Function at 0x40853f
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ecx, 0x20
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x368]
xor esi, esi
push ebx
sub esp, 0x3ac
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x378], esi
mov dword [ebp - 0x380], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x384], eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x374]
mov dword [esp + 4], 0x10
mov dword [esp], eax
call fcn.0043c01b
cmp dword [ebp + 8], 0
jns 0x408597
xor esi, esi
jmp 0x408b05
mov eax, dword [ebp + 8]
add eax, 0xffffff80
mov dword [ebp - 0x388], eax
cmp eax, 0x40
jbe 0x4085c4
mov dword [esp + 8], 0x107
mov dword [esp + 4], str.drive.c
mov dword [esp], str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
jmp 0x4086b0
mov dword [ebp - 0x37c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x394], ebx
mov dword [ebp - 0x390], 1
cmp dword [ebp - 0x394], 0
lea eax, [ebp - 0x220]
jne 0x40862f
mov dword [esp + 4], 0x104
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeA]
push ecx
push ecx
mov dword [ebp - 0x37c], eax
inc eax
jne 0x408684
cmp dword [ebp + 0x18], 0
jne 0x408590
call fcn.0043df77
mov dword [esp], str.Could_not_access_first_GUID_volume:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x408590
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x37c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_FindNextVolumeA]
sub esp, 0xc
test eax, eax
jne 0x408684
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
je 0x4089f4
cmp dword [ebp + 0x18], 0
jne 0x4089f4
call fcn.0043df77
mov dword [esp], str.Could_not_access_next_GUID_volume:__s
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x4089f4
lea esi, [ebp - 0x220]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov edi, eax
cmp eax, 4
ja 0x4086b6
mov dword [esp + 8], 0x11b
mov dword [esp + 4], str.drive.c
mov dword [esp], str.len___4
call dword [0x491228]
mov dword [esp + 8], 4
mov ebx, dword [sym.imp.msvcrt.dll__strnicmp]
mov dword [esp + 4], 0x4954ce
mov dword [esp], esi
call ebx
test eax, eax
je 0x4086ee
mov dword [esp + 8], 0x11c
mov dword [esp + 4], str.drive.c
mov dword [esp], str.safe_strnicmp_volume_name__volume_start__4___0
jmp 0x4086b0
lea eax, [edi - 1]
cmp byte [ebp + edi - 0x221], 0x5c
mov dword [ebp - 0x38c], eax
je 0x40871a
mov dword [esp + 8], 0x11d
mov dword [esp + 4], str.drive.c
mov dword [esp], str.volume_name_len___1___
jmp 0x4086b0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
sub eax, 2
push edx
cmp eax, 1
ja 0x4087bd
mov eax, dword [ebp - 0x38c]
lea edi, [ebp - 0x11c]
mov byte [ebp + eax - 0x220], 0
lea eax, [ebp - 0x21c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
sub esp, 0xc
test eax, eax
je 0x40879e
mov dword [esp + 8], 0xd
mov dword [esp + 4], str.DeviceCdRom
mov dword [esp], edi
call ebx
test eax, eax
je 0x40880a
mov dword [esp + 8], 0xe
mov dword [esp + 4], str.DeviceFloppy
mov dword [esp], edi
call ebx
test eax, eax
jne 0x4087c5
jmp 0x40880a
cmp dword [ebp + 0x18], 0
jne 0x4087bd
call fcn.0043df77
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Failed_to_get_device_path_for_GUID_volume__s:__s
call fcn.0043d9e0
or esi, 0xffffffff
jmp 0x4089e7
xor eax, eax
mov dword [esp + 0x1c], 0xbb8
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], esi
call fcn.0043eadf
mov ebx, eax
cmp eax, 0xffffffff
jne 0x408847
jmp 0x408828
cmp dword [ebp + 0x18], 0
jne 0x4087bd
lea eax, [ebp - 0x11c]
mov dword [esp], str.Skipping_GUID_volume_for__s
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x4087bd
cmp dword [ebp + 0x18], 0
jne 0x4087bd
call fcn.0043df77
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_open_GUID_volume__s:__s
jmp 0x4087b8
lea eax, [ebp - 0x378]
xor edi, edi
xor esi, esi
mov dword [esp], ebx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x2e8]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
lea edi, [ebx - 1]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0xc8
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x560000
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
sub esp, 0x20
test eax, eax
je 0x408af8
cmp dword [ebp - 0x378], 0
je 0x408ac3
xor esi, esi
cmp edi, 0xfffffffd
ja 0x4088b3
mov dword [esp], ebx
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
mov eax, dword [ebp - 0x2e8]
test eax, eax
jne 0x4088da
cmp dword [ebp + 0x18], 0
jne 0x4089e7
lea eax, [ebp - 0x220]
mov dword [esp], str.Ignoring_volume__s_because_it_has_no_extents...
mov dword [esp + 4], eax
jmp 0x4088f8
dec eax
je 0x408902
cmp dword [ebp + 0x18], 0
jne 0x4089e7
lea eax, [ebp - 0x220]
mov dword [esp], str.Ignoring_volume__s_because_it_has_more_than_one_extent__RAID__...
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x4089e7
mov eax, dword [ebp - 0x388]
cmp eax, dword [ebp - 0x2e0]
jne 0x4089e7
mov ecx, dword [ebp - 0x370]
cmp ecx, 0x10
jne 0x40893a
mov dword [esp + 4], 0x10
xor esi, esi
mov dword [esp], str.Error:_Trying_to_process_a_disk_with_more_than__d_partitions_
call fcn.0043d9e0
jmp 0x408aa8
cmp dword [ebp + 0x14], 0
je 0x40894e
mov eax, dword [ebp - 0x38c]
mov byte [ebp + eax - 0x220], 0x5c
mov eax, dword [ebp - 0x2d8]
mov edx, dword [ebp - 0x2d4]
mov dword [ebp + ecx*8 - 0x368], eax
lea eax, [ebp - 0x220]
mov dword [ebp + ecx*8 - 0x364], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x374]
mov dword [esp + 8], 1
mov dword [esp], eax
call fcn.0043c061
cmp dword [ebp + 0x18], 0
jne 0x4089e7
cmp dword [ebp - 0x390], 0
mov eax, dword [0x524104]
je 0x4089ac
test eax, eax
je 0x4089df
mov dword [esp], str.Windows_volumes_from_this_device:
call fcn.0043d9e0
cmp dword [0x524104], 0
je 0x4089df
mov eax, dword [ebp - 0x2d8]
mov edx, dword [ebp - 0x2d4]
mov dword [esp], str.__s___lld
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call fcn.0043d9e0
xor edx, edx
mov dword [ebp - 0x390], edx
inc dword [ebp - 0x394]
inc esi
je 0x4085e0
mov ebx, dword [ebp - 0x370]
xor esi, esi
xor eax, eax
test ebx, ebx
je 0x408aa8
mov edx, dword [ebp - 0x380]
mov ecx, dword [ebp - 0x384]
or edx, ecx
je 0x408a37
cmp eax, ebx
jae 0x408a55
cmp dword [ebp + eax*8 - 0x364], ecx
je 0x408a26
inc eax
jmp 0x408a06
mov edx, dword [ebp - 0x380]
cmp dword [ebp + eax*8 - 0x368], edx
jne 0x408a23
jmp 0x408a3b
cmp eax, ebx
jae 0x408a55
mov edx, dword [ebp - 0x374]
mov esi, dword [edx + eax*4]
test esi, esi
je 0x408aa8
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__strdup]
mov esi, eax
jmp 0x408aa8
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x380]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x384]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040839a
mov esi, eax
test eax, eax
je 0x408aa8
mov dword [esp + 4], 0x20
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x408aa8
mov dword [esp], str.Warning:_Using_physical_device_to_access_partition_data
call fcn.0043d9e0
cmp dword [ebp - 0x37c], 0xffffffff
je 0x408b05
mov eax, dword [ebp - 0x37c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_FindVolumeClose]
push eax
jmp 0x408b05
cmp dword [ebp + 0x18], 0
mov eax, str._empty_data_
jne 0x408ade
mov dword [esp + 4], eax
mov dword [esp], str.Could_not_get_Disk_Extents:__s
call fcn.0043d9e0
xor esi, esi
cmp edi, 0xfffffffd
ja 0x4089e7
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
jmp 0x4087bd
cmp dword [ebp + 0x18], 0
jne 0x408ade
call fcn.0043df77
jmp 0x408ace
lea eax, [ebp - 0x374]
mov dword [esp], eax
call fcn.0043c17c
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret