Function at 0x403db0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x54
xor eax, eax
push ebx
push ebp
push esi
push edi
xor esi, esi
xor ecx, ecx
xor edx, edx
push 0x411f2c
mov word [esp + 0x44], ax
mov dword [esp + 0x46], eax
mov word [esp + 0x4a], ax
mov dword [esp + 0x30], esi
xor edi, edi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov word [esp + 0x34], cx
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
mov word [esp + 0x3c], dx
mov dword [esp + 0x3e], eax
mov word [esp + 0x42], ax
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
cmp ebp, esi
jne 0x403e62
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push esi
push esi
push eax
call fcn.0040e710
mov esi, eax
add esi, 0x1270000
mov edi, edx
adc edi, 0x15
push edi
push esi
push 0x128
push str..GetSystemVolume.cpp
push str._S__d_nRet0x_016llX_n
call fcn.00401850
add esp, 0x14
jmp 0x403fbf
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtOpenSymbolicLinkObject
push ebp
call ebx
push str.NtQuerySymbolicLinkObject
push ebp
mov dword [esp + 0x30], eax
call ebx
push str.NtClose
push ebp
mov dword [esp + 0x28], eax
call ebx
push str.RtlInitUnicodeString
push ebp
mov dword [esp + 0x20], eax
call ebx
push str.RtlUnicodeStringToAnsiString
push ebp
mov dword [esp + 0x24], eax
call ebx
push str.RtlInitAnsiString
push ebp
mov dword [esp + 0x2c], eax
call ebx
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4040a5
cmp dword [esp + 0x20], esi
je 0x4040a5
cmp dword [esp + 0x18], esi
je 0x4040a5
cmp dword [esp + 0x24], esi
je 0x4040a5
test eax, eax
je 0x4040a5
mov eax, dword [esp + 0x6c]
push eax
lea ecx, [esp + 0x3c]
push ecx
call dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x48]
push eax
push 0x80000000
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x40]
push ecx
mov dword [esp + 0x54], 0x18
mov dword [esp + 0x60], 0x50
mov dword [esp + 0x5c], edx
call ebx
test eax, eax
je 0x403f55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push 0
push 0
push eax
call fcn.0040e710
mov esi, eax
add esi, 0x1510000
mov edi, edx
adc edi, 0x15
push edi
push esi
push 0x152
jmp 0x403e4b
xor ecx, ecx
mov eax, 0x104
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00404cb2
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x403fe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push ebx
push ebx
push eax
call fcn.0040e710
mov esi, eax
add esi, 0x1590000
mov edi, edx
adc edi, 3
push edi
push esi
push 0x15a
push str..GetSystemVolume.cpp
push str._S__d_nRet0x_016llX_n
call fcn.00401850
add esp, 0x14
test ebx, ebx
je 0x403fbf
push ebx
call fcn.004049ec
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x403fcd
push eax
call dword [esp + 0x1c]
test ebp, ebp
je 0x403fd8
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 8
push str.deviceharddisk000partition000winnt
push ebx
mov edx, 0x104
call fcn.004041c0
add esp, 8
push ebx
lea eax, [esp + 0x34]
push eax
call dword [esp + 0x24]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
push eax
call dword [esp + 0x2c]
test eax, eax
je 0x404048
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push 0
push 0
push eax
call fcn.0040e710
mov esi, eax
add esi, 0x1670000
mov edi, edx
adc edi, 0x15
push edi
push esi
push 0x168
jmp 0x403fa0
push 1
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x48]
push edx
call dword [esp + 0x30]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x68]
push 0x104
push eax
push ecx
call fcn.00405063
add esp, 0xc
test eax, eax
ja 0x403fb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push 0
push 0
push eax
call fcn.0040e710
mov esi, eax
add esi, 0x16f0000
mov edi, edx
adc edi, 0xe
push edi
push esi
push 0x170
jmp 0x403fa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push 0
push 0
push eax
call fcn.0040e710
mov esi, eax
add esi, 0x13b0000
mov edi, edx
adc edi, 0xb
push edi
push esi
push 0x13c
jmp 0x403e4b