Function at 0x489724
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x56
push 0
push 0
dec ecx
jne 0x48972c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x489e73
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x118]
mov ecx, pe_nt_image_headers32
call fcn.004053d8
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 4]
call fcn.00409d0c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405888
push pe_nt_image_headers32
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 4]
call fcn.004055f8
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4897d4
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.0040a164
call fcn.004896f8
test al, al
je 0x4897ea
lea eax, [ebp - 0x228]
call fcn.0048970c
jmp 0x489806
mov dword [ebp - 0x228], 0x88
mov dword [ebp - 0x21c], 0x3f31873
mov eax, dword [ebp - 0xc]
call fcn.00405158
push dword [ebp - 8]
push 0x489e8c
lea ecx, [ebp - 0x230]
mov edx, 8
mov eax, dword [ebp - 0x228]
call fcn.0040a13c
push dword [ebp - 0x230]
push 0x489e8c
lea ecx, [ebp - 0x234]
mov edx, 8
mov eax, dword [ebp - 0x220]
call fcn.0040a13c
push dword [ebp - 0x234]
push 0x489e8c
lea ecx, [ebp - 0x238]
mov edx, 8
mov eax, dword [ebp - 0x21c]
call fcn.0040a13c
push dword [ebp - 0x238]
lea eax, [ebp - 8]
mov edx, 7
call fcn.004054fc
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.004896ac
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.00409d0c
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 8]
call fcn.004051f0
lea eax, [ebp - 4]
call fcn.00405158
mov ebx, 1
or esi, 0xffffffff
lea eax, [ebp - 0x244]
push eax
mov edi, ebx
add edi, edi
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x244]
mov edx, 0x489e98
call fcn.00405590
jne 0x4898ec
mov esi, 1
jmp 0x489e0a
lea eax, [ebp - 0x248]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x248]
mov edx, 0x489ea4
call fcn.00405590
jne 0x48991e
mov esi, 2
jmp 0x489e0a
lea eax, [ebp - 0x24c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x24c]
mov edx, 0x489eb0
call fcn.00405590
jne 0x489950
mov esi, 3
jmp 0x489e0a
lea eax, [ebp - 0x250]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x250]
mov edx, 0x489ebc
call fcn.00405590
jne 0x489982
mov esi, 4
jmp 0x489e0a
lea eax, [ebp - 0x254]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x254]
mov edx, 0x489ec8
call fcn.00405590
jne 0x4899b4
mov esi, 5
jmp 0x489e0a
lea eax, [ebp - 0x258]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x258]
mov edx, 0x489ed4
call fcn.00405590
jne 0x4899e6
mov esi, 6
jmp 0x489e0a
lea eax, [ebp - 0x25c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x25c]
mov edx, 0x489ee0
call fcn.00405590
jne 0x489a18
mov esi, 7
jmp 0x489e0a
lea eax, [ebp - 0x260]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x260]
mov edx, 0x489eec
call fcn.00405590
jne 0x489a4a
mov esi, 8
jmp 0x489e0a
lea eax, [ebp - 0x264]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x264]
mov edx, 0x489ef8
call fcn.00405590
jne 0x489a7c
mov esi, 9
jmp 0x489e0a
lea eax, [ebp - 0x268]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x268]
mov edx, 0x489f04
call fcn.00405590
jne 0x489aae
mov esi, 0xa
jmp 0x489e0a
lea eax, [ebp - 0x26c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x26c]
mov edx, 0x489f10
call fcn.00405590
jne 0x489ae0
mov esi, 0xb
jmp 0x489e0a
lea eax, [ebp - 0x270]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x270]
mov edx, 0x489f1c
call fcn.00405590
jne 0x489b12
mov esi, 0xc
jmp 0x489e0a
lea eax, [ebp - 0x274]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x274]
mov edx, 0x489f28
call fcn.00405590
jne 0x489b44
mov esi, 0xd
jmp 0x489e0a
lea eax, [ebp - 0x278]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x278]
mov edx, 0x489f34
call fcn.00405590
jne 0x489b76
mov esi, 0xe
jmp 0x489e0a
lea eax, [ebp - 0x27c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x27c]
mov edx, 0x489f40
call fcn.00405590
jne 0x489ba8
mov esi, 0xf
jmp 0x489e0a
lea eax, [ebp - 0x280]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x280]
mov edx, 0x489f4c
call fcn.00405590
jne 0x489bda
mov esi, 0x10
jmp 0x489e0a
lea eax, [ebp - 0x284]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x284]
mov edx, 0x489f58
call fcn.00405590
jne 0x489c0c
mov esi, 0x11
jmp 0x489e0a
lea eax, [ebp - 0x288]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x288]
mov edx, 0x489f64
call fcn.00405590
jne 0x489c3e
mov esi, 0x12
jmp 0x489e0a
lea eax, [ebp - 0x28c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x28c]
mov edx, 0x489f70
call fcn.00405590
jne 0x489c70
mov esi, 0x13
jmp 0x489e0a
lea eax, [ebp - 0x290]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x290]
mov edx, 0x489f7c
call fcn.00405590
jne 0x489ca2
mov esi, 0x14
jmp 0x489e0a
lea eax, [ebp - 0x294]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x294]
mov edx, 0x489f88
call fcn.00405590
jne 0x489cd4
mov esi, 0x15
jmp 0x489e0a
lea eax, [ebp - 0x298]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x298]
mov edx, 0x489f94
call fcn.00405590
jne 0x489d06
mov esi, 0x16
jmp 0x489e0a
lea eax, [ebp - 0x29c]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x29c]
mov edx, 0x489fa0
call fcn.00405590
jne 0x489d38
mov esi, 0x17
jmp 0x489e0a
lea eax, [ebp - 0x2a0]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x2a0]
mov edx, 0x489fac
call fcn.00405590
jne 0x489d6a
mov esi, 0x18
jmp 0x489e0a
lea eax, [ebp - 0x2a4]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x2a4]
mov edx, 0x489fb8
call fcn.00405590
jne 0x489d99
mov esi, 0x19
jmp 0x489e0a
lea eax, [ebp - 0x2a8]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x2a8]
mov edx, 0x489fc4
call fcn.00405590
jne 0x489dc8
mov esi, 0x1a
jmp 0x489e0a
lea eax, [ebp - 0x2ac]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
cmp dword [ebp - 0x2ac], 0
je 0x489e0a
lea eax, [ebp - 0x2b0]
push eax
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405660
mov eax, dword [ebp - 0x2b0]
call fcn.0040a194
mov esi, eax
test esi, esi
jl 0x489e33
mov eax, esi
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
lea edx, [ebp - 0x2b4]
call fcn.0040a028
mov edx, dword [ebp - 0x2b4]
lea eax, [ebp - 4]
call fcn.00405434
inc ebx
cmp ebx, 0x21
jne 0x4898b3
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004051ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489e7a
lea eax, [ebp - 0x2b4]
mov edx, 0x23
call fcn.0040517c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040517c
ret