Function at 0x426970
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49edf3
mov eax, dword fs:[0]
push eax
sub esp, 0x54c
mov eax, dword [0x4c6374]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 1
push ecx
lea esi, [ebx + 0x18]
push 0x4b66d4
mov ecx, esi
call fcn.0040a470
mov edi, eax
cmp edi, 0xffffffff
je 0x426eb7
push edi
push 0
lea eax, [ebp - 0x428]
mov ecx, esi
push eax
call fcn.00408960
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x42c], 7
mov dword [ebp - 0x430], 0
mov word [ebp - 0x440], ax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x418], 3
jbe 0x426b85
push 0x98
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.004793f0
add esp, 4
lea ecx, [ebp - 0x508]
call fcn.00408c30
mov edx, 0x4b66d8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x508]
call fcn.0040b820
lea edx, [ebp - 0x428]
mov ecx, eax
call fcn.0040be40
push 0x17
push str.CXpRestore::GhostCreate
lea ecx, [ebp - 0x520]
mov dword [ebp - 0x50c], 0xf
mov dword [ebp - 0x510], 0
mov byte [ebp - 0x520], 0
call fcn.0040f450
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x550]
push 0xd
push str.XpRestore.cpp
mov dword [ebp - 0x53c], 0xf
mov dword [ebp - 0x540], 0
mov byte [ebp - 0x550], 0
call fcn.0040f450
lea eax, [ebp - 0x538]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x508]
call fcn.00408b50
push eax
lea eax, [ebp - 0x520]
mov byte [ebp - 4], 5
push eax
push 0x70
lea eax, [ebp - 0x550]
push eax
sub esp, 8
call fcn.0041f440
add esp, 4
mov ecx, eax
call fcn.0041f910
mov eax, dword [ebp - 0x524]
cmp eax, 8
jb 0x426afd
inc eax
lea ecx, [ebp - 0x538]
push eax
push dword [ebp - 0x538]
call fcn.0040f5b0
xor eax, eax
mov dword [ebp - 0x524], 7
mov word [ebp - 0x538], ax
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x528], 0
cmp eax, 0x10
jb 0x426b38
inc eax
lea ecx, [ebp - 0x550]
push eax
push dword [ebp - 0x550]
call fcn.0040f330
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x53c], 0xf
mov dword [ebp - 0x540], 0
mov byte [ebp - 0x550], 0
cmp eax, 0x10
jb 0x426b71
inc eax
lea ecx, [ebp - 0x520]
push eax
push dword [ebp - 0x520]
call fcn.0040f330
lea ecx, [ebp - 0x4b8]
call fcn.00408b70
mov byte [ebp - 4], 6
jmp 0x426df6
cmp dword [ebp - 0x414], 8
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
jne 0x426ccc
push 0x98
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.004793f0
add esp, 4
lea ecx, [ebp - 0x508]
call fcn.00408c30
mov edx, str.Error
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x508]
call fcn.0040b820
lea edx, [ebp - 0x428]
mov ecx, eax
call fcn.0040be40
mov edx, str.:DRIVE_UNKNOWN
mov ecx, eax
call fcn.0040b820
push str.CXpRestore::GhostCreate
lea ecx, [ebp - 0x538]
call fcn.0040f550
push str.XpRestore.cpp
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 8
call fcn.0040f550
lea eax, [ebp - 0x550]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x508]
call fcn.00408b50
push eax
lea eax, [ebp - 0x538]
mov byte [ebp - 4], 0xa
push eax
push 0x76
lea eax, [ebp - 0x520]
push eax
sub esp, 8
call fcn.0041f440
add esp, 4
mov ecx, eax
call fcn.0041f910
lea ecx, [ebp - 0x550]
call fcn.0040f680
mov eax, dword [ebp - 0x50c]
cmp eax, 0x10
jb 0x426c7f
inc eax
lea ecx, [ebp - 0x520]
push eax
push dword [ebp - 0x520]
call fcn.0040f330
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x50c], 0xf
mov dword [ebp - 0x510], 0
mov byte [ebp - 0x520], 0
cmp eax, 0x10
jb 0x426cb8
inc eax
lea ecx, [ebp - 0x538]
push eax
push dword [ebp - 0x538]
call fcn.0040f330
lea ecx, [ebp - 0x4b8]
call fcn.00408b70
mov byte [ebp - 4], 0xb
jmp 0x426df6
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x426cf7
mov eax, dword [ecx]
jmp 0x426cf9
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x428]
push edx
push eax
call fcn.0040ec30
lea ecx, [ebp - 0x440]
call fcn.00424800
add esp, 0x18
test al, al
jne 0x426e6f
push 0x98
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.004793f0
add esp, 4
lea ecx, [ebp - 0x508]
call fcn.00408c30
mov edx, str.GetPhysicalDriveFromPartitionLetter_Error:
