Function at 0x4513c0
Capabilities:
Enumerate pe sections
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x45c
mov eax, dword [0x519008]
xor eax, esp
mov dword [esp + 0x458], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [0x51dd94]
mov dword [esp + 0x24], eax
mov eax, 0x100
mov dword [esp + 0x1c], eax
push edi
mov eax, dword [esi]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], 0
mov edx, dword [eax + 0xc]
cmp eax, vtable.rhea::AllocatorSimple_class_rhea::AllocatorTrackingPolicy_simple_.0
jne 0x451914
push 4
push pe_nt_image_headers32
call fcn.0040bee4
add dword [esi + 0x1c], 0x108
mov edi, eax
inc dword [esi + 0x18]
add esp, 8
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jbe 0x451440
mov dword [esi + 0x20], eax
mov al, byte [esi + 0x15]
mov byte [edi + 2], al
mov al, byte [esi + 0x14]
mov byte [edi + 3], al
mov dword [edi + 4], 0x8010000
add edi, 8
mov byte [edi], 0
mov eax, 0x800
mov ecx, dword [esi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0
mov eax, dword [ecx + 0xc]
cmp ecx, vtable.rhea::AllocatorSimple_class_rhea::AllocatorTrackingPolicy_simple_.0
jne 0x45192f
push 4
push 0x808
call fcn.0040bee4
add dword [esi + 0x1c], 0x808
mov ebx, eax
inc dword [esi + 0x18]
add esp, 8
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jbe 0x4514a1
mov dword [esi + 0x20], eax
mov al, byte [esi + 0x15]
mov byte [ebx + 2], al
mov al, byte [esi + 0x14]
mov byte [ebx + 3], al
mov dword [ebx + 4], 0x8080000
add ebx, 8
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea edx, [esp + 0x38]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x34], 0
call fcn.0042a220
test al, al
je 0x45169c
mov edi, edi
xor eax, eax
cmp byte [esp + 0x38], al
je 0x4514f0
inc eax
cmp byte [esp + eax + 0x38], 0
jne 0x4514e8
cmp byte [esp + eax + 0x37], 0x5c
jne 0x4514fd
dec eax
mov byte [esp + eax + 0x38], 0
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
add ecx, 3
add ecx, eax
mov dword [esp + 0x18], ecx
cmp ecx, esi
jb 0x45152e
mov eax, dword [esp + 0x20]
add esi, 0x400
push esi
push eax
push edi
push dword [esp + 0x1c]
call fcn.004512d0
mov edi, eax
mov dword [esp + 0x20], esi
xor eax, eax
test edi, edi
je 0x45153f
cmp byte [edi], al
je 0x45153f
inc eax
cmp byte [eax + edi], 0
jne 0x451538
mov edx, esi
lea ecx, [eax + edi]
push 0x50d64c
sub edx, eax
call fcn.00428880
add esp, 4
xor eax, eax
test edi, edi
je 0x451567
cmp byte [edi], al
je 0x451567
lea ecx, [ecx]
inc eax
cmp byte [eax + edi], 0
jne 0x451560
lea ecx, [esp + 0x38]
mov edx, esi
push ecx
sub edx, eax
lea ecx, [eax + edi]
call fcn.00428880
add esp, 4
xor eax, eax
test edi, edi
je 0x45158c
cmp byte [edi], al
je 0x45158c
inc eax
cmp byte [eax + edi], 0
jne 0x451585
mov edx, esi
lea ecx, [eax + edi]
push 0x50d650
sub edx, eax
call fcn.00428880
xor eax, eax
add esp, 4
cmp byte [esp + 0x58], al
je 0x4515b0
inc eax
cmp byte [esp + eax + 0x58], 0
jne 0x4515a8
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
add ecx, 3
add ecx, eax
mov dword [esp + 0x14], ecx
cmp ecx, esi
jb 0x4515e1
mov eax, dword [esp + 0x1c]
add esi, 0x400
push esi
push eax
push ebx
push dword [esp + 0x1c]
call fcn.004512d0
mov ebx, eax
mov dword [esp + 0x1c], esi
xor eax, eax
test ebx, ebx
je 0x4515f7
cmp byte [ebx], al
je 0x4515f7
jmp 0x4515f0
inc eax
cmp byte [eax + ebx], 0
jne 0x4515f0
mov edx, esi
lea ecx, [eax + ebx]
push 0x50d64c
sub edx, eax
call fcn.00428880
add esp, 4
xor eax, eax
test ebx, ebx
je 0x45161c
cmp byte [ebx], al
je 0x45161c
inc eax
cmp byte [eax + ebx], 0
jne 0x451615
lea ecx, [esp + 0x58]
mov edx, esi
push ecx
sub edx, eax
lea ecx, [eax + ebx]
call fcn.00428880
add esp, 4
xor eax, eax
test ebx, ebx
je 0x451647
cmp byte [ebx], al
je 0x451647
lea ebx, [ebx]
inc eax
cmp byte [eax + ebx], 0
jne 0x451640
mov edx, esi
lea ecx, [eax + ebx]
push 0x50d650
sub edx, eax
call fcn.00428880
add esp, 4
lea edx, [esp + 0x38]
lea ecx, [esp + 0x30]
call fcn.0042a220
test al, al
jne 0x4514e0
mov eax, dword [esp + 0x18]
cmp byte [edi + eax - 1], 0x2c
jne 0x451684
dec eax
mov dword [esp + 0x18], eax
mov byte [edi + eax], 0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [ebx + eax - 1], 0x2c
jne 0x45169c
dec eax
mov dword [esp + 0x14], eax
mov byte [ebx + eax], 0
push 0
push 0
lea eax, [esp + 0x260]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x451738
lea ecx, [esp + 0x258]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4516c2
sub ecx, edx
xor eax, eax
sar ecx, 1
je 0x4516f8
lea edx, [eax + 0x2f]
jmp 0x4516e0
cmp word [esp + eax*2 + 0x258], 0x5c
jne 0x4516f3
mov word [esp + eax*2 + 0x258], dx
inc eax
cmp eax, ecx
jb 0x4516e0
push 0
push 0
push 0x100
lea eax, [esp + 0x164]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x26c]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
or edx, 0xffffffff
lea ecx, [esp + 0x158]
call fcn.0042bb20
mov cl, byte [esp + 0x158]
jmp 0x451741
xor cl, cl
mov byte [esp + 0x158], cl
xor eax, eax
test cl, cl
je 0x45175b
jmp 0x451750
inc eax
cmp byte [esp + eax + 0x158], 0
jne 0x451750
add eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add ecx, 0x60
add ecx, eax
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
cmp eax, vtable.rhea::AllocatorSimple_class_rhea::AllocatorTrackingPolicy_simple_.0
jne 0x45194a
lea eax, [ecx + 3]
and eax, 0xfffffffc
add eax, 8
push 4
push eax
mov dword [esp + 0x24], eax
call fcn.0040bee4
mov ecx, dword [esp + 0x24]
mov edx, eax
add dword [esi + 0x1c], ecx
add esp, 8
inc dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jbe 0x4517a7
mov dword [esi + 0x20], eax
mov al, byte [esi + 0x15]
mov byte [edx + 2], al
mov al, byte [esi + 0x14]
lea esi, [edx + 8]
mov byte [edx + 3], al
mov eax, ecx
shr eax, 0x18
mov byte [edx + 4], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 5], al
mov eax, ecx
shr eax, 8
mov byte [edx + 6], al
mov byte [edx + 7], cl
lea eax, [esp + 0x158]
push eax
push ebx
push edi
push str._drivePath_:__s___driveLabel_:__s___desktop_:__s_
push esi
call fcn.00402370
add esp, 0x14
xor eax, eax
test esi, esi
je 0x4517fa
cmp byte [esi], al
je 0x4517fa
inc eax
cmp byte [eax + esi], 0
jne 0x4517f3
mov ecx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x28]
push esi
movzx eax, byte [eax + 0x18]
push eax
push dword [esp + 0x34]
call fcn.00448b80
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
cmp eax, vtable.rhea::AllocatorSimple_class_rhea::AllocatorTrackingPolicy_simple_.0
jne 0x451961
movzx ecx, byte [edi - 4]
lea edx, [edi - 8]
movzx eax, byte [edx + 5]
mov edi, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edx + 6]
dec dword [edi + 0x18]
and ecx, 0x3fffffff
shl eax, 8
or ecx, eax
sub dword [edi + 0x1c], ecx
push edx
call fcn.0040beca
add esp, 4
mov eax, dword [edi]
cmp eax, vtable.rhea::AllocatorSimple_class_rhea::AllocatorTrackingPolicy_simple_.0
jne 0x451972
movzx ecx, byte [ebx - 4]
lea edx, [ebx - 8]
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edx + 6]
dec dword [edi + 0x18]
and ecx, 0x3fffffff
shl eax, 8
or ecx, eax
sub dword [edi + 0x1c], ecx
push edx
call fcn.0040beca
add esp, 4
mov eax, dword [edi]
cmp eax, vtable.rhea::AllocatorSimple_class_rhea::AllocatorTrackingPolicy_simple_.0
jne 0x45197f
movzx ecx, byte [esi - 4]
lea edx, [esi - 8]
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edx + 6]
dec dword [edi + 0x18]
and ecx, 0x3fffffff
shl eax, 8
or ecx, eax
sub dword [edi + 0x1c], ecx
push edx
call fcn.0040beca
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0x464]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0
push 0x503d60
push 4
push 0x100
mov ecx, esi
call edx
mov edi, eax
jmp 0x451456
push 0
push 0
push 0x503d60
push 4
push 0x800
mov ecx, esi
call eax
mov ebx, eax
jmp 0x4514b7
push 0
push 0
push 0x503d60
push 4
push ecx
mov ecx, esi
call edx
mov esi, eax
jmp 0x4517d1
push 0
push edi
mov edi, dword [esp + 0x18]
mov ecx, edi
call dword [eax + 0x10]
jmp 0x45185e
push 0
push ebx
mov ecx, edi
call dword [eax + 0x10]
jmp 0x4518a2
push 0
push esi
mov ecx, edi
call dword [eax + 0x10]
jmp 0x4518fd