Function at 0x164c9dcf0
Capabilities:
Check os version
Get storage device properties

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebp, dword [r11 + 8]
mov r14, rdx
xor edi, edi
mov qword [r11 - 0x48], rdi
call fcn.164ca23d0
mov rcx, rax
test rax, rax
je 0x164c9dfb7
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [0x164cdeeb8]
add rax, 0x18
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov esi, edi
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
mov r8d, ebp
lea rdx, str..PhysicalDrive_u
lea rcx, [rsp + 0x50]
call fcn.164ca12d0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [rdi + 3]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov rbp, 0xffffffffffffffff
cmp rax, rbp
jne 0x164c9ddbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x164c9df5c
mov ecx, 0x1001
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x164c9ddd6
lea edi, [rax + 8]
jmp 0x164c9df53
xor edx, edx
mov r8d, 0x1001
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rsi
mov r9d, 0xc
lea r8, [rsp + 0x58]
mov edx, 0x2d1400
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x164c9de2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x164c9df53
mov eax, dword [rsi + 0x18]
test eax, eax
je 0x164c9df4e
cmp eax, dword [rsp + 0x40]
jae 0x164c9df4e
cmp bl, 6
ja 0x164c9df1f
jne 0x164c9de59
shr bx, 8
cmp bl, 2
jae 0x164c9df1f
mov qword [rsp + 0x48], rdi
call fcn.164ca23d0
mov rcx, rax
test rax, rax
je 0x164c9dfc2
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [0x164cdeeb8]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov edx, dword [rsp + 0x40]
sub edx, dword [rsi + 0x18]
js 0x164c9dfac
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x164c9deb2
lea rcx, [rsp + 0x48]
call fcn.164ca0c80
mov rbx, qword [rsp + 0x48]
mov ecx, dword [rsi + 0x18]
add rcx, rsi
mov r8, rbx
call fcn.164c9d280
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
test eax, eax
js 0x164c9dfac
cmp eax, dword [rbx - 0xc]
jg 0x164c9dfac
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.164ca0890
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x164c9df44
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x164cdeeb8]
mov rcx, r14
call fcn.164ca03c0
jmp 0x164c9df53
mov rdx, rax
add rdx, rsi
jne 0x164c9df2b
mov eax, edi
jmp 0x164c9df39
mov rax, rbp
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x164c9df30
mov r8d, eax
mov rcx, r14
call fcn.164ca0d00
mov rcx, r14
call fcn.164ca03c0
jmp 0x164c9df53
mov edi, 0xd
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x164c9df89
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x164cdeeb8]
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.164cd6f70
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.164ca2080
nop
mov ecx, 0x80004005
call fcn.164ca2080
nop
mov ecx, 0x80004005
call fcn.164ca2080
int3