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x508]
call fcn.0040b820
lea edx, [ebp - 0x428]
mov ecx, eax
call fcn.0040be40
push str.CXpRestore::GhostCreate
lea ecx, [ebp - 0x520]
call fcn.0040f550
push str.XpRestore.cpp
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 0xd
call fcn.0040f550
lea eax, [ebp - 0x550]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x508]
call fcn.00408b50
push eax
lea eax, [ebp - 0x520]
mov byte [ebp - 4], 0xf
push eax
push 0x7b
lea eax, [ebp - 0x538]
push eax
sub esp, 8
call fcn.0041f440
add esp, 4
mov ecx, eax
call fcn.0041f910
lea ecx, [ebp - 0x550]
call fcn.0040f680
lea ecx, [ebp - 0x538]
call fcn.0040ef30
lea ecx, [ebp - 0x520]
call fcn.0040ef30
lea ecx, [ebp - 0x4b8]
call fcn.00408b70
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x4b8]
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
push eax
call fcn.0042f0f8
mov eax, dword [ebp - 0x42c]
add esp, 4
cmp eax, 8
jb 0x426e2d
inc eax
lea ecx, [ebp - 0x440]
push eax
push dword [ebp - 0x440]
call fcn.0040f5b0
xor eax, eax
mov dword [ebp - 0x42c], 7
mov word [ebp - 0x440], ax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x430], 0
cmp eax, 8
jb 0x426e68
inc eax
lea ecx, [ebp - 0x428]
push eax
push dword [ebp - 0x428]
call fcn.0040f5b0
xor al, al
jmp 0x42745e
push edi
push 0
mov ecx, esi
call fcn.0040ee80
push esi
lea edx, [ebp - 0x440]
lea ecx, [ebp - 0x538]
call fcn.0040c0c0
add esp, 4
mov ecx, esi
push eax
call fcn.00408a40
lea ecx, [ebp - 0x538]
call fcn.0040f680
lea ecx, [ebp - 0x440]
call fcn.0040f680
lea ecx, [ebp - 0x428]
call fcn.0040f680
xor eax, eax
mov dword [ebp - 0x45c], 7
mov dword [ebp - 0x460], 0
mov word [ebp - 0x470], ax
sub esp, 0x18
mov dword [ebp - 4], 0x11
mov ecx, esp
lea edi, [ebx + 0x48]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], eax
jb 0x426efd
mov eax, dword [ecx]
jmp 0x426eff
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
push edx
push edi
mov word [eax], dx
call fcn.0040ec30
lea ecx, [ebp - 0x470]
call fcn.00424800
add esp, 0x18
test al, al
jne 0x4270c0
push 0x98
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.004793f0
add esp, 4
lea ecx, [ebp - 0x508]
call fcn.00408c30
mov edx, str.GetPhysicalDriveFromPartitionLetter_Error:
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x508]
call fcn.0040b820
mov edx, ebx
mov ecx, eax
call fcn.0040be40
push 0x17
push str.CXpRestore::GhostCreate
lea ecx, [ebp - 0x520]
mov dword [ebp - 0x50c], 0xf
mov dword [ebp - 0x510], 0
mov byte [ebp - 0x520], 0
call fcn.0040f450
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x550]
push 0xd
push str.XpRestore.cpp
mov dword [ebp - 0x53c], 0xf
mov dword [ebp - 0x540], 0
mov byte [ebp - 0x550], 0
call fcn.0040f450
lea eax, [ebp - 0x538]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x508]
call fcn.00408b50
push eax
lea eax, [ebp - 0x520]
mov byte [ebp - 4], 0x15
push eax
push 0x84
lea eax, [ebp - 0x550]
push eax
sub esp, 8
call fcn.0041f440
add esp, 4
mov ecx, eax
call fcn.0041f910
mov eax, dword [ebp - 0x524]
cmp eax, 8
jb 0x42701d
inc eax
lea ecx, [ebp - 0x538]
push eax
push dword [ebp - 0x538]
call fcn.0040f5b0
xor eax, eax
mov dword [ebp - 0x524], 7
mov word [ebp - 0x538], ax
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x528], 0
cmp eax, 0x10
jb 0x427058
inc eax
lea ecx, [ebp - 0x550]
push eax
push dword [ebp - 0x550]
call fcn.0040f330
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x53c], 0xf
mov dword [ebp - 0x540], 0
mov byte [ebp - 0x550], 0
cmp eax, 0x10
jb 0x427091
inc eax
lea ecx, [ebp - 0x520]
push eax
push dword [ebp - 0x520]
call fcn.0040f330
lea ecx, [ebp - 0x4b8]
call fcn.00408b70
lea eax, [ebp - 0x4b8]
mov byte [ebp - 4], 0x16
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0042f0f8
add esp, 4
xor bl, bl
jmp 0x42743e
push str.Ghost.ba_
mov edx, edi
lea ecx, [ebp - 0x458]
call fcn.0040c1a0
add esp, 4
push 0x400
lea eax, [ebp - 0x410]
mov byte [ebp - 4], 0x17
push 0
push eax
