Function at 0x413e20
Capabilities:
Get disk information
Get process image filename
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x73c
mov eax, dword [0x448004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x6a8]
mov esi, edx
push 0
push eax
call fcn.00420f90
add esp, 0xc
mov dword [ebp - 0x6c8], 0x4429e8
xor eax, eax
mov dword [ebp - 0x6c4], 0x43feec
mov dword [ebp - 0x6f4], eax
xor ecx, ecx
mov dword [ebp - 0x6e0], eax
xor edi, edi
push 0x104
push eax
mov dword [ebp - 0x6d0], eax
xor ebx, ebx
mov byte [ebp - 0x6c9], al
mov dword [ebp - 0x6e4], eax
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x6c0], 0x4429ec
mov dword [ebp - 0x6bc], 0x4429f0
mov dword [ebp - 0x6b8], 0x4429f4
mov dword [ebp - 0x6b4], 0x4429f8
mov dword [ebp - 0x6b0], 0x4429fc
mov dword [ebp - 0x6ac], 0x442a00
mov dword [ebp - 0x6d4], ecx
call fcn.00420f90
add esp, 0xc
push dword [esi + 4]
push str.FindProcessOccupyDisk_for_PhyDrive__d
call fcn.00414ac0
push 0x104
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00420f90
add esp, 0x14
lea eax, [ebp - 0x298]
push dword [esi + 4]
push str..PhysicalDrive_d
push 0x80
push eax
call fcn.00401010
add esp, 0x10
lea eax, [ebp - 0x218]
push 0x104
push eax
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x413f66
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QueryDosDeviceA_failed_error:_u
call fcn.00414ac0
push 0x440240
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004241d3
add esp, 0x14
jmp 0x413f7a
lea eax, [ebp - 0x218]
push eax
push str.QueryDosDeviceA_success__s
call fcn.00414ac0
add esp, 8
xor ecx, ecx
cmp byte [ebp - 0x218], cl
je 0x413fa7
cmp ecx, 0x104
jge 0x413fa7
movsx ax, byte [ebp + ecx - 0x218]
mov word [ebp + ecx*2 - 0x6a8], ax
inc ecx
cmp byte [ebp + ecx - 0x218], bl
jne 0x413f84
lea eax, [ebp - 0x6a8]
mov dword [0x44aef4], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [0x44aea4], ebx
jne 0x414030
push str.Ntdll
call eax
mov esi, eax
test esi, esi
jne 0x414010
cmp word [0x4493f8], 0x20
jb 0x413fe5
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.00414ac0
add esp, 4
jmp 0x414010
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x414010
mov cx, word [0x4493f8]
movzx eax, cx
inc cx
mov word [0x4493f8], cx
mov dword [eax*4 + 0x44b6a0], esi
push str.NtQueryObject
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x44aea4], eax
mov eax, 0xc0000002
cmove edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [0x44aec4], ebx
jne 0x4140a8
push str.NtDll
call eax
mov esi, eax
test esi, esi
jne 0x414089
cmp word [0x4493f8], 0x20
jb 0x41405e
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.00414ac0
add esp, 4
jmp 0x414089
push str.NtDll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x414089
mov cx, word [0x4493f8]
movzx eax, cx
inc cx
mov word [0x4493f8], cx
mov dword [eax*4 + 0x44b6a0], esi
push str.NtDuplicateObject
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44aec4], eax
test eax, eax
jne 0x4140a8
test edi, edi
mov eax, 0xc0000002
cmovns edi, eax
cmp dword [0x44aeb4], ebx
jne 0x414147
push str.NtDll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x414109
cmp word [0x4493f8], 0x20
jb 0x4140de
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.00414ac0
add esp, 4
jmp 0x414109
push str.NtDll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x414109
mov cx, word [0x4493f8]
movzx eax, cx
inc cx
mov word [0x4493f8], cx
mov dword [eax*4 + 0x44b6a0], esi
push str.NtClose
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44aeb4], eax
test eax, eax
jne 0x414147
test edi, edi
js 0x414127
mov edi, 0xc0000002
mov ecx, edi
