Function at 0x42691e
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push 0x254
mov eax, 0x4696b7
call fcn.0046791c
mov ebx, ecx
mov dword [ebp - 0x220], ebx
call fcn.00424abc
test al, al
jne 0x426945
xor eax, eax
jmp 0x426d8e
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
push 0x105
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstVolumeW]
mov dword [ebp - 0x254], eax
cmp eax, 0xffffffff
jne 0x4269ba
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x4269b2
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x426c2e
jmp 0x4269bc
mov edi, esi
push 0x8001
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
mov esi, eax
mov dword [ebp - 0x260], esi
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
mov ebx, eax
cmp ebx, 3
je 0x426a05
cmp ebx, 2
jne 0x426bd8
push ecx
xor edx, edx
mov ecx, 0x405f54
call fcn.0043e8fc
test eax, eax
jne 0x426bd8
mov edi, dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x224], eax
lea edx, [ebp - 0x250]
lea eax, [ebp - 0x224]
push eax
lea ecx, [edi + 0x2c]
call fcn.0042fa72
test eax, eax
js 0x426af5
mov ecx, dword [ebp - 0x250]
mov eax, dword [edi + 0x2c]
push ecx
lea eax, [eax + ecx*4]
mov ebx, dword [eax]
lea ecx, [ebp - 0x23c]
push eax
mov dword [ebp - 0x22c], ebx
call fcn.00420b42
mov edi, eax
test edi, edi
js 0x426bd8
mov ecx, dword [ebp - 0x220]
push dword [ebp - 0x250]
add ecx, 0x2c
call fcn.0047594d
mov edi, eax
test edi, edi
js 0x426bd8
cmp byte [ebx + 0x21], 0
je 0x426a87
xor eax, eax
jmp 0x426a8a
mov eax, dword [ebx + 0x1c]
mov ecx, ebx
mov dword [ebp - 0x224], eax
call fcn.004209d9
mov edi, eax
test edi, edi
js 0x426bd8
mov edi, dword [ebp - 0x22c]
mov ecx, edi
mov bl, byte [ebx + 0x20]
call fcn.00423b45
mov al, byte [edi + 0x20]
mov byte [ebp - 0x228], al
cmp bl, al
je 0x426bab
test al, al
je 0x426ad5
cmp byte [edi + 0x21], 0
je 0x426ad0
xor eax, eax
jmp 0x426adb
mov eax, dword [edi + 0x1c]
jmp 0x426adb
mov eax, dword [ebp - 0x224]
push dword [ebp - 0x228]
mov ecx, dword [ebp - 0x220]
push eax
push edi
call fcn.004235f6
mov edi, eax
jmp 0x426ba7
and dword [ebp - 0x224], 0
mov edi, dword [ebp - 0x220]
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 4
call fcn.0042bb30
push ecx
lea eax, [ebp - 0x21c]
push eax
lea edx, [edi + 0xc]
lea ecx, [ebp - 0x224]
call fcn.0042fee0
mov edi, eax
test edi, edi
js 0x426b98
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x220]
call fcn.004235b5
mov edi, eax
test edi, edi
js 0x426b98
push ecx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x23c]
call fcn.00420b42
mov edi, eax
test edi, edi
js 0x426b98
cmp ebx, 2
jne 0x426b98
xor edx, edx
mov ecx, 0x410c38
call fcn.00431166
test al, al
jne 0x426b98
mov eax, dword [ebp - 0x224]
cmp byte [eax + 0x21], 0
je 0x426b82
xor eax, eax
jmp 0x426b85
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x22c]
push eax
push ecx
call fcn.0043004d
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 3
call fcn.0042bb30
test edi, edi
js 0x426bd8
mov ebx, dword [ebp - 0x220]
lea eax, [ebp - 0x24c]
lea edx, [ebp - 0x25c]
mov dword [ebp - 0x25c], ebx
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x258], eax
call fcn.0042fb83
mov edi, eax
jmp 0x426bde
mov ebx, dword [ebp - 0x220]
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
test edi, edi
js 0x426c2e
push 0x105
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x254]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextVolumeW]
test eax, eax
je 0x426c10
xor edi, edi
jmp 0x4269bc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x426c27
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x426c2e
mov edi, 0x80004005
lea esi, [edi + 0x7ff8ffee]
neg esi
sbb esi, esi
and esi, edi
jl 0x426d64
mov edi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x30]
lea eax, [edi + eax*4]
mov dword [ebp - 0x228], eax
cmp edi, eax
je 0x426c93
mov ebx, dword [edi]
cmp dword [ebx + 0xc], 0
je 0x426c68
push dword [ebx + 0xc]
call dword [sym.imp.api_ms_win_service_private_l1_1_0.dll_I_ScUnregisterDeviceNotification]
and dword [ebx + 0xc], 0
mov eax, dword [edi]
cmp byte [eax + 0x21], 0
je 0x426c74
xor ecx, ecx
jmp 0x426c77
mov ecx, dword [eax + 0x1c]
mov ebx, dword [ebp - 0x220]
push 0
push ecx
push eax
mov ecx, ebx
call fcn.004235f6
add edi, 4
cmp edi, dword [ebp - 0x228]
jne 0x426c53
mov eax, dword [ebx + 0x40]
add ebx, 0x3c
mov dword [ebp - 0x22c], ebx
mov edi, dword [ebx]
lea eax, [edi + eax*4]
mov dword [ebp - 0x228], eax
cmp edi, eax
je 0x426cd6
mov ebx, dword [edi]
cmp dword [ebx + 0xc], 0
je 0x426cc9
push dword [ebx + 0xc]
call dword [sym.imp.api_ms_win_service_private_l1_1_0.dll_I_ScUnregisterDeviceNotification]
and dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x228]
add edi, 4
cmp edi, eax
jne 0x426cae
mov ebx, dword [ebp - 0x22c]
mov edi, dword [ebp - 0x220]
lea ecx, [edi + 0x2c]
call fcn.00427b21
mov ecx, ebx
call fcn.00427b21
mov eax, dword [ebp - 0x23c]
xor ecx, ecx
mov dword [edi + 0x2c], eax
mov eax, dword [ebp - 0x234]
mov dword [edi + 0x34], eax
mov eax, dword [ebp - 0x238]
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0x230]
mov dword [edi + 0x38], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x244]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x248]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x230], ecx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x240], ecx
lea ecx, [ebp - 0x24c]
call fcn.00427b21
lea ecx, [ebp - 0x23c]
call fcn.00427b21
mov eax, dword [ebp - 0x254]
cmp eax, 0xffffffff
je 0x426d8c
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindVolumeClose]
mov eax, esi
call fcn.004678b9
ret