Function at 0x1002f850
Capabilities:
Get disk information
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0x458]
sub esp, 0x458
push 0xffffffffffffffff
push 0x1006b8d9
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp + 0x454], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x18], esi
mov ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x38], ebx
lea ecx, [ebp + 0x24]
mov dword [ebp - 0x30], 0
call fcn.10003c19
mov dword [ebp - 4], 1
test esi, esi
jne 0x1002f8c3
lea eax, [ebp + 0x24]
mov ecx, ebx
push eax
call fcn.10002ee7
jmp 0x10030137
push str.Kernel32.dll
lea ecx, [ebp - 0x68]
call fcn.100028f0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x68]
push eax
call fcn.10030880
mov ecx, eax
call fcn.10030940
mov edi, eax
mov dword [ebp - 0x2c], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x68]
call fcn.100028eb
push str.Psapi.dll
lea ecx, [ebp - 0x50]
call fcn.100028f0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x50]
push eax
call fcn.10030880
mov ecx, eax
call fcn.10030940
mov esi, eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.100028eb
test esi, esi
je 0x1003012c
test edi, edi
je 0x1003012c
lea ecx, [ebp + 0x334]
call fcn.1002c590
cmp dword [ebp + 0x338], 6
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jb 0x1002fb50
push str.QueryFullProcessImageNameW
push edi
call ebx
mov esi, eax
test esi, esi
je 0x1002fb4d
push 0x412
lea eax, [ebp + 0x40]
push 0
push eax
call fcn.10048ef0
add esp, 0xc
mov dword [ebp + 0x3c], 0x208
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x40]
push eax
push 0
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x1002fb4d
mov eax, dword [ebp + 0x3c]
cmp eax, 0x208
jae 0x1002f9b6
add eax, eax
cmp eax, 0x412
jae 0x1003016f
xor ecx, ecx
mov word [ebp + eax + 0x40], cx
lea eax, [ebp + 0x40]
push eax
call fcn.10002ab7
add esp, 4
lea ecx, [ebp + 0x24]
mov ebx, eax
call fcn.100029a0
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x14], eax
cmp ebx, eax
ja 0x1002fa0b
mov esi, edi
cmp eax, 8
jb 0x1002f9e1
mov esi, dword [edi]
push ebx
lea eax, [ebp + 0x40]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10002a85
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10002a74
add esp, 0x14
jmp 0x1002fb44
lea ecx, [ebp + 0x24]
call fcn.10002ee1
cmp ebx, eax
ja 0x10030174
lea ecx, [ebp + 0x24]
call fcn.10002ee1
lea ecx, [ebp + 0x24]
mov esi, eax
call fcn.100029a0
mov ecx, ebx
or ecx, 7
mov dword [ebp - 0x24], ecx
cmp ecx, esi
ja 0x1002fa60
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1002fa60
lea eax, [edx + ecx]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10002a23
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1002fa72
or ecx, 0xffffffff
jmp 0x1002fa7a
cmp ecx, 0x1000
jb 0x1002faa5
lea eax, [ecx + 0x23]
cmp eax, ecx
mov ecx, 0xffffffff
cmovbe eax, ecx
push eax
call fcn.10045a5f
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10030179
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1002fab6
test ecx, ecx
je 0x1002fab4
push ecx
call fcn.10045a5f
add esp, 4
jmp 0x1002fab6
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x40]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [ebp - 0x10]
push eax
push esi
call fcn.10002a9e
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10002a74
mov ecx, dword [ebp - 0x14]
add esp, 0x14
cmp ecx, 8
jb 0x1002fb24
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1002fb13
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10030179
mov eax, edx
push ecx
push eax
call fcn.10045a8f
mov eax, dword [ebp - 0x10]
add esp, 8
mov dword [edi], eax
jmp 0x1002fb44
push edi
call fcn.10002bc4
push eax
push 4
call fcn.1000235c
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.10002bc4
add esp, 0x10
mov ecx, dword [eax]
mov dword [esi], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp + 0x24]
call fcn.100028d8
test al, al
je 0x1002fed6
push str.GetProcessImageFileNameW
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x1002fb80
push str.GetProcessImageFileNameW
push edi
call ebx
mov esi, eax
test esi, esi
je 0x1002fd52
push 0x412
lea eax, [ebp + 0x40]
push 0
push eax
call fcn.10048ef0
add esp, 0xc
lea eax, [ebp + 0x40]
push 0x208
push eax
push dword [ebp - 0x18]
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x1002fd52
add eax, eax
cmp eax, 0x412
jae 0x1003016f
xor ecx, ecx
mov word [ebp + eax + 0x40], cx
lea eax, [ebp + 0x40]
push eax
call fcn.10002ab7
add esp, 4
lea ecx, [ebp + 0x24]
mov ebx, eax
call fcn.100029a0
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x20], eax
cmp ebx, eax
ja 0x1002fc19
mov esi, edi
cmp eax, 8
jb 0x1002fbef
mov esi, dword [edi]
push ebx
lea eax, [ebp + 0x40]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10002a85
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10002a74
add esp, 0x14
jmp 0x1002fd52
lea ecx, [ebp + 0x24]
call fcn.10002ee1
cmp ebx, eax
ja 0x1003017e
lea ecx, [ebp + 0x24]
call fcn.10002ee1
lea ecx, [ebp + 0x24]
mov esi, eax
call fcn.100029a0
mov ecx, ebx
or ecx, 7
mov dword [ebp - 0x28], ecx
cmp ecx, esi
ja 0x1002fc6e
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1002fc6e
lea eax, [edx + ecx]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10002a23
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1002fc80
or ecx, 0xffffffff
jmp 0x1002fc88
cmp ecx, 0x1000
jb 0x1002fcb3
lea eax, [ecx + 0x23]
cmp eax, ecx
mov ecx, 0xffffffff
cmovbe eax, ecx
push eax
call fcn.10045a5f
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10030179
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1002fcc4
test ecx, ecx
je 0x1002fcc2
push ecx
call fcn.10045a5f
add esp, 4
jmp 0x1002fcc4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x40]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [ebp - 0x10]
push eax
push esi
call fcn.10002a9e
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10002a74
mov ecx, dword [ebp - 0x20]
add esp, 0x14
cmp ecx, 8
jb 0x1002fd32
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1002fd21
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10030179
mov eax, edx
push ecx
push eax
call fcn.10045a8f
mov eax, dword [ebp - 0x10]
add esp, 8
mov dword [edi], eax
jmp 0x1002fd52
push edi
call fcn.10002bc4
push eax
push 4
call fcn.1000235c
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.10002bc4
add esp, 0x10
mov ecx, dword [eax]
mov dword [esi], ecx
lea ecx, [ebp + 0x24]
call fcn.100028d8
test al, al
jne 0x1002fed6
push 0x410
call fcn.10045a56
push 0x410
mov ebx, eax
push 0
push ebx
call fcn.10048ef0
add esp, 0x10
mov dword [ebp + 0x20], 0
xorps xmm0, xmm0
lea ecx, [ebp + 0x18]
movq qword [ebp + 0x18], xmm0
call fcn.100028cb
mov byte [ebp - 4], 4
call fcn.10039c10
lea ecx, [ebp + 0x18]
mov dword [ebp + 0x3c], 0
call fcn.10002891
test eax, eax
je 0x1002fec1
lea ecx, [ebp + 0x18]
call fcn.100029a0
xor esi, esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
mov edi, dword [eax]
add edi, esi
mov ecx, edi
call fcn.100029d1
cmp eax, 3
jb 0x1002fdfc
mov ecx, edi
call fcn.100029a0
mov ecx, eax
mov edx, dword [eax + 0x14]
cmp edx, 8
jb 0x1002fde8
mov ecx, dword [eax]
cmp word [ecx + 4], 0x5c
jne 0x1002fdfc
cmp edx, 8
jb 0x1002fdf6
mov eax, dword [eax]
xor ecx, ecx
mov word [eax + 4], cx
push 0x208
push ebx
mov ecx, edi
call fcn.100028e0
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1002fe17
mov word [ebx], ax
mov esi, ebx
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1002fe20
sub esi, ecx
sar esi, 1
je 0x1002fe54
lea ecx, [ebp + 0x24]
call fcn.100029d1
cmp esi, eax
jae 0x1002fe54
push esi
push ebx
lea ecx, [ebp + 0x24]
call fcn.100028e0
push eax
call fcn.1004fd0a
add esp, 0xc
test eax, eax
je 0x1002fe78
mov edi, dword [ebp + 0x3c]
lea ecx, [ebp + 0x18]
mov esi, dword [ebp - 0x10]
inc edi
add esi, 0x18
mov dword [ebp + 0x3c], edi
mov dword [ebp - 0x10], esi
call fcn.10002891
cmp edi, eax
