Function at 0x418c8f
Capabilities:
Get disk information
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
mov dword [ebp - 8], ecx
push edi
lea ecx, [ebp + 8]
call fcn.0040e58b
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], ebx
call fcn.0042460b
mov byte [ebp - 4], bl
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], ebx
jmp 0x418df4
push 4
lea eax, [ebp + 8]
push eax
push 0x47866c
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x418cea
mov byte [ebp - 4], 1
jmp 0x418df4
push 5
lea eax, [ebp + 8]
push eax
push str.mem
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x418d0a
mov byte [ebp - 2], 1
jmp 0x418df4
push 3
lea eax, [ebp + 8]
push eax
push 0x4784cc
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x418d2a
mov byte [ebp - 3], 1
jmp 0x418df4
push 7
lea eax, [ebp + 8]
push eax
push str.local
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x418d4a
or dword [ebp - 0x14], 0x10
jmp 0x418df4
push 0xa
lea eax, [ebp + 8]
push eax
push str.EnviMode
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x418d6a
or dword [ebp - 0x14], 0x20
jmp 0x418df4
push 5
lea eax, [ebp + 8]
push eax
push str.ncd
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x418d87
or dword [ebp - 0x28], 0x40
jmp 0x418df4
push 7
push dword [ebp + 8]
push str.logs:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x418e03
add dword [ebp + 8], 0xe
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.004124b4
add esp, 0xc
cmp dword [ebp - 0x1c], ebx
mov dword [ebp + 8], eax
jle 0x418dec
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
push dword [ebp - 0x34]
call fcn.00424629
mov ecx, dword [ebp - 8]
push 1
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
call fcn.0043cace
lea ecx, [ebp - 0x18]
call fcn.00424686
lea ecx, [ebp + 8]
call fcn.0040e58b
mov eax, dword [ebp + 8]
cmp word [eax], 0x2a
je 0x418cca
jmp 0x418e06
mov eax, dword [ebp + 8]
push 0x22
pop edi
cmp word [eax], di
mov esi, eax
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
sete byte [ebp - 1]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], ebx
call fcn.004124b4
add esp, 0xc
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
call fcn.0042460b
mov eax, dword [ebp - 0x1c]
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00424629
mov eax, dword [ebp - 0x10]
mov cx, word [eax]
cmp cx, di
jne 0x418e76
mov ecx, edi
cmp cx, di
je 0x418e62
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x418e53
cmp word [eax], bx
je 0x418e7b
inc eax
inc eax
jmp 0x418e7b
cmp cx, 0x2c
je 0x418e7b
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x418e6b
cmp word [eax], 0x2c
jne 0x418e90
mov word [eax], bx
movzx eax, word [eax + 2]
and eax, 0xffdf
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 8]
push 1
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call fcn.0043dcfa
mov esi, dword [ebp - 0xc]
cmp word [esi], di
je 0x418f0b
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], esi
call fcn.00403953
mov eax, dword [ebp - 0x34]
cmp word [eax], bx
pop ecx
je 0x418f0b
push esi
lea ecx, [ebp - 0x10]
call fcn.0042a1b7
push dword [ebp - 0x10]
call fcn.0046176a
mov esi, eax
pop ecx
lea eax, [esi + 3]
push eax
lea ecx, [ebp - 0xc]
call fcn.00424699
mov eax, dword [ebp - 0xc]
mov word [eax + esi*2 + 4], bx
mov eax, dword [ebp - 0xc]
push esi
push dword [ebp - 0x10]
add eax, 2
push eax
call fcn.0040391f
mov eax, dword [ebp - 0xc]
mov word [eax + esi*2 + 2], di
mov eax, dword [ebp - 0xc]
mov word [eax], di
mov esi, dword [ebp - 0xc]
add esp, 0xc
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], esi
call fcn.004124b4
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 8]
add esp, 0xc
push 1
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
sub edi, esi
sar edi, 1
call fcn.0043dcfa
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
call fcn.004246c0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [eax + edi*2]
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], eax
call fcn.00424686
mov esi, dword [ebp + 8]
push 5
push esi
push str.map:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x418f74
mov dword [ebp - 0x24], esi
mov dword [ebp + 8], esi
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
add ecx, ecx
lea esi, [ecx + edi]
mov ax, word [esi]
mov word [ebp - 0x48], ax
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov dword [ebp - 0x34], edi
mov word [esi], bx
je 0x419010
mov edx, dword [ebp + 8]
add eax, 0xa
mov word [ecx + edx], bx
mov dword [ebp + 8], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x3c], ebx
call fcn.0042e410
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
pop ecx
pop ecx
jg 0x418fc3
mov ebx, 0x80070057
jmp 0x4196c6
mov edi, dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
push ebx
push ebx
push ebx
push 6
push eax
mov dword [ebp - 0x40], eax
call edi
cmp eax, ebx
jne 0x418fe0
xor ebx, ebx
inc ebx
jmp 0x4196c6
mov ecx, dword [eax]
push eax
mov dword [ebp - 0x38], ecx
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
mov eax, dword [ebp - 0x38]
cmp eax, ebx
jle 0x418fd8
add eax, 4
push eax
push ebx
push ebx
push 6
push dword [ebp - 0x40]
call edi
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x418fd8
mov edi, dword [ebp - 0x34]
add eax, 4
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x30]
call fcn.0042460b
cmp word [edi], 0x2a
mov eax, edi
jne 0x419023
lea eax, [edi + 2]
push 0x2a
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x4190e9
cmp word [edi + 2], 0x2a
jne 0x41903f
xor edi, edi
cmp edi, ebx
je 0x4190e9
mov ecx, dword [ebp - 0x34]
mov eax, edi
sub eax, ecx
sar eax, 1
cmp word [ecx + eax*2 - 2], 0x22
mov dword [ebp - 0x18], eax
jne 0x41905f
dec eax
mov dword [ebp - 0x18], eax
inc edi
inc edi
cmp word [edi], bx
mov dword [ebp - 0x10], edi
je 0x41908b
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.004213da
test al, al
jne 0x419086
cmp cx, 0x22
je 0x419086
inc edi
inc edi
cmp word [edi], bx
jne 0x419069
cmp edi, dword [ebp - 0x10]
jne 0x419093
xor ebx, ebx
inc ebx
jmp 0x4196be
cmp byte [ebp - 1], bl
je 0x4191d2
cmp word [edi], 0x22
jne 0x4191d2
mov byte [ebp - 1], 1
mov word [edi], 0x20
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.00424710
sub dword [ebp - 0x10], 2
cmp byte [ebp - 1], bl
mov edx, dword [ebp - 0x10]
je 0x4190cd
mov word [edx], 0x22
inc edx
inc edx
cmp edx, edi
jae 0x4190e9
mov ecx, edi
sub ecx, edx
dec ecx
shr ecx, 1
inc ecx
shr ecx, 1
mov eax, 0x200020
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ax, word [ebp - 0x48]
mov word [esi], ax
mov esi, dword [ebp - 0x18]
push esi
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
call fcn.00424629
mov eax, dword [ebp - 0x2c]
mov word [eax + esi*2], bx
mov edi, dword [ebp - 0x2c]
mov dword [ebp + 8], edi
cmp word [edi], 0x2a
mov dword [ebp - 0x34], edi
jne 0x419135
push 0x5c
lea esi, [edi + 2]
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
push ebx
push esi
mov dword [ebp - 0x34], esi
call edi
cmp eax, ebx
jne 0x41912d
mov eax, esi
push 0x23
push ebx
push eax
call edi
mov edi, eax
cmp edi, ebx
mov esi, 0x4758e0
je 0x419144
cmp word [edi], 0x23
je 0x419146
mov edi, esi
xor edx, edx
cmp word [edi], bx
jne 0x4191dd
cmp edx, ebx
jle 0x41915f
lea eax, [ebp - 0x1c]
push eax
call fcn.00403977
pop ecx
cmp byte [ebp - 2], bl
je 0x41933e
lea ecx, [ebp - 0x54]
call fcn.00424559
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x38], esi
call fcn.00403953
mov eax, dword [ebp - 0x38]
pop ecx
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x24]
call fcn.00424629
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x26
je 0x41924a
mov ecx, dword [ebp - 8]
cmp byte [ecx + 9], bl
jne 0x41924a
lea ecx, [ebp - 0x54]
push ecx
push eax
call fcn.00428baa
push dword [ebp - 0x54]
call fcn.0046176a
add esp, 0xc
shl eax, 1
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
jmp 0x4192c8
mov byte [ebp - 1], bl
jmp 0x4190af
mov edi, eax
inc edx
lea eax, [edi + 2]
cmp word [eax], 0x23
je 0x4191da
cmp word [edi], bx
je 0x419151
xor eax, eax
mov ax, word [edi + 2]
push eax
call fcn.0040e5a7
add esp, 4
test al, al
je 0x419244
cmp word [edi], bx
je 0x419151
lea ecx, [edi + 2]
jmp 0x419212
inc ecx
inc ecx
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.0040e5a7
add esp, 4
test al, al
jne 0x419210
mov cx, word [ecx]
cmp cx, bx
je 0x419151
cmp cx, 0x7c
je 0x419151
cmp cx, 0x3a
je 0x419151
mov edi, esi
xor edx, edx
jmp 0x419202
mov esi, 0x48b5d4
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ecx, dword [ebp - 8]
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x24]
call fcn.0040a6dc
mov edi, eax
cmp edi, ebx
jne 0x419289
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea ecx, [ebp - 0x24]
call fcn.00424686
lea ecx, [ebp - 0x54]
call fcn.00424686
xor ebx, ebx
inc ebx
jmp 0x4196b6
mov eax, dword [edi + 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
mov eax, dword [edi + 8]
add eax, 0x10
push eax
lea ecx, [ebp - 0x54]
call fcn.0042459d
push dword [edi + 8]
push dword [edi + 4]
push dword [ebp - 0x54]
call fcn.00461a50
mov eax, dword [edi + 8]
add eax, dword [ebp - 0x54]
push 0x10
push ebx
push eax
call fcn.00461780
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp byte [0x4892a8], bl
jge 0x4192d7
mov byte [0x4892a8], 1
lea eax, [ebp - 0x54]
push 1
push eax
call fcn.00433ac4
push dword [ebp - 8]
lea eax, [ebp - 0x54]
push eax
call fcn.004187d4
push dword [ebp - 0x14]
lea eax, [ebp - 0x54]
push dword [ebp - 0x20]
push eax
call fcn.0040b814
mov esi, dword [ebp - 0x54]
add esp, 0x1c
push 0xffffffffffffffff
push str.mem
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x54], ebx
call fcn.00424642
mov ecx, dword [ebp - 8]
push ebx
push 0x40
push dword [eax]
push dword [ebp - 0x1c]
push esi
call fcn.004574bd
lea ecx, [ebp - 0x48]
call fcn.00424686
lea ecx, [ebp - 0x24]
call fcn.00424686
lea ecx, [ebp - 0x54]
jmp 0x4193e5
mov esi, dword [ebp - 0x38]
cmp esi, ebx
jle 0x4193ef
lea ecx, [ebp - 0x6c]
call fcn.00424559
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
call fcn.0042459d
push esi
push dword [ebp - 0x40]
mov dword [ebp - 0x64], esi
push dword [ebp - 0x6c]
mov dword [ebp - 0x68], esi
call fcn.00461a50
mov eax, dword [ebp - 0x6c]
push 0x10
add eax, esi
push ebx
push eax
call fcn.00461780
add esp, 0x18
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
lea eax, [ebp - 0x6c]
push 1
push eax
call fcn.00433ac4
push dword [ebp - 8]
lea eax, [ebp - 0x6c]
push eax
call fcn.004187d4
add esp, 0x10
cmp byte [0x4892a8], bl
jge 0x4193b8
mov byte [0x4892a8], 1
push dword [ebp - 0x14]
lea eax, [ebp - 0x6c]
push dword [ebp - 0x20]
push eax
call fcn.0040b814
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 8]
add esp, 0xc
push ebx
push 0x40
push dword [ebp - 0x2c]
mov dword [ebp - 0x6c], ebx
push dword [ebp - 0x1c]
push eax
call fcn.004574bd
lea ecx, [ebp - 0x6c]
call fcn.00424686
jmp 0x4196b6
mov eax, dword [ebp + 8]
cmp word [eax], 0x5c
jne 0x4194a6
add eax, 2
cmp word [eax], 0x5c
je 0x4194a6
push 0x909
lea ecx, [ebp - 0x40]
mov dword [ebp + 8], eax
call fcn.0042465d
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x38], edi
add edi, 0xbc8
push edi
push 0x324
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
mov esi, 0x5dc
xor eax, eax
sub esi, dword [ebp - 0x18]
jmp 0x419494
mov cx, word [edi]
cmp cx, word [ebp - 0x44]
jb 0x419489
cmp eax, esi
jge 0x419489
push dword [ebp + 8]
push edi
push str._s_s
push dword [ebp - 0x38]
call dword [sym.imp.USER32.dll_wsprintfW]
push dword [ebp - 0x38]
call fcn.004614b5
add esp, 0x14
test eax, eax
je 0x419489
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
or eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
push ebx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x38]
call fcn.00418ae9
cmp byte [ebp - 3], bl
je 0x419499
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x41943d
lea ecx, [ebp - 0x40]
call fcn.00424686
jmp 0x4196ad
cmp word [edi], bx
je 0x41968e
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3a
push edi
mov dword [ebp - 0x40], 0x478630
mov dword [ebp - 0x44], edi
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x4194e2
mov word [eax], bx
mov eax, dword [ebp - 0x10]
inc eax
inc eax
mov dword [ebp - 0x10], eax
cmp word [eax], 0x7c
mov dword [ebp - 0x44], eax
je 0x4194e2
mov dword [ebp - 0x40], eax
push 0x7c
push dword [ebp - 0x44]
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x4194f9
mov dword [ebp - 0x10], 0x4758e0
jmp 0x419500
mov word [eax], bx
add dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], 0x7fffffff
cmp word [eax], bx
je 0x419524
push 0x7c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042e1ad
add esp, 0xc
mov eax, dword [ebp - 0x10]
cmp word [eax], 0x2c
jne 0x41953c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042e410
pop ecx
pop ecx
cmp dword [ebp - 0x18], ebx
jle 0x4195e9
cmp dword [ebp - 0x38], ebx
jl 0x4195e9
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov esi, eax
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x23
mov dword [ebp - 0x28], ebx
je 0x419586
push 2
push ebx
push eax
mov dword [ebp - 0x28], 1
mov word [edi], bx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
mov word [edi], 0x23
je 0x419281
lea ecx, [ebp - 0x60]
call fcn.00424559
push edi
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
call fcn.0042a183
push ebx
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push esi
call fcn.0040e9a5
add esp, 0x14
lea ecx, [ebp - 0x44]
call fcn.00424686
cmp dword [ebp - 0x28], ebx
je 0x4195c5
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x38]
sub ecx, edx
jns 0x4195d1
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
jle 0x4195dd
mov eax, ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
jg 0x4195f3
lea ecx, [ebp - 0x60]
call fcn.00424686
mov ebx, 0x80070057
jmp 0x4196b6
cmp edx, ebx
mov esi, dword [ebp - 0x60]
je 0x41960b
push eax
lea eax, [esi + edx]
push eax
push esi
call fcn.00461d90
mov eax, dword [ebp - 0x18]
add esp, 0xc
push 6
add esi, eax
push ebx
push esi
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], eax
call fcn.00461780
lea eax, [ebp - 0x60]
push 1
push eax
call fcn.00433ac4
push dword [ebp - 8]
lea eax, [ebp - 0x60]
push eax
call fcn.004187d4
add esp, 0x1c
cmp byte [0x4892a8], bl
jge 0x419645
mov byte [0x4892a8], 1
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push dword [ebp - 0x30]
push eax
call fcn.00418a37
push dword [ebp - 0x14]
mov esi, eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x60]
push eax
call fcn.0040b814
mov eax, dword [ebp - 0x60]
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x60], ebx
je 0x419684
mov ecx, dword [ebp - 8]
push esi
push 0x40
push dword [ebp + 8]
push dword [ebp - 0x1c]
push eax
call fcn.004574bd
lea ecx, [ebp - 0x60]
call fcn.00424686
jmp 0x4196ad
push dword [ebp - 0x20]
movsx eax, byte [ebp - 4]
or eax, dword [ebp - 0x28]
push dword [ebp - 0x30]
or eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 0x1c]
push dword [ebp + 8]
call fcn.00418ae9
mov ecx, dword [ebp - 8]
push ebx
call fcn.0044c8fd
lea ecx, [ebp - 0x2c]
call fcn.00424686
lea ecx, [ebp - 0x30]
call fcn.00424686
lea ecx, [ebp - 0xc]
call fcn.00424686
lea ecx, [ebp - 0x20]
call fcn.00424686
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4