Function at 0x41f930
Capabilities:
Get disk information
Get process image filename

Disassembly:
ret 4
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xa40], eax
call fcn.004604ef
test al, al
je 0x41f976
aam 0x8c
cmpsd dword [esi], dword es:[edi]
jae 0x41f92b
cli
dec esi
and dword [0x18ca014f], esp
popal
or byte [ebp + 0x18178dfc], ah
mov ebx, 0x40aeae8
call fcn.00460465
test al, al
je 0x41f99d
add byte [eax + eax*8 - 0x2697e18c], al
push ebp
mov ebx, 0xca95e43e
cmp eax, 0x6ca64c6f
stosd dword es:[edi], eax
xchg ecx, eax
push ebp
cmp al, 0xe2
dec ecx
nop
and byte [esi - 0x4d7c2cd7], al
lcall 0x40d, 0x75e8ae40
add byte [eax + eax*8 + 0x73dd2074], al
mov byte [0xa701215a], al
push 0x3ebb55d9
in al, 0x95
retf 0x6f3d
call fcn.00460717
test al, al
je 0x41f9c6
fnsave dword [ebx - 0x5e]
pop edx
and dword [ecx], eax
cmpsd dword [esi], dword es:[edi]
jg 0x41f95f
xor byte [ebx - 0x12], dh
cmpsd dword [esi], dword es:[edi]
jb 0x41fa0e
mov bh, 0xc5
cmp esp, ebp
mov al, 0x49
fistp word [ebx + edx*4 - 0x183cec97]
fsubp st(6)
inc ebp
mov ecx, dword [ebp - 0xa40]
push 0
push 0x625f30
call fcn.00402510
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00486960
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push dword [ebp - 0xa3c]
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x41fb98
call fcn.00460420
push cs
or al, byte [eax + eax]
test al, al
je 0x41fa26
push ss
enter 0xffffffffffff82cb, 0xffffffffffffffd7
xor dh, byte [edi + 0x1b]
or dl, cl
shr dword [edx - 0x31], 0x37
call 0x9f2e268
add al, 0
call fcn.004603db
test al, al
je 0x41fa46
rol bh, 1
sub al, 0xa
ret 0x5fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0xa38], edi
test edi, edi
je 0x41fb98
call fcn.00460648
test al, al
je 0x41fa8d
mov esp, 0xc69c0eea
test edx, esp
inc eax
ja 0x41faa4
retf
call fcn.00460603
test al, al
je 0x41faa6
invalid
xchg ecx, eax
xor eax, 0x40c27e8
add byte [eax + eax*8 + 0x75a81d74], al
call fcn.004606d2
test al, al
je 0x41facc
test al, 0x75
invalid
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045566c
add esp, 4
mov dword [ebp - 0xa3c], eax
test eax, eax
je 0x41fb98
call fcn.004604ef
test al, al
je 0x41fb14
mov esi, 0x86487779
push es
sbb eax, 0xc27847f2
mov al, byte [ecx - 0x13]
jb 0x41fb6c
jg 0x41fb3d
retf
call fcn.00460465
test al, al
je 0x41fb3b
aam 0xac
ud1
stosb byte es:[edi], al
xchg ebp, eax
adc dword [edi + 0x47abfea9], edx
insd dword es:[edi], dx
pop esp
mov byte [ebx + 0x14], dl
fldenv [eax + 0x3a]
std
mov bh, cl
mov ch, dh
jbe 0x41fb62
jmp 0x41fb43
call fcn.00460717
or eax, dword [eax + eax]
test al, al
je 0x41fb64
and byte [edx + esi*8], bl
sbb al, 0xf2
stosb byte es:[edi], al
pop ebx
sub byte [0xd9d4681b], dl
les edi, [0x97d8f03a]
dec edx
inc ebx
sahf
cmc
movsb byte es:[edi], byte [esi]
call 0xde703c4f
mov edi, 0xdad78299
add ecx, dword [ebx - 0xa374b]
dec dword [ebx - 0xa3b63]
dec dword [ebp + 0x27504]
add byte [eax], al
fiadd dword [ebx]
mov esi, dword [ebp - 0xa38]
mov ebx, dword [ebp - 0xa3c]
lea eax, [esi*2 + 2]
invalid
push eax
push 0
push ebx
call fcn.00486960
add esp, 0xc
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x41fbad
push ebx
call fcn.00455675
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 8
call fcn.00460420
test al, al
je 0x41fbcc
into
insd dword es:[edi], dx
aas
ror dword [esi], cl
and byte [edx - 0x30], ah
push ss
jmp 0x41fbde
call fcn.004603db
test al, al
je 0x41fbec
insb byte es:[edi], dx
ljmp 0xb502
test al, 0xec
imul esi, dword [eax], 0x26
cld
xchg ebp, eax
pop eax
jmp 0x41fc5d
mov eax, dword [0x5c798c]
mov dword [ebp - 0xc], eax
mov ax, word [0x5c7990]
push 0x208
mov word [ebp - 8], ax
add byte [esi - 0x77], ah
inc ebp
clc
call fcn.0045566c
add esp, 4
mov dword [ebp - 0xa34], eax
test eax, eax
je 0x41fb8f
push 0x208
push 0
push eax
call fcn.00486960
add esp, 0xc
mov edi, ebx
mov dword [ebp - 0xa38], edi
call fcn.004606d2
test al, al
je 0x41fc55
daa
stosd dword es:[edi], eax
cmc
int1
mov byte [esi], bh
pop ds
or byte [eax - 0xe9f8dc8], ch
pushfd
inc esp
jl 0x41fbd5
push es
sub eax, 0xe0073967
rcr ecx, cl
xchg ebp, eax
bnd call fcn.004604aa
call fcn.004604aa
test al, al
je 0x41fc6f
adc dword [esi], eax
push es
arpl dx, dx
jns 0x41fcb1
dec esp
push eax
mov dh, 0x22
ja 0x41fbfe
aad 0xb2
xlatb
sbb ebp, esi
call fcn.004607a1
test al, al
je 0x41fc90
push edi
jmp 0x1c7f5899
mov ax, word [edi]
push 0x104
push dword [ebp - 0xa34]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x41fe00
mov ch, 0xcc
cmc
invalid
add dword [eax], eax
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetLastError
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov al, byte [0x83005c51]
clc
jp 0x41fccd
cmp eax, 0x7a
jne 0x41ff8b
test eax, ecx
add al, byte [eax]
add al, ch
or cl, byte [edx]
add al, 0
call fcn.004606d2
test al, al
je 0x41fce2
push ss
fdiv st(4), st(0)
cld
pop ds
imul edx, dword [edi - 5], 0x7e
push es
or dword [edi + edi*2], eax
add al, 0xcf
cmp al, 0xf5
int 0x1c
jns 0x41fd15
shl dword [ebx], cl
loopne 0x41fccb
call fcn.00460465
jle 0x41fcec
add al, 0
test al, al
je 0x41fd04
mov al, byte [0x7a6b7352]
test al, 0xd7
push edx
jae 0x41fd5a
jp 0x41fc99
xlatb
jb 0x41fcb6
lodsd eax, dword [esi]
inc ebp
fidiv dword [esi]
xchg esp, eax
and dl, byte [ebp - 0x3c]
outsd dx, dword [esi]
aas
lea ebx, [ebx + 0x61009df2]
call fcn.00460282
test al, al
je 0x41fd21
inc esp
xchg ecx, eax
inc esi
fsub dword [edi + 0x20229bb7]
and ah, byte [eax]
lodsd eax, dword [esi]
mov ah, 0xa8
jno 0x41fd48
mov eax, dword [0xd1b5fecd]
push dword [ebp - 0xa34]
call fcn.00455675
xor ecx, ecx
mov eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045566c
mov ebx, eax
add esp, 8
mov dword [ebp - 0xa34], ebx
test ebx, ebx
je 0x41ff8b
fadd dword [ebx - 0x6276f73c]
int3
call fcn.00460351
test al, al
je 0x41fd7c
xchg ebx, eax
adc dh, byte [ebx + 0x55b8ec12]
je 0x41fd94
dec ebp
mov dword [0xace72da5], eax
push ecx
lds edi, [ebp - 0x75]
popfd
int3
call fcn.004602c7
test al, al
je 0x41fda2
mov dword [0x6a94], eax
invalid
add byte [ecx], ah
test al, 0x82
test eax, 0x8b248617
popfd
int3
xor eax, eax
push 1
mov word [ebx], ax
lea eax, [ebp - 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebx, eax
mov dword [ebp - 0xa44], ebx
call fcn.004600e4
add al, 0
test al, al
je 0x41fddb
retf 0x2905
call fcn.004601b3
test al, al
je 0x41fdf8
salc
jl 0x41fe2b
xchg esp, eax
pop esp
fnsave dword [eax - 0x5319b1c4]
cmp ah, byte [esi - 0x66edbf50]
or eax, 0xdb857d2b
test ebx, ebx
je 0x41ff8b
call fcn.004606d2
test al, al
je 0x41fe24
jp 0x41fdbf
pop es
cmpsb byte [esi], byte es:[edi]
in eax, dx
stosb byte es:[edi], al
adc bh, byte [edi + 0x2dedbbe0]
push esi
sub dword [ecx - 0x6b15c7ff], ecx
mov dword [ecx], eax
cmp dl, ch
xchg esp, eax
mov edx, dword [esp + ebx]
dec ebp
sti
lea ebx, [0x681e808]
add al, 0
call fcn.004604aa
test al, al
je 0x41fe3e
sbb dword [0x6bf7186d], edx
jns 0x41fe17
insd dword es:[edi], dx
sbb bh, dh
imul edi, dword [ecx - 0x1f], 0xffffffed
in eax, dx
pop ebx
inc edi
sub byte [edi - 0x17ede3e8], bh
pop esi
or dword [eax + eax], eax
call fcn.004607a1
test al, al
je 0x41fe57
sti
push 0x1a
dec edx
test al, 0xb5
dec edi
mov cl, al
ror ecx, cl
xor al, 0xf4
add eax, 0x9d8bc112
int3
mov ebx, dword [ebp - 0xa34]
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41fe62
sub esi, ecx
lea eax, [ebp - 0x218]
sar esi, 1
push esi
push ebx
push eax
call fcn.0049423d
add esp, 0xc
test eax, eax
je 0x41feef
call fcn.00460351
test al, al
je 0x41fea2
and ah, byte [ebp + 0x51]
mov bl, byte [eax]
xor dword [ecx], edi
clc
jne 0x41fe30
or ah, 0xb1
xchg esi, eax
mov al, 0xf8
rol dword [ebp + 0x420e8bd], 4
add byte [eax + eax*8 + 0x1c6e1774], al
add dl, 0x6d
test byte [ecx + 0x6f], bh
test byte [esi + 0x52], 0x46
salc
sar byte [ebp - 0x16d7702], 1
adc eax, 0xbd8b96c2
enter 0xfffffffffffffff5, 0xffffffffffffffff
call fcn.004602c7
test al, al
je 0x41fec2
outsb dx, byte [esi]
sbb al, 0x80
ret 0x846d
mov edi, dword [ebp - 0xa38]
nop dword [eax + eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x41fed0
mov dword [ebp - 0xa38], edi
cmp word [edi], ax
jne 0x41fc90
jmp 0x41ff8b
push 0x800
lea eax, [ebp - 0xa18]
push 0
push eax
call fcn.00486960
lea eax, [ebp - 0x218]
lea eax, [eax + esi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x5c58d8
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.00420a00
add esp, 0x20
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.004023b0
mov ecx, dword [ebp - 0xa40]
push eax
call fcn.00403f10
lea ecx, [ebp - 0xa30]
call fcn.00402370
call fcn.00460420
test al, al
je 0x41ff6b
mov dh, 0x22
ret
call fcn.004603db
test al, al
je 0x41ff8b
add dword [ebx - 0x50], ecx
mov ebx, 0x373614af
mov ebx, 0xb5ce4324
cmp bl, byte [esi]
mov byte [0x187e36e3], al
inc esp
ljmp 4
call fcn.00460648
test al, al
je 0x41ffb2
push cs
pop edx
jo 0x41ffe9
invalid
call fcn.00460603
test al, al
je 0x41ffcb
cmpsb byte [esi], byte es:[edi]
out 0xe7, al
cmp byte [edx], bl
inc edi
cmp byte [ebp + 0x18], 0x81
and ch, byte [esp + ecx*8 - 0x173dc746]
add al, byte [edi]
add al, 0
call fcn.004606d2
test al, al
je 0x41fff1
invalid
sti
arpl word [ecx], cx
xor al, 0x2a
int3
mov eax, dword [ebp - 0xa3c]
push eax
call fcn.00455675
mov eax, dword [ebp - 0xa34]
add esp, 4
test eax, eax
je 0x420013
push eax
call fcn.00455675
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00455afe
mov esp, ebp
pop ebp
ret 8