Function at 0x463ae0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x677e70]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x2c], 0
je 0x463b26
push 0
push 0
push 0x30
push 0x5bd380
call fcn.0043bc90
add esp, 0x10
mov eax, 0x80004005
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x2c], eax
test eax, eax
je 0x463ce3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZwQuerySystemInformation
push eax
call esi
push str.ZwQueryInformationFile
push dword [edi + 0x2c]
mov ebx, eax
mov dword [ebp - 0x21c], ebx
call esi
mov dword [edi + 0x30], eax
test ebx, ebx
je 0x463ce3
test eax, eax
je 0x463ce3
xorps xmm0, xmm0
lea ebx, [edi + 0x34]
movups xmmword [ebx], xmm0
movups xmmword [ebx + 0x10], xmm0
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm0
movups xmmword [ebx + 0x40], xmm0
movups xmmword [ebx + 0x50], xmm0
movq qword [ebx + 0x60], xmm0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [0x5bd400]
mov edx, eax
mov dword [ebp - 0xc], ecx
xor esi, esi
mov ecx, dword [0x5bd404]
mov dword [ebp - 0x218], edx
mov dword [ebp - 8], ecx
mov eax, 1
mov ecx, esi
shl eax, cl
test edx, eax
je 0x463be6
push 0
push 0
push 0
push 0
push ebx
lea eax, [esi + 0x41]
push 0
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov edx, dword [ebp - 0x218]
inc esi
add ebx, 4
cmp esi, 0x1a
jl 0x463bb5
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
je 0x463ce3
xor ecx, ecx
mov esi, 0x1000
mov eax, esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0053e9a2
add esp, 4
mov dword [edi + 0x9c], eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0x10
push ecx
push 0x4000
push eax
push 0x10
call dword [ebp - 0x21c]
cmp eax, 0xc0000004
jne 0x463cd8
mov ebx, dword [ebp - 0x21c]
push dword [edi + 0x9c]
call fcn.0053eac5
add esi, esi
xor ecx, ecx
mov eax, esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0053e9a2
add esp, 8
mov dword [edi + 0x9c], eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0x10
push ecx
lea ecx, [esi*4]
push ecx
push eax
push 0x10
call ebx
cmp eax, 0xc0000004
je 0x463c82
mov ebx, dword [ebp - 8]
test eax, eax
jns 0x463d01
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
push edi
call dword [eax + 0x24]
pop esi
pop ebx
mov eax, 0x80004005
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x9c]
xor ebx, ebx
lea esi, [eax + 4]
cmp dword [eax], ebx
jbe 0x463d41
mov ecx, dword [ebp - 8]
movzx eax, word [esi + 6]
cmp eax, ecx
jne 0x463d28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x463d38
mov ecx, dword [ebp - 8]
mov eax, dword [edi + 0x9c]
inc ebx
add esi, 0x10
cmp ebx, dword [eax]
jb 0x463d13
jmp 0x463d41
mov al, byte [esi + 4]
mov byte [edi + 0xa0], al
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x9c]
push edi
lea ecx, [eax + 4]
mov dword [edi + 0x24], ecx
mov eax, dword [eax]
shl eax, 4
add eax, ecx
mov dword [edi + 0x28], eax
mov eax, dword [edi]
call dword [eax + 0x20]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret 4