Function at 0x1008b9e
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [section..data]
cmp eax, section..data
je 0x1008bcd
test dword [eax + 0x1c], 0x20000000
je 0x1008bcd
push 0x1001b1c
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010020a5
push esi
push edi
push 1
push 0x237
push 0x1001b40
lea ecx, [ebp - 0x40]
call fcn.0100771f
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
cmp dword [ebp + 0xc], edi
je 0x1008c04
mov ecx, dword [ebp + 0xc]
call fcn.01009eb9
lea eax, [ebp - 0x10]
push eax
push 0x10
call dword [sym.imp.ntdll.dll_RtlSetThreadErrorMode]
mov ecx, eax
call fcn.010089d6
mov dword [ebp - 0x40], eax
cmp eax, edi
mov eax, 0x247
jge 0x1008c2c
mov word [ebp - 0x3a], ax
jmp 0x1008eae
mov word [ebp - 0x3c], ax
mov eax, 0x249
cmp dword [ebp + 0xc], edi
jne 0x1008c43
mov dword [ebp - 0x40], 0x80070057
jmp 0x1008c23
push 0x20
pop esi
push ebx
push esi
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x40], edi
call fcn.01008a45
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ebx, [esi + esi + 2]
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x1008cc2
push ebx
mov ecx, 0x252
push edi
push eax
mov dword [ebp - 0x40], edi
mov word [ebp - 0x3c], cx
call sub.msvcrt.dll_memset
mov ebx, dword [ebp - 8]
add esp, 0xc
push edi
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x1008cd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
je 0x1008cd3
cmp eax, 0xea
jne 0x1008e95
mov eax, 0x261
jmp 0x1008c47
mov dword [ebp - 0x40], 0x8007000e
mov eax, 0x252
jmp 0x1008ea9
xor eax, eax
mov word [ebx + esi*2], ax
cmp word [ebx], di
je 0x1008cfc
mov ecx, dword [ebp + 0xc]
mov edx, ebx
call fcn.0100a785
mov dword [ebp - 0x40], eax
cmp eax, edi
mov eax, 0x267
jl 0x1008ea9
mov word [ebp - 0x3c], ax
mov dword [ebp - 0xc], 0x40
mov ebx, 0x271
push dword [ebp - 0xc]
call fcn.01008a45
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esi + esi]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1008d63
mov ecx, ebx
mov word [ebp - 0x3c], cx
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x40], edi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x1008d85
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1008d73
mov eax, 0x277
mov dword [ebp - 0x40], edi
mov word [ebp - 0x3c], ax
jmp 0x1008d08
mov dword [ebp - 0x40], 0x8007000e
mov word [ebp - 0x3a], bx
jmp 0x1008ead
call fcn.01008973
mov dword [ebp - 0x40], eax
mov eax, 0x277
jmp 0x1008ea9
mov esi, dword [ebp - 4]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1008d8d
mov ebx, dword [ebp + 0xc]
sub eax, edx
sar eax, 1
je 0x1008e74
mov eax, dword [ebp - 8]
cmp word [eax], di
je 0x1008dcc
mov edx, 0x1001b3c
mov ecx, ebx
call fcn.0100a785
mov dword [ebp - 0x40], eax
cmp eax, edi
mov eax, 0x287
jl 0x1008ea9
mov word [ebp - 0x3c], ax
mov edx, 0x1001b38
mov ecx, ebx
call fcn.0100a785
mov dword [ebp - 0x40], eax
cmp eax, edi
mov eax, 0x289
jl 0x1008ea9
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 4]
cmp word [eax], di
je 0x1008e58
cmp esi, dword [ebp - 4]
je 0x1008e19
mov edx, 0x1001b30
mov ecx, ebx
call fcn.0100a785
mov dword [ebp - 0x40], eax
cmp eax, edi
mov eax, 0x28f
jl 0x1008ea9
mov word [ebp - 0x3c], ax
mov edx, esi
mov ecx, ebx
call fcn.0100a785
mov dword [ebp - 0x40], eax
cmp eax, edi
mov eax, 0x291
jl 0x1008ea9
push 0x5c
pop edx
mov ecx, ebx
mov word [ebp - 0x3c], ax
call fcn.01009f87
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1008e41
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
cmp word [esi], di
jne 0x1008df4
mov edx, 0x1001b2c
mov ecx, ebx
call fcn.0100a785
mov dword [ebp - 0x40], eax
cmp eax, edi
mov eax, 0x294
jl 0x1008ea9
mov word [ebp - 0x3c], ax
cmp dword [ebx + 4], edi
jne 0x1008ead
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.0100a841
mov dword [ebp - 0x40], eax
cmp eax, edi
mov eax, 0x299
jl 0x1008ea9
mov word [ebp - 0x3c], ax
jmp 0x1008ead
call fcn.01008973
mov dword [ebp - 0x40], eax
mov eax, 0x261
mov dword [ebp - 0x38], 1
mov word [ebp - 0x3a], ax
pop ebx
push dword [ebp - 4]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
call esi
push dword [ebp - 8]
call esi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_RtlSetThreadErrorMode]
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.010078e6
pop edi
mov eax, esi
pop esi
leave
ret 8