Function at 0x444500
Capabilities:
Get storage device properties

Disassembly:
push 0xffffffffffffffff
push 0x4ce259
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x68]
push edi
mov edi, ecx
mov dword [esp + 0x2c], 0
cmp edi, 0x980c8
ja 0x444b9f
je 0x444b95
cmp edi, 0x7c008
ja 0x444846
je 0x44483c
cmp edi, 0x70000
ja 0x4446a1
je 0x444697
cmp edi, 0x4d004
ja 0x444617
je 0x44460d
cmp edi, 0x2480c
ja 0x4445d8
je 0x4445ce
cmp edi, 0x24804
ja 0x4445b8
je 0x4445ae
cmp edi, 0x24058
je 0x4445a4
cmp edi, 0x24800
jne case.0x44539f.5488645
push str.IOCTL_CDROM_CHECK_VERIFY
jmp 0x44579b
push str.IOCTL_CDROM_GET_CONFIGURATION
jmp 0x44579b
push str.IOCTL_CDROM_MEDIA_REMOVAL
jmp 0x44579b
cmp edi, 0x24808
jne case.0x44539f.5488645
push str.IOCTL_CDROM_EJECT_MEDIA
jmp 0x44579b
push str.IOCTL_CDROM_LOAD_MEDIA
jmp 0x44579b
mov eax, edi
sub eax, 0x41018
je 0x444603
sub eax, 8
je 0x4445f9
sub eax, 4
jne case.0x44539f.5488645
push str.IOCTL_SCSI_FREE_DUMP_POINTERS
jmp 0x44579b
push str.IOCTL_SCSI_GET_DUMP_POINTERS
jmp 0x44579b
push str.IOCTL_SCSI_GET_ADDRESS
jmp 0x44579b
push str.IOCTL_SCSI_PASS_THROUGH
jmp 0x44579b
cmp edi, 0x60198
ja 0x444662
je 0x444658
mov eax, edi
sub eax, 0x4d014
je 0x44464e
sub eax, 0x1317c
je 0x444644
sub eax, 4
jne case.0x44539f.5488645
push str.FSCTL_DFS_GET_REFERRALS
jmp 0x44579b
push str.FSCTL_DFS_TRANSLATE_PATH
jmp 0x44579b
push str.IOCTL_SCSI_PASS_THROUGH_DIRECT
jmp 0x44579b
push str.FSCTL_DFS_REPORT_INCONSISTENCY
jmp 0x44579b
mov eax, edi
sub eax, 0x6019c
je 0x44468d
sub eax, 4
je 0x444683
sub eax, 4
jne case.0x44539f.5488645
push str.FSCTL_DFS_GET_VERSION
jmp 0x44579b
push str.FSCTL_DFS_IS_ROOT
jmp 0x44579b
push str.FSCTL_DFS_IS_SHARE_IN_DFS
jmp 0x44579b
push str.IOCTL_DISK_GET_DRIVE_GEOMETRY
jmp 0x44579b
cmp edi, 0x70140
ja 0x44475e
je 0x444754
lea eax, [edi - 0x70014]
cmp eax, 0x8c
ja case.0x44539f.5488645
movzx eax, byte [eax + 0x4457f4]
jmp dword [eax*4 + 0x4457bc]
push str.IOCTL_DISK_VERIFY
jmp 0x44579b
push str.IOCTL_DISK_PERFORMANCE
jmp 0x44579b
push str.IOCTL_DISK_IS_WRITABLE
jmp 0x44579b
push str.IOCTL_DISK_LOGGING
jmp 0x44579b
push str.IOCTL_DISK_HISTOGRAM_STRUCTURE
jmp 0x44579b
push str.IOCTL_DISK_HISTOGRAM_DATA
jmp 0x44579b
push str.IOCTL_DISK_HISTOGRAM_RESET
jmp 0x44579b
push str.IOCTL_DISK_REQUEST_STRUCTURE
jmp 0x44579b
push str.IOCTL_DISK_REQUEST_DATA
jmp 0x44579b
push str.IOCTL_DISK_PERFORMANCE_OFF
jmp 0x44579b
push str.IOCTL_DISK_GET_PARTITION_INFO_EX
jmp 0x44579b
push str.IOCTL_DISK_GET_DRIVE_LAYOUT_EX
jmp 0x44579b
push str.IOCTL_DISK_GET_DRIVE_GEOMETRY_EX
jmp 0x44579b
push str.IOCTL_DISK_UPDATE_PROPERTIES
jmp 0x44579b
cmp edi, 0x74800
ja 0x4447e3
je 0x4447d9
cmp edi, 0x7405c
ja 0x4447b3
je 0x4447a9
mov eax, edi
sub eax, 0x70c00
je 0x44479f
sub eax, 0x3404
je 0x444795
sub eax, 8
jne case.0x44539f.5488645
push str.IOCTL_DISK_GET_DRIVE_LAYOUT
jmp 0x44579b
push str.IOCTL_DISK_GET_PARTITION_INFO
jmp 0x44579b
push str.IOCTL_DISK_GET_MEDIA_TYPES
jmp 0x44579b
push str.IOCTL_DISK_GET_LENGTH_INFO
jmp 0x44579b
mov eax, edi
sub eax, 0x74080
je 0x4447cf
sub eax, 0x54
jne case.0x44539f.5488645
push str.IOCTL_DISK_GET_CACHE_INFORMATION
jmp 0x44579b
push str.SMART_GET_VERSION
jmp 0x44579b
push str.IOCTL_DISK_CHECK_VERIFY
jmp 0x44579b
lea eax, [edi - 0x74804]
cmp eax, 0x14
ja case.0x44539f.5488645
movzx ecx, byte [eax + 0x4458a0]
jmp dword [ecx*4 + 0x445884]
push str.IOCTL_DISK_MEDIA_REMOVAL
jmp 0x44579b
push str.IOCTL_DISK_EJECT_MEDIA
jmp 0x44579b
push str.IOCTL_DISK_LOAD_MEDIA
jmp 0x44579b
push str.IOCTL_DISK_RESERVE
jmp 0x44579b
push str.IOCTL_DISK_RELEASE
jmp 0x44579b
push str.IOCTL_DISK_FIND_NEW_DEVICES
jmp 0x44579b
push str.IOCTL_DISK_SET_PARTITION_INFO
jmp 0x44579b
cmp edi, 0x90000
ja 0x44490a
je 0x4448f9
lea eax, [edi - 0x7c010]
cmp eax, 0xc8
ja case.0x44539f.5488645
movzx edx, byte [eax + 0x4458f0]
jmp dword [edx*4 + 0x4458b8]
push str.IOCTL_DISK_SET_DRIVE_LAYOUT
jmp 0x44579b
push str.IOCTL_DISK_FORMAT_TRACKS
jmp 0x44579b
push str.IOCTL_DISK_REASSIGN_BLOCKS
jmp 0x44579b
push str.IOCTL_DISK_FORMAT_TRACKS_EX
jmp 0x44579b
push str.SMART_SEND_DRIVE_COMMAND
jmp 0x44579b
push str.SMART_RCV_DRIVE_DATA
jmp 0x44579b
push str.IOCTL_DISK_SET_PARTITION_INFO_EX
jmp 0x44579b
push str.IOCTL_DISK_SET_DRIVE_LAYOUT_EX
jmp 0x44579b
push str.IOCTL_DISK_CREATE_DISK
jmp 0x44579b
push str.IOCTL_DISK_REASSIGN_BLOCKS_EX
jmp 0x44579b
push str.IOCTL_DISK_UPDATE_DRIVE_SIZE
jmp 0x44579b
push str.IOCTL_DISK_GROW_PARTITION
jmp 0x44579b
push str.IOCTL_DISK_SET_CACHE_INFORMATION
jmp 0x44579b
push 0x4e1f80
mov ebx, esi
call fcn.00402bd0
jmp 0x4457a2
cmp edi, 0x90120
ja 0x444b43
je 0x444b39
lea eax, [edi - 0x90004]
cmp eax, 0xfc
ja case.0x44539f.5488645
movzx eax, byte [eax + 0x445a8c]
jmp dword [eax*4 + 0x4459bc]
push str.FSCTL_REQUEST_OPLOCK_LEVEL_2
jmp 0x44579b
push str.FSCTL_REQUEST_BATCH_OPLOCK
jmp 0x44579b
push str.FSCTL_OPLOCK_BREAK_ACKNOWLEDGE
jmp 0x44579b
push str.FSCTL_OPBATCH_ACK_CLOSE_PENDING
jmp 0x44579b
push str.FSCTL_OPLOCK_BREAK_NOTIFY
jmp 0x44579b
push str.FSCTL_LOCK_VOLUME
jmp 0x44579b
push str.FSCTL_UNLOCK_VOLUME
jmp 0x44579b
push str.FSCTL_DISMOUNT_VOLUME
jmp 0x44579b
push str.FSCTL_IS_VOLUME_MOUNTED
jmp 0x44579b
push str.FSCTL_IS_PATHNAME_VALID
jmp 0x44579b
push str.FSCTL_MARK_VOLUME_DIRTY
jmp 0x44579b
push str.FSCTL_QUERY_RETRIEVAL_POINTERS
jmp 0x44579b
push str.FSCTL_GET_COMPRESSION
jmp 0x44579b
push str.FSCTL_OPLOCK_BREAK_ACK_NO_2
jmp 0x44579b
push str.FSCTL_QUERY_FAT_BPB
jmp 0x44579b
push str.FSCTL_REQUEST_FILTER_OPLOCK
jmp 0x44579b
push str.FSCTL_FILESYSTEM_GET_STATISTICS
jmp 0x44579b
push str.FSCTL_GET_NTFS_VOLUME_DATA
jmp 0x44579b
push str.FSCTL_GET_NTFS_FILE_RECORD
jmp 0x44579b
push str.FSCTL_GET_VOLUME_BITMAP
jmp 0x44579b
push str.FSCTL_GET_RETRIEVAL_POINTERS
jmp 0x44579b
push str.FSCTL_MOVE_FILE
jmp 0x44579b
push str.FSCTL_IS_VOLUME_DIRTY
jmp 0x44579b
push str.FSCTL_ALLOW_EXTENDED_DASD_IO
jmp 0x44579b
push str.FSCTL_READ_PROPERTY_DATA
jmp 0x44579b
push str.FSCTL_WRITE_PROPERTY_DATA
jmp 0x44579b
push str.FSCTL_FIND_FILES_BY_SID
jmp 0x44579b
push str.FSCTL_DUMP_PROPERTY_DATA
jmp 0x44579b
push str.FSCTL_SET_OBJECT_ID
jmp 0x44579b
push str.FSCTL_GET_OBJECT_ID
jmp 0x44579b
push str.FSCTL_DELETE_OBJECT_ID
jmp 0x44579b
push str.FSCTL_SET_REPARSE_POINT
jmp 0x44579b
push str.FSCTL_GET_REPARSE_POINT
jmp 0x44579b
push str.FSCTL_DELETE_REPARSE_POINT
jmp 0x44579b
push str.FSCTL_ENUM_USN_DATA
jmp 0x44579b
push str.FSCTL_READ_USN_JOURNAL
jmp 0x44579b
push str.FSCTL_SET_OBJECT_ID_EXTENDED
jmp 0x44579b
push str.FSCTL_CREATE_OR_GET_OBJECT_ID
jmp 0x44579b
push str.FSCTL_SET_SPARSE
jmp 0x44579b
push str.FSCTL_SET_ENCRYPTION
jmp 0x44579b
push str.FSCTL_ENCRYPTION_FSCTL_IO
jmp 0x44579b
push str.FSCTL_WRITE_RAW_ENCRYPTED
jmp 0x44579b
push str.FSCTL_READ_RAW_ENCRYPTED
jmp 0x44579b
push str.FSCTL_CREATE_USN_JOURNAL
jmp 0x44579b
push str.FSCTL_READ_FILE_USN_DATA
jmp 0x44579b
push str.FSCTL_WRITE_USN_CLOSE_RECORD
jmp 0x44579b
push str.FSCTL_EXTEND_VOLUME
jmp 0x44579b
push str.FSCTL_QUERY_USN_JOURNAL
jmp 0x44579b
push str.FSCTL_DELETE_USN_JOURNAL
jmp 0x44579b
push str.FSCTL_MARK_HANDLE
jmp 0x44579b
push str.FSCTL_SIS_COPYFILE
jmp 0x44579b
push str.FSCTL_FILE_PREFETCH
jmp 0x44579b
cmp edi, 0x940cf
ja 0x444b7f
je 0x444b75
cmp edi, 0x901af
je 0x444b6b
cmp edi, 0x940b7
jne case.0x44539f.5488645
push str.FSCTL_SECURITY_ID_CHECK
jmp 0x44579b
push str.CSC_FSCTL_OPERATION_QUERY_HANDLE
jmp 0x44579b
push str.FSCTL_QUERY_ALLOCATED_RANGES
jmp 0x44579b
cmp edi, 0x941e4
jne case.0x44539f.5488645
push str.FSCTL_TXFS_LIST_TRANSACTIONS
jmp 0x44579b
push str.FSCTL_SET_ZERO_DATA
jmp 0x44579b
cmp edi, 0x2d480c
ja 0x445037
je 0x44502d
cmp edi, 0x140191
ja 0x444d32
je 0x444d28
cmp edi, 0x110018
ja 0x444c8a
je 0x444c80
cmp edi, 0xc4003
ja 0x444c3b
je 0x444c31
cmp edi, 0x9c104
ja 0x444c1b
je 0x444c11
cmp edi, 0x980d0
je 0x444c07
cmp edi, 0x9c040
jne case.0x44539f.5488645
push str.FSCTL_SET_COMPRESSION
jmp 0x44579b
push str.FSCTL_ENABLE_UPGRADE
jmp 0x44579b
push str.FSCTL_SIS_LINK_FILES
jmp 0x44579b
cmp edi, 0x9c108
jne case.0x44539f.5488645
push str.FSCTL_HSM_MSG
jmp 0x44579b
push str.FSCTL_MAILSLOT_PEEK
jmp 0x44579b
lea eax, [edi - 0x110000]
cmp eax, 0x10
ja case.0x44539f.5488645
movzx ecx, byte [eax + 0x445ba0]
jmp dword [ecx*4 + 0x445b8c]
push str.FSCTL_PIPE_DISCONNECT
jmp 0x44579b
push str.FSCTL_PIPE_ASSIGN_EVENT
jmp 0x44579b
push str.FSCTL_PIPE_QUERY_EVENT
jmp 0x44579b
push str.FSCTL_PIPE_LISTEN
jmp 0x44579b
push str.FSCTL_PIPE_WAIT
jmp 0x44579b
cmp edi, 0x116000
ja 0x444cee
je 0x444ce4
cmp edi, 0x110024
ja 0x444cce
je 0x444cc4
mov eax, edi
sub eax, 0x11001c
je 0x444cba
sub eax, 4
jne case.0x44539f.5488645
push str.FSCTL_PIPE_SET_CLIENT_PROCESS
jmp 0x44579b
push str.FSCTL_PIPE_IMPERSONATE
jmp 0x44579b
push str.FSCTL_QUERY_CLIENT_PROCESS
jmp 0x44579b
cmp edi, 0x11400c
jne case.0x44539f.5488645
push str.FSCTL_PIPE_PEEK
jmp 0x44579b
push str.FSCTL_PIPE_INTERNAL_READ
jmp 0x44579b
cmp edi, 0x119ff8
je 0x444d1e
cmp edi, 0x11c017
je 0x444d14
cmp edi, 0x11dfff
jne case.0x44539f.5488645
push str.FSCTL_PIPE_INTERNAL_TRANSCEIVE
jmp 0x44579b
push str.FSCTL_PIPE_TRANSCEIVE
jmp 0x44579b
push str.FSCTL_PIPE_INTERNAL_WRITE
jmp 0x44579b
push str.FSCTL_LMR_START
jmp 0x44579b
cmp edi, 0x140378
ja 0x444e6f
je 0x444e65
lea eax, [edi - 0x140193]
cmp eax, 0x65
ja case.0x44539f.5488645
movzx edx, byte [eax + 0x445c20]
jmp dword [edx*4 + 0x445bb4]
push str.FSCTL_NETWORK_GET_CONNECTION_INFO
jmp 0x44579b
push str.FSCTL_NETWORK_ENUMERATE_CONNECTIONS
jmp 0x44579b
push str.FSCTL_NETWORK_DELETE_CONNECTION
jmp 0x44579b
push str.FSCTL_NETWORK_SET_CONFIGURATION_INFO
jmp 0x44579b
push str.FSCTL_NETWORK_GET_CONFIGURATION_INFO
jmp 0x44579b
push str.FSCTL_NETWORK_GET_STATISTICS
jmp 0x44579b
push str.FSCTL_NETWORK_SET_DOMAIN_NAME
jmp 0x44579b
push str.FSCTL_LMR_STOP
jmp 0x44579b
push str.FSCTL_LMR_BIND_TO_TRANSPORT
jmp 0x44579b
push str.FSCTL_LMR_UNBIND_FROM_TRANSPORT
jmp 0x44579b
push str.FSCTL_LMR_ENUMERATE_TRANSPORTS
jmp 0x44579b
push str.FSCTL_LMR_GET_HINT_SIZE
jmp 0x44579b
push str.FSCTL_LMR_FORCE_DISCONNECT
jmp 0x44579b
push str.FSCTL_LMR_TRANSACT
jmp 0x44579b
push str.FSCTL_LMR_ENUMERATE_PRINT_INFO
jmp 0x44579b
push str.FSCTL_LMR_START_SMBTRACE
jmp 0x44579b
push str.FSCTL_LMR_END_SMBTRACE
jmp 0x44579b
push str.FSCTL_LMR_START_RBR
jmp 0x44579b
push str.FSCTL_LMR_SET_SERVER_GUID
jmp 0x44579b
push str.FSCTL_LMR_QUERY_TARGET_INFO
jmp 0x44579b
push str.FSCTL_LMR_QUERY_DEBUG_INFO
jmp 0x44579b
push str.IOCTL_SMBMRX_START
jmp 0x44579b
push str.IOCTL_SMBMRX_STOP
jmp 0x44579b
push str.IOCTL_SMBMRX_GETSTATE
jmp 0x44579b
push str.IOCTL_SMBMRX_ADDCONN
jmp 0x44579b
push str.IOCTL_SMBMRX_DELCONN
jmp 0x44579b
push str.IOCTL_UMRX_RELEASE_THREADS
jmp 0x44579b
cmp edi, 0x140fdb
ja 0x444f0c
je 0x444f02
lea eax, [edi - 0x14037e]
cmp eax, 0x6a
ja case.0x44539f.5488645
movzx eax, byte [eax + 0x445cb4]
jmp dword [eax*4 + 0x445c88]
push str.FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT
jmp 0x44579b
push str.IOCTL_LMR_LWIO_PREIO
jmp 0x44579b
push str.IOCTL_LMR_LWIO_POSTIO
jmp 0x44579b
push str.IOCTL_LMR_DISABLE_LOCAL_BUFFERING
jmp 0x44579b
push str.IOCTL_LMR_QUERY_REMOTE_SERVER_NAME
jmp 0x44579b
push str.IOCTL_UMRX_GET_REQUEST
jmp 0x44579b
push str.IOCTL_UMRX_RESPONSE_AND_REQUEST
jmp 0x44579b
push str.IOCTL_UMRX_RESPONSE
jmp 0x44579b
push str.IOCTL_UMRX_GET_LOCK_OWNER
jmp 0x44579b
push str.IOCTL_UMRX_PREPARE_QUEUE
jmp 0x44579b
push str.IOCTL_SHADOW_END_REINT
jmp 0x44579b
cmp edi, 0x2d0c10
ja 0x444faa
je 0x444fa0
cmp edi, 0x2d0940
ja 0x444f69
je 0x444f5f
mov eax, edi
sub eax, 0x140fff
je 0x444f55
sub eax, 0x18f801
je 0x444f4b
sub eax, 0xc
jne case.0x44539f.5488645
push str.IOCTL_STORAGE_LOAD_MEDIA2
jmp 0x44579b
push str.IOCTL_STORAGE_CHECK_VERIFY2
jmp 0x44579b
push str.IOCTL_GETSHADOW
jmp 0x44579b
push str.IOCTL_STORAGE_EJECTION_CONTROL
jmp 0x44579b
mov eax, edi
sub eax, 0x2d0944
je 0x444f96
sub eax, 0x2bc
je 0x444f8c
sub eax, 4
jne case.0x44539f.5488645
push str.IOCTL_STORAGE_GET_MEDIA_TYPES_EX
jmp 0x44579b
push str.IOCTL_STORAGE_GET_MEDIA_TYPES
jmp 0x44579b
push str.IOCTL_STORAGE_MCN_CONTROL
jmp 0x44579b
push str.IOCTL_STORAGE_GET_MEDIA_SERIAL_NUMBER
jmp 0x44579b
cmp edi, 0x2d1400
ja 0x444ff8
je 0x444fee
cmp edi, 0x2d0c14
je 0x444fe4
cmp edi, 0x2d1080
je 0x444fda
cmp edi, 0x2d1100
jne case.0x44539f.5488645
push str.IOCTL_STORAGE_PREDICT_FAILURE
jmp 0x44579b
push str.IOCTL_STORAGE_GET_DEVICE_NUMBER
jmp 0x44579b
push str.IOCTL_STORAGE_GET_HOTPLUG_INFO
jmp 0x44579b
push str.IOCTL_STORAGE_QUERY_PROPERTY
jmp 0x44579b
mov eax, edi
sub eax, 0x2d4800
je 0x445023
sub eax, 4
je 0x445019
sub eax, 4
jne case.0x44539f.5488645
push str.IOCTL_STORAGE_EJECT_MEDIA
jmp 0x44579b
push str.IOCTL_STORAGE_MEDIA_REMOVAL
jmp 0x44579b
push str.IOCTL_STORAGE_CHECK_VERIFY
jmp 0x44579b
push str.IOCTL_STORAGE_LOAD_MEDIA
jmp 0x44579b
cmp edi, 0x530190
ja 0x445239
je 0x44522f
cmp edi, 0x4d000c
ja 0x44516f
je 0x445165
cmp edi, 0x2d5140
ja 0x4450f1
je 0x4450e7
cmp edi, 0x2d5000
ja 0x4450b2
je 0x4450a8
mov eax, edi
sub eax, 0x2d4810
je 0x44509e
sub eax, 4
je 0x445094
sub eax, 4
jne case.0x44539f.5488645
push str.IOCTL_STORAGE_FIND_NEW_DEVICES
jmp 0x44579b
push str.IOCTL_STORAGE_RELEASE
jmp 0x44579b
push str.IOCTL_STORAGE_RESERVE
jmp 0x44579b
push str.IOCTL_STORAGE_RESET_BUS
jmp 0x44579b
mov eax, edi
sub eax, 0x2d5004
je 0x4450dd
sub eax, 0x10
je 0x4450d3
sub eax, 4
jne case.0x44539f.5488645
push str.IOCTL_STORAGE_PERSISTENT_RESERVE_IN
jmp 0x44579b
push str.IOCTL_STORAGE_BREAK_RESERVATION
jmp 0x44579b
push str.IOCTL_STORAGE_RESET_DEVICE
jmp 0x44579b
push str.IOCTL_STORAGE_READ_CAPACITY
jmp 0x44579b
cmp edi, 0x38a813
ja 0x44513f
je 0x445135
cmp edi, 0x2d518c
je 0x44512b
cmp edi, 0x2dcc18
je 0x445121
cmp edi, 0x2dd01c
jne case.0x44539f.5488645
push str.IOCTL_STORAGE_PERSISTENT_RESERVE_OUT
jmp 0x44579b
push str.IOCTL_STORAGE_SET_HOTPLUG_INFO
jmp 0x44579b
push str.IOCTL_STORAGE_QUERY_DEPENDENT_DISK
jmp 0x44579b
push str.IOCTL_CHANNEL_GET_SNDCHANNEL
jmp 0x44579b
mov eax, edi
sub eax, 0x4d0000
je 0x44515b
sub eax, 8
jne case.0x44539f.5488645
push str.IOCTL_MOUNTDEV_QUERY_DEVICE_NAME
jmp 0x44579b
push str.IOCTL_MOUNTDEV_QUERY_UNIQUE_ID
jmp 0x44579b
push str.IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME
jmp 0x44579b
cmp edi, 0x530018
ja 0x4451b8
je 0x4451ae
mov eax, edi
sub eax, 0x4dc004
je 0x4451a4
sub eax, 0xc
je 0x44519a
sub eax, 4
jne case.0x44539f.5488645
push str.IOCTL_MOUNTDEV_LINK_DELETED
jmp 0x44579b
push str.IOCTL_MOUNTDEV_LINK_CREATED
jmp 0x44579b
push str.IOCTL_MOUNTDEV_UNIQUE_ID_CHANGE_NOTIFY
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_NAMES_OF_SNAPSHOTS
jmp 0x44579b
lea eax, [edi - 0x530024]
cmp eax, 0x3a
ja case.0x44539f.5488645
movzx ecx, byte [eax + 0x445d48]
jmp dword [ecx*4 + 0x445d20]
push str.IOCTL_VOLSNAP_QUERY_DIFF_AREA
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_DIFF_AREA_SIZES
jmp 0x44579b
push str.IOCTL_VOLSNAP_AUTO_CLEANUP
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_REVERT
jmp 0x44579b
push str.IOCTL_VOLSNAP_REVERT_CLEANUP
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_REVERT_PROGRESS
jmp 0x44579b
push str.IOCTL_VOLSNAP_CANCEL_REVERT
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_EPIC
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_COPY_FREE_BITMAP
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_ORIGINAL_VOLUME_NAME
jmp 0x44579b
cmp edi, 0x534054
ja 0x445308
je 0x4452fe
lea eax, [edi - 0x530194]
cmp eax, 0x3c
ja case.0x44539f.5488645
movzx edx, byte [eax + 0x445dc4]
jmp dword [edx*4 + 0x445d84]
push str.IOCTL_VOLSNAP_QUERY_CONFIG_INFO
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_APPLICATION_INFO
jmp 0x44579b
push str.IOCTL_VOLSNAP_HAS_CHANGED
jmp 0x44579b
push str.IOCTL_VOLSNAP_SET_SNAPSHOT_PRIORITY
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_SNAPSHOT_PRIORITY
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_DELTA_BITMAP
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_SNAPSHOT_SUPPLEMENTAL
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_COPIED_BITMAP
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_MOVE_LIST
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_PRE_COPIED_BITMAP
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_USED_PRE_COPIED_BITMAP
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_DEFRAG_PRE_COPIED_BITMAP
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_FREESPACE_PRE_COPIED_BITMAP
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_HOTBLOCKS_PRE_COPIED_BITMAP
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_DIFF_AREA_FILE_SIZES
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_OFFLINE
jmp 0x44579b
cmp edi, 0x53c000
ja 0x445375
je 0x44536b
lea eax, [edi - 0x534058]
cmp eax, 0x34
ja case.0x44539f.5488645
movzx eax, byte [eax + 0x445e20]
jmp dword [eax*4 + 0x445e04]
push str.IOCTL_VOLSNAP_QUERY_DIFF_AREA_MINIMUM_SIZE
jmp 0x44579b
push str.IOCTL_VOLSNAP_BLOCK_DELETE_IN_THE_MIDDLE
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_APPLICATION_FLAGS
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_PERFORMANCE_COUNTERS
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_PRE_COPY_AMOUNTS
jmp 0x44579b
push str.IOCTL_VOLSNAP_QUERY_DEFAULT_PRE_COPY_AMOUNTS
jmp 0x44579b
push str.IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES
jmp 0x44579b
cmp edi, 0x53c198
ja 0x445450
je 0x445446
lea eax, [edi - 0x53c004]
cmp eax, 0x8c
ja case.0x44539f.5488645
movzx ecx, byte [eax + 0x445e9c]
jmp dword [ecx*4 + 0x445e58]
push str.IOCTL_VOLSNAP_RELEASE_WRITES
jmp 0x44579b
push str.IOCTL_VOLSNAP_PREPARE_FOR_SNAPSHOT
jmp 0x44579b
push str.IOCTL_VOLSNAP_ABORT_PREPARED_SNAPSHOT
jmp 0x44579b
push str.IOCTL_VOLSNAP_COMMIT_SNAPSHOT
jmp 0x44579b
push str.IOCTL_VOLSNAP_END_COMMIT_SNAPSHOT
jmp 0x44579b
push str.IOCTL_VOLSNAP_CLEAR_DIFF_AREA
jmp 0x44579b
push str.IOCTL_VOLSNAP_ADD_VOLUME_TO_DIFF_AREA
jmp 0x44579b
push str.IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE
jmp 0x44579b
push str.IOCTL_VOLSNAP_DELETE_OLDEST_SNAPSHOT
jmp 0x44579b
push str.IOCTL_VOLSNAP_DELETE_SNAPSHOT
jmp 0x44579b
push str.IOCTL_VOLSNAP_REVERT
jmp 0x44579b
push str.IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE_TEMP
jmp 0x44579b
push str.IOCTL_VOLSNAP_SET_APPLICATION_FLAGS
jmp 0x44579b
push str.IOCTL_VOLSNAP_SET_BC_FAILURE_MODE
jmp 0x44579b
push str.IOCTL_VOLSNAP_SET_PRE_COPY_AMOUNTS
jmp 0x44579b
push str.IOCTL_VOLSNAP_PRE_EXPOSE_DEVICES
jmp 0x44579b
push str.IOCTL_VOLSNAP_SET_APPLICATION_INFO
jmp 0x44579b
mov eax, edi
sub eax, 0x560000
je 0x445796
sub eax, 0x38
je 0x44578f
mov eax, edi
shr eax, 0x10
mov dword [esp + 0x28], eax
mov eax, edi
mov ebp, edi
and eax, 3
shr ebp, 2
push 0x4de1c0
lea ebx, [esp + 0x24]
mov dword [esp + 0x28], eax
and ebp, 0xfff
call fcn.00402bd0
push 0x4e5a24
lea ebx, [esp + 0x20]
mov dword [esp + 0x68], 1
call fcn.00402bd0
push 0x4e5a0c
lea ebx, [esp + 0x1c]
mov byte [esp + 0x68], 2
call fcn.00402bd0
push 0x4e59f8
lea ebx, [esp + 0x18]
mov byte [esp + 0x68], 3
call fcn.00402bd0
mov edx, dword [esp + 0x24]
push 0
push edx
lea eax, [esp + 0x60]
mov byte [esp + 0x6c], 4
call fcn.00443520
mov ebx, eax
push 0
push ebp
lea eax, [esp + 0x5c]
mov byte [esp + 0x6c], 5
call fcn.00443520
mov ebp, eax
mov eax, dword [esp + 0x28]
push 0
push eax
lea eax, [esp + 0x58]
mov byte [esp + 0x6c], 6
call fcn.00443560
mov dword [esp + 0x28], eax
push 0
push edi
lea eax, [esp + 0x54]
mov byte [esp + 0x6c], 7
call fcn.00443560
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x4c]
push edx
push eax
mov byte [esp + 0x70], 8
call fcn.004907a0
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x48]
push edx
push eax
mov byte [esp + 0x70], 9
call fcn.004907a0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x44]
push edx
push eax
mov byte [esp + 0x70], 0xa
call fcn.004907a0
push ebp
lea ecx, [esp + 0x40]
push ecx
push eax
mov byte [esp + 0x70], 0xb
call fcn.004907a0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x3c]
push ecx
push eax
mov byte [esp + 0x70], 0xc
call fcn.004907a0
push ebx
lea edx, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x70], 0xd
call fcn.004907a0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push eax
mov byte [esp + 0x70], 0xe
call fcn.004907a0
mov eax, dword [eax]
mov dword [esi], eax
test eax, eax
je 0x4455bb
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebx, 1
mov dword [esp + 0x2c], ebx
test eax, eax
je 0x4455e4
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x4455e4
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 0xd
mov eax, dword [esp + 0x34]
test eax, eax
je 0x445603
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x445603
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 0xc
mov eax, dword [esp + 0x38]
test eax, eax
je 0x445622
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x445622
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 0xb
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x445641
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x445641
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 0xa
mov eax, dword [esp + 0x40]
test eax, eax
je 0x445660
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x445660
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 9
mov eax, dword [esp + 0x44]
test eax, eax
je 0x44567f
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x44567f
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 8
mov eax, dword [esp + 0x48]
test eax, eax
je 0x44569e
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x44569e
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 7
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x4456bd
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x4456bd
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 6
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4456dc
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x4456dc
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 5
mov eax, dword [esp + 0x54]
test eax, eax
je 0x4456fb
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x4456fb
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 4
mov eax, dword [esp + 0x58]
test eax, eax
je 0x44571a
push eax
mov ebp, eax
call edi
test eax, eax
jne 0x44571a
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 3
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x445737
push ebp
call edi
test eax, eax
jne 0x445737
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 2
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x445754
push ebp
call edi
test eax, eax
jne 0x445754
push ebp
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], bl
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x445770
push ebx
call edi
test eax, eax
jne 0x445770
push ebx
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x64], 0
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4457a2
push ebx
call edi
test eax, eax
jne 0x4457a2
push ebx
call fcn.0049e96f
add esp, 4
jmp 0x4457a2
push str.IOCTL_VOLUME_GET_GPT_ATTRIBUTES
jmp 0x44579b
push str.IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS
mov ebx, esi
call fcn.00402bd0
mov ecx, dword [esp + 0x5c]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x58
ret 4