Function at 0x404e80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427648
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x439040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 6
push 0xfffffffffffffff5
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push eax
call esi
push str._Disk_Scanner__Running_checks_for_replaced_drives_bypass...
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.00401d40
add esp, 8
mov ecx, eax
push 0x4026c0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push str._Disk_Scanner__Running_checks_for_virtual_disk_bypasses...
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.00401d40
add esp, 8
mov ecx, eax
push 0x4026c0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 7
push 0xfffffffffffffff5
call edi
push eax
call esi
xor eax, eax
mov dword [ebp - 0x88], 0
xor esi, esi
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x70], eax
lea edi, [esi + 0x41]
test al, 1
je 0x404fdc
xorps xmm0, xmm0
mov dword [ebp - 0x18], 1
movups xmmword [ebp - 0x28], xmm0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], di
mov word [ebp - 0x26], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
cmp esi, dword [ebp - 0x90]
je 0x404f80
mov ecx, esi
call fcn.00404d40
add esi, 0x18
mov dword [ebp - 0x84], esi
jmp 0x404f9b
push esi
lea ecx, [ebp - 0x88]
call fcn.00404ac0
mov eax, dword [ebp - 0x80]
mov esi, dword [ebp - 0x84]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp ecx, 7
jbe 0x404fd9
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404fcf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405486
push ecx
push edx
call fcn.0042604c
add esp, 8
mov eax, dword [ebp - 0x70]
shr eax, 1
inc edi
mov dword [ebp - 0x70], eax
cmp di, 0x5a
jbe 0x404f37
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 0
mov edi, eax
mov esi, edx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x70], edx
push 0
push 0x3e8
push esi
push edi
call fcn.004263d0
sub dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x88]
mov edi, eax
sbb dword [ebp - 0x70], edx
mov esi, dword [ebp - 0x84]
mov dword [ebp - 0x94], eax
cmp edi, esi
je 0x405429
nop dword [eax]
cmp dword [edi + 0x14], 7
mov ecx, edi
mov esi, dword [edi + 0x10]
mov dword [ebp - 0x6c], esi
jbe 0x405050
mov ecx, dword [edi]
cmp esi, 1
jne 0x405081
mov eax, 0x42a98c
sub ecx, eax
mov dword [ebp - 0x68], ecx
nop
movzx edx, word [ecx + eax]
movzx ecx, word [eax]
cmp dx, cx
jne 0x40507c
mov ecx, dword [ebp - 0x68]
add eax, 2
sub esi, 1
jne 0x405060
jmp 0x40540c
mov esi, dword [ebp - 0x6c]
jmp 0x405091
mov eax, SysReAllocString
sub eax, esi
cmp eax, 2
jb 0x4054b1
cmp dword [edi + 0x14], 7
mov dword [ebp - 0x6c], edi
jbe 0x40509f
mov eax, dword [edi]
mov dword [ebp - 0x6c], eax
lea ecx, [esi + 2]
mov edx, 7
mov dword [ebp - 0x74], ecx
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x68], eax
movups xmmword [ebp - 0x28], xmm0
cmp ecx, edx
jbe 0x4050f7
mov eax, ecx
or eax, edx
cmp eax, 0x7ffffffe
jbe 0x4050cd
mov eax, SysReAllocString
jmp 0x4050d8
cmp eax, 0xa
mov ecx, 0xa
cmovb eax, ecx
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00402010
mov edx, dword [ebp - 0x7c]
lea ecx, [esi + 2]
add esp, 8
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x28], eax
add esi, esi
mov dword [ebp - 0x18], ecx
push esi
push dword [ebp - 0x6c]
mov dword [ebp - 0x14], edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x68]
xor edx, edx
mov ecx, dword [ebp - 0x74]
add esp, 0xc
mov dword [esi + eax], 0x5c003a
mov word [eax + ecx*2], dx
mov ecx, dword [ebp - 0x18]
mov eax, SysReAllocString
sub eax, ecx
mov byte [ebp - 4], 2
cmp eax, 0x19
jb 0x4054b1
cmp dword [ebp - 0x14], 7
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
lea esi, [ecx + 0x19]
cmova edx, eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x74], edx
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x68], 7
mov dword [ebp - 0x6c], eax
movups xmmword [ebp - 0x40], xmm0
cmp esi, 7
jbe 0x4051b9
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x405189
mov eax, SysReAllocString
jmp 0x405194
cmp eax, 0xa
mov ecx, 0xa
cmovb eax, ecx
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00402010
mov ecx, dword [ebp - 0x68]
add esp, 8
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x68], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], esi
mov esi, dword [ebp - 0x68]
mov dword [ebp - 0x2c], esi
lea esi, [ecx + ecx]
push esi
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [0x42a990]
mov ecx, dword [ebp - 0x6c]
xor edx, edx
add esp, 0xc
movups xmmword [esi + ecx], xmm0
movups xmm0, xmmword [0x42a9a0]
movups xmmword [esi + ecx + 0x10], xmm0
movups xmm0, xmmword [0x42a9b0]
movups xmmword [esi + ecx + 0x20], xmm0
mov ax, word [0x42a9c0]
mov word [esi + ecx + 0x30], ax
mov eax, dword [ebp - 0x18]
mov word [ecx + eax*2 + 0x32], dx
cmp dword [ebp - 0x2c], 7
lea ecx, [ebp - 0x64]
push ecx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
cmova eax, dword [ebp - 0x40]
xorps xmm0, xmm0
push edx
push eax
movups xmmword [ebp - 0x64], xmm0
mov dword [ebp - 0x44], edx
movups xmmword [ebp - 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x4052b0
mov eax, dword [ebp - 0x50]
mov edx, 0xe57a42bd
mul edx
mov edi, 0xd6bf94d5
mov ecx, 0xe57a42bd
mov dword [ebp - 0x78], eax
mov esi, edx
mov eax, dword [ebp - 0x50]
mul edi
mov edi, eax
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 0x4c]
mul ecx
mov ecx, eax
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x4c]
mov edx, 0xd6bf94d5
mul edx
add ecx, esi
mov dword [ebp - 0x7c], edx
mov edx, dword [ebp - 0x74]
adc edx, 0
mov dword [ebp - 0x6c], eax
mov esi, dword [ebp - 0x6c]
add edi, ecx
mov ecx, dword [ebp - 0x68]
adc ecx, 0
mov dword [ebp - 0x78], edi
mov edi, dword [ebp - 0x94]
xor eax, eax
add edx, ecx
mov ecx, dword [ebp - 0x7c]
adc eax, eax
add esi, edx
adc ecx, eax
shrd esi, ecx, 0x17
shr ecx, 0x17
sub esi, 0xb6109100
sbb ecx, 2
jmp 0x4052be
xorps xmm0, xmm0
movlpd qword [ebp - 0x78], xmm0
mov ecx, dword [ebp - 0x74]
mov esi, dword [ebp - 0x78]
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x9c], ecx
cmp ecx, dword [ebp - 0x70]
jl 0x40537a
jg 0x4052e1
cmp esi, dword [ebp - 0x8c]
jbe 0x40537a
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
push str.____Warning:_Disk
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.00404830
add esp, 0x10
mov ecx, edi
cmp dword [edi + 0x14], 7
jbe 0x40530f
mov ecx, dword [edi]
push dword [edi + 0x10]
push ecx
push eax
call fcn.00402230
push str._was_installed_at:
push eax
call fcn.00404830
lea ecx, [ebp - 0x64]
mov dword [ebp - 0xa8], 0x42a9ec
mov dword [ebp - 0xac], ecx
add esp, 0x14
mov ecx, 0x42a9ec
nop
add ecx, 2
cmp word [ecx], 0
jne 0x405340
mov dword [ebp - 0xa4], ecx
lea ecx, [ebp - 0xac]
push str.._This_is_bannable.
push ecx
push eax
call fcn.00404610
add esp, 8
push eax
call fcn.00404830
add esp, 8
mov ecx, eax
push 0x4026c0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 2
cmp ecx, 7
jbe 0x4053b8
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4053ae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405486
push ecx
push edx
call fcn.0042604c
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 7
cmp eax, 7
jbe 0x40540c
mov edx, dword [ebp - 0x98]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405402
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405486
push ecx
push edx
call fcn.0042604c
add esp, 8
mov esi, dword [ebp - 0x84]
add edi, 0x18
mov dword [ebp - 0x94], edi
cmp edi, esi
jne 0x405040
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x405496
mov edi, eax
cmp edi, esi
je 0x405447
mov ecx, edi
call fcn.00403dc0
add edi, 0x18
cmp edi, esi
jne 0x405433
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x90]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x88]
lea ecx, [eax + eax*2]
mov eax, edx
shl ecx, 3
cmp ecx, 0x1000
jb 0x40548c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40548c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042604c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426399
mov esp, ebp
pop ebp
ret
call fcn.00403e20
int3