Function at 0x4a49f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov ebx, eax
xor edi, edi
cmp ebx, 0x50
mov dword [esp + 0x1c], edi
push ebx
jb 0x4a4c01
call fcn.004a4990
mov edi, eax
test edi, edi
je 0x4a4be7
push 0
push 0
push 0
push ebp
call fcn.004af030
test eax, eax
je 0x4a4bc0
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a4bb2
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0x4a4baa
lea ecx, [edi + 3]
mov edx, str.NTFS
mov dword [esp + 0xc], 8
mov eax, ecx
sub edx, ecx
movzx ebx, byte [edx + eax]
movzx ebp, byte [eax]
sub ebp, ebx
jne 0x4a4b87
mov ebx, 1
add eax, ebx
sub dword [esp + 0xc], ebx
jne 0x4a4a67
movzx ecx, byte [edi + 0xd]
push ecx
push str.sectors_per_cluster__d_n
call fcn.0048f080
mov al, byte [edi + 0xd]
add esp, 8
cmp al, 0x80
ja 0x4a4aa1
movzx edx, al
jmp 0x4a4aac
mov ecx, 0x100
sub ecx, eax
mov edx, ebx
shl edx, cl
movzx eax, word [edi + 0xb]
imul edx, eax
mov ecx, edx
push ecx
push str.bytes_per_cluster__d_n
mov dword [esi + 0x10], edx
call fcn.0048f080
mov edx, dword [esi + 0x10]
add esp, 8
test edx, edx
je 0x4a4b7e
movzx eax, word [edi + 0xb]
test eax, eax
mov dword [esi + 0x18], eax
je 0x4a4b75
mov cl, byte [edi + 0x40]
test cl, cl
jle 0x4a4af2
movsx eax, cl
imul eax, edx
mov dword [esi + 0x14], eax
jmp 0x4a4afb
neg ecx
mov edx, ebx
shl edx, cl
mov dword [esi + 0x14], edx
cmp dword [esi + 0x14], 0
je 0x4a4b6c
mov eax, dword [edi + 0x30]
mov dword [esi], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 4], ecx
mov edx, dword [edi + 0x48]
mov dword [esi + 8], edx
mov edx, dword [esi]
mov eax, dword [edi + 0x4c]
push ecx
push edx
push str.mft_lcn__I64u_n
mov dword [esi + 0xc], eax
call fcn.0048f080
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
push str.serial_number__I64u_n
call fcn.0048f080
mov edx, dword [esi + 0x10]
push edx
push str.bytes_per_cluster__u_n
call fcn.0048f080
mov eax, dword [esi + 0x14]
push eax
push str.bytes_per_file_record__u_n
call fcn.0048f080
add esp, 0x28
push edi
mov dword [esp + 0x20], ebx
call fcn.004a49d0
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret 4
push 0
push str.invalid_bytes_per_file_record__u_n
jmp 0x4a4bcc
push 0
push str.invalid_bytes_per_sector__u_n
jmp 0x4a4bcc
push 0
push str.invalid_bytes_per_cluster__u_n
jmp 0x4a4bcc
push 8
push ecx
push str.bad_NTFS_signature:__t_n
call fcn.0048f080
add esp, 0xc
push edi
call fcn.004a49d0
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
push eax
push str.unable_to_read_all_of_NTFS_boot_sector:__u_n
jmp 0x4a4bcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_read_NTFS_boot_sector:__u_n
jmp 0x4a4bcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_set_file_pointer_to_boot_sector__u_n
call fcn.0048f080
add esp, 8
push edi
call fcn.004a49d0
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
push str.failed_to_alloc_sector_buf
call fcn.0048f080
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
push str.bad_sector_size__u_n
call fcn.0048f080
add esp, 8
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4