Function at 0x101d744
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x10253c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x650], ebx
mov eax, dword [0x1025318]
mov esi, 0x1003ad4
cmp eax, 0x1025318
je 0x101d78e
test dword [eax + 0x1c], 0x20000000
je 0x101d78e
push ebx
push esi
push 0x38
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101b886
push 1
push 0x6a1
push 0x1003e30
lea ecx, [ebp - 0x648]
call fcn.0101a2a6
xor edi, edi
mov dword [ebp - 0x620], edi
mov dword [ebp - 0x624], edi
mov dword [ebp - 0x654], edi
cmp ebx, edi
je 0x101d823
mov eax, 0x6b0
mov word [ebp - 0x644], ax
lea eax, [ebp - 0x620]
push eax
mov dword [ebx], edi
mov dword [ebp - 0x648], edi
call fcn.0101d654
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6b2
jl 0x101d832
mov word [ebp - 0x644], ax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0x64c], eax
cmp eax, 0xffffffff
jne 0x101d83e
call fcn.0101df05
mov dword [ebp - 0x648], eax
mov eax, 0x6b5
jmp 0x101d832
mov dword [ebp - 0x648], 0x80070057
mov eax, 0x6b0
mov word [ebp - 0x642], ax
jmp 0x101dba4
and dword [ebp - 0x648], edi
mov eax, 0x6b5
mov word [ebp - 0x644], ax
mov eax, dword [0x1025318]
cmp eax, 0x1025318
je 0x101d87a
test dword [eax + 0x1c], 0x8000000
je 0x101d87a
lea ecx, [ebp - 0x20c]
push ecx
push esi
push 0x39
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101a71e
lea eax, [ebp - 0x20c]
push eax
call fcn.0101baec
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x648], eax
jl 0x101db62
mov edx, 0x6bb
mov word [ebp - 0x644], dx
jne 0x101db29
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x101d917
mov eax, dword [0x1025318]
cmp eax, 0x1025318
je 0x101db29
test dword [eax + 0x1c], 0x2000000
je 0x101db29
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101d8f7
and eax, 0xffff
or eax, 0x80070000
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x3a
mov eax, dword [0x1025318]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101a78b
jmp 0x101db29
lea eax, [ebp - 0x654]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x101d975
mov eax, dword [0x1025318]
cmp eax, 0x1025318
je 0x101db29
test dword [eax + 0x1c], 0x2000000
je 0x101db29
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101d968
and eax, 0xffff
or eax, 0x80070000
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x3b
jmp 0x101d902
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101c564
test eax, eax
jge 0x101d9c2
mov ecx, dword [0x1025318]
cmp ecx, 0x1025318
je 0x101db29
test dword [ecx + 0x1c], 0x2000000
je 0x101db29
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x3c
push dword [ecx + 0x14]
push dword [ecx + 0x10]
jmp 0x101d90d
mov eax, edi
test edi, edi
je 0x101d9d6
xor edi, edi
push eax
mov dword [ebp - 0x624], edi
call fcn.010112c6
mov eax, edi
test edi, edi
je 0x101d9e9
and dword [ebp - 0x624], 0
push eax
call fcn.010112c6
lea eax, [ebp - 0x624]
push eax
call fcn.0101d0b1
mov edi, dword [ebp - 0x624]
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6d2
jl 0x101db67
lea ecx, [edi + 4]
lea edx, [ebp - 0x20c]
mov word [ebp - 0x644], ax
call fcn.010223b2
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6d3
jl 0x101db67
lea ecx, [edi + 0x1c]
lea edx, [ebp - 0x61c]
mov word [ebp - 0x644], ax
call fcn.010223b2
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6d4
jl 0x101db67
lea ecx, [edi + 0x10]
lea edx, [ebp - 0x414]
mov word [ebp - 0x644], ax
call fcn.010223b2
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6d5
jl 0x101db67
mov word [ebp - 0x644], ax
lea eax, [edi + 0x2c]
push eax
lea eax, [edi + 0x28]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101be5e
test eax, eax
jge 0x101dacc
mov ecx, dword [0x1025318]
cmp ecx, 0x1025318
je 0x101db29
test dword [ecx + 0x1c], 0x2000000
je 0x101db29
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x3d
jmp 0x101d9b7
lea eax, [edi + 0x30]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101c2ae
test eax, eax
jge 0x101db07
mov ecx, dword [0x1025318]
cmp ecx, 0x1025318
je 0x101db29
test dword [ecx + 0x1c], 0x2000000
je 0x101db29
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x3e
jmp 0x101d9b7
push edi
push dword [ebp - 0x620]
call fcn.0101d025
mov dword [ebp - 0x648], eax
test eax, eax
mov eax, 0x6e5
jl 0x101db67
mov word [ebp - 0x644], ax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x101d850
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x101db70
call fcn.0101df05
mov dword [ebp - 0x648], eax
mov eax, 0x6f1
jmp 0x101db67
mov eax, 0x6bb
mov word [ebp - 0x642], ax
jmp 0x101db98
mov ecx, dword [ebp - 0x650]
and dword [ebp - 0x648], 0
mov eax, 0x6f1
mov word [ebp - 0x644], ax
mov eax, dword [ebp - 0x620]
and dword [ebp - 0x620], 0
mov dword [ecx], eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov esi, dword [ebp - 0x648]
test edi, edi
je 0x101dbb4
push edi
call fcn.010112c6
cmp dword [ebp - 0x620], 0
je 0x101dbc8
push dword [ebp - 0x620]
call fcn.0100afa7
lea ecx, [ebp - 0x648]
call fcn.0101a57c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01019b13
leave
ret 4