Function at 0x42a73b
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x5e2008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xa40], eax
call fcn.00431378
test al, al
je 0x42a781
pop edx
pop ebp
pop eax
push ecx
pop edx
push edx
pop edi
push eax
pop ebx
push esp
pop esi
push ebp
pop eax
pop ebx
pop edi
pop eax
push ebx
push edx
push ebx
push edi
pop eax
call fcn.0043110b
test al, al
je 0x42a79a
pop ecx
push ebp
pop ebp
push eax
pop ebp
pop ecx
push ebp
pop ecx
push edx
pop edi
pop edx
push eax
pop edx
pop edx
pop ecx
pop eax
call fcn.004316b4
test al, al
je 0x42a7b7
pop esi
push ecx
pop edx
pop edx
push ebx
pop ebx
pop ecx
push edx
pop esi
pop ebp
push esi
push esi
pop esi
push ebp
push edi
pop ebx
push ebx
pop edi
pop ebp
pop esi
mov ecx, dword [ebp - 0xa40]
xor ebx, ebx
push ebx
push 0x582524
call fcn.004202e4
push 0x20a
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0044ea80
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push dword [ebp - 0xa3c]
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x42a801
xor al, al
jmp 0x42accd
call fcn.004315e5
test al, al
je 0x42a81e
push esp
push esp
push ebp
push edi
push ecx
pop ebx
pop esi
pop esp
push eax
pop ebp
pop ebp
pop ecx
push ebp
push eax
pop edi
pop eax
pop ebp
push esp
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [ebp - 0xa38], eax
test eax, eax
je 0x42a7fa
call fcn.00431378
test al, al
je 0x42a856
push ebp
push ecx
push edi
pop esi
pop ecx
pop eax
pop esp
push ebx
push edi
pop ecx
push ecx
pop esp
push ecx
push eax
push ebx
push edi
push ebp
push esp
push eax
push ebx
pop esp
push eax
pop ebx
pop esi
pop eax
push ebp
push esi
push ecx
push edx
call fcn.004315e5
test al, al
je 0x42a87a
push esp
pop edx
push ebx
pop ebp
pop eax
pop ebp
push ecx
pop eax
push eax
push ecx
pop ebx
push edx
pop esi
push edx
pop esp
pop esp
push ebp
pop edx
pop ecx
push ebp
push eax
push edi
push esp
pop edi
push esi
push ecx
pop edi
mov eax, dword [ebp - 0xa38]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042c529
mov dword [ebp - 0xa3c], eax
pop ecx
test eax, eax
je 0x42a7fa
call fcn.00431378
test al, al
je 0x42a8c2
pop edx
pop ebp
pop eax
push ecx
pop edx
push edx
pop edi
push eax
pop ebx
push esp
pop esi
push ebp
pop eax
pop ebx
pop edi
pop eax
push ebx
push edx
push ebx
push edi
pop eax
call fcn.0043110b
test al, al
je 0x42a8db
pop ecx
push ebp
pop ebp
push eax
pop ebp
pop ecx
push ebp
pop ecx
push edx
pop edi
pop edx
push eax
pop edx
pop edx
pop ecx
pop eax
call fcn.004316b4
test al, al
je 0x42a8f8
pop esi
push ecx
pop edx
pop edx
push ebx
pop ebx
pop ecx
push edx
pop esi
pop ebp
push esi
push esi
pop esi
push ebp
push edi
pop ebx
push ebx
pop edi
pop ebp
pop esi
mov esi, dword [ebp - 0xa38]
xor edi, edi
mov ebx, dword [ebp - 0xa3c]
lea eax, [esi*2 + 2]
push eax
push edi
push ebx
call fcn.0044ea80
add esp, 0xc
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x42a930
push ebx
call fcn.0042c532
pop ecx
jmp 0x42a7fa
call fcn.004315e5
test al, al
je 0x42a953
push esp
push esp
push ebp
push edi
push ecx
pop ebx
pop esi
pop esp
push eax
pop ebp
pop ebp
pop ecx
push ebp
push eax
pop edi
pop eax
pop ebp
push esp
mov ebx, dword [ebp - 0xa3c]
xor edi, edi
mov eax, dword [0x5834f4]
mov esi, 0x208
mov dword [ebp - 0xc], eax
mov ax, word [0x5834f8]
push esi
mov word [ebp - 8], ax
call fcn.0042c529
mov dword [ebp - 0xa34], eax
pop ecx
test eax, eax
je 0x42a924
push esi
push edi
push eax
call fcn.0044ea80
add esp, 0xc
mov dword [ebp - 0xa38], ebx
call fcn.004312ee
test al, al
je 0x42a9af
push ebx
pop edx
push ebp
push ecx
push esp
push esp
pop esi
pop ebx
pop edx
pop edx
pop ebx
push esi
push eax
push esp
push esp
pop eax
pop ebx
pop eax
pop esi
pop eax
pop ebp
pop edi
push ebx
push edi
pop ebx
pop edx
call fcn.0043148c
test al, al
je 0x42a9d4
push esi
pop esp
push eax
push esi
push ebx
push esi
pop esp
push edi
pop ebp
push edi
push edx
pop edi
pop esp
push ecx
push ecx
pop eax
push ecx
pop ebp
push ebp
push ebx
pop esi
pop edi
pop ebx
push eax
pop ebp
push esp
push esi
push ebx
mov ebx, dword [ebp - 0xa34]
mov ecx, dword [ebp - 0xa38]
mov ax, word [ecx]
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x42aafc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42ac63
call fcn.004312a9
test al, al
je 0x42aa34
pop eax
push edx
pop esp
pop ebx
push ecx
push eax
pop edx
pop edi
push ebx
pop esp
pop edx
pop edi
push edi
pop esi
push edi
pop ecx
push esp
push eax
push esi
push esi
push ebp
pop esp
push edx
mov ebx, dword [ebp - 0xa34]
push ebx
call fcn.0042c532
xor eax, eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042c529
mov ebx, eax
mov dword [ebp - 0xa34], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x42ac63
call fcn.00431378
test al, al
je 0x42aa92
push eax
pop esp
pop ecx
push ebx
pop eax
pop ecx
push ecx
pop ebx
pop edx
push edi
push ebx
pop esp
push ebx
push ebx
push edi
pop esp
push edx
pop edi
pop ecx
pop ebx
push ebp
pop edx
pop edi
push edi
push edx
pop esp
push esi
push ebp
push esi
push edi
push ebx
push ebp
mov ebx, dword [ebp - 0xa34]
call fcn.0043166f
test al, al
je 0x42aab4
push esp
push edx
push edi
push edx
pop eax
pop ecx
push esp
push edx
pop ecx
pop edx
pop ecx
push esp
pop eax
push esp
pop edx
push esi
pop esp
push ebx
push edx
push esp
pop esi
push esp
push esi
push edi
pop edi
push 2
pop eax
push eax
push 0
push ebx
call fcn.0044ea80
add esp, 0xc
lea eax, [ebp - 0xc]
push 1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov dword [ebp - 0xa44], eax
call fcn.0043110b
test al, al
je 0x42aaef
push ebp
push ebp
pop esi
push ecx
pop edi
push edi
push eax
push edi
pop ebx
pop ebx
push esi
push ebp
push esi
push edx
push ebx
push esp
cmp dword [ebp - 0xa44], 0
je 0x42ac63
call fcn.004312ee
test al, al
je 0x42ab1f
push ebx
pop edx
push ebp
push ecx
push esp
push esp
pop esi
pop ebx
pop edx
pop edx
pop ebx
push esi
push eax
push esp
push esp
pop eax
pop ebx
pop eax
pop esi
pop eax
pop ebp
pop edi
push ebx
push edi
pop ebx
pop edx
call fcn.0043148c
test al, al
je 0x42ab44
push esi
pop esp
push eax
push esi
push ebx
push esi
pop esp
push edi
pop ebp
push edi
push edx
pop edi
pop esp
push ecx
push ecx
pop eax
push ecx
pop ebp
push ebp
push ebx
pop esi
pop edi
pop ebx
push eax
pop ebp
push esp
push esi
push ebx
mov ebx, dword [ebp - 0xa34]
push ebx
call fcn.004525b1
mov esi, eax
lea eax, [ebp - 0x218]
push esi
push ebx
push eax
call fcn.0045e6a4
add esp, 0x10
test eax, eax
je 0x42abe1
call fcn.00431378
test al, al
je 0x42ab96
push eax
pop esp
pop ecx
push ebx
pop eax
pop ecx
push ecx
pop ebx
pop edx
push edi
push ebx
pop esp
push ebx
push ebx
push edi
pop esp
push edx
pop edi
pop ecx
pop ebx
push ebp
pop edx
pop edi
push edi
push edx
pop esp
push esi
push ebp
push esi
push edi
push ebx
push ebp
mov ebx, dword [ebp - 0xa34]
call fcn.0043166f
test al, al
je 0x42abb8
push esp
push edx
push edi
push edx
pop eax
pop ecx
push esp
push edx
pop ecx
pop edx
pop ecx
push esp
pop eax
push esp
pop edx
push esi
pop esp
push ebx
push edx
push esp
pop esi
push esp
push esi
push edi
pop edi
mov ecx, dword [ebp - 0xa38]
push 2
pop edx
mov ax, word [ecx]
add ecx, edx
test ax, ax
jne 0x42abc1
xor eax, eax
mov dword [ebp - 0xa38], ecx
cmp word [ecx], ax
jne 0x42a9e0
jmp 0x42ac63
push 0x800
xor ebx, ebx
lea eax, [ebp - 0xa18]
push ebx
push eax
call fcn.0044ea80
lea eax, [ebp - 0x218]
lea eax, [eax + esi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x5826b0
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.0042b472
add esp, 0x20
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.0041fc8f
mov ecx, dword [ebp - 0xa40]
push eax
call fcn.00422101
push ebx
push 1
lea ecx, [ebp - 0xa30]
call fcn.0042019a
call fcn.004315e5
test al, al
je 0x42ac63
push esp
push esp
push ebp
push edi
push ecx
pop ebx
pop esi
pop esp
push eax
pop ebp
pop ebp
pop ecx
push ebp
push eax
pop edi
pop eax
pop ebp
push esp
call fcn.00431378
test al, al
je 0x42ac89
push ebp
push ecx
push edi
pop esi
pop ecx
pop eax
pop esp
push ebx
push edi
pop ecx
push ecx
pop esp
push ecx
push eax
push ebx
push edi
push ebp
push esp
push eax
push ebx
pop esp
push eax
pop ebx
pop esi
pop eax
push ebp
push esi
push ecx
push edx
call fcn.004315e5
test al, al
je 0x42acad
push esp
pop edx
push ebx
pop ebp
pop eax
pop ebp
push ecx
pop eax
push eax
push ecx
pop ebx
push edx
pop esi
push edx
pop esp
pop esp
push ebp
pop edx
pop ecx
push ebp
push eax
push edi
push esp
pop edi
push esi
push ecx
pop edi
mov eax, dword [ebp - 0xa3c]
push eax
call fcn.0042c532
mov eax, dword [ebp - 0xa34]
pop ecx
test eax, eax
je 0x42accb
push eax
call fcn.0042c532
pop ecx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c42d
mov esp, ebp
pop ebp
ret 8