Function at 0x100c4296
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push 0x48c
mov eax, 0x10112b4c
call fcn.10062882
mov dword [ebp - 0x498], edx
mov edi, ecx
mov dword [ebp - 0x484], edi
push 0x100
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.kernel32.dll_FindFirstVolumeW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100c44a6
push 0xc
call fcn.1004abd7
mov dword [ebp - 0x480], eax
pop ecx
mov ecx, dword [sym.imp.kernel32.dll_FindVolumeClose]
mov dword [eax], 0x1000544c
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [ebp - 0x494], eax
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x100c4306
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jb 0x100c4480
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x434]
call fcn.1004abd7
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.1007ff18
cmp dword [ebp - 0x420], 8
lea eax, [ebp - 0x434]
jb 0x100c4354
mov eax, dword [ebp - 0x434]
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
push eax
call dword [sym.imp.kernel32.dll_QueryDosDeviceW]
test eax, eax
jne 0x100c4380
xor eax, eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], al
call fcn.1006ab66
jmp 0x100c447e
lea esi, [ebp - 0x41c]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x100c438b
sub esi, ecx
mov eax, edi
sar esi, 1
cmp dword [edi + 0x14], 8
jb 0x100c43a4
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x41c]
push ecx
push eax
call fcn.1004abd7
add esp, 0xc
test eax, eax
jne 0x100c436b
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x488], eax
push 0x104
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 2
call fcn.1004abd7
mov edi, dword [ebp - 0x490]
lea ecx, [ebp - 0x480]
xor eax, eax
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x48c]
sub eax, edi
push ecx
sar eax, 1
push eax
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.kernel32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x100c44ae
call dword [sym.imp.kernel32.dll_GetLastError]
lea ecx, [ebp - 0x490]
cmp eax, 0xea
jne 0x100c4463
push dword [ebp - 0x480]
call fcn.1004abd7
mov eax, dword [ebp - 0x48c]
lea ecx, [ebp - 0x480]
mov edi, dword [ebp - 0x490]
sub eax, edi
push ecx
sar eax, 1
push eax
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.kernel32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x100c44ae
lea ecx, [ebp - 0x490]
call fcn.100754c5
xor eax, eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], al
call fcn.1006ab66
mov edi, dword [ebp - 0x484]
xor esi, esi
push 0x100
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindNextVolumeW]
test eax, eax
jne 0x100c42fd
lea ecx, [ebp - 0x494]
call fcn.1004abd7
xor al, al
call fcn.1006281a
ret
mov ecx, dword [ebp - 0x484]
lea eax, [ebp - 0x47c]
push 0xffffffffffffffff
push esi
push eax
call fcn.1004abd7
mov esi, eax
push edi
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 3
call fcn.1004abd7
push esi
lea edx, [ebp - 0x44c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x464]
call fcn.1008092b
mov ecx, dword [ebp - 0x498]
push eax
call fcn.1004abd7
lea ecx, [ebp - 0x464]
call fcn.1006ab66
lea ecx, [ebp - 0x44c]
call fcn.1006ab66
lea ecx, [ebp - 0x47c]
call fcn.1006ab66
lea ecx, [ebp - 0x490]
call fcn.100754c5
lea ecx, [ebp - 0x434]
call fcn.1006ab66
lea ecx, [ebp - 0x494]
call fcn.1004abd7
mov al, 1
jmp 0x100c44a8