Function at 0x14007e530
Capabilities:
Check os version
Get storage device properties

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140212c80]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebp, dword [r11 + 8]
mov r14, rdx
xor edi, edi
mov qword [r11 - 0x48], rdi
call fcn.140050400
mov rcx, rax
test rax, rax
je 0x14007e7f4
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400cc851.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov esi, edi
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
mov r8d, ebp
lea rdx, [0x1401e53e0]
lea rcx, [rsp + 0x50]
call fcn.140081330
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [rdi + 3]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov rbp, 0xffffffffffffffff
cmp rax, rbp
jne 0x14007e5fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14007e79a
mov ecx, 0x1001
call fcn.140154a40
mov rsi, rax
test rax, rax
jne 0x14007e615
lea edi, [rax + 8]
jmp 0x14007e791
xor edx, edx
mov r8d, 0x1001
mov rcx, rsi
call fcn.140176680
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rsi
mov r9d, recvfrom
lea r8, [rsp + 0x58]
mov edx, 0x2d1400
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14007e66b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14007e791
mov eax, dword [rsi + 0x18]
test eax, eax
je 0x14007e78c
cmp eax, dword [rsp + 0x40]
jae 0x14007e78c
cmp bl, 6
ja 0x14007e75d
jne 0x14007e698
shr bx, 8
cmp bl, 2
jae 0x14007e75d
mov qword [rsp + 0x48], rdi
call fcn.140050400
mov rcx, rax
test rax, rax
je 0x14007e7ff
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400cc851.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov edx, dword [rsp + 0x40]
sub edx, dword [rsi + 0x18]
js 0x14007e7e9
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x14007e6f1
lea rcx, [rsp + 0x48]
call fcn.140080d00
mov rbx, qword [rsp + 0x48]
mov ecx, dword [rsi + 0x18]
add rcx, rsi
mov r8, rbx
call fcn.14007df40
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1401596e8
test eax, eax
js 0x14007e7e9
cmp eax, dword [rbx - 0xc]
jg 0x14007e7e9
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.140080980
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007e782
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400cc851.0]
mov rcx, r14
call fcn.140080600
jmp 0x14007e791
mov rdx, rax
add rdx, rsi
jne 0x14007e76a
mov r8d, edi
jmp 0x14007e77a
mov r8, rbp
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14007e770
mov rcx, r14
call fcn.140080d80
mov rcx, r14
call fcn.140080600
jmp 0x14007e791
mov edi, recvfrom
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140143670
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x14007e7c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400cc851.0]
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140133600
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140050240
nop
mov ecx, 0x80004005
call fcn.140050240
nop
mov ecx, 0x80004005
call fcn.140050240
int3