Function at 0x41f4e0
Capabilities:
Get disk information
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1190
call fcn.0041df30
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str._CS_14
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
movzx eax, byte [0x4457c4]
test eax, eax
je 0x41f585
mov dword [ebp - 0x111c], 0x4456c0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1104], ecx
mov edx, dword [ebp - 0x1104]
mov dword [ebp - 0x118c], edx
mov eax, dword [ebp - 0x111c]
mov cl, byte [eax]
mov byte [ebp - 0x10b2], cl
mov edx, dword [ebp - 0x1104]
mov al, byte [ebp - 0x10b2]
mov byte [edx], al
mov ecx, dword [ebp - 0x111c]
add ecx, 1
mov dword [ebp - 0x111c], ecx
mov edx, dword [ebp - 0x1104]
add edx, 1
mov dword [ebp - 0x1104], edx
cmp byte [ebp - 0x10b2], 0
jne 0x41f52e
mov eax, 1
shl eax, 0
mov byte [eax + 0x43c040], 6
jmp 0x41ff9a
cmp dword [0x43c790], 0
je 0x41f5f7
mov ecx, dword [0x43c790]
mov dword [ebp - 0x1118], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1100], edx
mov eax, dword [ebp - 0x1100]
mov dword [ebp - 0x1184], eax
mov ecx, dword [ebp - 0x1118]
mov dl, byte [ecx]
mov byte [ebp - 0x10b3], dl
mov eax, dword [ebp - 0x1100]
mov cl, byte [ebp - 0x10b3]
mov byte [eax], cl
mov edx, dword [ebp - 0x1118]
add edx, 1
mov dword [ebp - 0x1118], edx
mov eax, dword [ebp - 0x1100]
add eax, 1
mov dword [ebp - 0x1100], eax
cmp byte [ebp - 0x10b3], 0
jne 0x41f5af
jmp 0x41ff94
push 1
push 0xb48
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
mov dword [0x43c790], eax
push 0x7d0
push 0
lea ecx, [ebp - 0xc1c]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
movzx edx, byte [0x4456bb]
test edx, edx
je 0x41f747
push 0x104
push 0
lea eax, [ebp - 0x244]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov byte [ebp - 0x10b1], 0
push 0x104
lea ecx, [ebp - 0x244]
push ecx
call fcn.0041f1a0
add esp, 8
test eax, eax
jne 0x41f671
mov dword [ebp - 0x1138], 0
jmp 0x41f67b
mov dword [ebp - 0x1138], 1
mov dl, byte [ebp - 0x1138]
mov byte [ebp - 0x10b1], dl
movzx eax, byte [ebp - 0x10b1]
test eax, eax
jne 0x41f69a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, byte [ebp - 0x10b1]
test ecx, ecx
je 0x41f64d
lea edx, [ebp - 0x244]
mov dword [ebp - 0x10cc], edx
mov eax, dword [ebp - 0x10cc]
mov dword [ebp - 0x1134], eax
mov ecx, dword [ebp - 0x10cc]
mov dl, byte [ecx]
mov byte [ebp - 0x10b5], dl
add dword [ebp - 0x10cc], 1
cmp byte [ebp - 0x10b5], 0
jne 0x41f6bd
mov eax, dword [ebp - 0x10cc]
sub eax, dword [ebp - 0x1134]
mov ecx, dword [ebp - 0x1134]
mov dword [ebp - 0x1140], ecx
mov dword [ebp - 0x1148], eax
lea edx, [ebp - 0xc1c]
add edx, 0xffffffff
mov dword [ebp - 0x10fc], edx
mov eax, dword [ebp - 0x10fc]
mov cl, byte [eax + 1]
mov byte [ebp - 0x10b6], cl
add dword [ebp - 0x10fc], 1
cmp byte [ebp - 0x10b6], 0
jne 0x41f708
mov edi, dword [ebp - 0x10fc]
mov esi, dword [ebp - 0x1140]
mov edx, dword [ebp - 0x1148]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx eax, byte [0x4456b8]
test eax, eax
je 0x41f9dc
push 0x104
push 0
lea ecx, [ebp - 0x140]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x102c], edx
mov dword [ebp - 0x1028], edx
mov dword [ebp - 0x1024], edx
mov dword [ebp - 0x1020], edx
push 1
lea eax, [ebp - 0x102c]
push eax
call fcn.00422770
add esp, 8
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + edx - 0x102c]
push eax
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + edx - 0x102c]
push eax
push str._X_X
lea ecx, [ebp - 0x140]
push ecx
call fcn.00424a50
add esp, 0x10
push 3
lea edx, [ebp - 0x102c]
push edx
call fcn.00422770
add esp, 8
mov eax, 4
imul ecx, eax, 3
cmp dword [ebp + ecx - 0x102c], 0
jne 0x41f800
mov edx, 4
imul eax, edx, 0
cmp dword [ebp + eax - 0x102c], 0
je 0x41f83b
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + edx - 0x102c]
push eax
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + edx - 0x102c]
push eax
lea ecx, [ebp - 0x140]
push ecx
push str._s_X_X
lea edx, [ebp - 0x140]
push edx
call fcn.00424a50
add esp, 0x14
lea eax, [ebp - 0x140]
mov dword [ebp - 0x10d0], eax
mov ecx, dword [ebp - 0x10d0]
add ecx, 1
mov dword [ebp - 0x114c], ecx
mov edx, dword [ebp - 0x10d0]
mov al, byte [edx]
mov byte [ebp - 0x10b7], al
add dword [ebp - 0x10d0], 1
cmp byte [ebp - 0x10b7], 0
jne 0x41f856
mov ecx, dword [ebp - 0x10d0]
sub ecx, dword [ebp - 0x114c]
mov dword [ebp - 0x1150], ecx
cmp dword [ebp - 0x1150], 0xd
jb 0x41f93a
lea edx, [ebp - 0x13b]
mov dword [ebp - 0x10d4], edx
mov eax, dword [ebp - 0x10d4]
mov dword [ebp - 0x1130], eax
mov ecx, dword [ebp - 0x10d4]
mov dl, byte [ecx]
mov byte [ebp - 0x10b8], dl
add dword [ebp - 0x10d4], 1
cmp byte [ebp - 0x10b8], 0
jne 0x41f8ab
mov eax, dword [ebp - 0x10d4]
sub eax, dword [ebp - 0x1130]
mov ecx, dword [ebp - 0x1130]
mov dword [ebp - 0x1154], ecx
mov dword [ebp - 0x1158], eax
lea edx, [ebp - 0xc1c]
add edx, 0xffffffff
mov dword [ebp - 0x10f8], edx
mov eax, dword [ebp - 0x10f8]
mov cl, byte [eax + 1]
mov byte [ebp - 0x10b9], cl
add dword [ebp - 0x10f8], 1
cmp byte [ebp - 0x10b9], 0
jne 0x41f8f6
mov edi, dword [ebp - 0x10f8]
mov esi, dword [ebp - 0x1154]
mov edx, dword [ebp - 0x1158]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41f9dc
lea eax, [ebp - 0x140]
mov dword [ebp - 0x10d8], eax
mov ecx, dword [ebp - 0x10d8]
mov dword [ebp - 0x113c], ecx
mov edx, dword [ebp - 0x10d8]
mov al, byte [edx]
mov byte [ebp - 0x10ba], al
add dword [ebp - 0x10d8], 1
cmp byte [ebp - 0x10ba], 0
jne 0x41f952
mov ecx, dword [ebp - 0x10d8]
sub ecx, dword [ebp - 0x113c]
mov edx, dword [ebp - 0x113c]
mov dword [ebp - 0x115c], edx
mov dword [ebp - 0x1160], ecx
lea eax, [ebp - 0xc1c]
add eax, 0xffffffff
mov dword [ebp - 0x10f4], eax
mov ecx, dword [ebp - 0x10f4]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x10bf], dl
add dword [ebp - 0x10f4], 1
cmp byte [ebp - 0x10bf], 0
jne 0x41f99d
mov edi, dword [ebp - 0x10f4]
mov esi, dword [ebp - 0x115c]
mov eax, dword [ebp - 0x1160]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx ecx, byte [0x4456b9]
test ecx, ecx
je 0x41fa77
push 0x104
push 0
lea edx, [ebp - 0x348]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x44c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x44c]
push ecx
lea edx, [ebp - 0x1058]
push edx
lea eax, [ebp - 0x1054]
push eax
lea ecx, [ebp - 0x1040]
push ecx
push 0x104
lea edx, [ebp - 0x348]
push edx
push 0x434888
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 0x1188], eax
mov eax, dword [ebp - 0x1040]
push eax
lea ecx, [ebp - 0xc1c]
push ecx
push str._s_X
lea edx, [ebp - 0xc1c]
push edx
call fcn.00424a50
add esp, 0x10
movzx eax, byte [0x4456ba]
test eax, eax
je 0x41fd12
mov ecx, 9
mov esi, str..PhysicalDrive0
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x1114], 0x43fea8
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1048], 0
xor ecx, ecx
mov dword [ebp - 0x1044], ecx
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x10c8], edx
mov eax, dword [ebp - 0x10c8]
add eax, 2
mov dword [ebp - 0x1164], eax
mov ecx, dword [ebp - 0x10c8]
mov dx, word [ecx]
mov word [ebp - 0x1106], dx
add dword [ebp - 0x10c8], 2
cmp word [ebp - 0x1106], 0
jne 0x41fad5
mov eax, dword [ebp - 0x10c8]
sub eax, dword [ebp - 0x1164]
sar eax, 1
mov dword [ebp - 0x1168], eax
mov ecx, dword [ebp - 0x1168]
mov dword [ebp - 0x1128], ecx
mov edx, 1
test edx, edx
je 0x41fd12
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1110], eax
cmp dword [ebp - 0x1110], 0xffffffff
jne 0x41fb4d
jmp 0x41fd12
push 0
lea ecx, [ebp - 0x1050]
push ecx
push 0x1000
push 0x43fea8
push 0xc
lea edx, [ebp - 0x104c]
push edx
push 0x2d1400
mov eax, dword [ebp - 0x1110]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41fb84
jmp 0x41fd12
mov ecx, dword [ebp - 0x1114]
cmp dword [ecx + 0x18], 0
jbe 0x41fce6
mov edx, dword [ebp - 0x1114]
mov eax, dword [edx + 0x18]
add eax, 0x43fea8
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x10e0], 0
jmp 0x41fbc3
mov ecx, dword [ebp - 0x10e0]
add ecx, 1
mov dword [ebp - 0x10e0], ecx
mov edx, dword [ebp - 0x1120]
mov dword [ebp - 0x10dc], edx
mov eax, dword [ebp - 0x10dc]
add eax, 1
mov dword [ebp - 0x1170], eax
mov ecx, dword [ebp - 0x10dc]
mov dl, byte [ecx]
mov byte [ebp - 0x10bb], dl
add dword [ebp - 0x10dc], 1
cmp byte [ebp - 0x10bb], 0
jne 0x41fbde
mov eax, dword [ebp - 0x10dc]
sub eax, dword [ebp - 0x1170]
mov dword [ebp - 0x1174], eax
mov ecx, dword [ebp - 0x10e0]
cmp ecx, dword [ebp - 0x1174]
jae 0x41fc34
mov edx, dword [ebp - 0x1120]
add edx, dword [ebp - 0x10e0]
movsx eax, byte [edx]
cmp eax, 0x20
je 0x41fc32
jmp 0x41fc34
jmp 0x41fbb4
mov ecx, dword [ebp - 0x1114]
mov edx, dword [ecx + 0x18]
mov eax, dword [ebp - 0x10e0]
lea ecx, [edx + eax + 0x43fea8]
mov dword [ebp - 0x10e4], ecx
mov edx, dword [ebp - 0x10e4]
mov dword [ebp - 0x1124], edx
mov eax, dword [ebp - 0x10e4]
mov cl, byte [eax]
mov byte [ebp - 0x10bc], cl
add dword [ebp - 0x10e4], 1
cmp byte [ebp - 0x10bc], 0
jne 0x41fc5c
mov edx, dword [ebp - 0x10e4]
sub edx, dword [ebp - 0x1124]
mov eax, dword [ebp - 0x1124]
mov dword [ebp - 0x1178], eax
mov dword [ebp - 0x117c], edx
lea ecx, [ebp - 0xc1c]
add ecx, 0xffffffff
mov dword [ebp - 0x10ec], ecx
mov edx, dword [ebp - 0x10ec]
mov al, byte [edx + 1]
mov byte [ebp - 0x10bd], al
add dword [ebp - 0x10ec], 1
cmp byte [ebp - 0x10bd], 0
jne 0x41fca7
mov edi, dword [ebp - 0x10ec]
mov esi, dword [ebp - 0x1178]
mov edx, dword [ebp - 0x117c]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x1110]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1128]
mov dx, word [ebp + ecx*2 - 0x2e]
add dx, 1
mov eax, dword [ebp - 0x1128]
mov word [ebp + eax*2 - 0x2e], dx
jmp 0x41fb16
movzx ecx, byte [0x4456bc]
test ecx, ecx
je 0x41fd5d
lea edx, [ebp - 0x101c]
push edx
call fcn.00422800
add esp, 4
mov dword [ebp - 0x1180], eax
cmp dword [ebp - 0x1180], 1
jle 0x41fd5d
lea eax, [ebp - 0x101c]
push eax
lea ecx, [ebp - 0xc1c]
push ecx
push str._s_s
lea edx, [ebp - 0xc1c]
push edx
call fcn.00424a50
add esp, 0x10
movzx eax, byte [0x4456b8]
test eax, eax
jne 0x41fdfb
movzx ecx, byte [0x4456bb]
test ecx, ecx
jne 0x41fdfb
movzx edx, byte [0x4456b9]
test edx, edx
jne 0x41fdfb
movzx eax, byte [0x4456ba]
test eax, eax
jne 0x41fdfb
movzx ecx, byte [0x4456bc]
test ecx, ecx
jne 0x41fdfb
xor edx, edx
mov dword [ebp - 0x103c], edx
mov dword [ebp - 0x1038], edx
mov dword [ebp - 0x1034], edx
mov dword [ebp - 0x1030], edx
push 1
lea eax, [ebp - 0x103c]
push eax
call fcn.00422770
add esp, 8
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + edx - 0x103c]
push eax
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + edx - 0x103c]
push eax
push str._08X_08X
lea ecx, [ebp - 0xc1c]
push ecx
call fcn.00424a50
add esp, 0x10
movzx edx, byte [0x4457c4]
test edx, edx
jne 0x41fe31
mov eax, 1
imul ecx, eax, 0
mov dword [ebp - 0x112c], ecx
cmp dword [ebp - 0x112c], 2
jae 0x41fe1f
jmp 0x41fe24
call fcn.0041d81a
mov edx, dword [ebp - 0x112c]
mov byte [edx + 0x43c040], 0
cmp dword [ebp + 8], 0
je 0x41ff31
lea eax, [ebp - 0x10b0]
push eax
call fcn.0042ef40
add esp, 4
lea ecx, [ebp - 0xc1c]
mov dword [ebp - 0x10e8], ecx
mov edx, dword [ebp - 0x10e8]
add edx, 1
mov dword [ebp - 0x116c], edx
mov eax, dword [ebp - 0x10e8]
mov cl, byte [eax]
mov byte [ebp - 0x10be], cl
add dword [ebp - 0x10e8], 1
cmp byte [ebp - 0x10be], 0
jne 0x41fe65
mov edx, dword [ebp - 0x10e8]
sub edx, dword [ebp - 0x116c]
mov dword [ebp - 0x1144], edx
mov eax, dword [ebp - 0x1144]
push eax
lea ecx, [ebp - 0xc1c]
push ecx
lea edx, [ebp - 0x10b0]
push edx
call fcn.0042f7a0
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x10b0]
push ecx
call fcn.0042ee70
add esp, 8
mov dword [ebp - 0x10c4], 0
jmp 0x41fee0
mov edx, dword [ebp - 0x10c4]
add edx, 1
mov dword [ebp - 0x10c4], edx
cmp dword [ebp - 0x10c4], 0x10
jae 0x41ff17
mov eax, dword [ebp - 0x10c4]
cmp eax, dword [ebp + 0xc]
jae 0x41ff17
mov ecx, dword [ebp - 0x10c4]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx*2]
push eax
mov ecx, dword [ebp - 0x10c4]
movzx edx, byte [ebp + ecx - 0x3c]
push edx
call fcn.00422620
add esp, 8
jmp 0x41fed1
movzx eax, byte [0x4457c4]
test eax, eax
jne 0x41ff31
mov ecx, 1
shl ecx, 0
mov byte [ecx + 0x43c040], 6
mov edx, dword [ebp + 8]
mov dword [ebp - 0x110c], edx
mov eax, dword [0x43c790]
mov dword [ebp - 0x10f0], eax
mov ecx, dword [ebp - 0x10f0]
mov dword [ebp - 0x1190], ecx
mov edx, dword [ebp - 0x110c]
mov al, byte [edx]
mov byte [ebp - 0x10b4], al
mov ecx, dword [ebp - 0x10f0]
mov dl, byte [ebp - 0x10b4]
mov byte [ecx], dl
mov eax, dword [ebp - 0x110c]
add eax, 1
mov dword [ebp - 0x110c], eax
mov ecx, dword [ebp - 0x10f0]
add ecx, 1
mov dword [ebp - 0x10f0], ecx
cmp byte [ebp - 0x10b4], 0
jne 0x41ff51
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret