Function at 0x140001600
Capabilities:
Check os version
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r14
push r15
lea rbp, [rsp - 0x8c8]
sub rsp, 0x9c8
xor edi, edi
mov qword [rcx + 0xd90], 0xffffffffffffffff
mov dword [rcx + 8], edi
lea rax, vtable.awACDReaderModeSPTI.0
mov qword [rcx], rax
mov r14, rcx
mov qword [rcx + 0xda8], rdi
mov r15, rdx
mov qword [rcx + 0xdb0], rdi
mov qword [rcx + 0xdc0], rdi
mov qword [rcx + 0xdc8], rdi
lea rcx, [rbp - 0x80]
mov dword [rdx], 0x80040200
mov dword [rbp - 0x80], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp - 0x70], 2
je 0x14000168b
mov dword [r15], 0x80040210
mov rax, r14
add rsp, 0x9c8
pop r15
pop r14
pop rdi
pop rbp
ret
mov qword [rsp + 0x9c0], rbx
mov qword [rsp + 0x9b8], rsi
mov qword [rsp + 0x9b0], r12
mov qword [rsp + 0x9a8], r13
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r12d, 0x3a
mov dword [rbp + 0x8f0], eax
mov r13d, edi
lea r15d, [r12 + 0x22]
bt eax, r13d
jae 0x140001abb
lea esi, [r13 + 0x41]
mov dword [rsp + 0x42], 0x5c003a
movsx ebx, sil
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], bx
mov word [rsp + 0x46], di
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x140001ab5
mov qword [rsp + 0x30], rdi
lea r8d, [rax - 2]
mov dword [rsp + 0x28], edi
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
mov dword [rsp + 0x40], 0x5c005c
mov dword [rsp + 0x44], 0x5c002e
mov word [rsp + 0x48], bx
mov dword [rsp + 0x4a], 0x3a
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 0xd90], rax
cmp rax, 0xffffffffffffffff
je 0x140001b0a
mov qword [rsp + 0x38], rdi
lea rcx, [rbp + 0x900]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov edx, 0x41010
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [r14 + 0xd90]
test eax, eax
jne 0x1400017a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001aaa
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x900]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x908]
lea rax, [rbp + 0x908]
mov dword [rsp + 0x28], 8
mov r9d, 8
mov qword [rsp + 0x20], rax
mov edx, 0x41018
mov dword [rbp + 0x908], 8
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400017fd
mov rcx, qword [r14 + 0xd90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001aaa
movsxd rax, dword [r14 + 8]
lea r15, [r14 + 0xc]
imul rcx, rax, 0x6c
add r15, rcx
mov word [r15], bx
movups xmm0, xmmword [str.:__SPTI]
movups xmmword [r15 + 2], xmm0
movzx eax, word [0x14012bbd0]
mov word [r15 + 0x12], ax
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [r15 + rax*2 + 2], di
jne 0x140001830
movzx edx, byte [rbp + 0x90d]
cdqe
inc rax
lea rcx, [r15 + rax*2]
call fcn.140027f40
mov ebx, 0x2d
mov word [rax], bx
lea rcx, [rax + 2]
movzx edx, byte [rbp + 0x90e]
call fcn.140027f40
mov word [rax], bx
lea rcx, [rax + 2]
movzx edx, byte [rbp + 0x90f]
call fcn.140027f40
mov rbx, rax
mov r8d, 0x800
mov dword [rax], 0x20003e
mov word [rax + 4], di
mov byte [r15 + 0x6b], sil
movzx ecx, byte [rbp + 0x90d]
mov byte [r15 + 0x68], cl
movzx ecx, byte [rbp + 0x90e]
mov byte [r15 + 0x69], cl
movzx ecx, byte [rbp + 0x90f]
mov byte [r15 + 0x6a], cl
mov ecx, dword [rsp + 0x68]
dec ecx
shl ecx, 0xc
cmp dword [rsp + 0x64], ecx
cmovb ecx, dword [rsp + 0x64]
xor edx, edx
mov dword [r15 + 0x60], ecx
lea rcx, [rbp + 0xa0]
mov eax, dword [rsp + 0x70]
mov dword [r15 + 0x64], eax
call fcn.1400ba240
mov rcx, qword [r14 + 0xd90]
lea rax, [rbp + 0x900]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rbp + 0xa0]
mov dword [rsp + 0x28], 0x800
mov edx, 0x4100c
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140001a93
movzx r12d, byte [rbp + 0xa0]
mov r15d, edi
test r12d, r12d
je 0x140001a8d
movzx r9d, byte [rbp + 0x90f]
lea rsi, [rbp + 0xa4]
movzx r10d, byte [rbp + 0x90e]
movzx r11d, byte [rbp + 0x90d]
mov eax, dword [rsi + 4]
mov edx, edi
movzx r8d, byte [rsi]
lea rax, [rbp + rax + 0xa0]
test r8d, r8d
je 0x140001999
nop dword [rax]
cmp byte [rax], r11b
jne 0x140001981
cmp byte [rax + 1], r10b
jne 0x140001981
cmp byte [rax + 2], r9b
je 0x1400019aa
mov ecx, dword [rax + 8]
test ecx, ecx
je 0x140001999
lea rax, [rbp + 0xa0]
inc edx
add rax, rcx
cmp edx, r8d
jl 0x140001970
inc r15d
add rsi, 8
cmp r15d, r12d
jl 0x140001957
jmp 0x140001a8d
movzx ecx, byte [rax + 0x14]
mov word [rbx + 4], cx
movzx ecx, byte [rax + 0x15]
mov word [rbx + 6], cx
movzx ecx, byte [rax + 0x16]
mov word [rbx + 8], cx
movzx ecx, byte [rax + 0x17]
mov word [rbx + 0xa], cx
movzx ecx, byte [rax + 0x18]
mov word [rbx + 0xc], cx
movzx ecx, byte [rax + 0x19]
mov word [rbx + 0xe], cx
movzx ecx, byte [rax + 0x1a]
mov word [rbx + 0x10], cx
movzx ecx, byte [rax + 0x1b]
mov word [rbx + 0x12], cx
movzx ecx, byte [rax + 0x1c]
mov word [rbx + 0x14], cx
movzx ecx, byte [rax + 0x1d]
mov word [rbx + 0x16], cx
movzx ecx, byte [rax + 0x1e]
mov word [rbx + 0x18], cx
movzx ecx, byte [rax + 0x1f]
mov word [rbx + 0x1a], cx
movzx ecx, byte [rax + 0x20]
mov word [rbx + 0x1c], cx
movzx ecx, byte [rax + 0x21]
mov word [rbx + 0x1e], cx
movzx ecx, byte [rax + 0x22]
mov word [rbx + 0x20], cx
movzx ecx, byte [rax + 0x23]
mov word [rbx + 0x22], cx
movzx ecx, byte [rax + 0x24]
mov word [rbx + 0x24], cx
movzx ecx, byte [rax + 0x25]
mov word [rbx + 0x26], cx
movzx ecx, byte [rax + 0x26]
mov word [rbx + 0x28], cx
movzx ecx, byte [rax + 0x27]
mov word [rbx + 0x2a], cx
movzx ecx, byte [rax + 0x28]
mov word [rbx + 0x2c], cx
movzx ecx, byte [rax + 0x29]
mov word [rbx + 0x2e], cx
movzx ecx, byte [rax + 0x2a]
mov word [rbx + 0x30], cx
movzx ecx, byte [rax + 0x2b]
mov word [rbx + 0x32], cx
mov word [rbx + 0x34], di
sub rbx, 0xffffffffffffffce
cmp word [rbx], 0x20
jne 0x140001a8d
nop dword [rax + rax]
mov word [rbx], di
lea rbx, [rbx - 2]
cmp word [rbx], 0x20
je 0x140001a80
mov r12d, 0x3a
inc dword [r14 + 8]
mov rcx, qword [r14 + 0xd90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, 0x5c
mov qword [r14 + 0xd90], 0xffffffffffffffff
mov eax, dword [rbp + 0x8f0]
inc r13d
cmp r13d, 0x20
jl 0x1400016c5
cmp dword [r14 + 8], edi
mov rax, qword [rbp + 0x8f8]
sete dil
mov dword [rax], edi
mov r12, qword [rsp + 0x9b0]
mov rax, r14
mov rsi, qword [rsp + 0x9b8]
mov rbx, qword [rsp + 0x9c0]
mov r13, qword [rsp + 0x9a8]
add rsp, 0x9c8
pop r15
pop r14
pop rdi
pop rbp
ret
mov rax, qword [rbp + 0x8f8]
mov dword [rax], 0x80040203
jmp 0x140001ad9
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0xdd8
call fcn.1400b6058
test rax, rax
je 0x140003db8
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x140001600
add rsp, 0x20
pop rbx
ret