Function at 0x14000f5e0
Capabilities:
Get disk information via ioctl
Read file on windows

Disassembly:
push r15
mov eax, 0x12c8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400747a0
sub rsp, rax
xor eax, eax
lea rsi, str._vFAT
mov dword [rsp + 0x1310], ecx
test rdx, rdx
mov ecx, 0x400
lea rdi, [rsp + 0x2c0]
rep stosd dword [rdi], eax
mov dword [rsp + 0x78], 0x5c3a53
mov ecx, 9
mov rbp, rdx
lea rdi, [rsp + 0x9c]
rep movsd dword [rdi], dword [rsi]
lea rsi, [rsp + 0x2c0]
jne 0x14000f65c
mov rax, qword [0x1400b12c0]
cmp dword [rax], 0x9f
ja 0x14000f65c
lea rcx, str.ESP_toggling_is_only_available_for_Windows_10_or_later
call fcn.140036717
jmp 0x14000f680
mov ecx, dword [rsp + 0x1310]
xor edx, edx
mov r9d, 1
mov r8d, 1
call fcn.14000c911
mov qword [rsp + 0x40], rax
inc rax
jne 0x14000f687
xor ebx, ebx
jmp 0x14000fcef
xor ebx, ebx
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x40]
mov edx, 0x70050
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x14000f6cb
cmp dword [rsp + 0x70], 0
jne 0x14000f6eb
call fcn.140036bd7
mov edx, dword [rsp + 0x1310]
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov r8, rax
call fcn.140036717
jmp 0x14000f80e
mov edx, dword [rsp + 0x2c4]
test rbp, rbp
je 0x14000f701
mov rax, rsi
xor ebx, ebx
jmp 0x14000f95a
lea r13, [rsp + 0x310]
xor ebx, ebx
lea rdi, [0x1400b9af0]
cmp dword [rsp + 0x2c4], ebx
jle 0x14000f74d
mov eax, dword [rsp + 0x2c0]
test eax, eax
jne 0x14000f738
cmp byte [r13], 0xef
je 0x14000f776
inc ebx
add r13, 0x90
jmp 0x14000f712
dec eax
jne 0x14000f72d
mov rdx, rdi
mov rcx, r13
call fcn.140035c44
test eax, eax
je 0x14000f72d
jmp 0x14000f776
mov rax, qword [sym.imp.msvcrt.dll__snprintf]
xor r14d, r14d
xor edi, edi
or ebx, 0xffffffff
movabs r15, 0x3bc93ec9a0004bba
mov r13d, 1
mov qword [rsp + 0x48], rax
jmp 0x14000f879
cmp dword [rsp + 0x2c0], 1
movsxd rdi, ebx
jne 0x14000fb27
imul rdi, rdi, 0x90
lea rcx, str.ESP_name:__S
lea rdx, [rsi + rdi + 0x78]
lea r13, [rsi + rdi + 0x60]
call fcn.140036717
mov r15, qword [sym.imp.msvcrt.dll__snprintf]
mov r14d, 1
lea rdi, [rsp + 0xc0]
lea r8, str.ToggleEsp_02u
mov rcx, rdi
mov r9d, r14d
mov edx, 0x10
call r15
mov rcx, rdi
mov byte [rsp + 0xcf], 0
call fcn.14000c6e8
test rax, rax
jne 0x14000fb5e
mov rcx, r13
call fcn.1400379be
mov rcx, rdi
mov rdx, rax
call fcn.14000c3cd
test eax, eax
jne 0x14000f9c1
lea rcx, str.ESP_toggling_data_could_not_be_stored
call fcn.140036717
xor ebx, ebx
jmp 0x14000fb05
test ebx, ebx
jns 0x14000f864
mov eax, dword [rsp + 0x2c0]
cmp eax, 1
jne 0x14000f8d5
mov r14, r8
mov rdx, r14
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rcx
call fcn.140035c44
mov rcx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
test eax, eax
jne 0x14000f909
inc r12d
add r8, 0x90
cmp dword [rsp + 0x2c4], r12d
jg 0x14000f815
inc r13d
cmp r13d, 8
jg 0x14000f9b1
test ebx, ebx
jns 0x14000fa01
lea rcx, [rsp + 0xc0]
mov r9d, r13d
mov edx, 0x10
mov rax, qword [rsp + 0x48]
lea r8, str.ToggleEsp_02u
mov qword [rsp + 0x58], rcx
call rax
mov rcx, qword [rsp + 0x58]
mov byte [rsp + 0xcf], 0
call fcn.14000c6e8
mov rcx, rax
call fcn.140037a3a
mov rcx, rax
test rax, rax
je 0x14000f864
lea rax, [rsp + 0x7c]
lea r8, [rsp + 0x320]
xor r12d, r12d
mov qword [rsp + 0x58], rax
jmp 0x14000f85a
test eax, eax
jne 0x14000f82c
mov eax, dword [rsp + 0x2c8]
xor r9d, r9d
mov r14, qword [rsp + 0x58]
mov dword [rsp + 0x80], r9d
mov dword [rsp + 0x7c], eax
mov rax, qword [r8 - 0x28]
mov qword [rsp + 0x84], rax
jmp 0x14000f82c
mov eax, dword [rsp + 0x2c0]
cmp eax, 1
jne 0x14000f931
mov dword [r8 - 0x10], 0xc12a7328
mov word [r8 - 0xc], 0xf81f
mov word [r8 - 0xa], 0x11d2
mov qword [r8 - 8], r15
jmp 0x14000f935
test eax, eax
je 0x14000f942
mov ebx, r12d
mov edi, 1
jmp 0x14000f850
mov byte [r8 - 0x10], 0xef
jmp 0x14000f935
mov rcx, qword [rax + 0x38]
add rax, 0x90
cmp rcx, rbp
je 0x14000f960
inc ebx
cmp ebx, edx
jl 0x14000f949
jmp 0x14000f9b5
mov edx, dword [rsp + 0x2c0]
movsxd rax, ebx
cmp edx, 1
jne 0x14000f99c
imul rax, rax, 0x90
movabs rdi, 0x11d2f81fc12a7328
mov qword [rsp + rax + 0x310], rdi
movabs rdi, 0x3bc93ec9a0004bba
mov qword [rsp + rax + 0x318], rdi
jmp 0x14000f9ff
test edx, edx
jne 0x14000f9ff
imul rax, rax, 0x90
mov byte [rsp + rax + 0x310], 0xef
jmp 0x14000f9ff
test ebx, ebx
jns 0x14000fa01
lea rcx, str.No_partition_to_toggle
jmp 0x14000f809
mov eax, dword [rsp + 0x2c0]
movsxd rdi, ebx
cmp eax, 1
jne 0x14000fc09
imul rdi, rdi, 0x90
movabs rax, 0x4433b9e5ebd0a0a2
mov qword [rsp + rdi + 0x310], rax
movabs rax, 0xc79926b7b668c087
mov qword [rsp + rdi + 0x318], rax
xor edi, edi
movsxd rbx, ebx
xor eax, eax
xor edx, edx
xor ecx, ecx
imul rbx, rbx, 0x90
mov r9d, dword [rsp + 0x70]
mov r8, rsi
mov byte [rsp + rbx + 0x30c], 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x28], edx
mov edx, 0x7c054
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x14000fa66
call fcn.140036bd7
lea rcx, str.Could_not_set_drive_layout:__s
mov rdx, rax
call fcn.140036717
jmp 0x14000f80e
mov rcx, qword [rsp + 0x40]
call fcn.14000f589
test rbp, rbp
je 0x14000fa7f
mov ebx, 1
jmp 0x14000fb05
test edi, edi
je 0x14000fabd
movzx r9d, r12b
lea rbx, [rsp + 0x8c]
mov edx, 0x10
mov rcx, rbx
lea r8, str.ToggleEsp_02u
call qword [sym.imp.msvcrt.dll__snprintf]
lea rdx, [0x1400833e0]
mov rcx, rbx
mov byte [rsp + 0x9b], 0
call fcn.14000c3cd
jmp 0x14000fa75
movsx ecx, byte [rsp + 0x78]
call fcn.14000e500
test eax, eax
jne 0x14000fa75
mov ecx, dword [rsp + 0x1310]
xor r9d, r9d
mov rdx, qword [rsp + rbx + 0x2f8]
mov r8d, 1
call fcn.14000caf6
lea rcx, [rsp + 0x78]
mov rbx, rax
mov rdx, rax
call fcn.14000f0ea
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000fa75
mov rax, qword [rsp + 0x40]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000fcef
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14000fcef
imul rdi, rdi, 0x90
mov eax, dword [rsp + 0x2c8]
xor r11d, r11d
lea r13, [rsp + 0x7c]
mov dword [rsp + 0x80], r11d
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + rdi + 0x2f8]
mov qword [rsp + 0x84], rax
jmp 0x14000f7a4
cmp byte [rax], 0
lea r8, str.ToggleEsp_02u
je 0x14000f7e7
inc r14d
cmp r14d, 9
jne 0x14000f7c0
lea rax, [rsp + 0xd0]
mov r15, qword [sym.imp.msvcrt.dll__snprintf]
mov edi, 1
lea r14, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov r9d, edi
inc edi
lea r8, str.ToggleEsp_02u
mov rcx, r14
mov edx, 0x10
call r15
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
mov r9d, edi
lea r8, str.ToggleEsp_02u
mov byte [rsp + 0xcf], 0
call r15
mov rcx, qword [rsp + 0x48]
mov byte [rsp + 0xdf], 0
call fcn.14000c6e8
mov rcx, r14
mov rdx, rax
call fcn.14000c3cd
cmp edi, 8
jne 0x14000fb9c
mov rcx, r13
call fcn.1400379be
mov rcx, qword [rsp + 0x48]
mov rdx, rax
jmp 0x14000f7f5
test eax, eax
jne 0x14000f9ff
imul rax, rdi, 0x90
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov byte [rsp + rax + 0x310], 0xb
mov rdx, qword [rsp + rax + 0x2f8]
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x14000f9ff
xor r10d, r10d
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x74]
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x20], r10
mov r8d, 0x200
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x14000f9ff
cmp dword [rsp + 0x74], 0x200
jne 0x14000f9ff
lea r14, [rsp + 0xf6]
lea r15, [rsp + 0x12e]
lea rdx, [rsp + 0x9d]
xor r13d, r13d
mov r8d, 8
mov rcx, r14
mov qword [rsp + 0x48], rdx
call sub.msvcrt.dll_memcmp
mov rdx, qword [rsp + 0x48]
test eax, eax
jne 0x14000fcd4
movsxd r13, r13d
imul rax, rdi, 0x90
lea r13, [r13 + r13*8]
mov dl, byte [rsp + r13 + 0x9c]
mov byte [rsp + rax + 0x310], dl
jmp 0x14000fce1
inc r13d
add rdx, 9
cmp r13d, 4
jne 0x14000fc98
add r14, 0x1c
cmp r14, r15
jne 0x14000fc8d
jmp 0x14000f9ff
mov eax, ebx
add rsp, 0x12c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret