Function at 0x408b0c
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ecx, 0x20
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x368]
xor esi, esi
push ebx
sub esp, 0x3ac
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x378], esi
mov dword [ebp - 0x380], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x384], eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x374]
mov dword [esp + 4], 0x10
mov dword [esp], eax
call fcn.0043d61c
cmp dword [ebp + 8], 0
jns 0x408b64
xor esi, esi
jmp 0x4090d2
mov eax, dword [ebp + 8]
add eax, 0xffffff80
mov dword [ebp - 0x388], eax
cmp eax, 0x40
jbe 0x408b91
mov dword [esp + 8], 0x109
mov dword [esp + 4], str.drive.c
mov dword [esp], str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
jmp 0x408c7d
mov dword [ebp - 0x37c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x394], ebx
mov dword [ebp - 0x390], 1
cmp dword [ebp - 0x394], 0
lea eax, [ebp - 0x220]
jne 0x408bfc
mov dword [esp + 4], 0x104
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeA]
push ecx
push ecx
mov dword [ebp - 0x37c], eax
inc eax
jne 0x408c51
cmp dword [ebp + 0x18], 0
jne 0x408b5d
call fcn.0043f53d
mov dword [esp], str.Could_not_access_first_GUID_volume:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x408b5d
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x37c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_FindNextVolumeA]
sub esp, 0xc
test eax, eax
jne 0x408c51
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
je 0x408fc1
cmp dword [ebp + 0x18], 0
jne 0x408fc1
call fcn.0043f53d
mov dword [esp], str.Could_not_access_next_GUID_volume:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x408fc1
lea esi, [ebp - 0x220]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov edi, eax
cmp eax, 4
ja 0x408c83
mov dword [esp + 8], 0x11d
mov dword [esp + 4], str.drive.c
mov dword [esp], str.len___4
call dword [0x494088]
mov dword [esp + 8], 4
mov ebx, dword [sym.imp.msvcrt.dll__strnicmp]
mov dword [esp + 4], 0x4984ba
mov dword [esp], esi
call ebx
test eax, eax
je 0x408cbb
mov dword [esp + 8], 0x11e
mov dword [esp + 4], str.drive.c
mov dword [esp], str.safe_strnicmp_volume_name__volume_start__4___0
jmp 0x408c7d
lea eax, [edi - 1]
cmp byte [ebp + edi - 0x221], 0x5c
mov dword [ebp - 0x38c], eax
je 0x408ce7
mov dword [esp + 8], 0x11f
mov dword [esp + 4], str.drive.c
mov dword [esp], str.volume_name_len___1___
jmp 0x408c7d
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
sub eax, 2
push edx
cmp eax, 1
ja 0x408d8a
mov eax, dword [ebp - 0x38c]
lea edi, [ebp - 0x11c]
mov byte [ebp + eax - 0x220], 0
lea eax, [ebp - 0x21c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
sub esp, 0xc
test eax, eax
je 0x408d6b
mov dword [esp + 8], 0xd
mov dword [esp + 4], str.DeviceCdRom
mov dword [esp], edi
call ebx
test eax, eax
je 0x408dd7
mov dword [esp + 8], 0xe
mov dword [esp + 4], str.DeviceFloppy
mov dword [esp], edi
call ebx
test eax, eax
jne 0x408d92
jmp 0x408dd7
cmp dword [ebp + 0x18], 0
jne 0x408d8a
call fcn.0043f53d
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Failed_to_get_device_path_for_GUID_volume__s:__s
call fcn.0043efa9
or esi, 0xffffffff
jmp 0x408fb4
xor eax, eax
mov dword [esp + 0x1c], 0xbb8
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], esi
call fcn.0043ff91
mov ebx, eax
cmp eax, 0xffffffff
jne 0x408e14
jmp 0x408df5
cmp dword [ebp + 0x18], 0
jne 0x408d8a
lea eax, [ebp - 0x11c]
mov dword [esp], str.Skipping_GUID_volume_for__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x408d8a
cmp dword [ebp + 0x18], 0
jne 0x408d8a
call fcn.0043f53d
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_open_GUID_volume__s:__s
jmp 0x408d85
lea eax, [ebp - 0x378]
xor edi, edi
xor esi, esi
mov dword [esp], ebx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x2e8]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
lea edi, [ebx - 1]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0xc8
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x560000
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
sub esp, 0x20
test eax, eax
je 0x4090c5
cmp dword [ebp - 0x378], 0
je 0x409090
xor esi, esi
cmp edi, 0xfffffffd
ja 0x408e80
mov dword [esp], ebx
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
mov eax, dword [ebp - 0x2e8]
test eax, eax
jne 0x408ea7
cmp dword [ebp + 0x18], 0
jne 0x408fb4
lea eax, [ebp - 0x220]
mov dword [esp], str.Ignoring_volume__s_because_it_has_no_extents...
