Function at 0x40531c
Capabilities:
Read file on windows
Unmount volume via ioctl
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 4], dl
mov esi, dword [edi + 0x10]
test esi, esi
jne 0x405336
mov esi, dword [edi + 0x14]
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x405353
call fcn.00406c6c
push esi
push eax
push 0x1011
call fcn.0040603b
add esp, 0xc
jmp 0x405360
push esi
push 0x1012
call fcn.0040603b
pop ecx
pop ecx
push 0x101d
call fcn.0040603b
mov edi, dword [edi + 0x14]
lea eax, [ebp - 0x38]
mov ebx, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
pop ecx
push edi
push eax
call ebx
push 0x2a
lea eax, [ebp - 0x38]
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x58], eax
xor ecx, ecx
push 7
lea eax, [ebp - 0x40]
mov dword [ebp - 0x5c], ecx
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x54], 0x40
push eax
push 0xc0100080
lea eax, [ebp - 8]
mov dword [ebp - 0x50], ecx
push eax
mov dword [ebp - 0x4c], ecx
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
test esi, esi
jns 0x4053d9
push 0x1013
call fcn.0040603b
pop ecx
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call fcn.00406087
jmp 0x40569e
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
push 0x401064
call fcn.00406bc1
mov esi, eax
test esi, esi
jns 0x40540d
push 0x1014
call fcn.0040603b
pop ecx
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call fcn.00406087
jmp 0x40568a
push dword [ebp - 0x24]
lea eax, [ebp - 0x38]
push eax
call ebx
push 0x4021
xor ecx, ecx
mov dword [ebp - 0x60], 0x18
lea eax, [ebp - 0x38]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x40]
push ecx
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x54], 0x40
push eax
push 0x100000
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], ecx
push eax
mov dword [ebp - 0x4c], ecx
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov ecx, dword [ebp - 0x24]
mov esi, eax
call fcn.00405f02
test esi, esi
jns 0x405467
push 0x1015
jmp 0x4053f4
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x30]
call fcn.00404f48
push dword [ebp - 0x28]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x40548f
push 0x1016
jmp 0x4053f4
mov ebx, dword [ebp - 0x30]
mov ecx, 0x200
mov edx, dword [0x410ec0]
cmp ebx, 1
jne 0x4054be
mov edi, dword [ebp - 0x10]
cmp edi, ecx
je 0x4054d5
push 0x108b
call fcn.0040603b
pop ecx
mov esi, 0xc0000001
jmp 0x40568a
cmp ebx, 3
jne 0x4054d2
cmp edx, 0x40a00c
jne 0x4054d2
push 0x108c
jmp 0x4054ae
mov edi, dword [ebp - 0x10]
mov eax, ebx
sub eax, 0
je 0x40550a
dec eax
je 0x405500
dec eax
je 0x4054f6
dec eax
je 0x4054ec
push 0x1017
jmp 0x4054ae
mov eax, dword [edx + 0x10]
mov ecx, 0x600
jmp 0x40550c
mov eax, dword [edx + 8]
mov ecx, 0x2000
jmp 0x40550c
mov eax, dword [edx + 4]
mov ecx, 0x600
jmp 0x40550c
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
xor edx, edx
mov eax, ecx
mov dword [ebp - 0x18], ecx
div edi
mov esi, ecx
mov dword [ebp - 0x20], ecx
test edx, edx
je 0x405528
sub esi, edx
add esi, edi
mov dword [ebp - 0x20], esi
cmp ebx, 3
jne 0x405533
imul esi, edi, 0x18
mov dword [ebp - 0x20], esi
lea ecx, [esi + edi]
call fcn.00405eea
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x405557
push 0x1018
call fcn.0040603b
pop ecx
mov esi, 0xc000009a
jmp 0x40568a
push 0
push edi
push 0
push eax
call fcn.00409bf0
mov edi, dword [ebp - 0x24]
test eax, eax
je 0x40556e
sub edi, eax
add edi, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x1c], edi
push ecx
push ecx
push ecx
push ecx
push 0x90018
lea eax, [ebp - 0x48]
mov dword [ebp - 0x2c], ecx
push eax
push ecx
push ecx
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 2], cl
mov byte [ebp - 3], cl
mov byte [ebp - 1], cl
call dword [sym.imp.ntdll.dll_NtFsControlFile]
test eax, eax
jns 0x4055b2
cmp byte [ebp - 4], 0
jne 0x4055ae
mov byte [ebp - 1], 1
mov dword [ebp - 0x2c], eax
jmp 0x4055f7
mov byte [ebp - 2], 1
xor ecx, ecx
lea eax, [ebp - 0x48]
push ecx
push ecx
push ecx
push ecx
push 0x90020
push eax
push ecx
push ecx
push ecx
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtFsControlFile]
test eax, eax
jns 0x4055da
mov byte [ebp - 3], 1
mov dword [ebp - 0x30], eax
jmp 0x4055f7
cmp byte [ebp - 2], 1
jne 0x4055f7
push 0x101e
call fcn.0040603b
mov dword [esp], 0x101d
call fcn.0040603b
pop ecx
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x405611
push 0x1019
jmp 0x40563d
lea eax, [ebp - 0xc]
push 0
push eax
cmp ebx, 3
jne 0x4056a7
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405638
cmp dword [ebp - 0xc], esi
je 0x4056c4
push 0x101a
call fcn.0040603b
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00406087
mov bl, byte [ebp - 1]
mov esi, 0xc0000001
cmp byte [ebp - 2], 0
jne 0x405682
test bl, bl
jne 0x405682
push 0
push 0
push 0
push 0
push 0x9001c
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtFsControlFile]
mov ecx, dword [ebp - 0x24]
call fcn.00405f02
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
push 0x101d
call fcn.0040603b
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405638
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
jne 0x405638
xor ecx, ecx
test ebx, ebx
js 0x4056e4
cmp ebx, 1
jle 0x4056dd
cmp ebx, 2
je 0x405794
cmp ebx, 3
jne 0x4056e4
movzx ecx, byte [edi + 1]
add ecx, 2
cmp ebx, 3
jne 0x4057a7
mov eax, 0x200
sub eax, ecx
push eax
mov eax, dword [ebp - 0x14]
add eax, ecx
push eax
lea eax, [ecx + edi]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x14]
lea ecx, [ebx + 0x7d]
mov eax, dword [ebp - 0x10]
add esp, 0xc
add edi, eax
lea esi, [edx + 0x200]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + 0x400]
mov edx, dword [ebp - 0x1c]
lea ecx, [ebx + 0x7d]
lea edi, [edx + eax*2]
rep movsd dword es:[edi], dword [esi]
imul ecx, eax, 0xb
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x405768
cmp esi, 0x6a
je 0x40575d
cmp esi, 0x6b
je 0x40575d
cmp esi, 0x70
je 0x40575d
movzx ecx, byte [esi + edx]
mov eax, edi
shr eax, 1
add ecx, eax
shl edi, 0x1f
add edi, ecx
mov ecx, dword [ebp - 0x18]
inc esi
cmp esi, ecx
jb 0x40573c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
imul esi, eax, 0xc
cmp ecx, esi
jae 0x405781
mov eax, dword [ebp - 0x14]
lea edi, [ecx + edx]
mov ecx, esi
sub ecx, dword [ebp - 0x18]
dec ecx
shr ecx, 2
inc ecx
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1c]
push esi
push edi
lea eax, [esi + edi]
push eax
call sub.msvcrt.dll_memcpy
mov esi, dword [ebp - 0x20]
jmp 0x4057bc
cmp dword [0x410ec0], 0x40a220
push 0x54
pop ecx
je 0x4057a7
mov byte [edi + 0x24], 0x80
mov eax, dword [ebp - 0x18]
sub eax, ecx
push eax
mov eax, dword [ebp - 0x14]
add eax, ecx
push eax
lea eax, [ecx + edi]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40560a
lea eax, [ebp - 0xc]
push 0
push eax
cmp ebx, 1
jne 0x405848
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x200
push edi
push dword [ebp - 8]
call esi
test eax, eax
je 0x40583e
cmp dword [ebp - 0xc], 0x200
jne 0x40583e
push 0
push 0
push 0x1800
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40560a
push 0
lea eax, [ebp - 0xc]
push eax
push 0x200
lea eax, [edi + 0x400]
push eax
push dword [ebp - 8]
call esi
test eax, eax
je 0x40583e
cmp dword [ebp - 0xc], 0x200
je 0x40585c
push 0x101b
jmp 0x40563d
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40583e
cmp dword [ebp - 0xc], esi
jne 0x40583e
xor eax, eax
xor esi, esi
sub ebx, eax
je 0x405882
dec ebx
je 0x40587b
dec ebx
je 0x405874
dec ebx
jne 0x405887
mov eax, 0x401160
jmp 0x405887
mov eax, 0x401148
jmp 0x405887
mov eax, 0x40113c
jmp 0x405887
mov eax, 0x401134
mov bl, byte [ebp - 1]
push eax
cmp bl, 1
jne 0x4058a1
push 0x101f
call fcn.0040603b
pop ecx
pop ecx
push dword [ebp - 0x2c]
jmp 0x4058b6
cmp byte [ebp - 3], 1
jne 0x4058c8
push 0x1020
call fcn.0040603b
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call fcn.00406087
jmp 0x405658
push 0x101c
call fcn.0040603b
pop ecx
pop ecx
jmp 0x405658