Function at 0x4517d2
Capabilities:
Enumerate disk volumes
Enumerate process modules
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c0], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x4f0], edi
test eax, eax
jne 0x451836
push eax
push eax
push 0x8e
push str.....CodeWin32ECProcessFinder.cpp
lea eax, [ebp - 0x450]
push 0x4aa638
push eax
call fcn.00407126
add esp, 0x14
mov ecx, edi
push eax
call fcn.0043630b
lea ecx, [ebp - 0x450]
call fcn.0043634f
mov eax, edi
jmp 0x4521cd
push ebx
xor ebx, ebx
lea eax, [ebp - 0x4dc]
push ebx
push eax
lea eax, [ebp - 0x4b8]
mov dword [ebp - 0x4b8], ebx
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 0x4dc], ebx
push eax
call fcn.004516aa
add esp, 0xc
lea ecx, [ebp - 0x43c]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x450]
call fcn.0043634f
lea ecx, [ebp - 0x43c]
call fcn.0043fe40
cmp eax, 0x7d1
jl 0x4518df
push ebx
push ebx
push 0x93
push str.....CodeWin32ECProcessFinder.cpp
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.004069d9
add esp, 0x14
mov ecx, edi
push eax
call fcn.0043630b
lea ecx, [ebp - 0x450]
call fcn.0043634f
lea ecx, [ebp - 0x43c]
call fcn.0043634f
push dword [ebp - 0x4b8]
call fcn.0046b1fd
pop ecx
mov eax, edi
jmp 0x4521cc
push esi
lea ecx, [ebp - 0x43c]
call fcn.0043634f
push 0x4a4694
lea ecx, [ebp - 0x4d4]
call fcn.004362eb
mov edi, dword [ebp - 0x4b8]
mov eax, ebx
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4dc], eax
jbe 0x4521a0
cmp byte [ebp + 0x10], 0
mov esi, dword [edi + eax*4]
mov dword [ebp - 0x4b8], esi
je 0x45193b
lea eax, [ebp - 0x4d4]
push eax
push esi
call fcn.00452592
pop ecx
pop ecx
test al, al
je 0x452153
lea ecx, [ebp - 0x428]
call fcn.00438a1f
push 1
call fcn.00445252
pop ecx
test al, al
je 0x451ab9
push esi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
jne 0x451989
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push 0x4a85dc
push eax
call fcn.004515f6
add esp, 0xc
push ebx
jmp 0x452142
call fcn.004525f1
mov dword [ebp - 0x4bc], eax
cmp byte [eax + 0x18], 0
jne 0x4519b9
push dword [ebp - 0x4b8]
push str.CKernel32_Dll_VistaOrLater::load
lea eax, [ebp - 0x4d4]
push eax
call fcn.004515f6
add esp, 0xc
jmp 0x45213c
lea eax, [ebp - 0x4e8]
mov ecx, 0x104
push eax
mov dword [ebp - 0x4e8], ecx
push ecx
lea ecx, [ebp - 0x428]
call fcn.0043ad6d
push eax
mov eax, dword [ebp - 0x4bc]
push ebx
push esi
call dword [eax + 0x34]
push 0xffffffffffffffff
lea ecx, [ebp - 0x428]
mov ebx, eax
call fcn.0043b06d
test ebx, ebx
jne 0x451a03
push dword [ebp - 0x4b8]
push str.QueryFullProcessImageName
jmp 0x4519a5
mov ebx, dword [ebp - 0x4c0]
lea ecx, [ebp - 0x428]
push 0
push dword [ebp - 0x4b8]
mov ebx, dword [ebx]
call fcn.0043fcdc
push eax
push 0xffffffffffffffff
push 0
push 0x4a3e38
lea ecx, [ebp - 0x428]
call fcn.0043a3b9
inc eax
lea ecx, [ebp - 0x428]
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.0043b6bf
mov ecx, eax
call fcn.0043fcdc
mov ecx, dword [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x450]
push eax
call dword [ebx]
push eax
lea ecx, [ebp - 0x43c]
call fcn.0043630b
lea ecx, [ebp - 0x450]
call fcn.0043634f
lea ecx, [ebp - 0x4b4]
call fcn.00438cda
cmp dword [ebp - 0x430], 0x7de
lea ecx, [ebp - 0x43c]
jne 0x452137
call fcn.0043634f
cmp esi, 0xffffffff
je 0x451aa7
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x428]
call fcn.00438cda
xor ebx, ebx
jmp 0x4521a0
push ebx
call fcn.004451c7
pop ecx
test al, al
je 0x451fff
call fcn.00445340
test al, al
je 0x451fff
push esi
push ebx
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x451969
call fcn.00452617
mov dword [ebp - 0x4bc], eax
cmp byte [eax + 0x18], 0
jne 0x451b0d
push dword [ebp - 0x4b8]
