Function at 0x401000
Capabilities:
Get disk information
Read file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x41600c]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x24], 3
push edi
mov edi, dword [esp + 0x2c]
jge 0x40102f
mov eax, 0xa0
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040134b
add esp, 0x20
ret
push esi
push section..data
push dword [edi + 8]
call fcn.004033f9
mov esi, eax
add esp, 8
test esi, esi
je 0x4012ee
push esi
push 6
call fcn.00403439
add esp, 8
cmp eax, 0xffffffff
je 0x4012d8
push esi
call fcn.004031a9
push 0x416004
push dword [edi + 4]
call fcn.004033f9
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4012ee
push edi
call fcn.0040323a
add esp, 4
cmp eax, 6
jne 0x4012d8
push ebx
push edi
push 1
lea eax, [esp + 0x18]
push 2
push eax
call fcn.00403729
add esp, 0x10
cmp eax, 1
jne 0x4012b2
mov ax, word [esp + 0x10]
mov ch, al
mov cl, ah
movzx eax, cx
mov dword [esp + 0x10], eax
movzx eax, cx
lea eax, [eax*2 + 2]
push eax
call fcn.00402db0
movzx ecx, word [esp + 0x14]
mov ebx, eax
push edi
push 1
add ecx, ecx
push ecx
push ebx
call fcn.00403729
add esp, 0x14
cmp eax, 1
jne 0x4012b2
movzx eax, word [esp + 0x10]
xor ecx, ecx
xorps xmm0, xmm0
mov word [ebx + eax*2], cx
lea eax, [esp + 0xc]
push eax
push ecx
push ecx
push 0x60000
push ebx
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 2
push eax
movups xmmword [esp + 0x30], xmm0
call sub.VirtDisk.dll_OpenVirtualDisk
mov ebx, eax
test ebx, ebx
je 0x401155
push esi
push 1
call fcn.00403439
push ebx
push esi
call fcn.00401310
push edi
call fcn.00402e32
push esi
call fcn.00402e32
add esp, 0x18
mov eax, ebx
pop ebx
pop esi
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040134b
add esp, 0x20
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
mov ebp, eax
call sub.VirtDisk.dll_AttachVirtualDisk
mov ebx, eax
test ebx, ebx
je 0x4011b4
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 2
call fcn.00403439
push ebx
push esi
call fcn.00401310
push edi
call fcn.00402e32
push esi
call fcn.00402e32
add esp, 0x18
mov eax, ebx
pop ebp
pop ebx
pop esi
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040134b
add esp, 0x20
ret
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
not ebp
and eax, ebp
bsr ebx, eax
jne 0x401202
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 3
call fcn.00403439
push esi
call fcn.004031a9
push edi
call fcn.00402e32
push esi
call fcn.00402e32
add esp, 0x14
mov eax, 0xf
pop ebp
pop ebx
pop esi
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040134b
add esp, 0x20
ret
push esi
push 0
call fcn.00403439
movsx eax, bl
add eax, 0x41
push esi
push eax
call fcn.00403439
push esi
call fcn.004031a9
push edi
call fcn.0040323a
add esp, 0x18
mov ebp, eax
push 0
push 0
push dword [esp + 0x18]
call sub.VirtDisk.dll_DetachVirtualDisk
mov ebx, eax
test ebx, ebx
je 0x401270
nop dword [eax + eax]
test ebp, ebp
jne 0x401270
push esi
push 1
call fcn.00403439
push esi
call fcn.004031a9
push edi
call fcn.0040323a
add esp, 0x10
mov ebp, eax
push 0
push 0
push dword [esp + 0x18]
call sub.VirtDisk.dll_DetachVirtualDisk
mov ebx, eax
test ebx, ebx
jne 0x401240
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test ebx, ebx
push esi
setne al
push eax
call fcn.00403439
push esi
call fcn.004031a9
push edi
call fcn.00402e32
push esi
call fcn.00402e32
add esp, 0x14
mov eax, ebx
pop ebp
pop ebx
pop esi
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040134b
add esp, 0x20
ret
push edi
call fcn.00402e32
push esi
call fcn.00402e32
add esp, 8
mov eax, 0x6d
pop ebx
pop esi
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040134b
add esp, 0x20
ret
pop esi
mov eax, 0x6d
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040134b
add esp, 0x20
ret
mov ecx, dword [esp + 0x24]
mov eax, 2
pop esi
pop edi
xor ecx, esp
call fcn.0040134b
add esp, 0x20
ret