Function at 0x43d3c5
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [0x4dca18]
xor ebx, ebx
push edi
xorps xmm0, xmm0
mov dword [ebp - 0xc], esi
mov al, bl
movlpd qword [ebp - 0x18], xmm0
push str.Disk_image_analysis:
mov edi, ebx
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 4], eax
call fcn.0042ed57
sub esp, 0xc
xor eax, eax
inc eax
mov edx, SHChangeNotifyRegister
mov ecx, esi
push eax
call fcn.0043cc79
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
jne 0x43d427
push dword [ebp - 0xc]
push str.__Could_not_open_image__s
call fcn.0042ed57
pop ecx
jmp 0x43d62f
mov ecx, dword [ebp - 0xc]
call fcn.0043d2e1
test eax, eax
setne al
mov dword [ebp - 4], eax
cmp byte [0x5228c1], bl
jne 0x43d469
push ebx
mov edx, str.__Image
mov ecx, esi
call fcn.00405848
cmp dword [0x4dca88], ebx
pop ecx
sete cl
dec cl
and cl, 2
test eax, eax
push 1
movzx ecx, cl
pop eax
cmovne ecx, eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x43d485
call fcn.0042fc51
push eax
push str.__Could_not_get_image_size:__s
jmp 0x43d41c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push ebx
push ebx
push dword [ebp - 0x24]
mov dword [0x522880], eax
push dword [ebp - 0x28]
mov dword [0x522884], ecx
push esi
mov dword [ebp - 8], 8
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43d4df
cmp dword [ebp - 0x18], 0x4957534d
jne 0x43d4df
cmp dword [ebp - 0x14], 0x4d
jne 0x43d4df
xor eax, eax
inc eax
mov byte [0x5228a7], al
jmp 0x43d630
mov eax, 0x200
mov byte [0x5228a7], bl
mov dword [ebp - 8], eax
cmp byte [0x5228c1], bl
jne 0x43d630
cmp dword [0x522884], ebx
ja 0x43d511
cmp dword [0x522880], 0x400
jb 0x43d630
push eax
call fcn.004812e1
mov edi, eax
mov eax, dword [0x522880]
sub eax, dword [ebp - 8]
pop ecx
mov ecx, dword [0x522884]
sbb ecx, ebx
test edi, edi
je 0x43d625
push ebx
push ebx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x43d625
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43d625
cmp dword [ebp - 8], 0x200
jne 0x43d625
push 8
push str.conectix
push edi
call fcn.00477534
add esp, 0xc
test eax, eax
jne 0x43d630
add dword [0x522880], 0xfffffe00
adc dword [0x522884], 0xffffffff
mov eax, dword [edi + 0xc]
bswap eax
cmp eax, 0x10000
jne 0x43d618
mov eax, dword [edi + 0x3c]
bswap eax
cmp eax, 2
jne 0x43d618
mov eax, dword [edi + 0x40]
xorps xmm2, xmm2
bswap eax
mov dword [edi + 0x40], ebx
movd xmm1, dword [edi + ebx]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
add ebx, 4
punpcklwd xmm1, xmm0
paddd xmm2, xmm1
cmp ebx, 0x200
jb 0x43d5b4
movaps xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
paddd xmm2, xmm0
movd ecx, xmm2
not ecx
cmp ecx, eax
je 0x43d604
push ecx
push eax
push str.__Warning:_VHD_footer_seems_corrupted__checksum:__04X__expected:__04X_
call fcn.0042ed57
add esp, 0xc
push str.__Image_is_a_Fixed_Hard_Disk_VHD_file
call fcn.0042ed57
xor eax, eax
inc eax
mov byte [0x5228a6], al
jmp 0x43d62f
push str.__Unsupported_type_of_VHD_image
call fcn.0042ed57
pop ecx
jmp 0x43d633
push str.__Could_not_read_VHD_footer
call fcn.0042ed57
pop ecx
mov ebx, dword [ebp - 4]
push edi
call fcn.004812c6
pop ecx
cmp esi, 0xffffffff
je 0x43d64a
test esi, esi
je 0x43d64a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret