Function at 0x4cbde0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x114], edx
mov ebx, ecx
mov dword [ebp - 0x12c], eax
cmp dword [0x5d186c], edi
jne 0x4cbe1a
call fcn.004cbc50
test eax, eax
je 0x4cbe3c
test ebx, ebx
je 0x4cbfaa
cmp byte [ebx], 0
je 0x4cbfaa
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
cmp edi, 0x104
jbe 0x4cbe4f
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
lea edx, [edi + 1]
xor esi, esi
mov dword [ebp - 0x118], edx
cmp edx, 0x10
jb 0x4cbede
lea ecx, [ebp - 0x110]
lea edx, [ebp - 0x110]
add ecx, edi
lea eax, [ebx + edi]
cmp edx, eax
mov edx, dword [ebp - 0x118]
ja 0x4cbe7e
cmp ecx, ebx
jae 0x4cbede
movaps xmm5, xmmword [0x5b8cc0]
mov eax, edx
movaps xmm6, xmmword [0x5b8d00]
and eax, 0xf
mov ecx, edi
sub ecx, eax
nop word [eax + eax]
movups xmm4, xmmword [ebx + esi]
movups xmm0, xmmword [ebp + esi - 0x110]
movaps xmm3, xmm4
pcmpeqb xmm3, xmm5
movaps xmm2, xmm3
movaps xmm1, xmm3
andps xmm2, xmm6
andnps xmm1, xmm0
orps xmm2, xmm1
andps xmm2, xmm3
andnps xmm3, xmm4
orps xmm2, xmm3
movups xmmword [ebp + esi - 0x110], xmm2
add esi, 0x10
cmp esi, ecx
jbe 0x4cbea0
cmp esi, edi
ja 0x4cbf15
lea eax, [ebp - 0x110]
sub ebx, eax
nop word [eax + eax]
lea edx, [ebp - 0x110]
mov eax, 0x5c
add edx, esi
cmp byte [ebx + edx], 0x2f
movzx ecx, byte [ebx + edx]
cmove ecx, eax
inc esi
mov byte [edx], cl
cmp esi, edi
jbe 0x4cbef0
mov edx, dword [ebp - 0x118]
cmp byte [ebp - 0x110], 0x5c
mov al, byte [ebp - 0x10f]
jne 0x4cbf8d
cmp al, 0x5c
jne 0x4cbf8d
mov eax, 2
xor ecx, ecx
cmp edi, eax
jbe 0x4cbfaa
cmp byte [ebp + eax - 0x110], 0x5c
jne 0x4cbf43
inc ecx
cmp ecx, 2
je 0x4cbf75
inc eax
cmp eax, edi
jb 0x4cbf33
cmp ecx, 1
jne 0x4cbfaa
lea eax, [ebp - 0x110]
cmp byte [eax + edi], 0x5c
je 0x4cbfaa
mov byte [eax + edi], 0x5c
mov edi, edx
cmp edx, 0x105
jae 0x4cc217
mov byte [ebp + edx - 0x110], 0
jmp 0x4cbfaa
inc eax
cmp eax, 0x105
jae 0x4cc217
mov byte [ebp + eax - 0x110], 0
mov edi, eax
jmp 0x4cbfaa
cmp al, 0x3a
jne 0x4cbfa1
mov word [ebp - 0x10e], 0x5c
mov edi, 3
jmp 0x4cbfaa
mov byte [ebp - 0x110], 0
xor edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x63fb00
call ebx
cmp dword [0x60d140], 0
je 0x4cbfda
lea eax, [ebp - 0x110]
push eax
push 0x60d15c
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4cc1c4
xor esi, esi
push 0x63fb00
mov dword [ebp - 0x128], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
push esi
lea eax, [ebp - 0x124]
xor ecx, ecx
cmp byte [ebp - 0x110], cl
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x110]
push esi
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 0x118], eax
test eax, eax
je 0x4cc16b
test byte [ebp - 0x124], 8
je 0x4cc16b
mov ecx, dword [ebp - 0x12c]
cmp dword [ecx + 8], esi
je 0x4cc16b
xor ecx, ecx
lea eax, [ebp - 0x110]
cmp byte [ebp - 0x110], cl
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x4cc16b
push esi
push 0x2000000
push 3
push esi
push 7
push 0x81020000
push dword [ebp - 0x114]
mov dword [ebp - 0x128], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x120], eax
cmp eax, 0xffffffff
je 0x4cc130
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], esi
push ecx
push esi
push esi
push 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4cc115
push dword [ebp - 0x114]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x11c], eax
test eax, eax
je 0x4cc115
lea ecx, [ebp - 0x114]
push ecx
push dword [ebp - 0x114]
push eax
push 0xc
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
push dword [ebp - 0x11c]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test esi, esi
setne al
mov dword [ebp - 0x11c], eax
mov esi, eax
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x63fb00
call ebx
mov ebx, dword [ebp - 0x118]
jmp 0x4cc17c
push 0
push 0
push 3
push 0
push 7
push 0x1000000
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x4cc16b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x63fb00
mov esi, 4
call ebx
mov ebx, dword [ebp - 0x118]
jmp 0x4cc17c
push 0x63fb00
call ebx
mov ebx, dword [ebp - 0x118]
test ebx, ebx
je 0x4cc1ef
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x60d15c
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp - 0x124]
mov dword [0x60d14c], eax
mov eax, dword [ebp - 0x128]
mov dword [0x60d144], 0
mov dword [0x60d150], eax
mov dword [0x60d154], esi
mov dword [0x60d140], 1
jmp 0x4cc1c9
mov ebx, 1
mov edx, dword [ebp - 0x12c]
mov ecx, 0x49
mov esi, 0x60d140
mov edi, edx
mov eax, dword [edx + 8]
mov dword [0x60d148], eax
mov eax, dword [edx + 0x18]
mov dword [0x60d158], eax
rep movsd dword es:[edi], dword [esi]
jmp 0x4cc1f9
mov dword [0x60d140], 0
push 0x63fb00
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00524763
mov esp, ebp
pop ebp
ret
call fcn.00524b54
int3