Function at 0x4497d0
Capabilities:
Get disk information
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x478850
mov eax, dword fs:[0]
push eax
sub esp, 0x5c4
mov eax, dword [0x49274c]
xor eax, esp
mov dword [esp + 0x5c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49274c]
xor eax, esp
push eax
lea eax, [esp + 0x5d8]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0x18], eax
mov ebx, ecx
mov dword [esp + 0x1c], 0
xor ecx, ecx
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], cx
mov dword [esp + 0x5e0], 1
test eax, eax
jne 0x449873
mov dword [ebx + 0x10], ecx
mov ecx, ebx
mov dword [ebx + 0x14], 7
mov word [ebx], ax
lea eax, [esp + 0x5c]
push eax
call fcn.00406510
jmp 0x449ea7
push 0xc
xor eax, eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
lea ecx, [esp + 0x48]
push str.Kernel32.dll
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
call fcn.004073e0
mov byte [esp + 0x5e0], 2
mov eax, dword [0x495974]
test al, 1
jne 0x4498ef
or eax, 1
mov dword [0x495974], eax
mov byte [esp + 0x5e0], 3
mov dword [0x495970], 0
call fcn.004184e0
push 0x478dd0
call fcn.00450ef2
add esp, 4
mov byte [esp + 0x5e0], 2
lea eax, [esp + 0x44]
mov ecx, 0x495970
push eax
call fcn.004186a0
mov ebp, eax
mov dword [esp + 0x24], ebp
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x58], 8
jb 0x44991f
push dword [esp + 0x44]
call fcn.0044fd7a
add esp, 4
xor eax, eax
mov dword [esp + 0x58], 7
push 9
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], eax
push str.Psapi.dll
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], eax
mov word [esp + 0x34], ax
call fcn.004073e0
mov byte [esp + 0x5e0], 4
mov eax, dword [0x495974]
test al, 1
jne 0x4499a4
or eax, 1
mov dword [0x495974], eax
mov byte [esp + 0x5e0], 5
mov dword [0x495970], 0
call fcn.004184e0
push 0x478dd0
call fcn.00450ef2
add esp, 4
mov byte [esp + 0x5e0], 4
lea eax, [esp + 0x2c]
mov ecx, 0x495970
push eax
call fcn.004186a0
mov esi, eax
mov dword [esp + 0x14], esi
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x40], 8
jb 0x4499d4
push dword [esp + 0x2c]
call fcn.0044fd7a
add esp, 4
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
test esi, esi
je 0x449e8c
test ebp, ebp
je 0x449e8c
lea ecx, [esp + 0x9c]
call fcn.0044a0f0
cmp dword [esp + 0xa0], 6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jb 0x449aa1
push str.QueryFullProcessImageNameW
push ebp
call edi
mov esi, eax
test esi, esi
je 0x449a9d
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.00455ee0
add esp, 0xc
mov dword [esp + 0x74], 0x208
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x1c0]
push eax
push 0
push dword [esp + 0x24]
call esi
test eax, eax
je 0x449a9d
mov eax, dword [esp + 0x74]
cmp eax, 0x208
jae 0x449a8c
add eax, eax
cmp eax, 0x412
jae 0x449be2
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x60]
call fcn.00404f90
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x6c], 0
jne 0x449df5
push str.GetProcessImageFileNameW
push esi
call edi
mov esi, eax
test esi, esi
jne 0x449ac8
push str.GetProcessImageFileNameW
push ebp
call edi
mov esi, eax
test esi, esi
je 0x449b2e
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.00455ee0
add esp, 0xc
lea eax, [esp + 0x1bc]
push 0x208
push eax
push dword [esp + 0x20]
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x449b2e
add eax, eax
cmp eax, 0x412
jae 0x449be2
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x60]
call fcn.00404f90
cmp dword [esp + 0x6c], 0
je 0x449d6e
push 0x410
call fcn.0044c49a
add esp, 4
mov ebp, eax
push 0x410
push 0
push ebp
call fcn.00455ee0
xorps xmm0, xmm0
mov dword [esp + 0x8c], 0
movq qword [esp + 0x84], xmm0
add esp, 0xc
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov byte [esp + 0x5e0], 6
lea ecx, [esp + 0x78]
call fcn.0044bc00
