Function at 0x42c9b3
Capabilities:
Get disk information
Get disk size
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37ac
call fcn.00453130
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x375c], 0
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebx + 8]
lea eax, [ebx + 0xc]
cmp edi, 0x3f
je 0x42ca1d
push ecx
push 0x469a48
push eax
call fcn.00450c76
add edi, 0x41
push edi
lea eax, [ebx + 0x4c]
push str.._c:
push eax
call fcn.00450c76
push edi
lea eax, [ebx + 0x8c]
push str.._c:_
push eax
call fcn.00450c76
add esp, 0x24
jmp 0x42ca5f
cmp byte [eax], 0
mov edi, 0x469a48
jne 0x42ca32
push ecx
push edi
push eax
call fcn.00450c76
add esp, 0xc
lea eax, [ebx + 0x4c]
cmp byte [eax], 0
jne 0x42ca45
push esi
push edi
push eax
call fcn.00450c76
add esp, 0xc
lea eax, [ebx + 0x8c]
cmp byte [eax], 0
jne 0x42ca5f
push esi
push 0x46a500
push eax
call fcn.00450c76
add esp, 0xc
push str._GLOBALROOTDeviceRamDiskInvisible
push esi
call fcn.00450597
pop ecx
pop ecx
test eax, eax
jne 0x42ca89
mov eax, 0x46daae
lea edx, [ebx + 0xcc]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42ca7d
jmp 0x42ca9c
push 0x64
lea eax, [ebx + 0xcc]
push eax
lea eax, [ebx + 0x50]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_QueryDosDeviceA]
push str.Collecting_Information
push 0x3f6
call fcn.00447f71
pop ecx
pop ecx
lea edi, [ebx + 0xcc]
push edi
push dword [0x48243c]
call fcn.0040cb24
test eax, eax
je 0x42caca
xor eax, eax
jmp 0x42d3ec
mov ecx, dword [0x4cdfa8]
or dword [ebp - 0x3770], 0xffffffff
call fcn.00446358
cmp eax, 1
jne 0x42cb23
mov ecx, dword [0x4cdfa8]
call fcn.00446281
cmp eax, 1
jne 0x42cb23
lea ecx, [ebx + 0x19c]
push ecx
lea ecx, [ebx + 0x198]
lea eax, [ebx + 0x130]
push ecx
push eax
push eax
call fcn.00428697
lea eax, [ebp - 0x3770]
push eax
push str._GLOBALROOTDeviceHarddiskVolumeShadowCopy_d
push esi
call fcn.00451ad6
add esp, 0xc
jmp 0x42cb3b
lea eax, [ebx + 0x19c]
push eax
lea eax, [ebx + 0x198]
push eax
push edi
lea eax, [ebx + 0x4c]
push eax
call fcn.00428697
call fcn.0041abd1
xor esi, esi
push 0x4ac
lea eax, [ebp - 0x36d0]
push esi
push eax
mov dword [ebp - 0x3758], esi
mov dword [ebp - 0x36d4], esi
call fcn.00450230
mov eax, dword [ebx + 0x398]
add esp, 0xc
cmp eax, esi
je 0x42cb7a
push eax
call fcn.0045038b
pop ecx
mov dword [ebx + 0x398], esi
cmp dword [ebp - 0x3758], esi
je 0x42cb92
push 0x3e8
call dword [sym.imp.___total_physical_size__lu_MB_Sleep]
call fcn.0041abd1
inc dword [ebp - 0x3758]
cmp dword [ebp - 0x3758], 0x12c
jge 0x42d3e9
mov eax, dword [ebx + 0x248]
cmp eax, esi
je 0x42cbc5
push 0x8000
push esi
push eax
call dword [sym.imp.___total_physical_size__lu_MB_VirtualFree]
mov dword [ebx + 0x248], esi
push dword [ebx + 0x194]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
or dword [ebx + 0x194], 0xffffffff
lea eax, [ebx + 0x4c]
push eax
call fcn.00428316
mov dword [ebx + 0x194], eax
cmp eax, 0xffffffff
je 0x42cac3
call fcn.0040cc01
test eax, eax
jne 0x42cac3
push 0x10
lea eax, [ebx + 0x20c]
push eax
lea eax, [ebx + 0x208]
push eax
lea eax, [ebx + 0x204]
push eax
lea eax, [ebx + 0x200]
push eax
push 0x41
lea eax, [ebx + 0x1bc]
push eax
lea eax, [ebx + 0x8c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetVolumeInformationA]
push 0x60
lea eax, [ebp - 0x3754]
push eax
push esi
push esi
push 0x90064
lea eax, [ebp - 0x37ac]
push eax
push dword [ebx + 0x194]
call fcn.00428243
lea edi, [ebx + 0x21c]
test eax, eax
jne 0x42cca9
mov ecx, dword [ebp - 0x372c]
mov eax, dword [ebp - 0x3728]
xor edx, edx
div ecx
cmp dword [ebp - 0x3740], 0
mov dword [ebx + 0x220], ecx
mov dword [edi], eax
jg 0x42d3fd
mov eax, dword [ebp - 0x3744]
jl 0x42cc93
cmp eax, 0xffffffff
ja 0x42d3fd
mov ecx, dword [ebp - 0x373c]
lea esi, [ebx + 0x228]
mov dword [ebx + 0x224], ecx
mov dword [esi], eax
jmp 0x42ccd4
lea esi, [ebx + 0x228]
push esi
lea eax, [ebx + 0x224]
push eax
lea ecx, [ebx + 0x220]
push ecx
push edi
lea eax, [ebx + 0x8c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetDiskFreeSpaceA]
test eax, eax
je 0x42d434
cmp dword [ebx + 0x220], 0x200
mov eax, dword [ebx + 0x224]
mov dword [ebp - 0x3768], eax
jne 0x42d51f
mov edi, dword [edi]
mov eax, dword [esi]
shl edi, 9
mul edi
and dword [ebx + 0x238], 0
mov dword [ebx + 0x22c], edi
mov dword [ebx + 0x230], eax
mov dword [ebx + 0x234], edx
mov ecx, dword [ebx + 0x238]
xor eax, eax
inc eax
shl eax, cl
cmp eax, edi
je 0x42cd2d
inc ecx
mov dword [ebx + 0x238], ecx
cmp ecx, 0x20
jb 0x42cd12
cmp dword [ebx + 0x238], 0x20
jae 0x42d543
cmp dword [ebp - 0x3758], 2
jg 0x42cd93
cmp edi, dword [0x4cd2b0]
jb 0x42cd93
push 4
mov edi, 0x472574
lea esi, [ebx + 0x20c]
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42cd87
push 6
mov edi, 0x473d5c
lea esi, [ebx + 0x20c]
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42cd87
push 5
mov edi, 0x46eea8
lea esi, [ebx + 0x20c]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x42cd93
mov dword [ebp - 0x376c], 1
jmp 0x42cd9a
and dword [ebp - 0x376c], 0
lea eax, [ebx + 0x20c]
push eax
push dword [ebx + 0x194]
call fcn.004285ce
xor edi, edi
add dword [ebx + 0x230], eax
mov dword [ebx + 0x240], eax
mov eax, edi
adc dword [ebx + 0x234], eax
push ebx
mov dword [ebx + 0x244], edi
call fcn.004283ba
cmp dword [0x4cd2a0], edi
je 0x42d555
cmp dword [ebp - 0x3758], 1
jne 0x42cf40
mov esi, dword [ebx + 0x228]
add esi, 7
shr esi, 3
lea eax, [esi + 0x1420]
and eax, 0xfffff000
inc eax
push eax
call fcn.00452122
push esi
mov dword [ebx + 0x398], eax
add eax, 0x10
push 0xff
push eax
call fcn.00450230
mov eax, dword [ebx + 0x398]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov eax, dword [ebx + 0x398]
mov edx, dword [ebx + 0x228]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, dword [0x4cd2d0]
add esp, 0x10
cmp eax, ecx
je 0x42ce4c
push eax
push ebx
call fcn.0042ad37
xor esi, esi
push esi
push str.PAGEFILE.SYS
push ebx
call fcn.0042a56d
push esi
push str.HIBERFIL.SYS
push ebx
call fcn.0042a56d
push esi
push str.WIN386.SWP
push ebx
call fcn.0042a56d
push esi
push str.386SPART.PAR
push ebx
call fcn.0042a56d
cmp dword [ebp - 0x3770], 0xffffffff
je 0x42cf40
mov esi, 0x800
push esi
lea eax, [ebx + 0xcc]
push eax
lea eax, [ebp - 0x1224]
push eax
call fcn.004561f2
lea eax, [ebp - 0x1224]
push eax
push str._sSystem_Volume_Information_
lea eax, [ebp - 0x2224]
push esi
push eax
call fcn.0042f7a5
push esi
lea eax, [ebp - 0x224]
push str.3808876b_c176_4e48_b7ae_04046e6cc752
push eax
call fcn.004561f2
lea eax, [ebp - 0x224]
push eax
push 0x473cb4
lea eax, [ebp - 0x3224]
push esi
push eax
call fcn.0042f7a5
add esp, 0x38
push ebx
push 0x42c953
push 0
push 1
lea eax, [ebp - 0x3224]
push eax
lea eax, [ebp - 0x2224]
push eax
call fcn.00413ccc
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x3770]
lea eax, [ebp - 0x1224]
push eax
push str._sSystem_Volume_Information_d_s
lea eax, [ebp - 0x2224]
push esi
push eax
call fcn.0042f7a5
add esp, 0x18
push 0
lea eax, [ebp - 0x2224]
push eax
push ebx
call fcn.00429efa
lea eax, [ebp - 0x3778]
push eax
lea eax, [ebp - 0x3768]
push eax
lea eax, [ebp - 0x3778]
push eax
push eax
lea eax, [ebx + 0x8c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetDiskFreeSpaceA]
xor edi, edi
cmp dword [ebp - 0x376c], edi
je 0x42cf85
push str.Scanning_for_FileLengths___1
push 0x3f6
call fcn.00447f71
pop ecx
pop ecx
push edi
push ebx
call fcn.0042993b
push dword [ebx + 0x228]
push ebx
call fcn.004284a9
cmp dword [ebx + 0x248], edi
je 0x42d23f
mov dword [ebp - 0x375c], edi
cmp dword [ebx + 0x398], edi
je 0x42d01c
mov eax, dword [ebx + 0x228]
add eax, 7
test eax, 0xfffffff8
jbe 0x42cfe2
mov eax, dword [ebx + 0x248]
mov ecx, dword [ebx + 0x398]
mov cl, byte [edi + ecx + 0x10]
lea eax, [eax + edi + 0x10]
and byte [eax], cl
mov eax, dword [ebx + 0x228]
add eax, 7
inc edi
shr eax, 3
cmp edi, eax
jb 0x42cfbb
xor eax, eax
cmp dword [ebx + 0x228], eax
jbe 0x42d01a
mov edi, dword [ebx + 0x398]
mov esi, dword [ebx + 0x228]
xor edx, edx
mov ecx, eax
and ecx, 7
inc edx
shl edx, cl
mov ecx, eax
shr ecx, 3
mov cl, byte [ecx + edi + 0x10]
test cl, dl
jne 0x42d015
inc dword [ebp - 0x375c]
inc eax
cmp eax, esi
jb 0x42cff8
xor edi, edi
mov eax, dword [ebx + 0x248]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov edx, ecx
or edx, eax
je 0x42d04d
push eax
push ecx
push str.startLcn___0__I64X
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x3d5
push str.NTCPVOL2FILE
call fcn.0044dc85
add esp, 0x18
mov eax, dword [ebx + 0x248]
mov ecx, dword [ebx + 0x228]
xor edx, edx
cmp dword [eax + 8], ecx
jne 0x42d067
mov eax, dword [eax + 0xc]
cmp eax, edx
je 0x42d09f
push 0
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
push dword [ebx + 0x228]
mov eax, dword [ebx + 0x248]
push dword [eax + 0xc]
push dword [eax + 8]
push str.ClustersToEndOfVol__I64u___Info__TotalNumberOfClusters__u_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x3db
push str.NTCPVOL2FILE
call fcn.0044dc85
add esp, 0x1c
mov eax, dword [ebx + 0x228]
xor edx, edx
mov dword [ebp - 0x3764], edx
mov dword [ebp - 0x3760], eax
cmp eax, edx
jbe 0x42d0e1
mov edi, dword [ebx + 0x248]
mov esi, eax
xor eax, eax
mov ecx, edx
and ecx, 7
inc eax
shl eax, cl
mov ecx, edx
shr ecx, 3
mov cl, byte [ecx + edi + 0x10]
test cl, al
jne 0x42d0dc
inc dword [ebp - 0x3764]
inc edx
cmp edx, esi
jb 0x42d0bf
mov eax, dword [ebx + 0x21c]
xor ecx, ecx
push ecx
push eax
push ecx
push dword [ebx + 0x224]
call fcn.00453310
xor ecx, ecx
push ecx
push dword [ebx + 0x220]
push edx
push eax
call fcn.00453310
mov dword [ebp - 0x3794], eax
xor eax, eax
push eax
push dword [ebx + 0x21c]
mov dword [ebp - 0x3790], edx
push eax
push dword [ebp - 0x3760]
call fcn.00453310
xor ecx, ecx
push ecx
push dword [ebx + 0x220]
push edx
push eax
call fcn.00453310
mov dword [ebp - 0x3788], eax
lea eax, [ebp - 0x37a4]
push eax
lea eax, [ebp - 0x3780]
push eax
lea eax, [ebp - 0x379c]
push eax
lea eax, [ebx + 0x8c]
push eax
mov dword [ebp - 0x3784], edx
call dword [sym.imp.___total_physical_size__lu_MB_GetDiskFreeSpaceExA]
test byte [0x4cdde0], 0x20
je 0x42d21e
push dword [ebp - 0x3790]
push dword [ebp - 0x3794]
push dword [ebp - 0x3784]
push dword [ebp - 0x3788]
push str.GetDiskFreeSpace:__TotalBytes__I64u_FreeBytes__I64u_n
call fcn.00450f5c
push dword [ebp - 0x3798]
push dword [ebp - 0x379c]
push dword [ebp - 0x37a0]
push dword [ebp - 0x37a4]
push dword [ebp - 0x377c]
push dword [ebp - 0x3780]
push str.GetDiskFreeSpaceEx:TotalBytes__I64u_FreeBytes__I64u_FreeForUser__I64u_n
call fcn.00450f5c
mov edi, dword [ebx + 0x21c]
mov esi, dword [ebx + 0x220]
add esp, 0x30
xor eax, eax
push eax
push edi
push eax
push dword [ebp - 0x3764]
call fcn.00453310
xor ecx, ecx
push ecx
push esi
push edx
push eax
call fcn.00453310
push edx
push eax
xor eax, eax
push eax
mov eax, dword [ebx + 0x248]
push edi
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00453310
xor ecx, ecx
push ecx
push esi
push edx
push eax
call fcn.00453310
push edx
push eax
push str.by_BitMap:_________TotalBytes__I64u_FreeBytes__I64u_n
call fcn.00450f5c
add esp, 0x14
mov eax, dword [ebp - 0x375c]
sub eax, dword [ebp - 0x3764]
mov ecx, dword [ebp - 0x3758]
add eax, dword [ebx + 0x224]
xor edi, edi
mov dword [ebp + ecx*4 - 0x36d4], eax
mov esi, dword [ebp - 0x375c]
cmp dword [ebx + 0x248], edi
je 0x42d26e
cmp dword [ebp - 0x376c], edi
je 0x42d26e
push str.Scanning_for_FileLengths___2
push 0x3f6
call fcn.00447f71
pop ecx
pop ecx
push 1
push ebx
call fcn.0042993b
lea eax, [ebp - 0x3774]
push eax
lea eax, [ebp - 0x378c]
push eax
lea eax, [ebp - 0x3774]
push eax
push eax
lea eax, [ebx + 0x8c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetDiskFreeSpaceA]
mov eax, dword [ebp - 0x378c]
cmp eax, dword [ebp - 0x3768]
je 0x42d2c0
push dword [ebp - 0x3758]
push dword [ebp - 0x3768]
push eax
push str.Filesystem_too_busy___lu____lu___retrying__d_n
call fcn.00450f5c
add esp, 0x10
xor esi, esi
jmp 0x42cb7a
mov eax, dword [ebp - 0x3758]
lea eax, [ebp + eax*4 - 0x36d4]
mov ecx, dword [eax]
cmp ecx, edi
je 0x42d2d8
cmp ecx, dword [eax - 4]
jne 0x42d2b9
call fcn.0042822a
mov eax, dword [ebx + 0x398]
cmp eax, edi
je 0x42d2f4
push eax
call fcn.0045038b
pop ecx
mov dword [ebx + 0x398], edi
call fcn.004552b3
add eax, 0x20
push eax
call fcn.00450a39
push eax
call fcn.0045525d
pop ecx
pop ecx
test eax, eax
jne 0x42d35f
lea eax, [ebp - 0x3760]
push eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x3760], 0x80
call dword [sym.imp.___total_physical_size__lu_MB_GetComputerNameA]
lea eax, [ebp - 0x3780]
push eax
call fcn.00452ccd
lea eax, [ebp - 0x3780]
push eax
call fcn.004529e5
push eax
call fcn.004563bf
push eax
lea eax, [ebp - 0x88]
push eax
push str.Backup_on__s_started_at__s_n
call fcn.00450f5c
add esp, 0x18
cmp dword [0x4cd324], edi
jne 0x42d37e
push dword [0x4cdda8]
lea eax, [ebx + 0xc]
push eax
push str.saving__s_____s_n
call fcn.00450f5c
add esp, 0xc
xor eax, eax
xor edx, edx
add esi, dword [ebx + 0x224]
push edi
push dword [ebx + 0x22c]
adc eax, edx
push eax
push esi
call fcn.00453310
mov ecx, dword [ebx + 0x230]
sub ecx, eax
mov eax, dword [ebx + 0x234]
push 9
sbb eax, edx
push eax
push ecx
call fcn.0040c6f5
push eax
mov eax, dword [ebx + 0x22c]
mul dword [ebx + 0x224]
push 9
push edx
push eax
call fcn.0040c6f5
push eax
push 9
push dword [ebx + 0x234]
push dword [ebx + 0x230]
call fcn.0040c6f5
push eax
push str.free_space_info:_total__sB___sB_free___sB_must_be_saved
call fcn.0041c7ee
add esp, 0x10
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 0xc
push 0
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
push dword [ebp - 0x3740]
push dword [ebp - 0x3744]
push str.Number_of_clusters___I64d__is_too_large._nThis_version_supports_only_up_to_4109_clusters._n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x31a
push str.NTCPVOL2FILE
call fcn.0044dc85
add esp, 0x18
jmp 0x42cac3
mov esi, dword [sym.imp.___total_physical_size__lu_MB_DeviceIoControl]
xor edi, edi
push edi
lea eax, [ebp - 0x3760]
push eax
push 0x20
lea eax, [ebp - 0x36f4]
push eax
push edi
push edi
push 0x74004
push dword [ebx + 0x194]
call esi
test eax, eax
jne 0x42d4cd
push edi
lea eax, [ebp - 0x3760]
push eax
push 0x90
lea eax, [ebp - 0x94]
push eax
push edi
push edi
push 0x70048
push dword [ebx + 0x194]
call esi
test eax, eax
jne 0x42d4b6
mov ecx, dword [0x4cdfa8]
call fcn.00446246
push eax
push str.Cant_get_PartitionInfo_for__s_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x338
push str.NTCPVOL2FILE
call fcn.0044dc85
add esp, 0x14
jmp 0x42cac3
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x36ec], ecx
mov dword [ebp - 0x36e8], eax
jmp 0x42d4d9
mov eax, dword [ebp - 0x36e8]
mov ecx, dword [ebp - 0x36ec]
mov dword [ebx + 0x230], ecx
shrd ecx, eax, 9
xor esi, esi
mov edx, 0x200
inc esi
mov dword [ebx + 0x234], eax
push ebx
mov dword [ebx + 0x21c], esi
mov dword [ebx + 0x220], edx
mov dword [ebx + 0x22c], edx
mov dword [ebx + 0x224], edi
shr eax, 9
mov dword [ebx + 0x228], ecx
call fcn.004283ba
mov eax, esi
jmp 0x42d3ec
push 0
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
push dword [ebx + 0x220]
push str.The_device_has_a_Sector_size_of__u_bytes_nThis_Sector_size_is_currently_not_supported_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x352
jmp 0x42d4a4
push edi
push str._n_nillegal_clustersize__u
call fcn.00450f5c
pop ecx
pop ecx
jmp 0x42cac3
mov dword [ebx + 0x224], edi
jmp 0x42d3e9