Function at 0x402240
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov dword [ebp - 0x3c], 0x8733
mov dword [ebp - 4], 0x10176
mov dword [ebp - 8], 0xdc0e
mov dword [ebp - 0x44], 0x6190
mov dword [ebp - 0xc], 0xb424
mov dword [ebp - 0x10], 0x10dd2
mov dword [ebp - 0x1c], 0x9e10
mov dword [ebp - 0x40], 0x3831
mov dword [ebp - 0x28], 0x16562
mov dword [ebp - 0x2c], 0x12d91
mov dword [ebp - 0x98], 0x9f24
mov dword [ebp - 0x30], 0x14250
mov dword [ebp - 0x58], 0x90a4
mov dword [ebp - 0x18], 0x17b28
mov dword [ebp - 0x34], 0x13dcb
mov dword [ebp - 0x60], 0x129df
mov dword [ebp - 0x4c], 0xe46c
mov dword [ebp - 0x80], 0x1738c
mov dword [ebp - 0x8c], 0x4d60
mov dword [ebp - 0x24], 0x7dc7
mov dword [ebp - 0xbc], 0xcf52
mov dword [ebp - 0x14], 0xebcc
mov dword [ebp - 0x20], 0x176d0
mov dword [ebp - 0x38], 0xff05
mov eax, dword [0xab1280]
cmp eax, dword [0xab15c8]
jge 0x402310
mov dword [ebp - 0x70], 1
jmp 0x402317
mov dword [ebp - 0x70], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0xcc], ecx
mov edx, dword [0xab128c]
mov dword [ebp - 0xd0], edx
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0xcc]
cmp ecx, dword [ebp - 0xd0]
jge 0x40234c
mov dword [ebp - 0x74], 1
jmp 0x402353
mov dword [ebp - 0x74], 0
mov edx, dword [ebp - 0x70]
or edx, dword [ebp - 0x74]
je 0x40242f
mov eax, dword [0xab17f4]
cmp eax, dword [0xab1290]
jne 0x40242f
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp - 0x3c]
jne 0x40242f
mov edx, dword [ebp - 0x98]
cmp edx, dword [ebp - 0x18]
jne 0x40242f
push 0xb9ba
push 0xa443
call dword [sym.imp.KERNEL32.dll_LocateXStateFeature]
add esp, 8
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x60]
jge 0x4023af
mov dword [ebp - 0x78], 1
jmp 0x4023b6
mov dword [ebp - 0x78], 0
mov ecx, dword [0xab1298]
cmp ecx, dword [0xab1638]
jge 0x4023cd
mov dword [ebp - 0x7c], 1
jmp 0x4023d4
mov dword [ebp - 0x7c], 0
mov edx, dword [ebp - 0x78]
and edx, dword [ebp - 0x80]
and edx, dword [ebp - 0x14]
or edx, dword [ebp - 0x7c]
je 0x40242f
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jne 0x40242f
mov ecx, dword [ebp - 0xbc]
cmp ecx, dword [ebp - 0x20]
jne 0x40242f
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
push 0xeec6
push 0x4a55
push 0x11991
push 0xe3f3
push 0x9e44
push 0x2fb9
push 0x14dce
push 0xa59f
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
add esp, 0x20
mov dword [ebp - 0x48], 0
jmp 0x402441
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x60]
sub ecx, 0x129de
cmp dword [ebp - 0x48], ecx
jge 0x40245a
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
jmp 0x402438
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x80]
jge 0x40246e
mov dword [ebp - 0x84], 1
jmp 0x402478
mov dword [ebp - 0x84], 0
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x30]
jge 0x40248c
mov dword [ebp - 0x88], 1
jmp 0x402496
mov dword [ebp - 0x88], 0
mov edx, dword [ebp - 0x84]
and edx, dword [ebp - 0x88]
je 0x4024f9
mov eax, dword [ebp - 0x1c]
cmp eax, dword [0xab1634]
jne 0x4024f9
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x58]
jne 0x4024f9
mov edx, dword [0xab1290]
cmp edx, dword [ebp - 0x8c]
jne 0x4024f9
mov eax, dword [0xab15c8]
imul eax, dword [ebp - 0x20]
test eax, eax
je 0x4024e1
mov ecx, dword [0xab14bc]
add ecx, 1
mov dword [0xab14bc], ecx
push 0xbe26
push 0xc7eb
push 0x10f6d
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
add esp, 0xc
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0xd4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xd4]
cmp edx, dword [ebp - 0xd8]
jge 0x40256d
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x3c]
jne 0x40256d
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [0xab1280]
jne 0x40256d
push 0x571d
push 0xa1d8
push 0x3bfd
push 0x12122
push 0x1841f
push 0x13266
push 0x5e5c
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
add esp, 0x1c
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp + 0xc]
or eax, 0xe954
xor eax, 0xeb71
mov ecx, dword [ebp + 0x10]
and ecx, 0x1645d
xor ecx, 0x2014
mov byte [ecx + str.WcrvJOa], al
mov edx, dword [ebp - 0x38]
sub edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x11ffb
push eax
mov ecx, dword [0xab1638]
sub ecx, 0x3666
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x5f12
push edx
call fcn.004136b0
add esp, 0xc
mov eax, 0xfffff574
sub eax, dword [ebp + 8]
xor eax, 0xffff9319
mov ecx, 0x7675
sub ecx, dword [ebp + 0x18]
xor ecx, 0x1eee
xor ecx, 0x22dd
mov byte [ecx + str.WcrvJOa], al
mov dword [ebp - 0x50], 0
jmp 0x4025f9
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 4]
sub eax, 0x10174
cmp dword [ebp - 0x50], eax
jge 0x402617
mov ecx, dword [0xab1638]
sub ecx, 1
mov dword [0xab1638], ecx
jmp 0x4025f0
mov edx, dword [0xab1294]
imul edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x24]
jge 0x402632
mov dword [ebp - 0x90], 1
jmp 0x40263c
mov dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [0xab1288]
jge 0x402653
mov dword [ebp - 0x94], 1
jmp 0x40265d
mov dword [ebp - 0x94], 0
mov ecx, dword [ebp - 0x90]
and ecx, dword [ebp - 0x94]
je 0x4027fb
mov edx, dword [0xab1634]
add edx, 1
mov dword [0xab1634], edx
mov eax, dword [0xab1634]
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xe0]
jge 0x4026b5
mov dword [ebp - 0x9c], 1
jmp 0x4026bf
mov dword [ebp - 0x9c], 0
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0xc]
jge 0x4026d3
mov dword [ebp - 0xa0], 1
jmp 0x4026dd
mov dword [ebp - 0xa0], 0
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x98]
and edx, dword [ebp - 0x9c]
or edx, dword [ebp - 0xa0]
je 0x4027fb
mov eax, dword [ebp - 4]
cmp eax, dword [0xab1280]
jne 0x4027fb
mov ecx, dword [0xab15c8]
cmp ecx, dword [0xab1280]
jne 0x4027fb
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 8]
jne 0x4027fb
push 0x17c37
push 0xf2ce
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
add esp, 8
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
jge 0x40274c
mov dword [ebp - 0xa4], 1
jmp 0x402756
mov dword [ebp - 0xa4], 0
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x1c]
jge 0x402773
mov dword [ebp - 0xa8], 1
jmp 0x40277d
mov dword [ebp - 0xa8], 0
mov eax, dword [0xab1288]
imul eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x40]
jge 0x402797
mov dword [ebp - 0xac], 1
jmp 0x4027a1
mov dword [ebp - 0xac], 0
mov ecx, dword [ebp - 0xa4]
and ecx, dword [ebp - 0xa8]
and ecx, dword [ebp - 0xac]
je 0x4027fb
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jge 0x4027d6
mov dword [ebp - 0xb0], 1
jmp 0x4027e0
mov dword [ebp - 0xb0], 0
mov ecx, dword [0xab1294]
imul ecx, dword [ebp - 0xc]
and ecx, dword [ebp - 0xb0]
je 0x4027fb
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [0xab128c]
jge 0x402812
mov dword [ebp - 0xb4], 1
jmp 0x40281c
mov dword [ebp - 0xb4], 0
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x34]
jge 0x402839
mov dword [ebp - 0xb8], 1
jmp 0x402843
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xb4]
and eax, dword [ebp - 0xb8]
je 0x4028a1
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x28]
jne 0x4028a1
mov edx, dword [0xab1294]
cmp edx, dword [ebp - 0x14]
jne 0x4028a1
mov eax, dword [0xab15c4]
cmp eax, dword [0xab15c8]
jne 0x4028a1
push 0x3dee
push 0xa4c4
push 0xabe8
push 0xeeeb
push 0x118ec
push 0xa743
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
add esp, 0x18
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0x24]
or edx, 0x94cf
sub edx, 0x41a7
xor edx, 0xb670
mov eax, dword [ebp + 0x20]
and eax, 0x931c
xor eax, 0x1305
mov byte [eax + str.WcrvJOa], dl
mov ecx, dword [ebp - 4]
sub ecx, 0x791d
push ecx
mov edx, dword [ebp - 4]
sub edx, 0x86ad
push edx
mov eax, dword [0xab1288]
add eax, 0xcf52
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x3d8f
push ecx
mov edx, dword [0xab1638]
add edx, 0x207
push edx
mov eax, dword [0xab17f4]
add eax, 0x1792
push eax
call fcn.0040b260
add esp, 0x18
mov ecx, dword [ebp + 0x24]
xor ecx, 0xa2ae
xor ecx, 0xd58e
xor ecx, 0x84cd
mov edx, dword [ebp + 0x10]
or edx, 0x19da
and edx, 0xafb2
and edx, 0x1a5b
xor edx, 0xa10
mov byte [edx + str.WcrvJOa], cl
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x54], 0
jmp 0x402963
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0xff03
cmp dword [ebp - 0x54], edx
jge 0x402a2f
mov eax, dword [0xab1280]
cmp eax, dword [ebp - 0xbc]
jge 0x40298e
mov dword [ebp - 0xc0], 1
jmp 0x402998
mov dword [ebp - 0xc0], 0
mov ecx, dword [0xab15c4]
mov dword [ebp - 0xe4], ecx
mov edx, dword [0xab1284]
mov dword [ebp - 0xe8], edx
mov eax, dword [0xab1284]
add eax, 1
mov dword [0xab1284], eax
mov ecx, dword [ebp - 0xe4]
cmp ecx, dword [ebp - 0xe8]
jge 0x4029d7
mov dword [ebp - 0xc4], 1
jmp 0x4029e1
mov dword [ebp - 0xc4], 0
mov edx, dword [0xab1294]
and edx, dword [ebp - 0xc0]
and edx, dword [ebp - 0xc4]
je 0x402a2a
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
jge 0x402a09
mov dword [ebp - 0xc8], 1
jmp 0x402a13
mov dword [ebp - 0xc8], 0
mov ecx, dword [0xab1290]
and ecx, dword [ebp - 0xc8]
je 0x402a2a
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
jmp 0x40295a
mov eax, dword [ebp + 0x1c]
xor eax, 0xd39f
xor eax, 0x2c82
mov ecx, dword [ebp + 8]
xor ecx, 0x381d
xor ecx, 0x59b6
mov byte [ecx + str.WcrvJOa], al
mov dword [ebp - 0x5c], 0
jmp 0x402a63
mov edx, dword [ebp - 0x5c]
add edx, 1
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x58]
sub eax, 0x90a3
cmp dword [ebp - 0x5c], eax
jge 0x402a7b
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x402a5a
mov edx, dword [ebp - 0x60]
sub edx, 0x98ea
push edx
call fcn.00411db0
add esp, 4
mov eax, 0x420e
sub eax, dword [ebp + 0x10]
xor eax, 0xffff8efe
mov ecx, dword [ebp + 0x10]
and ecx, 0x2952
xor ecx, 0x2114
mov byte [ecx + str.WcrvJOa], al
mov dword [ebp - 0x64], 0
jmp 0x402ac1
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x44]
sub eax, 0x6190
cmp dword [ebp - 0x64], eax
jge 0x402b55
mov ecx, dword [ebp - 0x10]
add ecx, dword [0xab15c4]
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xec], 0
je 0x402b50
mov eax, dword [ebp - 0x3c]
cmp eax, dword [0xab17f4]
jne 0x402b50
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jne 0x402b50
mov edx, dword [ebp - 0x1c]
cmp edx, dword [0xab1634]
jne 0x402b50
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
push 0xc197
push 0x15218
push 0x15fa2
push 0x878
push 0x10ec0
push 0x1357b
push 0x144c4
push 0xb42d
push 0x13d55
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
add esp, 0x24
jmp 0x402ab8
call fcn.00403b80
mov ecx, dword [ebp + 0x10]
and ecx, 0x3f90
or ecx, 0xb8eb
xor ecx, 0xbbb2
mov edx, dword [ebp + 0x24]
and edx, 0x31f1
xor edx, 0x31f2
mov byte [edx + str.WcrvJOa], cl
mov dword [ebp - 0x68], 0
jmp 0x402b96
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x17b25
cmp dword [ebp - 0x68], ecx
jge 0x402bfb
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x40]
jge 0x402bf9
mov eax, dword [0xab128c]
cmp eax, dword [ebp - 0x10]
jne 0x402bf9
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x14]
jne 0x402bf9
push 0xaf43
push 0x12d6e
push 0x78c5
push 0xe266
push 0x3409
push 0x7775
push 0x2635
call dword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
add esp, 0x1c
mov edx, dword [0xab15c4]
add edx, 1
mov dword [0xab15c4], edx
jmp 0x402b8d
mov eax, str.WcrvJOa
jmp 0x402c4d
mov esp, ebp
pop ebp
ret