Function at 0x4098b0
Capabilities:
Get disk information
Get disk size
Read file on windows

Disassembly:
mov eax, 0x2394
call fcn.0046be90
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x2390], eax
mov eax, dword [esp + 0x23ac]
push ebx
mov ebx, dword [esp + 0x23ac]
push ebp
mov ebp, dword [esp + 0x23a0]
push esi
mov esi, dword [esp + 0x23a8]
mov cl, 0x5c
push edi
mov dword [esp + 0x14], eax
mov al, byte [esi]
push 0x254
mov byte [esp + 0x29c], cl
mov byte [esp + 0x29d], cl
mov byte [esp + 0x29f], cl
mov byte [esp + 0x16], cl
add al, 0x41
mov dl, 0x3a
lea ecx, [esp + 0x48]
push 0
push ecx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x2a6], 0x2e
mov byte [esp + 0x2a8], al
mov byte [esp + 0x2a9], dl
mov byte [esp + 0x2aa], 0
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1f], 0
call fcn.0046bf90
mov edx, dword [esi]
add esp, 0xc
push 0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [0x4b511c]
push 0x254
lea ecx, [esp + 0x50]
push ecx
push 0x254
mov dword [esp + 0x58], edx
mov edx, ecx
push edx
push 0x22201c
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x409c99
cmp dword [esp + 0x18], 0
je 0x409c99
cmp dword [esp + 0x294], 2
jge 0x4099b1
push str.ERR_VOL_FORMAT_BAD
call fcn.00433d70
add esp, 4
xor eax, eax
jmp 0x409cbb
cmp dword [esp + 0x26c], 0
je 0x4099cf
push str.ERR_HIDDEN_NOT_NORMAL_VOLUME
call fcn.00433d70
add esp, 4
xor eax, eax
jmp 0x409cbb
test byte [esp + 0x27c], 3
jne 0x409c88
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
lea ecx, [esp + 0x2b0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x409a24
mov edx, dword [0x4dce70]
push 0x10
push edx
push str.CANT_ACCESS_OUTER_VOL
call fcn.0044c960
add esp, 4
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x409cac
xor ecx, ecx
push ecx
lea edx, [esp + 0x40]
push edx
push ecx
xor eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x409a50
push ebp
call fcn.00434ad0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409cac
push 0
lea eax, [esp + 0x3c]
push eax
push 0x1000
lea ecx, [esp + 0x3ac]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409aa2
push ebp
call fcn.00434ad0
mov edx, dword [0x4dce70]
add esp, 4
push 0x10
push edx
push str.CANT_ACCESS_OUTER_VOL
call fcn.0044c960
add esp, 4
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409cac
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
lea eax, [esp + 0x2a4]
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 3
lea edx, [esp + 0x2a4]
push 0x4903e0
push edx
call fcn.0046c19e
add esp, 0xc
test eax, eax
je 0x409c3b
mov al, 0x46
mov cl, 0x54
cmp byte [esp + 0x3d6], al
jne 0x409b0e
cmp byte [esp + 0x3d7], 0x41
jne 0x409b0e
cmp byte [esp + 0x3d8], cl
je 0x409c3b
cmp byte [esp + 0x3f2], al
jne 0x409b2e
cmp byte [esp + 0x3f3], 0x41
jne 0x409b2e
cmp byte [esp + 0x3f4], cl
je 0x409c3b
push 4
lea eax, [esp + 0x2a4]
push 0x48f890
push eax
call fcn.0046c19e
add esp, 0xc
test eax, eax
jne 0x409c18
cmp dword [0x4dce8c], 7
jne 0x409b6a
push str.HIDDEN_VOL_HOST_UNSUPPORTED_FILESYS_WIN2000
call fcn.00433d70
add esp, 4
xor eax, eax
jmp 0x409cbb
mov ecx, dword [0x4b9450]
mov ebx, dword [esp + 0x23b4]
test ecx, ecx
je 0x409bbe
mov edx, dword [esp + 0x23b0]
push ebx
push edx
push 0
call fcn.00448870
add esp, 0xc
mov dword [esp + 0x2c], eax
mov edi, edx
call fcn.00407eb0
push 1
cdq
push 0
push edx
push eax
call fcn.0046bca0
cmp edi, edx
ja 0x409bbe
jb 0x409bb1
cmp dword [esp + 0x2c], eax
ja 0x409bbe
push str.HIDDEN_VOL_HOST_NTFS
call fcn.00433ce0
add esp, 4
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x409bf6
push ebp
call fcn.00434ad0
push str.CANT_GET_OUTER_VOL_INFO
call fcn.00433d70
jmp 0x409cb5
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov dword [edx], eax
push ecx
cdq
push edx
mov edx, dword [esp + 0x23b8]
push eax
push ebx
push edx
jmp 0x409c75
cmp dword [0x4dce8c], 7
mov eax, str.HIDDEN_VOL_HOST_UNSUPPORTED_FILESYS_WIN2000
je 0x409c2b
mov eax, str.HIDDEN_VOL_HOST_UNSUPPORTED_FILESYS
push eax
call fcn.00433d70
add esp, 4
xor eax, eax
jmp 0x409cbb
movzx eax, byte [esp + 0x3ac]
movzx ecx, byte [esp + 0x3ab]
movzx edx, byte [esp + 0x3ad]
shl eax, 8
add eax, ecx
mov ecx, dword [esp + 0x14]
imul eax, edx
mov dword [ebx], eax
cdq
push ecx
push edx
mov edx, dword [esp + 0x23bc]
push eax
mov eax, dword [esp + 0x23bc]
push edx
push eax
call fcn.0046bbf0
push edx
push eax
push esi
push ebp
call fcn.00407c60
add esp, 0x14
jmp 0x409cbb
push str.ERR_HIDDEN_VOL_HOST_ENCRYPTED_INPLACE
call fcn.00433d10
add esp, 4
xor eax, eax
jmp 0x409cbb
push ebp
call fcn.00434ad0
push str.CANT_ACCESS_OUTER_VOL
call fcn.00433d70
add esp, 8
mov ecx, dword [esi]
push ecx
push ebp
call fcn.00431fa0
add esp, 8
or eax, 0xffffffff
mov ecx, dword [esp + 0x23a0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046be7b
add esp, 0x2394
ret