Function at 0x412cf3
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
push ebx
push edi
mov edx, 0x164
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x412cfb
call fcn.00427280
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x28
call fcn.00424e80
lea eax, [esp + 0x4c8]
push 0x28
push eax
call fcn.00427170
lea eax, [esp + 0x514]
mov edx, 0x42b02e
push edx
push 3
push eax
call fcn.004271b0
lea eax, [esp + 0x51c]
mov edx, 0x42b02e
push edx
push 2
push eax
call fcn.004271b0
mov edx, 0x42b02e
lea ecx, [esp + 0x520]
call fcn.00414068
lea eax, [esp + 0x524]
mov edx, 0x42b02e
push edx
push 3
push eax
call fcn.004271b0
lea eax, [esp + 0x52c]
mov edx, 0x42b02e
push edx
push 3
push eax
call fcn.004271b0
mov dword [esp + 0x540], 0
mov dword [esp + 0x544], 0
mov dword [esp + 0x548], 0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x104
call fcn.00424e80
lea eax, [esp + 0x550]
push eax
call fcn.004270e0
mov edx, 0x42b02e
lea ecx, [esp + 0x550]
call fcn.00414068
mov edx, 0x42b02e
lea ecx, [esp + 0x554]
call fcn.00414068
push edx
call fcn.004270a0
pop edx
push eax
push 0x10
push 1
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
call fcn.00415bfa
call fcn.00414362
add dword [esp], edx
call fcn.0040e70a
call fcn.00414380
mov dword [esp + 0x578], eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x10
push 2
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
call fcn.00415bfa
call fcn.00414362
add dword [esp], edx
call fcn.0040e70a
call fcn.00414380
mov dword [esp + 0x57c], eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x10
push 3
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
call fcn.00415bfa
call fcn.00414362
add dword [esp], edx
call fcn.0040e70a
call fcn.00414380
mov dword [esp + 0x580], eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x10
push 4
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
call fcn.00415bfa
call fcn.00414362
add dword [esp], edx
call fcn.0040e70a
call fcn.00414380
mov dword [esp + 0x584], eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x10
push 0xffffffdd
mov edx, dword [0x430784]
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004271e0
mov edx, str.System32imageres.dll
push edx
call fcn.004271e0
call fcn.00414362
add dword [esp], edx
call fcn.0040e70a
call fcn.00414380
mov dword [esp + 0x58c], eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x10
push 0xffffffdc
mov edx, dword [0x430784]
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004271e0
mov edx, str.System32imageres.dll
push edx
call fcn.004271e0
call fcn.00414362
add dword [esp], edx
call fcn.0040e70a
call fcn.00414380
mov dword [esp + 0x588], eax
push dword [0x430710]
call fcn.004181c1
push dword [0x430820]
call fcn.004181c1
mov eax, dword [esp + 0x54c]
push eax
push 0x104
call sub.KERNEL32.dll_GetLogicalDriveStringsW
mov dword [esp + 0x544], eax
mov dword [esp + 0x534], 0
jmp 0x412fe4
mov ebx, dword [esp + 0x544]
mov eax, ebx
mov ecx, 4
cdq
idiv ecx
mov ebx, eax
dec ebx
cmp ebx, dword [esp + 0x534]
jl 0x413b8b
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
mov eax, dword [esp + 0x554]
mov ebx, eax
mov edi, dword [esp + 0x53c]
shl edi, 2
add edi, edi
add ebx, edi
push ebx
call fcn.004261b0
lea eax, [esp + 0x518]
push 3
push eax
call fcn.00427170
push edx
call fcn.004270a0
pop edx
push eax
lea edx, [esp + 0x518]
push edx
call fcn.004270a0
pop edx
push eax
push 3
push edx
call fcn.00427370
call fcn.00414362
add dword [esp], edx
call sub.KERNEL32.dll_GetDriveTypeW
call fcn.00414380
mov dword [esp + 0x540], eax
mov ebx, dword [esp + 0x540]
cmp ebx, 2
je 0x413099
mov ebx, dword [esp + 0x540]
cmp ebx, 3
je 0x413099
jmp 0x4130a0
mov eax, 1
jmp 0x4130a2
xor eax, eax
and eax, eax
je 0x413b7e
push 0
push 0xc
lea eax, [esp + 0x98]
push eax
call fcn.00426200
push 0
push 0x90
lea eax, [esp + 8]
push eax
call fcn.00426200
push 0
push 0x428
lea eax, [esp + 0xa4]
push eax
call fcn.00426200
push edx
call fcn.004270a0
pop edx
push eax
lea eax, [esp + 0x94]
push eax
lea edx, [esp + 0x51c]
push edx
call fcn.004270a0
pop edx
push eax
push 3
push edx
call fcn.00427370
call fcn.00414362
add dword [esp], edx
call fcn.00409c5e
call fcn.00414380
and eax, eax
je 0x413b7e
push edx
call fcn.004270a0
pop edx
push eax
lea eax, [esp + 4]
push eax
lea edx, [esp + 0x51c]
push edx
call fcn.004270a0
pop edx
push eax
push 3
push edx
call fcn.00427370
call fcn.00414362
add dword [esp], edx
call fcn.0040a96c
call fcn.00414380
and eax, eax
je 0x413b7e
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x104
call fcn.00424e80
lea eax, [esp + 0x55c]
push eax
call fcn.004270e0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x104
call fcn.00424e80
lea eax, [esp + 0x560]
push eax
call fcn.004270e0
push edx
call fcn.004270a0
pop edx
push eax
push 0x104
mov eax, dword [esp + 0x564]
push eax
push 0
push 0
push 0
push 0x104
mov eax, dword [esp + 0x574]
push eax
lea edx, [esp + 0x534]
push edx
call fcn.004270a0
pop edx
push eax
push 3
push edx
call fcn.00427370
call fcn.00414362
add dword [esp], edx
call sub.KERNEL32.dll_GetVolumeInformationW
call fcn.00414380
mov dword [esp + 0x53c], eax
push edx
call fcn.004270a0
pop edx
push eax
lea eax, [esp + 0x574]
push eax
lea eax, [esp + 0x570]
push eax
lea eax, [esp + 0x56c]
push eax
lea edx, [esp + 0x524]
push edx
call fcn.004270a0
pop edx
push eax
push 3
push edx
call fcn.00427370
call fcn.00414362
add dword [esp], edx
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
call fcn.00414380
mov dword [esp + 0x53c], eax
mov dword [esp + 0x538], 0
jmp 0x413283
mov eax, 0x3ff
cmp eax, dword [esp + 0x538]
jl 0x4132b0
lea ebp, [esp + 0x9c]
push ebp
mov eax, dword [esp + 0x53c]
pop ebp
add ebp, eax
mov byte [ebp + 0x25], 0
inc dword [esp + 0x538]
jno 0x413283
mov edx, 0x42b02e
lea ecx, [esp + 0x554]
call fcn.00414068
push edx
call fcn.004270a0
pop edx
push eax
lea eax, [esp + 0xa0]
push eax
lea edx, [esp + 0x51c]
push edx
call fcn.004270a0
pop edx
push eax
push 3
push edx
call fcn.00427370
call fcn.00414362
add dword [esp], edx
call fcn.00412714
call fcn.00414380
and eax, eax
je 0x413405
lea ebp, [esp + 0x9c]
cmp dword [ebp + 0xc], 0
je 0x41337a
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x18
push 0xffffffff
lea eax, [esp + 0xb4]
mov ebx, eax
lea ebp, [esp + 0xb4]
add ebx, dword [ebp + 0xc]
push ebx
call fcn.00426370
call fcn.00414362
add dword [esp], edx
call fcn.00425f60
mov edx, 0x42b0d8
push edx
call fcn.004271e0
lea eax, [esp + 0x558]
push eax
call fcn.004270e0
lea ebp, [esp + 0x9c]
cmp dword [ebp + 0x10], 0
je 0x413405
mov edx, dword [esp + 0x554]
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004271e0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push 0x18
push 0xffffffff
lea eax, [esp + 0xb8]
mov ebx, eax
lea ebp, [esp + 0xb8]
add ebx, dword [ebp + 0x10]
push ebx
call fcn.00426370
call fcn.00414362
add dword [esp], edx
call fcn.00425f60
pop eax
mov edx, 0x42b0d8
push edx
call fcn.004271e0
lea eax, [esp + 0x558]
push eax
call fcn.004270e0
lea eax, [esp + 0x524]
mov edx, 0x42b02e
push edx
push 3
push eax
call fcn.004271b0
lea eax, [esp + 0x52c]
mov edx, 0x42b02e
push edx
push 3
push eax
call fcn.004271b0
lea ebp, [esp]
push dword [ebp]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4134dd
lea eax, [esp + 0x528]
mov edx, 0x42cf4c
push edx
push 3
push eax
call fcn.004271b0
lea ebp, [esp + 4]
movsx ebx, byte [ebp + 0x21]
cmp ebx, 1
jne 0x413483
lea eax, [esp + 0x530]
mov edx, 0x42b7ca
push edx
push 3
push eax
call fcn.004271b0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push 1
lea ebp, [esp + 0x10]
movsx eax, byte [ebp + 0x20]
cdq
push edx
push eax
call fcn.004259a0
call fcn.00427340
mov edx, 0x42c034
call fcn.00414390
mov ecx, eax
call fcn.004143a0
je 0x4134d8
lea eax, [esp + 0x530]
mov edx, 0x42d0ea
push edx
push 3
push eax
call fcn.004271b0
jmp 0x4135ea
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4135d2
lea eax, [esp + 0x528]
mov edx, 0x42ba62
push edx
push 3
push eax
call fcn.004271b0
push 0x28
lea eax, [esp + 0x4cc]
push eax
lea ebp, [esp + 0xc]
lea eax, [ebp + 0x20]
push eax
call sub.ole32.dll_StringFromGUID2
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
lea edx, [esp + 0x4d0]
push edx
call fcn.004270a0
pop edx
push eax
push 0x28
push edx
call fcn.00427370
call fcn.00414362
add dword [esp], edx
call fcn.00424f00
call fcn.00427340
mov edx, str.C12A7328_F81F_11D2_BA4B_00A0C93EC93B
call fcn.00414390
mov ecx, eax
call fcn.004143a0
je 0x4135d0
lea eax, [esp + 0x530]
mov edx, 0x42d0ea
push edx
push 3
push eax
call fcn.004271b0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
lea ebp, [esp + 0xc]
lea eax, [ebp + 0x48]
push eax
call fcn.004261b0
lea eax, [esp + 0x558]
push eax
call fcn.004270e0
mov edx, dword [esp + 0x554]
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004271e0
lea eax, [esp + 0x560]
push eax
call fcn.004270e0
jmp 0x4135ea
lea eax, [esp + 0x528]
mov edx, 0x42d7e4
push edx
push 3
push eax
call fcn.004271b0
pop eax
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
mov eax, 0x42b184
push eax
mov eax, 0x42d0f2
push eax
lea edx, [esp + 0x524]
push edx
call fcn.004270a0
pop edx
push eax
push 3
push edx
call fcn.00427370
call fcn.00414362
add dword [esp], edx
call fcn.004252d0
lea eax, [esp + 0x520]
push 2
push eax
call fcn.00427170
lea edx, [esp + 0x51c]
push edx
call fcn.004270a0
pop edx
push eax
push 2
push edx
call fcn.00427370
mov edx, 0x42b04e
push edx
call fcn.004271e0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
lea ebp, [esp + 0x9c]
mov eax, dword [ebp + 4]
cdq
push edx
push eax
call fcn.00424b20
pop eax
mov edx, 0x42b04e
push edx
call fcn.004271e0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
mov eax, dword [ebp + 8]
cdq
push edx
push eax
call fcn.00424b20
pop eax
mov edx, 0x42b04e
push edx
call fcn.004271e0
lea eax, [esp + 0x524]
push eax
call fcn.004270e0
mov edx, dword [esp + 0x520]
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004271e0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push dword [esp + 0x564]
call fcn.00424d20
pop eax
mov edx, 0x42b04e
push edx
call fcn.004271e0
push edx
call fcn.004270a0
pop edx
push eax
push dword [esp + 0x574]
push dword [esp + 0x574]
call fcn.00409cf3
pop eax
mov edx, 0x42b04e
push edx
call fcn.004271e0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push dword [esp + 0x568]
call fcn.00424d20
pop eax
mov edx, 0x42b04e
push edx
call fcn.004271e0
lea eax, [esp + 0x524]
push eax
call fcn.004270e0
mov edx, dword [esp + 0x520]
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004271e0
lea edx, [esp + 0x528]
push 3
push edx
call fcn.00427370
mov edx, 0x42b04e
push edx
call fcn.004271e0
lea edx, [esp + 0x530]
push 3
push edx
call fcn.00427370
mov edx, 0x42b04e
push edx
call fcn.004271e0
mov edx, dword [esp + 0x558]
push edx
call fcn.004271e0
mov edx, 0x42b04e
push edx
call fcn.004271e0
lea eax, [esp + 0x524]
push eax
call fcn.004270e0
mov edx, dword [esp + 0x520]
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004271e0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push dword [esp + 0x578]
push dword [esp + 0x578]
lea eax, [esp + 0x584]
mov edx, dword [eax]
sub dword [esp], edx
mov edx, dword [eax + 4]
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
call fcn.00424b20
pop eax
mov edx, 0x42b04e
push edx
call fcn.004271e0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push dword [esp + 0x580]
push dword [esp + 0x580]
call fcn.00424b20
pop eax
mov edx, 0x42b04e
push edx
call fcn.004271e0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
mov eax, dword [esp + 0x54c]
cdq
push edx
push eax
call fcn.00424b20
pop eax
mov edx, 0x42b04e
push edx
call fcn.004271e0
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
lea ebp, [esp + 0xa8]
movsx eax, word [ebp + 0x1c]
cdq
push edx
push eax
call fcn.00424b20
pop eax
lea eax, [esp + 0x524]
push eax
call fcn.004270e0
movsx ebx, word [ebp + 0x1c]
push ebx
mov ebx, 0xe
cmp ebx, dword [esp]
je 0x4138d3
mov ebx, 0xf
cmp ebx, dword [esp]
jne 0x413928
lea edx, [esp + 0x530]
push edx
call fcn.004270a0
pop edx
push eax
push 3
push edx
call fcn.00427370
call fcn.00427340
mov edx, 0x42d0ea
call fcn.00414390
mov ecx, eax
call fcn.004143a0
je 0x413915
mov eax, dword [esp + 0x588]
mov dword [esp + 0x54c], eax
jmp 0x413923
mov eax, dword [esp + 0x584]
mov dword [esp + 0x54c], eax
jmp 0x4139fa
push dword [esp + 0x544]
mov ebx, 2
cmp ebx, dword [esp]
jne 0x41394c
mov eax, dword [esp + 0x580]
mov dword [esp + 0x550], eax
jmp 0x4139f9
lea edx, [esp + 0x534]
push edx
call fcn.004270a0
pop edx
push eax
push 3
push edx
call fcn.00427370
call fcn.00427340
mov edx, 0x42d0ea
call fcn.00414390
mov ecx, eax
call fcn.004143a0
je 0x41398e
mov eax, dword [esp + 0x584]
mov dword [esp + 0x550], eax
jmp 0x4139f9
lea edx, [esp + 0x524]
push edx
call fcn.004270a0
pop edx
push eax
push 2
push edx
call fcn.00427370
call fcn.00427340
lea edx, [0x43070c]
push edx
call fcn.004270a0
pop edx
push eax
push 2
push edx
call fcn.00427370
call fcn.00414390
mov edx, eax
call fcn.00414390
mov ecx, eax
call fcn.004143a0
je 0x4139eb
mov eax, dword [esp + 0x590]
mov dword [esp + 0x550], eax
jmp 0x4139f9
mov eax, dword [esp + 0x594]
mov dword [esp + 0x550], eax
pop eax
pop eax
push edx
call fcn.004270a0
pop edx
push eax
mov eax, 0x42d0ea
push eax
lea edx, [esp + 0x534]
push edx
call fcn.004270a0
pop edx
push eax
push 3
push edx
call fcn.00427370
call fcn.00414362
add dword [esp], edx
call fcn.00425570
call fcn.00414380
mov ebx, eax
cmp ebx, 1
jge 0x413adf
push dword [esp + 0x548]
push dword [esp + 0x524]
push 0xffffffff
push dword [0x430710]
call fcn.004181e4
lea edx, [esp + 0x51c]
push edx
call fcn.004270a0
pop edx
push eax
push 2
push edx
call fcn.00427370
call fcn.00427340
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push 0
push 0
push dword [0x430758]
call fcn.00417b47
call fcn.00414390
mov edx, eax
call fcn.00414390
mov ecx, eax
call fcn.004143a0
je 0x413adf
xor eax, eax
push eax
push 0
push dword [0x430758]
push dword [0x430710]
call fcn.00417ce1
mov ebx, eax
dec ebx
push ebx
push dword [0x430710]
call fcn.00403a5a
push dword [esp + 0x548]
push dword [esp + 0x524]
push 0xffffffff
push dword [0x430820]
call fcn.004181e4
lea edx, [esp + 0x51c]
push edx
call fcn.004270a0
pop edx
push eax
push 2
push edx
call fcn.00427370
call fcn.00427340
push edx
call fcn.004270a0
pop edx
push eax
push edx
call fcn.004270a0
pop edx
push eax
push 0
push 0
push dword [0x4306ec]
call fcn.00417b47
call fcn.00414390
mov edx, eax
call fcn.00414390
mov ecx, eax
call fcn.004143a0
je 0x413b7e
xor eax, eax
push eax
push 0
push dword [0x4306ec]
push dword [0x430820]
call fcn.00417ce1
mov ebx, eax
dec ebx
push ebx
push dword [0x430820]
call fcn.00403a5a
inc dword [esp + 0x534]
jno 0x412fe4
push dword [esp + 0x578]
call sub.USER32.dll_DestroyIcon
mov dword [esp + 0x534], eax
push dword [esp + 0x57c]
call sub.USER32.dll_DestroyIcon
mov dword [esp + 0x534], eax
push dword [esp + 0x580]
call sub.USER32.dll_DestroyIcon
mov dword [esp + 0x534], eax
push dword [esp + 0x584]
call sub.USER32.dll_DestroyIcon
mov dword [esp + 0x534], eax
push dword [esp + 0x58c]
call sub.USER32.dll_DestroyIcon
mov dword [esp + 0x534], eax
push dword [esp + 0x588]
call sub.USER32.dll_DestroyIcon
mov dword [esp + 0x534], eax
push 0
push dword [0x430758]
call fcn.0040b219
push 0
push dword [0x4306ec]
call fcn.0040b219
push 0
push dword [0x430710]
call fcn.0040b219
push 0
push dword [0x430820]
call fcn.0040b219
xor eax, eax
push dword [esp + 0x55c]
call fcn.00427310
push dword [esp + 0x520]
call fcn.00427310
push dword [esp + 0x558]
call fcn.00427310
push dword [esp + 0x54c]
call fcn.00427310
push dword [esp + 0x554]
call fcn.00427310
push dword [esp + 0x550]
call fcn.00427310
add esp, 0x590
pop edi
pop ebx
pop ebp
ret