Function at 0x1400e2510
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x220
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x210], rax
movzx eax, word [r8 + 0xa0]
mov r14, qword [rdx + 0x98]
mov r15, qword [rdx + 0x90]
imul r14, rax
imul r15, rax
mov r12, rcx
movsxd rcx, dword [rcx + 0x14]
mov r13, r8
mov rbx, rdx
imul rcx, r14
call sub.MFC80U.DLL_Ordinal_265
test rax, rax
mov rbp, rax
jne 0x1400e265c
call fcn.140049470
lea rbx, [0x14043d210]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rbp, rax
call sub.ntdll.dll_memset
lea rcx, str..._ntfsfmt.cpp
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x1400e25b9
xor esi, esi
jmp 0x1400e2643
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x180]
mov r8d, reloc.MFC80U.DLL_Ordinal_980
mov byte [rsp + 0x180], 0
mov qword [rsp + 0x181], rax
mov word [rsp + reloc.MFC80U.DLL_Ordinal_393], ax
mov byte [rsp + 0x18b], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400e2600
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x180]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400e2630
mov rsi, rbx
mov rax, qword [rbp]
lea rdx, str._s:_No_sufficient_memory.
mov r8, rsi
mov rcx, rbp
call qword [rax + 0x10]
jmp 0x1400e2bff
movsxd r8, dword [r12 + 0x14]
xor edx, edx
mov rcx, rax
imul r8, r14
call sub.ntdll.dll_memset
lea rdx, str.INDX_
mov r8d, 0x1000
mov rcx, rbp
call sub.ntdll.dll_memcpy
xor eax, eax
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], 0
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
movsx eax, word [rbp + 6]
mov r11, qword [rsp + 0x50]
movsx r10, word [rbp + 4]
xor esi, esi
sub eax, 1
test eax, eax
mov edi, esi
jle 0x1400e26ff
lea rcx, [rbp + 0x1fe]
lea rdx, [r10 + rbp + 2]
nop
nop
movzx eax, word [rdx]
add edi, 1
add rdx, 2
mov word [rcx], ax
movsx eax, word [rbp + 6]
add rcx, reloc.MFC80U.DLL_Ordinal_512
sub eax, 1
cmp edi, eax
jl 0x1400e26e0
mov r8d, dword [rbp + 0x18]
movzx r9d, word [r13 + 0xa0]
add r8d, 0x18
movsxd rdi, r8d
imul r9d, dword [r12 + 0x14]
add rdi, rbp
cmp word [rdi + 8], 0x10
je 0x1400e2898
movabs rcx, 0xffffffffffff
lea r12, [0x140000000]
nop
nop
nop
mov rax, qword [rdi]
mov qword [rdi + 0x28], r11
mov qword [rdi + 0x30], r11
and rax, rcx
mov qword [rdi + 0x18], r11
mov qword [rdi + 0x20], r11
cmp rax, 0xb
ja case.0x1400e276b.5
mov eax, dword [r12 + rax*4 + 0xe2c2c]
add rax, r12
jmp rax
mov rax, qword [rbx + 0x70]
movsxd rcx, r9d
lea rdx, [rcx + rax - 1]
lea eax, [r9 - 1]
movabs rcx, 0xffffffffffff
not eax
cdqe
and rdx, rax
mov qword [rdi + 0x38], rdx
mov rax, qword [rbx + 0x70]
mov qword [rdi + 0x40], rax
jmp case.0x1400e276b.5
mov rax, qword [rbx + 0xb8]
movsxd rcx, r9d
lea rdx, [rcx + rax - 1]
lea eax, [r9 - 1]
movabs rcx, 0xffffffffffff
not eax
cdqe
and rdx, rax
mov qword [rdi + 0x38], rdx
mov rax, qword [rbx + 0xb8]
mov qword [rdi + 0x40], rax
jmp case.0x1400e276b.5
mov rax, qword [rbx + 0xd0]
movsxd rcx, r9d
lea rdx, [rcx + rax - 1]
lea eax, [r9 - 1]
movabs rcx, 0xffffffffffff
not eax
cdqe
and rdx, rax
mov qword [rdi + 0x38], rdx
mov rax, qword [rbx + 0xd0]
mov qword [rdi + 0x40], rax
jmp case.0x1400e276b.5
mov rax, qword [rbx + 0x58]
mov qword [rdi + 0x38], rax
mov rax, qword [rbx + 0x58]
mov qword [rdi + 0x40], rax
jmp case.0x1400e276b.5
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x38], rax
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x40], rax
jmp case.0x1400e276b.5
mov rax, qword [rbx + 0x40]
mov qword [rdi + 0x38], rax
mov rax, qword [rbx + 0x40]
mov qword [rdi + 0x40], rax
jmp case.0x1400e276b.5
lea eax, [r9 - 1]
movsxd rcx, r9d
not eax
movsxd rdx, eax
mov rax, qword [rbx + 0x100]
lea rcx, [rcx + rax - 1]
and rdx, rcx
movabs rcx, 0xffffffffffff
mov qword [rdi + 0x38], rdx
mov rax, qword [rbx + 0x100]
mov qword [rdi + 0x40], rax
jmp case.0x1400e276b.5
mov qword [rdi + 0x40], rsi
mov qword [rdi + 0x38], rsi
movsx eax, word [rdi + 8]
add r8d, eax
movsxd rdi, r8d
add rdi, rbp
cmp word [rdi + 8], 0x10
jne 0x1400e2740
movsx eax, word [rbp + 6]
mov edi, esi
sub eax, 1
test eax, eax
jle 0x1400e28dd
lea rcx, [rbp + 0x1fe]
lea rdx, [r10 + rbp + 2]
movzx eax, word [rcx]
add edi, 1
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [r10 + rbp]
add rcx, reloc.MFC80U.DLL_Ordinal_512
mov word [rcx - reloc.MFC80U.DLL_Ordinal_512], ax
movsx eax, word [rbp + 6]
sub eax, 1
cmp edi, eax
jl 0x1400e28b1
mov ebx, dword [r13]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, Ordinal_280
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], Ordinal_280
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x64], 6
jae 0x1400e2984
xor eax, eax
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0x190]
mov r8d, ebx
mov word [rsp + 0x190], si
mov qword [rsp + 0x192], rax
mov qword [rsp + 0x19a], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_418], rax
mov qword [rsp + 0x1aa], rax
mov qword [rsp + 0x1b2], rax
mov qword [rsp + 0x1ba], rax
mov qword [rsp + 0x1c2], rax
mov dword [rsp + 0x1ca], eax
mov word [rsp + 0x1ce], ax
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rcx, [rsp + 0x190]
jmp 0x1400e29bf
call fcn.1400494c0
mov edx, ebx
mov rdi, qword [rax]
mov rcx, rax
call qword [rdi + 0x18]
test eax, eax
js 0x1400e2b16
lea rdx, [0x1402e0fe0]
lea rcx, [rsp + 0x1d0]
mov r9d, ebx
mov r8d, eax
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rcx, [rsp + 0x1d0]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x1400e2b16
mov rax, qword [r13 + 8]
mov r9, r14
mov rdx, rbp
lea r8, [r15 + rax]
mov rcx, rbx
call fcn.1400e0c00
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call sub.MFC80U.DLL_Ordinal_266
test edi, edi
jne 0x1400e2b0c
call fcn.140049470
lea rbx, [0x14043d210]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rbp, rax
call sub.ntdll.dll_memset
lea edx, [rdi + 0x5c]
lea rcx, str..._ntfsfmt.cpp
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400e2af3
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x180]
mov r8d, Ordinal_1095
mov byte [rsp + 0x180], sil
mov qword [rsp + 0x181], rax
mov word [rsp + reloc.MFC80U.DLL_Ordinal_393], ax
mov byte [rsp + 0x18b], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rdx + rcx - 1], al
jne 0x1400e2ab0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x180]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400e2ae0
mov rsi, rbx
mov rax, qword [rbp]
lea rdx, str._s:_Failed_to_write_IndexRoot_Data.
mov r8, rsi
mov rcx, rbp
call qword [rax + 0x10]
jmp 0x1400e2bff
mov eax, 1
jmp 0x1400e2c01
call fcn.140049470
lea rbx, [0x14043d210]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov r12, rax
call sub.ntdll.dll_memset
lea rcx, str..._ntfsfmt.cpp
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400e2be3
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x180]
mov r8d, 0x438
mov byte [rsp + 0x180], sil
mov qword [rsp + 0x181], rax
mov word [rsp + reloc.MFC80U.DLL_Ordinal_393], ax
mov byte [rsp + 0x18b], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rdx + rcx - 1], al
jne 0x1400e2ba0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x180]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400e2bd0
mov rsi, rbx
mov rax, qword [r12]
lea rdx, str._s:_Failed_to_open_disk.
mov r8, rsi
mov rcx, r12
call qword [rax + 0x10]
mov rcx, rbp
call sub.MFC80U.DLL_Ordinal_266
xor eax, eax
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + reloc.MFC80U.DLL_Ordinal_632]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret