Function at 0x14004dda0
Capabilities:
Get disk information

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140132280]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
mov r15, qword [rsp + 0xc0]
mov r14d, 1
mov dword [rsp + 0x2c], r14d
mov rax, qword [0x1401319e0]
mov qword [rsp + 0x38], rax
mov rax, qword [0x1401319e0]
mov qword [rsp + 0x20], rax
lea rdx, str.AgentSettings.FTPPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.GnutellaPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.HTTPPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.HTTPSPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.IMAPPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.IRCPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.MSNPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.OSCARPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.POPPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.SMTPPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.XMPPPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.YPagerPorts
mov rcx, rbx
call fcn.14006f224
test eax, eax
je 0x14004e01a
lea rdx, str.AgentSettings.Drives
mov rcx, rbx
call fcn.14006f224
test eax, eax
jne 0x14004e00c
lea rdx, str._array_name_
lea rcx, [rsp + 0x20]
call fcn.1400449b0
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.1400449b0
lea rdx, str.__type_DriveInfo__size_27__
lea rcx, [rsp + 0x20]
call fcn.1400449b0
mov dword [rsp + 0x28], 0x5c3a43
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x20]
cmp rbx, 0x1b
jae 0x14004e0c0
lea rdx, str._struct_
call fcn.1400449b0
mov rax, qword [rdi]
mov r9d, dword [r15 + rbx*8]
lea r8, str.Capture
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rdi]
mov r9d, dword [r15 + rbx*8 + 4]
lea r8, [0x1400ce410]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [rax + pe_nt_image_headers64]
mov eax, r14d
cmp rbx, 0x1a
jae 0x14004dfd7
lea eax, [rbx + 0x41]
mov byte [rsp + 0x28], al
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov r10, qword [rdi]
mov r9d, eax
lea r8, [0x1400d4508]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [r10 + pe_nt_image_headers64]
lea rdx, str.__struct_
lea rcx, [rsp + 0x20]
call fcn.1400449b0
inc rbx
jmp 0x14004df63
xor ebx, ebx
mov r14d, ebx
mov dword [rsp + 0x2c], ebx
jmp 0x14004e0cc
mov rsi, qword [rsp + 0xc8]
shr rsi, 2
mov r8, rsi
lea rdx, [0x1400d44ac]
lea rcx, [rsp + 0x48]
call fcn.140027490
lea rdx, str._array_name_
lea rcx, [rsp + 0x20]
call fcn.1400449b0
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.1400449b0
lea rdx, str.__type_DWORD__size_
lea rcx, [rsp + 0x20]
call fcn.1400449b0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.1400449b0
lea rdx, [0x1400d34cc]
lea rcx, [rsp + 0x20]
call fcn.1400449b0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
cmp rbx, rsi
jae 0x14004e0bb
mov r9d, dword [r15 + rbx*4]
test r9d, r9d
je 0x14004e0b6
mov rax, qword [rdi]
lea r8, [0x140102c40]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [rax + pe_nt_image_headers64]
inc rbx
jmp 0x14004e08b
lea rcx, [rsp + 0x20]
lea rdx, str.__array_
call fcn.1400449b0
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.140044950
nop
jmp 0x14004e0e1
lea rcx, [rsp + 0x20]
call fcn.1400446d0
nop
lea rcx, [rsp + 0x38]
call fcn.1400446d0
mov eax, r14d
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140063ed0
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret