Function at 0x4b0918
Capabilities:
Enumerate pe sections
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x240
mov esi, dword [ebp + 0xc]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x238], eax
lea edi, [esp + 0x30]
mov ecx, edi
push esi
call fcn.0040252c
push edi
call fcn.004b026c
add esp, 4
mov ebx, eax
test byte [edi], 1
je 0x4b0960
push dword [esp + 0x38]
call fcn.005128f8
add esp, 4
test bl, bl
mov bl, 1
jne 0x4b0bb7
mov eax, dword [ebp + 8]
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [ecx + 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 8], ebx
push ecx
push eax
call fcn.004b0487
add esp, 8
test al, al
je 0x4b0ba4
xor eax, eax
dec eax
lea ebx, [esp + 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, ebx
push esi
call fcn.0040252c
movzx eax, byte [ebx]
test al, 1
jne 0x4b09bf
shr eax, 1
cmp word [esp + eax*2 + 0x10], 0x5c
je 0x4b09cf
lea ebx, [esp + 0x10]
lea esi, [esp + 0x12]
jmp 0x4b0a28
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp word [ecx + eax*2 - 2], 0x5c
jne 0x4b0a2c
dec eax
lea edx, [esp + 0x1c]
lea ebx, [esp + 0x10]
lea ecx, [esp + 0x30]
push edx
push eax
push 0
push ebx
call fcn.004215e6
test byte [ebx], 1
je 0x4b0a0f
mov eax, dword [esp + 0x18]
mov word [eax], 0
mov dword [esp + 0x14], 0
test byte [esp + 0x10], 1
je 0x4b0a0f
push dword [esp + 0x18]
call fcn.005128f8
add esp, 4
movsd xmm0, qword [edi]
lea esi, [esp + 0x12]
movsd qword [esi - 2], xmm0
mov eax, dword [edi + 8]
mov dword [esi + 6], eax
test byte [esi - 2], 1
jne 0x4b0a33
mov eax, esi
jmp 0x4b0a33
lea esi, [esp + 0x12]
mov eax, dword [esi + 6]
lea ecx, [esp + 0x22]
test byte [ecx - 2], 1
je 0x4b0a41
mov ecx, dword [esp + 0x28]
push eax
push ecx
call fcn.00527fa2
add esp, 8
test eax, eax
je 0x4b0aaf
mov dword [esp + 4], ebx
lea edi, [esp + 0x10]
mov ecx, edi
mov edx, edi
call fcn.004b0767
mov ebx, eax
mov ecx, edi
call fcn.004b0819
test al, al
jne 0x4b0ab6
test bl, bl
je 0x4b0ab6
xor ebx, ebx
lea edx, [esp + 0x30]
mov dword [edx + 4], ebx
mov dword [edx], ebx
mov dword [edx + 8], ebx
lea ecx, [esp + 0x20]
call fcn.004b0866
test al, al
je 0x4b0b3e
test byte [esp + 0x10], 1
je 0x4b0a9b
mov esi, dword [esp + 0x18]
test byte [esp + 0x30], 1
je 0x4b0b2b
mov eax, dword [esp + 0x38]
jmp 0x4b0b2f
mov bl, 1
jmp 0x4b0b91
xor ebx, ebx
test al, al
je 0x4b0b91
mov dword [esp + 0xc], ebx
xor edi, edi
mov dword [esp + 8], ebx
lea ebx, [esp + 0x30]
push 0x208
push 0xff
push ebx
call fcn.00516da0
add esp, 0xc
test byte [esp + 0x10], 1
je 0x4b0aec
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
lea ecx, [esp + 8]
mov dword [ecx], eax
push 0x104
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, 2
jb 0x4b0b8f
cmp eax, 0x104
je 0x4b0b8f
push ebx
call fcn.0052b964
add esp, 4
mov edi, eax
movzx eax, byte [esp + 0x10]
test al, 1
je 0x4b0b53
mov eax, dword [esp + 0x14]
jmp 0x4b0b55
lea eax, [esp + 0x32]
push esi
push eax
call fcn.00527fa2
add esp, 8
test eax, eax
sete bl
test byte [esp + 0x30], 1
je 0x4b0b91
push dword [esp + 0x38]
call fcn.005128f8
add esp, 4
jmp 0x4b0b91
shr eax, 1
lea ecx, [edi + eax]
add ecx, 0xfffffffe
movzx eax, byte [esp + 0x20]
test al, 1
je 0x4b0b6a
mov edx, dword [esp + 0x24]
jmp 0x4b0b6e
mov edx, eax
shr edx, 1
cmp ecx, edx
jne 0x4b0b8d
lea ecx, [esp + 0x22]
test al, 1
je 0x4b0b7e
mov ecx, dword [esp + 0x28]
push edi
push ebx
push ecx
call fcn.0052811f
add esp, 0xc
test eax, eax
je 0x4b0bcf
xor edi, edi
mov ebx, edi
test byte [esp + 0x10], 1
je 0x4b0ba4
push dword [esp + 0x18]
call fcn.005128f8
add esp, 4
test byte [esp + 0x20], 1
je 0x4b0bb7
push dword [esp + 0x28]
call fcn.005128f8
add esp, 4
mov ecx, dword [esp + 0x238]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 4]
add esi, 6
add eax, 4
test byte [esp + 0x10], 1
cmove eax, esi
test byte [esp + 0x20], 1
lea ecx, [esp + 0x22]
je 0x4b0bf4
mov ecx, dword [esp + 0x28]
lea ecx, [ecx + edi*2]
push eax
push ecx
call fcn.00527fa2
add esp, 8
test eax, eax
sete al
mov edi, eax
jmp 0x4b0b8f