Function at 0x140002560
Capabilities:
Get file size
Initialize winsock library
Read file on windows
Unmount volume via ioctl

Disassembly:
push rbp
push r13
push r14
push r15
sub rsp, 0x668
mov r15d, ecx
lea rcx, [0x140004460]
xor r13d, r13d
mov r14, rdx
mov ebp, r13d
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rdx, [rsp + 0x4b0]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
cmp r15d, 1
jle 0x1400025e0
mov rcx, qword [r14 + 8]
lea rdx, [0x14000577c]
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x1400025e0
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.devio_with_custom_DLL_support_nCopyright__C__2005_2018_Olof_Lagerkvist._n_nUsage_for_unmanaged_C_C_DLL_files:_ndevio___dlldllfile_procedure_other_devio_parameters_..._n_ndllfile_____Name_of_custom_DLL_file_to_use_for_device_I_O._n_nprocedure___Name_of_procedure_in_DLL_file_to_use_for_opening_device._This_n____________procedure_must_follow_the_dllopen_proc_typedef_as_specified_in_ndevio.h._n_nDeclaration_for_dllopen_is:_nvoid____cdecl_dllopen_const_char_str__n_______________________int_read_only__n_______________________dllread_proc_dllread__n_______________________dllwrite_proc_dllwrite__n_______________________dllclose_proc_dllclose__n_________________________int64_size__n_nstr_________Device_name_to_open_as_specified_at_devio_command_line._n_nread_only___A_non_zero_value_requests_a_device_to_be_opened_in_read_only_mode._n_ndllread_____Pointer_to_memory_where_dllopen_should_store_address_to_a_function_n____________that_is_used_when_reading_from_device._n_ndllwrite____Pointer_to_memory_where_dllopen_should_store_address_to_a_function_n____________that_is_used_when_writing_to_device._Address_is_ignored_by_devio_n____________if_device_is_opened_for_read_only._n_ndllclose____Pointer_to_memory_where_dllopen_should_store_address_to_a_function_n____________that_is_used_when_closing_device._n_nsize________Pointer_to_memory_where_dllopen_should_store_detected_size_of_n____________successfully_opened_device._This_is_optional._n_nTypes_for_dllread_proc__dllwrite_proc__dllclose_proc_are_declared_in_devio.h._n_nReturn_value_from_dllopen_is_typed_as_void__to_be_able_to_hold_as_much_data_n____________for_some_kind_of_reference_as_current_architecture_allows._Devio_n____________practically_ignores_this_value__it_is_just_sent_in_later_calls_to_n____________dllread_dllwrite_dllclose._The_only_thing_that_devio_checks_is_that_n____________this_value_is_not__void___1._That_case_is_treated_as_an_error_n____________return._n_nValue_returned_by_dllopen_will_be_passed_by_devio_to_to_dllread__dllwrite_and_ndllclose_functions._n_nUsage_for_.NET_managed_class_library_files:_ndevio___dlliobridge.dll_dllopen_other_devio_parameters_..._n_nParameter___dlliobridge.dll_dllopen_means_to_use_iobridge.dll_which_is_a_nmixed_managed_unmanaged_DLL_that_serves_as_a_bridge_to_transfer_requests_to_a_n.NET_managed_class_library._n_nThe_diskdev_parameter_to_devio_has_somewhat_special_meaning_in_this_case._nSyntax_of_diskdev_parameter_is_treated_as_follows:_nclasslibraryfile::classname::procedure::devicename_n_nclasslibraryfile_n____________Name_of_.NET_managed_class_library_DLL_file._n_nclassname::procedure_n____________Name_of_class__managed_type__and_a_static_method_in_that_class_n____________to_be_used_to_open_a_Stream_object_to_be_used_for_I_O_requests._n_ndevicename__User_specified_data__such_as_a_device_name__file_name_or_similar__n____________that_is_sent_as_first_parameter_to_above_specified_procedure._n_nDeclaration_for_classname::procedure:_npublic_static_System.IO.Stream_open_stream_String_devicename__bool_read_only__n_ndevicename__Device_name_to_open_as_specified_as_part_of_diskdev_parameter_in_n____________devio_command_line__as_specified_above._n_nread_only___Value_of_true_requests_a_device_to_be_opened_in_read_only_mode._n_nReturn_value_from_method_needs_to_be_a_valid_seekable_stream_object_of_a_type_nthat_derives_from_System.IO.Stream_class._Devio_will_use_Read____Write___and_nClose___methods_as_well_as_Position_and_Length_properties_on_opened_Stream_nobject._n
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
or eax, 0xffffffff
add rsp, 0x668
pop r15
pop r14
pop r13
pop rbp
ret
cmp r15d, 3
mov qword [rsp + 0x698], rbx
mov qword [rsp + 0x660], rsi
mov qword [rsp + 0x658], rdi
jl 0x1400026d0
mov rcx, qword [r14 + 8]
lea rdx, str.__dll
mov r8d, 6
call qword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
jne 0x1400026d0
mov rcx, qword [r14 + 8]
lea rdx, [0x140006500]
add rcx, 6
call qword [sym.imp.msvcrt.dll_strtok]
lea rdx, [0x140006502]
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.msvcrt.dll_strtok]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000267d
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.Error_loading__s:__m_n
mov r8, rsi
add rcx, 0x60
call section..text
mov eax, 1
jmp 0x140002817
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov qword [0x140008f98], rax
test rax, rax
jne 0x1400026bf
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.Cannot_find_procedure__s_in__s:__m_n
mov r9, rsi
add rcx, 0x60
mov r8, rbx
call section..text
mov eax, 1
jmp 0x140002817
mov dl, 1
dec r15d
add r14, 8
mov byte [0x140008914], dl
jmp 0x1400026de
mov r11, qword [0x140008f98]
movzx edx, byte [0x140008914]
cmp r15d, 4
jl 0x14000273b
mov rsi, qword [r14 + 8]
lea rdi, str.__novhd
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x140002706
add r14, 8
mov byte [reloc.WS2_32.dll_accept], bpl
dec r15d
cmp r15d, 4
jl 0x14000273b
mov rsi, qword [r14 + 8]
lea rdi, [0x140006550]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
jne 0x14000273b
mov rcx, qword [0x140008958]
add r14, 8
or rcx, 1
dec r15d
mov qword [0x140008958], rcx
jmp 0x140002742
mov rcx, qword [0x140008958]
lea eax, [r15 - 3]
cmp eax, 4
ja 0x140003864
lea rbx, [r14 + 8]
mov qword [rsp + 0x650], r12
mov r12, qword [rbx]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], r12
test dl, dl
je 0x14000283e
test cl, 1
je 0x1400027b0
mov rcx, qword [r14 + 0x10]
lea rax, [0x140008948]
lea r9, [0x140008f88]
mov qword [rsp + 0x28], rax
lea rax, [0x140008f90]
lea r8, [0x140008f80]
mov edx, 1
mov qword [rsp + 0x20], rax
call r11
mov qword [0x140008908], rax
jmp 0x1400027e6
mov rcx, qword [r14 + 0x10]
lea rax, [0x140008948]
lea r9, [0x140008f88]
mov qword [rsp + 0x28], rax
lea rax, [0x140008f90]
lea r8, [0x140008f80]
xor edx, edx
mov qword [rsp + 0x20], rax
call r11
mov qword [0x140008908], rax
test rax, rax
jne 0x140002899
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov r8, qword [r14 + 0x10]
lea rdx, str.Library_call_failed_to_open__s:__m_n
add rcx, 0x60
call section..text
mov eax, 1
mov r12, qword [rsp + 0x650]
mov rsi, qword [rsp + 0x660]
mov rbx, qword [rsp + 0x698]
mov rdi, qword [rsp + 0x658]
add rsp, 0x668
pop r15
pop r14
pop r13
pop rbp
ret
test cl, 1
je 0x14000285a
mov rcx, qword [r14 + 0x10]
mov edx, 0x8000
call qword [sym.imp.msvcrt.dll__open]
mov dword [0x140008320], eax
jmp 0x14000286f
mov rcx, qword [r14 + 0x10]
mov edx, 0x8002
call qword [sym.imp.msvcrt.dll__open]
mov dword [0x140008320], eax
cmp eax, 0xffffffff
jne 0x140002899
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov r8, qword [r14 + 0x10]
lea rdx, str.Failed_to_open__s:__m_n
add rcx, 0x60
call section..text
mov eax, 1
jmp 0x14000280f
mov rdx, qword [r14 + 0x10]
lea rcx, str.Successfully_opened__s._n
call qword [sym.imp.msvcrt.dll_printf]
cmp byte [0x140008914], bpl
je 0x1400028d2
mov rcx, qword [0x140008908]
lea rdx, [0x140008960]
xor r9d, r9d
mov r8d, 0x600
call qword [0x140008f80]
jmp 0x1400028e6
lea rcx, [0x140008960]
xor r8d, r8d
mov edx, 0x600
call fcn.140001200
cmp byte [reloc.WS2_32.dll_accept], bpl
je 0x140002ac8
cmp eax, 0x600
jne 0x140002ac8
lea rdx, str.cxsparse
lea rcx, [0x140008b60]
mov r8d, 8
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
jne 0x140002ac8
lea r8d, [rax + 8]
lea rdx, str.conectix
lea rcx, [0x140008960]
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
jne 0x140002ac8
cmp dword [0x14000899c], 0x3000000
jne 0x140002ac8
mov ecx, dword [0x140008324]
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [0x140008938], rax
test rax, rax
jne 0x140002989
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.malloc___failed:__m_n
add rcx, 0x60
call section..text
mov eax, 2
jmp 0x14000280f
lea rcx, str.Detected_dynamically_expanding_Microsoft_VHD_image_file_format.
call qword [sym.imp.msvcrt.dll_puts]
mov r11, r13
mov edi, r13d
lea rsi, [0x140008990]
nop word [rax + rax]
movsx rdx, byte [rsi]
mov ecx, 7
inc rsi
sub cl, dil
inc edi
shl cl, 3
shl rdx, cl
or r11, rdx
cmp edi, 8
jb 0x1400029b0
mov qword [0x140008f78], r11
mov r8, r13
mov edi, r13d
lea rsi, [0x140008b70]
nop word [rax + rax]
movsx rdx, byte [rsi]
mov ecx, 7
inc rsi
sub cl, dil
inc edi
shl cl, 3
shl rdx, cl
or r8, rdx
cmp edi, 8
jb 0x1400029f0
mov ecx, dword [0x140008b80]
mov qword [0x140008f68], r8
mov dword [0x140008334], 0x200
call qword [sym.imp.WS2_32.dll_ntohl]
movzx edx, r13w
cmp eax, 1
mov edi, eax
mov dword [0x140008f60], eax
setne cl
mov word [0x140008f64], dx
test cl, 1
je 0x140002a7a
nop word [rax + rax]
inc dx
mov eax, 1
movzx ecx, dl
shl eax, cl
mov ecx, r13d
cmp eax, edi
mov eax, r13d
setne cl
cmp dx, 0x40
setl al
test eax, ecx
jne 0x140002a50
mov word [0x140008f64], dx
mov rax, qword [0x140008f78]
movzx ecx, word [0x140008998]
movzx edi, byte [0x14000899b]
movzx esi, byte [0x14000899a]
mov qword [0x140008948], rax
mov byte [0x140008915], 1
call qword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [0x140008f60]
lea rcx, str.VHD_block_size:__u_bytes._C_H_S_geometry:__u__u__u._n
movzx r8d, ax
mov r9d, esi
mov dword [rsp + 0x20], edi
call qword [sym.imp.msvcrt.dll_printf]
mov edi, dword [0x140008334]
movzx edx, r13w
cmp edi, 1
mov word [0x140008f70], dx
setne al
test al, 1
je 0x140002b1a
nop word [rax + rax]
inc dx
mov eax, 1
movzx ecx, dl
shl eax, cl
mov ecx, r13d
cmp eax, edi
mov eax, r13d
setne cl
cmp dx, 0x40
setl al
test eax, ecx
jne 0x140002af0
mov word [0x140008f70], dx
cmp r15d, 3
lea rsi, [0x140000000]
jle 0x140002d33
mov rcx, qword [r14 + 0x18]
lea r9, [rsp + 0x690]
lea r8, [rsp + 0x6a8]
lea rdx, str._I64u_c
mov qword [rsp + 0x6a8], r13
mov byte [rsp + 0x690], bpl
call qword [sym.imp.msvcrt.dll_sscanf]
cmp eax, 2
jne 0x140002d12
movsx r8d, byte [rsp + 0x690]
lea eax, [r8 - 0x42]
cmp eax, 0x32
ja case.0x140002b8f.75
cdqe
movzx eax, byte [rsi + rax + 0x38b8]
mov ecx, dword [rsi + rax*4 + 0x3890]
add rcx, rsi
jmp rcx
mov rax, qword [rsp + 0x6a8]
shl rax, 0xa
shl rax, 0xa
shl rax, 0xa
shl rax, 0xa
mov qword [rsp + 0x6a8], rax
mov qword [0x140008948], rax
jmp 0x140002d38
mov rax, qword [rsp + 0x6a8]
shl rax, 0xa
shl rax, 0xa
shl rax, 0xa
mov qword [rsp + 0x6a8], rax
mov qword [0x140008948], rax
jmp 0x140002d38
mov rax, qword [rsp + 0x6a8]
shl rax, 0xa
shl rax, 0xa
mov qword [rsp + 0x6a8], rax
mov qword [0x140008948], rax
jmp 0x140002d38
mov rax, qword [rsp + 0x6a8]
shl rax, 0xa
mov qword [rsp + 0x6a8], rax
mov qword [0x140008948], rax
jmp 0x140002d38
mov rax, qword [rsp + 0x6a8]
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
mov qword [rsp + 0x6a8], rax
mov qword [0x140008948], rax
jmp 0x140002d38
mov rax, qword [rsp + 0x6a8]
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
mov qword [rsp + 0x6a8], rax
mov qword [0x140008948], rax
jmp 0x140002d38
mov rax, qword [rsp + 0x6a8]
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
mov qword [rsp + 0x6a8], rax
mov qword [0x140008948], rax
jmp 0x140002d38
mov rax, qword [rsp + 0x6a8]
imul rax, rax, 0x3e8
mov qword [rsp + 0x6a8], rax
mov qword [0x140008948], rax
jmp 0x140002d38
mov rax, qword [rsp + 0x6a8]
mov qword [0x140008948], rax
jmp 0x140002d38
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.Unsupported_size_suffix:__c_n
add rcx, 0x60
call section..text
mov rax, qword [rsp + 0x6a8]
mov qword [0x140008948], rax
jmp 0x140002d38
mov rax, qword [rsp + 0x6a8]
cmp rax, 0x200
jae 0x140002d26
mov ebp, eax
jmp 0x140002d38
shl rax, 9
mov qword [0x140008948], rax
jmp 0x140002d38
mov ebp, 1
cmp qword [0x140008948], r13
jne 0x140002f3c
cmp byte [0x140008914], r13b
je 0x140002d6a
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.DLL_did_not_return_size_of_image_partition._n
add rcx, 0x60
call section..text
jmp 0x140002f3c
mov ecx, dword [0x140008320]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea rdx, [rsp + 0x70]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x140002f11
lea rdx, [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
mov dword [rsp + 0x94], eax
cmp eax, 0xffffffff
jne 0x140002f18
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140002f11
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x6a0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90018
mov rcx, rdi
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140002e64
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x6a0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x90020
mov rcx, rdi
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140002e7e
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov r8, qword [r14 + 0x10]
lea rdx, str.Cannot_dismount_filesystem_on__s._n
add rcx, 0x60
call section..text
movzx edx, byte [0x140008958]
not dl
test dl, 1
je 0x140002e7e
mov eax, 9
jmp 0x14000280f
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 1
je 0x140002e7e
sub eax, 5
je 0x140002e7e
sub eax, 0x2c
je 0x140002e7e
cmp eax, 0x25
jne 0x140002e31
cmp qword [0x140008948], r13
jne 0x140002f3c
xor eax, eax
mov qword [rsp + 0x38], r13
xor r9d, r9d
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x6a0]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov edx, 0x74004
mov rcx, rdi
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140002f03
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.Cannot_determine_size_of_disk_volume._n
add rcx, 0x60
call section..text
jmp 0x140002f3c
mov rax, qword [rsp + 0x48]
mov qword [0x140008948], rax
jmp 0x140002f3c
mov edx, dword [rsp + 0x94]
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x6a0], edx
mov dword [rsp + 0x6a4], eax
mov rax, qword [rsp + 0x6a0]
mov qword [0x140008948], rax
mov rax, qword [0x140008f78]
mov rdx, qword [0x140008948]
test rax, rax
cmove rax, rdx
mov qword [0x140008f78], rax
test rdx, rdx
je 0x140002f6a
lea rcx, str.Image_size_used:__I64u_bytes._n
call qword [sym.imp.msvcrt.dll_printf]
lea eax, [rbp - 1]
cmp eax, 0x1fe
ja 0x14000349c
cmp byte [0x140008915], r13b
je 0x140002f9d
lea rcx, [rsp + 0x2b0]
xor r8d, r8d
mov edx, 0x200
call fcn.1400015e0
mov edx, eax
jmp 0x140003024
cmp byte [0x140008914], r13b
je 0x140002fc8
mov rcx, qword [0x140008908]
lea rdx, [rsp + 0x2b0]
xor r9d, r9d
mov r8d, 0x200
call qword [0x140008f80]
mov edx, eax
jmp 0x140003024
mov edi, dword [0x140008320]
xor r8d, r8d
xor edx, edx
mov ecx, edi
call qword [sym.imp.msvcrt.dll__lseeki64]
test rax, rax
je 0x140002fe5
or edx, 0xffffffff
jmp 0x140003024
lea rdx, [rsp + 0x2b0]
mov r8d, 0x200
mov ecx, edi
call qword [sym.imp.msvcrt.dll__read]
movsxd rdx, eax
cmp edx, 0x1ff
ja 0x140003024
mov eax, 0x200
lea rcx, [rsp + rdx + 0x2b0]
sub eax, edx
xor edx, edx
movsxd r8, eax
call sub.msvcrt.dll_memset
mov edx, 0x200
cmp edx, 0x200
jge 0x140003048
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.Error_reading_device:__m_n
add rcx, 0x60
call section..text
jmp 0x14000349c
cmp byte [rsp + 0x4ae], 0x55
jne 0x14000348f
cmp byte [rsp + 0x4af], 0xaa
jne 0x14000348f
test byte [rsp + 0x46e], 0x7f
jne 0x14000348f
test byte [rsp + 0x47e], 0x7f
jne 0x14000348f
test byte [rsp + 0x48e], 0x7f
jne 0x14000348f
test byte [rsp + 0x49e], 0x7f
jne 0x14000348f
lea rcx, str.Detected_a_master_boot_record_at_sector_0.
mov ebx, r13d
call qword [sym.imp.msvcrt.dll_puts]
xor r10d, r10d
mov qword [0x140008940], r10
mov eax, r13d
shl eax, 4
movsxd rcx, eax
movzx eax, byte [rsp + rcx + 0x472]
test al, al
je 0x140003459
cmp al, 5
je 0x1400031be
cmp al, 0xf
je 0x1400031be
inc ebx
cmp ebx, ebp
jne 0x140003459
shl r13d, 4
mov esi, r10d
mov edx, r10d
movsxd r8, r13d
lea rdi, [rsp + r8 + 0x476]
nop
movzx eax, byte [rdi]
lea ecx, [rdx*8]
inc edx
shl eax, cl
inc rdi
or esi, eax
cmp edx, 4
jb 0x140003100
movsx r9d, word [0x140008f70]
mov eax, esi
mov edx, r10d
mov ecx, r9d
mov esi, r10d
lea rdi, [rsp + r8 + 0x47a]
shl rax, cl
mov qword [0x140008940], rax
nop dword [rax]
movzx eax, byte [rdi]
lea ecx, [rdx*8]
inc edx
shl eax, cl
inc rdi
or esi, eax
cmp edx, 4
jb 0x140003140
mov eax, esi
mov ecx, r9d
shl rax, cl
mov qword [0x140008948], rax
mov rcx, qword [0x140008948]
test rcx, rcx
je 0x14000346b
mov rdx, qword [0x140008f78]
test rdx, rdx
je 0x140003196
mov rax, qword [0x140008940]
add rcx, rax
cmp rcx, rdx
jg 0x14000346b
lea rcx, str.Using_partition__i._n
mov edx, ebp
call qword [sym.imp.msvcrt.dll_printf]
mov rbx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
xor r13d, r13d
lea rsi, [0x140000000]
jmp 0x14000349c
mov esi, r10d
mov edx, r10d
lea rdi, [rsp + rcx + 0x476]
nop dword [rax]
movzx eax, byte [rdi]
lea ecx, [rdx*8]
inc edx
shl eax, cl
inc rdi
or esi, eax
cmp edx, 4
jb 0x1400031d0
movzx ecx, byte [0x140008f70]
mov r12d, esi
shl r12, cl
mov rax, r12
mov qword [0x140008940], rax
nop
lea rcx, str.Reading_extended_partition_table_at__I64i._n
mov rdx, rax
call qword [sym.imp.msvcrt.dll_printf]
cmp byte [0x140008915], 0
mov rdi, qword [0x140008940]
je 0x14000323c
lea rcx, [rsp + 0xb0]
mov r8, rdi
mov edx, 0x200
call fcn.1400015e0
mov edx, eax
jmp 0x1400032c4
cmp byte [0x140008914], 0
je 0x140003267
mov rcx, qword [0x140008908]
lea rdx, [rsp + 0xb0]
mov r9, rdi
mov r8d, 0x200
call qword [0x140008f80]
mov edx, eax
jmp 0x1400032c4
mov esi, dword [0x140008320]
xor r8d, r8d
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.msvcrt.dll__lseeki64]
cmp rax, rdi
je 0x140003285
or edx, 0xffffffff
jmp 0x1400032c4
lea rdx, [rsp + 0xb0]
mov r8d, 0x200
mov ecx, esi
call qword [sym.imp.msvcrt.dll__read]
movsxd rdx, eax
cmp edx, 0x1ff
ja 0x1400032c4
mov eax, 0x200
lea rcx, [rsp + rdx + 0xb0]
sub eax, edx
xor edx, edx
movsxd r8, eax
call sub.msvcrt.dll_memset
mov edx, 0x200
cmp edx, 0x200
jne 0x140003449
cmp byte [rsp + 0x2ae], 0x55
jne 0x140003449
cmp byte [rsp + 0x2af], 0xaa
jne 0x140003449
test byte [rsp + 0x26e], 0x7f
jne 0x140003449
test byte [rsp + 0x27e], 0x7f
jne 0x140003449
test byte [rsp + 0x28e], 0x7f
jne 0x140003449
test byte [rsp + 0x29e], 0x7f
jne 0x140003449
lea rcx, str.Found_valid_extended_partition_table.
call qword [sym.imp.msvcrt.dll_puts]
xor r10d, r10d
mov edx, r10d
nop word [rax + rax]
mov eax, edx
shl eax, 4
cdqe
movzx ecx, byte [rsp + rax + 0x272]
test cl, cl
je 0x140003363
cmp cl, 5
je 0x14000336f
cmp cl, 0xf
je 0x14000336f
inc ebx
cmp ebx, ebp
je 0x1400033c3
inc edx
cmp edx, 4
jl 0x140003340
jmp 0x140003459
shl edx, 4
mov esi, r10d
mov edi, r10d
movsxd rax, edx
lea rdx, [rsp + rax + 0x276]
nop word [rax + rax]
movzx eax, byte [rdx]
lea ecx, [rdi*8]
inc edi
shl eax, cl
inc rdx
or esi, eax
cmp edi, 4
jb 0x140003390
movzx ecx, byte [0x140008f70]
mov eax, esi
shl rax, cl
add rax, r12
mov qword [0x140008940], rax
jmp 0x140003200
shl edx, 4
mov esi, r10d
mov edi, r10d
movsxd r8, edx
lea rdx, [rsp + r8 + 0x276]
nop word [rax + rax]
movzx eax, byte [rdx]
lea ecx, [rdi*8]
inc edi
shl eax, cl
inc rdx
or esi, eax
cmp edi, 4
jb 0x1400033e0
movsx r9d, word [0x140008f70]
mov eax, esi
mov edx, r10d
mov ecx, r9d
mov esi, r10d
lea rdi, [rsp + r8 + 0x27a]
shl rax, cl
add qword [0x140008940], rax
nop dword [rax]
movzx eax, byte [rdi]
lea ecx, [rdx*8]
inc edx
shl eax, cl
inc rdi
or esi, eax
cmp edx, 4
jb 0x140003420
mov eax, esi
mov ecx, r9d
shl rax, cl
mov qword [0x140008948], rax
jmp 0x140003459
lea rcx, str.Invalid_extended_partition_table.
call qword [sym.imp.msvcrt.dll_puts]
xor r10d, r10d
inc r13d
cmp r13d, 4
jl 0x1400030b6
jmp 0x140003167
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.Partition__i_not_found._n
mov r8d, ebp
add rcx, 0x60
call section..text
mov eax, 1
jmp 0x14000280f
lea rcx, str.No_master_boot_record_detected._Using_entire_image.
call qword [sym.imp.msvcrt.dll_puts]
cmp qword [0x140008940], 0
jne 0x140003628
cmp r15d, 4
jle 0x14000366e
mov rcx, qword [r14 + 0x20]
lea r9, [rsp + 0x690]
lea r8, [rsp + 0x6a0]
lea rdx, str._I64i_c
mov qword [rsp + 0x6a0], r13
mov byte [rsp + 0x690], 0
call qword [sym.imp.msvcrt.dll_sscanf]
cmp eax, 2
jne 0x14000360f
movsx r8d, byte [rsp + 0x690]
lea eax, [r8 - 0x42]
cmp eax, 0x32
ja case.0x140003518.75
cdqe
movzx eax, byte [rsi + rax + 0x3914]
mov ecx, dword [rsi + rax*4 + 0x38ec]
add rcx, rsi
jmp rcx
mov rax, qword [rsp + 0x6a0]
shl rax, 0xa
shl rax, 0xa
shl rax, 0xa
shl rax, 0xa
jmp 0x14000361b
mov rax, qword [rsp + 0x6a0]
shl rax, 0xa
shl rax, 0xa
shl rax, 0xa
jmp 0x14000361b
mov rax, qword [rsp + 0x6a0]
shl rax, 0xa
shl rax, 0xa
jmp 0x14000361b
mov rax, qword [rsp + 0x6a0]
shl rax, 0xa
jmp 0x14000361b
mov rax, qword [rsp + 0x6a0]
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
jmp 0x14000361b
mov rax, qword [rsp + 0x6a0]
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
jmp 0x14000361b
mov rax, qword [rsp + 0x6a0]
imul rax, rax, 0x3e8
imul rax, rax, 0x3e8
jmp 0x14000361b
mov rax, qword [rsp + 0x6a0]
imul rax, rax, 0x3e8
jmp 0x14000361b
mov rax, qword [rsp + 0x6a0]
jmp 0x14000361b
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.Unsupported_size_suffix:__c_n
add rcx, 0x60
call section..text
mov rax, qword [rsp + 0x6a0]
jmp 0x14000361b
mov rax, qword [rsp + 0x6a0]
shl rax, 9
mov qword [0x140008940], rax
dec r15d
mov r14, rbx
cmp r15d, 4
jle 0x14000366e
mov rcx, qword [r14 + 0x20]
lea r8, [0x140008950]
lea rdx, str._I64u
call qword [sym.imp.msvcrt.dll_sscanf]
cmp eax, 1
je 0x140003679
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov r8, qword [r14 + 0x20]
lea rdx, str.Invalid_alignment_specification:__s_n
add rcx, 0x60
call section..text
or eax, 0xffffffff
jmp 0x14000280f
mov qword [0x140008950], 1
cmp r15d, 5
jle 0x1400037e8
mov rcx, qword [r14 + 0x28]
lea r9, [rsp + 0x690]
lea r8, [0x140008324]
lea rdx, str._u_c
mov byte [rsp + 0x690], 0
call qword [sym.imp.msvcrt.dll_sscanf]
cmp eax, 2
jne 0x1400037e0
movsx r8d, byte [rsp + 0x690]
lea eax, [r8 - 0x42]
cmp eax, 0x32
ja case.0x1400036de.75
cdqe
movzx eax, byte [rsi + rax + 0x3970]
mov ecx, dword [rsi + rax*4 + 0x3948]
add rcx, rsi
jmp rcx
mov eax, dword [0x140008324]
shl eax, 0xa
shl eax, 0xa
shl eax, 0xa
shl eax, 0xa
mov dword [0x140008324], eax
jmp 0x1400037ee
mov eax, dword [0x140008324]
shl eax, 0xa
shl eax, 0xa
shl eax, 0xa
mov dword [0x140008324], eax
jmp 0x1400037ee
mov eax, dword [0x140008324]
shl eax, 0xa
shl eax, 0xa
mov dword [0x140008324], eax
jmp 0x1400037ee
mov eax, dword [0x140008324]
shl eax, 0xa
mov dword [0x140008324], eax
jmp 0x1400037ee
mov eax, dword [0x140008324]
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [0x140008324], eax
jmp 0x1400037ee
mov eax, dword [0x140008324]
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [0x140008324], eax
jmp 0x1400037ee
mov eax, dword [0x140008324]
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [0x140008324], eax
jmp 0x1400037ee
mov eax, dword [0x140008324]
imul eax, eax, 0x3e8
mov dword [0x140008324], eax
jmp 0x1400037ee
mov eax, dword [0x140008324]
jmp 0x1400037ee
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.Unsupported_size_suffix:__c_n
add rcx, 0x60
call section..text
mov eax, dword [0x140008324]
jmp 0x1400037ee
mov eax, dword [0x140008324]
jmp 0x1400037ee
mov eax, dword [0x140008324]
mov r9, qword [0x140008940]
mov r8, qword [0x140008948]
mov rdx, qword [0x140008f78]
mov dword [rsp + 0x28], eax
mov rax, qword [0x140008950]
lea rcx, str.Total_size:__I64i_bytes._Using__I64u_bytes_from_offset__I64i._nRequired_alignment:__I64u_bytes._nBuffer_size:__u_bytes._n
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_printf]
mov rcx, r12
call fcn.140003dc0
cmp byte [0x140008914], 0
mov edi, eax
je 0x140003842
mov rcx, qword [0x140008908]
call qword [0x140008f90]
jmp 0x14000384e
mov ecx, dword [0x140008320]
call qword [sym.imp.msvcrt.dll__close]
lea rcx, str.Image_close_result:__i_n
mov edx, eax
call qword [sym.imp.msvcrt.dll_printf]
mov eax, edi
jmp 0x14000280f
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, str.devio___Device_I_O_Service_ver_3.05_nWith_support_for_Microsoft_VHD_format__custom_DLL_files_and_shared_memory_proxy_noperation._nCopyright__C__2005_2018_Olof_Lagerkvist._n_nUsage:_ndevio___r__tcp_portcommdev_diskdev__blocks___offset___alignm___buffersize__ndevio___r__tcp_portcommdev_diskdev__partitionnumber___alignm___buffersize__n_ntcp_port_can_be_any_free_tcp_port_where_this_service_should_listen_for_incoming_nclient_connections._n_ncommdev_is_a_path_to_a_communications_port__named_pipe_or_similar_where_this_nservice_should_listen_for_incoming_client_connections._n_ncommdev_can_also_start_with_shm:_followed_by_an_section_object_name_for_using_nshared_memory_communication._n_nDefault_number_of_blocks_is_0._When_running_on_Windows_the_program_will_try_to_nget_the_size_of_the_image_file_or_partition_automatically__otherwise_the_client_nmust_know_the_exact_size_without_help_from_this_service._n_nDefault_number_of_blocks_for_dynamically_expanding_VHD_image_files_are_read_nautomatically_from_VHD_header_structure_within_image_file._n_nDefault_alignment_is__u_bytes._nDefault_buffer_size_is__i_bytes._n_nFor_syntax_help_with_custom_I_O_DLL_under_Windows__type:_ndevio___dll_n
mov r9d, 0x4000000
add rcx, 0x60
mov r8d, 1
call qword [sym.imp.msvcrt.dll_fprintf]
or eax, 0xffffffff
jmp 0x140002817