Function at 0x14000bee5
Capabilities:
Get disk information
Get disk information via ioctl
Read file on windows

Disassembly:
push r15
mov eax, 0x1198
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140076d90
sub rsp, rax
movabs rax, 0xef0e0c0b07060401
mov qword [rsp + 0x88], rax
mov esi, ecx
xor eax, eax
test rdx, rdx
mov ecx, 0x40
mov r12, rdx
mov r13d, r8d
mov ebx, r9d
lea rdi, [rsp + 0x90]
lea rbp, [rsp + 0x190]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x190]
mov ecx, 0x400
rep stosd dword [rdi], eax
je 0x14000c076
lea r8, [0x1400ce268]
mov ecx, 0x20
xor r14d, r14d
xor r9d, r9d
mov rdi, r8
mov dword [0x1400ce260], r14d
mov r8d, 1
rep stosd dword [rdi], eax
mov ecx, 0x20
rep stosd dword [rdi], eax
mov byte [rdx], 0
mov ecx, esi
xor edx, edx
call fcn.140007e51
mov rdi, rax
test rax, rax
jne 0x14000bf9f
test ebx, ebx
jne 0x14000bfcb
mov edx, esi
lea rcx, str.No_volume_information_for_drive_0x_02x
call fcn.1400380b9
jmp 0x14000bfcb
mov dword [rsp + 0x38], r13d
xor r13d, r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], r12
mov rcx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x14000bf8b
mov rcx, rdi
call sub.msvcrt.dll_free
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov ecx, esi
call fcn.140007c6c
mov qword [rsp + 0x48], rax
inc rax
je 0x14000c076
xor edi, edi
lea r13, [rsp + 0x84]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
mov edx, 0x700a0
mov qword [rsp + 0x30], r13
mov rdi, qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
je 0x14000c043
cmp dword [rsp + 0x84], 0
jne 0x14000c081
test ebx, ebx
jne 0x14000c05d
call fcn.140038579
mov edx, esi
lea rcx, str.Could_not_get_geometry_for_drive_0x_02x:__s
mov r8, rax
call fcn.1400380b9
mov rax, qword [rsp + 0x48]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000c076
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ebx, ebx
mov dword [rsp + 0x54], ebx
jmp 0x14000c82b
mov rax, qword [rsp + 0xa8]
mov r8d, dword [rsp + 0xa4]
mov dword [0x1400ce254], 0xffffffff
mov qword [0x1400ce240], rax
mov dword [0x1400ce250], r8d
cmp r8d, 0x1ff
ja 0x14000c0ce
test ebx, ebx
jne 0x14000c0c4
mov edx, esi
lea rcx, str.Warning:_Drive_0x_02x_reports_a_sector_size_of__d___Correcting_to_512_bytes.
call fcn.1400380b9
mov dword [0x1400ce250], 0x200
mov eax, dword [rsp + 0xa0]
mov dword [0x1400ce24c], eax
mov eax, dword [rsp + 0x98]
mov dword [0x1400ce258], eax
test ebx, ebx
jne 0x14000c15d
mov r9d, dword [0x1400ce250]
mov rcx, qword [0x1400ce240]
xor edx, edx
mov r8d, 1
mov dword [rsp + 0x54], r9d
call fcn.1400389a1
cmp dword [0x1400ce258], 0xc
lea rdx, str.Removable
mov r9d, dword [rsp + 0x54]
mov r8, rax
lea rax, str.FIXED
lea rcx, str.Disk_type:__s__Disk_size:__s__Sector_size:__d_bytes
cmove rdx, rax
call fcn.1400380b9
mov r9d, dword [rsp + 0xa0]
mov r8d, dword [rsp + 0x9c]
lea rcx, str.Cylinders:__I64i__Tracks_per_cylinder:__d__Sectors_per_track:__d
mov rdx, qword [rsp + 0x90]
call fcn.1400380b9
xor r11d, r11d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r11
mov rcx, qword [rsp + 0x48]
mov edx, 0x70050
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rbp
call rdi
test eax, eax
je 0x14000c197
cmp dword [rsp + 0x84], 0
jne 0x14000c1b5
test ebx, ebx
jne 0x14000c05d
call fcn.140038579
mov edx, esi
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov r8, rax
jmp 0x14000c058
mov esi, dword [rsp + 0x190]
test esi, esi
je 0x14000c1cd
dec esi
je 0x14000c56e
jmp 0x14000c7de
xor r10d, r10d
mov r8d, dword [rsp + 0x194]
xor edx, edx
xor ecx, ecx
mov dword [0x1400ce25c], r10d
mov eax, dword [0x1400ce260]
cmp r8d, edx
je 0x14000c203
cmp byte [rbp + 0x50], 0
je 0x14000c1f8
inc eax
mov cl, 1
inc edx
add rbp, 0x90
jmp 0x14000c1e9
test cl, cl
je 0x14000c20d
mov dword [0x1400ce260], eax
cmp byte [rsp + 0x1e0], 0
je 0x14000c246
cmp qword [rsp + 0x1c8], 0
jne 0x14000c246
test ebx, ebx
je 0x14000c231
mov r15d, 1
jmp 0x14000c2b3
mov rdx, qword [str.Super_Floppy_Disk]
lea rcx, str.Partition_type:_SFD___s__or_unpartitioned
call fcn.1400380b9
jmp 0x14000c226
test ebx, ebx
jne 0x14000c25c
mov edx, dword [0x1400ce260]
lea rcx, str.Partition_type:_MBR__NB_Partitions:__d
call fcn.1400380b9
mov edx, dword [rsp + 0x198]
xor eax, eax
cmp edx, 0x49464555
sete al
mov dword [0x1400ce380], eax
test ebx, ebx
jne 0x14000c29c
cmp edx, 0x49464555
lea r8, [0x140088d40]
lea rax, str._UEFI_target_
cmove r8, rax
lea rcx, str.Disk_ID:_0x_08X__s
call fcn.1400380b9
mov rcx, qword [rsp + 0x48]
mov r8d, ebx
lea rdx, [0x140089c13]
xor r15d, r15d
call fcn.140009d76
mov eax, r15d
xor r9d, r9d
xor eax, 1
mov dword [rsp + 0x54], r9d
mov dword [rsp + 0x68], eax
mov eax, r15d
xor eax, 1
mov byte [rsp + 0x70], al
cmp esi, dword [rsp + 0x194]
jae 0x14000c800
mov ebp, esi
imul rax, rbp, 0x90
movzx edi, byte [rsp + rax + 0x1e0]
test dil, dil
je 0x14000c567
cmp dil, 4
jne 0x14000c317
test r15d, r15d
je 0x14000c317
cmp qword [0x1400ce240], 0x1000000
jle 0x14000c81b
jmp 0x14000c800
cmp dil, 0xef
jne 0x14000c81b
mov ecx, dword [0x1400ce250]
mov edx, 1
call sub.msvcrt.dll_calloc
mov r13, rax
test rax, rax
je 0x14000c81b
imul rax, rbp, 0x90
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + rax + 0x1c8]
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
jne 0x14000c366
xor r14d, r14d
jmp 0x14000c3ae
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x84]
mov rdx, r13
mov qword [rsp + 0x20], r8
mov r8d, dword [0x1400ce250]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x14000c361
lea rcx, [r13 + 0x2b]
mov r8d, 9
lea rdx, str.UEFI_NTFS
xor r14d, r14d
call sub.msvcrt.dll_strncmp
test eax, eax
sete r14b
mov rcx, r13
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x14000c3e3
lea r8, str.__UEFI:NTFS_
test r14d, r14d
jne 0x14000c3d0
xor r14d, r14d
lea r8, [0x140088d40]
mov eax, dword [rsp + 0x68]
lea rcx, str.Partition__d_s:
lea edx, [rax + rsi]
call fcn.1400380b9
xor eax, eax
lea rdx, [rsp + 0x88]
cmp dil, byte [rax + rdx]
je 0x14000c3fe
inc rax
cmp rax, 8
jne 0x14000c3ed
jmp 0x14000c406
mov dword [rsp + 0x54], 1
imul rcx, rbp, 0x90
mov rax, qword [rsp + rcx + 0x1c8]
cmp esi, 0xf
ja 0x14000c436
mov rcx, qword [rsp + rcx + 0x1d0]
lea rdx, [0x1400ce240]
mov qword [rdx + rbp*8 + 0x28], rax
mov qword [rdx + rbp*8 + 0xa8], rcx
test ebx, ebx
jne 0x14000c519
imul rbp, rbp, 0x90
mov ecx, dword [0x1400ce250]
mov r9d, esi
lea rdx, [0x140089a93]
lea r13, [0x140089a97]
cmp byte [rsp + rbp + 0x1e1], 0
cmovne r13, rdx
imul r9, r9, 0x90
cqo
xor r8d, r8d
idiv rcx
mov qword [rsp + 0x78], r9
mov edx, 1
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + r9 + 0x1d0]
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.1400389a1
mov r9, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
mov rbp, rax
mov rdx, qword [rsp + r9 + 0x1c8]
call fcn.14000a035
xor r8d, r8d
test r15d, r15d
cmove r8d, edi
mov r9, rax
cmp dil, 7
je 0x14000c4cf
cmp byte [rsp + 0x70], 0
jne 0x14000c4d9
cmp byte [r12], 0
mov rdx, r12
jne 0x14000c4ef
movzx ecx, dil
mov dword [rsp + 0x78], r8d
call fcn.14000be5a
mov r8d, dword [rsp + 0x78]
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], r13
lea rcx, str.__Type:__s__0x_02x__r_n__Detected_File_System:__s_r_n__Size:__s___lld_bytes__r_n__Start_Sector:__lld__Boot:__s
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
call fcn.1400380b9
mov eax, esi
mov ecx, dword [0x1400ce250]
imul rax, rax, 0x90
mov rax, qword [rsp + rax + 0x1c8]
cqo
idiv rcx
mov edx, dword [0x1400ce254]
cmp edx, eax
cmova edx, eax
mov dword [0x1400ce254], edx
cmp dil, 0xea
je 0x14000c551
test r14d, r14d
je 0x14000c557
dec dword [0x1400ce260]
cmp dil, 0xee
jne 0x14000c567
mov dword [0x1400ce37c], 1
inc esi
jmp 0x14000c2cf
mov dword [0x1400ce25c], 1
test ebx, ebx
jne 0x14000c5d3
mov edx, dword [rsp + 0x194]
lea rcx, str.Partition_type:_GPT__NB_Partitions:__d
call fcn.1400380b9
lea rcx, [rsp + 0x198]
mov edx, 1
call fcn.140038883
lea rcx, str.Disk_GUID:__s
mov rdx, rax
call fcn.1400380b9
mov r9, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1a8]
lea rcx, str.Max_parts:__d__Start_Offset:__I64i__Usable___I64i_bytes
mov edx, dword [rsp + 0x1b8]
call fcn.1400380b9
xor ecx, ecx
xor edi, edi
lea r14, [0x1400ce240]
mov dword [rsp + 0x54], ecx
cmp edi, dword [rsp + 0x194]
jae 0x14000c800
cmp edi, 0xf
mov esi, edi
ja 0x14000c61a
imul rax, rsi, 0x90
mov rdx, qword [rsp + rax + 0x1c8]
mov rax, qword [rsp + rax + 0x1d0]
mov qword [r14 + rsi*8 + 0x28], rdx
mov qword [r14 + rsi*8 + 0xa8], rax
imul r13, rsi, 0x90
lea rdx, [0x140089818]
inc dword [0x1400ce260]
lea r15, [rbp + r13 + 0x78]
mov rcx, r15
call sub.msvcrt.dll_wcscmp
mov r12d, eax
lea rax, [rbp + r13 + 0x50]
mov qword [rsp + 0x58], rax
test ebx, ebx
jne 0x14000c67b
mov rcx, rax
call fcn.14000be8c
test r12d, r12d
lea edx, [rdi + 1]
lea r8, str.__UEFI:NTFS_
mov r9, rax
lea rax, [0x140088d40]
lea rcx, str.Partition__d_s:_r_n__Type:__s
cmovne r8, rax
call fcn.1400380b9
imul rax, rsi, 0x90
cmp word [rsp + rax + 0x208], 0
je 0x14000c6a6
test ebx, ebx
jne 0x14000c754
mov rdx, r15
lea rcx, str.__Name:__S
call fcn.1400380b9
jmp 0x14000c6ae
test ebx, ebx
jne 0x14000c754
imul r15, rsi, 0x90
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + r15 + 0x1c8]
call fcn.14000a035
lea rcx, str.__Detected_File_System:__s
mov rdx, rax
call fcn.1400380b9
mov rax, qword [rsp + r15 + 0x1c8]
mov ecx, dword [0x1400ce250]
xor r8d, r8d
mov r10, qword [rsp + r15 + 0x200]
cqo
idiv rcx
mov rcx, qword [rsp + r15 + 0x1d0]
mov qword [rsp + 0x70], r10
mov edx, 1
mov qword [rsp + 0x60], rax
call fcn.1400389a1
lea rcx, [rbp + r13 + 0x60]
mov edx, 1
mov qword [rsp + 0x68], rax
call fcn.140038883
mov r10, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
lea rcx, str.__ID:__s_r_n__Size:__s___I64i_bytes__r_n__Start_Sector:__I64i__Attributes:_0x_016I64X
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + r15 + 0x1d0]
call fcn.1400380b9
imul rsi, rsi, 0x90
mov ecx, dword [0x1400ce250]
mov rax, qword [rsp + rsi + 0x1c8]
cqo
idiv rcx
mov edx, dword [0x1400ce254]
cmp edx, eax
cmova edx, eax
mov dword [0x1400ce254], edx
test r12d, r12d
jne 0x14000c78c
dec dword [0x1400ce260]
jmp 0x14000c7b6
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400bd480]
call fcn.140037544
test eax, eax
jne 0x14000c784
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400bd2d0]
call fcn.140037544
test eax, eax
jne 0x14000c784
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400bd440]
call fcn.140037544
test eax, eax
mov eax, 1
cmove eax, dword [rsp + 0x54]
inc edi
mov dword [rsp + 0x54], eax
jmp 0x14000c5e2
xor edx, edx
mov dword [0x1400ce25c], edx
test ebx, ebx
je 0x14000c7f2
xor eax, eax
mov dword [rsp + 0x54], eax
jmp 0x14000c800
lea rcx, str.Partition_type:_RAW
call fcn.1400380b9
jmp 0x14000c7ea
mov rax, qword [rsp + 0x48]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000c82b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14000c82b
xor r14d, r14d
test ebx, ebx
jne 0x14000c3e3
jmp 0x14000c3c6
mov eax, dword [rsp + 0x54]
add rsp, 0x1198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret