Function at 0x42a820
Capabilities:
Enumerate disk volumes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x593ab0]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 0
movzx eax, byte [eax]
push 2
push 0x20a
call fcn.00409a80
add esp, 8
test eax, eax
je 0x42ab89
mov esi, eax
push 0x20a
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x105
push esi
call sub.kernel32.dll_FindFirstVolumeW
mov dword [ebp - 0x30], eax
dec eax
cmp eax, 0xfffffffe
jae 0x42a8c5
mov ebx, esi
xor esi, esi
mov edi, 0xfffffffe
nop dword [eax]
cmp word [ebx + esi*2], 0
je 0x42a957
add edi, 0xfffffffe
inc esi
cmp edi, 0xfffffdf4
jne 0x42a890
push 0x5723a4
push 0x105
push 0x106
mov esi, ebx
call fcn.004df620
add esp, 0xc
jmp 0x42ab98
call fcn.0044ed20
test edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 1
je 0x42a8e7
lea eax, [ebp - 0x1c]
push eax
call fcn.0044ecd0
add esp, 4
push 2
push 0x20a
push esi
call main
add esp, 0xc
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x42a92e
mov edi, dword [ebp - 0x14]
add edi, 4
jmp 0x42a916
add edi, 0xc
dec esi
je 0x42a92e
mov eax, dword [edi - 4]
test eax, eax
je 0x42a910
add eax, eax
push 2
push eax
push dword [edi]
call main
add esp, 0xc
jmp 0x42a910
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42a949
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [ebp - 0x14]
call main
add esp, 0xc
mov eax, 4
xor ecx, ecx
xor edx, edx
jmp 0x42ab02
mov eax, dword [0x593ab0]
neg edi
movzx eax, byte [eax]
push 2
push edi
call fcn.00409a80
add esp, 8
test eax, eax
je 0x42ab7a
push edi
mov dword [ebp - 0x2c], ebx
push ebx
mov dword [ebp - 0x28], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
call fcn.00423190
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [ebp - 0x10], 1
push 0x105
mov esi, dword [ebp - 0x2c]
push esi
jmp 0x42a9e4
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
inc esi
lea ecx, [edi + edi*2]
inc edi
mov dword [eax + ecx*4], esi
mov dword [eax + ecx*4 + 4], edx
mov dword [eax + ecx*4 + 8], esi
mov dword [ebp - 0x10], edi
push 0x105
mov esi, ebx
push ebx
push dword [ebp - 0x30]
call sub.kernel32.dll_FindNextVolumeW
test eax, eax
je 0x42aa6b
xor esi, esi
mov edi, 0xfffffffe
nop word [eax + eax]
cmp word [ebx + esi*2], 0
je 0x42aa20
add edi, 0xfffffffe
inc esi
cmp edi, 0xfffffdf4
jne 0x42aa00
jmp 0x42a8a7
mov eax, dword [0x593ab0]
neg edi
movzx eax, byte [eax]
push 2
push edi
call fcn.00409a80
add esp, 8
test eax, eax
je 0x42ab7a
push edi
push ebx
mov dword [ebp - 0x2c], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
jne 0x42a9c0
lea eax, [ebp - 0x18]
push eax
call fcn.00423190
add esp, 4
jmp 0x42a9c0
call fcn.0044ed20
lea edi, [ebp - 0x1c]
test edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], 1
je 0x42aa8d
push edi
call fcn.0044ecd0
add esp, 4
call fcn.0044ed20
lea ecx, [ebp - 0x20]
cmp eax, 0x80070012
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
jne 0x42aab1
test edx, edx
je 0x42aabe
push ecx
call fcn.0044ecd0
add esp, 4
jmp 0x42aabe
test edx, edx
je 0x42aabe
push ecx
call fcn.0044ecd0
add esp, 4
push dword [ebp - 0x30]
call sub.kernel32.dll_FindVolumeClose
test eax, eax
jne 0x42aae9
call fcn.0044ed20
test edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], 1
je 0x42aae9
push edi
call fcn.0044ecd0
add esp, 4
push 2
push 0x20a
push esi
call main
add esp, 0xc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.00417f40
add esp, 8
movsd xmm0, qword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
movsd qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], eax
push esi
call fcn.004183e0
add esp, 4
mov eax, dword [esi]
test eax, eax
je 0x42ab63
imul eax, eax, 0x58
push 8
push eax
push dword [esi + 4]
call main
add esp, 0xc
mov eax, dword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x24]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
push 2
mov esi, ebx
call fcn.004ce340
add esp, 8
jmp 0x42ab98
push 0x20a
push 2
call fcn.004ce360
add esp, 8
ud2