Function at 0x1101087b0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor r12d, r12d
mov rdi, rdx
mov r14, rcx
test rcx, rcx
jne 0x11010881d
call sym.msvcrt.dll___doserrno
mov dword [rax], r12d
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
jmp 0x110108c1c
test rdi, rdi
je 0x1101087f1
lea rdx, [0x110179028]
call sym.msvcrt.dll__mbspbrk
test rax, rax
je 0x11010884b
call sym.msvcrt.dll__errno
mov edi, 2
mov dword [rax], edi
call sym.msvcrt.dll___doserrno
mov dword [rax], edi
jmp 0x110108c1c
cmp byte [r14 + 1], 0x3a
jne 0x11010886c
cmp byte [r14], r12b
je 0x11010885d
cmp byte [r14 + 2], r12b
je 0x110108833
movsx ecx, byte [r14]
call sym.msvcrt.dll__mbctolower
lea r13d, [rax - 0x60]
jmp 0x110108874
call sym.msvcrt.dll__getdrive
mov r13d, eax
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x110108a50
lea rdx, [0x11017902c]
mov rcx, r14
mov r15, r12
call sym.msvcrt.dll__mbspbrk
test rax, rax
je 0x110108833
call sym.msvcrt.dll__errno
mov r12d, dword [rax]
call sym.msvcrt.dll__errno
mov r8d, 0x104
lea rcx, [rbp + 0xa0]
mov rdx, r14
and dword [rax], r15d
call sym.msvcrt.dll__fullpath
mov rsi, rax
test rax, rax
je 0x1101088dd
call sym.msvcrt.dll__errno
mov dword [rax], r12d
jmp 0x110108906
call sym.msvcrt.dll__errno
cmp dword [rax], 0x22
jne 0x110108833
call sym.msvcrt.dll__errno
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
mov dword [rax], r12d
call sym.msvcrt.dll__fullpath
mov r15, rax
mov rsi, rax
xor r12d, r12d
test rsi, rsi
je 0x110108a3a
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rsi + rcx], r12b
jne 0x110108916
cmp rcx, 3
je 0x1101089d8
or rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], r12b
jne 0x11010892d
cmp rax, 5
jb 0x110108a3a
mov r9b, 0x5c
mov r8b, 0x2f
cmp byte [rsi], r9b
je 0x110108954
cmp byte [rsi], r8b
jne 0x110108a3a
mov al, byte [rsi + 1]
cmp al, r9b
je 0x110108965
cmp al, r8b
jne 0x110108a3a
mov al, byte [rsi + 2]
cmp al, r9b
je 0x110108a3a
cmp al, r8b
je 0x110108a3a
lea rdx, [rsi + 3]
mov al, byte [rdx]
test al, al
je 0x110108a3a
mov cl, al
mov al, cl
cmp cl, r9b
je 0x1101089a1
cmp cl, r8b
je 0x1101089a1
inc rdx
mov al, byte [rdx]
mov cl, al
test al, al
jne 0x11010898a
test al, al
je 0x110108a3a
lea rcx, [rdx + 1]
mov al, byte [rcx]
test al, al
je 0x110108a3a
mov dl, al
cmp al, r9b
je 0x1101089ce
cmp al, r8b
je 0x1101089ce
inc rcx
mov al, byte [rcx]
mov dl, al
test al, al
jne 0x1101089b7
test dl, dl
je 0x1101089d8
cmp byte [rcx + 1], r12b
jne 0x110108a3a
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeA]
mov esi, 1
cmp eax, esi
jbe 0x110108a3a
test r15, r15
je 0x1101089f7
mov rcx, r15
call sym.msvcrt.dll_free
or dword [rsp + 0x30], 0xffffffff
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov r8d, esi
mov edx, esi
mov dword [rsp + 0x20], r12d
mov ecx, 0x7bc
mov dword [rsp + 0x60], 0x10
mov qword [rsp + 0x7c], r12
mov byte [rbp - 0x74], r12b
call fcn.110165164
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x30], rax
jmp 0x110108bc6
test r15, r15
je 0x110108833
mov rcx, r15
call sym.msvcrt.dll_free
jmp 0x110108833
cmp dword [rsp + 0x74], r12d
jne 0x110108a63
cmp dword [rsp + 0x78], r12d
jne 0x110108a63
mov rax, r12
jmp 0x110108ac7
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x74]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x110108c06
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNELBASE.dll_FileTimeToSystemTime]
test eax, eax
je 0x110108c06
or dword [rsp + 0x30], 0xffffffff
movzx eax, word [rsp + 0x54]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
movzx r8d, word [rsp + 0x4e]
movzx edx, word [rsp + 0x4a]
movzx ecx, word [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.110165164
mov qword [rdi + 0x28], rax
cmp dword [rsp + 0x6c], r12d
jne 0x110108ad9
cmp dword [rsp + 0x70], r12d
je 0x110108b3d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x110108c06
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNELBASE.dll_FileTimeToSystemTime]
test eax, eax
je 0x110108c06
or dword [rsp + 0x30], 0xffffffff
movzx eax, word [rsp + 0x54]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
movzx r8d, word [rsp + 0x4e]
movzx edx, word [rsp + 0x4a]
movzx ecx, word [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.110165164
mov qword [rdi + 0x20], rax
cmp dword [rsp + 0x64], r12d
jne 0x110108b55
cmp dword [rsp + 0x68], r12d
jne 0x110108b55
mov rax, qword [rdi + 0x28]
jmp 0x110108bb9
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x64]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x110108c06
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNELBASE.dll_FileTimeToSystemTime]
test eax, eax
je 0x110108c06
or dword [rsp + 0x30], 0xffffffff
movzx eax, word [rsp + 0x54]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
movzx r8d, word [rsp + 0x4e]
movzx edx, word [rsp + 0x4a]
movzx ecx, word [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.110165164
mov rcx, rsi
mov qword [rdi + 0x30], rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov ecx, dword [rsp + 0x60]
mov rdx, r14
call fcn.1101086b8
mov ecx, dword [rsp + 0x7c]
mov word [rdi + 6], ax
mov eax, dword [rbp - 0x80]
shl rcx, 0x20
add rcx, rax
mov dword [rdi + 8], 1
lea eax, [r13 - 1]
mov qword [rdi + 0x18], rcx
mov dword [rdi], eax
mov dword [rdi + 0x10], eax
xor eax, eax
mov word [rdi + 4], r12w
mov word [rdi + 0xc], r12w
jmp 0x110108c1f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.110107d08
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
or eax, 0xffffffff
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1101303f0
lea r11, [rsp + 0x2c0]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret