Function at 0x44e560
Capabilities:
Get disk information
Get disk information via ioctl
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
mov eax, dword [0x46f650]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x54c], ecx
mov eax, dword [0x4606c0]
mov dword [ebp - 0x340], eax
push 0x100
push 0
lea ecx, [ebp - 0x33c]
push ecx
call fcn.0042ac10
add esp, 0xc
mov edx, dword [ebp - 0x54c]
mov al, byte [edx + 0x28]
mov byte [ebp - 0x340], al
push 0x104
lea ecx, [ebp - 0x228]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x340]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x44e5d7
xor eax, eax
jmp 0x44e8a0
mov eax, dword [str..mpapiZ:]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x4606c8]
mov dword [ebp - 0x11c], ecx
mov edx, dword [0x4606cc]
mov dword [ebp - 0x118], edx
mov ax, word [0x4606d0]
mov word [ebp - 0x114], ax
push 0x103
push 0
lea ecx, [ebp - 0x112]
push ecx
call fcn.0042ac10
add esp, 0xc
mov edx, dword [ebp - 0x54c]
mov al, byte [edx + 0x28]
mov byte [ebp - 0x116], al
push 0x104
lea ecx, [ebp - 0x113]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x54c]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x54c]
cmp dword [edx + 0x24], 0xffffffff
jne 0x44e6b9
push str..Z:
lea eax, [ebp - 0x120]
push eax
call fcn.0044ebe0
add esp, 8
mov ecx, dword [ebp - 0x54c]
mov dl, byte [ecx + 0x28]
mov byte [ebp - 0x11c], dl
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x54c]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x54c]
cmp dword [edx + 0x24], 0xffffffff
jne 0x44e6cc
xor eax, eax
jmp 0x44e8a0
push 0
lea eax, [ebp - 0x544]
push eax
push 0xc
lea ecx, [ebp - 0x234]
push ecx
push 0
push 0
push 0x2d1080
mov edx, dword [ebp - 0x54c]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x44e70a
mov ecx, dword [ebp - 0x54c]
mov edx, dword [ebp - 0x230]
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x54c]
mov dword [eax + 0x20], 0
push str.NTFS
lea ecx, [ebp - 0x228]
push ecx
call fcn.0043c5d9
add esp, 8
test eax, eax
jne 0x44e739
mov eax, 1
jmp 0x44e8a0
push 0
push 0
push 0
mov edx, dword [ebp - 0x54c]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x544]
push ecx
push 0x200
lea edx, [ebp - 0x540]
push edx
mov eax, dword [ebp - 0x54c]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44e77f
xor eax, eax
jmp 0x44e8a0
movzx edx, word [ebp - 0x342]
cmp edx, 0xaa55
je 0x44e795
xor eax, eax
jmp 0x44e8a0
movzx eax, byte [ebp - 0x540]
cmp eax, 0xeb
jne 0x44e7b2
movzx ecx, byte [ebp - 0x53e]
cmp ecx, 0x90
je 0x44e818
mov edx, dword [ebp - 0x54c]
mov eax, dword [edx + 0x20]
add eax, dword [ebp - 0x37a]
mov ecx, dword [ebp - 0x54c]
mov dword [ecx + 0x20], eax
push 0
push 0
mov edx, dword [ebp - 0x37a]
push edx
mov eax, dword [ebp - 0x54c]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx edx, byte [ebp - 0x540]
cmp edx, 0xaa55
jne 0x44e811
movzx eax, byte [ebp - 0x540]
cmp eax, 0xeb
jne 0x44e811
movzx ecx, byte [ebp - 0x53e]
cmp ecx, 0x90
je 0x44e818
xor eax, eax
jmp 0x44e8a0
movzx edx, word [ebp - 0x532]
mov eax, dword [ebp - 0x54c]
mov dword [eax + 0x20], edx
movzx ecx, word [ebp - 0x52a]
mov dword [ebp - 0x548], ecx
cmp dword [ebp - 0x548], 0
jne 0x44e84a
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x548], edx
movzx eax, byte [ebp - 0x530]
imul eax, dword [ebp - 0x548]
mov ecx, dword [ebp - 0x54c]
add eax, dword [ecx + 0x20]
mov edx, dword [ebp - 0x54c]
mov dword [edx + 0x20], eax
movzx eax, word [ebp - 0x52f]
shl eax, 5
movzx ecx, word [ebp - 0x535]
lea eax, [eax + ecx - 1]
movzx ecx, word [ebp - 0x535]
cdq
idiv ecx
mov edx, dword [ebp - 0x54c]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x54c]
mov dword [ecx + 0x20], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428d44
mov esp, ebp
pop ebp
ret