Function at 0x4435f0
Capabilities:
Enumerate disk volumes
Enumerate process modules
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448e87
mov eax, dword fs:[0]
push eax
mov eax, 0x1950
call fcn.0043e270
mov eax, dword [0x4594d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x234]
call fcn.00408180
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x443655
xor eax, eax
jmp 0x443bab
movzx ecx, byte [ebp + 0x23c]
test ecx, ecx
je 0x443ad6
push 0x20a
push 0
lea edx, [ebp - 0x224]
push edx
call fcn.0042d120
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x443ad6
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x234]
push eax
lea eax, [ebp - 0x224]
call fcn.00405060
mov ecx, dword [ebp + 0x234]
push ecx
call fcn.004426e0
add esp, 4
lea edx, [ebp - 0x644]
push edx
mov ecx, dword [ebp + 0x238]
call fcn.00410910
jmp 0x4436ea
push 0
lea eax, [ebp - 0x18cc]
push eax
lea ecx, [ebp - 0x644]
call fcn.00410a70
lea ecx, [ebp - 0x18d4]
push ecx
mov ecx, dword [ebp + 0x238]
call fcn.00410940
push eax
lea ecx, [ebp - 0x644]
call fcn.00410ab0
movzx edx, al
test edx, edx
je 0x44379f
lea ecx, [ebp - 0x644]
call fcn.00410a50
call fcn.00405170
push eax
lea ecx, [ebp - 0x644]
call fcn.00410a50
call fcn.00405160
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0042d63f
add esp, 0xc
test eax, eax
jne 0x44379a
lea ecx, [ebp - 0x644]
call fcn.00410a50
call fcn.00405170
xor ebx, ebx
mov esi, dword [ebp + 0x234]
call fcn.004050d0
lea ecx, [ebp - 0x644]
call fcn.00410a50
add eax, 0x1c
push eax
push 0
mov ecx, dword [ebp + 0x234]
call fcn.00410820
mov ecx, dword [ebp + 0x234]
push ecx
call fcn.004426e0
add esp, 4
mov eax, 1
jmp 0x443bab
jmp 0x4436d6
push 0x208
push 0
lea edx, [ebp - 0x42c]
push edx
call fcn.0042d120
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x63c]
push eax
call fcn.0042d120
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0xffffffff
je 0x4439f9
mov ecx, dword [ebp + 0x238]
call fcn.004109f0
mov dword [ebp - 0x648], 0
lea edx, [ebp - 0x648]
push edx
push 0
push 0
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
cmp dword [ebp - 0x648], 0
jbe 0x4439cb
xor ecx, ecx
mov eax, dword [ebp - 0x648]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042bbab
add esp, 4
mov dword [ebp - 0x18d8], eax
mov eax, dword [ebp - 0x18d8]
mov dword [ebp - 0x64c], eax
lea ecx, [ebp - 0x648]
push ecx
mov edx, dword [ebp - 0x648]
push edx
mov eax, dword [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x4439b0
mov dword [ebp - 0x650], 0
mov edx, dword [ebp - 0x648]
sub edx, 1
cmp dword [ebp - 0x650], edx
jae 0x4439b0
mov eax, dword [ebp - 0x650]
mov ecx, dword [ebp - 0x64c]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x66c]
call fcn.00404fe0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x66c]
call fcn.00405170
mov edx, dword [ebp - 0x650]
lea eax, [edx + eax + 1]
mov dword [ebp - 0x650], eax
lea eax, [ebp - 0x66c]
call fcn.00405170
sub eax, 1
push eax
lea ecx, [ebp - 0x66c]
call fcn.00410850
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x443924
lea eax, [ebp - 0x66c]
call fcn.00405170
mov edx, eax
sub edx, 1
mov eax, dword [0x44de98]
mov ebx, edx
lea esi, [ebp - 0x66c]
call fcn.004050d0
push 0x104
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x66c]
call fcn.00405160
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x443999
lea ecx, [ebp - 0x6a4]
call fcn.004107c0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x66c]
lea ecx, [ebp - 0x688]
call fcn.00405050
lea ecx, [ebp - 0x6a4]
push ecx
lea eax, [ebp - 0x63c]
call fcn.00405060
lea edx, [ebp - 0x6a4]
push edx
mov ecx, dword [ebp + 0x238]
call fcn.00410970
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6a4]
call fcn.004107f0
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x66c]
call fcn.00401380
jmp 0x44388f
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
push ecx
call fcn.0042bd0e
add esp, 4
push 0x104
lea edx, [ebp - 0x42c]
push edx
mov eax, dword [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x4437fb
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
lea edx, [ebp - 0x6ac]
push edx
mov ecx, dword [ebp + 0x238]
call fcn.00410910
jmp 0x443a21
push 0
lea eax, [ebp - 0x18e4]
push eax
lea ecx, [ebp - 0x6ac]
call fcn.00410a70
lea ecx, [ebp - 0x18ec]
push ecx
mov ecx, dword [ebp + 0x238]
call fcn.00410940
push eax
lea ecx, [ebp - 0x6ac]
call fcn.00410ab0
movzx edx, al
test edx, edx
je 0x443ad6
lea ecx, [ebp - 0x6ac]
call fcn.00410a50
call fcn.00405170
push eax
lea ecx, [ebp - 0x6ac]
call fcn.00410a50
call fcn.00405160
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0042d63f
add esp, 0xc
test eax, eax
jne 0x443ad1
lea ecx, [ebp - 0x6ac]
call fcn.00410a50
call fcn.00405170
xor ebx, ebx
mov esi, dword [ebp + 0x234]
call fcn.004050d0
lea ecx, [ebp - 0x6ac]
call fcn.00410a50
add eax, 0x1c
push eax
push 0
mov ecx, dword [ebp + 0x234]
call fcn.00410820
mov ecx, dword [ebp + 0x234]
push ecx
call fcn.004426e0
add esp, 4
mov eax, 1
jmp 0x443bab
jmp 0x443a0d
push 0x1000
push 0
lea edx, [ebp - 0x16b4]
push edx
call fcn.0042d120
add esp, 0xc
mov dword [ebp - 0x6b0], 0
lea eax, [ebp - 0x6b0]
push eax
push 0x1000
lea ecx, [ebp - 0x16b4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x443b9f
mov eax, dword [ebp - 0x6b0]
shr eax, 2
cmp eax, 1
jb 0x443b9f
push 0x20a
push 0
lea ecx, [ebp - 0x18c4]
push ecx
call fcn.0042d120
add esp, 0xc
push 0x104
lea edx, [ebp - 0x18c4]
push edx
mov eax, dword [ebp - 0x16b4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x443b9f
mov edx, dword [ebp + 0x234]
push edx
lea eax, [ebp - 0x18c4]
call fcn.00405060
mov eax, dword [ebp + 0x234]
push eax
call fcn.004426e0
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x234]
push edx
call fcn.004426e0
add esp, 4
mov eax, 1
jmp 0x443bab
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bbc1
mov esp, ebp
pop ebp
ret