Function at 0x489640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x524
mov eax, dword [0x4d757c]
mov dword [esp + 0x520], eax
xor eax, eax
push ebx
push esi
push edi
mov word [esp + 0x78], 0
mov ecx, 0x27
lea edi, [esp + 0x7a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov eax, dword [ebp + 8]
test eax, eax
mov byte [esp + 0x2c], 0
je 0x4897ef
mov bl, byte [ebp + 0xc]
xor ecx, ecx
movzx eax, bl
push eax
mov dword [esp + 0x18], ecx
push str.Drive
mov dword [esp + 0x20], ecx
push str.Physical
mov dword [esp + 0x28], ecx
push 0x4c3b3c
mov dword [esp + 0x30], ecx
lea edx, [esp + 0x88]
mov dword [esp + 0x34], ecx
push str._s_s_s_d
push edx
mov dword [esp + 0x40], ecx
call dword [sym.imp.MSVCR71.dll_swprintf]
add esp, 0x18
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x4897ef
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x18
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0x74080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4897e8
mov edx, dword [esp + 0x18]
test dl, 1
je 0x4897e8
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov ecx, 0x104
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
mov cl, bl
and cl, 1
or cl, 0xfa
shl cl, 4
mov byte [esp + 0x61], cl
mov dword [esp + 0x74], eax
movzx ecx, bl
mov eax, 0x10
sar eax, cl
test edx, eax
jne 0x4897ef
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x410
lea edx, [esp + 0x124]
push edx
push 0x20
lea eax, [esp + 0x6c]
push eax
push 0x7c088
push esi
mov byte [esp + 0x82], 0xec
mov byte [esp + 0x84], bl
mov byte [esp + 0x7d], 1
mov byte [esp + 0x7e], 1
mov dword [esp + 0x78], 0x200
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x489806
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x52c]
call fcn.0045a4fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x140]
mov eax, dword [esp + 0x144]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x148]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x14c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov byte [esp + 0x40], 0
lea eax, [esp + 0x2d]
mov esi, 0xa
jmp 0x489850
mov cl, byte [eax - 1]
mov dl, byte [eax]
mov byte [eax - 1], dl
mov byte [eax], cl
add eax, 2
dec esi
jne 0x489850
mov ecx, dword [esp + 0x2c]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x30]
mov dword [eax], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov ecx, 0xa
lea esi, [esp + 0x15e]
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x54], 0
lea eax, [esp + 0x2d]
mov esi, 0x14
mov cl, byte [eax - 1]
mov dl, byte [eax]
mov byte [eax - 1], dl
mov byte [eax], cl
add eax, 2
dec esi
jne 0x4898a5
mov eax, dword [ebp + 8]
lea esi, [esp + 0x2c]
xor ecx, ecx
sub esi, eax
cmp byte [eax], 0x20
jne 0x4898d1
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
inc eax
cmp ecx, 0xc
jl 0x4898c0
mov ecx, 0xa
lea esi, [esp + 0x156]
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x54], 0
lea eax, [esp + 0x2d]
mov esi, 0x14
mov cl, byte [eax - 1]
mov dl, byte [eax]
mov byte [eax - 1], dl
mov byte [eax], cl
add eax, 2
dec esi
jne 0x4898f1
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x52c]
mov eax, 1
call fcn.0045a4fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8