Function at 0x140088c60
Capabilities:
Check os version
Get storage device properties

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebp, dword [r11 + 8]
mov r14, rdx
xor edi, edi
mov qword [r11 - 0x48], rdi
call fcn.140053b50
mov rcx, rax
test rax, rax
je 0x140088f24
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400cd6b1.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov esi, edi
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
mov r8d, ebp
lea rdx, str..PhysicalDrive_u
lea rcx, [rsp + 0x50]
call fcn.14008ba60
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [rdi + 3]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov rbp, 0xffffffffffffffff
cmp rax, rbp
jne 0x140088d2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140088eca
mov ecx, 0x1001
call fcn.140179010
mov rsi, rax
test rax, rax
jne 0x140088d45
lea edi, [rax + 8]
jmp 0x140088ec1
xor edx, edx
mov r8d, 0x1001
mov rcx, rsi
call fcn.14019b380
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rsi
mov r9d, recvfrom
lea r8, [rsp + 0x58]
mov edx, 0x2d1400
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140088d9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140088ec1
mov eax, dword [rsi + 0x18]
test eax, eax
je 0x140088ebc
cmp eax, dword [rsp + 0x40]
jae 0x140088ebc
cmp bl, 6
ja 0x140088e8d
jne 0x140088dc8
shr bx, 8
cmp bl, 2
jae 0x140088e8d
mov qword [rsp + 0x48], rdi
call fcn.140053b50
mov rcx, rax
test rax, rax
je 0x140088f2f
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400cd6b1.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov edx, dword [rsp + 0x40]
sub edx, dword [rsi + 0x18]
js 0x140088f19
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140088e21
lea rcx, [rsp + 0x48]
call fcn.14008b430
mov rbx, qword [rsp + 0x48]
mov ecx, dword [rsi + 0x18]
add rcx, rsi
mov r8, rbx
call fcn.140088670
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14017e144
test eax, eax
js 0x140088f19
cmp eax, dword [rbx - 0xc]
jg 0x140088f19
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.14008b0b0
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140088eb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400cd6b1.0]
mov rcx, r14
call fcn.14008ad30
jmp 0x140088ec1
mov rdx, rax
add rdx, rsi
jne 0x140088e9a
mov r8d, edi
jmp 0x140088eaa
mov r8, rbp
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140088ea0
mov rcx, r14
call fcn.14008b4b0
mov rcx, r14
call fcn.14008ad30
jmp 0x140088ec1
mov edi, recvfrom
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140167c30
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x140088ef6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400cd6b1.0]
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140144310
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140053990
nop
mov ecx, 0x80004005
call fcn.140053990
nop
mov ecx, 0x80004005
call fcn.140053990
int3