Function at 0x10113d6
Capabilities:
Get disk information via ioctl
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x45c8
call sub.ntdll.dll__chkstk
mov eax, dword [0x105b00c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ebx, ecx
mov dword [ebp - 0x42fc], edi
call fcn.0100fa54
push edi
push esi
mov ecx, ebx
call fcn.01010337
test al, al
jne 0x101141c
mov ecx, ebx
call fcn.0100fa54
jmp 0x1011ec2
push dword [ebp - 0x42fc]
lea eax, [ebx + 0x100]
push eax
lea edi, [ebx + 0x24]
push edi
push dword [ebp + 0x14]
mov dword [ebp - 0x4300], edi
push 0x100003
push esi
call fcn.0101039a
xor esi, esi
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x1011410
push esi
push esi
push esi
push esi
push 0x70024
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
push dword [ebp + 0x18]
cmp eax, 0xc00000a2
mov dword [ebx + 0x34], eax
setne al
mov ecx, ebx
mov byte [ebx + 0x105], al
call fcn.0100fe22
push 4
push 8
lea eax, [ebp - 0x4338]
push eax
lea eax, [ebp - 0x4308]
push eax
push dword [edi]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x1011512
mov eax, dword [ebp - 0x4334]
test al, 0x10
je 0x10114b7
mov dword [ebx + 0x108], 3
jmp 0x1011518
mov ecx, dword [ebp - 0x4338]
cmp ecx, 2
jb 0x1011512
push 3
pop edx
cmp ecx, edx
jbe 0x1011506
cmp ecx, 6
jbe 0x1011512
cmp ecx, 8
jbe 0x10114f6
cmp ecx, 0x12
je 0x10114ee
cmp ecx, 0x14
je 0x10114ee
cmp ecx, 0x24
jne 0x1011512
mov dword [ebx + 0x108], 5
jmp 0x1011518
mov dword [ebx + 0x108], edx
jmp 0x1011518
and al, 1
neg al
sbb eax, eax
inc eax
inc eax
mov dword [ebx + 0x108], eax
jmp 0x1011518
mov dword [ebx + 0x108], 4
jmp 0x1011518
mov dword [ebx + 0x108], esi
push 0x18
lea eax, [ebp - 0x4328]
push eax
push esi
push esi
push 0x70000
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
mov byte [ebx + 0x2c], 0
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x10115a1
cmp eax, 0xc0000001
je 0x101159b
cmp eax, 0xc0000014
je 0x101159b
mov ecx, ebx
call fcn.0100fa54
mov ebx, dword [ebx + 0x34]
cmp ebx, 0x80000011
je 0x1011583
cmp ebx, 0xc0000013
je 0x101157c
cmp ebx, 0xc00000a3
je 0x1011583
mov eax, 0x7d6
jmp 0x1011588
mov eax, 0x7d7
jmp 0x1011588
mov eax, 0x830
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1011ec2
jmp 0x1011ebc
mov dword [ebp - 0x4320], esi
cmp dword [ebp - 0x4320], esi
jne 0x10115c2
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x4328]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x4300]
mov dword [ebp - 0x4320], esi
cmp dword [ebp - 0x4320], 0xc
je 0x10115d8
cmp dword [ebp - 0x4320], 0xb
jne 0x1011ad1
push 8
lea eax, [ebp - 0x4340]
push eax
push esi
push esi
push 0x7405c
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
setge cl
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x101162c
cmp eax, 0xc0000010
je 0x101162c
mov ecx, ebx
call fcn.0100fa54
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1011ec2
push 0x7e7
jmp 0x1011ebd
test cl, cl
je 0x1011ad1
push 0x90
lea eax, [ebp - 0x43e8]
push eax
push esi
push esi
push 0x70048
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
mov edx, 0x1001380
jge 0x10116ad
cmp eax, 0xc0000010
jne 0x101160d
mov eax, dword [ebp - 0x4340]
and dword [ebp - 0x43dc], 0
mov dword [ebp - 0x43d8], eax
mov eax, dword [ebp - 0x433c]
mov dword [ebp - 0x43e8], 1
mov dword [ebp - 0x43e0], 0x7e00
mov dword [ebp - 0x43d4], eax
mov esi, edx
lea edi, [ebp - 0x43c8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [ebp - 0x43e8], esi
je 0x1011707
and dword [ebp - 0x43e8], 0
push 4
pop ecx
xor eax, eax
mov edi, edx
lea esi, [ebp - 0x43c8]
repe cmpsd dword [esi], dword es:[edi]
push 0
push dword [ebp - 0x4314]
setne al
push dword [ebp - 0x43dc]
dec al
push dword [ebp - 0x43e0]
and al, 0x19
add al, 0xee
mov byte [ebp - 0x43c8], al
mov byte [ebp - 0x43c7], 0
mov byte [ebp - 0x43c6], 1
call sub.ntdll.dll__alldiv
mov dword [ebp - 0x43c4], eax
push 0x24
lea edi, [ebx + 0x38]
pop ecx
lea esi, [ebp - 0x43e8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x105c040]
mov ecx, 0x20001
cmp eax, ecx
jne 0x1011954
cmp dword [ebp - 0x4320], 0xb
jne 0x1011739
mov dword [ebx + 0x20], 1
jmp 0x101173d
and dword [ebx + 0x20], 0
mov eax, dword [0x105c040]
cmp eax, ecx
jne 0x1011954
cmp dword [ebx + 0x20], 1
je 0x10119d5
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
push ecx
mov dword [eax], ecx
push ecx
xor esi, esi
mov dword [eax + 4], esi
mov ecx, dword [ebp - 0x43e0]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43dc]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
mov dword [ebp - 0x4330], esi
mov dword [ebp - 0x432c], esi
call fcn.0100bd16
cmp word [ebx + 0x10c], si
mov ecx, dword [eax]
mov dword [ebx + 0xf0], ecx
mov eax, dword [eax + 4]
mov cx, word [ebp - 0x4314]
mov dword [ebx + 0xf4], eax
lea eax, [ebx + 0xe8]
mov dword [eax], esi
mov word [eax], cx
jne 0x10118cf
lea ecx, [ebp - 0x4354]
call fcn.010154ae
push dword [ebx + 0x100]
mov edi, 0x2800
push edi
lea ecx, [ebp - 0x4354]
mov dword [ebp - 0x42f0], esi
call fcn.0101539c
test eax, eax
jne 0x10117fe
lea ecx, [ebp - 0x4354]
call fcn.010154da
jmp 0x1011ec2
mov eax, dword [ebp - 0x4344]
push esi
push esi
push edi
push eax
mov dword [ebp - 0x430c], eax
mov dword [ebp - 0x42f4], eax
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov ecx, 0xc0000000
mov dword [ebx + 0x34], eax
and eax, ecx
cmp eax, ecx
je 0x10117ee
cmp dword [ebp - 0x4304], edi
jne 0x10117ee
mov eax, dword [ebp - 0x42f4]
mov cx, word [eax + 0x13]
mov word [ebp - 0x42f0], cx
cmp dword [ebp - 0x42f0], esi
jne 0x1011864
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x42f0], eax
mov edi, dword [ebp - 0x430c]
push edi
xor eax, eax
push eax
push dword [ebp - 0x42f0]
call fcn.0100e2ea
test al, al
je 0x1011890
mov eax, dword [ebp - 0x42f4]
mov ax, word [eax + 0xb]
mov word [ebp - 0x4314], ax
jmp 0x10118c4
lea eax, [edi + 0x2200]
push eax
lea eax, [edi + 0x2000]
push eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x42f0]
call fcn.0100e4c2
test al, al
je 0x10118c4
mov eax, 0x200
cmp dword [ebp - 0x4314], eax
je 0x10118c4
mov dword [ebp - 0x4314], eax
lea ecx, [ebp - 0x4354]
call fcn.010154da
mov edi, dword [ebp - 0x4330]
push ecx
push ecx
mov eax, esp
push dword [ebp - 0x432c]
mov dword [eax], esi
push edi
mov dword [eax + 4], esi
call fcn.0100f070
test al, al
je 0x1011925
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
push ecx
mov dword [eax], ecx
mov dword [eax + 4], esi
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100bd16
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x101192b
mov ecx, dword [ebp - 0x432c]
mov edx, dword [ebp - 0x43c4]
lea eax, [ebx + 0xc8]
push eax
push ecx
push ecx
mov eax, esp
push ecx
mov dword [eax], edx
mov dword [eax + 4], esi
push edi
lea eax, [ebp - 0x4328]
push eax
call fcn.0100fb2a
jmp 0x1011a2a
cmp eax, 0x40002
jne 0x10119c7
cmp byte [ebp - 0x43c8], 1
jne 0x10119a5
push ecx
push ecx
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], 0x300000
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
call fcn.0100fba0
neg al
sbb eax, eax
and eax, 0xfffffc00
add eax, 0x800
mov dword [ebp - 0x4314], eax
jmp 0x1011a2a
cmp byte [ebp - 0x43c8], 4
je 0x10119bb
cmp byte [ebp - 0x43c8], 6
jne 0x1011a3c
mov dword [ebp - 0x4314], 0x800
jmp 0x1011a2a
cmp eax, ecx
jne 0x1011a3c
cmp dword [ebx + 0x20], 1
jne 0x1011a95
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], ecx
push ecx
mov ecx, dword [ebp - 0x43e0]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43dc]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100bd16
mov ecx, dword [eax]
mov dword [ebx + 0xf0], ecx
mov eax, dword [eax + 4]
mov cx, word [ebp - 0x4314]
mov dword [ebx + 0xf4], eax
lea eax, [ebx + 0xe8]
and dword [eax], 0
mov word [eax], cx
cmp dword [0x105c040], 0x20001
jne 0x1011a3c
cmp dword [ebx + 0x20], 1
jne 0x1011a95
lea eax, [ebx + 0xc8]
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x43c4]
mov eax, esp
and dword [eax + 4], 0
mov dword [eax], ecx
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], ecx
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100bd16
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x4328]
push eax
call fcn.0100fb2a
xor esi, esi
lea eax, [ebx + 0xfc]
cmp dword [eax], esi
jne 0x1011dd7
push 0x30
mov dword [eax], 1
call fcn.010131df
mov edi, eax
cmp edi, esi
pop ecx
je 0x1011dbe
push fcn.01010375
push 1
push 0x30
push edi
call fcn.0100f9fd
jmp 0x1011dc0
lea eax, [ebx + 0xc8]
push eax
lea eax, [ebp - 0x4328]
push eax
call fcn.010106bd
mov ecx, ebx
call fcn.0100bd3f
test al, al
je 0x1011a97
push 0x1e0
lea eax, [ebp - 0x45c8]
push eax
push esi
push esi
push 0x70c00
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x1011b6d
mov ecx, ebx
call fcn.0100fa54
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1011ec2
mov ebx, dword [ebx + 0x34]
cmp ebx, 0x80000011
je 0x1011eb7
cmp ebx, 0xc0000013
je 0x1011b63
cmp ebx, 0xc00000a3
je 0x1011eb7
mov eax, 0x7d6
jmp 0x1011ebc
mov eax, 0x8aa
jmp 0x1011ebc
mov eax, dword [ebp - 0x4304]
push 0x18
xor edx, edx
pop ecx
div ecx
cmp eax, esi
mov dword [ebx + 0xfc], eax
jne 0x1011ba3
mov ecx, ebx
call fcn.0100fa54
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1011ec2
push 0x7d6
jmp 0x1011ebd
cmp dword [0x105c040], 0x20001
jne 0x1011c6e
cmp eax, esi
mov dword [ebp - 0x42f0], esi
jle 0x1011c6e
lea edx, [ebp - 0x45c8]
cmp dword [edx + 8], 6
jne 0x1011c0d
mov eax, dword [ebx + 0xfc]
dec eax
cmp dword [ebp - 0x42f0], eax
mov dword [ebp - 0x42f4], eax
jge 0x1011c07
mov eax, dword [ebx + 0xfc]
sub eax, dword [ebp - 0x42f0]
lea esi, [edx + 0x18]
dec eax
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x42f4]
shl ecx, 3
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebx + 0xfc], eax
cmp dword [edx + 8], 0x16
jne 0x1011c53
mov eax, dword [ebx + 0xfc]
dec eax
cmp dword [ebp - 0x42f0], eax
mov dword [ebp - 0x42f4], eax
jge 0x1011c4d
mov eax, dword [ebx + 0xfc]
sub eax, dword [ebp - 0x42f0]
lea esi, [edx + 0x18]
dec eax
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x42f4]
shl ecx, 3
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebx + 0xfc], eax
inc dword [ebp - 0x42f0]
mov eax, dword [ebp - 0x42f0]
add edx, 0x18
cmp eax, dword [ebx + 0xfc]
jl 0x1011bc7
mov edi, dword [ebx + 0xfc]
cmp edi, esi
mov dword [ebp - 0x42f0], edi
jle 0x1011d12
lea eax, [edi - 1]
mov dword [ebp - 0x42f4], eax
mov eax, edi
mov dword [ebp - 0x430c], eax
cmp dword [ebp - 0x42f4], esi
jle 0x1011d0a
mov ecx, dword [ebx + 0xfc]
dec ecx
lea eax, [ebp - 0x45a0]
mov dword [ebp - 0x432c], ecx
mov ecx, dword [eax - 0x1c]
imul ecx, dword [eax - 0x18]
mov edx, dword [eax - 4]
imul ecx, dword [eax - 0x14]
imul edx, dword [eax + 4]
imul ecx, dword [eax - 0x28]
imul edx, dword [eax - 0x10]
imul edx, dword [eax]
cmp ecx, edx
jae 0x1011cf9
push 6
pop ecx
lea edx, [eax - 0x28]
push 6
mov esi, edx
lea edi, [ebp - 0x4358]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea esi, [eax - 0x10]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
lea esi, [ebp - 0x4358]
lea edi, [eax - 0x10]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, dword [ebp - 0x42f0]
add eax, 0x18
dec dword [ebp - 0x432c]
jne 0x1011cae
dec dword [ebp - 0x430c]
jne 0x1011c93
lea eax, [edi + edi*2]
shl eax, 4
push eax
call fcn.010131df
cmp eax, esi
pop ecx
mov dword [ebp - 0x430c], eax
je 0x1011d3f
push fcn.01010375
push edi
push 0x30
push eax
call fcn.0100f9fd
mov eax, dword [ebp - 0x430c]
jmp 0x1011d41
xor eax, eax
cmp eax, esi
mov dword [ebx + 0xf8], eax
jne 0x1011d6a
mov ecx, ebx
call fcn.0100fa54
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1011ec2
push 0x801
jmp 0x1011ebd
xor edi, edi
cmp dword [ebx + 0xfc], esi
jle 0x1011a97
lea eax, [ebp - 0x45c8]
mov dword [ebp - 0x42f4], esi
mov dword [ebp - 0x42f0], eax
mov eax, dword [ebx + 0xf8]
add eax, dword [ebp - 0x42f4]
push eax
push dword [ebp - 0x42f0]
call fcn.010106bd
add dword [ebp - 0x42f4], 0x30
add dword [ebp - 0x42f0], 0x18
inc edi
cmp edi, dword [ebx + 0xfc]
jl 0x1011d8a
jmp 0x1011a97
xor edi, edi
cmp edi, esi
mov dword [ebx + 0xf8], edi
je 0x1011d4b
push 0xc
lea esi, [ebx + 0xc8]
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov ecx, ebx
call fcn.0100fe4b
test al, al
mov ecx, ebx
je 0x1011b23
call fcn.0100ff39
test al, al
jne 0x1011dfe
cmp dword [ebx + 0x34], 0xc0000023
je 0x1011ec2
cmp dword [ebp - 0x4320], 0xb
jne 0x1011efb
mov edi, dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
push 0x36c0
lea eax, [ebp - 0x36c4]
push eax
push esi
push esi
push 0x70050
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
mov byte [ebp - 0x42f5], 0
call edi
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x1011e92
cmp eax, 0xc0000010
jne 0x1011e92
push 0xc28
lea eax, [ebp - 0x42ec]
push eax
push esi
push esi
push 0x7400c
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
mov byte [ebp - 0x42f5], 1
call edi
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x1011e92
cmp dword [ebp - 0x42ec], 4
jae 0x1011e92
mov byte [ebx + 0x104], 1
cmp dword [ebx + 0x34], esi
jl 0x1011b21
cmp byte [ebp - 0x42f5], 0
jne 0x1011eed
cmp dword [ebp - 0x36c4], esi
jne 0x1011ec6
cmp dword [ebp - 0x36c0], 4
jae 0x1011eed
jmp 0x1011ee6
mov eax, 0x830
push eax
call fcn.0100f02b
xor al, al
jmp 0x1011f13
cmp dword [ebp - 0x36c4], 1
jne 0x1011eed
cmp dword [ebp - 0x36c0], 1
jne 0x1011eed
mov eax, dword [ebp - 0x368c]
or eax, dword [ebp - 0x3688]
jne 0x1011eed
mov byte [ebx + 0x104], 1
mov ecx, ebx
call fcn.01010abd
mov ecx, ebx
call fcn.01012be1
cmp byte [ebp + 0x10], 0
jne 0x1011f11
mov edi, dword [ebp - 0x4300]
push dword [edi]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [edi], esi
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.01059e06
pop edi
pop esi
pop ebx
leave
ret 0x14