Function at 0x140149020
Capabilities:
Get disk information

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x6a0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x698], rbx
mov qword [rbp + 0x6a0], rsi
mov qword [rbp + 0x6a8], rdi
mov rax, qword [0x1401990d8]
xor rax, rbp
mov qword [rbp + 0x650], rax
mov rsi, rcx
mov qword [rbp + 0x18], rcx
lea rdx, [0x140156609]
lea rcx, [rbp + 0x10]
call fcn.140022164
nop
mov ebx, 0x20a
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x440]
call fcn.140054ae0
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x230]
call fcn.140054ae0
xor r12d, r12d
mov dword [rbp + 4], r12d
mov dword [rbp + 0xc], r12d
mov dword [rbp + 8], r12d
xor edx, edx
lea r8d, [rbx - 2]
lea rcx, [rbp + 0x20]
call fcn.140054ae0
xor r9d, r9d
lea r8d, [r12 + 0x25]
lea rdx, [rbp + 0x20]
xor ecx, ecx
call fcn.140148574
mov word [rbp + 0x26], r12w
mov r8d, 0x105
mov dword [rsp + 0x38], r8d
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 4]
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x14014912b
mov dword [rbp], 0x756c25
mov r8d, dword [rbp + 4]
lea rdx, [rbp]
lea rcx, [rbp + 0x10]
call fcn.1400236ac
mov r8, qword [rbp + 0x10]
or r13, 0xffffffffffffffff
test r8, r8
je 0x1401491aa
mov rax, r13
inc rax
cmp byte [r8 + rax], r12b
jne 0x14014913b
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1401491aa
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14014916c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140052660
sub rsp, rcx
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x1401491aa
mov word [rdi], r12w
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdi
mov r9d, r13d
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rbx, rbx
and rbx, rdi
jmp 0x1401491ad
mov rbx, r12
call fcn.140023a0c
mov rcx, rax
test rax, rax
je 0x14014934a
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsi], rax
test rbx, rbx
je 0x1401492dd
cmp rbx, 0x10000
jae 0x140149205
movzx ebx, bx
xor edx, edx
mov ecx, ebx
call fcn.1400231f4
test rax, rax
je 0x1401492e6
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call fcn.140027564
jmp 0x1401492e6
mov rdi, r13
inc rdi
cmp word [rbx + rdi*2], r12w
jne 0x140149208
test edi, edi
je 0x1401492dd
mov r15d, dword [rax - 0x10]
mov r14, rbx
sub r14, rax
sar r14, 1
test edi, edi
js 0x14014933f
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, ecx
jge 0x14014924a
mov edx, edi
mov rcx, rsi
call fcn.140027674
mov rcx, qword [rsi]
movsxd r8, edi
add r8, r8
cmp r14, r15
ja 0x14014928b
lea rdx, [rcx + r14*2]
test r8, r8
je 0x1401492c5
test rcx, rcx
jne 0x140149273
call fcn.14007bf48
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
jmp 0x1401492c0
test rdx, rdx
je 0x140149266
movsxd rax, dword [rcx - 0xc]
add rax, rax
cmp rax, r8
jb 0x1401492b5
call fcn.1400530f0
jmp 0x1401492c5
movsxd rax, dword [rcx - 0xc]
add rax, rax
test r8, r8
je 0x1401492c5
test rcx, rcx
je 0x140149266
cmp rax, r8
jb 0x1401492ab
mov rdx, rbx
call fcn.1400530f0
jmp 0x1401492c5
mov r8, rax
xor edx, edx
call fcn.140054ae0
call fcn.14007bf48
mov dword [rax], Ordinal_35
call fcn.1400618e8
mov rax, qword [rsi]
cmp edi, dword [rax - 0xc]
jg 0x14014933f
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsi]
mov word [rax + rcx*2], r12w
jmp 0x1401492e6
mov rcx, rsi
call fcn.140027310
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
mov ecx, r13d
lock xadd dword [rdx + 0x10], ecx
add ecx, r13d
test ecx, ecx
jg 0x140149307
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov rax, rsi
mov rcx, qword [rbp + 0x650]
xor rcx, rbp
call fcn.140051d60
mov rbx, qword [rbp + 0x698]
mov rsi, qword [rbp + 0x6a0]
mov rdi, qword [rbp + 0x6a8]
lea rsp, [rbp + 0x660]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400232a8
nop
mov ecx, 0x80004005
call fcn.1400232a8
int3