Function at 0x449b37
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90c
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0xfc
xor esi, esi
lea eax, [ebp - 0x908]
push ebx
inc esi
push eax
mov dword [ebp - 0x7f8], esi
mov dword [ebp - 0x90c], ebx
call fcn.00450230
add esp, 0xc
mov dword [ebp - 0x7fc], ebx
call fcn.00447806
test eax, eax
je 0x449b88
mov eax, esi
jmp 0x44a1ad
mov ecx, dword [0x4cdfa8]
call fcn.0044628c
test eax, eax
jne 0x449ba4
push str.No_disks_in_backup._Please_check_your_command_line.
call fcn.0041c7ee
pop ecx
jmp 0x449b81
cmp dword [0x4d7590], ebx
jne 0x449bc0
push 0x4d7590
push str.SetThreadExecutionState
push str.kernel32.DLL
call fcn.0042f670
mov ecx, 0x4cdf98
call fcn.004429ba
mov dword [ebp - 0x808], eax
cmp eax, ebx
je 0x449bdb
or dword [eax + 0x20], 2
mov dword [eax + 0x24], ebx
cmp dword [0x4cd2ec], esi
jne 0x449bf4
push str.Please_wait
push 0x3f8
call fcn.00447f71
pop ecx
pop ecx
mov ecx, dword [0x4cdfa8]
push edi
call fcn.00446224
cmp dword [0x4cd658], esi
jne 0x449cc9
mov ecx, dword [0x4cdfa8]
xor edi, edi
call fcn.0044625e
mov ecx, dword [0x4cdfa8]
push eax
call fcn.00443c36
push eax
call fcn.0040e8b4
mov byte [ebp - 0x414], bl
cmp eax, ebx
je 0x449c51
cmp dword [eax], 1
jne 0x449c51
push dword [eax + 8]
lea eax, [ebp - 0x414]
push str..PhysicalDrive_d
push eax
call fcn.00450c76
add esp, 0xc
xor esi, esi
cmp dword [0x4cddb8], ebx
jle 0x449c8b
mov eax, dword [0x4cce90]
push 0x103
push dword [eax + esi*4]
lea eax, [ebp - 0x414]
push eax
call fcn.00450c23
add esp, 0xc
test eax, eax
jne 0x449c7e
xor edi, edi
inc edi
inc esi
cmp esi, dword [0x4cddb8]
jl 0x449c5b
cmp edi, ebx
jne 0x449cc9
push ebx
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
push str.You_have_to_use_your_MAXDATA_drive_as_backup_destination._nBackups_to_other_disks_are_not_allowed.
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x964
push str.WINSHOT
call fcn.0044dc85
add esp, 0x10
mov dword [0x4d659c], 1
mov dword [ebp - 0x7f8], 0x40
jmp 0x44a128
cmp dword [0x4cd630], ebx
jne 0x449cdc
push str.Disks_in_backup:
call fcn.0041c7ee
pop ecx
xor edi, edi
inc edi
cmp dword [0x4cd630], ebx
jne 0x449d0c
mov ecx, dword [0x4cdfa8]
call fcn.0044625e
mov ecx, dword [0x4cdfa8]
push eax
call fcn.00446246
push eax
push str.____s_____s
call fcn.0041c7ee
add esp, 0xc
push 0x3dc
lea eax, [ebp - 0x7f0]
push ebx
push eax
mov dword [ebp - 0x7f4], ebx
call fcn.00450230
mov ecx, dword [0x4cdfa8]
add esp, 0xc
push 0x40
call fcn.00446246
push eax
lea eax, [ebp - 0x7e8]
push eax
call fcn.00451260
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
push eax
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x7e8]
push eax
push 0x46a500
call fcn.0042f614
pop ecx
pop ecx
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetDiskFreeSpaceA]
test eax, eax
jne 0x449d8c
mov eax, edi
mov dword [ebp - 0x800], 0x200
mov dword [ebp - 0x804], eax
jmp 0x449d92
mov eax, dword [ebp - 0x804]
imul eax, dword [ebp - 0x800]
cmp byte [ebp - 0x7e7], 0x3a
mov dword [ebp - 0x5c8], eax
jne 0x449deb
cmp eax, ebx
je 0x449deb
push dword [0x4cd2d0]
lea eax, [ebp - 0x7f4]
push eax
call fcn.0042ad37
lea eax, [ebp - 0x7e8]
push eax
push str._sSnapshotDeleteAfterRestore.bat
call fcn.0042f614
push eax
call fcn.004503c5
mov ecx, dword [ebp - 0x7fc]
add esp, 0xc
inc dword [ebp - 0x7fc]
mov dword [ebp + ecx*4 - 0x90c], eax
mov ecx, dword [0x4cdfa8]
call fcn.00446229
test eax, eax
jne 0x449cdf
cmp dword [0x4d659c], ebx
jne 0x44a1d9
cmp dword [0x4cd308], 2
je 0x449e67
mov ecx, dword [0x4cdfa8]
call fcn.00446f74
mov esi, eax
cmp esi, ebx
je 0x449e67
cmp esi, edi
je 0x449e5b
jle 0x449e2f
cmp esi, 4
jle 0x449e5b
push ebx
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
push esi
push str.internal_error:invalid_return_value_from_Backup__create:__d
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x9a8
push str.WINSHOT
call fcn.0044dc85
add esp, 0x14
push edi
call fcn.00451974
cmp dword [0x4cd308], edi
je 0x44a128
mov eax, dword [0x4d7590]
cmp eax, ebx
je 0x449e77
push Ordinal_2
call eax
cmp dword [0x4cd334], edi
