Function at 0x4a4aa0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov ebx, eax
xor edi, edi
cmp ebx, 0x50
mov dword [esp + 0x1c], edi
push ebx
jb 0x4a4cb1
call fcn.004a4a40
mov edi, eax
test edi, edi
je 0x4a4c97
push 0
push 0
push 0
push ebp
call fcn.004af0b0
test eax, eax
je 0x4a4c70
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a4c62
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0x4a4c5a
lea ecx, [edi + 3]
mov edx, str.NTFS
mov dword [esp + 0xc], 8
mov eax, ecx
sub edx, ecx
movzx ebx, byte [edx + eax]
movzx ebp, byte [eax]
sub ebp, ebx
jne 0x4a4c37
mov ebx, 1
add eax, ebx
sub dword [esp + 0xc], ebx
jne 0x4a4b17
movzx ecx, byte [edi + 0xd]
push ecx
push str.sectors_per_cluster__d_n
call fcn.0048f0d0
mov al, byte [edi + 0xd]
add esp, 8
cmp al, 0x80
ja 0x4a4b51
movzx edx, al
jmp 0x4a4b5c
mov ecx, 0x100
sub ecx, eax
mov edx, ebx
shl edx, cl
movzx eax, word [edi + 0xb]
imul edx, eax
mov ecx, edx
push ecx
push str.bytes_per_cluster__d_n
mov dword [esi + 0x10], edx
call fcn.0048f0d0
mov edx, dword [esi + 0x10]
add esp, 8
test edx, edx
je 0x4a4c2e
movzx eax, word [edi + 0xb]
test eax, eax
mov dword [esi + 0x18], eax
je 0x4a4c25
mov cl, byte [edi + 0x40]
test cl, cl
jle 0x4a4ba2
movsx eax, cl
imul eax, edx
mov dword [esi + 0x14], eax
jmp 0x4a4bab
neg ecx
mov edx, ebx
shl edx, cl
mov dword [esi + 0x14], edx
cmp dword [esi + 0x14], 0
je 0x4a4c1c
mov eax, dword [edi + 0x30]
mov dword [esi], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 4], ecx
mov edx, dword [edi + 0x48]
mov dword [esi + 8], edx
mov edx, dword [esi]
mov eax, dword [edi + 0x4c]
push ecx
push edx
push str.mft_lcn__I64u_n
mov dword [esi + 0xc], eax
call fcn.0048f0d0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
push str.serial_number__I64u_n
call fcn.0048f0d0
mov edx, dword [esi + 0x10]
push edx
push str.bytes_per_cluster__u_n
call fcn.0048f0d0
mov eax, dword [esi + 0x14]
push eax
push str.bytes_per_file_record__u_n
call fcn.0048f0d0
add esp, 0x28
push edi
mov dword [esp + 0x20], ebx
call fcn.004a4a80
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret 4
push 0
push str.invalid_bytes_per_file_record__u_n
jmp 0x4a4c7c
push 0
push str.invalid_bytes_per_sector__u_n
jmp 0x4a4c7c
push 0
push str.invalid_bytes_per_cluster__u_n
jmp 0x4a4c7c
push 8
push ecx
push str.bad_NTFS_signature:__t_n
call fcn.0048f0d0
add esp, 0xc
push edi
call fcn.004a4a80
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
push eax
push str.unable_to_read_all_of_NTFS_boot_sector:__u_n
jmp 0x4a4c7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_read_NTFS_boot_sector:__u_n
jmp 0x4a4c7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_set_file_pointer_to_boot_sector__u_n
call fcn.0048f0d0
add esp, 8
push edi
call fcn.004a4a80
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
push str.failed_to_alloc_sector_buf
call fcn.0048f0d0
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
push str.bad_sector_size__u_n
call fcn.0048f0d0
add esp, 8
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4