Function at 0x409140
Capabilities:
Enumerate pe sections
Get disk information
Get disk size
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x414b2c
push eax
mov eax, dword [esp + 0x18]
mov dword fs:[0], esp
sub esp, 0x688
cmp eax, 1
push ebx
push ebp
push esi
push edi
jne 0x409177
lea eax, [esp + 0x290]
push str.BackupDisk
push eax
jmp 0x4091a1
cmp eax, 0x20
jne 0x40918b
lea ecx, [esp + 0x290]
push str.SecondDisk
push ecx
jmp 0x4091a1
cmp eax, 8
jne 0x4099e3
lea edx, [esp + 0x290]
push str.USBDisk
push edx
mov edi, dword [sym.imp.MSVCRT.dll_wcscpy]
call edi
mov eax, dword [esp + 0x6b0]
mov ebp, dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 8
lea ecx, [esp + 0x1dc]
push eax
push str..PHYSICALDRIVE_d
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x1dc]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x2c], esi
je 0x4099df
lea eax, [esp + 0x290]
lea ecx, [esp + 0x114]
push eax
push ecx
call edi
add esp, 8
lea edx, [esp + 0x3c]
lea eax, [esp + 0xfc]
push 0
push edx
push 0x18
push eax
push 0
push 0
push 0x70000
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, dword [esp + 0x6ac]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
je 0x409300
mov ecx, dword [esp + 0x110]
lea edx, [esp + 0x5c]
push ecx
push 0x41dd5c
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x114]
push esi
push eax
push str.BytesPerSector
push ecx
call ebx
mov edx, dword [esp + 0x10c]
lea eax, [esp + 0x5c]
push edx
push 0x41dd5c
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x114]
push esi
push ecx
push str.SectorsPerTrack
push edx
call ebx
mov eax, dword [esp + 0x108]
lea ecx, [esp + 0x5c]
push eax
push 0x41dd5c
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x5c]
lea eax, [esp + 0x114]
push esi
push edx
push str.TracksPerCylinder
push eax
call ebx
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0xfc]
push ecx
push edx
lea eax, [esp + 0x64]
push 0x41dd5c
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x114]
push esi
push ecx
push str.Cylinders
push edx
call ebx
jmp 0x409342
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.storeDriveInfo
call fcn.00413dc4
push ecx
mov dword [esp + 0x6a8], 0
mov ecx, esp
mov dword [esp + 0x28], esp
push str.IOCTL_DISK_GET_DRIVE_GEOMETRY
call fcn.00413dc4
push 0
mov dword [esp + 0x6ac], 0xffffffff
call fcn.00406a10
add esp, 0xc
push 0xca8
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x18], edi
je 0x4099d4
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x3c]
push 0
push eax
push 0xca8
push edi
push 0
push 0
push 0x7400c
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4093ca
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.storeDriveInfo
call fcn.00413dc4
push ecx
mov dword [esp + 0x6a8], 1
mov ecx, esp
mov dword [esp + 0x28], esp
push str.IOCTL_DISK_GET_DRIVE_LAYOUT
call fcn.00413dc4
push 0
mov dword [esp + 0x6ac], 0xffffffff
call fcn.00406a10
add esp, 0xc
jmp 0x4097cc
mov edx, dword [edi + 4]
lea eax, [esp + 0x5c]
push edx
push str.0x_08X
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x290]
push esi
push ecx
push str.Signature
push edx
call ebx
mov ecx, dword [edi]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x34], eax
jbe 0x4097a3
add edi, 0x1c
mov dword [esp + 0x30], edi
mov eax, dword [edi]
test eax, eax
je 0x409783
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x6b0]
inc edx
cmp ecx, 1
mov dword [esp + 0x10], edx
jne 0x409783
push eax
push str.Partition
lea eax, [esp + 0x11c]
push str._s_d
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x114]
push esi
push 0
push str.DriveLetter
push ecx
call ebx
push esi
push 0
lea edx, [esp + 0x11c]
push str.Label
push edx
call ebx
lea eax, [edi - 0x10]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x38], eax
mov eax, dword [eax]
push eax
push str.0x_08X
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x5c]
lea eax, [esp + 0x114]
push esi
push edx
push str.StartingOffsetHigh
push eax
call ebx
mov ecx, dword [edi - 0x14]
lea eax, [edi - 0x14]
push ecx
lea edx, [esp + 0x60]
push str.0x_08X
push edx
mov dword [esp + 0x30], eax
call ebp
add esp, 0xc
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x114]
push esi
push eax
push str.StartingOffsetLow
push ecx
call ebx
mov edx, dword [edi - 8]
lea eax, [esp + 0x5c]
push edx
push str.0x_08X
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x114]
push esi
push ecx
push str.PartitionLengthHigh
push edx
call ebx
mov eax, dword [edi - 0xc]
lea ecx, [esp + 0x5c]
push eax
push str.0x_08X
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x5c]
lea eax, [esp + 0x114]
push esi
push edx
push str.PartitionLengthLow
push eax
call ebx
xor ecx, ecx
mov cl, byte [edi + 4]
push ecx
lea edx, [esp + 0x60]
push str.0x_02X
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x114]
push esi
push eax
push str.PartitionType
push ecx
call ebx
xor edx, edx
lea eax, [esp + 0x5c]
mov dl, byte [edi + 5]
push edx
push 0x41dd5c
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x114]
push esi
push ecx
push str.BootIndicator
push edx
call ebx
mov eax, dword [edi - 4]
lea ecx, [esp + 0x5c]
push eax
push 0x41dd5c
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x5c]
lea eax, [esp + 0x114]
push esi
push edx
push str.HiddenSectors
push eax
call ebx
xor ecx, ecx
lea edx, [esp + 0x5c]
mov cl, byte [edi + 6]
push ecx
push 0x41dd5c
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x114]
push esi
push eax
push str.RecognizedPartition
push ecx
call ebx
xor eax, eax
mov al, byte [edi + 4]
cmp eax, 0xb
mov dword [esp + 0x28], eax
je 0x4095f3
cmp eax, 0xc
je 0x4095f3
cmp eax, 0x12
je 0x4095f3
cmp eax, 0x1c
je 0x4095f3
push esi
push 0
lea edx, [esp + 0x11c]
push str.FAT32LABEL
push edx
call ebx
jmp 0x4096ec
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x2c]
push 0
mov edx, dword [ecx]
push eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x3c]
push 0
push eax
lea ecx, [esp + 0x4a0]
push 0x200
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
mov ecx, 0x28
mov dword [esp + 0x48], edx
xor eax, eax
lea edi, [esp + 0x5c]
mov dword [esp + 0x4c], edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x4e3]
mov eax, dword [esp + 0x4df]
mov dword [esp + 0x50], edx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x54], edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x58], edx
mov dx, word [esp + 0x4e7]
mov dword [esp + 0x48], eax
mov al, byte [esp + 0x4e9]
push ecx
lea ecx, [esp + 0x18]
mov word [esp + 0x54], dx
mov byte [esp + 0x56], al
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 0x14]
mov dword [esp + 0x6a0], 2
call sub.MFC42u.DLL_CString::TrimRight_1
mov edx, dword [esp + 0x14]
push 0x41e6a4
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x4096bf
push 0x4207b8
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator_2
mov eax, dword [esp + 0x14]
push esi
push eax
lea ecx, [esp + 0x11c]
push str.FAT32LABEL
push ecx
call ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x6a0], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
cmp eax, 0x12
je 0x4096fe
cmp eax, 0x1c
jne 0x409783
mov ecx, dword [esp + 0x6a8]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x20]
push edx
push eax
lea eax, [edi - 0x14]
push eax
push ecx
call fcn.0040a0e0
mov eax, dword [esp + 0x30]
add esp, 0x10
imul eax, dword [esp + 0x1c]
xor edx, edx
mov ecx, 9
call fcn.00413f60
push edx
lea edx, [esp + 0x60]
push str.0x_08X
push edx
mov dword [esp + 0x4c], eax
call ebp
add esp, 0xc
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x114]
push esi
push eax
push str.FreeBytesHigh
push ecx
call ebx
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x5c]
push edx
push str.0x_08X
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x114]
push esi
push ecx
push str.FreeBytesLow
push edx
call ebx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
inc eax
add edi, 0x20
mov edx, dword [ecx]
mov dword [esp + 0x34], eax
cmp eax, edx
mov dword [esp + 0x30], edi
jb 0x40940d
mov edi, ecx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x5c]
push edx
push 0x41dd5c
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x290]
push esi
push ecx
push str.PartitionCount
push edx
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x6b4]
add esp, 4
cmp eax, 1
jne 0x4099d4
mov ecx, dword [esp + 0x6a8]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.004080b0
mov eax, dword [esp + 0x18]
add esp, 8
shr eax, 2
mov edi, 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edi
je 0x4099d4
test al, 1
je 0x4099bd
lea edx, [esp + 0x24]
lea eax, [esp + 0x28]
add edi, 0x41
push edx
push eax
push edi
call fcn.004085a0
mov ecx, dword [esp + 0x6b4]
mov eax, dword [esp + 0x34]
add esp, 0xc
cmp eax, ecx
je 0x409884
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x41c198
call fcn.00413dc4
push ecx
mov dword [esp + 0x6ac], 3
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.error:_drive_mismatch
call fcn.00413dc4
mov dword [esp + 0x6ac], 0xffffffff
call fcn.00406ff0
add esp, 0xc
and edi, 0xffff
lea edx, [esp + 0x5c]
push edi
push 0x41e638
push edx
call ebp
mov eax, dword [esp + 0x30]
add esp, 0xc
lea ecx, [esp + 0x114]
push eax
push str.Partition
push str._s_d
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x5c]
lea eax, [esp + 0x114]
push esi
push edx
push str.DriveLetter
push eax
call ebx
push edi
lea ecx, [esp + 0x1b8]
push str._c:_
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x40]
lea eax, [esp + 0x1b4]
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x5c]
push ecx
push str.0x_08X
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x114]
push esi
push eax
push str.FreeBytesHigh
push ecx
call ebx
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x5c]
push edx
push str.0x_08X
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x114]
push esi
push ecx
push str.FreeBytesLow
push edx
call ebx
lea eax, [esp + 0x204]
push 0x14
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0x240]
push 0x32
lea edx, [esp + 0x1cc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea eax, [esp + 0x22c]
push esi
push eax
lea ecx, [esp + 0x11c]
push str.Label
push ecx
call ebx
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x5c]
push edx
push str.0x_08X
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x114]
push esi
push ecx
push str.Serial
push edx
call ebx
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
shr eax, 1
inc edi
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x18], edi
jne 0x409815
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4099e8
mov eax, 1
mov ecx, dword [esp + 0x698]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x694
ret