Function at 0x4a4d40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov ebx, eax
xor edi, edi
cmp ebx, 0x50
mov dword [esp + 0x1c], edi
push ebx
jb 0x4a4f51
call fcn.004a4850
mov edi, eax
test edi, edi
je 0x4a4f37
push 0
push 0
push 0
push ebp
call fcn.004af360
test eax, eax
je 0x4a4f10
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a4f02
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0x4a4efa
lea ecx, [edi + 3]
mov edx, str.NTFS
mov dword [esp + 0xc], 8
mov eax, ecx
sub edx, ecx
movzx ebx, byte [edx + eax]
movzx ebp, byte [eax]
sub ebp, ebx
jne 0x4a4ed7
mov ebx, 1
add eax, ebx
sub dword [esp + 0xc], ebx
jne 0x4a4db7
movzx ecx, byte [edi + 0xd]
push ecx
push str.sectors_per_cluster__d_n
call fcn.0048f080
mov al, byte [edi + 0xd]
add esp, 8
cmp al, 0x80
ja 0x4a4df1
movzx edx, al
jmp 0x4a4dfc
mov ecx, 0x100
sub ecx, eax
mov edx, ebx
shl edx, cl
movzx eax, word [edi + 0xb]
imul edx, eax
mov ecx, edx
push ecx
push str.bytes_per_cluster__d_n
mov dword [esi + 0x10], edx
call fcn.0048f080
mov edx, dword [esi + 0x10]
add esp, 8
test edx, edx
je 0x4a4ece
movzx eax, word [edi + 0xb]
test eax, eax
mov dword [esi + 0x18], eax
je 0x4a4ec5
mov cl, byte [edi + 0x40]
test cl, cl
jle 0x4a4e42
movsx eax, cl
imul eax, edx
mov dword [esi + 0x14], eax
jmp 0x4a4e4b
neg ecx
mov edx, ebx
shl edx, cl
mov dword [esi + 0x14], edx
cmp dword [esi + 0x14], 0
je 0x4a4ebc
mov eax, dword [edi + 0x30]
mov dword [esi], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 4], ecx
mov edx, dword [edi + 0x48]
mov dword [esi + 8], edx
mov edx, dword [esi]
mov eax, dword [edi + 0x4c]
push ecx
push edx
push str.mft_lcn__I64u_n
mov dword [esi + 0xc], eax
call fcn.0048f080
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
push str.serial_number__I64u_n
call fcn.0048f080
mov edx, dword [esi + 0x10]
push edx
push str.bytes_per_cluster__u_n
call fcn.0048f080
mov eax, dword [esi + 0x14]
push eax
push str.bytes_per_file_record__u_n
call fcn.0048f080
add esp, 0x28
push edi
mov dword [esp + 0x20], ebx
call fcn.004a4890
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret 4
push 0
push str.invalid_bytes_per_file_record__u_n
jmp 0x4a4f1c
push 0
push str.invalid_bytes_per_sector__u_n
jmp 0x4a4f1c
push 0
push str.invalid_bytes_per_cluster__u_n
jmp 0x4a4f1c
push 8
push ecx
push str.bad_NTFS_signature:__t_n
call fcn.0048f080
add esp, 0xc
push edi
call fcn.004a4890
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
push eax
push str.unable_to_read_all_of_NTFS_boot_sector:__u_n
jmp 0x4a4f1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_read_NTFS_boot_sector:__u_n
jmp 0x4a4f1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_set_file_pointer_to_boot_sector__u_n
call fcn.0048f080
add esp, 8
push edi
call fcn.004a4890
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
push str.failed_to_alloc_sector_buf
call fcn.0048f080
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
push str.bad_sector_size__u_n
call fcn.0048f080
add esp, 8
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4