Function at 0x4e3148
Capabilities:
Delete file
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4e361f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x80], 1
mov eax, dword [ebp - 0x14]
call fcn.004e4cac
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x4e35d4
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xc4], 0
je 0x4e35d4
xor eax, eax
mov dword [ebp - 0x34], eax
test esi, esi
jne 0x4e31dd
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x84]
call fcn.004e0e14
mov esi, eax
lea ecx, [ebp - 0xc]
mov edx, 0x4e363c
mov eax, ebx
call fcn.004142a8
mov eax, ebx
call fcn.00413d00
test al, al
je 0x4e3204
mov eax, ebx
call fcn.00406dec
push eax
call sub.kernel32.dll_DeleteFileW
lea ecx, [ebp - 0x244]
mov edx, 0x4e363c
mov eax, ebx
call fcn.004142a8
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x10]
call fcn.00414590
mov edx, esi
mov eax, dword [ebp - 0x14]
call fcn.004e3f68
mov edi, eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x28], eax
mov dl, 1
mov eax, dword [0x4cfb28]
call fcn.004d0164
mov dword [ebp - 0x2c], eax
xor edx, edx
push ebp
push 0x4e35cd
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, ebx
mov eax, dword [ebp - 0x2c]
call fcn.004d059c
mov dl, 1
mov eax, dword [ebp - 0x2c]
call fcn.004d029c
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
call fcn.004d0294
test al, al
jne 0x4e329c
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x44], 0
jne 0x4e329c
cmp dword [eax + 0x40], 0
jne 0x4e329c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x30]
mov dword [eax + 0x40], ecx
mov ecx, dword [edx + 0x34]
mov dword [eax + 0x44], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x44], 0
jne 0x4e32ad
cmp dword [eax + 0x40], 0
jbe 0x4e32ec
jmp 0x4e32af
jle 0x4e32ec
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x44]
mov eax, dword [eax + 0x40]
cmp edx, dword [esp + 4]
jne 0x4e32e8
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4e3317
jmp 0x4e32ec
pop edx
pop eax
jle 0x4e3317
mov edx, 0x4e3654
mov eax, dword [ebp - 0x14]
call fcn.004ce38c
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x80], 0
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.004e2f58
mov dword [ebp - 0x18], eax
jmp 0x4e359c
add edi, 0x1a
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x34]
test eax, eax
ja 0x4e3328
xor ecx, ecx
jmp 0x4e332a
mov ecx, eax
add ecx, edi
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x34], 0
jne 0x4e3340
cmp dword [eax + 0x30], 0x7fffffff
jbe 0x4e3349
jmp 0x4e3342
jle 0x4e3349
mov ebx, 0x7fffffff
jmp 0x4e3351
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x30]
mov ebx, eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x44], 0
jne 0x4e3362
cmp dword [eax + 0x40], 0
jbe 0x4e338c
jmp 0x4e3364
jle 0x4e338c
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x44]
mov eax, dword [eax + 0x40]
cmp edx, dword [esp + 4]
jne 0x4e3382
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4e338c
jmp 0x4e3386
pop edx
pop eax
jge 0x4e338c
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax + 0x40]
cmp ebx, edi
jae 0x4e3397
mov dword [ebp - 0x18], 0xffffd5c6
cmp dword [ebp - 0x18], 0
jne 0x4e359c
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x24]
mov eax, ecx
xor edx, edx
div ebx
test edx, edx
je 0x4e33bc
mov eax, ecx
xor edx, edx
div ebx
inc eax
imul ebx
jmp 0x4e33be
mov eax, ecx
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x34], eax
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4d8bf0]
call fcn.004db95c
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x34]
call fcn.004d4f28
push 1
mov ecx, dword [ebp - 0x34]
mov edx, esi
mov eax, dword [ebp - 0x14]
call fcn.004e6c54
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4e3588
mov eax, dword [ebp - 0x2c]
call fcn.004d0294
test al, al
jne 0x4e3588
mov byte [ebp - 0x2d], 0
jmp 0x4e357e
push 0
lea eax, [ebp - 0x248]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x250], eax
mov byte [ebp - 0x24c], 0x11
lea ecx, [ebp - 0x250]
mov edx, 0x2b1b
mov eax, dword [ebp - 0x14]
call fcn.004cf350
mov eax, dword [ebp - 0x248]
push eax
push 0
lea eax, [ebp - 0x254]
push eax
mov dword [ebp - 0x250], 1
mov byte [ebp - 0x24c], 0
lea ecx, [ebp - 0x250]
mov edx, 0x2b26
mov eax, dword [ebp - 0x14]
call fcn.004cf350
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 8]
pop ecx
call fcn.0040721c
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
movzx ecx, word [0x4e3684]
mov dl, 2
mov eax, dword [ebp - 8]
call fcn.0046fb88
mov eax, dword [ebp - 0x34]
cmp byte [eax + 0xc6], 1
jne 0x4e34f6
push 0
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x104
lea eax, [ebp - 0x240]
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x14
push eax
call sub.kernel32.dll_GetVolumeInformationW
mov edx, 0x4e3688
lea eax, [ebp - 0x240]
call fcn.00414e90
test eax, eax
jne 0x4e357e
mov byte [ebp - 0x2d], 1
jmp 0x4e357e
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4e3515
mov eax, ebx
sub eax, 0xa
cmp word [eax], 2
je 0x4e3515
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00406314
mov ebx, eax
mov esi, ebx
test esi, esi
je 0x4e3520
sub esi, 4
mov esi, dword [esi]
lea edx, [ebp - 0x258]
mov eax, dword [ebp - 0xc]
call fcn.004145d0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x38], eax
mov edi, dword [ebp - 0x38]
test edi, edi
je 0x4e3543
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x25c]
push eax
mov ecx, esi
sub ecx, edi
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00407488
mov edx, dword [ebp - 0x25c]
lea eax, [ebp - 4]
mov ecx, 0x4e36ac
call fcn.0040721c
mov eax, dword [ebp - 4]
call fcn.00413d00
test al, al
je 0x4e357e
mov byte [ebp - 0x2d], 1
cmp byte [ebp - 0x2d], 0
je 0x4e3416
cmp dword [ebp - 0x18], 0
jne 0x4e359c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
call fcn.004e6b34
mov dword [ebp - 0x18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e35d4
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [ebp - 0x34], edx
call fcn.00404e68
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [ebp - 0x2c], edx
call fcn.00404e68
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x34], edx
ret
cmp dword [ebp - 0x18], 0
jge 0x4e35e4
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004ce14c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3626
lea eax, [ebp - 0x25c]
mov edx, 3
call fcn.00406d58
lea eax, [ebp - 0x248]
mov edx, 2
call fcn.00406d58
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406d58
ret