Function at 0x100b4bc0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10116f0f
mov eax, dword fs:[0]
push eax
sub esp, 0x4a4
mov eax, dword [0x10163164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x4a8], 0
lea eax, [ebp - 0x428]
mov dword [ebp - 4], 0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x100b4f0c
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea esi, [ebp - 0x428]
nop dword [eax]
movzx eax, word [esi]
test ax, ax
je 0x100b4f0c
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x220]
push 0x104
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x16], 0x3a
push eax
call edi
test eax, eax
je 0x100b4ed8
xor eax, eax
mov dword [ebp - 0x42c], 7
mov dword [ebp - 0x430], 0
mov word [ebp - 0x440], ax
cmp word [ebp - 0x18], ax
jne 0x100b4c98
xor ecx, ecx
jmp 0x100b4caf
lea ecx, [ebp - 0x18]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b4ca0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x440]
call fcn.100b1210
xor eax, eax
mov dword [ebp - 0x478], 7
mov dword [ebp - 0x47c], 0
mov word [ebp - 0x48c], ax
mov dword [ebp - 0x460], 7
mov dword [ebp - 0x464], eax
mov word [ebp - 0x474], ax
mov dword [ebp - 0x45c], eax
push 1
push 0x1011d9fc
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 2
call fcn.100b0fc0
cmp word [ebp - 0x220], 0
jne 0x100b4d1d
xor eax, eax
jmp 0x100b4d35
lea eax, [ebp - 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100b4d26
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x48c]
call fcn.100b1210
cmp word [ebp - 0x18], 0
jne 0x100b4d53
xor ecx, ecx
jmp 0x100b4d6f
lea ecx, [ebp - 0x18]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b4d60
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x474]
call fcn.100b1210
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b4d90
sub ecx, edx
lea eax, [ebp - 0x48c]
sar ecx, 1
mov dword [ebp - 0x45c], ecx
lea ecx, [ebp - 0x4b0]
push eax
call fcn.100b4950
cmp dword [ebp - 0x42c], 8
lea eax, [ebp - 0x440]
cmovae eax, dword [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x100b4eab
cmp eax, 4
je 0x100b4eab
xor eax, eax
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], ax
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x4a4]
call fcn.100afce0
lea eax, [ebp - 0x458]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.100b4a10
mov ecx, dword [ebp - 0x490]
add esp, 8
mov byte [ebp - 4], 3
mov bl, al
cmp ecx, 8
jb 0x100b4e55
inc ecx
push ecx
push dword [ebp - 0x4a4]
lea ecx, [ebp - 0x4a4]
call fcn.100b15f0
test bl, bl
je 0x100b4e8d
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x48c]
call fcn.100b10f0
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x48c]
push eax
call fcn.100b4950
mov eax, dword [ebp - 0x444]
cmp eax, 8
jb 0x100b4eab
inc eax
lea ecx, [ebp - 0x458]
push eax
push dword [ebp - 0x458]
call fcn.100b15f0
lea ecx, [ebp - 0x48c]
call fcn.100b00f0
mov eax, dword [ebp - 0x42c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x100b4ed8
inc eax
lea ecx, [ebp - 0x440]
push eax
push dword [ebp - 0x440]
call fcn.100b15f0
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b4ee0
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
lea ecx, [ebp - 0x428]
mov eax, esi
sub eax, ecx
sar eax, 1
cmp eax, 0x104
jb 0x100b4c40
push 0x1017348c
mov dword [ebp - 0x18], vtable.nfapi::AutoLock.0
mov dword [ebp - 0x14], 0x1017348c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x4b0]
mov byte [ebp - 4], 5
push eax
mov ecx, 0x10173480
call fcn.100b0230
push 0x1017348c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [ebp - 0x4b0]
test ebx, ebx
je 0x100b4fce
push dword [ebp - 0x14]
lea eax, [ebp - 0x4b0]
push eax
push dword [ebp - 0x4ac]
push ebx
call fcn.100aeed0
mov ecx, dword [ebp - 0x4a8]
mov eax, 0x4ec4ec4f
sub ecx, ebx
add esp, 0x10
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x4ec4ec4
jbe 0x100b4f8d
call fcn.100c9aa4
imul eax, eax, 0x34
cmp eax, 0x1000
jb 0x100b4fc5
test bl, 0x1f
je 0x100b4fa1
call fcn.100c9aa4
mov eax, dword [ebx - 4]
cmp eax, ebx
jb 0x100b4fad
call fcn.100c9aa4
sub ebx, eax
cmp ebx, 4
jae 0x100b4fb9
call fcn.100c9aa4
cmp ebx, 0x23
jbe 0x100b4fc3
call fcn.100c9aa4
mov ebx, eax
push ebx
call fcn.100b88ab
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b8868
mov esp, ebp
pop ebp
ret