Function at 0x4ccf40
Capabilities:
Get disk information
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fe1ce
mov eax, dword fs:[0]
push eax
mov eax, 0x1a68
call fcn.005ddc60
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a44], ecx
mov eax, dword [ebp + 0x1c]
xor esi, esi
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1a3c], eax
mov eax, dword [ebp + 0x10]
shld eax, edx, 9
push esi
mov dword [ebp - 0x1a70], eax
lea eax, [ebp - 0x1a70]
shl edx, 9
push eax
push edx
push ebx
mov dword [ebp - 0x1a40], ebx
mov dword [ebp - 0x1a50], esi
mov dword [ebp - 0x1a74], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4cd346
push 0x1000
lea eax, [ebp - 0x1010]
push esi
push eax
call fcn.00588800
add esp, 0xc
mov dword [ebp - 0x1a58], esi
lea eax, [ebp - 0x1a58]
push esi
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4cd346
cmp dword [ebp - 0x1a58], 0x1000
jne 0x4cd346
cmp byte [ebp - 0xe12], 0x55
jne 0x4cd346
cmp byte [ebp - 0xe11], 0xaa
jne 0x4cd346
xorps xmm0, xmm0
mov dword [ebp - 0x1a4c], esi
movlpd qword [ebp - 0x1a6c], xmm0
lea ecx, [ebp - 0xe4e]
mov edi, dword [ebp - 0x1a68]
mov ebx, dword [ebp - 0x1a6c]
mov dword [ebp - 0x1a48], ecx
mov al, byte [ecx]
test al, al
je 0x4cd2de
mov edx, dword [ecx + 8]
test edx, edx
je 0x4cd2ee
cmp al, 5
je 0x4cd2f6
cmp al, 0xf
je 0x4cd2f6
push 0x48
mov dword [ebp - 0x1a50], 1
call fcn.00560437
add esp, 4
mov dword [ebp - 0x1a68], eax
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.004cc500
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1a64], esi
test esi, esi
je 0x4cd2c9
mov ebx, dword [ebp - 0x1a48]
xor eax, eax
mov edi, dword [ebp - 0x1a3c]
mov dword [esi], edi
cmp byte [ebx - 4], 0x80
sete al
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov dword [esi + 0x14], 1
movzx eax, byte [ebx]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x28], eax
mov eax, 0
mov dword [esi + 0x2c], 0
mov ecx, dword [ebx + 4]
add ecx, dword [ebp + 0xc]
mov dword [esi + 0x20], ecx
adc eax, dword [ebp + 0x10]
push eax
push ecx
push dword [ebp - 0x1a40]
mov dword [esi + 0x24], eax
call fcn.004cd370
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0
mov al, byte [ebx]
cmp al, 0x1b
je 0x4cd141
cmp al, 0x1c
je 0x4cd141
cmp al, 0x17
je 0x4cd141
cmp al, 0x11
je 0x4cd141
cmp al, 0x14
je 0x4cd141
cmp al, 0x16
je 0x4cd141
cmp al, 0x1e
je 0x4cd141
xor al, al
jmp 0x4cd143
mov al, 1
mov byte [esi + 0xc], al
cmp byte [ebx], 0xaf
sete al
mov byte [esi + 0xd], al
lea eax, [ebp - 0x1a5c]
push dword [esi + 0x24]
push dword [esi + 0x20]
push edi
push eax
call fcn.004cdaf0
mov dword [ebp - 4], 1
mov edx, dword [eax]
mov edi, dword [esi + 0x40]
sub edi, 0x10
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x4cd1c0
cmp dword [edi + 0xc], 0
jl 0x4cd1b4
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4cd1b4
call fcn.0040c950
mov dword [ebp - 0x1a54], eax
lea ecx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4cd1a6
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x1a54]
add eax, 0x10
mov dword [esi + 0x40], eax
jmp 0x4cd1c0
push dword [edx - 0xc]
lea ecx, [esi + 0x40]
push edx
call fcn.0040c9d0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x1a5c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4cd1e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0x514
lea eax, [ebp - 0x1a38]
push eax
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x4cd20e
cmp word [ebp - 0x1a38], 0
je 0x4cd20e
mov byte [esi + 0xd], 0
mov eax, dword [esi + 0x40]
cmp dword [eax - 0xc], 0
je 0x4cd2ab
push eax
lea eax, [ebp - 0x1a60]
push eax
call fcn.004cdf80
mov dword [ebp - 4], 3
mov edx, dword [eax]
mov edi, dword [esi + 0x38]
sub edi, 0x10
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x4cd286
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x4cd27a
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4cd27a
call fcn.0040c950
mov dword [ebp - 0x1a54], eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x4cd26c
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x1a54]
add eax, 0x10
mov dword [esi + 0x38], eax
jmp 0x4cd286
push dword [edx - 0xc]
lea ecx, [esi + 0x38]
push edx
call fcn.0040c9d0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x1a60]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4cd2ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [esi + 0x28]
lea eax, [ebp - 0x1a64]
add ebx, dword [esi + 0x20]
mov edi, dword [esi + 0x2c]
mov ecx, dword [ebp - 0x1a44]
adc edi, dword [esi + 0x24]
push eax
call fcn.004ce920
mov esi, dword [ebp - 0x1a4c]
mov ecx, dword [ebp - 0x1a48]
add ecx, 0x10
mov dword [ebp - 0x1a48], ecx
inc esi
mov dword [ebp - 0x1a4c], esi
cmp esi, 4
jl 0x4cd055
mov eax, dword [ebp - 0x1a50]
jmp 0x4cd348
push dword [ebp - 0x1a3c]
mov ecx, dword [ecx + 4]
xor eax, eax
add ecx, dword [ebp + 0xc]
push 0
adc eax, dword [ebp + 0x10]
push edx
push eax
push ecx
push dword [ebp - 0x1a40]
mov ecx, dword [ebp - 0x1a44]
call fcn.004ccf40
test eax, eax
jne 0x4cd2cf
mov eax, ebx
or eax, edi
je 0x4cd2cf
push dword [ebp - 0x1a3c]
mov ecx, dword [ebp - 0x1a44]
push 0
push 0
push edi
push ebx
push dword [ebp - 0x1a40]
call fcn.004ccf40
jmp 0x4cd2cf
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 0x18