Function at 0x14008a4d0
Capabilities:
Check os version
Get storage device properties

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebp, dword [r11 + 8]
mov r14, rdx
xor edi, edi
mov qword [r11 - 0x48], rdi
call fcn.140043c30
mov rcx, rax
test rax, rax
je 0x14008a794
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400a96cf.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov esi, edi
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
mov r8d, ebp
lea rdx, str..PhysicalDrive_u
lea rcx, [rsp + 0x50]
call fcn.14008d230
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [rdi + 3]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov rbp, 0xffffffffffffffff
cmp rax, rbp
jne 0x14008a59b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14008a73a
mov ecx, 0x1001
call fcn.1400c89d0
mov rsi, rax
test rax, rax
jne 0x14008a5b5
lea edi, [rax + 8]
jmp 0x14008a731
xor edx, edx
mov r8d, 0x1001
mov rcx, rsi
call fcn.1400fed10
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rsi
mov r9d, 0xc
lea r8, [rsp + 0x58]
mov edx, 0x2d1400
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14008a60b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14008a731
mov eax, dword [rsi + 0x18]
test eax, eax
je 0x14008a72c
cmp eax, dword [rsp + 0x40]
jae 0x14008a72c
cmp bl, 6
ja 0x14008a6fd
jne 0x14008a638
shr bx, 8
cmp bl, 2
jae 0x14008a6fd
mov qword [rsp + 0x48], rdi
call fcn.140043c30
mov rcx, rax
test rax, rax
je 0x14008a79f
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400a96cf.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov edx, dword [rsp + 0x40]
sub edx, dword [rsi + 0x18]
js 0x14008a789
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x14008a691
lea rcx, [rsp + 0x48]
call fcn.14008cc00
mov rbx, qword [rsp + 0x48]
mov ecx, dword [rsi + 0x18]
add rcx, rsi
mov r8, rbx
call fcn.140089ee0
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400db1c4
test eax, eax
js 0x14008a789
cmp eax, dword [rbx - 0xc]
jg 0x14008a789
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.14008c880
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008a722
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400a96cf.0]
mov rcx, r14
call fcn.14008c500
jmp 0x14008a731
mov rdx, rax
add rdx, rsi
jne 0x14008a70a
mov r8d, edi
jmp 0x14008a71a
mov r8, rbp
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14008a710
mov rcx, r14
call fcn.14008cc80
mov rcx, r14
call fcn.14008c500
jmp 0x14008a731
mov edi, 0xd
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.1400c89e0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x14008a766
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400a96cf.0]
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400b89f0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140043a70
nop
mov ecx, 0x80004005
call fcn.140043a70
nop
mov ecx, 0x80004005
call fcn.140043a70
int3