mov dword [esp + 4], eax
jmp 0x408ec5
dec eax
je 0x408ecf
cmp dword [ebp + 0x18], 0
jne 0x408fb4
lea eax, [ebp - 0x220]
mov dword [esp], str.Ignoring_volume__s_because_it_has_more_than_one_extent__RAID__...
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x408fb4
mov eax, dword [ebp - 0x388]
cmp eax, dword [ebp - 0x2e0]
jne 0x408fb4
mov ecx, dword [ebp - 0x370]
cmp ecx, 0x10
jne 0x408f07
mov dword [esp + 4], 0x10
xor esi, esi
mov dword [esp], str.Error:_Trying_to_process_a_disk_with_more_than__d_partitions_
call fcn.0043efa9
jmp 0x409075
cmp dword [ebp + 0x14], 0
je 0x408f1b
mov eax, dword [ebp - 0x38c]
mov byte [ebp + eax - 0x220], 0x5c
mov eax, dword [ebp - 0x2d8]
mov edx, dword [ebp - 0x2d4]
mov dword [ebp + ecx*8 - 0x368], eax
lea eax, [ebp - 0x220]
mov dword [ebp + ecx*8 - 0x364], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x374]
mov dword [esp + 8], 1
mov dword [esp], eax
call fcn.0043d662
cmp dword [ebp + 0x18], 0
jne 0x408fb4
cmp dword [ebp - 0x390], 0
mov eax, dword [0x526ca4]
je 0x408f79
test eax, eax
je 0x408fac
mov dword [esp], str.Windows_volumes_from_this_device:
call fcn.0043efa9
cmp dword [0x526ca4], 0
je 0x408fac
mov eax, dword [ebp - 0x2d8]
mov edx, dword [ebp - 0x2d4]
mov dword [esp], str.__s___lld
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call fcn.0043efa9
xor edx, edx
mov dword [ebp - 0x390], edx
inc dword [ebp - 0x394]
inc esi
je 0x408bad
mov ebx, dword [ebp - 0x370]
xor esi, esi
xor eax, eax
test ebx, ebx
je 0x409075
mov edx, dword [ebp - 0x380]
mov ecx, dword [ebp - 0x384]
or edx, ecx
je 0x409004
cmp eax, ebx
jae 0x409022
cmp dword [ebp + eax*8 - 0x364], ecx
je 0x408ff3
inc eax
jmp 0x408fd3
mov edx, dword [ebp - 0x380]
cmp dword [ebp + eax*8 - 0x368], edx
jne 0x408ff0
jmp 0x409008
cmp eax, ebx
jae 0x409022
mov edx, dword [ebp - 0x374]
mov esi, dword [edx + eax*4]
test esi, esi
je 0x409075
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__strdup]
mov esi, eax
jmp 0x409075
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x380]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x384]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040893d
mov esi, eax
test eax, eax
je 0x409075
mov dword [esp + 4], 0x20
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x409075
mov dword [esp], str.Warning:_Using_physical_device_to_access_partition_data
call fcn.0043efa9
cmp dword [ebp - 0x37c], 0xffffffff
je 0x4090d2
mov eax, dword [ebp - 0x37c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_FindVolumeClose]
push eax
jmp 0x4090d2
cmp dword [ebp + 0x18], 0
mov eax, str._empty_data_
jne 0x4090ab
mov dword [esp + 4], eax
mov dword [esp], str.Could_not_get_Disk_Extents:__s
call fcn.0043efa9
xor esi, esi
cmp edi, 0xfffffffd
ja 0x408fb4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
jmp 0x408d8a
cmp dword [ebp + 0x18], 0
jne 0x4090ab
call fcn.0043f53d
jmp 0x40909b
lea eax, [ebp - 0x374]
mov dword [esp], eax
call fcn.0043d77d
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret