0x1127f1b8
call fcn.1113dbf0
push 0x1127f184
mov ecx, 0x1127f1c8
call fcn.1113dbf0
add edi, 0x868
push edi
push 0x1127f0c4
push str.Wanted_printer_driver_s__existing_s_n
call fcn.111bd7b0
add esp, 0xc
mov byte [0x1127f1a4], 1
jmp 0x11154c42
call fcn.1113c610
mov ecx, 0x1127f1b8
call fcn.1113c610
mov ecx, 0x1127f1c8
call fcn.1113c610
mov ecx, dword [ebp - 0xfc]
push 0
add edi, 0x928
push edi
mov byte [0x1127f1a4], 1
call fcn.1114c4c0
test eax, eax
je 0x11154c42
xor ecx, ecx
mov word [edi], cx
push str.DoCaptureNT...done_n
call fcn.111bd7b0
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 8
jmp 0x11154f15
mov esi, dword [edi]
mov dword [ebp - 0x104], ebx
cmp dword [ebp + 8], ebx
je 0x11154e26
cmp dword [edi + 0x360], ebx
jne 0x11154f15
mov edx, dword [esi]
mov eax, dword [edx + 0x90]
push ebx
push 0xffffffffffffffff
mov ecx, esi
call eax
push 0x60
lea ebx, [edi + 0x368]
push ebx
push 0x11247f3c
push str.device
push str.windows
mov dword [ebp - 0xfc], ebx
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
mov edx, dword [esi]
mov eax, dword [edx + 0x90]
push 0
push 0
mov ecx, esi
call eax
cmp word [0x1127efe0], 0
je 0x11154cf0
push 0x1127f0a0
lea ecx, [ebp - 0xf8]
push 0x1127efe0
mov edx, ecx
push str._s_winspool__s:
push edx
mov dword [ebp - 0x104], ecx
call dword [sym.imp.MSVCR100.dll__swprintf]
add esp, 0x10
jmp 0x11154d79
push 0x2c
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_wcschr]
call ebx
add esp, 8
test eax, eax
je 0x11154d79
add eax, 2
push 0x2c
push eax
call ebx
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x11154d79
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x11154d16
sub eax, edx
sar eax, 1
cmp word [ebx + eax*2 - 2], 0x3a
jne 0x11154d79
push str.FILE:
push ebx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x11154d79
push 9
add ebx, 2
push ebx
push 0x1127f0a0
call dword [sym.imp.MSVCR100.dll_wcsncpy]
mov eax, 0x1127f0a0
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x11154d60
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [eax*2 + 0x1127f09e], cx
push 0x100
lea ebx, [edi + 0x160]
push ebx
push 0x1127f0a0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ecx, ebx
xor ebx, ebx
mov dword [edi + 0x364], ebx
cmp word [ecx], bx
je 0x11154dd3
nop
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x100], edx
jmp 0x11154db0
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x11154db0
sub eax, dword [ebp - 0x100]
inc ebx
sar eax, 1
lea ecx, [ecx + eax*2 + 2]
mov dword [edi + 0x364], ebx
cmp word [ecx], dx
jne 0x11154da0
cmp dword [edi + 0x364], 2
jle 0x11154deb
push 0
push 0x1127f0a0
push 3
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
cmp dword [edi + 0x14c], 0
je 0x11154e17
push 0x1127f0a0
lea eax, [ebp - 0x38]
push 0x1122e0e8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [edi + 0x14c]
add esp, 0xc
lea ecx, [ebp - 0x38]
push ecx
call edx
mov dword [edi + 0x360], 1
jmp 0x11154ea4
cmp dword [edi + 0x360], ebx
je 0x11154f15
cmp dword [edi + 0x364], 2
mov dword [edi + 0x360], ebx
jle 0x11154e55
lea eax, [edi + 0x160]
push eax
push 0x1127f0a0
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov edx, dword [esi]
mov eax, dword [edx + 0x90]
lea ecx, [edi + 0x368]
push ebx
mov dword [ebp - 0x104], ecx
push 0xffffffffffffffff
mov ecx, esi
call eax
lea ecx, [ebp - 0xf8]
push 0x60
mov edx, ecx
push edx
push 0x11247f3c
push str.device
push str.windows
mov dword [ebp - 0xfc], ecx
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
mov eax, dword [esi]
mov edx, dword [eax + 0x90]
push ebx
push ebx
mov ecx, esi
call edx
mov ebx, dword [ebp - 0x104]
test ebx, ebx
je 0x11154f05
mov eax, dword [ebp - 0xfc]
push eax
push ebx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x11154f05
mov edx, dword [esi]
mov eax, dword [edx + 0x90]
push 0
push 0xffffffffffffffff
mov ecx, esi
call eax
push ebx
push str.device
push str.windows
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
mov edx, dword [esi]
mov eax, dword [edx + 0x90]
push 0
push 0
mov ecx, esi
call eax
push 0
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [edi + 0x150]
test edi, edi
je 0x11154f15
mov ecx, dword [ebp + 8]
push ecx
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret