Function at 0x4070ec
Capabilities:
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
and esp, 0xffffffc0
push ebp
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x438
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x428]
mov esi, 0x437600
mov ecx, 0xd8
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x428]
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov eax, 0x4376e0
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + 8]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x350], esi
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x348], edx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x344], edx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x340], edx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x33c], edx
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x338], edx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x334], edx
mov edx, dword [eax + 0x20]
mov dword [ebp - 0x330], edx
mov edx, dword [eax + 0x24]
mov dword [ebp - 0x32c], edx
mov edx, dword [eax + 0x28]
mov dword [ebp - 0x328], edx
mov edx, dword [eax + 0x2c]
mov dword [ebp - 0x324], edx
mov edx, dword [eax + 0x30]
mov dword [ebp - 0x320], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 0x31c], edx
mov edx, dword [eax + 0x38]
mov dword [ebp - 0x318], edx
mov edx, dword [eax + 0x3c]
mov dword [ebp - 0x314], edx
mov edx, dword [eax + 0x40]
mov dword [ebp - 0x310], edx
mov edx, dword [eax + 0x44]
mov dword [ebp - 0x30c], edx
mov edx, dword [eax + 0x48]
mov dword [ebp - 0x308], edx
mov edx, dword [eax + 0x4c]
mov dword [ebp - 0x304], edx
mov edx, dword [eax + 0x50]
mov dword [ebp - 0x300], edx
mov edx, dword [eax + 0x54]
mov dword [ebp - 0x2fc], edx
mov edx, dword [eax + 0x58]
mov dword [ebp - 0x2f8], edx
mov edx, dword [eax + 0x5c]
mov dword [ebp - 0x2f4], edx
mov edx, dword [eax + 0x60]
mov dword [ebp - 0x2f0], edx
mov edx, dword [eax + 0x64]
mov dword [ebp - 0x2ec], edx
mov edx, dword [eax + 0x68]
mov dword [ebp - 0x2e8], edx
mov edx, dword [eax + 0x6c]
mov dword [ebp - 0x2e4], edx
mov edx, dword [eax + 0x70]
mov dword [ebp - 0x2e0], edx
mov edx, dword [eax + 0x74]
mov dword [ebp - 0x2dc], edx
mov edx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x2d8], edx
mov dword [ebp - 0x2d4], eax
lea edi, [ebp - 0x2d0]
mov esi, 0x437760
mov ecx, 0x1fe
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 0x437960
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov dword [ebp - 0xd0], edx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], edi
mov dword [ebp - 0xc0], edx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0xbc], edx
mov edx, dword [eax + 0x18]
mov dword [ebp - 0xb8], edx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0xb4], edx
mov edx, dword [eax + 0x20]
mov dword [ebp - 0xb0], edx
mov edx, dword [eax + 0x24]
mov dword [ebp - 0xac], edx
mov edx, dword [eax + 0x28]
mov dword [ebp - 0xa8], edx
mov edx, dword [eax + 0x2c]
mov dword [ebp - 0xa4], edx
mov edx, dword [eax + 0x30]
mov dword [ebp - 0xa0], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 0x9c], edx
mov edx, dword [eax + 0x38]
mov dword [ebp - 0x98], edx
mov edx, dword [eax + 0x3c]
mov dword [ebp - 0x94], edx
mov edx, dword [eax + 0x40]
mov dword [ebp - 0x90], edx
mov edx, dword [eax + 0x44]
mov dword [ebp - 0x8c], edx
mov edx, dword [eax + 0x48]
mov dword [ebp - 0x88], edx
mov edx, dword [eax + 0x4c]
mov dword [ebp - 0x84], edx
mov edx, dword [eax + 0x50]
mov dword [ebp - 0x80], edx
mov edx, dword [eax + 0x54]
mov dword [ebp - 0x7c], edx
mov edx, dword [eax + 0x58]
mov dword [ebp - 0x78], edx
mov edx, dword [eax + 0x5c]
mov dword [ebp - 0x74], edx
mov edx, dword [eax + 0x60]
mov dword [ebp - 0x70], edx
mov edx, dword [eax + 0x64]
mov dword [ebp - 0x6c], edx
mov edx, dword [eax + 0x68]
mov dword [ebp - 0x68], edx
mov edx, dword [eax + 0x6c]
mov dword [ebp - 0x64], edx
mov edx, dword [eax + 0x70]
mov dword [ebp - 0x60], edx
mov edx, dword [eax + 0x74]
mov dword [ebp - 0x5c], edx
mov edx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], eax
push 1
xor eax, eax
mov dword [ebp - 0x50], eax
xor edx, edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], edx
xor ecx, ecx
mov dword [ebp - 0x40], ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, eax
lea edx, [ebp - 0x428]
push edx
push 0x6c
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
call fcn.00405a60
mov edx, dword [ebp - 0x2c]
movzx ecx, word [edx]
test ecx, ecx
je 0x4077e8
mov edi, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], esi
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
cmp esi, 3
je 0x4073e5
cmp esi, 4
jne 0x407786
mov edx, dword [0x45fee0]
test edx, edx
je 0x407786
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x350]
push 0x40
push edx
push ecx
push eax
lea edx, [ebp - 0x50]
push edx
push 0xff
lea edx, [ebp - 0x2d0]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x407786
mov edx, dword [ebp - 0x24]
push edx
push edi
call fcn.00405eec
mov dword [ebp - 0x20], eax
add esp, 8
mov edx, eax
test edx, edx
je 0x40746f
push edx
call dword [sym.imp.MSVCR71.dll_wcslen]
pop ecx
test eax, eax
je 0x40746f
push 0x4440dc
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.MSVCR71.dll_wcscmp]
add esp, 8
test eax, eax
je 0x40746f
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x2d0]
push 0xff
push edx
push ecx
call dword [sym.imp.MSVCR71.dll_wcsncpy]
add esp, 0xc
xor edx, edx
mov word [ebp - 0xd4], dx
lea edx, [ebp - 0x2d0]
push edx
call dword [sym.imp.MSVCR71.dll_wcslen]
pop ecx
test eax, eax
je 0x40749a
push 0x4440dc
lea edx, [ebp - 0x2d0]
push edx
call dword [sym.imp.MSVCR71.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x4074f3
lea edx, [ebp - 0xd0]
push edi
push edx
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
xor edx, edx
mov word [ebp - 0xcc], dx
cmp esi, 3
jne 0x4074d7
lea ecx, [ebp - 0x2d0]
lea edx, [ebp - 0xd0]
push edx
push str.Local_Disk___s_
push ecx
call dword [sym.imp.MSVCR71.dll_swprintf]
add esp, 0xc
jmp 0x40751a
lea ecx, [ebp - 0x2d0]
lea edx, [ebp - 0xd0]
push edx
push str.Network_Drive___s_
push ecx
call dword [sym.imp.MSVCR71.dll_swprintf]
add esp, 0xc
cmp esi, 4
jne 0x40751a
lea edx, [ebp - 0x350]
push 0x40
push str.Network
push edx
call dword [sym.imp.MSVCR71.dll_wcsncpy]
add esp, 0xc
xor edx, edx
mov word [ebp - 0x2d2], dx
jmp 0x407542
push edi
call fcn.004028a8
pop ecx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
shl ecx, 0xc
shr edx, 0x14
or ecx, edx
mov edx, dword [eax + 8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [eax + 0xc]
shl ecx, 0xc
shr edx, 0x14
or ecx, edx
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x30]
test edx, edx
jne 0x4075aa
mov ecx, dword [0x44c3a8]
mov edx, 1
mov dword [ebp - 0x30], edx
test ecx, ecx
je 0x407566
push str.File_System
call fcn.00402db0
pop ecx
mov edx, dword [0x44e880]
test edx, edx
je 0x407577
mov edx, 0x4434c0
jmp 0x40757c
mov edx, str.SUBCOMPONENT
push edx
call fcn.00402e10
pop ecx
mov edx, dword [0x44e880]
test edx, edx
je 0x4075b0
je 0x407596
mov edx, str.ROWSET_TABLE_MGMT_ECM_OS_FILESYSTEM__CONFIG_TRUE_
jmp 0x40759b
mov edx, str.FILE_SYSTEM
push edx
call fcn.00402e10
pop ecx
mov edx, dword [0x44e880]
jmp 0x4075b0
mov edx, dword [0x44e880]
test edx, edx
jne 0x4075cf
je 0x4075bd
mov edx, str.ROWSET_TABLE_MGMT_ECM_OS_FILESYSTEM__CONFIG_TRUE_
jmp 0x4075c2
mov edx, str.FILE_SYSTEM
push edx
call fcn.00402e10
pop ecx
mov edx, dword [0x44e880]
test edx, edx
je 0x4075da
mov edx, 0x444940
jmp 0x4075df
mov edx, 0x4434c0
push edx
call fcn.00402e10
lea edx, [ebp - 0x2d0]
push edx
call fcn.00401a9c
push 0x80
push eax
push str.RESOURCE_NAME
call fcn.00402e68
push edi
call fcn.00401a9c
push 0x400
push eax
push str.MOUNT_LOCATION
call fcn.00402e68
lea edx, [ebp - 0x350]
push 0x64
push edx
push str.TYPE
call fcn.00402e68
push dword [ebp - 0x48]
call fcn.00406d58
push 0x400
push eax
push str.MOUNT_OPTIONS
call fcn.00402e68
push str.10.1.0.2
push 0x449880
call dword [sym.imp.MSVCR71.dll_wcscmp]
add esp, 0x48
test eax, eax
jl 0x40774c
cmp esi, 4
jne 0x4076cb
mov eax, dword [0x44e880]
test eax, eax
je 0x407672
mov eax, str.DISK_SPACE_IN_GB
jmp 0x407677
mov eax, 0x4434c0
push 8
push 0
push eax
call fcn.00402e68
add esp, 0xc
mov eax, dword [0x44e880]
test eax, eax
je 0x407694
mov eax, str.LOCAL_DRIVE
jmp 0x407699
mov eax, 0x4434c0
push 0
push eax
call fcn.004031a8
add esp, 8
mov eax, dword [0x44e880]
test eax, eax
je 0x4076b4
mov eax, str.AVAIL_DISK_SPACE_IN_GB
jmp 0x4076b9
mov eax, 0x4434c0
push 8
push 0
push eax
call fcn.00402e68
add esp, 0xc
jmp 0x40774c
mov eax, dword [ebp - 0x3c]
push 0x400
push eax
call fcn.004010b8
add esp, 8
mov eax, dword [0x44e880]
test eax, eax
je 0x4076ec
mov eax, str.DISK_SPACE_IN_GB
jmp 0x4076f1
mov eax, 0x4434c0
fstp qword [esp + 4]
mov dword [esp], eax
call fcn.00403120
mov eax, dword [0x44e880]
test eax, eax
je 0x40770d
mov eax, str.LOCAL_DRIVE
jmp 0x407712
mov eax, 0x4434c0
push 1
push eax
call fcn.004031a8
mov eax, dword [ebp - 0x40]
push 0x400
push eax
call fcn.004010b8
add esp, 0x10
mov eax, dword [0x44e880]
test eax, eax
je 0x40773b
mov eax, str.AVAIL_DISK_SPACE_IN_GB
jmp 0x407740
mov eax, 0x4434c0
fstp qword [esp + 4]
mov dword [esp], eax
call fcn.00403120
mov eax, dword [0x44e880]
test eax, eax
je 0x40775c
mov eax, 0x444940
jmp 0x407761
mov eax, 0x4434c0
push eax
call fcn.0040322c
pop ecx
mov eax, dword [0x44e880]
test eax, eax
jne 0x407786
je 0x40777a
mov eax, str.ROWSET_TABLE_MGMT_ECM_OS_FILESYSTEM__CONFIG_TRUE_
jmp 0x40777f
mov eax, str.FILE_SYSTEM
push eax
call fcn.0040322c
pop ecx
push 0
push edi
call dword [sym.imp.MSVCR71.dll_wcschr]
mov edi, eax
add esp, 8
add edi, 2
movzx eax, word [edi]
test eax, eax
jne 0x4073c0
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
test edx, edx
je 0x4077e8
mov edx, dword [0x44e880]
test edx, edx
je 0x4077d1
je 0x4077bf
mov edx, str.ROWSET_TABLE_MGMT_ECM_OS_FILESYSTEM__CONFIG_TRUE_
jmp 0x4077c4
mov edx, str.FILE_SYSTEM
push edx
call fcn.0040322c
pop ecx
mov edx, dword [0x44e880]
test edx, edx
je 0x4077dc
mov edx, 0x4434c0
jmp 0x4077e1
mov edx, str.SUBCOMPONENT
push edx
call fcn.0040322c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret