Function at 0x140010b0b
Capabilities:
Get disk information
Get disk information via ioctl
Read file on windows

Disassembly:
push r15
mov eax, 0x1198
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400747a0
sub rsp, rax
movabs rax, 0xef0e0c0b07060401
mov qword [rsp + 0x88], rax
mov esi, ecx
xor eax, eax
test rdx, rdx
mov ecx, 0x40
mov r12, rdx
mov r13d, r8d
mov ebx, r9d
lea rdi, [rsp + 0x90]
lea rbp, [rsp + 0x190]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x190]
mov ecx, 0x400
rep stosd dword [rdi], eax
je 0x140010c9c
lea r8, [0x1400fa588]
mov ecx, 0x20
xor r14d, r14d
xor r9d, r9d
mov rdi, r8
mov dword [0x1400fa580], r14d
mov r8d, 1
rep stosd dword [rdi], eax
mov ecx, 0x20
rep stosd dword [rdi], eax
mov byte [rdx], 0
mov ecx, esi
xor edx, edx
call fcn.14000caf6
mov rdi, rax
test rax, rax
jne 0x140010bc5
test ebx, ebx
jne 0x140010bf1
mov edx, esi
lea rcx, str.No_volume_information_for_drive_0x_02x
call fcn.140036717
jmp 0x140010bf1
mov dword [rsp + 0x38], r13d
xor r13d, r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], r12
mov rcx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x140010bb1
mov rcx, rdi
call sub.msvcrt.dll_free
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov ecx, esi
call fcn.14000c911
mov qword [rsp + 0x48], rax
inc rax
je 0x140010c9c
xor edi, edi
lea r13, [rsp + 0x84]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
mov edx, 0x700a0
mov qword [rsp + 0x30], r13
mov rdi, qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
je 0x140010c69
cmp dword [rsp + 0x84], 0
jne 0x140010ca7
test ebx, ebx
jne 0x140010c83
call fcn.140036bd7
mov edx, esi
lea rcx, str.Could_not_get_geometry_for_drive_0x_02x:__s
mov r8, rax
call fcn.140036717
mov rax, qword [rsp + 0x48]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140010c9c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ebx, ebx
mov dword [rsp + 0x54], ebx
jmp 0x140011447
mov rax, qword [rsp + 0xa8]
mov r8d, dword [rsp + 0xa4]
mov dword [0x1400fa574], 0xffffffff
mov qword [0x1400fa560], rax
mov dword [0x1400fa570], r8d
cmp r8d, 0x1ff
ja 0x140010cf4
test ebx, ebx
jne 0x140010cea
mov edx, esi
lea rcx, str.Warning:_Drive_0x_02x_reports_a_sector_size_of__d___Correcting_to_512_bytes.
call fcn.140036717
mov dword [0x1400fa570], 0x200
mov eax, dword [rsp + 0xa0]
mov dword [0x1400fa56c], eax
mov eax, dword [rsp + 0x98]
mov dword [0x1400fa578], eax
test ebx, ebx
jne 0x140010d83
mov r9d, dword [0x1400fa570]
mov rcx, qword [0x1400fa560]
xor edx, edx
mov r8d, 1
mov dword [rsp + 0x54], r9d
call fcn.140037ab9
cmp dword [0x1400fa578], 0xc
lea rdx, str.Removable
mov r9d, dword [rsp + 0x54]
mov r8, rax
lea rax, str.FIXED
lea rcx, str.Disk_type:__s__Disk_size:__s__Sector_size:__d_bytes
cmove rdx, rax
call fcn.140036717
mov r9d, dword [rsp + 0xa0]
mov r8d, dword [rsp + 0x9c]
lea rcx, str.Cylinders:__I64i__Tracks_per_cylinder:__d__Sectors_per_track:__d
mov rdx, qword [rsp + 0x90]
call fcn.140036717
xor r11d, r11d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r11
mov rcx, qword [rsp + 0x48]
mov edx, 0x70050
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rbp
call rdi
test eax, eax
je 0x140010dbd
cmp dword [rsp + 0x84], 0
jne 0x140010ddb
test ebx, ebx
jne 0x140010c83
call fcn.140036bd7
mov edx, esi
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov r8, rax
jmp 0x140010c7e
mov esi, dword [rsp + 0x190]
test esi, esi
je 0x140010df3
dec esi
je 0x140011194
jmp 0x1400113fa
xor r10d, r10d
mov r8d, dword [rsp + 0x194]
xor edx, edx
xor ecx, ecx
mov dword [0x1400fa57c], r10d
mov eax, dword [0x1400fa580]
cmp r8d, edx
je 0x140010e29
cmp byte [rbp + 0x50], 0
je 0x140010e1e
inc eax
mov cl, 1
inc edx
add rbp, 0x90
jmp 0x140010e0f
test cl, cl
je 0x140010e33
mov dword [0x1400fa580], eax
cmp byte [rsp + 0x1e0], 0
je 0x140010e6c
cmp qword [rsp + 0x1c8], 0
jne 0x140010e6c
test ebx, ebx
je 0x140010e57
mov r15d, 1
jmp 0x140010ed9
mov rdx, qword [str.WG_b_]
lea rcx, str.Partition_type:_SFD___s__or_unpartitioned
call fcn.140036717
jmp 0x140010e4c
test ebx, ebx
jne 0x140010e82
mov edx, dword [0x1400fa580]
lea rcx, str.Partition_type:_MBR__NB_Partitions:__d
call fcn.140036717
mov edx, dword [rsp + 0x198]
xor eax, eax
cmp edx, 0x49464555
sete al
mov dword [0x1400fa6a0], eax
test ebx, ebx
jne 0x140010ec2
cmp edx, 0x49464555
lea r8, [0x1400833e0]
lea rax, str._UEFI_target_
cmove r8, rax
lea rcx, str.Disk_ID:_0x_08X__s
call fcn.140036717
mov rcx, qword [rsp + 0x48]
mov r8d, ebx
lea rdx, [0x1400842b3]
xor r15d, r15d
call fcn.14000ea08
mov eax, r15d
xor r9d, r9d
xor eax, 1
mov dword [rsp + 0x54], r9d
mov dword [rsp + 0x68], eax
mov eax, r15d
xor eax, 1
mov byte [rsp + 0x70], al
cmp esi, dword [rsp + 0x194]
jae 0x14001141c
mov ebp, esi
imul rax, rbp, 0x90
movzx edi, byte [rsp + rax + 0x1e0]
test dil, dil
je 0x14001118d
cmp dil, 4
jne 0x140010f3d
test r15d, r15d
je 0x140010f3d
cmp qword [0x1400fa560], 0x1000000
jle 0x140011437
jmp 0x14001141c
cmp dil, 0xef
jne 0x140011437
mov ecx, dword [0x1400fa570]
mov edx, 1
call sub.msvcrt.dll_calloc
mov r13, rax
test rax, rax
je 0x140011437
imul rax, rbp, 0x90
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + rax + 0x1c8]
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
jne 0x140010f8c
xor r14d, r14d
jmp 0x140010fd4
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x84]
mov rdx, r13
mov qword [rsp + 0x20], r8
mov r8d, dword [0x1400fa570]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x140010f87
lea rcx, [r13 + 0x2b]
mov r8d, 9
lea rdx, str.UEFI_NTFS
xor r14d, r14d
call sub.msvcrt.dll_strncmp
test eax, eax
sete r14b
mov rcx, r13
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x140011009
lea r8, str.__UEFI:NTFS_
test r14d, r14d
jne 0x140010ff6
xor r14d, r14d
lea r8, [0x1400833e0]
mov eax, dword [rsp + 0x68]
lea rcx, str.Partition__d_s:
lea edx, [rax + rsi]
call fcn.140036717
xor eax, eax
lea rdx, [rsp + 0x88]
cmp dil, byte [rax + rdx]
je 0x140011024
inc rax
cmp rax, 8
jne 0x140011013
jmp 0x14001102c
mov dword [rsp + 0x54], 1
imul rcx, rbp, 0x90
mov rax, qword [rsp + rcx + 0x1c8]
cmp esi, 0xf
ja 0x14001105c
mov rcx, qword [rsp + rcx + 0x1d0]
lea rdx, [0x1400fa560]
mov qword [rdx + rbp*8 + 0x28], rax
mov qword [rdx + rbp*8 + 0xa8], rcx
test ebx, ebx
jne 0x14001113f
imul rbp, rbp, 0x90
mov ecx, dword [0x1400fa570]
mov r9d, esi
lea rdx, [0x140084133]
lea r13, [0x140084137]
cmp byte [rsp + rbp + 0x1e1], 0
cmovne r13, rdx
imul r9, r9, 0x90
cqo
xor r8d, r8d
idiv rcx
mov qword [rsp + 0x78], r9
mov edx, 1
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + r9 + 0x1d0]
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.140037ab9
mov r9, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
mov rbp, rax
mov rdx, qword [rsp + r9 + 0x1c8]
call fcn.14000ecc7
xor r8d, r8d
test r15d, r15d
cmove r8d, edi
mov r9, rax
cmp dil, 7
je 0x1400110f5
cmp byte [rsp + 0x70], 0
jne 0x1400110ff
cmp byte [r12], 0
mov rdx, r12
jne 0x140011115
movzx ecx, dil
mov dword [rsp + 0x78], r8d
call fcn.140010a85
mov r8d, dword [rsp + 0x78]
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], r13
lea rcx, str.__Type:__s__0x_02x__r_n__Detected_File_System:__s_r_n__Size:__s___lld_bytes__r_n__Start_Sector:__lld__Boot:__s
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
call fcn.140036717
mov eax, esi
mov ecx, dword [0x1400fa570]
imul rax, rax, 0x90
mov rax, qword [rsp + rax + 0x1c8]
cqo
idiv rcx
mov edx, dword [0x1400fa574]
cmp edx, eax
cmova edx, eax
mov dword [0x1400fa574], edx
cmp dil, 0xea
je 0x140011177
test r14d, r14d
je 0x14001117d
dec dword [0x1400fa580]
cmp dil, 0xee
jne 0x14001118d
mov dword [0x1400fa69c], 1
inc esi
jmp 0x140010ef5
mov dword [0x1400fa57c], 1
test ebx, ebx
jne 0x1400111f4
mov edx, dword [rsp + 0x194]
lea rcx, str.Partition_type:_GPT__NB_Partitions:__d
call fcn.140036717
lea rcx, [rsp + 0x198]
call fcn.1400379be
lea rcx, str.Disk_GUID:__s
mov rdx, rax
call fcn.140036717
mov r9, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1a8]
lea rcx, str.Max_parts:__d__Start_Offset:__I64i__Usable___I64i_bytes
mov edx, dword [rsp + 0x1b8]
call fcn.140036717
xor ecx, ecx
xor edi, edi
lea r14, [0x1400fa560]
mov dword [rsp + 0x54], ecx
cmp edi, dword [rsp + 0x194]
jae 0x14001141c
cmp edi, 0xf
mov esi, edi
ja 0x14001123b
imul rax, rsi, 0x90
mov rdx, qword [rsp + rax + 0x1c8]
mov rax, qword [rsp + rax + 0x1d0]
mov qword [r14 + rsi*8 + 0x28], rdx
mov qword [r14 + rsi*8 + 0xa8], rax
imul r13, rsi, 0x90
lea rdx, [0x140083eb8]
inc dword [0x1400fa580]
lea r15, [rbp + r13 + 0x78]
mov rcx, r15
call sub.msvcrt.dll_wcscmp
mov r12d, eax
lea rax, [rbp + r13 + 0x50]
mov qword [rsp + 0x58], rax
test ebx, ebx
jne 0x14001129c
mov rcx, rax
call fcn.140010ab7
test r12d, r12d
lea edx, [rdi + 1]
lea r8, str.__UEFI:NTFS_
mov r9, rax
lea rax, [0x1400833e0]
lea rcx, str.Partition__d_s:_r_n__Type:__s
cmovne r8, rax
call fcn.140036717
imul rax, rsi, 0x90
cmp word [rsp + rax + 0x208], 0
je 0x1400112c7
test ebx, ebx
jne 0x140011370
mov rdx, r15
lea rcx, str.__Name:__S
call fcn.140036717
jmp 0x1400112cf
test ebx, ebx
jne 0x140011370
imul r15, rsi, 0x90
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + r15 + 0x1c8]
call fcn.14000ecc7
lea rcx, str.__Detected_File_System:__s
mov rdx, rax
call fcn.140036717
mov rax, qword [rsp + r15 + 0x1c8]
mov ecx, dword [0x1400fa570]
xor r8d, r8d
mov r10, qword [rsp + r15 + 0x200]
cqo
idiv rcx
mov rcx, qword [rsp + r15 + 0x1d0]
mov qword [rsp + 0x70], r10
mov edx, 1
mov qword [rsp + 0x60], rax
call fcn.140037ab9
lea rcx, [rbp + r13 + 0x60]
mov qword [rsp + 0x68], rax
call fcn.1400379be
mov r10, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
lea rcx, str.__ID:__s_r_n__Size:__s___I64i_bytes__r_n__Start_Sector:__I64i__Attributes:_0x_016I64X
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + r15 + 0x1d0]
call fcn.140036717
imul rsi, rsi, 0x90
mov ecx, dword [0x1400fa570]
mov rax, qword [rsp + rsi + 0x1c8]
cqo
idiv rcx
mov edx, dword [0x1400fa574]
cmp edx, eax
cmova edx, eax
mov dword [0x1400fa574], edx
test r12d, r12d
jne 0x1400113a8
dec dword [0x1400fa580]
jmp 0x1400113d2
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400b9ca0]
call fcn.140035c44
test eax, eax
jne 0x1400113a0
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400b9af0]
call fcn.140035c44
test eax, eax
jne 0x1400113a0
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400b9c60]
call fcn.140035c44
test eax, eax
mov eax, 1
cmove eax, dword [rsp + 0x54]
inc edi
mov dword [rsp + 0x54], eax
jmp 0x140011203
xor edx, edx
mov dword [0x1400fa57c], edx
test ebx, ebx
je 0x14001140e
xor eax, eax
mov dword [rsp + 0x54], eax
jmp 0x14001141c
lea rcx, str.Partition_type:_RAW
call fcn.140036717
jmp 0x140011406
mov rax, qword [rsp + 0x48]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140011447
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140011447
xor r14d, r14d
test ebx, ebx
jne 0x140011009
jmp 0x140010fec
mov eax, dword [rsp + 0x54]
add rsp, 0x1198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret