Function at 0x404330
Capabilities:
Unmount volume via ioctl

Disassembly:
sub esp, 0x46c
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x468], eax
push ebx
mov ebx, dword [esp + 0x474]
push ebp
push edi
xor ebp, ebp
push 0x103
lea eax, [esp + 0x16d]
push ebp
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], 0xffffffff
mov byte [esp + 0x174], 0
call fcn.0046bf90
push 0x103
lea ecx, [esp + 0x75]
push ebp
push ecx
mov byte [esp + 0x7c], 0
call fcn.0046bf90
mov edi, 1
mov dword [0x4b94e8], edi
mov edx, dword [ebx + 8]
push ebp
push edx
call fcn.00402310
add esp, 0x20
test eax, eax
jne 0x4043cb
pop edi
lea eax, [ebp + 0x1c]
pop ebp
pop ebx
mov ecx, dword [esp + 0x468]
xor ecx, esp
call fcn.0046be7b
add esp, 0x46c
ret
push 0x200
call fcn.0046bdb1
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebp
jne 0x4043fd
pop edi
pop ebp
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x468]
xor ecx, esp
call fcn.0046be7b
add esp, 0x46c
ret
push esi
push 0x200
push eax
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov eax, dword [ebx + 8]
push eax
call fcn.00433650
add esp, 4
cmp edx, ebp
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], edx
jg 0x404452
jl 0x404428
cmp eax, ebp
jae 0x404432
mov edi, 0x1e
jmp 0x40499d
cmp edx, ebp
jg 0x404452
jl 0x40443f
cmp eax, 0x728000
jae 0x404452
push edi
push str.PARTITION_TOO_SMALL_FOR_NONSYS_INPLACE_ENC
call fcn.00401b80
add esp, 8
jmp 0x404998
mov ecx, dword [ebx + 4]
push edx
push eax
push ecx
call fcn.00448870
mov ecx, dword [ebx + 8]
mov dword [esp + 0x40], edx
add esp, 0xc
mov dword [esp + 0x30], eax
lea edx, [esp + 0x270]
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
test al, al
jne 0x404472
lea edx, [esp + 0x270]
push edx
call fcn.00430d20
lea eax, [esp + 0x274]
push eax
call fcn.004334f0
push ebp
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x17c]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 8]
push edx
push eax
call fcn.00430590
add esp, 0x18
test eax, eax
jne 0x40499d
lea ecx, [esp + 0x68]
push ecx
call fcn.00433230
add esp, 4
test eax, eax
je 0x40498b
push ebp
push SysReAllocStringLen
push 3
push ebp
push 3
push 0xc0000000
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404519
mov eax, dword [0x4dce6c]
push eax
call fcn.00434ad0
push str.INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL
call fcn.00433d70
add esp, 8
mov dword [esp + 0x24], esi
jmp 0x404998
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebp
lea ecx, [esp + 0x2c]
push ecx
push ebp
push ebp
push ebp
push ebp
push 0x90083
push esi
mov dword [esp + 0x44], esi
call edi
test eax, eax
jne 0x404559
mov edx, dword [0x4dce6c]
push edx
call fcn.00434ad0
push 1
push str.INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL_ALT
call fcn.00401b80
add esp, 0xc
jmp 0x404998
mov eax, dword [ebx + 8]
lea ecx, [esp + 0x50]
push ebp
push ecx
lea ebx, [esp + 0x68]
mov edx, esi
call fcn.00401730
mov ecx, eax
and ecx, edx
add esp, 8
cmp ecx, 0xffffffff
jne 0x40458d
push 1
push str.INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL_ALT
call fcn.00401b80
add esp, 8
jmp 0x404998
xor ecx, ecx
xor ebp, ebp
push ebp
mov dword [esp + 0x50], ecx
mov dword [esp + 0x50], edx
lea edx, [esp + 0x2c]
push edx
push ebp
push ebp
mov dword [esp + 0x58], ecx
push 0x18
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x4c]
push eax
push 0x901b0
mov dword [esp + 0x54], ecx
push esi
mov dword [0x4b94e8], 2
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x58], 1
call edi
test eax, eax
jne 0x4045fe
mov ecx, dword [0x4dce6c]
push ecx
call fcn.00434ad0
push 1
push str.CANNOT_RESIZE_FILESYS
call fcn.00401b80
add esp, 0xc
jmp 0x404998
push ebp
lea edx, [esp + 0x2c]
push edx
push ebp
push ebp
push 0x18
lea eax, [esp + 0x4c]
push eax
push 0x901b0
push esi
xor ebx, ebx
mov dword [esp + 0x58], 2
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ebp
call edi
test eax, eax
jne 0x4046c0
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x404733
cmp ebx, ebp
jne 0x404742
mov ecx, dword [esp + 0x50]
cmp ecx, 0x40000
jbe 0x40465a
mov eax, 1
jmp 0x404663
mov eax, 0x40000
xor edx, edx
div ecx
mov edx, dword [esp + 0x60]
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x64]
sbb eax, ecx
push eax
push edx
lea ecx, [esp + 0x278]
push ecx
push esi
call fcn.00404270
add esp, 0x10
test eax, eax
je 0x40472a
push ebp
lea edx, [esp + 0x2c]
push edx
push ebp
push ebp
push 0x18
lea eax, [esp + 0x4c]
push eax
push 0x901b0
push esi
mov ebx, 1
mov dword [esp + 0x58], 2
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ebp
call edi
test eax, eax
je 0x404630
mov eax, dword [esp + 0x14]
mov ecx, dword [0x4dce6c]
push eax
push ecx
mov dword [0x4b94e8], 1
call fcn.00431fa0
add esp, 8
push 0
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
push 0
push 0x90018
push esi
mov ebx, 0x12c
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x404770
test ebx, ebx
jle 0x404756
push 0x32
call ebp
push 0
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push 0
push 0x90018
push esi
dec ebx
call edi
test eax, eax
je 0x404704
jmp 0x404770
mov ecx, dword [0x4dce6c]
push ecx
jmp 0x40473a
mov edx, dword [0x4dce6c]
push edx
call fcn.00434ad0
add esp, 4
push 1
push str.CANNOT_RESIZE_FILESYS
call fcn.00401b80
add esp, 8
jmp 0x404998
test eax, eax
jne 0x404770
push str.VOL_LOCK_FAILED_OFFER_FORCED_DISMOUNT
call fcn.00433e50
add esp, 4
cmp eax, 7
je 0x404998
push 0
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push 0
push 0
push 0x90020
push esi
mov ebx, 0x12c
call edi
test eax, eax
jne 0x4047b4
test ebx, ebx
jle 0x404809
push 0x32
call ebp
push 0
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
push 0
push 0x90020
push esi
dec ebx
call edi
test eax, eax
je 0x404790
mov eax, dword [esp + 0x488]
neg eax
sbb eax, eax
and eax, 0xff
inc eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x54], eax
test eax, eax
jle 0x4048e4
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
add ebx, 0x20000
adc ebp, 0
mov edi, edi
xor ecx, ecx
cmp dword [esp + 0x488], ecx
je 0x404803
cmp eax, 0xff
setl cl
test eax, eax
jne 0x404821
jmp 0x40482a
test eax, eax
jne 0x4047b4
push 1
push str.INPLACE_ENC_CANT_LOCK_OR_DISMOUNT_FILESYS
call fcn.00401b80
add esp, 8
jmp 0x404998
mov eax, dword [esp + 0x10]
add eax, 0x41a8
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x3c]
push edx
mov edx, dword [ecx + 0x28]
or edx, 2
push edx
mov edx, dword [esp + 0x40]
push 0
push 0
push 0
push ebp
push ebx
push 0
push 0
push edx
mov edx, dword [esp + 0x5c]
push edx
lea edx, [esp + 0x40]
push edx
push eax
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x44]
push eax
mov eax, dword [ecx + 0x20]
mov ecx, dword [esp + 0x58]
push edx
push 1
push eax
push ecx
push 0
call fcn.00459490
mov edi, eax
add esp, 0x50
test edi, edi
jne 0x40499d
push edi
push edi
mov ecx, ebp
push ecx
mov eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x404984
mov edx, dword [esp + 0x1c]
push edx
push esi
push 1
call fcn.00459e60
add esp, 0xc
test eax, eax
je 0x404984
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
push 1
push edi
push eax
push ecx
push edx
push esi
call fcn.00459fc0
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x40499d
mov eax, dword [esp + 0x14]
inc eax
cmp eax, dword [esp + 0x54]
mov dword [esp + 0x14], eax
jl 0x4047f0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x44]
push edx
push ecx
push 0
lea edx, [esp + 0x24]
push edx
push eax
mov eax, esi
call fcn.00401f20
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x40499d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov eax, dword [ecx + 0x4450]
mov edi, dword [edx + 0x4450]
mov ecx, dword [ecx + 0x4454]
cmp edi, eax
jne 0x404428
mov edx, dword [edx + 0x4454]
cmp edx, ecx
jne 0x404428
or eax, ecx
je 0x404428
call fcn.00401a20
mov edi, eax
test edi, edi
jne 0x40499d
mov eax, dword [esp + 0x488]
push eax
push 1
call fcn.00401cc0
add esp, 8
call fcn.00437a30
test eax, eax
jne 0x404980
push str._prinplace
push eax
call fcn.00433a30
add esp, 8
xor edi, edi
jmp 0x40499d
mov edi, 1
jmp 0x40499d
push str.ONLY_MOUNTED_VOL_SUPPORTED_FOR_NONSYS_INPLACE_ENC
call fcn.00433d70
add esp, 4
mov edi, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [esp + 0x10]
xor esi, esi
cmp eax, esi
je 0x4049bc
push eax
call fcn.0042c060
add esp, 4
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x4049d1
push eax
call fcn.0042c060
add esp, 4
mov dword [esp + 0x18], esi
mov ebx, dword [esp + 0x1c]
mov ecx, 0x200
mov edx, ebx
mov esi, ecx
mov eax, ebx
mov byte [eax], 0
inc eax
sub esi, 1
jne 0x4049e0
pop esi
lea ebx, [ebx]
dec ecx
mov byte [edx], 0
inc edx
test ecx, ecx
jne 0x4049f0
push 0x200
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push ebx
call fcn.0046bcd4
add esp, 4
cmp byte [esp + 0x168], 0
je 0x404a30
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 8]
lea ecx, [esp + 0x168]
push ecx
push eax
call fcn.004305f0
add esp, 8
mov ecx, dword [esp + 0x480]
mov edx, dword [esp + 0x20]
mov dword [ecx], edx
test edi, edi
je 0x404a48
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x474]
mov eax, edi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046be7b
add esp, 0x46c
ret