Function at 0x465230
Capabilities:
Get disk information
Get disk information via ioctl
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
mov eax, dword [0x48794c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x54c], ecx
mov eax, dword [0x477da4]
mov dword [ebp - 0x340], eax
push 0x100
push 0
lea ecx, [ebp - 0x33c]
push ecx
call fcn.00440cf0
add esp, 0xc
mov edx, dword [ebp - 0x54c]
mov al, byte [edx + 0x28]
mov byte [ebp - 0x340], al
push 0x104
lea ecx, [ebp - 0x228]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x340]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4652a7
xor eax, eax
jmp 0x465570
mov eax, dword [str..mpapiZ:]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x477dac]
mov dword [ebp - 0x11c], ecx
mov edx, dword [0x477db0]
mov dword [ebp - 0x118], edx
mov ax, word [0x477db4]
mov word [ebp - 0x114], ax
push 0x103
push 0
lea ecx, [ebp - 0x112]
push ecx
call fcn.00440cf0
add esp, 0xc
mov edx, dword [ebp - 0x54c]
mov al, byte [edx + 0x28]
mov byte [ebp - 0x116], al
push 0x104
lea ecx, [ebp - 0x113]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x54c]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x54c]
cmp dword [edx + 0x24], 0xffffffff
jne 0x465389
push 0x477db8
lea eax, [ebp - 0x120]
push eax
call fcn.004658b0
add esp, 8
mov ecx, dword [ebp - 0x54c]
mov dl, byte [ecx + 0x28]
mov byte [ebp - 0x11c], dl
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x54c]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x54c]
cmp dword [edx + 0x24], 0xffffffff
jne 0x46539c
xor eax, eax
jmp 0x465570
push 0
lea eax, [ebp - 0x544]
push eax
push 0xc
lea ecx, [ebp - 0x234]
push ecx
push 0
push 0
push 0x2d1080
mov edx, dword [ebp - 0x54c]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4653da
mov ecx, dword [ebp - 0x54c]
mov edx, dword [ebp - 0x230]
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x54c]
mov dword [eax + 0x20], 0
push str.NTFS
lea ecx, [ebp - 0x228]
push ecx
call fcn.004551ac
add esp, 8
test eax, eax
jne 0x465409
mov eax, 1
jmp 0x465570
push 0
push 0
push 0
mov edx, dword [ebp - 0x54c]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x544]
push ecx
push 0x200
lea edx, [ebp - 0x540]
push edx
mov eax, dword [ebp - 0x54c]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46544f
xor eax, eax
jmp 0x465570
movzx edx, word [ebp - 0x342]
cmp edx, 0xaa55
je 0x465465
xor eax, eax
jmp 0x465570
movzx eax, byte [ebp - 0x540]
cmp eax, 0xeb
jne 0x465482
movzx ecx, byte [ebp - 0x53e]
cmp ecx, 0x90
je 0x4654e8
mov edx, dword [ebp - 0x54c]
mov eax, dword [edx + 0x20]
add eax, dword [ebp - 0x37a]
mov ecx, dword [ebp - 0x54c]
mov dword [ecx + 0x20], eax
push 0
push 0
mov edx, dword [ebp - 0x37a]
push edx
mov eax, dword [ebp - 0x54c]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx edx, byte [ebp - 0x540]
cmp edx, 0xaa55
jne 0x4654e1
movzx eax, byte [ebp - 0x540]
cmp eax, 0xeb
jne 0x4654e1
movzx ecx, byte [ebp - 0x53e]
cmp ecx, 0x90
je 0x4654e8
xor eax, eax
jmp 0x465570
movzx edx, word [ebp - 0x532]
mov eax, dword [ebp - 0x54c]
mov dword [eax + 0x20], edx
movzx ecx, word [ebp - 0x52a]
mov dword [ebp - 0x548], ecx
cmp dword [ebp - 0x548], 0
jne 0x46551a
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x548], edx
movzx eax, byte [ebp - 0x530]
imul eax, dword [ebp - 0x548]
mov ecx, dword [ebp - 0x54c]
add eax, dword [ecx + 0x20]
mov edx, dword [ebp - 0x54c]
mov dword [edx + 0x20], eax
movzx eax, word [ebp - 0x52f]
shl eax, 5
movzx ecx, word [ebp - 0x535]
lea eax, [eax + ecx - 1]
movzx ecx, word [ebp - 0x535]
cdq
idiv ecx
mov edx, dword [ebp - 0x54c]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x54c]
mov dword [ecx + 0x20], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ea11
mov esp, ebp
pop ebp
ret