Function at 0x4cd520
Capabilities:
Get disk information
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fe23e
mov eax, dword fs:[0]
push eax
mov eax, 0x5070
call fcn.005ddc60
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x505c], ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x5068]
push 0
push eax
push 0x200
push ebx
mov dword [ebp - 0x5054], ebx
mov dword [ebp - 0x5068], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4cd9f6
push 0
lea eax, [ebp - 0x506c]
mov dword [ebp - 0x506c], 0
push eax
push 0x4200
lea eax, [ebp - 0x5048]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4cd9f6
lea eax, [ebp - 0x5048]
cmp dword [eax], 0x20494645
jne 0x4cd9f6
cmp dword [eax + 4], 0x54524150
jne 0x4cd9f6
cmp dword [ebp - 0x4ff4], 0x80
jne 0x4cd9f6
cmp dword [ebp - 0x5000], 2
jne 0x4cd9f6
cmp dword [ebp - 0x4ffc], 0
jne 0x4cd9f6
cmp dword [ebp - 0x5030], 1
jne 0x4cd9f6
cmp dword [ebp - 0x502c], 0
jne 0x4cd9f6
cmp dword [ebp - 0x5020], 0x22
jne 0x4cd9f6
cmp dword [ebp - 0x501c], 0
jne 0x4cd9f6
cmp dword [ebp - 0x5034], 0
jne 0x4cd9f6
mov ebx, dword [sym.imp.ole32.dll_StringFromGUID2]
lea esi, [ebp - 0x4e10]
mov dword [ebp - 0x5064], 0
nop word [eax + eax]
lea eax, [esi - 0x38]
test eax, eax
je 0x4cd9d3
mov eax, dword [esi - 0x18]
or eax, dword [esi - 0x14]
je 0x4cd9ef
movzx eax, word [0x639ee0]
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push 0
push eax
call fcn.00588800
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x103
push eax
lea eax, [esi - 0x38]
push eax
call ebx
movzx eax, word [0x639ee0]
push 0x206
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push 0
push eax
call fcn.00588800
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x103
push eax
lea eax, [esi - 0x28]
push eax
call ebx
push 0x48
call fcn.00560437
add esp, 4
mov dword [ebp - 0x507c], eax
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.004cc500
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x5070], edi
test edi, edi
je 0x4cd9d3
mov ecx, dword [esi - 8]
and ecx, 1
mov dword [edi + 8], ecx
mov dword [edi + 0x14], 2
mov ecx, dword [esi - 0x10]
sub ecx, dword [esi - 0x18]
mov eax, dword [esi - 0xc]
sbb eax, dword [esi - 0x14]
add ecx, 1
mov dword [edi + 0x28], ecx
adc eax, 0
mov dword [edi + 0x2c], eax
mov eax, dword [esi - 0x18]
mov dword [edi + 0x20], eax
mov eax, dword [esi - 0x14]
mov dword [edi + 0x24], eax
test esi, esi
jne 0x4cd754
xor ecx, ecx
jmp 0x4cd76f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cd760
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [edi + 0x38]
call fcn.0040c9d0
lea edx, [ebp - 0x218]
lea ecx, [edi + 0x3c]
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4cd785
sub edx, ebx
lea eax, [ebp - 0x218]
sar edx, 1
push edx
push eax
call fcn.0040c9d0
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
cmp dword [esi - 4], 0
jg 0x4cd7b8
jl 0x4cd7b4
cmp dword [esi - 8], 0
jae 0x4cd7b8
mov al, 1
jmp 0x4cd7ba
xor al, al
lea ecx, [ebp - 0x420]
mov byte [edi + 0xc], al
lea ebx, [edi + 0x40]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cd7d0
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.0040c9d0
push dword [edi + 0x24]
lea eax, [ebp - 0x5060]
push dword [edi + 0x20]
push dword [ebp + 0xc]
push eax
call fcn.004cdaf0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x5060]
cmp dword [eax - 0xc], 0
je 0x4cd873
mov ebx, dword [ebx]
lea ecx, [eax - 0x10]
sub ebx, 0x10
cmp ecx, ebx
je 0x4cd870
cmp dword [ebx + 0xc], 0
jl 0x4cd860
mov edx, dword [ecx]
cmp edx, dword [ebx]
jne 0x4cd860
call fcn.0040c950
mov dword [ebp - 0x504c], eax
lea edx, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4cd856
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x504c]
add eax, 0x10
lea ebx, [edi + 0x40]
mov dword [ebx], eax
jmp 0x4cd873
push dword [eax - 0xc]
lea ebx, [edi + 0x40]
push eax
mov ecx, ebx
call fcn.0040c9d0
jmp 0x4cd873
lea ebx, [edi + 0x40]
cmp byte [edi + 0xc], 0
jne 0x4cd8ec
lea ecx, [ebp - 0x5050]
call fcn.0040c490
mov byte [ebp - 4], 2
lea eax, [ebp - 0x5050]
push dword [ebx]
push str._Volume_s_
push eax
call fcn.0040d300
add esp, 0xc
lea eax, [ebp - 0xe48]
push 0
push 0x514
push eax
push dword [ebp - 0x5050]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x4cd8c6
cmp word [ebp - 0xe48], 0
jne 0x4cd8ca
mov byte [edi + 0xc], 1
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x5050]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4cd8ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esi - 0x14]
mov ebx, dword [ebp - 0x505c]
push dword [esi - 0x18]
push 0
push dword [ebx + 0x10]
call fcn.005dd6d0
push 0
lea ecx, [ebp - 0x5074]
mov dword [ebp - 0x5078], eax
push ecx
push eax
push dword [ebp - 0x5054]
mov dword [ebp - 0x5074], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4cd996
mov ebx, dword [ebx + 0x10]
shl ebx, 2
push ebx
call fcn.00560596
add esp, 4
mov dword [ebp - 0x504c], eax
test eax, eax
je 0x4cd996
push 0
lea ecx, [ebp - 0x5058]
mov dword [ebp - 0x5058], 0
push ecx
push ebx
push eax
push dword [ebp - 0x5054]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4cd987
cmp dword [ebp - 0x5058], ebx
jne 0x4cd987
mov ecx, dword [ebp - 0x504c]
call fcn.004cd420
cmp al, 0xaf
mov dword [edi + 0x10], eax
sete al
mov byte [edi + 0xd], al
jmp 0x4cd98d
mov ecx, dword [ebp - 0x504c]
push ecx
call fcn.00560591
add esp, 4
mov ecx, dword [ebp - 0x505c]
lea eax, [ebp - 0x5070]
push eax
call fcn.004ce920
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x5060]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4cd9cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [sym.imp.ole32.dll_StringFromGUID2]
mov eax, dword [ebp - 0x5064]
sub esi, 0xffffff80
inc eax
mov dword [ebp - 0x5064], eax
cmp eax, dword [ebp - 0x4ff4]
jb 0x4cd660
mov eax, 1
jmp 0x4cd9f8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 8