Function at 0x11df9a50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fb86e8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
test esi, esi
mov ebp, 1
je 0x11df9c64
push esi
call fcn.11e67d05
add esp, 4
test eax, eax
je 0x11df9c64
lea ecx, [esp + 0x10]
call fcn.11e84ba0
or edi, 0xffffffff
lea ecx, [esp + 0x10]
push edi
push 0
mov dword [esp + 0x30], 0
call fcn.11e84c10
lea eax, [esp + 0x10]
push eax
call fcn.11dfa680
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x11df9c41
push 0
call fcn.11df9ea0
add esp, 4
test eax, eax
jne 0x11df9c1e
push esi
lea ecx, [esp + 0x34]
call fcn.11e7eae0
lea ecx, [esp + 0xc]
push esi
push ecx
mov ecx, 0x1212b5c0
mov byte [esp + 0x30], 1
call fcn.11d7ce00
mov edx, dword [esp + 0xc]
mov byte [esp + 0x28], 2
mov eax, dword [edx - 8]
test eax, eax
je 0x11df9b15
lea eax, [esp + 0xc]
lea ecx, [esp + 0x30]
push eax
call fcn.11e7f410
mov eax, dword [0x12133f80]
test eax, eax
je 0x11df9b3d
mov ecx, dword [esp + 0xc]
push ecx
push esi
push 0x33a
push str._CSDSafeDiskMgr::IsSafeDiskForbiddenPath__Line:_d__Org__s__Cvrt__s_
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x18
lea ecx, [esp + 0x30]
call fcn.11e805b0
push 0x5c
lea ecx, [esp + 0x34]
call fcn.11e82ba0
push 0x12022ca0
lea ecx, [esp + 0x34]
call fcn.11e7fed0
mov eax, dword [esp + 0x14]
xor edi, edi
test eax, eax
jle 0x11df9b8b
mov edx, dword [esp + 0x10]
mov eax, dword [edx + edi*4]
push eax
mov eax, dword [esp + 0x34]
push eax
call fcn.11e9bad0
add esp, 8
test eax, eax
jne 0x11df9bf1
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jl 0x11df9b69
mov eax, dword [0x12133f80]
xor ebp, ebp
test eax, eax
je 0x11df9bb0
push esi
push 0x350
push str._CSDSafeDiskMgr::IsSafeDiskForbiddenPath__Line:_d_Path__s__is_not_forbidden.
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x14
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.11e7f280
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.11e84bb0
pop edi
mov eax, ebp
pop esi
pop ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov eax, dword [0x12133f80]
test eax, eax
je 0x11df9bb0
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + edi*4]
push edx
push esi
push 0x346
push str._CSDSafeDiskMgr::IsSafeDiskForbiddenPath__Line:_d_SrcPath__s___SafeDiskForbidden__s_
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x18
jmp 0x11df9bb0
mov eax, dword [0x12133f80]
test eax, eax
je 0x11df9c41
push esi
push 0x32c
push str._CSDSafeDiskMgr::IsSafeDiskForbiddenPath__Line:_d_Path__s__IsAllowVisitSDiskByPolicy
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x14
lea ecx, [esp + 0x10]
xor esi, esi
mov dword [esp + 0x28], edi
call fcn.11e84bb0
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov eax, dword [0x12133f80]
test eax, eax
je 0x11df9c86
push 0x317
push str._CSDSafeDiskMgr::IsSafeDiskForbiddenPath__Line:_d_Path_is_null
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x10
mov ecx, dword [esp + 0x20]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret