Function at 0x424630
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3c03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcf4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
lea edi, [esi + 0xf8]
push edi
call fcn.00403280
add esp, 4
push 0x104
lea eax, [ebp - 0x2f8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea ecx, [ebp - 0x2f8]
push ecx
call fcn.0046ab7c
add esp, 4
push eax
lea edx, [ebp - 0x14]
push edx
mov ecx, edi
call fcn.004062c0
mov eax, dword [eax]
lea ecx, [ebp - 0x2f8]
push ecx
push eax
call fcn.0046ab92
mov ebx, eax
mov eax, dword [ebp - 0x14]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4246c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x4246d3
inc dword [0x4d0968]
mov ecx, esi
call fcn.004252f0
add dword [esi + 0x10], eax
call fcn.0047ef80
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
push eax
lea ecx, [ebp - 0x18]
push str._sinfo.mdb
xor ebx, ebx
push ecx
mov dword [ebp - 4], ebx
mov dword [esi], 0x30
call fcn.00403140
add esp, 0xc
push 0x400
lea edx, [ebp - 0xd00]
push edx
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x24]
push edx
push 0x104
lea eax, [ebp - 0x500]
push eax
push 0x4ab854
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
je 0x42479b
call fcn.0047ef80
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
push str._pwd_08lu
push ecx
mov byte [ebp - 4], 1
call fcn.00403140
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add esp, 0xc
push edi
push edx
mov ecx, esi
call fcn.00422f60
mov dword [esi + 8], eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42479b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
cmp dword [esi + 8], ebx
jne 0x4247e6
mov edx, dword [0x4cff68]
mov eax, dword [ebp - 0x18]
and edx, 0xfffffffe
add eax, 0xfffffff0
mov dword [0x4cff68], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4247d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00498d33
mov eax, dword [eax + 4]
push ebx
push 0x4ab834
push 0x4a8658
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.0049bfd6
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00404530
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x424832
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edi, dword [ebp - 0x18]
mov eax, dword [edi - 0xc]
cmp eax, ebx
je 0x424ab1
cmp eax, 0x1e
je 0x424888
inc dword [0x4d0968]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
add edi, 0xfffffff0
mov esi, ecx
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x424875
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push ebx
push 0x30
push edi
mov ecx, esi
call fcn.00424310
cmp eax, dword [esi + 0x30]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
jne 0x4248ad
mov eax, dword [esi + 0x34]
mov ecx, edx
cmp ecx, eax
je 0x4249a6
lea edx, [ebp - 0x34]
push edx
mov byte [ebp - 4], 3
call fcn.00462143
lea ebx, [esi + 0x120]
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.0045e24c
push ebx
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 5
call fcn.0045e9e7
push 0x4ab4f0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
call fcn.0045f423
push 0
push 1
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00460875
lea ecx, [ebp - 0xf0]
call fcn.0045dcd6
lea ecx, [ebp - 0xf0]
call fcn.0045f927
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x20], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [ebp - 0x1c], eax
fild qword [ebp - 0x20]
and ecx, 0x80000000
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], 0
fild qword [ebp - 0x20]
lea edx, [ebp - 0x34]
push edx
push 0x4a867c
fchs
lea ecx, [ebp - 0xf0]
faddp st(1)
mov word [ebp - 0x34], 5
fstp qword [ebp - 0x2c]
call fcn.0045faf7
lea ecx, [ebp - 0xf0]
call fcn.0045f97f
lea ecx, [ebp - 0xf0]
call fcn.0045e2da
lea ecx, [ebp - 0x58]
call fcn.0045dc18
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 5
call fcn.0045ea79
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.0045e26f
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor ebx, ebx
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x3c]
push 0x11
push 0xb
push 0x30
mov dword [esi + 0x30], ecx
push edi
mov ecx, esi
mov dword [esi + 0x34], edx
mov dword [esi + 0x68], ebx
call fcn.00424310
push 0x18
push 0x12
push 0x30
push edi
mov ecx, esi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.00424310
push 0xb
push 7
push 0x30
push edi
mov ecx, esi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
call fcn.00424310
push 0x1e
push 0x1a
push 0x30
push edi
mov ecx, esi
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], edx
call fcn.00424310
push edi
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], edx
call fcn.0046ab7c
add esp, 4
xor edx, edx
test eax, eax
jle 0x424ab4
xor ecx, ecx
mov cx, word [edi + edx*2]
add ecx, 0xffffffd0
cmp cx, 9
jbe 0x424a39
add ecx, 0xfff9
cmp cx, 0x1f
jbe 0x424a41
xor ecx, ecx
xor ebx, ecx
inc edx
cmp edx, eax
jl 0x424a24
test bx, bx
je 0x424ab4
add edi, 0xfffffff0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x424a75
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 8], ebx
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x424ad5
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret