Function at 0x14005a310
Capabilities:
Get disk information
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x240], esi
xor dil, dil
mov dword [rbp + 0x248], edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rbp + 0x258], eax
lea rcx, str.FAT32
mov qword [rbp - 0x58], rcx
mov dword [rbp - 0x50], 0x52
mov dword [rbp - 0x4c], 0x43
lea rcx, [0x1400a9f6c]
mov qword [rbp - 0x48], rcx
mov dword [rbp - 0x40], 0x36
mov dword [rbp - 0x3c], 0x27
lea rcx, str.NTFS
mov qword [rbp - 0x38], rcx
mov dword [rbp - 0x30], 3
mov dword [rbp - 0x2c], 0x48
mov ebx, esi
mov dword [rbp + 0x250], ebx
lea r15d, [rsi + 1]
bt eax, ebx
jae 0x14005a876
lea eax, [rbx + 0x41]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r15
mov word [rsp + 0x60], ax
mov word [rsp + 0x62], si
mov r9d, 4
lea r8, str.._
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14005fcd0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
or r14d, 1
mov r8, r15
lea rdx, [0x1400a9f78]
lea rcx, [rsp + 0x40]
call fcn.1400272a0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
or r14d, 2
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14005a49c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a497
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a8ab
call fcn.14007bbb4
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14005a4f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a4ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a8b1
call fcn.14007bbb4
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14005a834
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x60]
mov r8d, 0x200
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005a82a
mov edi, esi
mov r12, rsi
lea rbx, [rbp - 0x50]
mov rcx, qword [rbx - 8]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x14005a570
mov eax, dword [rbx]
lea rdx, [rbp - 0x10]
add rdx, rax
call fcn.140086930
test eax, eax
je 0x14005a59a
inc edi
inc r12
add rbx, 0x10
cmp edi, 3
jl 0x14005a560
cmp edi, 3
jge 0x14005a81e
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r15d, esi
nop
mov edx, 9
xor ecx, ecx
call fcn.1400097e0
mov ecx, eax
lea r9, [rbp - 0x13]
test eax, eax
jns 0x14005a620
neg ecx
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r9], cl
mov ecx, edx
test edx, edx
jne 0x14005a5e0
dec r9
mov byte [r9], 0x2d
jmp 0x14005a649
dec r9
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r9], cl
mov ecx, edx
test edx, edx
jne 0x14005a620
mov qword [rsp + 0x60], rsi
mov rdi, rsi
mov qword [rsp + 0x70], rsi
mov esi, 0xf
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x60], 0
lea rax, [rbp - 0x13]
cmp r9, rax
je 0x14005a68c
lea r8, [rbp - 0x13]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.140027420
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
or r14d, 0xc
mov dword [rbp + 0x240], r14d
lea r9, [rsp + 0x60]
mov r14, qword [rsp + 0x60]
cmp rsi, 0x10
cmovae r9, r14
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x14005a6ed
lea rax, [rcx + rdi]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.14007dab0
mov byte [rbx + rdi], 0
jmp 0x14005a70c
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14000b710
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x60]
cmp rsi, 0x10
jb 0x14005a743
lea rdx, [rsi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14005a73b
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a8b7
mov rcx, r14
call fcn.14007bbb4
inc r15d
cmp r15d, 8
mov r14d, dword [rbp + 0x240]
mov esi, 0
jl 0x14005a5c0
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
add r12, r12
mov ecx, dword [rbp + r12*8 - 0x4c]
mov eax, dword [rax]
mov dword [rbp + rcx - 0x10], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14005a7cc
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x5c]
mov r8d, 0x200
lea rdx, [rbp - 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [rbp + 0x248]
movzx edi, dil
cmp eax, 1
mov r15d, 1
cmove edi, r15d
mov dword [rbp + 0x248], edi
jmp 0x14005a7d8
mov edi, dword [rbp + 0x248]
mov r15d, 1
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14005a815
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a810
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a89f
call fcn.14007bbb4
mov r14d, dword [rbp + 0x240]
jmp 0x14005a824
mov edi, dword [rbp + 0x248]
mov ebx, dword [rbp + 0x250]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14005a870
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a86b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a8a5
call fcn.14007bbb4
mov eax, dword [rbp + 0x258]
inc ebx
mov dword [rbp + 0x250], ebx
cmp ebx, 0x20
jl 0x14005a3a3
movzx eax, dil
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140082148
nop
call fcn.140082148
nop
call fcn.140082148
nop
call fcn.140082148
nop
call fcn.140082148
int3