Function at 0x4293f0
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x69def4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push esi
mov esi, dword [ebp + 8]
push 0
push 0x6097e8
mov dword [ebp - 0xa38], eax
call fcn.004072f0
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005d4b40
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x42945b
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cabbc
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov esi, eax
test esi, esi
jne 0x429480
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cabbc
mov esp, ebp
pop ebp
ret
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
push ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005cb0d7
mov ebx, eax
add esp, 4
mov dword [ebp - 0xa34], ebx
test ebx, ebx
je 0x429513
lea eax, [esi*2 + 2]
push eax
push 0
push ebx
call fcn.005d4b40
add esp, 0xc
push ebx
push esi
call edi
test eax, eax
jne 0x4294e0
push ebx
call fcn.005cac0b
add esp, 4
xor al, al
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cabbc
mov esp, ebp
pop ebp
ret
mov eax, dword [0x60c3f4]
mov dword [ebp - 0xc], eax
mov ax, word [0x60c3f8]
push 0x208
mov word [ebp - 8], ax
call fcn.005cb0d7
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x429526
push dword [ebp - 0xa34]
call fcn.005cac0b
add esp, 4
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cabbc
mov esp, ebp
pop ebp
ret
push 0x208
push 0
push ebx
call fcn.005d4b40
mov esi, dword [ebp - 0xa34]
add esp, 0xc
mov ax, word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push ebx
push eax
call edi
test eax, eax
jne 0x4295ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42964d
push ebx
call fcn.005cac0b
xor ecx, ecx
mov eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005cb0d7
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x42964d
xor eax, eax
push 1
mov word [ebx], ax
lea eax, [ebp - 0xc]
push ebx
push eax
call edi
test eax, eax
je 0x42964d
mov edi, ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4295b1
sub edi, ecx
lea eax, [ebp - 0x218]
sar edi, 1
push edi
push ebx
push eax
call fcn.005e066d
add esp, 0xc
test eax, eax
je 0x4295ea
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x4295d5
cmp word [esi], ax
je 0x42964d
jmp 0x42953c
push 0x800
lea eax, [ebp - 0xa18]
push 0
push eax
call fcn.005d4b40
lea eax, [ebp - 0x218]
lea eax, [eax + edi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x609b88
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.0042ca10
add esp, 0x20
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.00405d50
mov ecx, dword [ebp - 0xa38]
push eax
call fcn.00405ee0
lea ecx, [ebp - 0xa30]
call fcn.00405db0
push dword [ebp - 0xa34]
call fcn.005cac0b
add esp, 4
test ebx, ebx
je 0x429668
push ebx
call fcn.005cac0b
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.005cabbc
mov esp, ebp
pop ebp
ret