call fcn.004793f0
add esp, 0xc
lea edx, [ebp - 0x470]
lea ecx, [ebp - 0x520]
call fcn.00425830
mov edi, eax
mov edx, esi
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x538]
call fcn.00425830
cmp dword [edi + 0x14], 0x10
jb 0x42711b
mov edi, dword [edi]
cmp dword [eax + 0x14], 0x10
jb 0x427123
mov eax, dword [eax]
push edi
push eax
push str.Ghost.exe__nousb__clone_modepload_src__s:1__dst__s___fro__crcignore__sure__fx
lea eax, [ebp - 0x410]
push 0x400
push eax
call fcn.0040ee60
mov ecx, dword [ebp - 0x524]
add esp, 0x14
mov esi, eax
cmp ecx, 0x10
jb 0x42715e
inc ecx
push ecx
push dword [ebp - 0x538]
lea ecx, [ebp - 0x538]
call fcn.0040f330
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x524], 0xf
mov dword [ebp - 0x528], 0
mov byte [ebp - 0x538], 0
cmp eax, 0x10
jb 0x42719b
inc eax
lea ecx, [ebp - 0x520]
push eax
push dword [ebp - 0x520]
call fcn.0040f330
cmp esi, 0xffffffff
jne 0x4272f0
push 0x98
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.004793f0
add esp, 4
lea ecx, [ebp - 0x508]
call fcn.00408c30
mov edx, str.sprintf_s_Error:
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x508]
call fcn.0040b820
lea edx, [ebp - 0x410]
mov ecx, eax
call fcn.0040bae0
push str.CXpRestore::GhostCreate
lea ecx, [ebp - 0x550]
call fcn.0040f550
push str.XpRestore.cpp
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 0x1a
call fcn.0040f550
lea eax, [ebp - 0x538]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x508]
call fcn.00408b50
push eax
lea eax, [ebp - 0x550]
mov byte [ebp - 4], 0x1c
push eax
push 0x8e
lea eax, [ebp - 0x520]
push eax
sub esp, 8
call fcn.0041f440
add esp, 4
mov ecx, eax
call fcn.0041f910
mov eax, dword [ebp - 0x524]
cmp eax, 8
jb 0x427268
inc eax
lea ecx, [ebp - 0x538]
push eax
push dword [ebp - 0x538]
call fcn.0040f5b0
xor eax, eax
mov dword [ebp - 0x524], 7
mov word [ebp - 0x538], ax
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x528], 0
cmp eax, 0x10
jb 0x4272a3
inc eax
lea ecx, [ebp - 0x520]
push eax
push dword [ebp - 0x520]
call fcn.0040f330
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x50c], 0xf
mov dword [ebp - 0x510], 0
mov byte [ebp - 0x520], 0
cmp eax, 0x10
jb 0x4272dc
inc eax
lea ecx, [ebp - 0x550]
push eax
push dword [ebp - 0x550]
call fcn.0040f330
lea ecx, [ebp - 0x4b8]
call fcn.00408b70
mov byte [ebp - 4], 0x1d
jmp 0x4273e4
push ecx
push esi
lea edx, [ebp - 0x410]
lea ecx, [ebp - 0x458]
call fcn.00414980
add esp, 8
test al, al
jne 0x427401
push 0x98
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.004793f0
add esp, 4
lea ecx, [ebp - 0x508]
call fcn.00408c30
mov edx, str.SetFileBuf_Error__FilePath:
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x508]
call fcn.0040b820
lea edx, [ebp - 0x458]
mov ecx, eax
call fcn.0040be40
push str.CXpRestore::GhostCreate
lea ecx, [ebp - 0x520]
call fcn.0040f550
push str.XpRestore.cpp
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 0x1f
call fcn.0040f550
lea eax, [ebp - 0x550]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x508]
call fcn.00408b50
push eax
lea eax, [ebp - 0x520]
mov byte [ebp - 4], 0x21
push eax
push 0x94
lea eax, [ebp - 0x538]
push eax
sub esp, 8
call fcn.0041f440
add esp, 4
mov ecx, eax
call fcn.0041f910
lea ecx, [ebp - 0x550]
call fcn.0040f680
lea ecx, [ebp - 0x538]
call fcn.0040ef30
lea ecx, [ebp - 0x520]
call fcn.0040ef30
lea ecx, [ebp - 0x4b8]
call fcn.00408b70
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x4b8]
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
push eax
call fcn.0042f0f8
add esp, 4
xor bl, bl
jmp 0x427403
mov bl, 1
mov eax, dword [ebp - 0x444]
cmp eax, 8
jb 0x427421
inc eax
lea ecx, [ebp - 0x458]
push eax
push dword [ebp - 0x458]
call fcn.0040f5b0
xor eax, eax
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], ax
mov ecx, dword [ebp - 0x45c]
cmp ecx, 8
jb 0x42745c
inc ecx
push ecx
push dword [ebp - 0x470]
lea ecx, [ebp - 0x470]
call fcn.0040f5b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475cda
mov esp, ebp
pop ebp
ret