jne 0x449e91
mov ecx, 0x4cde18
call fcn.00414f41
test eax, eax
je 0x44a128
mov ecx, dword [0x4cdfa8]
call fcn.00446224
mov esi, 0x3f8
mov ecx, dword [0x4cdfa8]
mov dword [0x4a4230], ebx
mov dword [0x4a4234], ebx
call fcn.00446246
lea edx, [ebp - 0x20c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x449ec0
mov ecx, dword [0x4cdfa8]
call fcn.0044625e
lea edx, [ebp - 0x108]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x449edd
mov ecx, dword [0x4cdfa8]
call fcn.00446269
lea edx, [ebp - 0x310]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x449efa
xor eax, eax
mov cl, byte [ebp + eax - 0x310]
mov byte [eax + 0x4cd33c], cl
inc eax
cmp cl, bl
jne 0x449f06
cmp dword [0x4cd2ec], edi
jne 0x449f30
push str.Please_Wait
push esi
call fcn.00447f71
pop ecx
pop ecx
push ebx
jmp 0x449f3e
push 0x47a9f0
push esi
call fcn.00447f71
pop ecx
pop ecx
push edi
push esi
call fcn.00447e70
push ebx
push 0x41a
call fcn.00447e18
mov eax, str.differential
cmp dword [0x4cd314], ebx
jne 0x449f61
mov eax, 0x469fcc
push eax
push str.Saving__simage_of
push 0x401
call fcn.00447f71
lea eax, [ebp - 0x20c]
push eax
push 0x3ff
call fcn.00447f71
add esp, 0x14
cmp dword [0x4cd314], edi
jne 0x449fa9
push ebx
push edi
push Ordinal_2
lea eax, [ebp - 0x310]
push eax
push ebx
call fcn.00418796
test eax, eax
js 0x44a1d9
mov ecx, dword [0x4cdfa8]
call fcn.00446358
cmp eax, edi
jne 0x449fe2
mov ecx, dword [0x4cdfa8]
call fcn.00446281
cmp eax, edi
jne 0x449fe2
push dword [0x4cdfa8]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0042f421
jmp 0x44a044
lea eax, [ebp - 0x20c]
push eax
call fcn.0040cd48
sub eax, ebx
je 0x44a00f
dec eax
jne 0x44a04a
mov ecx, dword [0x4cdfa8]
call fcn.00446246
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0041bf6b
jmp 0x44a044
mov ecx, dword [0x4cdfa8]
call fcn.00446358
test eax, eax
jne 0x44a02b
call fcn.004250fe
test eax, eax
je 0x44a1bb
mov ecx, dword [0x4cdfa8]
push ebx
call fcn.00446246
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0042ebb5
mov dword [ebp - 0x7f8], eax
call fcn.00417370
cmp dword [ebp - 0x7f8], ebx
jne 0x44a1e4
push 0x420
push dword [0x4d617c]
call dword [sym.imp.e_to_open__s_IsDlgButtonChecked]
test eax, eax
jne 0x44a078
cmp dword [0x4cd300], ebx
je 0x44a0c6
push str.Verifying
push 0x401
call fcn.00447f71
xor eax, eax
cmp dword [0x4cd314], ebx
pop ecx
setne al
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004212d6
mov dword [ebp - 0x7f8], eax
cmp dword [0x4cd300], ebx
jne 0x44a0ba
push edi
push str.TestImageAfterBackup
call fcn.00447d88
cmp dword [ebp - 0x7f8], ebx
jne 0x44a1fc
mov ecx, dword [0x4cdfa8]
lea eax, [ebp - 0x108]
push eax
call fcn.00446246
push eax
push str._s_successfully_saved_to__s
push 0x517
call fcn.00447f71
push 0x46cf98
push esi
call fcn.00447f71
add esp, 0x18
cmp dword [0x4cd2ec], ebx
jne 0x44a109
push edi
push 0x41a
call fcn.00447e18
mov ecx, dword [0x4cdfa8]
call fcn.00446229
test eax, eax
jne 0x449ea1
push ebx
mov ecx, dword [0x4cdfa8]
call fcn.00445617
mov ecx, 0x4cde18
call fcn.00414eaa
mov eax, dword [0x4d7590]
cmp eax, ebx
je 0x44a142
push Ordinal_2
call eax
xor esi, esi
cmp dword [ebp - 0x7fc], ebx
jle 0x44a16e
mov edi, dword [ebp + esi*4 - 0x90c]
cmp edi, ebx
je 0x44a165
push edi
call fcn.00455606
push edi
call fcn.0045038b
pop ecx
pop ecx
inc esi
cmp esi, dword [ebp - 0x7fc]
jl 0x44a14c
cmp dword [0x4cd2ec], 1
pop edi
jne 0x44a184
push 1
push 0x3f8
call fcn.00447e18
mov eax, dword [ebp - 0x808]
cmp eax, ebx
je 0x44a19b
mov ecx, dword [ebp - 0x7f8]
and dword [eax + 0x20], 0xfffffffd
mov dword [eax + 0x24], ecx
push dword [0x49efd0]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov eax, dword [ebp - 0x7f8]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret
push str._nCannot_load_the_required_driver_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x9f1
push str.WINSHOT
call fcn.0044dc85
add esp, 0x10
mov dword [ebp - 0x7f8], edi
jmp 0x44a128
mov ecx, dword [0x4cdfa8]
call fcn.00446246
push eax
push str.Backup_of__s_aborted
call fcn.0041c7ee
pop ecx
pop ecx
push edi
jmp 0x44a11d