Function at 0x1006fa0
Capabilities:
Check if file exists
Get disk size
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
test edi, edi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
jne 0x1007022
mov edi, dword [ebp + 8]
push 0xc0000000
push edi
call sub.imdisk.cpl__ImDiskOpenDeviceByNumber_8
mov esi, eax
cmp esi, 0xffffffff
jne 0x1007205
push 0x80000000
push edi
call sub.imdisk.cpl__ImDiskOpenDeviceByNumber_8
mov esi, eax
cmp esi, 0xffffffff
jne 0x1007205
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10071ee
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
push 0x1004544
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 8
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1007027
sub eax, edx
sar eax, 1
cmp eax, 2
jne 0x1007047
xor eax, eax
cmp word [edi + 2], 0x3a
sete al
jmp 0x10070a4
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1007050
sub eax, edx
sar eax, 1
cmp eax, 3
jne 0x100711a
mov ecx, 0x1003f64
lea eax, [edi + 2]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1007096
test dx, dx
je 0x1007092
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1007096
add eax, 4
add ecx, 4
test dx, dx
jne 0x1007070
xor eax, eax
jmp 0x100709b
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
je 0x100711a
mov ecx, dword [0x100453c]
mov edx, dword [0x1004534]
mov eax, dword [0x1004538]
push 0
push 0x20000000
push 3
push 0
push 3
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], edx
mov dx, word [0x1004540]
mov dword [ebp - 0x1c], eax
mov ax, word [edi]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0xc0000000
lea ecx, [ebp - 0x20]
push ecx
mov word [ebp - 0x14], dx
mov word [ebp - 0x18], ax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x1007205
push 0
push 0x20000000
push 3
push 0
push 3
push 0x80000000
lea edx, [ebp - 0x20]
push edx
call edi
jmp 0x1006fe4
push 0xc0000000
push edi
call sub.imdisk.cpl__ImDiskOpenDeviceByMountPoint_8
mov esi, eax
cmp esi, 0xffffffff
jne 0x1007205
push 0x80000000
push edi
call sub.imdisk.cpl__ImDiskOpenDeviceByMountPoint_8
mov esi, eax
cmp esi, 0xffffffff
jne 0x1007205
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
ja 0x10071a8
je 0x10071c9
sub eax, 1
je 0x1007183
sub eax, 0x56
jne 0x10071b6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
push 0x1003e38
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 8
pop edi
mov eax, 9
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x40
push ecx
push 0x1003da4
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 8
pop edi
mov eax, 9
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x10b
je 0x10071c9
cmp eax, 0x1126
je 0x10071c9
push edi
call fcn.01005400
pop edi
mov eax, 9
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [sym.imp.msvcrt.dll__iob]
push edi
add edx, 0x40
push 0x10044f8
push edx
call fcn.01005380
add esp, 0xc
pop edi
mov eax, 9
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x1003bd4
call fcn.01005400
pop edi
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret 0x10
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_puts]
push 0x1004884
call ebx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
add esp, 4
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0
push 0x10
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x30]
push ecx
push 0x7c0d0
push esi
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], edx
call edi
test eax, eax
jne 0x1007269
mov edx, dword [ebp + 0xc]
push edx
call fcn.01005400
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 3
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x1004864
call ebx
add esp, 4
push 0
lea eax, [ebp + 8]
push eax
push 8
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0x7405c
push esi
call edi
test eax, eax
je 0x10072ab
push 0
lea eax, [ebp + 8]
push eax
push 0x18
lea ecx, [ebp - 0x48]
push ecx
push 0
push 0
push 0x70000
push esi
call edi
test eax, eax
jne 0x10072e1
mov edi, dword [ebp + 0xc]
push edi
call fcn.01005400
mov edx, dword [sym.imp.msvcrt.dll__iob]
push edi
add edx, 0x40
push 0x10044c8
push edx
call fcn.01005380
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
push 0
push eax
push ecx
push edx
call fcn.01008a30
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
push eax
push 0
push 0
push 8
lea ecx, [ebp - 0x10]
push ecx
push 0x900f0
push esi
mov dword [ebp - 0xc], edx
call edi
test eax, eax
jne 0x1007329
mov edx, dword [ebp + 0xc]
push edx
call fcn.01005400
push 0x10047b8
call ebx
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp eax, 0x100
mov ecx, dword [ebp - 8]
jb 0x100734a
ja 0x1007343
test ecx, ecx
jb 0x100734a
mov edx, 0x10046bc
jmp 0x10073b9
test eax, eax
ja 0x1007356
cmp ecx, 0x40000000
jb 0x100735d
mov edx, 0x10046b8
jmp 0x10073b9
test eax, eax
ja 0x1007369
cmp ecx, 0x100000
jb 0x1007370
mov edx, 0x10046b4
jmp 0x10073b9
test eax, eax
ja 0x100737c
cmp ecx, 0x400
jb 0x1007383
mov edx, 0x10046b0
jmp 0x10073b9
cmp ecx, 1
jne 0x10073b4
test eax, eax
jne 0x10073b4
mov edx, 0x10046a8
fild qword [ebp - 8]
push edx
sub esp, 8
fstp qword [esp]
push 0x10047a0
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0x10
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edx, 0x10046a0
cmp eax, 0x100
jb 0x10073d1
ja 0x10073c6
test ecx, ecx
jb 0x10073d1
fild qword [ebp - 8]
fmul qword [0x1004698]
jmp 0x1007394
test eax, eax
ja 0x10073dd
cmp ecx, 0x40000000
jb 0x10073e8
fild qword [ebp - 8]
fmul qword [0x1004690]
jmp 0x1007394
test eax, eax
ja 0x10073f4
cmp ecx, 0x100000
jb 0x10073ff
fild qword [ebp - 8]
fmul qword [0x1004688]
jmp 0x1007394
test eax, eax
ja 0x100740b
cmp ecx, 0x400
jb 0x1007391
fild qword [ebp - 8]
fmul qword [0x1004680]
jmp 0x1007394