Function at 0x4b9e30
Capabilities:
Get disk information
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x58e8e0
mov eax, dword fs:[0]
push eax
sub esp, 0x5c4
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x5c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x5d8]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0x18], eax
mov ebx, ecx
mov dword [esp + 0x1c], 0
xor ecx, ecx
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], cx
mov dword [esp + 0x5e0], 1
test eax, eax
jne 0x4b9ed3
mov dword [ebx + 0x10], ecx
mov ecx, ebx
mov dword [ebx + 0x14], 7
mov word [ebx], ax
lea eax, [esp + 0x5c]
push eax
call fcn.00404150
jmp 0x4ba507
push 0xc
xor eax, eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
lea ecx, [esp + 0x48]
push str.Kernel32.dll
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
call fcn.00404a80
mov byte [esp + 0x5e0], 2
mov eax, dword [0x7e23f4]
test al, 1
jne 0x4b9f4f
or eax, 1
mov dword [0x7e23f4], eax
mov byte [esp + 0x5e0], 3
mov dword [0x7e23f0], 0
call fcn.004c1de0
push 0x59ffb0
call fcn.00565027
add esp, 4
mov byte [esp + 0x5e0], 2
lea eax, [esp + 0x44]
mov ecx, 0x7e23f0
push eax
call fcn.004c1fa0
mov ebp, eax
mov dword [esp + 0x24], ebp
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x58], 8
jb 0x4b9f7f
push dword [esp + 0x44]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x58], 7
push 9
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], eax
push str.Psapi.dll
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], eax
mov word [esp + 0x34], ax
call fcn.00404a80
mov byte [esp + 0x5e0], 4
mov eax, dword [0x7e23f4]
test al, 1
jne 0x4ba004
or eax, 1
mov dword [0x7e23f4], eax
mov byte [esp + 0x5e0], 5
mov dword [0x7e23f0], 0
call fcn.004c1de0
push 0x59ffb0
call fcn.00565027
add esp, 4
mov byte [esp + 0x5e0], 4
lea eax, [esp + 0x2c]
mov ecx, 0x7e23f0
push eax
call fcn.004c1fa0
mov esi, eax
mov dword [esp + 0x14], esi
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x40], 8
jb 0x4ba034
push dword [esp + 0x2c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
test esi, esi
je 0x4ba4ec
test ebp, ebp
je 0x4ba4ec
lea ecx, [esp + 0x9c]
call fcn.004c28a0
cmp dword [esp + 0xa0], 6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jb 0x4ba101
push str.QueryFullProcessImageNameW
push ebp
call edi
mov esi, eax
test esi, esi
je 0x4ba0fd
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.0056cbb0
add esp, 0xc
mov dword [esp + 0x74], 0x208
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x1c0]
push eax
push 0
push dword [esp + 0x24]
call esi
test eax, eax
je 0x4ba0fd
mov eax, dword [esp + 0x74]
cmp eax, 0x208
jae 0x4ba0ec
add eax, eax
cmp eax, 0x412
jae 0x4ba242
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x60]
call fcn.0040bc40
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x6c], 0
jne 0x4ba455
push str.GetProcessImageFileNameW
push esi
call edi
mov esi, eax
test esi, esi
jne 0x4ba128
push str.GetProcessImageFileNameW
push ebp
call edi
mov esi, eax
test esi, esi
je 0x4ba18e
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 0x1bc]
push 0x208
push eax
push dword [esp + 0x20]
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x4ba18e
add eax, eax
cmp eax, 0x412
jae 0x4ba242
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x60]
call fcn.0040bc40
cmp dword [esp + 0x6c], 0
je 0x4ba3ce
push 0x410
call fcn.00560e4f
add esp, 4
mov ebp, eax
push 0x410
push 0
push ebp
call fcn.0056cbb0
xorps xmm0, xmm0
mov dword [esp + 0x8c], 0
movq qword [esp + 0x84], xmm0
add esp, 0xc
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov byte [esp + 0x5e0], 6
lea ecx, [esp + 0x78]
call fcn.004c2e50
mov ecx, dword [esp + 0x7c]
mov eax, 0x2aaaaaab
mov esi, dword [esp + 0x78]
sub ecx, esi
imul ecx
mov dword [esp + 0x74], 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x28], eax
je 0x4ba373
mov edi, esi
lea ebx, [ebx]
cmp dword [edi + 0x10], 3
jb 0x4ba261
mov ecx, dword [edi + 0x14]
cmp ecx, 8
jb 0x4ba247
mov eax, dword [edi]
jmp 0x4ba249
call fcn.0056582e
mov eax, edi
cmp word [eax + 4], 0x5c
jne 0x4ba261
cmp ecx, 8
jb 0x4ba259
mov eax, dword [edi]
jmp 0x4ba25b
mov eax, edi
xor ecx, ecx
mov word [eax + 4], cx
cmp dword [edi + 0x14], 8
jb 0x4ba26b
mov eax, dword [edi]
jmp 0x4ba26d
mov eax, edi
push 0x208
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x4ba282
mov word [ebp], ax
mov esi, ebp
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4ba287
sub esi, ecx
sar esi, 1
je 0x4ba2bb
cmp esi, dword [esp + 0x6c]
jae 0x4ba2bb
cmp dword [esp + 0x70], 8
lea eax, [esp + 0x5c]
push esi
cmovae eax, dword [esp + 0x60]
push ebp
push eax
call fcn.005699aa
add esp, 0xc
test eax, eax
je 0x4ba2d6
mov esi, dword [esp + 0x74]
add edi, 0x18
inc esi
mov dword [esp + 0x74], esi
cmp esi, dword [esp + 0x28]
jb 0x4ba230
jmp 0x4ba369
xor eax, eax
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], 0
mov word [esp + 0x84], ax
mov byte [esp + 0x5e0], 7
lea eax, [esp + 0x5c]
cmp dword [esp + 0x70], 8
cmovae eax, dword [esp + 0x5c]
cmp dword [edi + 0x14], 8
jb 0x4ba32a
mov edi, dword [edi]
lea eax, [eax + esi*2]
push eax
push edi
lea eax, [esp + 0x8c]
push 0x5ba4a0
push eax
call fcn.004b0200
add esp, 0x10
lea eax, [esp + 0x84]
lea ecx, [esp + 0x5c]
push eax
call fcn.00403c20
mov byte [esp + 0x5e0], 6
lea ecx, [esp + 0x84]
call fcn.00403b40
mov esi, dword [esp + 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
call fcn.0056503c
add esp, 4
mov byte [esp + 0x5e0], 1
test esi, esi
je 0x4ba3bf
push dword [esp + 0x20]
mov edx, dword [esp + 0x80]
push ecx
mov ecx, esi
call fcn.0040d3f0
push esi
call fcn.00564de3
add esp, 0xc
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
cmp dword [esp + 0x6c], 0
jne 0x4ba455
mov ebp, dword [esp + 0x24]
push str.GetModuleFileNameExW
push dword [esp + 0x18]
call edi
mov esi, eax
test esi, esi
jne 0x4ba3ed
push str.GetModuleFileNameExW
push ebp
call edi
mov esi, eax
test esi, esi
je 0x4ba455
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 0x1bc]
push 0x208
push eax
push 0
push dword [esp + 0x24]
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x4ba455
add eax, eax
cmp eax, 0x412
jae 0x4ba242
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x60]
call fcn.0040bc40
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x84]
call fcn.004b27a0
mov esi, eax
mov byte [esp + 0x5e0], 8
lea eax, [esp + 0x5c]
cmp eax, esi
je 0x4ba4ab
cmp dword [esp + 0x70], 8
jb 0x4ba48a
push dword [esp + 0x5c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x70], 7
push esi
lea ecx, [esp + 0x60]
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
call fcn.00404150
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x98], 8
jb 0x4ba4cc
push dword [esp + 0x84]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], 0
mov word [esp + 0x84], ax
mov dword [ebx + 0x10], eax
mov ecx, ebx
xor eax, eax
mov dword [ebx + 0x14], 7
mov word [ebx], ax
lea eax, [esp + 0x5c]
push eax
call fcn.00404150
mov dword [esp + 0x1c], 1
mov byte [esp + 0x5e0], 0
cmp dword [esp + 0x70], 8
jb 0x4ba52a
push dword [esp + 0x5c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], eax
mov word [esp + 0x5c], ax
mov eax, ebx
mov ecx, dword [esp + 0x5d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c0]
xor ecx, esp
call fcn.00564de8
add esp, 0x5d0
ret