Function at 0x48969c
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x56
push 0
push 0
dec ecx
jne 0x4896a4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x489deb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x118]
mov ecx, pe_nt_image_headers32
call fcn.004053d8
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 4]
call fcn.00409d0c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405888
push pe_nt_image_headers32
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 4]
call fcn.004055f8
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x48974c
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.0040a164
call fcn.00489670
test al, al
je 0x489762
lea eax, [ebp - 0x228]
call fcn.00489684
jmp 0x48977e
mov dword [ebp - 0x228], 0x88
mov dword [ebp - 0x21c], 0x3f31873
mov eax, dword [ebp - 0xc]
call fcn.00405158
push dword [ebp - 8]
push 0x489e04
lea ecx, [ebp - 0x230]
mov edx, 8
mov eax, dword [ebp - 0x228]
call fcn.0040a13c
push dword [ebp - 0x230]
push 0x489e04
lea ecx, [ebp - 0x234]
mov edx, 8
mov eax, dword [ebp - 0x220]
call fcn.0040a13c
push dword [ebp - 0x234]
push 0x489e04
lea ecx, [ebp - 0x238]
mov edx, 8
mov eax, dword [ebp - 0x21c]
call fcn.0040a13c
push dword [ebp - 0x238]
lea eax, [ebp - 8]
mov edx, 7
call fcn.004054fc
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.00489624
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.00409d0c
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 8]
call fcn.004051f0
lea eax, [ebp - 4]
call fcn.00405158
mov ebx, 1
or esi, 0xffffffff
lea eax, [ebp - 0x244]
push eax
mov edi, ebx
add edi, edi
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x244]
mov edx, 0x489e10
call fcn.00405590
jne 0x489864
mov esi, 1
jmp 0x489d82
lea eax, [ebp - 0x248]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x248]
mov edx, 0x489e1c
call fcn.00405590
jne 0x489896
mov esi, 2
jmp 0x489d82
lea eax, [ebp - 0x24c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x24c]
mov edx, 0x489e28
call fcn.00405590
jne 0x4898c8
mov esi, 3
jmp 0x489d82
lea eax, [ebp - 0x250]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x250]
mov edx, 0x489e34
call fcn.00405590
jne 0x4898fa
mov esi, 4
jmp 0x489d82
lea eax, [ebp - 0x254]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x254]
mov edx, 0x489e40
call fcn.00405590
jne 0x48992c
mov esi, 5
jmp 0x489d82
lea eax, [ebp - 0x258]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x258]
mov edx, 0x489e4c
call fcn.00405590
jne 0x48995e
mov esi, 6
jmp 0x489d82
lea eax, [ebp - 0x25c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x25c]
mov edx, 0x489e58
call fcn.00405590
jne 0x489990
mov esi, 7
jmp 0x489d82
lea eax, [ebp - 0x260]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x260]
mov edx, 0x489e64
call fcn.00405590
jne 0x4899c2
mov esi, 8
jmp 0x489d82
lea eax, [ebp - 0x264]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x264]
mov edx, 0x489e70
call fcn.00405590
jne 0x4899f4
mov esi, 9
jmp 0x489d82
lea eax, [ebp - 0x268]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x268]
mov edx, 0x489e7c
call fcn.00405590
jne 0x489a26
mov esi, 0xa
jmp 0x489d82
lea eax, [ebp - 0x26c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x26c]
mov edx, 0x489e88
call fcn.00405590
jne 0x489a58
mov esi, 0xb
jmp 0x489d82
lea eax, [ebp - 0x270]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x270]
mov edx, 0x489e94
call fcn.00405590
jne 0x489a8a
mov esi, 0xc
jmp 0x489d82
lea eax, [ebp - 0x274]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x274]
mov edx, 0x489ea0
call fcn.00405590
jne 0x489abc
mov esi, 0xd
jmp 0x489d82
lea eax, [ebp - 0x278]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x278]
mov edx, 0x489eac
call fcn.00405590
jne 0x489aee
mov esi, 0xe
jmp 0x489d82
lea eax, [ebp - 0x27c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x27c]
mov edx, 0x489eb8
call fcn.00405590
jne 0x489b20
mov esi, 0xf
jmp 0x489d82
lea eax, [ebp - 0x280]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x280]
mov edx, 0x489ec4
call fcn.00405590
jne 0x489b52
mov esi, 0x10
jmp 0x489d82
lea eax, [ebp - 0x284]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x284]
mov edx, 0x489ed0
call fcn.00405590
jne 0x489b84
mov esi, 0x11
jmp 0x489d82
lea eax, [ebp - 0x288]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x288]
mov edx, 0x489edc
call fcn.00405590
jne 0x489bb6
mov esi, 0x12
jmp 0x489d82
lea eax, [ebp - 0x28c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x28c]
mov edx, 0x489ee8
call fcn.00405590
jne 0x489be8
mov esi, 0x13
jmp 0x489d82
lea eax, [ebp - 0x290]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x290]
mov edx, 0x489ef4
call fcn.00405590
jne 0x489c1a
mov esi, 0x14
jmp 0x489d82
lea eax, [ebp - 0x294]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x294]
mov edx, 0x489f00
call fcn.00405590
jne 0x489c4c
mov esi, 0x15
jmp 0x489d82
lea eax, [ebp - 0x298]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x298]
mov edx, 0x489f0c
call fcn.00405590
jne 0x489c7e
mov esi, 0x16
jmp 0x489d82
lea eax, [ebp - 0x29c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x29c]
mov edx, 0x489f18
call fcn.00405590
jne 0x489cb0
mov esi, 0x17
jmp 0x489d82
lea eax, [ebp - 0x2a0]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x2a0]
mov edx, 0x489f24
call fcn.00405590
jne 0x489ce2
mov esi, 0x18
jmp 0x489d82
lea eax, [ebp - 0x2a4]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x2a4]
mov edx, 0x489f30
call fcn.00405590
jne 0x489d11
mov esi, 0x19
jmp 0x489d82
lea eax, [ebp - 0x2a8]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x2a8]
mov edx, 0x489f3c
call fcn.00405590
jne 0x489d40
mov esi, 0x1a
jmp 0x489d82
lea eax, [ebp - 0x2ac]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
cmp dword [ebp - 0x2ac], 0
je 0x489d82
lea eax, [ebp - 0x2b0]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x2b0]
call fcn.0040a194
mov esi, eax
test esi, esi
jl 0x489dab
mov eax, esi
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
lea edx, [ebp - 0x2b4]
call fcn.0040a028
mov edx, dword [ebp - 0x2b4]
lea eax, [ebp - 4]
call fcn.00405434
inc ebx
cmp ebx, 0x21
jne 0x48982b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004051ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489df2
lea eax, [ebp - 0x2b4]
mov edx, 0x23
call fcn.0040517c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040517c
ret