Function at 0x140011280
Capabilities:
Get disk information
Read file on windows

Disassembly:
jmp 0x140011830
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x6a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x2b8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x250], rax
lea rcx, [0x1400230b2]
call fcn.1400113a7
cmp dword [rbp + 0x280], 3
jge 0x14001188f
mov eax, 0xa0
jmp 0x140011c99
mov eax, 8
imul rax, rax, 2
lea rdx, [0x14001ad44]
mov rcx, qword [rbp + 0x288]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400118c5
mov eax, 2
jmp 0x140011c99
mov rdx, qword [rbp + 8]
mov ecx, 6
call qword [sym.imp.ucrtbased.dll_fputc]
cmp eax, 0xffffffff
jne 0x1400118e3
mov eax, 0x6d
jmp 0x140011c99
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fflush]
mov eax, 8
imul rax, rax, 1
lea rdx, [0x14001ad48]
mov rcx, qword [rbp + 0x288]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140011923
mov eax, 2
jmp 0x140011c99
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fgetc]
cmp eax, 6
je 0x14001193c
mov eax, 0x6d
jmp 0x140011c99
mov r9, qword [rbp + 0x28]
mov r8d, 1
mov edx, 2
lea rcx, [rbp + 0x44]
call qword [sym.imp.ucrtbased.dll_fread]
cmp rax, 1
je 0x140011979
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
mov eax, 0x6d
jmp 0x140011c99
movzx ecx, word [rbp + 0x44]
call fcn.14001128a
mov word [rbp + 0x44], ax
movzx eax, word [rbp + 0x44]
inc eax
cdqe
mov qword [rbp + 0x248], rax
mov eax, 2
mov rcx, qword [rbp + 0x248]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x68], rax
movzx eax, word [rbp + 0x44]
shl rax, 1
mov r9, qword [rbp + 0x28]
mov r8d, 1
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ucrtbased.dll_fread]
cmp rax, 1
je 0x1400119fe
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
mov eax, 0x6d
jmp 0x140011c99
movzx eax, word [rbp + 0x44]
xor ecx, ecx
mov rdx, qword [rbp + 0x68]
mov word [rdx + rax*2], cx
mov dword [rbp + 0x88], 2
mov r8d, 0x10
xor edx, edx
lea rcx, [rbp + 0x8c]
call fcn.1400112df
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x60000
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x88]
call fcn.140011078
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0
je 0x140011aa4
mov rdx, qword [rbp + 8]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_fputc]
mov edx, dword [rbp + 0xd4]
mov rcx, qword [rbp + 8]
call fcn.140011df0
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
mov eax, dword [rbp + 0xd4]
jmp 0x140011c99
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rbp + 0xf4], eax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xb8]
call fcn.140011375
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0
je 0x140011b2f
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 8]
mov ecx, 2
call qword [sym.imp.ucrtbased.dll_fputc]
mov edx, dword [rbp + 0xd4]
mov rcx, qword [rbp + 8]
call fcn.140011df0
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
mov eax, dword [rbp + 0xd4]
jmp 0x140011c99
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rbp + 0x114], eax
mov eax, dword [rbp + 0xf4]
not eax
mov ecx, dword [rbp + 0x114]
and ecx, eax
mov eax, ecx
mov dword [rbp + 0x134], eax
mov eax, dword [rbp + 0x134]
bsr eax, eax
mov dword [rbp + 0x154], eax
setne al
movzx eax, al
test eax, eax
jne 0x140011bb0
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 8]
mov ecx, 3
call qword [sym.imp.ucrtbased.dll_fputc]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fflush]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
mov eax, 0xf
jmp 0x140011c99
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_fputc]
movsx eax, byte [rbp + 0x154]
add eax, 0x41
mov rdx, qword [rbp + 8]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_fputc]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fflush]
xor eax, eax
cmp eax, 1
je 0x140011c39
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fgetc]
mov dword [rbp + 0x174], eax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xb8]
call fcn.140011032
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0
je 0x140011c1c
cmp dword [rbp + 0x174], 0
je 0x140011c1e
jmp 0x140011c39
mov rdx, qword [rbp + 8]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_fputc]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fflush]
jmp 0x140011bdc
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0xd4], 0
jne 0x140011c5b
mov dword [rbp + 0x244], 0
jmp 0x140011c65
mov dword [rbp + 0x244], 1
mov rdx, qword [rbp + 8]
mov ecx, dword [rbp + 0x244]
call qword [sym.imp.ucrtbased.dll_fputc]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fflush]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
mov eax, dword [rbp + 0xd4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001acf0]
call fcn.140011339
mov rax, rdi
mov rcx, qword [rbp + 0x250]
xor rcx, rbp
call fcn.1400111c2
lea rsp, [rbp + 0x268]
pop rdi
pop rbp
ret