Function at 0x533ee0
Capabilities:
Get disk information
Get disk size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x494
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6527dc], 0
xorps xmm0, xmm0
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x494], ecx
mov dword [ebp - 0x490], esi
movups xmmword [ebp - 0x47c], xmm0
mov dword [ebp - 0x45c], 0
movups xmmword [ebp - 0x46c], xmm0
je 0x533f47
mov eax, dword [0x6527d8]
test eax, eax
je 0x533f5a
push 0x105
lea edx, [ebp - 0x210]
push edx
push ecx
call eax
test eax, eax
jne 0x533f81
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x105
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x533f47
xor eax, eax
mov word [ebp - 0x20a], ax
mov ax, word [ebp - 0x210]
test ax, ax
je 0x533f47
cmp word [ebp - 0x20e], 0x3a
jne 0x533f47
mov word [ebp - 0x470], ax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x533f47
mov eax, dword [ebp - 0x478]
mov ecx, 0x200
test eax, eax
push 0x105
cmove eax, ecx
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x480]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x533f47
lea eax, [ebp - 0x41c]
xor edi, edi
push 0x5f86e0
push eax
call fcn.005d09f9
add esp, 8
test eax, eax
jne 0x534039
lea edi, [eax + 1]
jmp 0x5340a7
lea eax, [ebp - 0x41c]
push 0x5f86f4
push eax
call fcn.005d09f9
add esp, 8
test eax, eax
jne 0x534056
lea edi, [eax + 2]
jmp 0x5340a7
lea eax, [ebp - 0x41c]
push str.exFAT
push eax
call fcn.005d09f9
add esp, 8
test eax, eax
jne 0x534073
lea edi, [eax + 3]
jmp 0x5340a7
lea eax, [ebp - 0x41c]
push 0x5fc96c
push eax
call fcn.005d09f9
add esp, 8
test eax, eax
je 0x5340a7
lea eax, [ebp - 0x41c]
push str.ReFS
push eax
call fcn.005d09f9
add esp, 8
test eax, eax
jne 0x533f47
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5340b0
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x20a
jae 0x534319
xor eax, eax
mov word [ebp + ecx - 0x210], ax
lea eax, [ebp - 0x210]
push ebx
push eax
lea eax, [ebp - 0x41c]
push str.._s
push eax
call fcn.0047c390
add esp, 0xc
lea eax, [ebp - 0x41c]
push 0
push 0
push 3
push 0
push 7
push accept
push eax
call dword [0x648de0]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x534306
push 0
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x480], 1
push eax
push 0x20
lea eax, [ebp - 0x43c]
push eax
push 0
push 0
push 0x74004
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x534167
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x460], eax
cmp edi, 1
je 0x53417a
cmp edi, 2
je 0x53417a
cmp edi, 3
jne 0x5342b4
push 4
push 0x1000
push dword [ebp - 0x478]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x5342fc
push 0
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x478]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53428d
mov ecx, dword [ebp - 0x478]
cmp dword [ebp - 0x48c], ecx
jne 0x53428d
cmp edi, 3
jne 0x5341e6
mov edi, dword [esi + 0x58]
mov dword [ebp - 0x474], edi
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
mov dword [ebp - 0x484], eax
jmp 0x534261
cmp edi, 2
jne 0x53420e
movzx edi, byte [esi + 0x10]
imul edi, dword [esi + 0x24]
movzx eax, word [esi + 0xe]
mov dword [ebp - 0x484], 0
add edi, eax
mov dword [ebp - 0x474], edi
mov ecx, dword [esi + 0x20]
jmp 0x534261
movzx eax, word [esi + 0x11]
xor edx, edx
shl eax, 5
dec eax
movzx edi, word [esi + 0x16]
add eax, ecx
div ecx
movzx ecx, byte [esi + 0x10]
imul edi, ecx
movzx ecx, word [esi + 0xe]
add edi, eax
add edi, ecx
mov dword [ebp - 0x474], edi
movzx eax, word [esi + 0x13]
cdq
mov ecx, eax
mov dword [ebp - 0x488], eax
or ecx, edx
mov dword [ebp - 0x484], edx
jne 0x53425b
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x484], 0
jmp 0x534261
mov ecx, dword [ebp - 0x488]
mov eax, edi
mul dword [ebp - 0x478]
mov dword [ebp - 0x46c], eax
xor eax, eax
mov dword [ebp - 0x468], edx
cmp eax, dword [ebp - 0x484]
jb 0x534297
ja 0x534285
cmp edi, ecx
jb 0x534297
mov dword [ebp - 0x480], eax
jmp 0x534297
mov dword [ebp - 0x480], 0
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [ebp - 0x480], 0
je 0x5342fc
mov esi, dword [ebp - 0x490]
push 0x20
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x494]
call fcn.00533ce0
add esp, 0x18
test eax, eax
je 0x5342fc
mov eax, dword [esi]
movups xmm0, xmmword [ebp - 0x47c]
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x46c]
movups xmmword [eax + 0x10], xmm0
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or ebx, 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
call fcn.0058c358
int3