Function at 0x164f940b0
Capabilities:
Check os version
Get storage device properties

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebp, dword [r11 + 8]
mov r14, rdx
xor edi, edi
mov qword [r11 - 0x48], rdi
call fcn.164e72eb0
mov rcx, rax
test rax, rax
je 0x164f94374
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x164e9d7b8.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov esi, edi
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
mov r8d, ebp
lea rdx, [0x1650cfbc0]
lea rcx, [rsp + 0x50]
call fcn.164f96ee0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [rdi + 3]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov rbp, 0xffffffffffffffff
cmp rax, rbp
jne 0x164f9417b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x164f9431a
mov ecx, 0x1001
call fcn.1650164a0
mov rsi, rax
test rax, rax
jne 0x164f94195
lea edi, [rax + 8]
jmp 0x164f94311
xor edx, edx
mov r8d, 0x1001
mov rcx, rsi
call fcn.165040130
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rsi
mov r9d, DosDateTimeToVariantTime
lea r8, [rsp + 0x58]
mov edx, 0x2d1400
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x164f941eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x164f94311
mov eax, dword [rsi + 0x18]
test eax, eax
je 0x164f9430c
cmp eax, dword [rsp + 0x40]
jae 0x164f9430c
cmp bl, 6
ja 0x164f942dd
jne 0x164f94218
shr bx, 8
cmp bl, 2
jae 0x164f942dd
mov qword [rsp + 0x48], rdi
call fcn.164e72eb0
mov rcx, rax
test rax, rax
je 0x164f9437f
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x164e9d7b8.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov edx, dword [rsp + 0x40]
sub edx, dword [rsi + 0x18]
js 0x164f94369
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x164f94271
lea rcx, [rsp + 0x48]
call fcn.164f968b0
mov rbx, qword [rsp + 0x48]
mov ecx, dword [rsi + 0x18]
add rcx, rsi
mov r8, rbx
call fcn.164f93ac0
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.165028424
test eax, eax
js 0x164f94369
cmp eax, dword [rbx - 0xc]
jg 0x164f94369
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.164f96530
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x164f94302
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x164e9d7b8.0]
mov rcx, r14
call fcn.164f961b0
jmp 0x164f94311
mov rdx, rax
add rdx, rsi
jne 0x164f942ea
mov r8d, edi
jmp 0x164f942fa
mov r8, rbp
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x164f942f0
mov rcx, r14
call fcn.164f96930
mov rcx, r14
call fcn.164f961b0
jmp 0x164f94311
mov edi, reloc.OLEAUT32.dll_DosDateTimeToVariantTime
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.165015e80
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x164f94346
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x164e9d7b8.0]
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.165001080
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.164e43420
nop
mov ecx, 0x80004005
call fcn.164e43420
nop
mov ecx, 0x80004005
call fcn.164e43420
int3