Function at 0x435360
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448ea3
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x467040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x263], cl
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x435788
cmp byte [ebp - 0x263], 0
mov byte [ebp - 0x261], 0
jne 0x4353ef
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 3
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push str._NTFS_Scanner__Running_checks_for_important_file_modifications..._n
call fcn.0042fd40
add esp, 4
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 7
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Scanning_macro_traces_may_be_useless_in_1.9_servers._Do_you_want_to_scan_macro_traces___y_n_:
call fcn.0040af60
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0x262]
call fcn.00435800
mov al, byte [ebp - 0x262]
cmp al, 0x79
je 0x435425
mov byte [ebp - 0x262], 0
cmp al, 0x59
jne 0x43542c
mov byte [ebp - 0x262], 1
cmp byte [ebp - 0x114], 0
lea esi, [ebp - 0x114]
je 0x4354e5
nop
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x435445
sub ecx, edx
cmp ecx, 3
jne 0x4354b5
cmp byte [esi + 1], 0x3a
jne 0x4354b5
cmp byte [esi + 2], 0x5c
jne 0x4354b5
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
nop dword [eax]
test eax, eax
je 0x4354b5
lea eax, [ebp - 0x218]
push str.NTFS
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x435652
mov dl, byte [ebp - 0x262]
mov cl, byte [esi]
call fcn.00434e00
mov ch, byte [ebp - 0x261]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4354c0
sub eax, edx
inc esi
add esi, eax
cmp byte [esi], cl
jne 0x435440
test ch, ch
je 0x4354e5
mov cl, byte ds:[ebp - 0x263]
call fcn.00434c60
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 7
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea ecx, ds:[ebp - 0x260]
call fcn.00434620
push ecx
lea eax, [ebp - 0x248]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x260]
call fcn.0042f480
mov byte [ebp - 4], 1
lea edx, [ebp - 0x248]
cmp dword [ebp - 0x234], 0xf
lea eax, [ebp - 0x248]
cmova edx, dword [ebp - 0x248]
add edx, dword [ebp - 0x238]
cmp dword [ebp - 0x234], 0xf
cmova eax, dword [ebp - 0x248]
cmp eax, edx
je 0x435564
cmp byte [eax], 0x5c
jne 0x43555d
mov byte [eax], 0x2f
inc eax
cmp eax, edx
jne 0x435555
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.File_modifications_were_exported_to:
call fcn.0040af60
cmp dword [ebp - 0x234], 0xf
lea edx, [ebp - 0x248]
push dword [ebp - 0x238]
cmova edx, dword [ebp - 0x248]
mov ecx, eax
call fcn.0040dd00
add esp, 4
mov ecx, eax
push 0x40d840
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.Order_the_folder_by__Date_modified__and_open_the_most_recent__.txt__files_to_check_all_important_modifications._n
call fcn.0042fd40
push str.You_should_ban_the_user_if_you_find_a_modification_made_just_before_the_Screenshare._n
call fcn.0042fd40
add esp, 8
cmp byte [ebp - 0x262], 0
je 0x4355d3
push str.In_the_case_of_the_logitech.txt_file__only_ban_if_this_modification_is_exactly_settings.db._n
call fcn.0042fd40
add esp, 4
push 0x15
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
push str.new_renamed_files.txt
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 0
movups xmmword [ebp - 0x230], xmm0
call fcn.004063e0
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0041dfa0
mov byte ds:[ebp - 4], 1
mov ecx, dword [ebp - 0x21c]
cmp ecx, 7
jbe 0x435669
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43565f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43565f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ch, 1
mov byte [ebp - 0x261], ch
jmp 0x4354bb
push ecx
push edx
call fcn.00444ae8
add esp, 8
push 0x15
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
push str.old_renamed_files.txt
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 0
movups xmmword [ebp - 0x230], xmm0
call fcn.004063e0
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 3
call fcn.0041dfa0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 7
jbe 0x4356f0
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4356e6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4356e6
nop word [eax + eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00444ae8
add esp, 8
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe 0x435728
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43571c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x435778
push ecx
push edx
call fcn.00444ae8
add esp, 8
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
cmp ecx, 7
jbe 0x435788
mov edx, dword ds:[ebp - 0x260]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43577e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43577e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00444ae8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00444aa0
mov esp, ebp
pop ebp
ret