Function at 0x101d764
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x10253c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x650], ebx
mov eax, dword [0x1025318]
mov esi, 0x1003ad4
cmp eax, 0x1025318
je 0x101d7ae
test dword [eax + 0x1c], 0x20000000
je 0x101d7ae
push ebx
push esi
push 0x38
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101b8a6
push 1
push 0x6a1
push 0x1003e30
lea ecx, [ebp - 0x648]
call fcn.0101a2c6
xor edi, edi
mov dword [ebp - 0x620], edi
mov dword [ebp - 0x624], edi
mov dword [ebp - 0x654], edi
cmp ebx, edi
je 0x101d843
mov eax, 0x6b0
mov word [ebp - 0x644], ax
lea eax, [ebp - 0x620]
push eax
mov dword [ebx], edi
mov dword [ebp - 0x648], edi
call fcn.0101d674
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6b2
jl 0x101d852
mov word [ebp - 0x644], ax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0x64c], eax
cmp eax, 0xffffffff
jne 0x101d85e
call fcn.0101df25
mov dword [ebp - 0x648], eax
mov eax, 0x6b5
jmp 0x101d852
mov dword [ebp - 0x648], 0x80070057
mov eax, 0x6b0
mov word [ebp - 0x642], ax
jmp 0x101dbc4
and dword [ebp - 0x648], edi
mov eax, 0x6b5
mov word [ebp - 0x644], ax
mov eax, dword [0x1025318]
cmp eax, 0x1025318
je 0x101d89a
test dword [eax + 0x1c], 0x8000000
je 0x101d89a
lea ecx, [ebp - 0x20c]
push ecx
push esi
push 0x39
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101a73e
lea eax, [ebp - 0x20c]
push eax
call fcn.0101bb0c
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x648], eax
jl 0x101db82
mov edx, 0x6bb
mov word [ebp - 0x644], dx
jne 0x101db49
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x101d937
mov eax, dword [0x1025318]
cmp eax, 0x1025318
je 0x101db49
test dword [eax + 0x1c], 0x2000000
je 0x101db49
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101d917
and eax, 0xffff
or eax, 0x80070000
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x3a
mov eax, dword [0x1025318]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101a7ab
jmp 0x101db49
lea eax, [ebp - 0x654]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x101d995
mov eax, dword [0x1025318]
cmp eax, 0x1025318
je 0x101db49
test dword [eax + 0x1c], 0x2000000
je 0x101db49
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101d988
and eax, 0xffff
or eax, 0x80070000
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x3b
jmp 0x101d922
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101c584
test eax, eax
jge 0x101d9e2
mov ecx, dword [0x1025318]
cmp ecx, 0x1025318
je 0x101db49
test dword [ecx + 0x1c], 0x2000000
je 0x101db49
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x3c
push dword [ecx + 0x14]
push dword [ecx + 0x10]
jmp 0x101d92d
mov eax, edi
test edi, edi
je 0x101d9f6
xor edi, edi
push eax
mov dword [ebp - 0x624], edi
call fcn.010112e8
mov eax, edi
test edi, edi
je 0x101da09
and dword [ebp - 0x624], 0
push eax
call fcn.010112e8
lea eax, [ebp - 0x624]
push eax
call fcn.0101d0d1
mov edi, dword [ebp - 0x624]
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6d2
jl 0x101db87
lea ecx, [edi + 4]
lea edx, [ebp - 0x20c]
mov word [ebp - 0x644], ax
call fcn.010223d2
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6d3
jl 0x101db87
lea ecx, [edi + 0x1c]
lea edx, [ebp - 0x61c]
mov word [ebp - 0x644], ax
call fcn.010223d2
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6d4
jl 0x101db87
lea ecx, [edi + 0x10]
lea edx, [ebp - 0x414]
mov word [ebp - 0x644], ax
call fcn.010223d2
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6d5
jl 0x101db87
mov word [ebp - 0x644], ax
lea eax, [edi + 0x2c]
push eax
lea eax, [edi + 0x28]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101be7e
test eax, eax
jge 0x101daec
mov ecx, dword [0x1025318]
cmp ecx, 0x1025318
je 0x101db49
test dword [ecx + 0x1c], 0x2000000
je 0x101db49
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x3d
jmp 0x101d9d7
lea eax, [edi + 0x30]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101c2ce
test eax, eax
jge 0x101db27
mov ecx, dword [0x1025318]
cmp ecx, 0x1025318
je 0x101db49
test dword [ecx + 0x1c], 0x2000000
je 0x101db49
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x3e
jmp 0x101d9d7
push edi
push dword [ebp - 0x620]
call fcn.0101d045
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6e5
jl 0x101db87
mov word [ebp - 0x644], ax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x101d870
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x101db90
call fcn.0101df25
mov dword [ebp - 0x648], eax
mov eax, 0x6f1
jmp 0x101db87
mov eax, 0x6bb
mov word [ebp - 0x642], ax
jmp 0x101dbb8
mov ecx, dword [ebp - 0x650]
and dword [ebp - 0x648], 0
mov eax, 0x6f1
mov word [ebp - 0x644], ax
mov eax, dword [ebp - 0x620]
and dword [ebp - 0x620], 0
mov dword [ecx], eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov esi, dword [ebp - 0x648]
test edi, edi
je 0x101dbd4
push edi
call fcn.010112e8
cmp dword [ebp - 0x620], 0
je 0x101dbe8
push dword [ebp - 0x620]
call fcn.0100afc7
lea ecx, [ebp - 0x648]
call fcn.0101a59c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01019b35
leave
ret 4