Function at 0x140005c24
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x810]
sub rsp, 0x910
mov rax, qword [0x140036068]
xor rax, rsp
mov qword [rbp + 0x800], rax
mov r12, r8
mov r15d, edx
mov rdi, rcx
xor ebx, ebx
xor edx, edx
lea rcx, [0x1400367a0]
lea r8d, [rbx + 0x58]
call sub.msvcrt.dll_memset
mov dword [0x1400367bc], r15d
lea eax, [rbx + 1]
mov r13w, 0x5c
test rdi, rdi
je 0x140005c98
cmp word [rdi], r13w
jne 0x140005c98
cmp word [rdi + 2], r13w
jne 0x140005c98
mov byte [rsp + 0x40], al
jmp 0x140005c9e
mov al, bl
mov byte [rsp + 0x40], bl
or r14, 0xffffffffffffffff
mov esi, 0x104
test rdi, rdi
je 0x140005f7b
test al, al
jne 0x140005e4f
mov r8d, esi
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x140005cf6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
lea rdx, str.Failed_to_GetVolumePathName_for__ws___u_.
mov r9d, eax
mov ecx, 4
call fcn.14000b134
mov ebx, 0xc000000d
jmp 0x1400061fc
lea r9, [rbp + 0x160]
mov r8, rdi
lea rdx, str.VolumePathName_for__ws_is__ws
mov ecx, 2
call fcn.14000b134
lea rax, [rbp + 0x160]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], bx
jne 0x140005d1b
mov rax, r14
inc rax
cmp word [rdi + rax*2], bx
jne 0x140005d27
cmp rsi, rax
jbe 0x140005d4f
lea r8, [rbp + 0x160]
mov ecx, 4
lea rdx, str.Invalid_VolumePathNameLegth__ws
call fcn.14000b134
jmp 0x140005cec
lea rcx, [rbp + 0x160]
cmp rsi, 3
jne 0x140005d95
mov r8d, 0x104
mov word [rbp + 0x164], bx
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x140005e26
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbp + 0x160]
lea rdx, str.Failed_to_QueryDosDevice_for__ws___u_.
jmp 0x140005cdf
mov r8d, 0x32
lea rdx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x140005dc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbp + 0x160]
lea rdx, str.Unable_to_GetVolumeNameForVolumeMountPoint__ws___u_.
jmp 0x140005cdf
lea r8, [rbp + 0x370]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcscpy_s]
lea rcx, [rsp + 0x50]
mov rax, r14
inc rax
cmp word [rcx + rax*2], bx
jne 0x140005de4
cmp rax, 1
jbe 0x140005e26
cmp word [rsp + 0x52], r13w
jne 0x140005e05
mov ecx, 0x3f
mov word [rsp + 0x52], cx
cmp word [rsp + rax*2 + 0x4e], r13w
jne 0x140005e26
lea rax, [rax*2 - 2]
cmp rax, 0x208
jae 0x140006241
mov word [rsp + rax + 0x50], bx
lea r8, [rsi - 1]
mov rdx, rdi
lea rcx, [rbp + 0x160]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x140005ede
lea rdi, [rdi + rsi*2]
add rdi, 0xfffffffffffffffe
jmp 0x140005ede
mov rax, r14
inc rax
cmp word [rdi + rax*2], bx
jne 0x140005e52
mov r8d, 0xe
cmp rax, r8
jb 0x140006014
mov rdx, rdi
lea rcx, str._GLOBALROOT
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x140006014
mov r8d, esi
lea rdx, [rbp + 0x5f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x140005ea3
mov ebx, 0xc0000001
jmp 0x1400061fc
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea r8, [rbp + 0x60c]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcscpy_s]
lea rcx, [rsp + 0x50]
mov rax, r14
inc rax
cmp word [rcx + rax*2], bx
jne 0x140005ecd
lea rdi, [rdi + rax*2]
add rdi, 0x1c
lea rcx, [rsp + 0x50]
mov rax, r14
inc rax
cmp word [rcx + rax*2], bx
jne 0x140005ee6
lea rsi, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r13d, 8
mov r8, rsi
mov rcx, rax
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1400367d0], rax
test rax, rax
jne 0x140005f28
mov ebx, 0xc0000017
jmp 0x1400061fc
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, r14
inc rax
cmp word [rdi + rax*2], bx
jne 0x140005f3b
lea rsi, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1400367f0], rax
test rax, rax
je 0x140005f1e
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov byte [0x1400367b8], bl
call fcn.140004c9c
movzx ecx, byte [0x1400367b8]
lea r13, str.en_us
cmp eax, 2
mov eax, 1
cmove ecx, eax
test r12, r12
mov byte [0x1400367b8], cl
mov rax, r14
cmovne r13, r12
inc rax
cmp word [r13 + rax*2], bx
jne 0x140005faf
lea rsi, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1400367c8], rax
test rax, rax
je 0x140005f1e
mov r8, rsi
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_memcpy
xor ecx, ecx
call fcn.140002698
mov qword [0x1400367e8], rax
test rax, rax
jne 0x140006034
mov ebx, 0xc0000225
jmp 0x1400061fc
lea r9, str._GLOBALROOT
mov r8, rdi
lea rdx, str.Expected_provided_path___ws__to_start_with__ws
mov ecx, 4
call fcn.14000b134
jmp 0x140005cec
test r15b, 0x10
je 0x14000604f
mov rcx, rax
call fcn.140001e28
mov byte [0x1400367b9], al
mov rax, qword [0x1400367e8]
mov rcx, r14
inc rcx
cmp word [rax + rcx*2], bx
jne 0x140006052
lea r15, [rcx*2 + 2]
lea r12, [r15 + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140005f1e
mov dword [rax], 2
lea rcx, [rax + 0x14]
mov rdx, qword [0x1400367e8]
mov r8, r15
call sub.msvcrt.dll_memcpy
lea rax, [rsp + 0x50]
mov dword [0x1400367e0], r12d
mov qword [0x1400367d8], rsi
inc r14
cmp word [rax + r14*2], bx
jne 0x1400060b6
lea r14, [r14*2 + 2]
lea r15, [r14 + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140005f1e
mov r12d, 2
lea rcx, [rax + 0x14]
mov r8, r14
mov dword [rax], r12d
lea rdx, [rsp + 0x50]
call sub.msvcrt.dll_memcpy
mov dword [0x1400367a8], r15d
mov qword [0x1400367a0], rsi
test rdi, rdi
je 0x140006215
lea rax, str.System32_bootstr.dll
mov edx, 0x104
lea rcx, [rbp + 0x3e0]
cmp byte [rsp + 0x40], bl
jne 0x140006159
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x160]
lea r8, str._s_s_s
mov qword [rsp + 0x20], rdi
call qword [sym.imp.msvcrt.dll_swprintf_s]
jmp 0x140006181
mov qword [rsp + 0x30], rax
lea r9, str._GLOBALROOT
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
lea r8, str._s_s_s_s
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_swprintf_s]
lea rdx, [rsp + 0x44]
mov rcx, r13
call fcn.14000e38c
test eax, eax
lea rcx, [rbp + 0x3e0]
movzx edx, bx
cmovns dx, word [rsp + 0x44]
mov word [0x1400367c0], dx
call fcn.14001eff0
mov qword [0x1400367b0], rax
test rax, rax
jne 0x140006215
mov r8d, r12d
lea rcx, [rbp + 0x3e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1400367b0], rax
test rax, rax
jne 0x140006215
mov ebx, 0xc0000001
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbp + 0x3e0]
mov ecx, 4
mov r9d, eax
lea rdx, str.BCD_strings_MUI_load_failure__ws___u_.
call fcn.14000b134
mov r8d, ebx
lea rdx, str.Failed_to_initialize_global_state._Status____x_
mov ecx, 4
call fcn.14000b134
call fcn.140005af8
mov eax, ebx
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.14001fbe0
mov rbx, qword [rsp + 0x968]
add rsp, 0x910
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14001fdb8
int3