Function at 0x14003e320
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov r14, rcx
add rcx, 0xc0
mov qword [rsp + 0x78], rcx
mov byte [rbp - 0x80], 0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbp - 0x80], 1
mov edi, 1
xor eax, eax
lock cmpxchg dword [r14 + 0x2e68], edi
je 0x14003e39d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rbp - 0x80], 0
jmp 0x14003eaf3
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rbp - 0x80], 0
mov eax, dword [r14 + 0x2e6c]
test eax, eax
je 0x14003e3d4
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x14003e3c9
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [r14 + 0x2e6c]
test eax, eax
jne 0x14003e3b7
xor esi, esi
mov qword [rbp - 0x40], rsi
or r15, 0xffffffffffffffff
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x50], esi
mov word [rbp + 0x50], si
xor eax, eax
mov qword [rbp + 0x52], rax
mov qword [rbp + 0x5a], rax
mov qword [rbp + 0x62], rax
mov dword [rbp + 0x6a], eax
mov rcx, r14
call fcn.140043a90
lea rcx, [rbp - 0x40]
call fcn.140043650
mov edx, esi
mov rax, qword [rbp - 0x40]
test rax, rax
setne dl
test edx, edx
jne 0x14003e437
mov dword [rsp + 0x6c], 0x80004005
lea rdx, [0x140176950]
lea rcx, [rsp + 0x6c]
call fcn.1400de560
int3
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
mov r8d, 0x206
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.FLTLIB.DLL_FilterVolumeFindFirst]
test eax, eax
je 0x14003e490
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x14003e46c
call qword [sym.imp.FLTLIB.DLL_FilterVolumeFindClose]
xchg dword [r14 + 0x2e68], esi
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x40], rax
je 0x14003e486
lea rcx, [rbp - 0x40]
call fcn.140043680
xor al, al
jmp 0x14003eaf5
mov rcx, qword [rbp - 0x40]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 2], si
mov rbx, qword [rbp - 0x40]
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
add rbx, 2
je 0x14003e500
test rbx, 0xffffffffffff0000
jne 0x14003e4ed
movzx ebx, bx
mov ecx, ebx
call fcn.140002830
test rax, rax
je 0x14003e517
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400029f0
jmp 0x14003e512
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14003e502
mov ecx, esi
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140002120
mov rdi, qword [rsp + 0x40]
cmp dword [rdi - 0x10], 0
jl 0x14003e674
lea rdx, str.DeviceLanmanRedirector
mov rcx, rdi
call fcn.1400d8384
test rax, rax
je 0x14003e544
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jne 0x14003e5f4
cmp dword [rdi - 0x10], 0
jl 0x14003e674
lea rdx, str.DeviceMup
mov rcx, rdi
call fcn.1400d8384
test rax, rax
je 0x14003e571
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jne 0x14003e5f4
cmp dword [rdi - 0x10], 0
jl 0x14003e674
lea rdx, str.DeviceWebDavRedirector
mov rcx, rdi
call fcn.1400d8384
test rax, rax
je 0x14003e59a
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jne 0x14003e5f4
cmp dword [rdi - 0x10], 0
jl 0x14003e674
lea rdx, str.DeviceHGFS
mov rcx, rdi
call fcn.1400d8384
test rax, rax
je 0x14003e5c3
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jne 0x14003e5f4
cmp dword [rdi - 0x10], 0
jl 0x14003e674
lea rdx, str.DeviceRDPDR
mov rcx, rdi
call fcn.1400d8384
test rax, rax
je 0x14003e674
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
je 0x14003e674
mov ecx, 0x40
call fcn.1400d5224
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14003e630
lea rax, [rbp - 0x58]
mov qword [rbp - 0x68], rax
lea rdx, [0x14012ed28]
lea rcx, [rbp - 0x58]
call fcn.140002ad0
nop
mov rdx, rax
mov rcx, rbx
call fcn.14003cca0
jmp 0x14003e633
mov rax, rsi
mov qword [rsp + 0x70], rax
mov dword [rax + 0x10], 6
lea r8, [rsp + 0x70]
mov rdx, rdi
mov rcx, r14
call fcn.140043940
nop
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14003e66a
mov rcx, rbx
call fcn.14003cf40
mov rcx, rbx
call fcn.1400d4d78
mov qword [rsp + 0x70], rsi
jmp 0x14003e9e8
mov rcx, qword [rbp - 0x40]
add rcx, 2
mov r8d, send
lea rdx, [rbp + 0x50]
call qword [sym.imp.FLTLIB.DLL_FilterGetDosName]
test eax, eax
jne 0x14003e9e8
lea ecx, [rax + 0x40]
call fcn.1400d5224
mov rdi, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x14003e6ce
lea rax, [rbp - 0x50]
mov qword [rbp - 0x70], rax
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.140002ad0
nop
mov rdx, rax
mov rcx, rdi
call fcn.14003cca0
mov r12, rax
jmp 0x14003e6d1
mov r12, rsi
mov qword [rsp + 0x58], r12
mov rcx, qword [r12]
call fcn.14003eb30
mov dword [r12 + 0x10], eax
lea rdx, [r12 + 0x20]
mov r8b, 1
mov rcx, qword [r12]
call fcn.14003ca40
lea r9, [r12 + 0x38]
lea r8, [r12 + 0x30]
lea rdx, [r12 + 0x28]
mov rcx, qword [r12]
call fcn.14003c230
mov dword [rsp + 0x68], esi
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov rdx, r12
lea rcx, [rbp - 0x60]
call fcn.140042ed0
mov r13, rax
mov edx, 1
sub edx, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, 0x104
or ecx, edx
jge 0x14003e763
mov edx, 0x104
lea rcx, [rsp + 0x48]
call fcn.1400020c0
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 0xc], 0x104
jl 0x14003eabd
mov dword [rbx - 0x10], 0x104
mov word [rbx + 0x208], si
mov rax, qword [r12 + 8]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x14003e7a6
mov edx, 0x104
lea rcx, [r12 + 8]
call fcn.1400020c0
mov rdx, qword [r12 + 8]
cmp dword [rdx - 0xc], 0x104
jl 0x14003eab2
mov dword [rdx - 0x10], 0x104
mov rax, qword [r12 + 8]
mov word [rax + 0x208], si
lea rax, [r12 + 0x1c]
lea r9, [r12 + 0x18]
mov dword [rsp + 0x38], 0x104
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r8d, 0x104
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
setne r13b
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003e826
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, qword [r12 + 8]
test rcx, rcx
jne 0x14003e834
mov eax, esi
jmp 0x14003e845
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d4f10
test eax, eax
js 0x14003eaa7
mov rcx, qword [r12 + 8]
cmp eax, dword [rcx - 0xc]
jg 0x14003eaa7
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [r12 + 8]
mov word [rax + rcx*2], si
movsxd rdx, dword [rbx - 0xc]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1400d4f10
test eax, eax
js 0x14003ea9c
cmp eax, dword [rbx - 0xc]
jg 0x14003ea9c
mov dword [rbx - 0x10], eax
cdqe
mov word [rdi + rax*2], si
test r13b, r13b
je 0x14003ea31
cmp dword [rbx - 0x10], 0
jl 0x14003e95f
lea rdx, str.FAT32
mov rcx, rdi
call fcn.1400d8384
test rax, rax
je 0x14003e8cd
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
je 0x14003e8cd
mov dword [r12 + 0x14], 2
jmp 0x14003e95f
cmp dword [rbx - 0x10], 0
jl 0x14003e95f
lea rdx, [0x14012efa8]
mov rcx, rdi
call fcn.1400d8384
test rax, rax
je 0x14003e901
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
je 0x14003e901
mov dword [r12 + 0x14], 1
jmp 0x14003e95f
cmp dword [rbx - 0x10], 0
jl 0x14003e95f
lea rdx, str.NTFS
mov rcx, rdi
call fcn.1400d8384
test rax, rax
je 0x14003e931
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
je 0x14003e931
mov dword [r12 + 0x14], 3
jmp 0x14003e95f
cmp dword [rbx - 0x10], 0
jl 0x14003e95f
lea rdx, str.exFAT
mov rcx, rdi
call fcn.1400d8384
test rax, rax
je 0x14003e95f
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
je 0x14003e95f
mov dword [r12 + 0x14], 4
mov rdx, qword [rbp - 0x40]
add rdx, 2
lea rcx, [rbp - 0x78]
call fcn.140002ad0
nop
lea r8, [rsp + 0x58]
mov rdx, qword [rbp - 0x78]
mov rcx, r14
call fcn.140043940
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003e9a3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003e9c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x14003e9de
mov rcx, rdi
call fcn.14003cf40
mov rcx, rdi
call fcn.1400d4d78
mov qword [rsp + 0x58], rsi
mov rdi, qword [rsp + 0x40]
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003ea03
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x206
mov r8, qword [rbp - 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.FLTLIB.DLL_FilterVolumeFindNext]
test eax, eax
jne 0x14003eac8
jmp 0x14003e490
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, esi
xchg dword [r14 + 0x2e68], edx
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003ea61
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, r12
call fcn.14003cf40
mov rcx, r12
call fcn.1400d4d78
mov qword [rsp + 0x58], rsi
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
dec r15d
test r15d, r15d
jg 0x14003ea97
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
jmp 0x14003e473
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x14003ead9
call qword [sym.imp.FLTLIB.DLL_FilterVolumeFindClose]
xchg dword [r14 + 0x2e68], esi
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x40], rax
je 0x14003eaf3
lea rcx, [rbp - 0x40]
call fcn.140043680
mov al, 1
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret