Function at 0x40b5b0
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov eax, 0x1218
call fcn.00412cb0
mov eax, dword [0x42d0f0]
xor eax, esp
mov dword [esp + 0x1214], eax
push ebx
mov ebx, dword [esp + 0x1224]
push ebp
mov ebp, dword [esp + 0x1224]
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x40ba51
mov ecx, dword [ebp + 0x238]
mov edx, dword [ecx + 0x94]
mov eax, dword [ebp + 0x234]
push ebx
push edx
call eax
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x40b71e
test eax, eax
jne 0x40b639
mov ecx, dword [ebp + 0x234]
push ebx
push str.Ignoring_volume__s_because_the_drive_type_cannot_be_determined.
call ecx
add esp, 8
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
cmp eax, 1
jne 0x40b666
mov edx, dword [ebp + 0x234]
push ebx
push str.Ignoring_volume__s_because_there_is_no_volume_mounted.
call edx
add esp, 8
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
cmp eax, 2
jne 0x40b693
mov eax, dword [ebp + 0x234]
push ebx
push str.Ignoring_volume__s_because_it_has_removable_media.
call eax
add esp, 8
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
cmp eax, 4
jne 0x40b6c0
mov ecx, dword [ebp + 0x234]
push ebx
push str.Ignoring_volume__s_because_it_is_a_remote__network__drive.
call ecx
add esp, 8
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
cmp eax, 5
jne 0x40b6ed
mov edx, dword [ebp + 0x234]
push ebx
push str.Ignoring_volume__s_because_it_is_a_CD_ROM_drive.
call edx
add esp, 8
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
cmp eax, 6
jne 0x40ba51
mov eax, dword [ebp + 0x234]
push ebx
push str.Ignoring_volume__s_because_it_is_a_RAM_disk.
call eax
add esp, 8
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
push 0x200
lea ecx, [esp + 0x418]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x40b7c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x40b779
mov edx, dword [ebp + 0x238]
mov eax, dword [edx + 0xe4]
mov ecx, dword [ebp + 0x22c]
push ebx
push eax
push 0
push 0
call ecx
add esp, 0x10
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
push 0x200
lea edx, [esp + 0x818]
push edx
push eax
call sym.JkDefrag.exe_SystemErrorStr
mov ecx, dword [ebp + 0x238]
mov edx, dword [ecx + 0xa0]
lea eax, [esp + 0x820]
push eax
mov eax, dword [ebp + 0x22c]
push ebx
push edx
push 0
push 0
call eax
add esp, 0x20
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push 0
lea edx, [esp + 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test dword [esp + 0xc], 0x80000
je 0x40b821
mov eax, dword [ebp + 0x238]
mov ecx, dword [eax + 0x90]
mov edx, dword [ebp + 0x234]
push ebx
push ecx
call edx
add esp, 8
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
lea eax, [esp + 0x414]
push eax
lea ecx, [esp + 0x18]
push 0x200
push ecx
call fcn.00411f80
lea edx, [esp + 0x20]
push 0
push edx
call fcn.0041246b
lea ecx, [esp + 0x28]
add esp, 0x14
cmp eax, ecx
je 0x40b85d
sub eax, 2
cmp word [eax], 0x5c
jne 0x40b85d
xor edx, edx
mov word [eax], dx
push esi
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b8d2
push 0x200
lea ecx, [esp + 0x81c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.JkDefrag.exe_SystemErrorStr
mov ecx, dword [ebp + 0x22c]
lea edx, [esp + 0x824]
push edx
push ebx
lea eax, [esp + 0x2c]
push eax
push str.Cannot_open_volume__s_at_mountpoint__s:__s
push 0
push 1
call ecx
add esp, 0x24
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0x90028
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x40b92f
mov ecx, dword [ebp + 0x238]
mov edx, dword [ecx + 0x7c]
push ebx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [ebp + 0x22c]
push edx
push 0
push 0
call eax
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1214]
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea edx, [eax + 2]
jmp 0x40b940
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b940
sub eax, edx
sar eax, 1
push edi
lea edi, [eax + 2]
lea ecx, [edi + edi]
push ecx
call fcn.00412a5f
mov esi, eax
add esp, 4
test esi, esi
je 0x40b98a
push ebx
push 0x424ab8
push edi
push esi
call fcn.00411311
mov edx, dword [esp + 0x1244]
push edx
push esi
push ebp
call fcn.0040aa20
push esi
call fcn.00412c14
add esp, 0x20
push 0x304
lea eax, [esp + 0xc20]
push eax
lea ecx, [esp + 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40ba4f
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b9b7
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [esp + 0xc1c]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b9d2
sub eax, esi
sar eax, 1
lea edi, [eax + edx + 1]
lea edx, [edi + edi]
push edx
call fcn.00412a5f
mov esi, eax
add esp, 4
test esi, esi
je 0x40ba24
lea eax, [esp + 0xc1c]
push eax
push ebx
push str._s_s
push edi
push esi
call fcn.00411311
mov ecx, dword [esp + 0x1248]
push ecx
push esi
push ebp
call fcn.0040b5b0
push esi
call fcn.00412c14
add esp, 0x24
mov eax, dword [esp + 0x10]
push 0x304
lea edx, [esp + 0xc20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
test eax, eax
jne 0x40b9b2
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
pop edi
pop esi
mov ecx, dword [esp + 0x121c]
pop ebp
pop ebx
xor ecx, esp
call fcn.00411002
add esp, 0x1218
ret