push str.CPSAPI_Dll_XPOrLater::load
jmp 0x4519a5
mov eax, 0x104
lea ecx, [ebp - 0x428]
push eax
push eax
call fcn.0043ad6d
push eax
mov eax, dword [ebp - 0x4bc]
push esi
call dword [eax + 0x34]
push 0xffffffffffffffff
lea ecx, [ebp - 0x428]
call fcn.0043b06d
push str.Device_
lea ecx, [ebp - 0x43c]
call fcn.004389d2
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x428]
call fcn.0043b602
cmp eax, 0x3e9
jne 0x451f62
lea ecx, [ebp - 0x43c]
call fcn.0043b037
push eax
push 0x4a3e38
lea ecx, [ebp - 0x428]
call fcn.0043a3b0
push eax
push ebx
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x428]
call fcn.0043b6bf
lea ecx, [ebp - 0x4a0]
call fcn.0043ae73
cmp eax, 0x3e9
jne 0x451bdb
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push str.GetProcessImageFileName
push eax
call fcn.004515f6
add esp, 0xc
lea ecx, [ebp - 0x4a0]
call fcn.00438cda
lea ecx, [ebp - 0x43c]
call fcn.00438cda
jmp 0x45213c
lea ecx, [ebp - 0x478]
call fcn.00438a1f
mov eax, 0x104
lea ecx, [ebp - 0x478]
push eax
push eax
call fcn.0043ad6d
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeW]
mov ebx, eax
lea ecx, [ebp - 0x478]
push 0xffffffffffffffff
mov dword [ebp - 0x4bc], ebx
call fcn.0043b06d
cmp ebx, 0xffffffff
jne 0x451c40
push dword [ebp - 0x4b8]
push str.FindFirstVolume
lea eax, [ebp - 0x4d4]
push eax
call fcn.004515f6
add esp, 0xc
lea ecx, [ebp - 0x478]
call fcn.00438cda
jmp 0x451bc0
mov dword [ebp - 0x4d8], 1
push 0x498fa0
lea ecx, [ebp - 0x478]
call fcn.0043b65a
cmp eax, 0x3e8
jne 0x451c80
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push str.FindFirstVolumeFindNextVolume
push eax
call fcn.004515f6
add esp, 0xc
jmp 0x451e2c
push 0x4a3da4
lea ecx, [ebp - 0x450]
call fcn.004389d2
push 0x4a3e38
lea ecx, [ebp - 0x4b4]
call fcn.004389d2
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x478]
call fcn.0043b386
lea ecx, [ebp - 0x464]
call fcn.0043634f
lea ecx, [ebp - 0x4b4]
call fcn.00438cda
lea ecx, [ebp - 0x450]
call fcn.00438cda
lea ecx, [ebp - 0x48c]
call fcn.00438a1f
mov eax, 0x104
lea ecx, [ebp - 0x48c]
push eax
push eax
call fcn.0043ad6d
push eax
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x478]
call fcn.0043b6bf
mov ecx, eax
call fcn.0043fcdc
push eax
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceW]
lea ecx, [ebp - 0x464]
mov ebx, eax
call fcn.00438cda
push 0xffffffffffffffff
lea ecx, [ebp - 0x48c]
call fcn.0043b06d
test ebx, ebx
je 0x451f3b
push 0xffffffffffffffff
push 0x4a3e38
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x478]
call fcn.0043a082
lea ecx, [ebp - 0x464]
call fcn.0043634f
push 0xffffffffffffffff
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x4a0]
call fcn.0043a176
lea ecx, [ebp - 0x464]
cmp dword [eax + 0xc], 0x3ec
sete bl
call fcn.0043634f
test bl, bl
je 0x451def
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0046e5c0
and dword [ebp - 0x4ec], 0
add esp, 0xc
call fcn.00445397
mov ebx, eax
cmp byte [ebx + 0x18], 0
jne 0x451e72
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push str.CKernel32_Dll_XPOrLater::load
push eax
call fcn.004515f6
add esp, 0xc
jmp 0x451e21
mov eax, 0x104
lea ecx, [ebp - 0x478]
push eax
push eax
call fcn.0043ad6d
push eax
push dword [ebp - 0x4bc]
call dword [sym.imp.KERNEL32.DLL_FindNextVolumeW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x4d8], eax
call fcn.0043b06d
lea ecx, [ebp - 0x48c]
call fcn.00438cda
cmp dword [ebp - 0x4d8], 0
jne 0x451c4a
mov ebx, dword [ebp - 0x4b8]
push dword [ebp - 0x4bc]
call dword [sym.imp.KERNEL32.DLL_FindVolumeClose]
cmp dword [ebp - 0x4d8], 0
jne 0x451f4c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
je 0x451f4c
push ebx
push str.FindFirstVolumeFindNextVolume
jmp 0x451c24
lea eax, [ebp - 0x4ec]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x478]
call fcn.0043fcdc
push eax
call dword [ebx + 0x30]
test eax, eax
jne 0x451ec3
mov ebx, dword [ebp - 0x4b8]
push ebx
push str.GetVolumePathNamesForVolumeName
lea eax, [ebp - 0x4d4]
push eax
call fcn.004515f6
add esp, 0xc
lea ecx, [ebp - 0x48c]
call fcn.00438cda
jmp 0x451e3f
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x450]
call fcn.004389d2
lea eax, [ebp - 0x450]
push eax
push 0x4a3e38
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.00438e64
add esp, 0xc
lea ecx, [ebp - 0x428]
push eax
lea eax, [ebp - 0x464]
push eax
call fcn.0043b281
lea ecx, [ebp - 0x464]
call fcn.0043634f
lea ecx, [ebp - 0x4b4]
call fcn.00438cda
lea ecx, [ebp - 0x450]
call fcn.00438cda
lea ecx, [ebp - 0x48c]
call fcn.00438cda
jmp 0x451e39
mov ebx, dword [ebp - 0x4b8]
push ebx
push str.QueryDosDevice
jmp 0x451ea4
lea ecx, [ebp - 0x478]
call fcn.00438cda
lea ecx, [ebp - 0x4a0]
call fcn.00438cda
mov eax, dword [ebp - 0x4c0]
lea ecx, [ebp - 0x428]
push 0
push dword [ebp - 0x4b8]
mov ebx, dword [eax]
call fcn.0043fcdc
push eax
push 0xffffffffffffffff
push 0
push 0x4a3e38
lea ecx, [ebp - 0x428]
call fcn.0043a3b9
inc eax
lea ecx, [ebp - 0x428]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.0043b6bf
mov ecx, eax
call fcn.0043fcdc
mov ecx, dword [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x464]
push eax
call dword [ebx]
push eax
lea ecx, [ebp - 0x504]
call fcn.0043630b
lea ecx, [ebp - 0x464]
call fcn.0043634f
lea ecx, [ebp - 0x450]
call fcn.00438cda
cmp dword [ebp - 0x4f8], 0x7de
lea ecx, [ebp - 0x504]
je 0x45216f
call fcn.0043634f
jmp 0x451bcb
push esi
push ebx
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x451969
lea eax, [ebp - 0x508]
push eax
push 4
lea eax, [ebp - 0x4e4]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x452040
push dword [ebp - 0x4b8]
push 0x49b4b8
jmp 0x4519a5
xor eax, eax
push 0x206
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.0046e5c0
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
push dword [ebp - 0x4e4]
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
jne 0x452094
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push str.GetModuleBaseName
push eax
call fcn.004515f6
add esp, 0xc
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0046e5c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [ebp - 0x4e4]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x4520e8
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4d4]
push str.GetModuleFileNameEx
push eax
call fcn.004515f6
add esp, 0xc
mov ecx, dword [ebp - 0x4c0]
lea edx, [ebp - 0x20c]
push ebx
push dword [ebp - 0x4b8]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x414]
push edx
lea edx, [ebp - 0x464]
push edx
call dword [eax]
push eax
lea ecx, [ebp - 0x504]
call fcn.0043630b
lea ecx, [ebp - 0x464]
call fcn.0043634f
cmp dword [ebp - 0x4f8], 0x7de
lea ecx, [ebp - 0x504]
je 0x452184
call fcn.0043634f
cmp esi, 0xffffffff
je 0x452148
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x428]
call fcn.00438cda
mov eax, dword [ebp - 0x4e0]
xor ebx, ebx
inc eax
mov dword [ebp - 0x4e0], eax
cmp eax, dword [ebp - 0x4dc]
jae 0x4521a0
jmp 0x451915
call fcn.0043634f
lea ecx, [ebp - 0x43c]
call fcn.00438cda
jmp 0x451a9b
call fcn.0043634f
cmp esi, 0xffffffff
je 0x452195
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x428]
call fcn.00438cda
mov ecx, dword [ebp - 0x4f0]
lea eax, [ebp - 0x4d4]
push ebx
push eax
call fcn.0043630b
lea ecx, [ebp - 0x4d4]
call fcn.0043634f
push edi
call fcn.0046b1fd
mov eax, dword [ebp - 0x4f0]
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0046a6d5
mov esp, ebp
pop ebp
ret