Function at 0x405370
Capabilities:
Create thread
Get disk information
Resize volume shadow copy storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2b4
mov eax, dword [0x429004]
xor eax, esp
mov dword [esp + 0x2b0], eax
push ebx
push esi
mov ebx, 0x41
push edi
xor edi, edi
mov esi, ebx
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
mov dword [esp + 0x10], eax
push str.__
push eax
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x10]
push 0x42547c
mov word [eax + 8], bx
add eax, 0xa
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov word [esp + 0xa0], bx
mov word [esp + 0xa6], ax
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa6], 0x5c003a
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x405417
cmp eax, 3
je 0x405417
cmp eax, 4
jne 0x4055ac
cmp byte [0x42a33b], 0
je 0x405431
push dword [esp + 0x10]
push str.___Found_drive:__s_n
call fcn.004012f0
add esp, 8
push 0
push 0x80
push 3
push 0
push 3
xorps xmm0, xmm0
mov dword [esp + 0xbc], 0x5c005c
push 0x12019f
lea eax, [esp + 0xc0]
mov dword [esp + 0xc4], 0x5c002e
push eax
mov word [esp + 0xcc], bx
mov dword [esp + 0xce], 0x3a
movlpd qword [esp + 0xa4], xmm0
movlpd qword [esp + 0xac], xmm0
mov dword [esp + 0xb4], 1
mov dword [esp + 0xb8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x4054fe
cmp byte [0x42a33b], 0
je 0x405590
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push pe_nt_image_headers32
lea ecx, [esp + 0xc0]
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [esp + 0xb8]
push eax
push esi
push str.____Couldnt_delete_shadow_copies_from__c:_:__s_n
call fcn.004012f0
add esp, 0xc
jmp 0x405590
push 0
lea ecx, [esp + 0x88]
push ecx
push 0
push 0
push 0x18
lea ecx, [esp + 0x9c]
push ecx
push 0x53c028
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40553f
cmp byte [0x42a33b], 0
je 0x405586
push esi
push str.___Successfully_delete_shadow_copies_from__c:__n
call fcn.004012f0
add esp, 8
jmp 0x405586
cmp byte [0x42a33b], 0
je 0x405586
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push pe_nt_image_headers32
lea ecx, [esp + 0xc0]
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [esp + 0xb8]
push eax
push esi
push str.____Couldnt_delete_shadow_copies_from__c:_:__s_n
call fcn.004012f0
add esp, 0xc
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push dword [esp + 0x18]
push 0x404dd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + edi*4 + 0x18], eax
inc edi
inc ebx
inc esi
cmp bx, 0x5a
jbe 0x405396
xor esi, esi
test edi, edi
jle 0x4055d1
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [esp + esi*4 + 0x1c]
call ebx
inc esi
cmp esi, edi
jl 0x4055c4
cmp byte [0x42a339], 0
je 0x4055e1
xor ecx, ecx
call fcn.00404c50
mov ecx, dword [esp + 0x2bc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00409a70
mov esp, ebp
pop ebp
ret