Function at 0x14004a358
Capabilities:
Get disk information

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1590]
mov eax, 0x1690
call fcn.140030b10
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x16c0], rbx
mov qword [rsp + 0x16d0], rsi
mov qword [rsp + 0x16d8], rdi
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x1580], rax
mov ebx, edx
mov r14d, ecx
mov dword [rsp + 0x30], ecx
mov esi, 0x800
test dword [0x1400ca100], esi
je 0x14004a3d2
lea rdx, [0x1400a1ff8]
lea rcx, [0x1400c8290]
call fcn.140028d78
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x41
xor r13d, r13d
mov word [rsp + 0x58], r13w
lea rax, fcn.140008d70
mov qword [rsp + 0x40], rax
mov rdx, qword [0x1400c9cc0]
lea rcx, [rbp + 0x980]
call fcn.140028fe8
nop
cmp qword [0x1400c9cc0], r13
je 0x14004a47c
lea rax, [rbp + 0x178]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], 0x401
mov word [rbp + 0x178], r13w
lea rax, [0x14008b990]
mov qword [rbp + 0x160], rax
lea rdx, [rbp + 0x160]
mov ecx, ebx
call fcn.14004fddc
xor r9d, r9d
mov r8, qword [rbp + 0x168]
mov edx, 0x800003f0
lea rcx, [rbp + 0x980]
call fcn.140051240
nop
lea rcx, [rbp + 0x160]
call fcn.140029298
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindows_Search
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xa0]
call fcn.140021940
nop
mov ebx, r13d
lea r8, [rsp + 0x40]
lea rdx, str.DataDirectory
lea rcx, [rbp + 0xa0]
call fcn.1400178f0
mov edi, 0x80070000
lea r12, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
test eax, eax
jne 0x14004a4f8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14004a4d9
movzx ebx, ax
or ebx, edi
mov rcx, qword [rbp + 0x15b8]
mov r9d, ebx
mov r8, r12
mov edx, 0x784
call fcn.14001f2e8
test ebx, ebx
js 0x14004a5e2
mov r8d, dword [rsp + 0x54]
lea edx, [r8 - 1]
mov rax, qword [rsp + 0x48]
movzx ecx, word [rax + rdx*2]
call fcn.1400257b4
test eax, eax
je 0x14004a522
lea rcx, [rsp + 0x40]
call fcn.140017e50
mov r8d, dword [rsp + 0x54]
mov rax, qword [rsp + 0x40]
or r9d, 0xffffffff
lea rdx, [0x1400a1728]
lea rcx, [rsp + 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x14000702c.0]
test dword [0x1400ca100], esi
je 0x14004a561
mov r8, qword [rsp + 0x48]
lea rdx, [0x1400a2258]
lea rcx, [0x1400c8290]
call fcn.140052f9c
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x48]
call fcn.14005bc7c
test eax, eax
jne 0x14004a5e2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x91
jne 0x14004a59c
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.14005bc7c
test eax, eax
jne 0x14004a5e2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, 0xfffffffc
jne 0x14004a5a8
cmp eax, 1
jne 0x14004a5e2
test eax, eax
jg 0x14004a5b0
mov ebx, eax
jmp 0x14004a5b5
movzx ebx, ax
or ebx, edi
mov rcx, qword [rbp + 0x15b8]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, str.DataDirectory:__ls
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r12
mov edx, 0x79f
call fcn.140050168
call fcn.14000aa20
test al, al
je 0x14004a72b
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetLogicalDrives]
mov r15d, eax
mov edi, r13d
mov r14d, 0x41
bt r15d, edi
jae 0x14004a71b
lea esi, [r14 + rdi]
movabs rax, 0x5c003a0020
mov qword [rbp + 0x12f0], rax
mov word [rbp + 0x12f0], si
lea rcx, [rbp + 0x12f0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 3
jne 0x14004a71b
mov rax, qword [rsp + 0x40]
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [0x14009f788]
lea rcx, [rsp + 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x14000702c.0]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140017eac
mov word [rax], si
mov rax, qword [rsp + 0x40]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x54]
lea rdx, str.System_Volume_InformationMicrosoftWindows_Search_
lea rcx, [rsp + 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x14000702c.0]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x48]
call fcn.14005bc7c
test eax, eax
jne 0x14004a71b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x91
jne 0x14004a6cd
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.14005bc7c
test eax, eax
jne 0x14004a71b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, 0xfffffffc
jne 0x14004a6d9
cmp eax, 1
jne 0x14004a71b
test ebx, ebx
js 0x14004a71b
test eax, eax
jg 0x14004a6e5
mov ebx, eax
jmp 0x14004a6ee
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rbp + 0x15b8]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, str.VolumeDataDirectory:__ls
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r12
mov edx, 0x7be
call fcn.140050168
inc edi
cmp edi, 0x1a
jb 0x14004a601
mov r14d, dword [rsp + 0x30]
lea rax, str.Applications
mov qword [rbp + 0x1300], rax
lea rax, str.CatalogNames
mov qword [rbp + 0x1308], rax
lea rax, str.Databases
mov qword [rbp + 0x1310], rax
lea rax, str.Gather
mov qword [rbp + 0x1318], rax
lea rax, str.Gathering_ManagerApplications
mov qword [rbp + 0x1320], rax
lea rax, str.UsnNotifier
mov qword [rbp + 0x1328], rax
lea rax, str.CrawlScopeManager
mov qword [rbp + 0x1330], rax
lea rax, str.CatalogListApplications
mov qword [rbp + 0x1338], rax
mov ecx, 2
call fcn.14002b118
mov r12d, eax
lea r15, [rbp + 0x1300]
sub r14d, 3
neg r14d
sbb rsi, rsi
add rsi, 8
lea rax, [rbp]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x41
mov word [rbp], r13w
lea rax, fcn.140008d70
mov qword [rbp - 0x18], rax
lea rax, [0x14008b078]
mov qword [rbp - 0x20], rax
mov dword [rbp + 0x88], r13d
mov qword [rbp + 0x90], r13
mov r14, qword [r15]
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov r8, r14
mov rdx, qword [rbp + 0x150]
lea rcx, [rbp - 0x20]
call fcn.1400177b0
mov edi, eax
test eax, eax
js 0x14004a870
mov dword [rsp + 0x30], 0x100
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x1380]
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.140044b2c
test eax, eax
je 0x14004a870
lea rdx, [rbp + 0x1380]
lea rcx, [rbp - 0x20]
call fcn.14005b1c0
test eax, eax
jne 0x14004a824
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x14004a870
movzx edi, ax
or edi, 0x80070000
cmp r12d, edi
je 0x14004a883
mov ecx, 3
call fcn.14002b118
cmp eax, edi
jne 0x14004a886
mov edi, r13d
mov rcx, qword [rbp + 0x15b8]
mov qword [rsp + 0x28], r14
lea rax, str.CleanupRegKey:__ls
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x7fc
call fcn.1400501a0
nop
test ebx, ebx
cmovs edi, ebx
mov ebx, edi
lea rcx, [rbp - 0x20]
call fcn.140017740
add r15, 8
sub rsi, 1
jne 0x14004a7bd
cmp qword [0x1400c9cc0], r13
je 0x14004a9b4
test ebx, ebx
js 0x14004a91e
xor r8d, r8d
mov edx, 0x400003f2
lea rcx, [rbp + 0x980]
call fcn.140029230
test dword [0x1400ca100], 0x800
je 0x14004a9b4
lea rdx, [0x1400a1168]
lea rcx, [0x1400c8290]
call fcn.140028d78
jmp 0x14004a9b4
xor r9d, r9d
lea r8, [0x1400a11d8]
lea edi, [r9 + 0x20]
mov edx, edi
lea rcx, [rbp + 0x1340]
call fcn.140009728
mov r9d, ebx
lea r8, str.0x_x
mov edx, edi
lea rcx, [rbp + 0x1300]
call fcn.140009728
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1300]
lea r8, [rbp + 0x1340]
mov edx, 0xc00003f3
lea rcx, [rbp + 0x980]
call fcn.140050c84
test dword [0x1400ca100], 0x8000
je 0x14004a998
mov r8d, ebx
lea rdx, [0x1400a2188]
lea rcx, [0x1400c8290]
call fcn.140052eb8
mov rcx, qword [rbp + 0x15b8]
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x813
call fcn.14001f2e8
nop
lea rcx, [rbp + 0xa0]
call fcn.140017740
nop
lea rcx, [rbp + 0x980]
call fcn.14002ce70
nop
lea rcx, [rsp + 0x40]
call fcn.140029258
mov eax, ebx
mov rcx, qword [rbp + 0x1580]
xor rcx, rsp
call fcn.14002dd40
lea r11, [rsp + 0x1690]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret