Function at 0x4aeac0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x230], ecx
xor esi, esi
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x218], 0x410
mov dword [ebp - 0x214], 0x400
mov dword [ebp - 0x210], 0x1000
test edi, edi
jne 0x4aeb9c
push edx
push edi
push dword [ebp + esi*4 - 0x218]
call ebx
mov edx, dword [ebp - 0x22c]
inc esi
mov edi, eax
cmp esi, 3
jb 0x4aeb13
test edi, edi
jne 0x4aeb9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x230]
push eax
call fcn.004af720
mov ecx, eax
call fcn.004af870
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x230]
call fcn.004af720
push str.cant_open_proc:
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
push dword [ebp - 0x22c]
push 0x561dc0
push esi
call fcn.004ad730
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
push 0x208
call fcn.004eec3a
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 4
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x228], 0
push str.psapi.dll
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4aebf6
push str.GetModuleFileNameExW
push eax
call esi
test eax, eax
je 0x4aebf6
push 0x104
push dword [ebp - 0x21c]
push 0
push edi
call eax
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x4aec61
push str.psapi.dll
call ebx
test eax, eax
je 0x4aec25
push str.GetProcessImageFileNameW
push eax
call esi
test eax, eax
je 0x4aec25
push 0x104
push dword [ebp - 0x21c]
push edi
call eax
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x4aec61
push str.QueryFullProcessImageNameW
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0x104
test eax, eax
je 0x4aec67
lea ecx, [ebp - 0x220]
push ecx
push esi
push 0
push edi
call eax
mov dword [ebp - 0x228], eax
jmp 0x4aec67
mov esi, dword [ebp - 0x21c]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x224]
push 0x105
lea ebx, [edi + 8]
mov dword [edi + 0x120], 0x105
mov ecx, ebx
call fcn.004ada80
cmp byte [ebx + 0x114], 0
lea eax, [ebx + 4]
jne 0x4aec9b
mov eax, dword [ebx]
add eax, 4
cmp word [esi], 0x5c
mov dword [ebp - 0x234], eax
je 0x4aecbe
push esi
push 0x104
push eax
call fcn.004f3967
add esp, 0xc
jmp 0x4aee28
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov esi, eax
test esi, esi
je 0x4aee1c
lea ecx, [esi*2 + 2]
push ecx
call fcn.004eec3a
add esp, 4
mov dword [ebp - 0x220], eax
lea ecx, [esi + 1]
push eax
push ecx
call edi
cmp eax, esi
ja 0x4aee0e
test eax, eax
je 0x4aee0e
mov eax, dword [0x562074]
mov edi, dword [ebp - 0x220]
mov dword [ebp - 0x214], eax
mov ax, word [0x562078]
push 0x208
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e5200
add esp, 0xc
nop word [eax + eax]
mov ax, word [edi]
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4aeda1
lea esi, [ebp - 0x20c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4aed70
sub esi, ecx
sar esi, 1
cmp esi, 0x104
jae 0x4aeda1
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
call fcn.004f9a9a
add esp, 0xc
test eax, eax
je 0x4aede0
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4aeda6
sub ecx, edx
sar ecx, 1
je 0x4aee0e
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4aedc0
sub ecx, edx
sar ecx, 1
lea edi, [edi + ecx*2]
add edi, 2
cmp word [edi], ax
jne 0x4aed40
jmp 0x4aee0e
mov eax, dword [ebp - 0x21c]
lea eax, [eax + esi*2]
push eax
lea eax, [ebp - 0x214]
push eax
push str._s_s
push 0x103
push 0x104
push dword [ebp - 0x234]
call fcn.004adb30
add esp, 0x18
push dword [ebp - 0x220]
call fcn.004e4a56
add esp, 4
mov esi, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x224]
mov ecx, edi
call fcn.004ad500
test al, al
je 0x4aee76
mov cl, byte [ebx + 0x114]
lea eax, [ebx + 4]
test cl, cl
jne 0x4aee42
mov eax, dword [ebx]
cmp word [eax + 4], 0x22
jne 0x4aee76
mov eax, dword [edi + 4]
cmp eax, 2
jl 0x4aee76
test cl, cl
lea ecx, [ebx + 4]
jne 0x4aee5a
mov ecx, dword [ebx]
cmp word [ecx + eax*2 + 2], 0x22
jne 0x4aee76
dec eax
mov ecx, edi
push eax
call fcn.004ad5c0
push 1
push 0
mov ecx, edi
call fcn.004ad600
push esi
call fcn.004e4a56
add esp, 4
cmp dword [ebp - 0x228], 0
jne 0x4aeeed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x230]
push eax
call fcn.004af720
mov ecx, eax
call fcn.004af870
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x230]
call fcn.004af720
push str.cant_get_proc_name:
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
push dword [ebp - 0x22c]
push 0x561dc0
push esi
call fcn.004ad730
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e24d7
mov esp, ebp
pop ebp
ret