Function at 0x14000a94e
Capabilities:
Get disk information via ioctl
Read file on windows

Disassembly:
push r15
mov eax, 0x12c8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140076d90
sub rsp, rax
xor eax, eax
lea rsi, str._vFAT
mov dword [rsp + 0x1310], ecx
test rdx, rdx
mov ecx, 0x400
lea rdi, [rsp + 0x2c0]
rep stosd dword [rdi], eax
mov dword [rsp + 0x78], 0x5c3a53
mov ecx, 9
mov rbp, rdx
lea rdi, [rsp + 0x9c]
rep movsd dword [rdi], dword [rsi]
lea rsi, [rsp + 0x2c0]
jne 0x14000a9ca
mov rax, qword [0x1400b4480]
cmp dword [rax], 0x9f
ja 0x14000a9ca
lea rcx, str.ESP_toggling_is_only_available_for_Windows_10_or_later
call fcn.1400380b9
jmp 0x14000a9ee
mov ecx, dword [rsp + 0x1310]
xor edx, edx
mov r9d, 1
mov r8d, 1
call fcn.140007c6c
mov qword [rsp + 0x40], rax
inc rax
jne 0x14000a9f5
xor ebx, ebx
jmp 0x14000b067
xor ebx, ebx
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x40]
mov edx, 0x70050
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x14000aa39
cmp dword [rsp + 0x70], 0
jne 0x14000aa59
call fcn.140038579
mov edx, dword [rsp + 0x1310]
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov r8, rax
call fcn.1400380b9
jmp 0x14000ab81
mov edx, dword [rsp + 0x2c4]
test rbp, rbp
je 0x14000aa6f
mov rax, rsi
xor ebx, ebx
jmp 0x14000accd
lea r13, [rsp + 0x310]
xor ebx, ebx
lea rdi, [0x1400bd2d0]
cmp dword [rsp + 0x2c4], ebx
jle 0x14000aabb
mov eax, dword [rsp + 0x2c0]
test eax, eax
jne 0x14000aaa6
cmp byte [r13], 0xef
je 0x14000aae4
inc ebx
add r13, 0x90
jmp 0x14000aa80
dec eax
jne 0x14000aa9b
mov rdx, rdi
mov rcx, r13
call fcn.140037544
test eax, eax
je 0x14000aa9b
jmp 0x14000aae4
mov rax, qword [sym.imp.msvcrt.dll__snprintf]
xor r14d, r14d
xor edi, edi
or ebx, 0xffffffff
movabs r15, 0x3bc93ec9a0004bba
mov r13d, 1
mov qword [rsp + 0x48], rax
jmp 0x14000abec
cmp dword [rsp + 0x2c0], 1
movsxd rdi, ebx
jne 0x14000ae9a
imul rdi, rdi, 0x90
lea rcx, str.ESP_name:__S
lea rdx, [rsi + rdi + 0x78]
lea r13, [rsi + rdi + 0x60]
call fcn.1400380b9
mov r15, qword [sym.imp.msvcrt.dll__snprintf]
mov r14d, 1
lea rdi, [rsp + 0xc0]
lea r8, str.ToggleEsp_02u
mov rcx, rdi
mov r9d, r14d
mov edx, 0x10
call r15
mov rcx, rdi
mov byte [rsp + 0xcf], 0
call fcn.140007a43
test rax, rax
jne 0x14000aed1
mov edx, 1
mov rcx, r13
call fcn.140038883
mov rcx, rdi
mov rdx, rax
call fcn.140007728
test eax, eax
jne 0x14000ad34
lea rcx, str.ESP_toggling_data_could_not_be_stored
call fcn.1400380b9
xor ebx, ebx
jmp 0x14000ae78
test ebx, ebx
jns 0x14000abd7
mov eax, dword [rsp + 0x2c0]
cmp eax, 1
jne 0x14000ac48
mov r14, r8
mov rdx, r14
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rcx
call fcn.140037544
mov rcx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
test eax, eax
jne 0x14000ac7c
inc r12d
add r8, 0x90
cmp dword [rsp + 0x2c4], r12d
jg 0x14000ab88
inc r13d
cmp r13d, 8
jg 0x14000ad24
test ebx, ebx
jns 0x14000ad74
lea rcx, [rsp + 0xc0]
mov r9d, r13d
mov edx, 0x10
mov rax, qword [rsp + 0x48]
lea r8, str.ToggleEsp_02u
mov qword [rsp + 0x58], rcx
call rax
mov rcx, qword [rsp + 0x58]
mov byte [rsp + 0xcf], 0
call fcn.140007a43
mov rcx, rax
call fcn.140038922
mov rcx, rax
test rax, rax
je 0x14000abd7
lea rax, [rsp + 0x7c]
lea r8, [rsp + 0x320]
xor r12d, r12d
mov qword [rsp + 0x58], rax
jmp 0x14000abcd
test eax, eax
jne 0x14000ab9f
mov eax, dword [rsp + 0x2c8]
xor r9d, r9d
mov r14, qword [rsp + 0x58]
mov dword [rsp + 0x80], r9d
mov dword [rsp + 0x7c], eax
mov rax, qword [r8 - 0x28]
mov qword [rsp + 0x84], rax
jmp 0x14000ab9f
mov eax, dword [rsp + 0x2c0]
cmp eax, 1
jne 0x14000aca4
mov dword [r8 - 0x10], 0xc12a7328
mov word [r8 - 0xc], 0xf81f
mov word [r8 - 0xa], 0x11d2
mov qword [r8 - 8], r15
jmp 0x14000aca8
test eax, eax
je 0x14000acb5
mov ebx, r12d
mov edi, 1
jmp 0x14000abc3
mov byte [r8 - 0x10], 0xef
jmp 0x14000aca8
mov rcx, qword [rax + 0x38]
add rax, 0x90
cmp rcx, rbp
je 0x14000acd3
inc ebx
cmp ebx, edx
jl 0x14000acbc
jmp 0x14000ad28
mov edx, dword [rsp + 0x2c0]
movsxd rax, ebx
cmp edx, 1
jne 0x14000ad0f
imul rax, rax, 0x90
movabs rdi, 0x11d2f81fc12a7328
mov qword [rsp + rax + 0x310], rdi
movabs rdi, 0x3bc93ec9a0004bba
mov qword [rsp + rax + 0x318], rdi
jmp 0x14000ad72
test edx, edx
jne 0x14000ad72
imul rax, rax, 0x90
mov byte [rsp + rax + 0x310], 0xef
jmp 0x14000ad72
test ebx, ebx
jns 0x14000ad74
lea rcx, str.No_partition_to_toggle
jmp 0x14000ab7c
mov eax, dword [rsp + 0x2c0]
movsxd rdi, ebx
cmp eax, 1
jne 0x14000af81
imul rdi, rdi, 0x90
movabs rax, 0x4433b9e5ebd0a0a2
mov qword [rsp + rdi + 0x310], rax
movabs rax, 0xc79926b7b668c087
mov qword [rsp + rdi + 0x318], rax
xor edi, edi
movsxd rbx, ebx
xor eax, eax
xor edx, edx
xor ecx, ecx
imul rbx, rbx, 0x90
mov r9d, dword [rsp + 0x70]
mov r8, rsi
mov byte [rsp + rbx + 0x30c], 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x28], edx
mov edx, 0x7c054
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x14000add9
call fcn.140038579
lea rcx, str.Could_not_set_drive_layout:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x14000ab81
mov rcx, qword [rsp + 0x40]
call fcn.14000a8f7
test rbp, rbp
je 0x14000adf2
mov ebx, 1
jmp 0x14000ae78
test edi, edi
je 0x14000ae30
movzx r9d, r12b
lea rbx, [rsp + 0x8c]
mov edx, 0x10
mov rcx, rbx
lea r8, str.ToggleEsp_02u
call qword [sym.imp.msvcrt.dll__snprintf]
lea rdx, [0x140088d40]
mov rcx, rbx
mov byte [rsp + 0x9b], 0
call fcn.140007728
jmp 0x14000ade8
movsx ecx, byte [rsp + 0x78]
call fcn.14000985b
test eax, eax
jne 0x14000ade8
mov ecx, dword [rsp + 0x1310]
xor r9d, r9d
mov rdx, qword [rsp + rbx + 0x2f8]
mov r8d, 1
call fcn.140007e51
lea rcx, [rsp + 0x78]
mov rbx, rax
mov rdx, rax
call fcn.14000a458
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000ade8
mov rax, qword [rsp + 0x40]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000b067
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14000b067
imul rdi, rdi, 0x90
mov eax, dword [rsp + 0x2c8]
xor r11d, r11d
lea r13, [rsp + 0x7c]
mov dword [rsp + 0x80], r11d
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + rdi + 0x2f8]
mov qword [rsp + 0x84], rax
jmp 0x14000ab12
cmp byte [rax], 0
lea r8, str.ToggleEsp_02u
je 0x14000ab55
inc r14d
cmp r14d, 9
jne 0x14000ab2e
lea rax, [rsp + 0xd0]
mov r15, qword [sym.imp.msvcrt.dll__snprintf]
mov edi, 1
lea r14, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov r9d, edi
inc edi
lea r8, str.ToggleEsp_02u
mov rcx, r14
mov edx, 0x10
call r15
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
mov r9d, edi
lea r8, str.ToggleEsp_02u
mov byte [rsp + 0xcf], 0
call r15
mov rcx, qword [rsp + 0x48]
mov byte [rsp + 0xdf], 0
call fcn.140007a43
mov rcx, r14
mov rdx, rax
call fcn.140007728
cmp edi, 8
jne 0x14000af0f
mov edx, 1
mov rcx, r13
call fcn.140038883
mov rcx, qword [rsp + 0x48]
mov rdx, rax
jmp 0x14000ab68
test eax, eax
jne 0x14000ad72
imul rax, rdi, 0x90
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov byte [rsp + rax + 0x310], 0xb
mov rdx, qword [rsp + rax + 0x2f8]
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x14000ad72
xor r10d, r10d
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x74]
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x20], r10
mov r8d, 0x200
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x14000ad72
cmp dword [rsp + 0x74], 0x200
jne 0x14000ad72
lea r14, [rsp + 0xf6]
lea r15, [rsp + 0x12e]
lea rdx, [rsp + 0x9d]
xor r13d, r13d
mov r8d, 8
mov rcx, r14
mov qword [rsp + 0x48], rdx
call sub.msvcrt.dll_memcmp
mov rdx, qword [rsp + 0x48]
test eax, eax
jne 0x14000b04c
movsxd r13, r13d
imul rax, rdi, 0x90
lea r13, [r13 + r13*8]
mov dl, byte [rsp + r13 + 0x9c]
mov byte [rsp + rax + 0x310], dl
jmp 0x14000b059
inc r13d
add rdx, 9
cmp r13d, 4
jne 0x14000b010
add r14, 0x1c
cmp r14, r15
jne 0x14000b005
jmp 0x14000ad72
mov eax, ebx
add rsp, 0x12c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret