Function at 0x4cca50
Capabilities:
Get disk information
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fe165
mov eax, dword fs:[0]
push eax
mov eax, 0x1a6c
call fcn.005ddc60
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a40], ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1a44], edi
mov dword [ebp - 0x1a5c], 0
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x4ccf32
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1a4c], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x1a4c]
push edi
push str..PhysicalDrive_d
push eax
call fcn.0040d300
mov esi, dword [ebp - 0x1a4c]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push 0x6576a0
mov dword [ebp - 0x1a3c], eax
call fcn.004131f0
or ebx, 0xffffffff
add esp, 8
cmp dword [ebp - 0x1a3c], ebx
je 0x4cced7
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.00588800
add esp, 0xc
mov dword [ebp - 0x1a54], 0
lea eax, [ebp - 0x1a54]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1a3c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ccecb
cmp dword [ebp - 0x1a54], 0x1000
jne 0x4ccecb
cmp byte [ebp - 0xe12], 0x55
jne 0x4ccecb
cmp byte [ebp - 0xe11], 0xaa
jne 0x4ccecb
mov esi, dword [ebp - 0x1a40]
lea ebx, [ebp - 0xe4e]
xor ecx, ecx
mov dword [ebp - 0x1a5c], 1
mov dword [ebp - 0x1a58], ecx
mov dword [ebp - 0x1a48], ebx
nop word [eax + eax]
mov al, byte [ebx]
test al, al
je 0x4cceb2
cmp dword [ebx + 8], 0
je 0x4ccec2
cmp al, 0xee
jne 0x4ccbef
push str.Found_GPT_Partiton_n
call fcn.004131f0
add esp, 4
mov ecx, esi
push edi
push dword [ebp - 0x1a3c]
call fcn.004cd520
mov dword [esi + 0xc], 2
jmp 0x4ccea3
cmp al, 5
je 0x4ccf17
cmp al, 0xf
je 0x4ccf17
push 0x48
mov dword [esi + 0xc], 1
call fcn.00560437
add esp, 4
mov dword [ebp - 0x1a78], eax
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004cc500
mov edi, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x1a74], edi
test edi, edi
je 0x4cce9d
mov eax, dword [ebp - 0x1a44]
xor ecx, ecx
mov dword [edi], eax
cmp byte [ebx - 4], 0x80
push 0
sete cl
mov dword [edi + 8], ecx
movzx eax, byte [ebx]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 1
mov eax, dword [ebx + 8]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0
mov eax, dword [ebx + 4]
push eax
push dword [ebp - 0x1a3c]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0
call fcn.004cd370
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], 0
mov al, byte [ebx]
cmp al, 0x1b
je 0x4cccaa
cmp al, 0x1c
je 0x4cccaa
cmp al, 0x17
je 0x4cccaa
cmp al, 0x11
je 0x4cccaa
cmp al, 0x14
je 0x4cccaa
cmp al, 0x16
je 0x4cccaa
cmp al, 0x1e
je 0x4cccaa
xor al, al
jmp 0x4cccac
mov al, 1
mov byte [edi + 0xc], al
cmp byte [ebx], 0xaf
sete al
mov byte [edi + 0xd], al
lea eax, [ebp - 0x1a68]
push dword [edi + 0x24]
push dword [edi + 0x20]
push dword [ebp - 0x1a44]
push eax
call fcn.004cdaf0
mov byte [ebp - 4], 3
mov eax, dword [eax]
mov ecx, dword [edi + 0x40]
mov dword [ebp - 0x1a50], eax
sub ecx, 0x10
add eax, 0xfffffff0
mov dword [ebp - 0x1a64], ecx
mov dword [ebp - 0x1a40], eax
cmp eax, ecx
je 0x4ccd61
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x1a60], eax
jl 0x4ccd4f
mov eax, dword [ebp - 0x1a40]
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x4ccd4f
mov ecx, dword [ebp - 0x1a40]
call fcn.0040c950
mov edx, dword [ebp - 0x1a60]
or ecx, 0xffffffff
mov dword [ebp - 0x1a40], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4ccd47
mov eax, dword [ebp - 0x1a64]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1a40]
add eax, 0x10
mov dword [edi + 0x40], eax
jmp 0x4ccd61
mov eax, dword [ebp - 0x1a50]
lea ecx, [edi + 0x40]
push dword [eax - 0xc]
push eax
call fcn.0040c9d0
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x1a68]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ccd83
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0x514
lea eax, [ebp - 0x1a38]
push eax
push dword [edi + 0x40]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x4ccdac
cmp word [ebp - 0x1a38], 0
je 0x4ccdac
mov byte [edi + 0xd], 0
mov eax, dword [edi + 0x40]
cmp dword [eax - 0xc], 0
je 0x4cce49
push eax
lea eax, [ebp - 0x1a6c]
push eax
call fcn.004cdf80
mov byte [ebp - 4], 5
mov edx, dword [eax]
mov ebx, dword [edi + 0x38]
sub ebx, 0x10
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x4cce21
cmp dword [ebx + 0xc], 0
jl 0x4cce15
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x4cce15
call fcn.0040c950
mov dword [ebp - 0x1a50], eax
lea edx, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4cce0d
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1a50]
add eax, 0x10
mov dword [edi + 0x38], eax
jmp 0x4cce21
push dword [edx - 0xc]
lea ecx, [edi + 0x38]
push edx
call fcn.0040c9d0
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x1a6c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4cce43
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x1a48]
lea eax, [ebp - 0x1a70]
mov ecx, edi
push eax
call fcn.004cc620
mov byte [ebp - 4], 7
push dword [edi + 0x10]
push dword [eax]
push str.Find_Partition_size_s_type_x_n
call fcn.004131f0
add esp, 0xc
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x1a70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4cce8f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1a74]
mov ecx, esi
push eax
call fcn.004ce920
mov edi, dword [ebp - 0x1a44]
mov ecx, dword [ebp - 0x1a58]
add ebx, 0x10
mov dword [ebp - 0x1a48], ebx
inc ecx
mov dword [ebp - 0x1a58], ecx
cmp ecx, 4
jl 0x4ccbb0
mov esi, dword [ebp - 0x1a4c]
or ebx, 0xffffffff
push dword [ebp - 0x1a3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4ccef3
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1a5c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 4
push edi
sub esp, 8
mov ecx, esi
push 0
push dword [ebx + 4]
push dword [ebp - 0x1a3c]
call fcn.004ccf40
jmp 0x4ccea3
push 0x80004005
call fcn.0040b250
int3