Function at 0x10494f2
Capabilities:
Get disk information
Get file system object information

Disassembly:
mov eax, reloc.ADVAPI32.dll_AddAccessAllowedAce
call fcn.01077798
mov eax, 0x24cc
call fcn.01077950
mov eax, dword [0x10de03c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
movzx eax, byte [esi + 0x30]
push edi
and eax, 0xffffff7f
dec eax
push 0x29
pop edi
je 0x10495f6
dec eax
je 0x10495c7
dec eax
je 0x104958c
dec eax
je 0x1049552
dec eax
dec eax
je 0x104954b
sub eax, 0x51
je 0x10495f6
push 5
jmp 0x1049648
push 0xa
jmp 0x1049648
movzx eax, byte [esi + 0x31]
sub eax, 0
je 0x1049585
dec eax
je 0x104957e
sub eax, 6
je 0x1049577
dec eax
je 0x1049570
dec eax
jne 0x1049585
push 0x19
jmp 0x1049648
push 0x18
jmp 0x1049648
push 0x1a
jmp 0x1049648
push reloc.KERNEL32.dll_GetLocaleInfoW
jmp 0x1049648
push GetLocaleInfoW
jmp 0x1049648
movzx eax, byte [esi + 0x31]
dec eax
je 0x10495c0
dec eax
je 0x10495b9
dec eax
je 0x10495b2
dec eax
dec eax
je 0x10495ab
dec eax
jne 0x1049649
push 0x17
jmp 0x1049648
push 0x16
jmp 0x1049648
push 0x15
jmp 0x1049648
push 0x14
jmp 0x1049648
push 0x13
jmp 0x1049648
test byte [esi + 0x60], 2
je 0x1049646
movzx eax, byte [esi + 0x31]
sub eax, 0
je 0x10495f2
dec eax
je 0x10495ee
dec eax
je 0x10495ea
dec eax
je 0x10495e6
dec eax
jne 0x1049649
push LoadLibraryW
jmp 0x1049648
push 0xe
jmp 0x1049648
push reloc.KERNEL32.dll_LoadLibraryW
jmp 0x1049648
push 0xd
jmp 0x1049648
push 0xc
jmp 0x1049648
mov al, byte [esi + 0x31]
cmp al, 1
je 0x1049646
cmp al, 2
je 0x1049646
mov eax, dword [0x1004ba0]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1004ba4]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x34]
mov ax, word [eax]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
dec eax
je 0x1049642
dec eax
je 0x104963e
dec eax
je 0x1049544
dec eax
jne 0x1049544
push 4
jmp 0x1049648
push 3
jmp 0x1049648
push 2
jmp 0x1049648
push 0x11
pop edi
lea eax, [edi - 2]
cmp eax, 0x1a
ja case.0x104965c.6
movzx eax, byte [eax + 0x1049cb7]
jmp dword [eax*4 + 0x1049c73]
lea ecx, [ebp - 0x24d8]
call fcn.01075e60
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 3
je 0x1049752
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
lea ecx, [ebp - 0x220]
push ecx
push esi
call dword [eax + 0x10e6c9c]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x24d8]
call fcn.01075e54
push 0x5c
lea ecx, [ebp - 0x24d8]
call fcn.01076898
push 0x200
push 0x2b4
lea eax, [ebp - 0x24d4]
push eax
push 0
push dword [ebp - 0x24d8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x10496f4
push 0x104
lea eax, [ebp - 0x24c8]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x1049713
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 0
push CompareStringW
lea ecx, [ebp - 0x220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x70
call fcn.01075fe0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x104974c
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push esi
call dword [eax + 0x10e6db8]
mov ecx, dword [ebp - 0x14]
push eax
push esi
push ebx
lea eax, [ebp - 0x220]
push eax
push edi
call fcn.01047909
jmp 0x104974e
xor eax, eax
mov esi, eax
jmp 0x1049754
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24d8]
call fcn.01075e24
mov eax, esi
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x70
call fcn.01075fe0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov dword [ebp - 4], 2
je case.0x104965c.6
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push esi
call dword [eax + 0x10e6db8]
mov ecx, dword [ebp - 0x14]
push eax
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
push edi
call fcn.01047909
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x50
call fcn.01075fe0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov dword [ebp - 4], 3
je case.0x104965c.6
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push esi
call dword [eax + 0x10e6db8]
mov ecx, dword [ebp - 0x14]
push eax
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
push edi
call fcn.01047545
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x50
call fcn.01075fe0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov dword [ebp - 4], 4
je case.0x104965c.6
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push esi
call dword [eax + 0x10e6db8]
mov ecx, dword [ebp - 0x14]
push eax
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
push edi
call fcn.01047583
jmp 0x1049c5a
cmp dword [ebp + 0x10], 1
jne case.0x104965c.6
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x50
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 5
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.010474ce
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x50
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 6
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.010477fd
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x50
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 7
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047829
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x50
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 8
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047855
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x50
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 9
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047881
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x50
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 0xa
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.010478ad
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x58
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], LoadLibraryW
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047dbe
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
cmp eax, 0x18
push 0x58
jne 0x1049b16
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], LoadLibraryW
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047dea
jmp 0x1049c5a
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], LoadLibraryW
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047dea
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
cmp eax, 0x19
push 0x58
jne 0x1049b9d
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], LoadLibraryW
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047e16
jmp 0x1049c5a
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], LoadLibraryW
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047e16
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x58
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], reloc.KERNEL32.dll_LoadLibraryW
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047e42
jmp 0x1049c5a
movzx eax, byte [esi + 0x30]
imul eax, eax, 0x14c
push 1
push reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
lea ecx, [ebp - 0x2220]
push ecx
push esi
call dword [eax + 0x10e6c98]
push 0x58
call fcn.01075fe0
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov dword [ebp - 4], 0x11
je case.0x104965c.6
push esi
push ebx
lea eax, [ebp - 0x2220]
push eax
call fcn.01047e6e
jmp 0x1049c5a
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01075aef
leave
ret 0xc