call fcn.00413590
push eax
push str.Warning:_Could_not_enumerate_process_handles:__s
call fcn.00414ac0
mov edi, dword [ebp - 0x6d4]
add esp, 8
jmp 0x4148da
test edi, edi
js 0x414127
cmp dword [0x44aea8], ebx
jne 0x4141f5
mov eax, dword [0x44aebc]
test eax, eax
jne 0x4141ce
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x4141b5
cmp word [0x4493f8], 0x20
jb 0x41418a
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.00414ac0
add esp, 4
jmp 0x4141b5
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4141b5
mov cx, word [0x4493f8]
movzx eax, cx
inc cx
mov word [0x4493f8], cx
mov dword [eax*4 + 0x44b6a0], esi
push str.RtlCreateHeap
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44aebc], eax
test eax, eax
je 0x414122
push 0
push 0
push 0x100000
push 0x200000
push 0
push 3
call eax
mov dword [0x44aea8], eax
test eax, eax
jne 0x4141f5
mov edi, 0x80000001
jmp 0x414127
lea ecx, [ebp - 0x6d4]
call fcn.004137f0
mov edi, eax
test edi, edi
js 0x414127
mov ecx, dword [0x44aef4]
mov dword [ebp - 0x708], ebx
mov dword [ebp - 0x6f0], 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414223
sub ecx, edx
mov dword [ebp - 0x6e8], 0x200
sar ecx, 1
movzx eax, cx
mov ecx, 0x200
mov dword [ebp - 0x714], eax
call fcn.00413760
mov edi, dword [ebp - 0x6d4]
mov ebx, eax
mov dword [ebp - 0x6dc], ebx
test ebx, ebx
je 0x4148da
push dword [edi]
push str.handles__NumberOfHandles___lu
call fcn.00414ac0
add esp, 8
cmp dword [edi], 0x2710
ja 0x4148da
push 0
call fcn.004252d3
mov ecx, dword [edi]
xor esi, esi
add esp, 4
mov dword [ebp - 0x70c], eax
mov dword [ebp - 0x710], edx
mov dword [ebp - 0x6ec], esi
test ecx, ecx
je 0x4148da
lea edx, [edi + 8]
mov dword [ebp - 0x700], edx
cmp esi, ecx
mov dword [ebp - 0x6fc], 8
mov eax, 0x51eb851f
mov ecx, esi
sbb edi, edi
and edi, edx
mul esi
mov dword [ebp - 0x6d8], edi
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
jne 0x414302
push ecx
call fcn.004252d3
add esp, 4
sub eax, dword [ebp - 0x70c]
sbb edx, dword [ebp - 0x710]
test edx, edx
jg 0x4148ce
jl 0x414302
cmp eax, 0xa
ja 0x4148c0
mov eax, dword [ebp - 0x6e0]
test eax, eax
je 0x414326
cmp dword [ebp - 0x6d0], 0xffffffff
je 0x414326
push eax
call dword [0x44aeb4]
mov dword [ebp - 0x6e0], 0
test edi, edi
je 0x41432f
mov eax, dword [edi + 4]
jmp 0x414332
or eax, 0xffffffff
mov ecx, dword [ebp - 0x6f0]
mov dword [ebp + ecx*4 - 0x708], eax
mov esi, dword [ebp - 0x708]
mov ebx, dword [ebp - 0x704]
cmp esi, ebx
je 0x4143c6
inc ecx
and ecx, 0x80000001
jns 0x41435d
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp byte [ebp - 0x6c9], 0
mov dword [ebp - 0x6f0], ecx
je 0x4143a6
mov eax, dword [ebp - 0x6e4]
and eax, 7
push dword [ebp + eax*4 - 0x6c8]
lea eax, [ebp - 0x110]
push eax
push dword [ebp + ecx*4 - 0x708]
push str.___06u___s___s_
call fcn.00414ac0
add esp, 0x10
mov byte [ebp - 0x6c9], 0
xor eax, eax
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebp - 0x6d0]
test eax, eax
je 0x4143c6
cmp eax, 0xffffffff
je 0x4143bc
push eax
call dword [0x44aeb4]
mov dword [ebp - 0x6d0], 0
mov ecx, dword [ebp - 0x6d4]
mov eax, dword [ebp - 0x6ec]
cmp eax, dword [ecx]
jae 0x4148ce
mov edi, dword [edi + 4]
cmp edi, dword [ebp - 0x6f4]
je 0x414892
mov ecx, dword [ebp - 0x6d8]
test byte [ecx + 0xc], 0x23
je 0x414892
cmp esi, ebx
je 0x414533
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, eax
jne 0x41441a
mov dword [ebp - 0x6d0], 0xffffffff
jmp 0x414892
mov eax, dword [0x44aeac]
test eax, eax
jne 0x414498
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x414478
cmp word [0x4493f8], 0x20
jb 0x41444d
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.00414ac0
add esp, 4
jmp 0x414478
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x414478
mov cx, word [0x4493f8]
movzx eax, cx
inc cx
mov word [0x4493f8], cx
mov dword [eax*4 + 0x44b6a0], esi
push str.NtOpenProcess
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44aeac], eax
test eax, eax
jne 0x414498
mov dword [ebp - 0x6d0], eax
jmp 0x414892
lea ecx, [ebp - 0x720]
mov dword [ebp - 0x720], edi
push ecx
lea ecx, [ebp - 0x738]
mov dword [ebp - 0x71c], 0
push ecx
push 0x450
lea ecx, [ebp - 0x6d0]
mov dword [ebp - 0x738], 0x18
push ecx
mov dword [ebp - 0x734], 0
mov dword [ebp - 0x72c], 0
mov dword [ebp - 0x730], 0
mov dword [ebp - 0x728], 0
mov dword [ebp - 0x724], 0
call eax
test eax, eax
jns 0x41452d
mov dword [ebp - 0x6d0], 0
cmp eax, 0xc0000022
jne 0x414892
mov eax, dword [ebp - 0x6d8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x6f4], eax
jmp 0x414892
mov ecx, dword [ebp - 0x6d8]
mov eax, dword [ebp - 0x6d0]
cmp eax, 0xffffffff
je 0x414892
push 0
push 0
push 0
lea edx, [ebp - 0x6e0]
push edx
push 0xffffffffffffffff
push dword [ecx + 8]
push eax
call dword [0x44aec4]
test eax, eax
js 0x414892
push dword [ebp - 0x6e0]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x414892
mov ebx, dword [ebp - 0x6dc]
mov esi, dword [ebp - 0x6e8]
lea eax, [ebp - 0x6f8]
push eax
push esi
push ebx
push 1
push dword [ebp - 0x6e0]
call dword [0x44aea4]
mov edi, eax
cmp edi, 0x80000005
je 0x4145b9
cmp edi, 0xc0000004
je 0x4145b9
cmp edi, 0xc0000023
jne 0x414673
push dword [ebp - 0x6f8]
push esi
push str.SearchProcess:_Realloc_from__d_to__d
call fcn.00414ac0
mov eax, dword [ebp - 0x6f8]
add esp, 0xc
mov dword [ebp - 0x6e8], eax
mov eax, dword [0x44aeb8]
test eax, eax
jne 0x41464c
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x414637
cmp word [0x4493f8], 0x20
jb 0x41460c
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.00414ac0
add esp, 4
jmp 0x414637
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x414637
mov cx, word [0x4493f8]
movzx eax, cx
inc cx
mov word [0x4493f8], cx
mov dword [eax*4 + 0x44b6a0], esi
push str.RtlFreeHeap
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44aeb8], eax
test eax, eax
je 0x414657
push ebx
push 0
push dword [0x44aea8]
call eax
mov esi, dword [ebp - 0x6e8]
mov ecx, esi
call fcn.00413760
sub dword [ebp - 0x6fc], 1
mov ebx, eax
jne 0x414584
mov dword [ebp - 0x6dc], ebx
test edi, edi
jns 0x4146a3
mov ecx, edi
call fcn.00413590
mov esi, dword [ebp - 0x6d8]
push eax
push dword [esi + 4]
push dword [esi + 8]
push str.SearchProcess:_NtQueryObject_failed_for_handle__X_of_process__ld:__s
call fcn.00414ac0
add esp, 0x10
jmp 0x414892
mov eax, dword [ebp - 0x714]
cmp ax, word [ebx]
ja 0x414892
movzx eax, ax
push eax
push dword [ebx + 4]
push dword [0x44aef4]
call fcn.00425331
add esp, 0xc
test eax, eax
jne 0x414892
mov eax, dword [ebp - 0x6d8]
mov ecx, dword [ebp - 0x6e4]
mov byte [ebp - 0x6c9], 1
or ecx, dword [eax + 0xc]
mov dword [ebp - 0x6e4], ecx
test cl, 0x20
je 0x4146fc
and ecx, 3
or ecx, 4
mov dword [ebp - 0x6e4], ecx
cmp byte [ebp - 0x110], 0
jne 0x414718
push dword [0x44aef4]
push str.WARNING:_The_following_process_es__or_service_s__are_accessing__S:
call fcn.00414ac0
add esp, 8
mov ecx, dword [ebp - 0x6d0]
mov dword [ebp - 0x718], 0x104
call fcn.00413a30
mov esi, eax
test esi, esi
je 0x414761
push 0
push 0
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call fcn.0042422d
add esp, 4
jmp 0x414892
mov esi, dword [ebp - 0x6d0]
push 2
push 0x103
call fcn.00421bc0
add esp, 8
mov edi, eax
push 0x103
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x4147c3
push 0
push 0
push 0x103
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jne 0x4147c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x4147d0
push edi
call fcn.0042422d
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x414892
lea eax, [ebp - 0x718]
push eax
lea eax, [ebp - 0x4a0]
push eax
push esi
push dword [ebp - 0x6d0]
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test al, al
je 0x414823
push esi
push esi
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x4a0]
push eax
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x414892
push 0x104
lea eax, [ebp - 0x4a0]
push eax
push dword [ebp - 0x6d0]
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
setne bl
test eax, eax
je 0x41486a
push 0
push 0
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x4a0]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test bl, bl
jne 0x414892
mov eax, dword [ebp - 0x6d8]
push 0
push dword [eax + 4]
lea eax, [ebp - 0x110]
push str.Unknown_Process_0x_llx
push 0x104
push eax
call fcn.00401010
add esp, 0x14
mov edi, dword [ebp - 0x6d4]
mov esi, dword [ebp - 0x6ec]
mov edx, dword [ebp - 0x700]
inc esi
add edx, 0x1c
mov dword [ebp - 0x6ec], esi
mov ecx, dword [edi]
mov dword [ebp - 0x700], edx
cmp esi, ecx
jb 0x4142b1
jmp 0x4148d4
mov ebx, dword [ebp - 0x6dc]
mov edi, dword [ebp - 0x6d4]
jmp 0x4148da
mov edi, dword [ebp - 0x6d4]
mov ebx, dword [ebp - 0x6dc]
cmp byte [ebp - 0x110], 0
je 0x4148f2
push str.You_should_close_these_applications_before_attempting_to_reformat_the_drive.
call fcn.00414ac0
add esp, 4
jmp 0x414905
push dword [0x44aef4]
push str.NOTE:_Could_not_identify_the_process_es__or_service_s__accessing__S
call fcn.00414ac0
add esp, 8
mov eax, dword [0x44aeb8]
test ebx, ebx
je 0x414990
test eax, eax
jne 0x414980
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x41496b
cmp word [0x4493f8], 0x20
jb 0x414940
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.00414ac0
add esp, 4
jmp 0x41496b
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x41496b
mov cx, word [0x4493f8]
movzx eax, cx
inc cx
mov word [0x4493f8], cx
mov dword [eax*4 + 0x44b6a0], esi
push str.RtlFreeHeap
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44aeb8], eax
test eax, eax
je 0x414990
push ebx
push 0
push dword [0x44aea8]
call eax
mov eax, dword [0x44aeb8]
test edi, edi
je 0x414a0d
test eax, eax
jne 0x414a02
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x4149ed
cmp word [0x4493f8], 0x20
jb 0x4149c2
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.00414ac0
add esp, 4
jmp 0x4149ed
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4149ed
mov cx, word [0x4493f8]
movzx eax, cx
inc cx
mov word [0x4493f8], cx
mov dword [eax*4 + 0x44b6a0], esi
push str.RtlFreeHeap
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44aeb8], eax
test eax, eax
je 0x414a0d
push edi
push 0
push dword [0x44aea8]
call eax
mov ecx, dword [0x44aea8]
test ecx, ecx
je 0x414aa1
mov eax, dword [0x44aecc]
test eax, eax
jne 0x414a94
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x414a79
cmp word [0x4493f8], 0x20
jb 0x414a4e
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.00414ac0
add esp, 4
jmp 0x414a79
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x414a79
mov cx, word [0x4493f8]
movzx eax, cx
inc cx
mov word [0x4493f8], cx
mov dword [eax*4 + 0x44b6a0], esi
push str.RtlDestroyHeap
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44aecc], eax
test eax, eax
je 0x414aa1
mov ecx, dword [0x44aea8]
push ecx
call eax
neg eax
sbb eax, eax
and dword [0x44aea8], eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret