Function at 0x1001138d0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x500
mov rax, qword [0x100176150]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov r12d, ecx
mov dword [rsp + 0x40], ecx
xor r14d, r14d
lea rcx, [0x100041e00]
mov rdi, r8
mov qword [rsp + 0x98], r8
mov r13, rdx
mov qword [rsp + 0x60], rdx
mov esi, r14d
lea ebx, [r14 + 1]
call fcn.10011cf34
mov ebp, 0x206
lea rcx, [rsp + 0xd2]
xor edx, edx
mov r8, rbp
mov qword [rsp + 0x70], r14
mov word [rsp + 0xd0], r14w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x2e2]
mov r8, rbp
xor edx, edx
mov word [rsp + 0x2e0], r14w
call sub.msvcrt.dll_memset
lea r8d, [r14 + 0x26]
lea rcx, [rsp + 0xa2]
xor edx, edx
mov word [rsp + 0xa0], r14w
call sub.msvcrt.dll_memset
or qword [rsp + 0x90], 0xffffffffffffffff
xor ecx, ecx
or eax, 0xffffffff
or r15, 0xffffffffffffffff
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rcx
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x58], eax
cmp rdi, rcx
je 0x1001139c0
mov qword [rdi], rcx
cmp r13, rcx
jne 0x100113a16
mov r9d, 0x57
mov ebx, ecx
mov esi, r9d
mov rcx, qword [0x100177368]
lea rdi, [0x100177368]
cmp rcx, rdi
je 0x1001143ed
test byte [rcx + 0x1c], 8
je 0x1001143ed
lea edx, [r9 - 0x3b]
lea rax, [0x100041e38]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039c0]
mov qword [rsp + 0x20], rax
call fcn.100106f14
jmp 0x1001143ed
cmp rdi, rcx
jne 0x100113a54
mov r9d, 0x57
mov ebx, ecx
mov esi, r9d
mov rcx, qword [0x100177368]
lea rdi, [0x100177368]
cmp rcx, rdi
je 0x1001143ed
test byte [rcx + 0x1c], 8
je 0x1001143ed
lea edx, [r9 - 0x3a]
lea rax, [0x100041e48]
jmp 0x1001139fc
cmp dword [r13 + 4], ecx
je 0x1001143ed
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], rcx
lea rdx, [0x100041a40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x68]
xor edx, edx
cmp eax, edx
mov edi, edx
sete dil
cmp rcx, rdx
je 0x100113aac
cmp rcx, 0xffffffffffffffff
je 0x100113aac
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
cmp edi, edx
je 0x100113aec
mov rcx, qword [0x100177368]
lea rdi, [0x100177368]
cmp rcx, rdi
je 0x100113ae5
mov r13d, 2
test byte [rcx + 0x1c], r13b
je 0x100113ae5
mov rcx, qword [rcx + 0x10]
lea edx, [r13 + 0x1c]
lea r8, [0x1000039c0]
call fcn.100106cf8
xor edx, edx
mov esi, edx
jmp 0x1001143ed
call fcn.100117c3c
xor edi, edi
movsxd rbp, eax
cmp ebp, edi
jne 0x100113b36
mov ebx, edi
mov esi, 0x65e
mov rcx, qword [0x100177368]
lea rdi, [0x100177368]
cmp rcx, rdi
je 0x1001143ed
test byte [rcx + 0x1c], 8
je 0x1001143ed
mov edx, AtlInternalQueryInterface
lea rax, [0x100041e60]
mov r9d, esi
jmp 0x1001139fc
cmp ebp, ebx
jne 0x100113b94
lea rcx, [rsp + 0x78]
call fcn.1001132b4
cmp eax, edi
jne 0x100113b94
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [0x100177368]
lea rdi, [0x100177368]
cmp rax, rdi
je 0x1001143ed
test byte [rax + 0x1c], 8
je 0x1001143ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, reloc.ATL.DLL_AtlInternalQueryInterface
mov r9d, eax
lea rax, [0x100041e78]
mov rcx, qword [0x100177368]
jmp 0x1001139fc
lea rcx, [rsp + 0x2e0]
mov edx, 0x104
call fcn.100113488
cmp eax, edi
jne 0x100113bec
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [0x100177368]
lea rdi, [0x100177368]
cmp rax, rdi
je 0x1001143ed
test byte [rax + 0x1c], 8
je 0x1001143ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x21
mov r9d, eax
lea rax, [0x100041eb0]
jmp 0x100113b88
mov eax, 3
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
mov edx, 0x80000000
mov r8d, eax
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x90], rax
cmp rax, rdi
je 0x1001143ae
cmp rax, 0xffffffffffffffff
je 0x1001143ae
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov edx, 0x560000
mov rcx, rax
call fcn.10011db14
cmp eax, edi
jne 0x100113ca4
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [0x100177368]
lea rdi, [0x100177368]
cmp rax, rdi
je 0x1001143ed
test byte [rax + 0x1c], 8
je 0x1001143ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x23
mov r9d, eax
lea rax, [0x100041f10]
jmp 0x100113b88
lea rcx, [rsp + 0x48]
call fcn.100120350
cmp eax, edi
jne 0x100113d10
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [0x100177368]
lea rdi, [0x100177368]
cmp rax, rdi
je 0x100113d06
test byte [rax + 0x1c], 8
je 0x100113d06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x24
mov r9d, eax
lea rax, [0x100041f88]
mov rcx, qword [0x100177368]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039c0]
mov qword [rsp + 0x20], rax
call fcn.100106f14
mov r14, qword [rsp + 0x48]
jmp 0x1001143ed
mov r10, qword [rsp + 0x48]
cmp word [r10], di
je 0x100113d3e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r10
repne scasw ax, word [rdi]
xor edi, edi
not rcx
sub rcx, rbx
cmp word [r10 + rcx*2 - 2], 0x5c
jne 0x100113d3e
mov word [r10 + rcx*2 - 2], di
mov r8d, 3
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov edx, 0x80000000
mov rcx, r10
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rsp + 0x50], rax
cmp rax, rdi
je 0x100114362
cmp rax, 0xffffffffffffffff
je 0x100114362
lea rax, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x560000
mov rcx, r15
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.10011db14
cmp eax, edi
jne 0x100113df0
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [0x100177368]
lea rdi, [0x100177368]
cmp rax, rdi
je 0x100113d06
test byte [rax + 0x1c], 8
je 0x100113d06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x26
mov r9d, eax
lea rax, [0x100041fd0]
jmp 0x100113cea
mov eax, dword [r13 + 4]
lea ecx, [rax + rax*2]
shl ecx, 3
call fcn.10011d3f0
xor r11d, r11d
mov rcx, rax
mov qword [rsp + 0x70], rax
cmp rax, r11
jne 0x100113e49
mov ebx, r11d
lea esi, [r11 + 0xe]
mov rcx, qword [0x100177368]
lea rdi, [0x100177368]
cmp rcx, rdi
je 0x100113d06
test byte [rcx + 0x1c], 8
je 0x100113d06
lea edx, [rsi + 0x19]
lea rax, [0x100042040]
mov r9d, esi
jmp 0x100113cf1
mov r15d, r11d
mov r9, rbp
mov qword [rsp + 0x68], rbp
cmp dword [r13 + 4], r11d
jbe 0x1001141e6
lea r14, [rax + 0xc]
mov rax, qword [rsp + 0x60]
lea rbp, [r13 + 0x50]
mov r13d, 2
lea rdi, [0x100177368]
lea rcx, [0x100000000]
mov dword [r14 - 4], r15d
cmp dword [rbp - 8], r11d
je 0x1001141c9
cmp dword [rbp - 0x20], r11d
jne 0x100113eaf
mov al, byte [rbp]
cmp al, r11b
je 0x1001141c4
cmp al, 5
je 0x1001141c4
cmp al, 0xf
je 0x1001141c4
cmp dword [rbp - 0x20], ebx
jne 0x100113ee1
mov rdx, qword [rbp]
lea rcx, [rcx + 0x359e8]
cmp rdx, qword [rcx]
jne 0x100113ed3
mov rdx, qword [rbp + 8]
cmp rdx, qword [rcx + 8]
jne 0x100113ed3
mov eax, r11d
jmp 0x100113ed8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r11d
je 0x1001141bd
mov rcx, qword [rsp + 0x80]
mov edx, r11d
mov r8d, dword [rcx]
