Function at 0x402518
Capabilities:
Unmount volume via ioctl

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x402233
push 1
call fcn.00483c58
pop ecx
push ecx
push edx
jmp 0x4022e9
pop edx
pop ecx
jmp 0x402343
mov eax, dword [0x48a54f]
mov dword [ebp - 8], eax
mov ax, word [0x48a553]
mov word [ebp - 4], ax
mov al, byte [0x48a555]
mov byte [ebp - 2], al
mov dl, byte [ebp + 8]
mov byte [ebp - 4], dl
push 0
push 0x20000000
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 8]
push ecx
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x402392
or eax, 0xffffffff
jmp 0x402511
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0x90018
push dword [ebp - 0xc]
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x4023c1
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
or eax, 0xffffffff
jmp 0x402511
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0x8000e004
push dword [ebp - 0xc]
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x4023f2
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffffe
jmp 0x402511
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0x90020
push dword [ebp - 0xc]
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x402423
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffffd
jmp 0x402511
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0x9001c
push dword [ebp - 0xc]
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x402454
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffffc
jmp 0x402511
push 0
lea edx, [ebp - 4]
push edx
push 2
call sub.kernel32.dll_DefineDosDeviceA
test eax, eax
jne 0x402477
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffffb
jmp 0x402511
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
jmp 0x4024d8
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x4024ad
pop esi
cmp edi, 0xf603cff8
pop ebp
pop edi
nop
jmp 0x402222
jmp 0x40250f
aad 0xbf
push 0x11
pop edx
xor eax, 0x96adddb
or byte [edi - 0x3efc2e87], bl
in al, dx
nop
pop esi
jge 0x402538
push esi
mov al, byte [esi + 7]
jb 0x4024b3
pop es
lea ebx, [ebp + 0x1e9ccb9a]
and edi, dword [esi - 0x7f]
sbb dh, ah
and byte [eax - 0x3fcc8e62], 0x8b
in eax, 0x5d
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
add esp, 0xffffffec
push edi
push ebp
push esi
or edi, 0xffffffff
inc edi
call fcn.0040274e
dec edx
dec edx
pop edx
jp 0x4024e3
cld
sti
xchg ebp, eax
arpl dx, sp
test dword [edi + 0x4c], esp
lodsb al, byte [esi]
mov dl, dh
pop edi
sbb al, 0xd4
dec edi
shl ebx, 1
pop ds
shl byte [ecx + edx*4 - 0x55], 0xfb
dec edi
jns 0x40257e
stosd dword es:[edi], eax
popfd
or bl, byte [ebp - 0x88a174c]
invalid
push dword [ebx]
add ebx, dword [esp + 0x18]
mov ebx, 0x49993e
pop ebx
adc ecx, ebx
add ecx, ebx
lea ecx, [edi + 0x86c00]
sub ecx, edi
lea ebx, [ebx + ecx]
rcr ecx, 0xcd
xor ecx, dword [esp + 8]
mov ecx, dword [ebx]
and ecx, 0xff
sub ebx, 0xffffffc1
xor ebx, dword [esp + 0x28]
lea ebx, [ebp + esi - 0xb]
lea ebx, [ecx + 0xcac313]
sub ebx, ecx
lea ecx, [ecx + edi - 0xcac3fb]
sub ecx, edi
lea ecx, [ecx + ebx*2 + 0x23]
sub ecx, 0x23
sub ecx, ebx
test ecx, ecx
je 0x402600
add ebp, dword [esp + 0x38]
mov ebp, 0x45d7c6
add esi, 0x296bd940
rol edi, 0x81
xor edi, dword [esp + 0x28]
push dword fs:[0]
jmp 0x402600
pop ecx
pop ebx
jmp 0x40266f
mov eax, dword [0x48a556]
mov dword [ebp - 8], eax
mov ax, word [0x48a55a]
mov word [ebp - 4], ax
mov al, byte [0x48a55c]
mov byte [ebp - 2], al
mov dl, byte [ebp + 8]
mov byte [ebp - 4], dl
push 0
push 0x20000000
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 8]
push ecx
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4026be
or eax, 0xffffffff
jmp 0x4027db
push 0x11c
call fcn.0047e1d8
pop ecx
mov dword [ebp - 0x10], eax
push 0x11c
push 0
push dword [ebp - 0x10]
call fcn.0047e7f4
add esp, 0xc
push 0
lea edx, [ebp - 0x14]
push edx
push 0x11c
push dword [ebp - 0x10]
push 0
push 0
push 0x80006008
push dword [ebp - 0xc]
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x402711
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
or eax, 0xffffffff
jmp 0x4027db
cmp dword [ebp - 0x14], 0x18
jae 0x402727
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
or eax, 0xffffffff
jmp 0x4027db
mov edx, dword [ebp - 0x10]
movzx ecx, word [edx + 0x12]
push ecx
mov eax, dword [ebp - 0x10]
add eax, 0x14
push eax
push dword [ebp + 0xc]
call fcn.0047eae0
add esp, 0xc
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
jmp 0x4027a2
jmp 0x4027d9
xor eax, eax
mov esp, ebp
pop ebp
ret