Function at 0x41d810
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x408
mov eax, dword [0x42c008]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
push edi
push 0x90
xor edi, edi
lea eax, [esp + 0x68]
mov esi, ecx
push edi
push eax
mov dword [esp + 0x20], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x60], 0x94
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x70], 2
jne 0x41dadf
push dword [esi]
lea eax, [esp + 0xfc]
push str..PhysicalDrive_d
push eax
call fcn.00401410
add esp, 0xc
lea eax, [esp + 0xf8]
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x41d9b1
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edi
push ecx
push 0x18
lea ecx, [esp + 0x4c]
xorps xmm0, xmm0
push ecx
push edi
push edi
push 0x74080
push eax
movaps xmmword [esp + 0x60], xmm0
movq qword [esp + 0x70], xmm0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41d9a7
mov al, byte [esp + 0x43]
mov byte [esp + 0xb], al
test al, al
je 0x41d9a7
push 0x210
xorps xmm0, xmm0
mov byte [esp + 0x2b], 0
lea eax, [esp + 0x1fc]
movlpd qword [esp + 0x2d], xmm0
push edi
push eax
movlpd qword [esp + 0x3d], xmm0
mov dword [esp + 0x45], edi
call sub.VCRUNTIME140.dll_memset
mov cl, byte [esi]
add esp, 0xc
mov al, cl
mov dword [esp + 0x20], 0x10100
and al, 1
mov byte [esp + 0x24], 0
or al, 0xfa
mov byte [esp + 0x28], cl
shl al, 4
mov byte [esp + 0x25], al
mov al, byte [esp + 0xb]
shr al, cl
and al, 0x10
mov dword [esp + 0x1c], 0x200
neg al
push edi
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x2a], al
lea eax, [esp + 0x14]
push eax
push 0x210
lea eax, [esp + 0x204]
push eax
push 0x20
lea eax, [esp + 0x30]
push eax
push 0x7c088
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41d9a7
xor ecx, ecx
lea edx, [esi + 4]
movzx eax, word [esp + ecx*2 + 0x208]
lea edx, [edx + 4]
inc ecx
mov dword [edx - 4], eax
cmp ecx, 0x100
jl 0x41d984
mov ecx, esi
call fcn.0041ce50
mov edi, 1
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x41daf6
mov ecx, esi
call fcn.0041d4c0
test eax, eax
jne 0x41daf8
mov ecx, esi
call fcn.0041d060
test eax, eax
jne 0x41daf8
push dword [esi]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xfc]
push str..PhysicalDrive_d
push eax
call fcn.00401410
add esp, 0xc
lea eax, [esp + 0xf8]
push edi
push edi
push 3
push edi
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x41dac7
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], edi
push ecx
push 0x18
lea ecx, [esp + 0x4c]
xorps xmm0, xmm0
push ecx
push edi
push edi
push 0x74080
push eax
movaps xmmword [esp + 0x60], xmm0
movq qword [esp + 0x70], xmm0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41dac7
push 0x221
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov edi, eax
lea eax, [esp + 0x14]
push 0
push eax
push 0x221
push edi
push 0x21
push edi
push 0x7c088
push dword [esp + 0x28]
mov byte [edi + 0xa], 0xec
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41dab3
xor edx, edx
lea ecx, [esi + 4]
nop
movzx eax, word [edi + edx*2 + 0x10]
lea ecx, [ecx + 4]
inc edx
mov dword [ecx - 4], eax
cmp edx, 0x100
jl 0x41da90
mov ecx, esi
call fcn.0041ce50
mov dword [esp + 0x10], 1
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0041e5ae
mov esp, ebp
pop ebp
ret
xor esi, esi
test edi, edi
jne 0x41daf6
mov ecx, dword [esp + 0x14]
call fcn.0041d2a0
inc esi
mov edi, eax
cmp esi, 0xa
jl 0x41dae1
mov eax, edi
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
xor ecx, esp
call fcn.0041e5ae
mov esp, ebp
pop ebp
ret