cmp r8d, r11d
jbe 0x100113f4a
add rcx, 0x10
cmp dword [rcx - 8], r12d
jne 0x100113f07
mov rax, qword [rbp - 0x18]
cmp qword [rcx], rax
je 0x100113f14
add edx, ebx
add rcx, 0x18
cmp edx, r8d
jae 0x100113f4a
jmp 0x100113ef8
movzx eax, word [r14]
or ax, r13w
mov word [r14], ax
cmp r9, rbx
jne 0x100113f2c
cmp dword [rsp + 0x78], r12d
je 0x100113f31
cmp r9, r13
jne 0x100113f4a
or ax, 4
mov word [r14], ax
cmp r9, r13
jne 0x100113f4a
mov eax, dword [rbp - 8]
mov dword [rsp + 0x5c], r12d
mov dword [rsp + 0x58], eax
mov rcx, qword [rsp + 0x88]
mov edx, r11d
mov r8d, dword [rcx]
cmp r8d, r11d
jbe 0x100113f81
add rcx, 0x10
cmp dword [rcx - 8], r12d
jne 0x100113f70
mov rax, qword [rbp - 0x18]
cmp qword [rcx], rax
je 0x100113f7d
add edx, ebx
add rcx, 0x18
cmp edx, r8d
jae 0x100113f81
jmp 0x100113f61
or word [r14], bx
mov edx, dword [rbp - 8]
lea r9, [rsp + 0xd0]
xor r8d, r8d
mov ecx, r12d
mov dword [rsp + 0x20], 0x104
call fcn.10011e640
xor r12d, r12d
cmp eax, r12d
je 0x100114305
mov eax, r15d
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x70]
lea r12, [rax + rcx*8]
lea rcx, [rsp + 0xd0]
mov rdx, r12
call fcn.100121214
xor r11d, r11d
cmp eax, r11d
jne 0x100114004
mov r10, qword [0x100177368]
cmp r10, rdi
je 0x10011400b
test byte [r10 + 0x1c], r13b
je 0x10011400b
mov rcx, qword [r10 + 0x10]
lea edx, [r11 + 0x29]
lea r9, [rsp + 0xd0]
lea r8, [0x1000039c0]
call fcn.100106e10
xor r11d, r11d
mov r10, qword [0x100177368]
mov r9, qword [rsp + 0x68]
cmp r9, r13
jne 0x1001141b8
cmp dword [rbp - 0x20], ebx
jne 0x10011404e
mov rdx, qword [rbp]
lea rcx, [0x100000000]
lea rcx, [rcx + 0x359f8]
cmp rdx, qword [rcx]
jne 0x100114044
mov rdx, qword [rbp + 8]
cmp rdx, qword [rcx + 8]
jne 0x100114044
mov eax, r11d
jmp 0x100114049
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r11d
je 0x10011406b
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x5c]
cmp ecx, eax
jne 0x100114063
mov edx, dword [rsp + 0x58]
cmp dword [rbp - 8], edx
je 0x100114077
mov r12d, ecx
jmp 0x1001141bd
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x5c]
mov edx, dword [rsp + 0x58]
cmp ecx, eax
jne 0x100114080
cmp dword [rbp - 8], edx
je 0x1001140af
cmp r10, rdi
je 0x1001140af
test byte [r10 + 0x1c], 4
je 0x1001140af
mov eax, dword [rbp - 8]
mov r9d, ecx
mov rcx, qword [r10 + 0x10]
lea r8, [0x1000039c0]
mov edx, 0x2a
mov dword [rsp + 0x20], eax
call fcn.100106ecc
mov ecx, dword [rsp + 0x40]
mov eax, dword [rbp - 8]
lea r9, [0x1000420c8]
lea r8, [0x1000420f0]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0xd0]
mov edx, 0x104
call fcn.100052890
xor ecx, ecx
cmp eax, ecx
jl 0x100114289
mov dword [rsp + 0x38], reloc.ATL.DLL_AtlModuleRevokeClassObjects
mov byte [r14 + 2], cl
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov word [rsp + 0xa0], cx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0xd0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor r11d, r11d
cmp eax, r11d
jne 0x100114195
mov rax, qword [0x100177368]
cmp rax, rdi
je 0x100114179
test byte [rax + 0x1c], 4
je 0x100114179
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100177368]
mov r12d, dword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 8]
lea r8, [0x1000039c0]
mov edx, 0x2c
mov r9d, r12d
mov dword [rsp + 0x20], eax
call fcn.100113164
xor r11d, r11d
jmp 0x10011417e
mov r12d, dword [rsp + 0x40]
cmp r12d, dword [rsp + 0x5c]
jne 0x10011418e
mov eax, dword [rsp + 0x58]
cmp dword [rbp - 8], eax
je 0x1001141f8
mov r9, qword [rsp + 0x68]
jmp 0x1001141bd
lea rdx, [r12 + 0xe]
lea rcx, [rsp + 0xa0]
call fcn.10012f358
xor r11d, r11d
cmp eax, r11d
je 0x100114255
mov r9, qword [rsp + 0x68]
mov r12d, dword [rsp + 0x40]
lea rcx, [0x100000000]
mov rax, qword [rsp + 0x60]
add r15d, ebx
add rbp, 0x90
add r14, 0x18
cmp r15d, dword [rax + 4]
jb 0x100113e7f
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x70], r11
mov qword [rax], rcx
jmp 0x100114246
mov ebx, r11d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [0x100177368]
cmp rax, rdi
je 0x100114246
test byte [rax + 0x1c], 8
je 0x100114246
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x2d
mov r9d, eax
lea rax, [0x10003f868]
mov rcx, qword [0x100177368]
lea r8, [0x1000039c0]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.100106f14
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x50]
jmp 0x1001143ed
mov ebx, r11d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [0x100177368]
cmp rax, rdi
je 0x100114246
test byte [rax + 0x1c], 8
je 0x100114246
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x2e
mov r9d, eax
lea rax, [0x1000421f0]
jmp 0x10011422a
mov ebx, ecx
mov ecx, eax
call fcn.10011cfdc
mov esi, eax
mov rax, qword [0x100177368]
cmp rax, rdi
je 0x100114246
test byte [rax + 0x1c], 8
je 0x100114246
mov eax, dword [rbp - 8]
lea r9, [0x1000420c8]
lea r8, [0x1000420f0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x40]
lea rcx, [rsp + 0xd0]
mov edx, 0x104
mov dword [rsp + 0x20], eax
call fcn.100052890
mov rcx, qword [0x100177368]
lea r8, [0x1000039c0]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
lea rax, [0x100042140]
mov edx, 0x2b
mov qword [rsp + 0x20], rax
call fcn.100106f14
jmp 0x100114246
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [0x100177368]
cmp rax, rdi
je 0x100114353
test byte [rax + 0x1c], 8
je 0x100114353
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100177368]
lea r8, [0x1000039c0]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
lea rax, [0x100042050]
mov edx, 0x28
mov qword [rsp + 0x20], rax
call fcn.100106f14
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x50]
jmp 0x1001143f0
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x100177368]
lea rdi, [0x100177368]
cmp rcx, rdi
je 0x100113d06
test byte [rcx + 0x1c], 8
je 0x100113d06
mov rcx, qword [rcx + 0x10]
lea r9, [0x100041fb8]
lea r8, [0x1000039c0]
mov edx, 0x25
call fcn.10010a294
jmp 0x100113d06
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x100177368]
lea rdi, [0x100177368]
cmp rcx, rdi
je 0x1001143ed
test byte [rcx + 0x1c], 8
je 0x1001143ed
mov rcx, qword [rcx + 0x10]
lea r9, [0x100041f00]
lea r8, [0x1000039c0]
mov edx, 0x22
call fcn.10010a294
xor r12d, r12d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsp + 0x90]
cmp rax, r12
je 0x10011443c
cmp rax, 0xffffffffffffffff
je 0x10011443c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r15, r12
je 0x100114450
cmp r15, 0xffffffffffffffff
je 0x100114450
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100041e00]
call fcn.10011cf74
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.100130df0
mov rbx, qword [rsp + 0x558]
add rsp, 0x500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret