Function at 0x5744d0
Capabilities:
Access peb ldr_data
Get disk information
Get process heap flags

Disassembly:
push ebp
mov ecx, 0x3a61
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword fs:[0x18]
sub esp, 0x7f4
mov eax, dword [sym.imp.kernel32.dll_QueryDosDeviceA]
mov word [ebp - 0x7df], cx
mov byte [ebp - 0x7dd], 0
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x7e4], eax
call eax
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x601b57
mov dword [eax + 4], 0x4c
xor eax, eax
mov edx, dword [esi + 0x34]
test ebx, ebx
jne 0x574549
xor eax, eax
cmp edx, 0x7a
sete al
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.QueryDosDeviceA_no_buffer_:_returned__lu__le_lu_n
mov esi, dword fs:[0x18]
call fcn.005744b0
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi + 0x34], 0xdeadbeef
sub esp, 0xc
mov ebx, eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x7e4]
call eax
sub esp, 0xc
mov dword [ebp - 0x7e8], eax
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x601b57
mov dword [eax + 4], 0x52
mov eax, dword [esi + 0x34]
test edi, edi
je 0x5746f0
cmp eax, 0x7a
je 0x5748ba
mov dword [esp + 8], eax
mov dword [esp + 4], str.QueryDosDeviceA_failed_to_return_list__last_error__lu_n
mov dword [esp], 1
call fcn.005744b0
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x7a
je 0x574708
mov esi, ebx
jmp 0x574667
mov edx, dword [ebp - 0x7ec]
cmp dword [edx + 0x34], 5
jne 0x574630
mov edx, dword [0x8f0770]
xor eax, eax
test edx, edx
sete al
lea esi, [esi]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.QueryDosDeviceA_failed_to_return_current_mapping_for__s__last_error__lu_n
call fcn.005744b0
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strlen]
mov edx, dword [ebp - 0x7e8]
lea esi, [esi + eax + 1]
mov eax, esi
sub eax, ebx
cmp eax, edx
jae 0x574708
cmp byte [esi], 0
je 0x574708
lea eax, [ebp - 0x7dc]
mov dword [esp + 8], 0x7d0
mov dword [esp + 4], eax
mov dword [esp], esi
mov eax, dword [ebp - 0x7e4]
call eax
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x601b57
mov dword [eax + 4], 0x5b
mov eax, 1
mov edx, dword fs:[0x18]
mov dword [ebp - 0x7ec], edx
mov ecx, dword [edx + 0x34]
test edi, edi
jne 0x574630
mov dword [ebp - 0x7f0], ecx
mov dword [esp + 4], str.MSSECFLTSYS
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strcmp]
mov ecx, dword [ebp - 0x7f0]
test eax, eax
je 0x574610
xor eax, eax
jmp 0x574630
mov dword [esp + 8], eax
mov dword [esp + 4], str.QueryDosDeviceA_failed_to_return_list__last_error__lu_n
mov dword [esp], 0
call fcn.005744b0
cmp byte [ebp - 0x7df], 0x7a
lea edi, [ebp - 0x7df]
mov dword [ebp - 0x7e8], 0
jle 0x57476d
jmp 0x574838
cmp ecx, 2
je 0x574810
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], str.QueryDosDeviceA_failed_to_return_current_mapping_for__s__last_error__lu_n
mov dword [esp], 0
call fcn.005744b0
movzx eax, byte [ebp - 0x7df]
add eax, 1
mov byte [ebp - 0x7df], al
cmp al, 0x7a
jg 0x574838
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], ebx
mov dword [esp], edi
mov eax, dword [ebp - 0x7e4]
call eax
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x601b57
mov dword [eax + 4], 0x65
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x34]
test esi, esi
je 0x574730
mov dword [esp + 0xc], ecx
mov esi, ebx
mov dword [esp + 8], edi
mov dword [esp + 4], str.QueryDosDeviceA_failed_to_return_current_mapping_for__s__last_error__lu_n
mov dword [esp], 1
call fcn.005744b0
movsx eax, byte [ebx]
test al, al
je 0x5747e6
lea esi, [esi]
mov dword [esp], eax
add esi, 1
call dword [sym.imp.msvcrt.dll_toupper]
mov byte [esi - 1], al
movsx eax, byte [esi]
test al, al
jne 0x5747d0
mov dword [esp + 4], str.HARDDISK
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strstr]
test eax, eax
je 0x574890
mov dword [ebp - 0x7e8], 1
jmp 0x574755
mov dword [esp + 0xc], 2
mov dword [esp + 8], edi
mov dword [esp + 4], str.QueryDosDeviceA_failed_to_return_current_mapping_for__s__last_error__lu_n
mov dword [esp], 1
call fcn.005744b0
jmp 0x574755
call fcn.0057d110
mov dword [eax], 0x601b57
mov dword [eax + 4], 0x6c
mov dword [esp + 4], str.expected_at_least_one_devicename_to_contain_HARDDISK_or_RAMDISK_n
mov eax, dword [ebp - 0x7e8]
mov dword [esp], eax
call fcn.005744b0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.RAMDISK
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strstr]
test eax, eax
mov eax, 1
cmove eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x7e8], eax
jmp 0x574755
mov dword [esp + 8], 0x7a
mov dword [esp + 4], str.QueryDosDeviceA_failed_to_return_list__last_error__lu_n
mov dword [esp], 0
call fcn.005744b0
jmp 0x5745f7