jae 0x1002fec1
mov eax, dword [ebp - 0x14]
jmp 0x1002fdc5
lea ecx, [ebp]
call fcn.10003c19
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x24]
call fcn.100028e0
mov ecx, edi
lea eax, [eax + esi*2]
push eax
call fcn.100028e0
push eax
lea eax, [ebp]
push str._s_s
push eax
call fcn.1002cbd0
add esp, 0x10
lea eax, [ebp]
lea ecx, [ebp + 0x24]
push eax
call fcn.1000f9d0
mov byte [ebp - 4], 4
lea ecx, [ebp]
call fcn.100028eb
push ebx
call fcn.10045856
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.100028c6
lea ecx, [ebp + 0x24]
call fcn.100028d8
test al, al
je 0x100300e4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetModuleFileNameExW
push dword [ebp - 0x1c]
call edi
mov esi, eax
test esi, esi
jne 0x1002ff10
push str.GetModuleFileNameExW
push dword [ebp - 0x2c]
call edi
mov esi, eax
test esi, esi
je 0x100300e4
push 0x412
lea eax, [ebp + 0x40]
push 0
push eax
call fcn.10048ef0
add esp, 0xc
lea eax, [ebp + 0x40]
push 0x208
push eax
push 0
push dword [ebp - 0x18]
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x100300e4
add eax, eax
cmp eax, 0x412
jae 0x1003016f
xor ecx, ecx
mov word [ebp + eax + 0x40], cx
lea eax, [ebp + 0x40]
push eax
call fcn.10002ab7
add esp, 4
lea ecx, [ebp + 0x24]
mov ebx, eax
call fcn.100029a0
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x20], eax
cmp ebx, eax
ja 0x1002ffab
mov esi, edi
cmp eax, 8
jb 0x1002ff81
mov esi, dword [edi]
push ebx
lea eax, [ebp + 0x40]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10002a85
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10002a74
add esp, 0x14
jmp 0x100300e4
lea ecx, [ebp + 0x24]
call fcn.10002ee1
cmp ebx, eax
ja 0x10030183
lea ecx, [ebp + 0x24]
call fcn.10002ee1
lea ecx, [ebp + 0x24]
mov esi, eax
call fcn.100029a0
mov ecx, ebx
or ecx, 7
mov dword [ebp - 0x28], ecx
cmp ecx, esi
ja 0x10030000
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x10030000
lea eax, [edx + ecx]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10002a23
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x10030012
or ecx, 0xffffffff
jmp 0x1003001a
cmp ecx, 0x1000
jb 0x10030045
lea eax, [ecx + 0x23]
cmp eax, ecx
mov ecx, 0xffffffff
cmovbe eax, ecx
push eax
call fcn.10045a5f
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10030179
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x10030056
test ecx, ecx
je 0x10030054
push ecx
call fcn.10045a5f
add esp, 4
jmp 0x10030056
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x40]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [ebp - 0x18]
push eax
push esi
call fcn.10002a9e
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10002a74
mov ecx, dword [ebp - 0x20]
add esp, 0x14
cmp ecx, 8
jb 0x100300c4
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x100300b3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10030179
mov eax, edx
push ecx
push eax
call fcn.10045a8f
mov eax, dword [ebp - 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x100300e4
push edi
call fcn.10002bc4
push eax
push 4
call fcn.1000235c
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call fcn.10002bc4
add esp, 0x10
mov ecx, dword [eax]
mov dword [esi], ecx
lea edx, [ebp + 0x24]
lea ecx, [ebp - 0x50]
call fcn.10032000
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x24]
push eax
call fcn.100039c9
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.100028eb
mov ecx, dword [ebp - 0x34]
lea eax, [ebp + 0x24]
push eax
call fcn.10002ee7
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
call fcn.100028eb
mov eax, dword [ebp - 0x34]
jmp 0x1003014c
lea eax, [ebp + 0x24]
mov ecx, ebx
push eax
call fcn.10002ee7
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
call fcn.100028eb
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x454]
xor ecx, ebp
call fcn.10045845
lea esp, [ebp + 0x458]
pop ebp
ret
call fcn.1004597c
call fcn.10002e9f
call fcn.1004eec7
call fcn.10002e9f
call fcn.10002e9f
int3