Function at 0x4384d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0xb306b10e
mov dword [esp + 0xc], 0xb70ab510
mov dword [esp + 0x10], 0x8bf48934
mov dword [esp + 0x14], 0x8f328d28
mov dword [esp + 0x18], 0x8382813c
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x18
ja 0x438558
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0x21bce998]
add eax, 0x98
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0xd8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x19
jb 0x438520
lea esi, [esp + 8]
push esi
call fcn.00439e70
add esp, 4
mov ecx, eax
mov dword [0x44f7f8], eax
xor edx, edx
test eax, eax
sete dl
xor eax, eax
jmp dword [edx*4 + 0x44565c]
push 0xde118a15
push ecx
call fcn.0043a500
add esp, 8
mov dword [0x44f800], eax
push 0x9b1cb500
push dword [0x44f7f8]
call fcn.0043a500
add esp, 8
mov dword [0x44f804], eax
push 0xb3a80508
push dword [0x44f7f8]
call fcn.0043a500
add esp, 8
mov dword [0x44f808], eax
push 0x1f488771
push dword [0x44f7f8]
call fcn.0043a500
add esp, 8
mov dword [0x4477dc], eax
mov dword [esp + 8], 0xb377b14b
mov dword [esp + 0xc], 0xb748b546
mov dword [esp + 0x10], 0xab56a96d
mov dword [esp + 0x14], 0xaf7cad7f
mov dword [esp + 0x18], 0xa366a17e
mov dword [esp + 0x1c], 0xa75aa558
mov word [esp + 0x20], 0x5958
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x29], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x24
ja 0x438680
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax - 0x35460b98]
mov edi, ecx
not edi
or edi, edx
and edx, ecx
add edx, edi
neg edx
add eax, edx
add eax, 0xcab9f467
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x28
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x25
jb 0x438640
push esi
call fcn.00439e70
add esp, 4
mov ecx, eax
mov dword [0x4477d4], eax
xor edx, edx
test eax, eax
sete dl
xor eax, eax
jmp dword [edx*4 + 0x445664]
push 0x2df68b61
push ecx
call fcn.0043a500
add esp, 8
mov dword [0x4464c8], eax
push 0xd4ed4ea7
push dword [0x4477d4]
call fcn.0043a500
add esp, 8
mov dword [0x4465cc], eax
push 0xe174828e
push dword [0x4477d4]
call fcn.0043a500
add esp, 8
mov dword [0x4477f4], eax
call fcn.004389a0
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x44566c]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call fcn.00432f20
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x445674]
jmp dword [0x44567c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [0x4464c8]
mov dword [esp + 8], 0x63fa650b
mov dword [esp + 0xc], 0x6ff061e5
mov dword [esp + 0x10], 0x6b316df2
mov dword [esp + 0x14], 0x973a6934
mov dword [esp + 0x18], 0x930095fa
mov dword [esp + 0x1c], 0x9f909106
mov word [esp + 0x20], 0
jmp dword [0x445688]
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x19
ja 0x4387bd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + edx]
add edi, 0x969e18f1
add ecx, 0x969e18f1
and ecx, edx
add ecx, ecx
sub edi, ecx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
add cl, 0x69
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x1a
jb 0x438780
push 0x800
push 0
push esi
call eax
mov ecx, dword [case.0x438699.13]
nop
nop
nop
jmp ecx
test eax, eax
je 0x4387db
mov dword [0x4477ec], eax
xor ecx, ecx
test eax, eax
setne cl
mov al, 1
jmp dword [ecx*4 + 0x44569c]
xor eax, eax
jmp dword [0x4456ac]
mov ecx, dword [case.0x438699.5]
nop
nop
jmp ecx
mov ecx, dword [case.0x438699.1]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [case.0x438699.31]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp + 8]
test edi, edi
mov ebx, 0
sete bl
jmp dword [ebx*4 + 0x4456f4]
xor ebx, ebx
cmp dword [ebp + 0xc], 0
sete bl
jmp dword [ebx*4 + 0x4456fc]