mov ecx, dword [esp + 0x7c]
mov eax, 0x2aaaaaab
mov esi, dword [esp + 0x78]
sub ecx, esi
imul ecx
mov dword [esp + 0x74], 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x28], eax
je 0x449d13
mov edi, esi
lea ebx, [ebx]
cmp dword [edi + 0x10], 3
jb 0x449c01
mov ecx, dword [edi + 0x14]
cmp ecx, 8
jb 0x449be7
mov eax, dword [edi]
jmp 0x449be9
call fcn.00451b68
mov eax, edi
cmp word [eax + 4], 0x5c
jne 0x449c01
cmp ecx, 8
jb 0x449bf9
mov eax, dword [edi]
jmp 0x449bfb
mov eax, edi
xor ecx, ecx
mov word [eax + 4], cx
cmp dword [edi + 0x14], 8
jb 0x449c0b
mov eax, dword [edi]
jmp 0x449c0d
mov eax, edi
push 0x208
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x449c22
mov word [ebp], ax
mov esi, ebp
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x449c27
sub esi, ecx
sar esi, 1
je 0x449c5b
cmp esi, dword [esp + 0x6c]
jae 0x449c5b
cmp dword [esp + 0x70], 8
lea eax, [esp + 0x5c]
push esi
cmovae eax, dword [esp + 0x60]
push ebp
push eax
call fcn.004673a5
add esp, 0xc
test eax, eax
je 0x449c76
mov esi, dword [esp + 0x74]
add edi, 0x18
inc esi
mov dword [esp + 0x74], esi
cmp esi, dword [esp + 0x28]
jb 0x449bd0
jmp 0x449d09
xor eax, eax
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], 0
mov word [esp + 0x84], ax
mov byte [esp + 0x5e0], 7
lea eax, [esp + 0x5c]
cmp dword [esp + 0x70], 8
cmovae eax, dword [esp + 0x5c]
cmp dword [edi + 0x14], 8
jb 0x449cca
mov edi, dword [edi]
lea eax, [eax + esi*2]
push eax
push edi
lea eax, [esp + 0x8c]
push str._s_s
push eax
call fcn.004115f0
add esp, 0x10
lea eax, [esp + 0x84]
lea ecx, [esp + 0x5c]
push eax
call fcn.00416790
mov byte [esp + 0x5e0], 6
lea ecx, [esp + 0x84]
call fcn.00404f60
mov esi, dword [esp + 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
call fcn.00451046
add esp, 4
mov byte [esp + 0x5e0], 1
test esi, esi
je 0x449d5f
push dword [esp + 0x20]
mov edx, dword [esp + 0x80]
push ecx
mov ecx, esi
call fcn.004084c0
push esi
call fcn.0044fd7a
add esp, 0xc
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
cmp dword [esp + 0x6c], 0
jne 0x449df5
mov ebp, dword [esp + 0x24]
push str.GetModuleFileNameExW
push dword [esp + 0x18]
call edi
mov esi, eax
test esi, esi
jne 0x449d8d
push str.GetModuleFileNameExW
push ebp
call edi
mov esi, eax
test esi, esi
je 0x449df5
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.00455ee0
add esp, 0xc
lea eax, [esp + 0x1bc]
push 0x208
push eax
push 0
push dword [esp + 0x24]
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x449df5
add eax, eax
cmp eax, 0x412
jae 0x449be2
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x60]
call fcn.00404f90
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x84]
call fcn.00412130
mov esi, eax
mov byte [esp + 0x5e0], 8
lea eax, [esp + 0x5c]
cmp eax, esi
je 0x449e4b
cmp dword [esp + 0x70], 8
jb 0x449e2a
push dword [esp + 0x5c]
call fcn.0044fd7a
add esp, 4
xor eax, eax
mov dword [esp + 0x70], 7
push esi
lea ecx, [esp + 0x60]
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
call fcn.00406510
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x98], 8
jb 0x449e6c
push dword [esp + 0x84]
call fcn.0044fd7a
add esp, 4
xor eax, eax
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], 0
mov word [esp + 0x84], ax
mov dword [ebx + 0x10], eax
mov ecx, ebx
xor eax, eax
mov dword [ebx + 0x14], 7
mov word [ebx], ax
lea eax, [esp + 0x5c]
push eax
call fcn.00406510
mov dword [esp + 0x1c], 1
mov byte [esp + 0x5e0], 0
cmp dword [esp + 0x70], 8
jb 0x449eca
push dword [esp + 0x5c]
call fcn.0044fd7a
add esp, 4
xor eax, eax
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], eax
mov word [esp + 0x5c], ax
mov eax, ebx
mov ecx, dword [esp + 0x5d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c0]
xor ecx, esp
call fcn.0044fd7f
add esp, 0x5d0
ret