Function at 0x413db2
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x1ac
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push 0x10000
push 8
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x134], 0x5c3a41
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
mov dword [ebp - 0x138], eax
cmp eax, ecx
je 0x414101
push esi
push edi
lea edi, [eax + 0x104]
mov dword [ebp - 0x12c], edi
mov esi, 0x400
add edi, esi
mov dword [ebp - 0x100], edi
mov eax, 0x800
add edi, eax
mov dword [ebp - 0xfc], edi
add edi, eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x120], edi
add edi, 0x1000
mov dword [ebp - 0x11c], edi
add edi, esi
mov dword [ebp + 0x6c], eax
lea eax, [ebp + 0x68]
mov dword [ebp - 0x128], edi
push eax
push dword [ebx + 0xc]
add edi, esi
mov dword [ebp - 0x130], edi
add edi, esi
mov byte [ebp - 0xe0], cl
mov byte [ebp - 0xa0], cl
mov byte [ebp - 0x20], cl
mov dword [ebp + 0x64], ecx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x68], ecx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x413e88
lea eax, [ebp + 0x68]
push eax
call fcn.004012a0
pop ecx
call fcn.00406ca2
cmp byte [ebx + 0x15], 0
mov eax, dword [0x49cb5c]
jne 0x413e9d
mov eax, dword [0x49cb88]
push dword [ebx + 0x128]
push eax
push dword [ebp - 0x12c]
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebx + 0xba4]
mov dword [ebp + 0x60], eax
xor eax, eax
add esp, 0xc
cmp ax, word [ebx + 0x194]
jne 0x413f24
push dword [ebx + 0x16c]
push eax
push 0x100418
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x124], eax
test eax, eax
je 0x413f08
push 0x104
lea eax, [ebx + 0x194]
push eax
push 0
push dword [ebp - 0x124]
call sub.PSAPI.DLL_GetModuleFileNameExW
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebx + 0x3a0]
xor eax, eax
cmp ax, word [ecx]
jne 0x413f24
lea eax, [ebx + 0x194]
push eax
push ecx
call fcn.0046e0b5
pop ecx
pop ecx
cmp dword [ebx + 0x39c], 0x454c4946
jne 0x413f56
mov ecx, dword [ebp - 0x120]
lea esi, [ebx + 0x3a0]
call fcn.00413502
mov eax, dword [ebp - 0x120]
mov al, byte [eax]
mov byte [ebp - 0x134], al
mov esi, 0x400
jmp 0x413f62
lea eax, [ebx + 0x3a0]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x11c]
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x120]
mov byte [eax], 0
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x413f9a
push esi
push dword [ebp - 0x120]
push dword [ebp - 0x11c]
call fcn.0046fe9f
add esp, 0xc
mov ecx, dword [ebp - 0x130]
mov eax, dword [ebp - 0x128]
push ecx
mov byte [eax], 0
push eax
mov byte [ecx], 0
push dword [ebx + 0xc]
call fcn.0041266c
lea esi, [edi + 0x400]
push esi
push edi
push dword [ebp - 0x128]
mov byte [edi], 0
mov byte [esi], 0
call fcn.004125e4
mov eax, dword [ebx + 0x39c]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xf0], eax
add esp, 0x18
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0x114], ebx
mov byte [ebp - 0xf7], 0
mov byte [ebp - 0xf8], 0
mov dword [ebp - 0xec], edi
mov dword [ebp - 0xe8], esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp dword [ebx + 0x39c], 0x454c4946
mov dword [ebp - 0xe4], eax
jne 0x4140a8
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0x11c]
call fcn.0041258c
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x11c]
call fcn.00407b51
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x11c]
call fcn.00407b85
add esp, 0x18
test byte [ebp + 0x60], 2
je 0x4140a8
lea eax, [ebp - 0x118]
push eax
call fcn.004156c4
pop ecx
cmp byte [ebx + 0x14], 0
je 0x4140be
lea esi, [ebp - 0x118]
call fcn.00413d02
cmp eax, 0x70
je 0x4140ea
cmp byte [0x49c17d], 0
je 0x4140d4
lea eax, [ebp - 0x118]
push eax
call fcn.00415057
pop ecx
cmp dword [0x49c194], 0
je 0x4140ea
lea eax, [ebp - 0x118]
push eax
call fcn.00415af9
pop ecx
push dword [ebp - 0x138]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
push ebx
call fcn.00411f08
pop ecx
mov ecx, dword [ebp + 0x70]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.0046c1d2
add ebp, 0x74
leave
ret