Function at 0x429200
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x69cef4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push esi
mov esi, dword [ebp + 8]
push 0
push 0x6087e8
mov dword [ebp - 0xa38], eax
call fcn.00407280
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005d4520
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x42926b
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ca59c
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov esi, eax
test esi, esi
jne 0x429290
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ca59c
mov esp, ebp
pop ebp
ret
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
push ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005caab7
mov ebx, eax
add esp, 4
mov dword [ebp - 0xa34], ebx
test ebx, ebx
je 0x429323
lea eax, [esi*2 + 2]
push eax
push 0
push ebx
call fcn.005d4520
add esp, 0xc
push ebx
push esi
call edi
test eax, eax
jne 0x4292f0
push ebx
call fcn.005ca5eb
add esp, 4
xor al, al
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ca59c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x60b3f4]
mov dword [ebp - 0xc], eax
mov ax, word [0x60b3f8]
push 0x208
mov word [ebp - 8], ax
call fcn.005caab7
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x429336
push dword [ebp - 0xa34]
call fcn.005ca5eb
add esp, 4
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ca59c
mov esp, ebp
pop ebp
ret
push 0x208
push 0
push ebx
call fcn.005d4520
mov esi, dword [ebp - 0xa34]
add esp, 0xc
mov ax, word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push ebx
push eax
call edi
test eax, eax
jne 0x4293bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42945d
push ebx
call fcn.005ca5eb
xor ecx, ecx
mov eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005caab7
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x42945d
xor eax, eax
push 1
mov word [ebx], ax
lea eax, [ebp - 0xc]
push ebx
push eax
call edi
test eax, eax
je 0x42945d
mov edi, ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4293c1
sub edi, ecx
lea eax, [ebp - 0x218]
sar edi, 1
push edi
push ebx
push eax
call fcn.005e006d
add esp, 0xc
test eax, eax
je 0x4293fa
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x4293e5
cmp word [esi], ax
je 0x42945d
jmp 0x42934c
push 0x800
lea eax, [ebp - 0xa18]
push 0
push eax
call fcn.005d4520
lea eax, [ebp - 0x218]
lea eax, [eax + edi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x608b88
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.0042c820
add esp, 0x20
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.00405d50
mov ecx, dword [ebp - 0xa38]
push eax
call fcn.00405e70
lea ecx, [ebp - 0xa30]
call fcn.00405db0
push dword [ebp - 0xa34]
call fcn.005ca5eb
add esp, 4
test ebx, ebx
je 0x429478
push ebx
call fcn.005ca5eb
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.005ca59c
mov esp, ebp
pop ebp
ret