Function at 0x403d90
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x54
xor eax, eax
push ebx
push ebp
push esi
push edi
xor esi, esi
xor ecx, ecx
xor edx, edx
push str.ntdll.dll
mov word [esp + 0x44], ax
mov dword [esp + 0x46], eax
mov word [esp + 0x4a], ax
mov dword [esp + 0x30], esi
xor edi, edi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov word [esp + 0x34], cx
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
mov word [esp + 0x3c], dx
mov dword [esp + 0x3e], eax
mov word [esp + 0x42], ax
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
cmp ebp, esi
jne 0x403e42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push esi
push esi
push eax
call fcn.004148f0
mov esi, eax
add esi, 0x1270000
mov edi, edx
adc edi, 0x15
push edi
push esi
push 0x128
push str..GetSystemVolume.cpp
push str._S__d_nRet0x_016llX_n
call fcn.004019b0
add esp, 0x14
jmp 0x403f9f
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtOpenSymbolicLinkObject
push ebp
call ebx
push str.NtQuerySymbolicLinkObject
push ebp
mov dword [esp + 0x30], eax
call ebx
push str.NtClose
push ebp
mov dword [esp + 0x28], eax
call ebx
push str.RtlInitUnicodeString
push ebp
mov dword [esp + 0x20], eax
call ebx
push str.RtlUnicodeStringToAnsiString
push ebp
mov dword [esp + 0x24], eax
call ebx
push str.RtlInitAnsiString
push ebp
mov dword [esp + 0x2c], eax
call ebx
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404085
cmp dword [esp + 0x20], esi
je 0x404085
cmp dword [esp + 0x18], esi
je 0x404085
cmp dword [esp + 0x24], esi
je 0x404085
test eax, eax
je 0x404085
mov eax, dword [esp + 0x6c]
push eax
lea ecx, [esp + 0x3c]
push ecx
call dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x48]
push eax
push 0x80000000
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x40]
push ecx
mov dword [esp + 0x54], 0x18
mov dword [esp + 0x60], 0x50
mov dword [esp + 0x5c], edx
call ebx
test eax, eax
je 0x403f35
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push 0
push 0
push eax
call fcn.004148f0
mov esi, eax
add esi, 0x1510000
mov edi, edx
adc edi, 0x15
push edi
push esi
push 0x152
jmp 0x403e2b
xor ecx, ecx
mov eax, 0x104
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00409c6f
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x403fc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push ebx
push ebx
push eax
call fcn.004148f0
mov esi, eax
add esi, 0x1590000
mov edi, edx
adc edi, 3
push edi
push esi
push 0x15a
push str..GetSystemVolume.cpp
push str._S__d_nRet0x_016llX_n
call fcn.004019b0
add esp, 0x14
test ebx, ebx
je 0x403f9f
push ebx
call fcn.00409895
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x403fad
push eax
call dword [esp + 0x1c]
test ebp, ebp
je 0x403fb8
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 8
push str.deviceharddisk000partition000winnt
push ebx
mov edx, 0x104
call fcn.00404490
add esp, 8
push ebx
lea eax, [esp + 0x34]
push eax
call dword [esp + 0x24]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
push eax
call dword [esp + 0x2c]
test eax, eax
je 0x404028
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push 0
push 0
push eax
call fcn.004148f0
mov esi, eax
add esi, 0x1670000
mov edi, edx
adc edi, 0x15
push edi
push esi
push 0x168
jmp 0x403f80
push 1
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x48]
push edx
call dword [esp + 0x30]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x68]
push 0x104
push eax
push ecx
call fcn.0040a3ae
add esp, 0xc
test eax, eax
ja 0x403f92
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push 0
push 0
push eax
call fcn.004148f0
mov esi, eax
add esi, 0x16f0000
mov edi, edx
adc edi, 0xe
push edi
push esi
push 0x170
jmp 0x403f80
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push 0
push 0
push eax
call fcn.004148f0
mov esi, eax
add esi, 0x13b0000
mov edi, edx
adc edi, 0xb
push edi
push esi
push 0x13c
jmp 0x403e2b