Function at 0x402b70
Capabilities:
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2f4
mov eax, dword [0x452004]
xor eax, esp
mov dword [esp + 0x2f0], eax
push ebx
push esi
push edi
push 0x80
lea eax, [esp + 0x174]
mov dword [esp + 0x1c], edx
xorps xmm0, xmm0
mov bl, cl
push 0
push eax
movlpd qword [esp + 0x1c], xmm0
call fcn.00423b10
add esp, 0xc
lea eax, [esp + 0xf0]
push 0x80
push 0
push eax
call fcn.00423b10
add esp, 0xc
movsx eax, bl
mov dword [esp + 0x1c], eax
push eax
push str.._C:
lea eax, [esp + 0x78]
push 0x80
push eax
call fcn.00401100
add esp, 0x10
lea eax, [esp + 0x70]
push 0
push 0
push 3
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402c27
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x74]
push eax
push str.CreateFileA__s_failed__u_n
push 1
call fcn.00401a20
add esp, 0x10
jmp 0x402e90
push 0
lea eax, [esp + 0x24]
push eax
push 0x20
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0x560000
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x402e73
cmp dword [esp + 0x30], 0
je 0x402e73
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
test eax, eax
js 0x402e93
cmp ecx, 0x100000
jne 0x402e60
test edx, edx
jne 0x402e60
lea ecx, [esp + 0xf0]
push ecx
lea ecx, [esp + 0x174]
push ecx
lea edx, [esp + 0x18]
mov ecx, eax
call fcn.00402350
add esp, 8
test eax, eax
je 0x402cc5
push str.GetPhyDriveInfo_failed_n
push 1
call fcn.00401a20
add esp, 8
jmp 0x402eab
mov edi, dword [esp + 0x14]
mov esi, 1
mov ebx, dword [esp + 0x10]
mov edx, edi
mov ecx, ebx
call fcn.004427e0
movaps xmm2, xmm0
mov eax, ebx
movsd xmm0, qword [0x44f7d0]
and eax, 0x3fffffff
or eax, 0
divsd xmm2, xmm0
divsd xmm2, xmm0
divsd xmm2, xmm0
jne 0x402d04
shrd ebx, edi, 0x1e
jmp 0x402d4f
movsd xmm3, qword [0x44f7c0]
xor eax, eax
nop
movd xmm1, esi
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm2
jbe 0x402d27
movaps xmm0, xmm1
subsd xmm0, xmm2
jmp 0x402d2e
movaps xmm0, xmm2
subsd xmm0, xmm1
divsd xmm0, xmm1
comisd xmm3, xmm0
ja 0x402d4a
inc eax
add esi, esi
cmp eax, 0xc
jl 0x402d10
movaps xmm0, xmm2
call fcn.00442680
jmp 0x402d4d
mov eax, esi
cdq
mov ebx, eax
push ebx
mov ebx, dword [esp + 0x1c]
push str._dGB
push 0x40
lea eax, [ebx + 0x84]
push eax
call fcn.00401100
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 0x184]
push eax
push 0x44a8b0
lea eax, [ebx + 0xc4]
push pe_nt_image_headers32
push eax
call fcn.00401100
add esp, 0x24
lea eax, [esp + 0x50]
push dword [esp + 0x1c]
push str._C:_
push 0x20
push eax
call fcn.00401100
add esp, 0x10
lea eax, [esp + 0x1f0]
push 0x104
push eax
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0
push 0
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x402dec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetVolumeInformationA_failed__u_n
push 1
call fcn.00401a20
add esp, 0xc
jmp 0x402eab
lea eax, [esp + 0x1f0]
push str.NTFS
push eax
call fcn.00427c70
add esp, 8
test eax, eax
jne 0x402e0c
mov dword [ebx + 0x40], 1
lea eax, [esp + 0x1f0]
push eax
lea eax, [ebx + 0x44]
push 0x40
push eax
call fcn.00427bdd
mov ecx, dword [esp + 0x44]
add esp, 0xc
mov edx, ebx
call fcn.00402850
test eax, eax
je 0x402e49
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetVentoyVersion_failed__u_n
push 1
call fcn.00401a20
add esp, 0xc
jmp 0x402eab
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2f0]
xor ecx, esp
call fcn.00422702
mov esp, ebp
pop ebp
ret
push edx
push ecx
push str.Partition_offset_is_NOT_1MB._This_is_NOT_ventoy_image_partition___llu__n
push 1
call fcn.00401a20
add esp, 0x10
jmp 0x402eab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTSfailed__u_n
push 1
call fcn.00401a20
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
push str.GetPhyDriveByLogicalDrive_failed__d__llu_n
push 1
call fcn.00401a20
add esp, 0x14
mov ecx, dword [esp + 0x2fc]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00422702
mov esp, ebp
pop ebp
ret