Function at 0x1011925
Capabilities:
Get disk information via ioctl
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x45c8
call sub.ntdll.dll__chkstk
mov eax, dword [0x106000c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ebx, ecx
mov dword [ebp - 0x42fc], edi
call fcn.0100ff08
push edi
push esi
mov ecx, ebx
call fcn.01010886
test al, al
jne 0x101196b
mov ecx, ebx
call fcn.0100ff08
jmp 0x1012411
push dword [ebp - 0x42fc]
lea eax, [ebx + 0x100]
push eax
lea edi, [ebx + 0x24]
push edi
push dword [ebp + 0x14]
mov dword [ebp - 0x4300], edi
push 0x100003
push esi
call fcn.010108e9
xor esi, esi
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x101195f
push esi
push esi
push esi
push esi
push 0x70024
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
push dword [ebp + 0x18]
cmp eax, 0xc00000a2
mov dword [ebx + 0x34], eax
setne al
mov ecx, ebx
mov byte [ebx + 0x105], al
call fcn.0101032d
push 4
push 8
lea eax, [ebp - 0x4338]
push eax
lea eax, [ebp - 0x4308]
push eax
push dword [edi]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x1011a61
mov eax, dword [ebp - 0x4334]
test al, 0x10
je 0x1011a06
mov dword [ebx + 0x108], 3
jmp 0x1011a67
mov ecx, dword [ebp - 0x4338]
cmp ecx, 2
jb 0x1011a61
push 3
pop edx
cmp ecx, edx
jbe 0x1011a55
cmp ecx, 6
jbe 0x1011a61
cmp ecx, 8
jbe 0x1011a45
cmp ecx, 0x12
je 0x1011a3d
cmp ecx, 0x14
je 0x1011a3d
cmp ecx, 0x24
jne 0x1011a61
mov dword [ebx + 0x108], 5
jmp 0x1011a67
mov dword [ebx + 0x108], edx
jmp 0x1011a67
and al, 1
neg al
sbb eax, eax
inc eax
inc eax
mov dword [ebx + 0x108], eax
jmp 0x1011a67
mov dword [ebx + 0x108], 4
jmp 0x1011a67
mov dword [ebx + 0x108], esi
push 0x18
lea eax, [ebp - 0x4328]
push eax
push esi
push esi
push 0x70000
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
mov byte [ebx + 0x2c], 0
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x1011af0
cmp eax, 0xc0000001
je 0x1011aea
cmp eax, 0xc0000014
je 0x1011aea
mov ecx, ebx
call fcn.0100ff08
mov ebx, dword [ebx + 0x34]
cmp ebx, 0x80000011
je 0x1011ad2
cmp ebx, 0xc0000013
je 0x1011acb
cmp ebx, 0xc00000a3
je 0x1011ad2
mov eax, 0x7d6
jmp 0x1011ad7
mov eax, 0x7d7
jmp 0x1011ad7
mov eax, 0x830
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1012411
jmp 0x101240b
mov dword [ebp - 0x4320], esi
cmp dword [ebp - 0x4320], esi
jne 0x1011b11
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x4328]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x4300]
mov dword [ebp - 0x4320], esi
cmp dword [ebp - 0x4320], 0xc
je 0x1011b27
cmp dword [ebp - 0x4320], 0xb
jne 0x1012020
push 8
lea eax, [ebp - 0x4340]
push eax
push esi
push esi
push 0x7405c
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
setge cl
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x1011b7b
cmp eax, 0xc0000010
je 0x1011b7b
mov ecx, ebx
call fcn.0100ff08
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1012411
push 0x7e7
jmp 0x101240c
test cl, cl
je 0x1012020
push 0x90
lea eax, [ebp - 0x43e8]
push eax
push esi
push esi
push 0x70048
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
mov edx, 0x10014dc
jge 0x1011bfc
cmp eax, 0xc0000010
jne 0x1011b5c
mov eax, dword [ebp - 0x4340]
and dword [ebp - 0x43dc], 0
mov dword [ebp - 0x43d8], eax
mov eax, dword [ebp - 0x433c]
mov dword [ebp - 0x43e8], 1
mov dword [ebp - 0x43e0], 0x7e00
mov dword [ebp - 0x43d4], eax
mov esi, edx
lea edi, [ebp - 0x43c8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [ebp - 0x43e8], esi
je 0x1011c56
and dword [ebp - 0x43e8], 0
push 4
pop ecx
xor eax, eax
mov edi, edx
lea esi, [ebp - 0x43c8]
repe cmpsd dword [esi], dword es:[edi]
push 0
push dword [ebp - 0x4314]
setne al
push dword [ebp - 0x43dc]
dec al
push dword [ebp - 0x43e0]
and al, 0x19
add al, 0xee
mov byte [ebp - 0x43c8], al
mov byte [ebp - 0x43c7], 0
mov byte [ebp - 0x43c6], 1
call sub.ntdll.dll__alldiv
mov dword [ebp - 0x43c4], eax
push 0x24
lea edi, [ebx + 0x38]
pop ecx
lea esi, [ebp - 0x43e8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x1060050]
mov ecx, 0x20001
cmp eax, ecx
jne 0x1011ea3
cmp dword [ebp - 0x4320], 0xb
jne 0x1011c88
mov dword [ebx + 0x20], 1
jmp 0x1011c8c
and dword [ebx + 0x20], 0
mov eax, dword [0x1060050]
cmp eax, ecx
jne 0x1011ea3
cmp dword [ebx + 0x20], 1
je 0x1011f24
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
push ecx
mov dword [eax], ecx
push ecx
xor esi, esi
mov dword [eax + 4], esi
mov ecx, dword [ebp - 0x43e0]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43dc]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
mov dword [ebp - 0x4330], esi
mov dword [ebp - 0x432c], esi
call fcn.0100e6bd
cmp word [ebx + 0x10c], si
mov ecx, dword [eax]
mov dword [ebx + 0xf0], ecx
mov eax, dword [eax + 4]
mov cx, word [ebp - 0x4314]
mov dword [ebx + 0xf4], eax
lea eax, [ebx + 0xe8]
mov dword [eax], esi
mov word [eax], cx
jne 0x1011e1e
lea ecx, [ebp - 0x4354]
call fcn.0100e5b9
push dword [ebx + 0x100]
mov edi, 0x2800
push edi
lea ecx, [ebp - 0x4354]
mov dword [ebp - 0x42f0], esi
call fcn.0100e4a7
test eax, eax
jne 0x1011d4d
lea ecx, [ebp - 0x4354]
call fcn.0100e5e5
jmp 0x1012411
mov eax, dword [ebp - 0x4344]
push esi
push esi
push edi
push eax
mov dword [ebp - 0x430c], eax
mov dword [ebp - 0x42f4], eax
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov ecx, 0xc0000000
mov dword [ebx + 0x34], eax
and eax, ecx
cmp eax, ecx
je 0x1011d3d
cmp dword [ebp - 0x4304], edi
jne 0x1011d3d
mov eax, dword [ebp - 0x42f4]
mov cx, word [eax + 0x13]
mov word [ebp - 0x42f0], cx
cmp dword [ebp - 0x42f0], esi
jne 0x1011db3
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x42f0], eax
mov edi, dword [ebp - 0x430c]
push edi
xor eax, eax
push eax
push dword [ebp - 0x42f0]
call fcn.0100ed08
test al, al
je 0x1011ddf
mov eax, dword [ebp - 0x42f4]
mov ax, word [eax + 0xb]
mov word [ebp - 0x4314], ax
jmp 0x1011e13
lea eax, [edi + 0x2200]
push eax
lea eax, [edi + 0x2000]
push eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x42f0]
call fcn.0100eee0
test al, al
je 0x1011e13
mov eax, 0x200
cmp dword [ebp - 0x4314], eax
je 0x1011e13
mov dword [ebp - 0x4314], eax
lea ecx, [ebp - 0x4354]
call fcn.0100e5e5
mov edi, dword [ebp - 0x4330]
push ecx
push ecx
mov eax, esp
push dword [ebp - 0x432c]
mov dword [eax], esi
push edi
mov dword [eax + 4], esi
call fcn.01010082
test al, al
je 0x1011e74
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
push ecx
mov dword [eax], ecx
mov dword [eax + 4], esi
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100e6bd
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x1011e7a
mov ecx, dword [ebp - 0x432c]
mov edx, dword [ebp - 0x43c4]
lea eax, [ebx + 0xc8]
push eax
push ecx
push ecx
mov eax, esp
push ecx
mov dword [eax], edx
mov dword [eax + 4], esi
push edi
lea eax, [ebp - 0x4328]
push eax
call fcn.0100ffc0
jmp 0x1011f79
cmp eax, 0x40002
jne 0x1011f16
cmp byte [ebp - 0x43c8], 1
jne 0x1011ef4
push ecx
push ecx
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], 0x300000
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
call fcn.0101005c
neg al
sbb eax, eax
and eax, 0xfffffc00
add eax, 0x800
mov dword [ebp - 0x4314], eax
jmp 0x1011f79
cmp byte [ebp - 0x43c8], 4
je 0x1011f0a
cmp byte [ebp - 0x43c8], 6
jne 0x1011f8b
mov dword [ebp - 0x4314], 0x800
jmp 0x1011f79
cmp eax, ecx
jne 0x1011f8b
cmp dword [ebx + 0x20], 1
jne 0x1011fe4
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], ecx
push ecx
mov ecx, dword [ebp - 0x43e0]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43dc]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100e6bd
mov ecx, dword [eax]
mov dword [ebx + 0xf0], ecx
mov eax, dword [eax + 4]
mov cx, word [ebp - 0x4314]
mov dword [ebx + 0xf4], eax
lea eax, [ebx + 0xe8]
and dword [eax], 0
mov word [eax], cx
cmp dword [0x1060050], 0x20001
jne 0x1011f8b
cmp dword [ebx + 0x20], 1
jne 0x1011fe4
lea eax, [ebx + 0xc8]
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x43c4]
mov eax, esp
and dword [eax + 4], 0
mov dword [eax], ecx
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], ecx
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100e6bd
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x4328]
push eax
call fcn.0100ffc0
xor esi, esi
lea eax, [ebx + 0xfc]
cmp dword [eax], esi
jne 0x1012326
push 0x30
mov dword [eax], 1
call fcn.01013e0e
mov edi, eax
cmp edi, esi
pop ecx
je 0x101230d
push fcn.010108c4
push 1
push 0x30
push edi
call fcn.0100fea5
jmp 0x101230f
lea eax, [ebx + 0xc8]
push eax
lea eax, [ebp - 0x4328]
push eax
call fcn.01010c0c
mov ecx, ebx
call fcn.01010312
test al, al
je 0x1011fe6
push 0x1e0
lea eax, [ebp - 0x45c8]
push eax
push esi
push esi
push 0x70c00
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x10120bc
mov ecx, ebx
call fcn.0100ff08
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1012411
mov ebx, dword [ebx + 0x34]
cmp ebx, 0x80000011
je 0x1012406
cmp ebx, 0xc0000013
je 0x10120b2
cmp ebx, 0xc00000a3
je 0x1012406
mov eax, 0x7d6
jmp 0x101240b
mov eax, 0x8aa
jmp 0x101240b
mov eax, dword [ebp - 0x4304]
push 0x18
xor edx, edx
pop ecx
div ecx
cmp eax, esi
mov dword [ebx + 0xfc], eax
jne 0x10120f2
mov ecx, ebx
call fcn.0100ff08
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1012411
push 0x7d6
jmp 0x101240c
cmp dword [0x1060050], 0x20001
jne 0x10121bd
cmp eax, esi
mov dword [ebp - 0x42f0], esi
jle 0x10121bd
lea edx, [ebp - 0x45c8]
cmp dword [edx + 8], 6
jne 0x101215c
mov eax, dword [ebx + 0xfc]
dec eax
cmp dword [ebp - 0x42f0], eax
mov dword [ebp - 0x42f4], eax
jge 0x1012156
mov eax, dword [ebx + 0xfc]
sub eax, dword [ebp - 0x42f0]
lea esi, [edx + 0x18]
dec eax
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x42f4]
shl ecx, 3
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebx + 0xfc], eax
cmp dword [edx + 8], 0x16
jne 0x10121a2
mov eax, dword [ebx + 0xfc]
dec eax
cmp dword [ebp - 0x42f0], eax
mov dword [ebp - 0x42f4], eax
jge 0x101219c
mov eax, dword [ebx + 0xfc]
sub eax, dword [ebp - 0x42f0]
lea esi, [edx + 0x18]
dec eax
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x42f4]
shl ecx, 3
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebx + 0xfc], eax
inc dword [ebp - 0x42f0]
mov eax, dword [ebp - 0x42f0]
add edx, 0x18
cmp eax, dword [ebx + 0xfc]
jl 0x1012116
mov edi, dword [ebx + 0xfc]
cmp edi, esi
mov dword [ebp - 0x42f0], edi
jle 0x1012261
lea eax, [edi - 1]
mov dword [ebp - 0x42f4], eax
mov eax, edi
mov dword [ebp - 0x430c], eax
cmp dword [ebp - 0x42f4], esi
jle 0x1012259
mov ecx, dword [ebx + 0xfc]
dec ecx
lea eax, [ebp - 0x45a0]
mov dword [ebp - 0x432c], ecx
mov ecx, dword [eax - 0x1c]
imul ecx, dword [eax - 0x18]
mov edx, dword [eax - 4]
imul ecx, dword [eax - 0x14]
imul edx, dword [eax + 4]
imul ecx, dword [eax - 0x28]
imul edx, dword [eax - 0x10]
imul edx, dword [eax]
cmp ecx, edx
jae 0x1012248
push 6
pop ecx
lea edx, [eax - 0x28]
push 6
mov esi, edx
lea edi, [ebp - 0x4358]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea esi, [eax - 0x10]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
lea esi, [ebp - 0x4358]
lea edi, [eax - 0x10]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, dword [ebp - 0x42f0]
add eax, 0x18
dec dword [ebp - 0x432c]
jne 0x10121fd
dec dword [ebp - 0x430c]
jne 0x10121e2
lea eax, [edi + edi*2]
shl eax, 4
push eax
call fcn.01013e0e
cmp eax, esi
pop ecx
mov dword [ebp - 0x430c], eax
je 0x101228e
push fcn.010108c4
push edi
push 0x30
push eax
call fcn.0100fea5
mov eax, dword [ebp - 0x430c]
jmp 0x1012290
xor eax, eax
cmp eax, esi
mov dword [ebx + 0xf8], eax
jne 0x10122b9
mov ecx, ebx
call fcn.0100ff08
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1012411
push 0x801
jmp 0x101240c
xor edi, edi
cmp dword [ebx + 0xfc], esi
jle 0x1011fe6
lea eax, [ebp - 0x45c8]
mov dword [ebp - 0x42f4], esi
mov dword [ebp - 0x42f0], eax
mov eax, dword [ebx + 0xf8]
add eax, dword [ebp - 0x42f4]
push eax
push dword [ebp - 0x42f0]
call fcn.01010c0c
add dword [ebp - 0x42f4], 0x30
add dword [ebp - 0x42f0], 0x18
inc edi
cmp edi, dword [ebx + 0xfc]
jl 0x10122d9
jmp 0x1011fe6
xor edi, edi
cmp edi, esi
mov dword [ebx + 0xf8], edi
je 0x101229a
push 0xc
lea esi, [ebx + 0xc8]
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov ecx, ebx
call fcn.01010356
test al, al
mov ecx, ebx
je 0x1012072
call fcn.01010444
test al, al
jne 0x101234d
cmp dword [ebx + 0x34], 0xc0000023
je 0x1012411
cmp dword [ebp - 0x4320], 0xb
jne 0x101244a
mov edi, dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
push 0x36c0
lea eax, [ebp - 0x36c4]
push eax
push esi
push esi
push 0x70050
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
mov byte [ebp - 0x42f5], 0
call edi
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x10123e1
cmp eax, 0xc0000010
jne 0x10123e1
push 0xc28
lea eax, [ebp - 0x42ec]
push eax
push esi
push esi
push 0x7400c
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
mov byte [ebp - 0x42f5], 1
call edi
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x10123e1
cmp dword [ebp - 0x42ec], 4
jae 0x10123e1
mov byte [ebx + 0x104], 1
cmp dword [ebx + 0x34], esi
jl 0x1012070
cmp byte [ebp - 0x42f5], 0
jne 0x101243c
cmp dword [ebp - 0x36c4], esi
jne 0x1012415
cmp dword [ebp - 0x36c0], 4
jae 0x101243c
jmp 0x1012435
mov eax, 0x830
push eax
call fcn.0100fe86
xor al, al
jmp 0x1012462
cmp dword [ebp - 0x36c4], 1
jne 0x101243c
cmp dword [ebp - 0x36c0], 1
jne 0x101243c
mov eax, dword [ebp - 0x368c]
or eax, dword [ebp - 0x3688]
jne 0x101243c
mov byte [ebx + 0x104], 1
mov ecx, ebx
call fcn.0101100c
mov ecx, ebx
call fcn.01013b3c
cmp byte [ebp + 0x10], 0
jne 0x1012460
mov edi, dword [ebp - 0x4300]
push dword [edi]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [edi], esi
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.0105f135
pop edi
pop esi
pop ebx
leave
ret 0x14