Function at 0x21009d470
Capabilities:
Check os version
Enumerate files on windows
Get disk information
Get disk information via ioctl

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x7b8
mov ecx, 0x3f
movabs rax, 0x7600650044005c
mov qword [rsp + 0x180], rax
xor eax, eax
lea rdi, [rsp + 0x190]
rep stosq qword [rdi], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x808], rdx
movabs rdx, 0x6500630069
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x188], rdx
mov r8, rax
mov edx, 1
mov qword [rsp + 0xe0], 0x10000e
mov dword [rsp + 0x150], 0x30
mov qword [rsp + 0x158], 0
mov dword [rsp + 0x168], 0x40
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0
mov qword [rsp + 0x70], rax
call sym.NtOpenDirectoryObject
test eax, eax
js 0x21009df19
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
lea r12, [rsp + 0xc8]
lea rdi, [rsp + 0xb0]
xor esi, esi
mov rcx, r12
mov eax, dword [rax - 0x2cc8]
mov dword [rsp + 0xc8], eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov eax, dword [rax - 0x2cc4]
mov dword [rsp + 0xcc], eax
call method.tmp_pathbuf.c_get__
mov rcx, r12
mov qword [rsp + 0x98], rax
mov r15, rax
call method.tmp_pathbuf.c_get__
mov rcx, r12
mov r13, rax
call method.tmp_pathbuf.w_get__
mov rcx, r12
mov r14, r13
mov qword [rsp + 0x88], rax
call method.tmp_pathbuf.w_get__
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0x60], rax
mov eax, 1
nop word [rax + rax]
mov rdi, qword [rsp + 0x80]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, 0x10000
mov qword [rsp + 0x30], 0
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rdi
mov rcx, qword [rsp + 0xb8]
call sym.NtQueryDirectoryObject
mov dword [rsp + 0x78], eax
test eax, eax
js 0x21009df3e
mov rbx, qword [rsp + 0x60]
movzx eax, word [rbx]
test ax, ax
je 0x21009da61
lea r13, [0x2102900b2]
nop dword [rax]
cmp ax, 0x11
jbe 0x21009da50
mov rcx, qword [rbx + 8]
mov r8d, 8
mov rdx, r13
call sym.msys_2.0.dll_wcsncasecmp
test eax, eax
jne 0x21009da50
mov rdi, qword [rbx + 8]
movzx ecx, word [rdi + 0x10]
call sym.msys_2.0.dll_iswdigit
test eax, eax
je 0x21009da50
mov r8d, 0xa
lea rcx, [rdi + 0x10]
xor edx, edx
call sym.msys_2.0.dll_wcstoul
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rbx + 8]
mov rbp, rax
mov rcx, rdi
call sym.msys_2.0.dll_wcscpy
movzx ecx, word [rbx]
lea rdx, str.Partition0
and rcx, 0xfffffffffffffffe
add rcx, rdi
call sym.msys_2.0.dll_wcpcpy
movzx eax, word [rbx]
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0x20], 7
mov r8, qword [rsp + 0x70]
lea r9, [rsp + 0xd0]
mov dword [rsp + 0x150], 0x30
lea edx, [rax + 0x16]
add eax, 0x18
mov word [rsp + 0xe2], ax
mov rax, qword [rsp + 0xb8]
mov word [rsp + 0xe0], dx
mov edx, 0x20000
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x168], 0x40
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0
call sym.NtOpenFile
test eax, eax
js 0x21009dbc0
test sil, sil
je 0x21009ddf0
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70048
lea rsi, [rsp + 0xb4]
mov dword [rsp + 0x28], 0x8000
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rsi
call sym.DeviceIoControl
test eax, eax
je 0x21009dc90
lea rcx, [rsp + 0xf0]
xor r8d, r8d
mov edx, ebp
mov rdi, qword [r14 + 0x10]
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
shr rdi, 0xa
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
call method.device.parsedisk_int__int_
mov rax, qword [rsp + 0xf0]
mov rcx, r15
mov qword [rsp + 0x20], rdi
movzx r9d, word [rsp + 0xf8]
lea rdx, str._5d__5d__9U__s_n
mov rdi, r14
movzx r8d, word [rsp + 0xfa]
add rax, 5
mov qword [rsp + 0x28], rax
call sym.__small_sprintf
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], 0
cdqe
mov rcx, qword [rsp + 0xc0]
mov edx, 0x70050
mov dword [rsp + 0x28], 0x8000
add r15, rax
mov qword [rsp + 0x20], r14
call sym.DeviceIoControl
mov qword [rsp + 0x58], 0
test eax, eax
je 0x21009dd9f
mov eax, dword [r14 + 4]
lea rdi, [r14 + 0x30]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
xor r12d, r12d
test eax, eax
je 0x21009da18
mov qword [rsp + 0x90], r14
mov r14, qword [rsp + 0x58]
mov dword [rsp + 0x7c], ebp
jmp 0x21009d9e5
mov ebp, dword [rdi + 0x18]
mov rsi, qword [rdi + 0x10]
add rdi, 0x90
test ebp, ebp
je 0x21009d9d4
mov edx, dword [rsp + 0x7c]
mov r8d, ebp
lea rcx, [rsp + 0x120]
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
shr rsi, 0xa
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
call method.device.parsedisk_int__int_
mov rax, qword [rsp + 0x120]
mov rcx, r15
mov qword [rsp + 0x20], rsi
movzx r9d, word [rsp + 0x128]
lea rdx, str._5d__5d__9U__s
movzx r8d, word [rsp + 0x12a]
add rax, 5
mov qword [rsp + 0x28], rax
call sym.__small_sprintf
lea rcx, [rsp + 0x390]
mov r8, rbx
mov r9d, ebp
movsxd rsi, eax
lea rdx, str._GLOBALROOTDevice_SPartition_u_
mov qword [rsp + 0x58], rcx
call sym.__small_swprintf_wchar_t__wchar_t_const__::_
add rsi, r15
mov rcx, qword [rsp + 0x58]
lea r15, [rsp + 0x5a0]
mov r8d, 0x104
mov rdx, r15
call sym.GetVolumeNameForVolumeMountPointW
test eax, eax
jne 0x21009db08
mov byte [rsi], 0xa
cmp byte [rsp + 0x146], 0
lea r15, [rsi + 1]
jne 0x21009daf0
cmp byte [rsp + 0x147], 0
jne 0x21009dad8
add r12d, 1
cmp r12d, dword [rsp + 0x4c]
jae 0x21009da10
cmp r12d, 0x3f
ja 0x21009da10
test rdi, rdi
jne 0x21009d8c8
mov ebp, dword [r14 + 0x14]
mov rsi, qword [r14 + 8]
add r14, 0x20
test ebp, ebp
jne 0x21009d8de
add r12d, 1
cmp r12d, dword [rsp + 0x4c]
jb 0x21009d9df
nop dword [rax]
mov r14, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xc0]
call sym.NtClose
cmp byte [rsp + 0x116], 0
jne 0x21009dc79
movzx esi, byte [rsp + 0x117]
test sil, sil
jne 0x21009dc00
mov esi, 1
nop dword [rax]
movzx eax, word [rbx + 0x20]
add rbx, 0x20
test ax, ax
jne 0x21009d660
xor eax, eax
cmp dword [rsp + 0x78], 0x105
je 0x21009d600
mov rcx, qword [rsp + 0xb8]
xor r12d, r12d
call sym.NtClose
test sil, sil
jne 0x21009deda
mov edx, dword [rsp + 0xc8]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc8], edx
mov edx, dword [rsp + 0xcc]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc4], edx
mov rax, r12
add rsp, 0x7b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x130]
call sym.cfree
jmp 0x21009d9d4
mov rcx, qword [rsp + 0x120]
call sym.cfree
jmp 0x21009d9c6
mov rdx, qword [rsp + 0x88]
lea r9, [rsp + 0xac]
mov r8d, 0x8000
mov rcx, r15
call sym.GetVolumePathNamesForVolumeNameW
test eax, eax
je 0x21009d9b1
mov rax, qword [rsp + 0x120]
lea rcx, [rax + 5]
call sym.msys_2.0.dll_strlen
lea edx, [rax + 1]
mov dword [rsp + 0xac], edx
cmp eax, 5
ja 0x21009db6d
nop
mov byte [rsi], 0x20
mov eax, dword [rsp + 0xac]
add rsi, 1
lea edx, [rax + 1]
mov dword [rsp + 0xac], edx
cmp eax, 5
jbe 0x21009db50
mov rax, qword [rsp + 0x88]
cmp word [rax], 0
je 0x21009d9b1
mov r15, rax
nop word [rax + rax]
mov r8, r15
mov rcx, rsi
lea rdx, [0x2102901e4]
call sym.__small_sprintf
xor edx, edx
mov rcx, r15
cdqe
add rsi, rax
call sym.msys_2.0.dll_wcschr
cmp word [rax + 2], 0
lea r15, [rax + 2]
jne 0x21009db88
jmp 0x21009d9b1
test byte [0x210273880], 1
jne 0x21009dea0
mov r8d, eax
mov edx, 0x6e8
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_proc.cc
add rbx, 0x20
call sym.seterrno_from_nt_status_char_const__int__int_
movzx eax, word [rbx]
test ax, ax
jne 0x21009d660
jmp 0x21009da61
mov rcx, qword [rsp + 0x100]
add rbx, 0x20
call sym.cfree
movzx eax, word [rbx]
test ax, ax
jne 0x21009d660
jmp 0x21009da61
test byte [0x210273880], 1
je 0x21009da18
mov rax, qword [rsp + 0x50]
lea r9, str.DeviceIoControl__S__IOCTL_DISK_GET_DRIVE_LAYOUT_EX_:__E
lea r8, str.off_t_format_proc_partitions_void__char_
mov edx, 0x40
lea rcx, [0x210273880]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov rcx, qword [rsp + 0xc0]
call sym.NtClose
cmp byte [rsp + 0x116], 0
je 0x21009da33
mov rcx, qword [rsp + 0xf0]
call sym.cfree
jmp 0x21009da33
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x74004
mov dword [rsp + 0x28], 0x8000
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], r14
call sym.DeviceIoControl
test eax, eax
je 0x21009de50
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x58], r14
shr rdi, 0xa
xor r8d, r8d
mov edx, ebp
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
call method.device.parsedisk_int__int_
mov rax, qword [rsp + 0xf0]
mov rcx, r15
mov qword [rsp + 0x20], rdi
movzx r9d, word [rsp + 0xf8]
lea rdx, str._5d__5d__9U__s_n
movzx r8d, word [rsp + 0xfa]
add rax, 5
mov qword [rsp + 0x28], rax
call sym.__small_sprintf
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], 0
cdqe
mov rcx, qword [rsp + 0xc0]
mov edx, 0x70050
mov dword [rsp + 0x28], 0x8000
add r15, rax
mov qword [rsp + 0x20], r14
call sym.DeviceIoControl
test eax, eax
jne 0x21009d894
xor edi, edi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7400c
mov dword [rsp + 0x28], 0x8000
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], r14
call sym.DeviceIoControl
test eax, eax
je 0x21009dc28
mov eax, dword [r14]
mov dword [rsp + 0x4c], eax
lea rax, [r14 + 8]
mov qword [rsp + 0x58], rax
jmp 0x21009d8a0
movabs rax, 0x696d20726f6a616d
add r15, 0x29
movabs rdx, 0x6c62232020726f6e
mov qword [r15 - 0x29], rax
movabs rax, 0x616e2020736b636f
mov qword [r15 - 0x21], rdx
movabs rdx, 0x6e6977202020656d
mov qword [r15 - 0x19], rax
movabs rax, 0xa73746e756f6d2d
mov qword [r15 - 0x11], rdx
mov edx, 0xa
mov qword [r15 - 9], rax
mov word [r15 - 1], dx
jmp 0x21009d778
mov qword [rsp + 0x58], 0
xor edi, edi
test byte [0x210273880], 1
je 0x21009dcd8
mov rax, qword [rsp + 0x50]
lea r9, str.DeviceIoControl___S__IOCTL_DISK_GET_PARTITION_INFO_EX___E
lea r8, str.off_t_format_proc_partitions_void__char_
mov edx, 0x40
lea rcx, [0x210273880]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21009dcd8
mov dword [rsp + 0x28], eax
lea r9, str.NtOpenFile__S___status__y
lea r8, str.off_t_format_proc_partitions_void__char_
mov edx, 0x40
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x50]
lea rcx, [0x210273880]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, dword [rsp + 0x4c]
jmp 0x21009dbcd
mov rsi, qword [rsp + 0x98]
mov rax, qword [rsp + 0x808]
sub r15, rsi
mov rcx, qword [rax]
mov rdx, r15
mov r12, r15
call sym.crealloc_abort
mov r8, r15
mov rdx, rsi
mov rcx, rax
mov rax, qword [rsp + 0x808]
mov qword [rax], rcx
call sym.msys_2.0.dll_memcpy
jmp 0x21009da8a
test byte [0x210273880], 1
jne 0x21009df87
mov r8d, eax
mov edx, 0x6a6
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_proc.cc
xor r12d, r12d
call sym.seterrno_from_nt_status_char_const__int__int_
jmp 0x21009dabe
test byte [0x210273880], 1
jne 0x21009df62
mov r8d, dword [rsp + 0x78]
mov edx, 0x6c1
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_proc.cc
call sym.seterrno_from_nt_status_char_const__int__int_
jmp 0x21009da71
mov dword [rsp + 0x20], eax
lea r9, [0x210290090]
lea r8, str.off_t_format_proc_partitions_void__char_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21009df47
mov dword [rsp + 0x20], eax
lea r9, [0x210290038]
lea r8, str.off_t_format_proc_partitions_void__char_
mov edx, 0x40
lea rcx, [0x210273880]
mov dword [rsp + 0x4c], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, dword [rsp + 0x4c]
jmp 0x21009df22