Function at 0x407920
Capabilities:
Enumerate disk volumes
Get disk information
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48923a
mov eax, dword fs:[0]
push eax
sub esp, 0x744
mov eax, dword [0x4b38b4]
xor eax, esp
mov dword [esp + 0x740], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b38b4]
xor eax, esp
push eax
lea eax, [esp + 0x758]
mov dword fs:[0], eax
mov esi, dword [esp + 0x768]
xor ebx, ebx
push 0x254
lea eax, [esp + 0xf4]
push ebx
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
call fcn.0046a470
mov ecx, dword [esp + 0x778]
add esp, 0xc
push ebx
lea edx, [esp + 0x24]
push edx
mov edx, dword [0x4b118c]
push 0x254
lea eax, [esp + 0xfc]
push eax
push 0x254
mov dword [esp + 0x104], ecx
mov ecx, eax
push ecx
push 0x22201c
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4079d1
push esi
call fcn.00433e20
add esp, 4
xor eax, eax
jmp 0x407f29
mov esi, 0xf
mov edi, 7
xor eax, eax
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
mov dword [esp + 0xac], esi
mov dword [esp + 0xa8], ebx
mov byte [esp + 0x98], bl
mov dword [esp + 0xc8], esi
mov dword [esp + 0xc4], ebx
mov byte [esp + 0xb4], bl
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe0], ebx
mov word [esp + 0xd0], ax
mov byte [esp + 0xe8], bl
mov byte [esp + 0xe9], bl
mov byte [esp + 0xea], bl
mov byte [esp + 0xeb], bl
mov byte [esp + 0xec], bl
mov byte [esp + 0xed], bl
mov byte [esp + 0xee], bl
mov byte [esp + 0xef], bl
push 3
push 0x48dc90
lea ecx, [esp + 0x9c]
mov dword [esp + 0x768], ebx
call fcn.00402150
mov eax, dword [esp + 0x98]
mov ebp, 0x10
cmp dword [esp + 0xac], ebp
jae 0x407a9d
lea eax, [esp + 0x98]
mov cl, byte [esp + 0xf0]
add cl, 0x41
xor edx, edx
mov byte [eax], cl
lea eax, [esp + 0xf8]
mov word [esp + 0x44], dx
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x407ac2
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x48]
call fcn.00402460
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x60]
push edx
mov byte [esp + 0x768], 1
call fcn.0043e450
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x84]
mov byte [esp + 0x76c], 2
call fcn.00401e90
cmp dword [esp + 0x74], ebp
jb 0x407b28
mov eax, dword [esp + 0x60]
push eax
call fcn.00469789
add esp, 4
mov edi, 8
mov dword [esp + 0x74], esi
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
mov byte [esp + 0x760], bl
cmp dword [esp + 0x58], edi
jb 0x407b53
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00469789
add esp, 4
push 4
push ebx
push 0x48dc88
lea ecx, [esp + 0x84]
call fcn.00401320
test eax, eax
jne 0x407bb2
push 0xffffffffffffffff
push 4
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 0x84]
call fcn.00402920
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x84]
mov byte [esp + 0x76c], 3
call fcn.00401e90
mov byte [esp + 0x760], bl
cmp dword [esp + 0x58], ebp
jb 0x407bb2
mov eax, dword [esp + 0x44]
push eax
call fcn.00469789
add esp, 4
mov eax, dword [esp + 0x7c]
cmp dword [esp + 0x90], ebp
jae 0x407bc3
lea eax, [esp + 0x7c]
push eax
call fcn.0042fbf0
add esp, 4
test eax, eax
je 0x407e55
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], ebx
mov byte [esp + 0x6c], bl
call fcn.00401e90
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x768], 4
call fcn.0043e1b0
add esp, 8
cmp dword [eax + 0x18], edi
jb 0x407c1b
mov eax, dword [eax + 4]
jmp 0x407c1e
add eax, 4
lea ecx, [esp + 0x54c]
push ecx
push eax
call fcn.00432520
add esp, 8
mov esi, eax
cmp dword [esp + 0x58], edi
jb 0x407c44
mov edx, dword [esp + 0x44]
push edx
call fcn.00469789
add esp, 4
cmp esi, ebx
je 0x407cbf
lea eax, [esp + 0x54c]
push eax
lea ecx, [esp + 0x28]
call fcn.00402960
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x44]
push edx
mov byte [esp + 0x768], 5
call fcn.0043e450
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x68]
mov byte [esp + 0x76c], 6
call fcn.00401e90
cmp dword [esp + 0x58], ebp
jb 0x407c9b
mov eax, dword [esp + 0x44]
push eax
call fcn.00469789
add esp, 4
mov edi, 0xf
lea ecx, [esp + 0x24]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov byte [esp + 0x760], 4
call fcn.0043a110
jmp 0x407cc4
mov edi, 0xf
push 0x104
lea ecx, [esp + 0x348]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov esi, eax
cmp esi, 0xffffffff
je 0x407e3b
jmp 0x407cf0
lea eax, [esp + 0x344]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407d06
sub eax, edx
push eax
lea edx, [esp + 0x348]
push edx
lea ecx, [esp + 0x48]
call fcn.00402150
mov eax, dword [esp + 0x54]
add eax, 0xfffffffb
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x76c], 7
call fcn.00402920
or dword [esp + 0x18], 1
mov byte [esp + 0x760], 8
cmp dword [eax + 0x18], ebp
jb 0x407d58
mov eax, dword [eax + 4]
jmp 0x407d5b
add eax, 4
push 0x104
lea edx, [esp + 0x44c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x407daa
lea eax, [esp + 0x448]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407d80
mov ecx, dword [esp + 0x70]
sub eax, edx
push eax
lea eax, [esp + 0x44c]
push eax
push ecx
push ebx
lea ecx, [esp + 0x6c]
call fcn.00401490
mov byte [esp + 0x17], 1
test eax, eax
je 0x407dae
mov byte [esp + 0x17], bl
test byte [esp + 0x18], 1
mov dword [esp + 0x760], 7
je 0x407dd8
and dword [esp + 0x18], 0xfffffffe
cmp dword [esp + 0x3c], ebp
jb 0x407dd8
mov edx, dword [esp + 0x28]
push edx
call fcn.00469789
add esp, 4
cmp byte [esp + 0x17], bl
jne 0x407e17
mov byte [esp + 0x760], 4
cmp dword [esp + 0x58], ebp
jb 0x407df9
mov eax, dword [esp + 0x44]
push eax
call fcn.00469789
add esp, 4
push 0x104
lea ecx, [esp + 0x348]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
test eax, eax
jne 0x407cf0
jmp 0x407e34
lea edx, [esp + 0x344]
push edx
lea ecx, [esp + 0xb4]
call fcn.00402690
lea ecx, [esp + 0x40]
call fcn.00401cf0
push esi
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov byte [esp + 0x760], bl
cmp dword [esp + 0x74], ebp
jb 0x407e55
mov eax, dword [esp + 0x60]
push eax
call fcn.00469789
add esp, 4
cmp dword [esp + 0x31c], ebx
setne cl
cmp dword [esp + 0x320], ebx
mov byte [esp + 0xed], cl
setne dl
cmp dword [esp + 0x324], ebx
mov byte [esp + 0xee], dl
setne al
cmp dword [0x4b89d8], 1
mov byte [esp + 0xef], al
sete cl
mov byte [esp + 0xec], cl
cmp dword [esp + 0xc4], ebx
jne 0x407f02
mov eax, dword [esp + 0x7c]
cmp dword [esp + 0x90], ebp
jae 0x407eb3
lea eax, [esp + 0x7c]
push eax
call fcn.0042fbf0
add esp, 4
test eax, eax
je 0x407f02
push 0xb
push ebx
push str._Volume
lea ecx, [esp + 0x84]
call fcn.00401320
test eax, eax
je 0x407f02
push ebx
push str.Partition0
lea ecx, [esp + 0x80]
call fcn.004017b0
cmp eax, 0xffffffff
mov eax, str.FAVORITE_ADD_PARTITION_TYPE_WARNING
je 0x407ef9
mov eax, str.FAVORITE_ADD_DRIVE_DEV_WARNING
push eax
call fcn.00432f40
add esp, 4
mov eax, dword [esp + 0x770]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x78]
push edx
push eax
push ecx
call fcn.00407790
add esp, 0xc
lea ecx, [esp + 0x78]
mov esi, eax
call fcn.00401dc0
mov eax, esi
mov ecx, dword [esp + 0x758]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x740]
xor ecx, esp
call fcn.00469f7b
add esp, 0x750