Function at 0x404b6c
Capabilities:
Enumerate disk volumes
Get disk information via ioctl

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x3d8
push ebx
push esi
push 0x384
lea ecx, [ebp + 0x5c]
call fcn.0043dd9c
mov eax, dword [ebp + 0x5c]
lea ecx, [eax + 0x5a0]
lea esi, [eax + 0x398]
mov dword [ebp + 0x58], ecx
lea ecx, [eax + 0x618]
xor ebx, ebx
mov dword [ebp + 0x40], eax
add eax, 0x690
cmp dword [ebp + 0x7c], ebx
mov dword [ebp + 0x50], ecx
mov dword [ebp + 0x60], eax
mov word [esi], bx
mov dword [ebp + 0x54], 2
je 0x404bc0
mov esi, dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], ebx
mov dword [ebp + 0x64], ebx
jne 0x404be9
push 0x103
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
cmp eax, 0xffffffff
mov dword [ebp + 0x64], eax
jne 0x404be9
lea ecx, [ebp + 0x5c]
call fcn.00437e1a
jmp 0x404d8c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
js 0x404c00
lea eax, [esi + eax*2]
cmp word [eax], 0x5c
jne 0x404c00
mov word [eax], bx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push 0x80
push 3
push ebx
push 7
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x7c], eax
je 0x404d5b
xor eax, eax
mov dword [ebp - 0x370], ebx
mov ecx, 0xc7
lea edi, [ebp - 0x36c]
rep stosd dword es:[edi], eax
lea edi, [ebp + 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp + 0x48], 0xffffffff
push ebx
lea eax, [ebp - 0x370]
push eax
push 0xc
lea eax, [ebp + 0x44]
push eax
push ebx
push ebx
push 0x2d1080
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
mov edi, 0x90
push edi
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.00492e00
or dword [ebp - 0x38], 0xffffffff
add esp, 0xc
push ebx
lea eax, [ebp - 0x370]
push eax
push edi
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
push 0x70048
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [ebp + 0x7c], ebx
je 0x404cba
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x78]
cmp eax, ebx
jl 0x404cca
cmp eax, dword [ebp + 0x4c]
jne 0x404d5b
mov eax, dword [ebp + 0x74]
cmp eax, ebx
jl 0x404cda
cmp eax, dword [ebp + 0x48]
jne 0x404d5b
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp + 0x58]
call fcn.004878e2
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp + 0x50]
call fcn.004878e2
add esp, 0x18
cmp dword [ebp - 0x50], 1
jne 0x404d0e
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0x60]
call fcn.0043b87d
jmp 0x404d21
movzx eax, byte [ebp - 0x30]
push eax
push 0x4a7164
push dword [ebp + 0x60]
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [ebp + 0x40]
add esp, 0xc
push dword [ebp + 0x50]
push dword [ebp + 0x58]
push dword [ebp + 0x60]
push dword [ebp + 0x44]
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
push esi
push str._r_n_s__d__d__d__s__s__s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp + 0x54]
mov ecx, dword [ebp + 0x70]
add esp, 0x24
lea eax, [edi + eax*2]
push eax
call fcn.0043ddea
mov dword [ebp + 0x54], ebx
cmp dword [ebp + 0x64], ebx
je 0x404d83
push 0x103
push esi
push dword [ebp + 0x64]
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x404bea
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
lea ecx, [ebp + 0x5c]
call fcn.00437e1a
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret