Function at 0x10113a6
Capabilities:
Get disk information via ioctl
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x45c8
call sub.ntdll.dll__chkstk
mov eax, dword [0x105b00c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ebx, ecx
mov dword [ebp - 0x42fc], edi
call fcn.0100fa24
push edi
push esi
mov ecx, ebx
call fcn.01010307
test al, al
jne 0x10113ec
mov ecx, ebx
call fcn.0100fa24
jmp 0x1011e92
push dword [ebp - 0x42fc]
lea eax, [ebx + 0x100]
push eax
lea edi, [ebx + 0x24]
push edi
push dword [ebp + 0x14]
mov dword [ebp - 0x4300], edi
push 0x100003
push esi
call fcn.0101036a
xor esi, esi
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x10113e0
push esi
push esi
push esi
push esi
push 0x70024
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
push dword [ebp + 0x18]
cmp eax, 0xc00000a2
mov dword [ebx + 0x34], eax
setne al
mov ecx, ebx
mov byte [ebx + 0x105], al
call fcn.0100fdf2
push 4
push 8
lea eax, [ebp - 0x4338]
push eax
lea eax, [ebp - 0x4308]
push eax
push dword [edi]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x10114e2
mov eax, dword [ebp - 0x4334]
test al, 0x10
je 0x1011487
mov dword [ebx + 0x108], 3
jmp 0x10114e8
mov ecx, dword [ebp - 0x4338]
cmp ecx, 2
jb 0x10114e2
push 3
pop edx
cmp ecx, edx
jbe 0x10114d6
cmp ecx, 6
jbe 0x10114e2
cmp ecx, 8
jbe 0x10114c6
cmp ecx, 0x12
je 0x10114be
cmp ecx, 0x14
je 0x10114be
cmp ecx, 0x24
jne 0x10114e2
mov dword [ebx + 0x108], 5
jmp 0x10114e8
mov dword [ebx + 0x108], edx
jmp 0x10114e8
and al, 1
neg al
sbb eax, eax
inc eax
inc eax
mov dword [ebx + 0x108], eax
jmp 0x10114e8
mov dword [ebx + 0x108], 4
jmp 0x10114e8
mov dword [ebx + 0x108], esi
push 0x18
lea eax, [ebp - 0x4328]
push eax
push esi
push esi
push 0x70000
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
mov byte [ebx + 0x2c], 0
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x1011571
cmp eax, 0xc0000001
je 0x101156b
cmp eax, 0xc0000014
je 0x101156b
mov ecx, ebx
call fcn.0100fa24
mov ebx, dword [ebx + 0x34]
cmp ebx, 0x80000011
je 0x1011553
cmp ebx, 0xc0000013
je 0x101154c
cmp ebx, 0xc00000a3
je 0x1011553
mov eax, 0x7d6
jmp 0x1011558
mov eax, 0x7d7
jmp 0x1011558
mov eax, 0x830
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1011e92
jmp 0x1011e8c
mov dword [ebp - 0x4320], esi
cmp dword [ebp - 0x4320], esi
jne 0x1011592
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x4328]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x4300]
mov dword [ebp - 0x4320], esi
cmp dword [ebp - 0x4320], 0xc
je 0x10115a8
cmp dword [ebp - 0x4320], 0xb
jne 0x1011aa1
push 8
lea eax, [ebp - 0x4340]
push eax
push esi
push esi
push 0x7405c
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
setge cl
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x10115fc
cmp eax, 0xc0000010
je 0x10115fc
mov ecx, ebx
call fcn.0100fa24
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1011e92
push 0x7e7
jmp 0x1011e8d
test cl, cl
je 0x1011aa1
push 0x90
lea eax, [ebp - 0x43e8]
push eax
push esi
push esi
push 0x70048
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
mov edx, 0x1001380
jge 0x101167d
cmp eax, 0xc0000010
jne 0x10115dd
mov eax, dword [ebp - 0x4340]
and dword [ebp - 0x43dc], 0
mov dword [ebp - 0x43d8], eax
mov eax, dword [ebp - 0x433c]
mov dword [ebp - 0x43e8], 1
mov dword [ebp - 0x43e0], 0x7e00
mov dword [ebp - 0x43d4], eax
mov esi, edx
lea edi, [ebp - 0x43c8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [ebp - 0x43e8], esi
je 0x10116d7
and dword [ebp - 0x43e8], 0
push 4
pop ecx
xor eax, eax
mov edi, edx
lea esi, [ebp - 0x43c8]
repe cmpsd dword [esi], dword es:[edi]
push 0
push dword [ebp - 0x4314]
setne al
push dword [ebp - 0x43dc]
dec al
push dword [ebp - 0x43e0]
and al, 0x19
add al, 0xee
mov byte [ebp - 0x43c8], al
mov byte [ebp - 0x43c7], 0
mov byte [ebp - 0x43c6], 1
call sub.ntdll.dll__alldiv
mov dword [ebp - 0x43c4], eax
push 0x24
lea edi, [ebx + 0x38]
pop ecx
lea esi, [ebp - 0x43e8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x105c040]
mov ecx, 0x20001
cmp eax, ecx
jne 0x1011924
cmp dword [ebp - 0x4320], 0xb
jne 0x1011709
mov dword [ebx + 0x20], 1
jmp 0x101170d
and dword [ebx + 0x20], 0
mov eax, dword [0x105c040]
cmp eax, ecx
jne 0x1011924
cmp dword [ebx + 0x20], 1
je 0x10119a5
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
push ecx
mov dword [eax], ecx
push ecx
xor esi, esi
mov dword [eax + 4], esi
mov ecx, dword [ebp - 0x43e0]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43dc]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
mov dword [ebp - 0x4330], esi
mov dword [ebp - 0x432c], esi
call fcn.0100bd16
cmp word [ebx + 0x10c], si
mov ecx, dword [eax]
mov dword [ebx + 0xf0], ecx
mov eax, dword [eax + 4]
mov cx, word [ebp - 0x4314]
mov dword [ebx + 0xf4], eax
lea eax, [ebx + 0xe8]
mov dword [eax], esi
mov word [eax], cx
jne 0x101189f
lea ecx, [ebp - 0x4354]
call fcn.01015476
push dword [ebx + 0x100]
mov edi, 0x2800
push edi
lea ecx, [ebp - 0x4354]
mov dword [ebp - 0x42f0], esi
call fcn.01015364
test eax, eax
jne 0x10117ce
lea ecx, [ebp - 0x4354]
call fcn.010154a2
jmp 0x1011e92
mov eax, dword [ebp - 0x4344]
push esi
push esi
push edi
push eax
mov dword [ebp - 0x430c], eax
mov dword [ebp - 0x42f4], eax
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov ecx, 0xc0000000
mov dword [ebx + 0x34], eax
and eax, ecx
cmp eax, ecx
je 0x10117be
cmp dword [ebp - 0x4304], edi
jne 0x10117be
mov eax, dword [ebp - 0x42f4]
mov cx, word [eax + 0x13]
mov word [ebp - 0x42f0], cx
cmp dword [ebp - 0x42f0], esi
jne 0x1011834
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x42f0], eax
mov edi, dword [ebp - 0x430c]
push edi
xor eax, eax
push eax
push dword [ebp - 0x42f0]
call fcn.0100e2ba
test al, al
je 0x1011860
mov eax, dword [ebp - 0x42f4]
mov ax, word [eax + 0xb]
mov word [ebp - 0x4314], ax
jmp 0x1011894
lea eax, [edi + 0x2200]
push eax
lea eax, [edi + 0x2000]
push eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x42f0]
call fcn.0100e492
test al, al
je 0x1011894
mov eax, 0x200
cmp dword [ebp - 0x4314], eax
je 0x1011894
mov dword [ebp - 0x4314], eax
lea ecx, [ebp - 0x4354]
call fcn.010154a2
mov edi, dword [ebp - 0x4330]
push ecx
push ecx
mov eax, esp
push dword [ebp - 0x432c]
mov dword [eax], esi
push edi
mov dword [eax + 4], esi
call fcn.0100f040
test al, al
je 0x10118f5
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
push ecx
mov dword [eax], ecx
mov dword [eax + 4], esi
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100bd16
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x10118fb
mov ecx, dword [ebp - 0x432c]
mov edx, dword [ebp - 0x43c4]
lea eax, [ebx + 0xc8]
push eax
push ecx
push ecx
mov eax, esp
push ecx
mov dword [eax], edx
mov dword [eax + 4], esi
push edi
lea eax, [ebp - 0x4328]
push eax
call fcn.0100fafa
jmp 0x10119fa
cmp eax, 0x40002
jne 0x1011997
cmp byte [ebp - 0x43c8], 1
jne 0x1011975
push ecx
push ecx
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], 0x300000
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
call fcn.0100fb70
neg al
sbb eax, eax
and eax, 0xfffffc00
add eax, 0x800
mov dword [ebp - 0x4314], eax
jmp 0x10119fa
cmp byte [ebp - 0x43c8], 4
je 0x101198b
cmp byte [ebp - 0x43c8], 6
jne 0x1011a0c
mov dword [ebp - 0x4314], 0x800
jmp 0x10119fa
cmp eax, ecx
jne 0x1011a0c
cmp dword [ebx + 0x20], 1
jne 0x1011a65
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], ecx
push ecx
mov ecx, dword [ebp - 0x43e0]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43dc]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100bd16
mov ecx, dword [eax]
mov dword [ebx + 0xf0], ecx
mov eax, dword [eax + 4]
mov cx, word [ebp - 0x4314]
mov dword [ebx + 0xf4], eax
lea eax, [ebx + 0xe8]
and dword [eax], 0
mov word [eax], cx
cmp dword [0x105c040], 0x20001
jne 0x1011a0c
cmp dword [ebx + 0x20], 1
jne 0x1011a65
lea eax, [ebx + 0xc8]
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x43c4]
mov eax, esp
and dword [eax + 4], 0
mov dword [eax], ecx
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], ecx
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100bd16
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x4328]
push eax
call fcn.0100fafa
xor esi, esi
lea eax, [ebx + 0xfc]
cmp dword [eax], esi
jne 0x1011da7
push 0x30
mov dword [eax], 1
call fcn.010131a7
mov edi, eax
cmp edi, esi
pop ecx
je 0x1011d8e
push fcn.01010345
push 1
push 0x30
push edi
call fcn.0100f9cd
jmp 0x1011d90
lea eax, [ebx + 0xc8]
push eax
lea eax, [ebp - 0x4328]
push eax
call fcn.0101068d
mov ecx, ebx
call fcn.0100bd3f
test al, al
je 0x1011a67
push 0x1e0
lea eax, [ebp - 0x45c8]
push eax
push esi
push esi
push 0x70c00
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x1011b3d
mov ecx, ebx
call fcn.0100fa24
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1011e92
mov ebx, dword [ebx + 0x34]
cmp ebx, 0x80000011
je 0x1011e87
cmp ebx, 0xc0000013
je 0x1011b33
cmp ebx, 0xc00000a3
je 0x1011e87
mov eax, 0x7d6
jmp 0x1011e8c
mov eax, 0x8aa
jmp 0x1011e8c
mov eax, dword [ebp - 0x4304]
push 0x18
xor edx, edx
pop ecx
div ecx
cmp eax, esi
mov dword [ebx + 0xfc], eax
jne 0x1011b73
mov ecx, ebx
call fcn.0100fa24
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1011e92
push 0x7d6
jmp 0x1011e8d
cmp dword [0x105c040], 0x20001
jne 0x1011c3e
cmp eax, esi
mov dword [ebp - 0x42f0], esi
jle 0x1011c3e
lea edx, [ebp - 0x45c8]
cmp dword [edx + 8], 6
jne 0x1011bdd
mov eax, dword [ebx + 0xfc]
dec eax
cmp dword [ebp - 0x42f0], eax
mov dword [ebp - 0x42f4], eax
jge 0x1011bd7
mov eax, dword [ebx + 0xfc]
sub eax, dword [ebp - 0x42f0]
lea esi, [edx + 0x18]
dec eax
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x42f4]
shl ecx, 3
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebx + 0xfc], eax
cmp dword [edx + 8], 0x16
jne 0x1011c23
mov eax, dword [ebx + 0xfc]
dec eax
cmp dword [ebp - 0x42f0], eax
mov dword [ebp - 0x42f4], eax
jge 0x1011c1d
mov eax, dword [ebx + 0xfc]
sub eax, dword [ebp - 0x42f0]
lea esi, [edx + 0x18]
dec eax
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x42f4]
shl ecx, 3
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebx + 0xfc], eax
inc dword [ebp - 0x42f0]
mov eax, dword [ebp - 0x42f0]
add edx, 0x18
cmp eax, dword [ebx + 0xfc]
jl 0x1011b97
mov edi, dword [ebx + 0xfc]
cmp edi, esi
mov dword [ebp - 0x42f0], edi
jle 0x1011ce2
lea eax, [edi - 1]
mov dword [ebp - 0x42f4], eax
mov eax, edi
mov dword [ebp - 0x430c], eax
cmp dword [ebp - 0x42f4], esi
jle 0x1011cda
mov ecx, dword [ebx + 0xfc]
dec ecx
lea eax, [ebp - 0x45a0]
mov dword [ebp - 0x432c], ecx
mov ecx, dword [eax - 0x1c]
imul ecx, dword [eax - 0x18]
mov edx, dword [eax - 4]
imul ecx, dword [eax - 0x14]
imul edx, dword [eax + 4]
imul ecx, dword [eax - 0x28]
imul edx, dword [eax - 0x10]
imul edx, dword [eax]
cmp ecx, edx
jae 0x1011cc9
push 6
pop ecx
lea edx, [eax - 0x28]
push 6
mov esi, edx
lea edi, [ebp - 0x4358]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea esi, [eax - 0x10]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
lea esi, [ebp - 0x4358]
lea edi, [eax - 0x10]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, dword [ebp - 0x42f0]
add eax, 0x18
dec dword [ebp - 0x432c]
jne 0x1011c7e
dec dword [ebp - 0x430c]
jne 0x1011c63
lea eax, [edi + edi*2]
shl eax, 4
push eax
call fcn.010131a7
cmp eax, esi
pop ecx
mov dword [ebp - 0x430c], eax
je 0x1011d0f
push fcn.01010345
push edi
push 0x30
push eax
call fcn.0100f9cd
mov eax, dword [ebp - 0x430c]
jmp 0x1011d11
xor eax, eax
cmp eax, esi
mov dword [ebx + 0xf8], eax
jne 0x1011d3a
mov ecx, ebx
call fcn.0100fa24
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1011e92
push 0x801
jmp 0x1011e8d
xor edi, edi
cmp dword [ebx + 0xfc], esi
jle 0x1011a67
lea eax, [ebp - 0x45c8]
mov dword [ebp - 0x42f4], esi
mov dword [ebp - 0x42f0], eax
mov eax, dword [ebx + 0xf8]
add eax, dword [ebp - 0x42f4]
push eax
push dword [ebp - 0x42f0]
call fcn.0101068d
add dword [ebp - 0x42f4], 0x30
add dword [ebp - 0x42f0], 0x18
inc edi
cmp edi, dword [ebx + 0xfc]
jl 0x1011d5a
jmp 0x1011a67
xor edi, edi
cmp edi, esi
mov dword [ebx + 0xf8], edi
je 0x1011d1b
push 0xc
lea esi, [ebx + 0xc8]
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov ecx, ebx
call fcn.0100fe1b
test al, al
mov ecx, ebx
je 0x1011af3
call fcn.0100ff09
test al, al
jne 0x1011dce
cmp dword [ebx + 0x34], 0xc0000023
je 0x1011e92
cmp dword [ebp - 0x4320], 0xb
jne 0x1011ecb
mov edi, dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
push 0x36c0
lea eax, [ebp - 0x36c4]
push eax
push esi
push esi
push 0x70050
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
mov byte [ebp - 0x42f5], 0
call edi
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x1011e62
cmp eax, 0xc0000010
jne 0x1011e62
push 0xc28
lea eax, [ebp - 0x42ec]
push eax
push esi
push esi
push 0x7400c
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
mov byte [ebp - 0x42f5], 1
call edi
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x1011e62
cmp dword [ebp - 0x42ec], 4
jae 0x1011e62
mov byte [ebx + 0x104], 1
cmp dword [ebx + 0x34], esi
jl 0x1011af1
cmp byte [ebp - 0x42f5], 0
jne 0x1011ebd
cmp dword [ebp - 0x36c4], esi
jne 0x1011e96
cmp dword [ebp - 0x36c0], 4
jae 0x1011ebd
jmp 0x1011eb6
mov eax, 0x830
push eax
call fcn.0100effb
xor al, al
jmp 0x1011ee3
cmp dword [ebp - 0x36c4], 1
jne 0x1011ebd
cmp dword [ebp - 0x36c0], 1
jne 0x1011ebd
mov eax, dword [ebp - 0x368c]
or eax, dword [ebp - 0x3688]
jne 0x1011ebd
mov byte [ebx + 0x104], 1
mov ecx, ebx
call fcn.01010a8d
mov ecx, ebx
call fcn.0102f659
cmp byte [ebp + 0x10], 0
jne 0x1011ee1
mov edi, dword [ebp - 0x4300]
push dword [edi]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [edi], esi
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.01059dea
pop edi
pop esi
pop ebx
leave
ret 0x14