Function at 0x14000b883
Capabilities:
Get disk information via ioctl
Get file size

Disassembly:
push r15
mov eax, 0x1198
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140077930
sub rsp, rax
movabs rax, 0xef0e0c0b07060401
mov qword [rsp + 0x88], rax
mov esi, ecx
xor eax, eax
test rdx, rdx
mov ecx, 0x40
mov r12, rdx
mov r13d, r8d
mov ebx, r9d
lea rdi, [rsp + 0x90]
lea rbp, [rsp + 0x190]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x190]
mov ecx, 0x400
rep stosd dword [rdi], eax
je 0x14000ba0f
lea rdx, [0x1400cf248]
xor r14d, r14d
mov ecx, 0x160
xor r9d, r9d
mov rdi, rdx
mov dword [0x1400cf240], r14d
mov r8d, 1
xor edx, edx
rep stosd dword [rdi], eax
mov byte [r12], 0
mov ecx, esi
call fcn.140007977
mov rdi, rax
test rax, rax
jne 0x14000b938
test ebx, ebx
jne 0x14000b964
mov edx, esi
lea rcx, str.No_volume_information_for_drive_0x_02x
call fcn.140038472
jmp 0x14000b964
mov dword [rsp + 0x38], r13d
xor r13d, r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], r12
mov rcx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x14011c5e0]
test eax, eax
je 0x14000b924
mov rcx, rdi
call fcn.1400796c8
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov ecx, esi
call fcn.1400077b5
mov qword [rsp + 0x48], rax
inc rax
je 0x14000ba0f
xor edi, edi
lea r13, [rsp + 0x84]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
mov edx, 0x700a0
mov qword [rsp + 0x30], r13
mov rdi, qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
je 0x14000b9dc
cmp dword [rsp + 0x84], 0
jne 0x14000ba1a
test ebx, ebx
jne 0x14000b9f6
call fcn.14003893c
mov edx, esi
lea rcx, str.Could_not_get_geometry_for_drive_0x_02x:__s
mov r8, rax
call fcn.140038472
mov rax, qword [rsp + 0x48]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000ba0f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
xor ebx, ebx
mov dword [rsp + 0x54], ebx
jmp 0x14000c1c3
mov rax, qword [rsp + 0xa8]
mov r8d, dword [rsp + 0xa4]
mov dword [0x1400cf234], 0xffffffff
mov qword [0x1400cf220], rax
mov dword [0x1400cf230], r8d
cmp r8d, 0x1ff
ja 0x14000ba67
test ebx, ebx
jne 0x14000ba5d
mov edx, esi
lea rcx, str.Warning:_Drive_0x_02x_reports_a_sector_size_of__d___Correcting_to_512_bytes.
call fcn.140038472
mov dword [0x1400cf230], 0x200
mov eax, dword [rsp + 0xa0]
mov dword [0x1400cf22c], eax
mov eax, dword [rsp + 0x98]
mov dword [0x1400cf238], eax
test ebx, ebx
jne 0x14000baf4
mov r9d, dword [0x1400cf230]
mov rcx, qword [0x1400cf220]
xor edx, edx
mov r8d, 1
mov dword [rsp + 0x54], r9d
call fcn.140038d8b
cmp dword [0x1400cf238], 0xc
mov r9d, dword [rsp + 0x54]
lea rdx, str.Removable
mov r8, rax
jne 0x14000bac4
lea rdx, str.FIXED
lea rcx, str.Disk_type:__s__Disk_size:__s__Sector_size:__d_bytes
call fcn.140038472
mov r9d, dword [rsp + 0xa0]
mov r8d, dword [rsp + 0x9c]
lea rcx, str.Cylinders:__I64i__Tracks_per_cylinder:__d__Sectors_per_track:__d
mov rdx, qword [rsp + 0x90]
call fcn.140038472
xor r11d, r11d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r11
mov rcx, qword [rsp + 0x48]
mov edx, 0x70050
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rbp
call rdi
test eax, eax
je 0x14000bb2e
cmp dword [rsp + 0x84], 0
jne 0x14000bb4c
test ebx, ebx
jne 0x14000b9f6
call fcn.14003893c
mov edx, esi
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov r8, rax
jmp 0x14000b9f1
mov esi, dword [rsp + 0x190]
test esi, esi
je 0x14000bb64
dec esi
je 0x14000bf03
jmp 0x14000c176
xor r10d, r10d
mov r8d, dword [rsp + 0x194]
xor edx, edx
xor ecx, ecx
mov dword [0x1400cf23c], r10d
mov eax, dword [0x1400cf240]
cmp r8d, edx
je 0x14000bb9a
cmp byte [rbp + 0x50], 0
je 0x14000bb8f
inc eax
mov cl, 1
inc edx
add rbp, 0x90
jmp 0x14000bb80
test cl, cl
je 0x14000bba4
mov dword [0x1400cf240], eax
cmp byte [rsp + 0x1e0], 0
je 0x14000bbdd
cmp qword [rsp + 0x1c8], 0
jne 0x14000bbdd
test ebx, ebx
je 0x14000bbc8
mov r15d, 1
jmp 0x14000bc48
mov rdx, qword [str.Super_Floppy_Disk]
lea rcx, str.Partition_type:_SFD___s__or_unpartitioned
call fcn.140038472
jmp 0x14000bbbd
test ebx, ebx
jne 0x14000bbf3
mov edx, dword [0x1400cf240]
lea rcx, str.Partition_type:_MBR__NB_Partitions:__d
call fcn.140038472
mov edx, dword [rsp + 0x198]
xor eax, eax
cmp edx, 0x49464555
sete al
mov dword [0x1400cf7e0], eax
test ebx, ebx
jne 0x14000bc31
lea r8, [0x140089da0]
cmp edx, 0x49464555
jne 0x14000bc25
lea r8, str._UEFI_target_
lea rcx, str.Disk_ID:_0x_08X__s
call fcn.140038472
mov rcx, qword [rsp + 0x48]
mov r8d, ebx
lea rdx, [0x14008ae15]
xor r15d, r15d
call fcn.14000988a
mov eax, r15d
xor r9d, r9d
xor eax, 1
mov dword [rsp + 0x54], r9d
mov dword [rsp + 0x68], eax
mov eax, r15d
xor eax, 1
mov byte [rsp + 0x70], al
cmp esi, dword [rsp + 0x194]
jae 0x14000c198
mov ebp, esi
imul rax, rbp, 0x90
movzx edi, byte [rsp + rax + 0x1e0]
test dil, dil
je 0x14000befc
cmp dil, 4
jne 0x14000bcac
test r15d, r15d
je 0x14000bcac
cmp qword [0x1400cf220], 0x1000000
jle 0x14000c1b3
jmp 0x14000c198
cmp dil, 0xef
jne 0x14000c1b3
mov ecx, dword [0x1400cf230]
mov edx, 1
call sub.msvcrt.dll_vfprintf
mov r13, rax
test rax, rax
je 0x14000c1b3
imul rax, rbp, 0x90
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + rax + 0x1c8]
call qword [0x14011c720]
test eax, eax
jne 0x14000bcfb
xor r14d, r14d
jmp 0x14000bd43
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x84]
mov rdx, r13
mov qword [rsp + 0x20], r8
mov r8d, dword [0x1400cf230]
call qword [0x14011c6d8]
test eax, eax
je 0x14000bcf6
lea rcx, [r13 + 0x2b]
mov r8d, 9
lea rdx, str.UEFI_NTFS
xor r14d, r14d
call fcn.140079800
test eax, eax
sete r14b
mov rcx, r13
call fcn.1400796c8
test ebx, ebx
jne 0x14000bd78
lea r8, str.__UEFI:NTFS_
test r14d, r14d
jne 0x14000bd65
xor r14d, r14d
lea r8, [0x140089da0]
mov eax, dword [rsp + 0x68]
lea rcx, str.Partition__d_s:
lea edx, [rax + rsi]
call fcn.140038472
xor eax, eax
lea rdx, [rsp + 0x88]
cmp dil, byte [rax + rdx]
je 0x14000bd93
inc rax
cmp rax, 8
jne 0x14000bd82
jmp 0x14000bd9b
mov dword [rsp + 0x54], 1
imul rcx, rbp, 0x90
mov rax, qword [rsp + rcx + 0x1c8]
cmp esi, 0xf
ja 0x14000bdcd
imul r8, rbp, 0x58
mov rcx, qword [rsp + rcx + 0x1d0]
lea rdx, [0x1400cf220]
add rdx, r8
mov qword [rdx + 0x70], rax
mov qword [rdx + 0x78], rcx
test ebx, ebx
jne 0x14000beae
imul rbp, rbp, 0x90
lea r13, [0x14008ac99]
cmp byte [rsp + rbp + 0x1e1], 0
je 0x14000bdf4
lea r13, [0x14008ac95]
mov ecx, dword [0x1400cf230]
cqo
mov r9d, esi
xor r8d, r8d
imul r9, r9, 0x90
idiv rcx
mov qword [rsp + 0x78], r9
mov edx, 1
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + r9 + 0x1d0]
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.140038d8b
mov r9, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
mov rbp, rax
mov rdx, qword [rsp + r9 + 0x1c8]
call fcn.140009b4b
xor r8d, r8d
test r15d, r15d
cmove r8d, edi
mov r9, rax
cmp dil, 7
je 0x14000be64
cmp byte [rsp + 0x70], 0
jne 0x14000be6e
cmp byte [r12], 0
mov rdx, r12
jne 0x14000be84
movzx ecx, dil
mov dword [rsp + 0x78], r8d
call fcn.14000b7f8
mov r8d, dword [rsp + 0x78]
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], r13
lea rcx, str.__Type:__s__0x_02x__r_n__Detected_File_System:__s_r_n__Size:__s___lld_bytes__r_n__Start_Sector:__lld__Boot:__s
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
call fcn.140038472
mov eax, esi
mov ecx, dword [0x1400cf230]
imul rax, rax, 0x90
mov rax, qword [rsp + rax + 0x1c8]
cqo
idiv rcx
mov edx, dword [0x1400cf234]
cmp edx, eax
cmova edx, eax
mov dword [0x1400cf234], edx
cmp dil, 0xea
je 0x14000bee6
test r14d, r14d
je 0x14000beec
dec dword [0x1400cf240]
cmp dil, 0xee
jne 0x14000befc
mov dword [0x1400cf7dc], 1
inc esi
jmp 0x14000bc64
mov dword [0x1400cf23c], 1
test ebx, ebx
jne 0x14000bf68
mov edx, dword [rsp + 0x194]
lea rcx, str.Partition_type:_GPT__NB_Partitions:__d
call fcn.140038472
lea rcx, [rsp + 0x198]
mov edx, 1
call fcn.140038c6c
lea rcx, str.Disk_GUID:__s
mov rdx, rax
call fcn.140038472
mov r9, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1a8]
lea rcx, str.Max_parts:__d__Start_Offset:__I64i__Usable___I64i_bytes
mov edx, dword [rsp + 0x1b8]
call fcn.140038472
xor ecx, ecx
xor edi, edi
lea r15, [0x1400cf220]
mov dword [rsp + 0x54], ecx
cmp edi, dword [rsp + 0x194]
jae 0x14000c198
mov esi, edi
imul r12, rsi, 0x90
lea r14, [rbp + r12 + 0x78]
cmp edi, 0xf
ja 0x14000bfc4
imul rax, rsi, 0x58
mov rcx, qword [rsp + r12 + 0x1c8]
lea rdx, [r15 + rax]
mov qword [rdx + 0x70], rcx
mov rcx, qword [rsp + r12 + 0x1d0]
mov qword [rdx + 0x78], rcx
lea rcx, [r15 + rax + 0x28]
mov rdx, r14
call fcn.140079860
lea rdx, [0x14008aa30]
mov rcx, r14
inc dword [0x1400cf240]
call fcn.140079858
mov r13d, eax
lea rax, [rbp + r12 + 0x50]
mov qword [rsp + 0x58], rax
test ebx, ebx
jne 0x14000c017
mov rcx, rax
call fcn.14000b82a
lea r8, [0x140089da0]
mov r9, rax
test r13d, r13d
jne 0x14000c008
lea r8, str.__UEFI:NTFS_
lea edx, [rdi + 1]
lea rcx, str.Partition__d_s:_r_n__Type:__s
call fcn.140038472
imul rax, rsi, 0x90
cmp word [rsp + rax + 0x208], 0
je 0x14000c042
test ebx, ebx
jne 0x14000c0f0
mov rdx, r14
lea rcx, str.__Name:__S
call fcn.140038472
jmp 0x14000c04a
test ebx, ebx
jne 0x14000c0f0
imul r14, rsi, 0x90
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + r14 + 0x1c8]
call fcn.140009b4b
lea rcx, str.__Detected_File_System:__s
mov rdx, rax
call fcn.140038472
mov rax, qword [rsp + r14 + 0x1c8]
mov ecx, dword [0x1400cf230]
xor r8d, r8d
mov r10, qword [rsp + r14 + 0x200]
cqo
idiv rcx
mov rcx, qword [rsp + r14 + 0x1d0]
mov qword [rsp + 0x70], r10
mov edx, 1
mov qword [rsp + 0x60], rax
call fcn.140038d8b
lea rcx, [rbp + r12 + 0x60]
mov edx, 1
mov qword [rsp + 0x68], rax
call fcn.140038c6c
mov r10, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
lea rcx, str.__ID:__s_r_n__Size:__s___I64i_bytes__r_n__Start_Sector:__I64i__Attributes:_0x_016I64X
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + r14 + 0x1d0]
call fcn.140038472
imul rsi, rsi, 0x90
mov ecx, dword [0x1400cf230]
mov rax, qword [rsp + rsi + 0x1c8]
cqo
idiv rcx
mov edx, dword [0x1400cf234]
cmp edx, eax
cmova edx, eax
mov dword [0x1400cf234], edx
test r13d, r13d
jne 0x14000c128
dec dword [0x1400cf240]
jmp 0x14000c152
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400bf040]
call fcn.1400378e4
test eax, eax
jne 0x14000c120
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400bee90]
call fcn.1400378e4
test eax, eax
jne 0x14000c120
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400bf000]
call fcn.1400378e4
test eax, eax
setne al
inc edi
movzx eax, al
or dword [rsp + 0x54], eax
jmp 0x14000bf77
xor edx, edx
mov dword [0x1400cf23c], edx
test ebx, ebx
je 0x14000c18a
xor eax, eax
mov dword [rsp + 0x54], eax
jmp 0x14000c198
lea rcx, str.Partition_type:_RAW
call fcn.140038472
jmp 0x14000c182
mov rax, qword [rsp + 0x48]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000c1c3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
jmp 0x14000c1c3
xor r14d, r14d
test ebx, ebx
jne 0x14000bd78
jmp 0x14000bd5b
mov eax, dword [rsp + 0x54]
add rsp, 0x1198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret