Function at 0x415db4
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 0x340], ecx
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x416014
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404558
mov dl, 1
mov eax, dword [0x410738]
call fcn.00403904
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsA
mov esi, eax
test esi, esi
jns 0x415e2d
add esi, 3
sar esi, 2
test esi, esi
jl 0x415e9d
inc esi
lea ebx, [ebp - 0x114]
lea eax, [ebp - 0x320]
movzx edx, byte [ebx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x320]
lea eax, [ebp - 0x324]
call fcn.0040332c
lea eax, [ebp - 0x328]
movzx edx, byte [ebx + 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x328]
lea eax, [ebp - 0x324]
mov cl, 2
call fcn.004032fc
lea edx, [ebp - 0x324]
lea eax, [ebp - 4]
call fcn.004047bc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add ebx, 4
dec esi
jne 0x415e3b
push edi
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
push 0x105
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.PSAPI.dll_GetProcessImageFileNameA
test eax, eax
je 0x415fdd
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x415fdd
inc esi
xor ebx, ebx
push 0x104
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x32c]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x32c]
call fcn.004049c4
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
je 0x415fd5
lea eax, [ebp - 0x330]
lea edx, [ebp - 0x218]
mov ecx, 0x104
call fcn.004047c8
mov eax, dword [ebp - 0x330]
push eax
lea eax, [ebp - 0x334]
lea edx, [ebp - 0x31c]
mov ecx, 0x104
call fcn.004047c8
mov eax, dword [ebp - 0x334]
pop edx
call fcn.00404a64
test eax, eax
jle 0x415fd5
lea ecx, [ebp - 0x338]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x338]
push eax
lea eax, [ebp - 0x33c]
push eax
mov eax, 0x104
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x31c]
call fcn.00408250
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push eax
lea eax, [ebp - 0x31c]
call fcn.00408250
inc eax
push eax
lea eax, [ebp - 0x340]
lea edx, [ebp - 0x218]
mov ecx, 0x104
call fcn.004047c8
mov eax, dword [ebp - 0x340]
pop edx
pop ecx
call fcn.00404a24
mov ecx, dword [ebp - 0x33c]
mov eax, dword [ebp - 8]
pop edx
call fcn.0040484c
inc ebx
dec esi
jne 0x415ee0
mov eax, dword [ebp - 0x10]
call fcn.00403934
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41601b
lea eax, [ebp - 0x340]
mov edx, 6
call fcn.0040457c
lea eax, [ebp - 4]
call fcn.00404558
ret