Function at 0x4050af
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x32e4
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x32d4], 0
push edi
mov edi, str.BitlockerRecoverKeys
mov dword [ebp - 0x32d0], 0x5c3a41
push edi
push str._s_Entered
call fcn.00449974
cmp dword [0x715f80], 0
pop ecx
pop ecx
jne 0x4050fe
push edi
push str._s_WMI_is_not_initialized_at_init....returning
jmp 0x40557d
lea eax, [ebp - 0x32d4]
push eax
push str.ROOTCIMV2SecurityMicrosoftVolumeEncryption
call fcn.00447970
pop ecx
pop ecx
test eax, eax
je 0x405129
push eax
push edi
push str._s_Failed_to_get_Bitlocker_namespace__MicrosoftVolumeEncryption_...Error_code__0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x405560
push ebx
push esi
push edi
push str._s_Successfully_got_Bitlocker_WMI_namespace
call fcn.00449974
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
push esi
push edi
push str._s_dwDriveMask0x_.8x
mov dword [ebp - 0x32d8], esi
call fcn.00449974
add esp, 0xc
xor ebx, ebx
xor eax, eax
mov ecx, ebx
inc eax
shl eax, cl
test esi, eax
je 0x405547
lea eax, [ebx + 0x41]
mov byte [ebp - 0x32d0], al
lea eax, [ebp - 0x32d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
cmp esi, 3
je 0x40518c
cmp esi, 2
jne 0x405541
push 0x3e8
lea eax, [ebp - 0x3ec]
mov byte [ebp - 0x3ec], 0
push eax
lea eax, [ebp - 0x32d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
jne 0x4051d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x32d0]
push eax
push edi
push str._s_Failed_to_get_VolumeId_for_Drive_s__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x405541
lea eax, [ebp - 0x3ec]
push eax
push esi
lea eax, [ebp - 0x32d0]
push eax
push edi
push str._n_n_s_Found_Volume_Id_for_drive_s__Type_d__Volume_Id_s
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
add esp, 0x18
mov ecx, 0x3e8
dec eax
cmp eax, ecx
jae 0x405591
mov byte [ebp + eax - 0x3ec], 0
xor eax, eax
push ecx
mov word [ebp - 0x1b5c], ax
lea eax, [ebp - 0x1b5c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3ec]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x405255
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._n_s_:_Failed_to_convert_volume_string_to_unicode__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x405541
lea eax, [ebp - 0x1b5c]
push eax
push dword [ebp - 0x32d4]
call fcn.004473ab
pop ecx
pop ecx
test eax, eax
lea eax, [ebp - 0x32d0]
push eax
push edi
jne 0x40527c
push str._s_This_Drive___s__is_not_Protected_by_Bitlocker...returning
jmp 0x405248
push str._s_Drive__s_is_Protected_by_Bitlocker...now_getting_ID__keys
call fcn.00449974
lea eax, [ebp - 0x32e4]
mov dword [ebp - 0x32e4], 0xa
push eax
push 0
lea eax, [ebp - 0x1b5c]
push eax
push dword [ebp - 0x32d4]
call fcn.00405597
add esp, 0x1c
test eax, eax
jne 0x4052c4
push edi
push str._s_Failed_to_get_Key_Protector_IDs_for_this_volume
call fcn.00449974
pop ecx
pop ecx
jmp 0x405541
mov edi, dword [ebp - 0x32e4]
push edi
push str.BitlockerRecoverKeys
push str._s_Total_Key_Protectors_found___d
call fcn.00449974
add esp, 0xc
test edi, edi
je 0x40553c
mov esi, 0x7105a8
and dword [ebp - 0x32e0], 0
lea eax, [ebp - 0x32dc]
push eax
lea eax, [ebp - 0x32cc]
mov dword [ebp - 0x32dc], 0x3e8
push eax
lea eax, [ebp - 0x32e0]
push eax
push esi
lea eax, [ebp - 0x1b5c]
push eax
push dword [ebp - 0x32d4]
call fcn.0044717b
add esp, 0x18
test eax, eax
je 0x40534d
lea eax, [ebp - 0x32cc]
push eax
push dword [ebp - 0x32e0]
push esi
push str.ID_S__Type___d__S
call fcn.00449974
mov eax, dword [ebp - 0x32e0]
add esp, 0x10
jmp 0x405355
xor eax, eax
mov dword [ebp - 0x32e0], eax
sub eax, 0
je 0x405445
sub eax, 1
je 0x405380
dec eax
sub eax, 1
je 0x405445
sub eax, 1
je 0x405380
sub eax, 1
je 0x405380
sub eax, 1
jne 0x40552d
xor eax, eax
mov dword [ebp - 0x32dc], 0x3e8
mov word [ebp - 0x232c], ax
lea eax, [ebp - 0x32dc]
push eax
lea eax, [ebp - 0x232c]
push eax
push esi
lea eax, [ebp - 0x1b5c]
push eax
push dword [ebp - 0x32d4]
call fcn.00447432
add esp, 0x14
test eax, eax
je 0x40552d
lea eax, [ebp - 0x232c]
push eax
push esi
push str.TPM_ID:__S___nPCR_Validation_Profile:__S
call fcn.00449974
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x32d0]
push eax
call fcn.00448c89
movsx eax, byte [ebp - 0x32d0]
push eax
lea eax, [ebp - 0x7d4]
push eax
push str._s___c:_
lea eax, [ebp - 0x138c]
push 0x3e8
push eax
call fcn.00445d6d
push esi
push str.ID_S
lea eax, [ebp - 0xfa4]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x232c]
push eax
push str._TPM_PCR_Profile___S
lea eax, [ebp - 0xbbc]
push 0x3e8
push eax
call fcn.00445d6d
add esp, 0x48
jmp 0x405500
lea eax, [ebp - 0x32dc]
mov dword [ebp - 0x32dc], 0x3e8
push eax
lea eax, [ebp - 0x2afc]
push eax
push esi
lea eax, [ebp - 0x1b5c]
push eax
push dword [ebp - 0x32d4]
call fcn.00446fbc
add esp, 0x14
test eax, eax
je 0x40552d
lea eax, [ebp - 0x2afc]
push eax
push esi
push str.Numerical_Password_ID:__S___nRecovery_Key:__S
call fcn.00449974
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x32d0]
push eax
call fcn.00448c89
movsx eax, byte [ebp - 0x32d0]
push eax
lea eax, [ebp - 0x7d4]
push eax
push str._s___c:_
lea eax, [ebp - 0x138c]
push 0x3e8
push eax
call fcn.00445d6d
push esi
push str.ID_S
lea eax, [ebp - 0xfa4]
push 0x3e8
push eax
call fcn.00445d6d
add esp, 0x38
lea eax, [ebp - 0xbbc]
xor ecx, ecx
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2afc]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0xbbc]
push ecx
push eax
lea eax, [ebp - 0xfa4]
push eax
lea eax, [ebp - 0x138c]
push eax
push ecx
push 0x1f6
push 0xc
call fcn.00412c85
add esp, 0x20
add esi, 0x7d0
sub edi, 1
jne 0x4052ea
mov edi, str.BitlockerRecoverKeys
mov esi, dword [ebp - 0x32d8]
inc ebx
cmp ebx, 0x1a
jb 0x405157
push edi
push str._s_All_drives_checking_completed
call fcn.00449974
pop ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x32d4]
test ecx, ecx
je 0x405577
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [ebp - 0x32d4], 0
push edi
push str._s_Finished
call fcn.00449974
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3