Function at 0x402310
Capabilities:
Get disk information
Get volume information via ioctl

Disassembly:
sub esp, 0x584
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x580], eax
push ebx
push ebp
mov ebp, dword [esp + 0x590]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x181]
push ebx
push eax
mov byte [esp + 0x188], bl
call fcn.0046bf90
push 0x103
lea ecx, [esp + 0x89]
push ebx
push ecx
mov byte [esp + 0x90], bl
call fcn.0046bf90
or eax, 0xffffffff
add esp, 0x18
cmp dword [0x4dce90], 6
mov byte [esp + 8], bl
mov byte [esp + 9], 0x3a
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], bl
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
jge 0x4023bc
cmp dword [esp + 0x594], ebx
jne 0x4023a3
push ebx
push str.OS_NOT_SUPPORTED_FOR_NONSYS_INPLACE_ENC
call fcn.00401b80
add esp, 8
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x580]
xor ecx, esp
call fcn.0046be7b
add esp, 0x584
ret
lea edx, [esp + 0xc]
push edx
push str.DeviceHarddiskVolume_d
push ebp
call fcn.0046c2c8
add esp, 0xc
cmp eax, 1
je 0x402420
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x48f8fc
push ebp
call fcn.0046c2c8
add esp, 0x10
cmp eax, 2
je 0x402420
cmp dword [esp + 0x594], ebx
jne 0x402407
push str.INPLACE_ENC_INVALID_PATH
call fcn.00433d70
add esp, 4
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x580]
xor ecx, esp
call fcn.0046be7b
add esp, 0x584
ret
cmp dword [esp + 0xc], ebx
jne 0x402455
cmp dword [esp + 0x594], ebx
jne 0x402407
push str.RAW_DEV_NOT_SUPPORTED_FOR_INPLACE_ENC
call fcn.00433d10
add esp, 4
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x580]
xor ecx, esp
call fcn.0046be7b
add esp, 0x584
ret
push edi
call sub.SHELL32.dll_IsUserAnAdmin
mov edi, dword [esp + 0x598]
test eax, eax
jne 0x402477
cmp edi, ebx
jne 0x402477
push str.ADMIN_PRIVILEGES_WARN_DEVICES
call fcn.00433d10
add esp, 4
lea edx, [esp + 0x384]
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x402482
lea edx, [esp + 0x384]
push edx
call fcn.00430d20
lea eax, [esp + 0x388]
push eax
call fcn.004334f0
add esp, 8
cmp eax, ebx
jl 0x4024b3
add al, 0x41
mov byte [esp + 0xc], al
push ebx
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x188]
push edx
push ebp
call fcn.00430590
add esp, 0x10
test eax, eax
je 0x402507
cmp edi, ebx
jne 0x4024ed
mov eax, dword [0x4dce6c]
push eax
call fcn.00434ad0
push str.INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL
call fcn.00433d70
add esp, 8
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x580]
xor ecx, esp
call fcn.0046be7b
add esp, 0x584
ret
push esi
push ebx
push SysReAllocStringLen
push 3
push ebx
push 3
push 0xc0000000
lea ecx, [esp + 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402553
cmp edi, ebx
jne 0x40271b
mov edx, dword [0x4dce6c]
push edx
call fcn.00434ad0
push str.INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL
call fcn.00433d70
add esp, 8
jmp 0x40271b
push 0x100
lea eax, [esp + 0x28c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 4
lea edx, [esp + 0x28c]
push 0x48f890
push edx
call fcn.0046c19e
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
add esp, 0xc
test eax, eax
je 0x4025ea
push ebx
lea eax, [esp + 0x20]
push eax
push 0x60
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push 0x90064
push esi
call edi
test eax, eax
jne 0x4025ea
cmp dword [esp + 0x59c], ebx
jne 0x402714
lea edx, [esp + 0x80]
push edx
call fcn.00433230
add esp, 4
test eax, eax
je 0x4025d8
push ebx
push str.ONLY_NTFS_SUPPORTED_FOR_NONSYS_INPLACE_ENC
jmp 0x40270c
push str.ONLY_MOUNTED_VOL_SUPPORTED_FOR_NONSYS_INPLACE_ENC
call fcn.00433d10
add esp, 4
jmp 0x402714
mov eax, dword [esp + 0x59c]
push eax
push ebx
xor ebx, ebx
mov edx, esi
call fcn.00401730
and eax, edx
add esp, 8
cmp eax, 0xffffffff
jne 0x40261f
cmp dword [esp + 0x59c], ebx
jne 0x402714
push 1
push str.INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL_ALT
jmp 0x40270c
push ebp
call fcn.00433650
add esp, 4
test edx, edx
jg 0x402677
jl 0x402632
test eax, eax
jae 0x402651
cmp dword [esp + 0x59c], ebx
jne 0x402714
push str.INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL
call fcn.00433d70
add esp, 4
jmp 0x402714
test edx, edx
jg 0x402677
jl 0x40265e
cmp eax, 0x728000
jae 0x402677
cmp dword [esp + 0x59c], ebx
jne 0x402714
push 0
push str.PARTITION_TOO_SMALL_FOR_NONSYS_INPLACE_ENC
jmp 0x40270c
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x60
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0x90064
push esi
call edi
test eax, eax
jne 0x4026a7
cmp dword [esp + 0x59c], ebx
jne 0x402714
push 1
push str.INPLACE_ENC_CANT_ACCESS_OR_GET_INFO_ON_VOL
jmp 0x40270c
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x4c]
push eax
push ecx
push 0
push edx
call fcn.0046bca0
test edx, edx
jg 0x4026dc
jl 0x4026ca
cmp eax, 0x40000
jae 0x4026dc
cmp dword [esp + 0x59c], ebx
jne 0x402714
push 1
push str.NOT_ENOUGH_FREE_FILESYS_SPACE_FOR_SHRINK
jmp 0x40270c
mov eax, dword [esp + 0x48]
cmp eax, 0x1000
ja 0x4026fc
test eax, 0x1ff
jne 0x4026fc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x40271d
cmp dword [esp + 0x59c], ebx
jne 0x402714
push 1
push str.SECTOR_SIZE_UNSUPPORTED
call fcn.00401b80
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x590]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046be7b
add esp, 0x584
ret