Function at 0x1002af9
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x1008010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4b0], esi
mov dword [ebp - 0x4c0], esi
call fcn.01006c7f
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0x4b0]
push eax
call sub.VSSAPI.DLL_CreateVssBackupComponentsInternal
test eax, eax
jl 0x1002d72
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x8c]
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [eax]
lea edx, [ebp - 0x4c0]
push edx
push 3
push 1
sub esp, 0x10
mov ebx, 0x1001788
mov edi, esp
mov esi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0xac]
xor edx, edx
cmp eax, edx
jl 0x1002d66
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x1002d66
mov esi, ebx
lea edi, [ebp - 0x424]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x414], ax
push edx
lea eax, [ebp - 0x412]
push eax
mov dword [ebp - 0x4b8], edx
mov dword [ebp - 0x4b4], edx
mov dword [ebp - 0x4bc], ecx
call sub.msvcrt.dll_memset
xor eax, eax
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
add esp, 0x18
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x4c4]
call esi
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call esi
jmp 0x1002d4d
mov eax, dword [ebp - 0x4c0]
mov ecx, dword [eax]
lea edx, [ebp - 0x4bc]
push edx
lea edx, [ebp - 0x4ac]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1002d4d
cmp dword [ebp - 0x4bc], 0
je 0x1002d5a
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x47c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1002d41
mov eax, dword [ebp - 0x4b8]
or eax, dword [ebp - 0x4b4]
mov eax, dword [ebp - 0x454]
jne 0x1002cb2
lea esi, [ebp - 0x4a4]
lea edi, [ebp - 0x424]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x4b4], eax
movsd dword es:[edi], dword [esi]
jmp 0x1002d41
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [ebp - 0x4b4]
jg 0x1002cd2
jl 0x1002cca
cmp eax, dword [ebp - 0x4b8]
ja 0x1002cd2
lea edi, [ebp - 0x434]
jmp 0x1002cf4
lea esi, [ebp - 0x424]
lea edi, [ebp - 0x434]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4b4], ecx
lea edi, [ebp - 0x424]
lea esi, [ebp - 0x4a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x4b0]
and dword [ebp - 0x4c4], 0
mov esi, ebx
lea edi, [ebp - 0x444]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x444]
push edx
lea edx, [ebp - 0x4c4]
push edx
push 0
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push 3
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x434]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x9c]
lea eax, [ebp - 0x4a4]
push eax
call sub.VSSAPI.DLL_VssFreeSnapshotPropertiesInternal
cmp dword [ebp - 0x4bc], 0
jne 0x1002c29
mov eax, dword [ebp - 0x4c0]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x4c8]
call fcn.01006cba
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100663c
leave
ret 4