Function at 0x428f40
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x69def4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push esi
mov esi, dword [ebp + 8]
push 0
push 0x6097e8
mov dword [ebp - 0xa38], eax
call fcn.00407210
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005d4960
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x428fab
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005caa5c
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov esi, eax
test esi, esi
jne 0x428fd0
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005caa5c
mov esp, ebp
pop ebp
ret
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
push ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005caf77
mov ebx, eax
add esp, 4
mov dword [ebp - 0xa34], ebx
test ebx, ebx
je 0x429063
lea eax, [esi*2 + 2]
push eax
push 0
push ebx
call fcn.005d4960
add esp, 0xc
push ebx
push esi
call edi
test eax, eax
jne 0x429030
push ebx
call fcn.005caaab
add esp, 4
xor al, al
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005caa5c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x60c3f4]
mov dword [ebp - 0xc], eax
mov ax, word [0x60c3f8]
push 0x208
mov word [ebp - 8], ax
call fcn.005caf77
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x429076
push dword [ebp - 0xa34]
call fcn.005caaab
add esp, 4
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005caa5c
mov esp, ebp
pop ebp
ret
push 0x208
push 0
push ebx
call fcn.005d4960
mov esi, dword [ebp - 0xa34]
add esp, 0xc
mov ax, word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push ebx
push eax
call edi
test eax, eax
jne 0x4290fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42919d
push ebx
call fcn.005caaab
xor ecx, ecx
mov eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005caf77
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x42919d
xor eax, eax
push 1
mov word [ebx], ax
lea eax, [ebp - 0xc]
push ebx
push eax
call edi
test eax, eax
je 0x42919d
mov edi, ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x429101
sub edi, ecx
lea eax, [ebp - 0x218]
sar edi, 1
push edi
push ebx
push eax
call fcn.005e048d
add esp, 0xc
test eax, eax
je 0x42913a
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x429125
cmp word [esi], ax
je 0x42919d
jmp 0x42908c
push 0x800
lea eax, [ebp - 0xa18]
push 0
push eax
call fcn.005d4960
lea eax, [ebp - 0x218]
lea eax, [eax + edi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x609b88
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.0042c560
add esp, 0x20
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.00405c70
mov ecx, dword [ebp - 0xa38]
push eax
call fcn.00405e00
lea ecx, [ebp - 0xa30]
call fcn.00405cd0
push dword [ebp - 0xa34]
call fcn.005caaab
add esp, 4
test ebx, ebx
je 0x4291b8
push ebx
call fcn.005caaab
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.005caa5c
mov esp, ebp
pop ebp
ret