Function at 0x1400dd48c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x1401543b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
lea rcx, str.GetVolumeNameFromDeviceName
lea edi, [rbx + 1]
call fcn.140008368
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
call sub.msvcrt.dll_memset
test rbp, rbp
jne 0x1400dd51b
lea r9d, [rbx + 0x57]
mov edi, ebx
mov ebx, r9d
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dd6e4
test byte [rcx + 0x1c], 8
je 0x1400dd6e4
lea edx, [rbp + 0x16]
lea rax, str.pwszDeviceName
jmp 0x1400dd6cf
test rsi, rsi
jne 0x1400dd559
lea r9d, [rsi + 0x57]
mov edi, ebx
mov ebx, r9d
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dd6e4
test byte [rcx + 0x1c], 8
je 0x1400dd6e4
lea edx, [rsi + 0x17]
lea rax, str.pwszVolumeName
jmp 0x1400dd6cf
mov r15d, 0x105
mov word [rsi], bx
mov edx, r15d
lea r8, str._GLOBALROOT_s
mov r9, rbp
lea rcx, [rsp + 0x30]
call fcn.140006550
test eax, eax
jns 0x1400dd5f0
mov ecx, eax
mov edi, ebx
call fcn.1400de1e4
mov ebx, eax
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dd6e4
test byte [rcx + 0x1c], 8
je 0x1400dd6e4
mov r9, rbp
lea r8, str._GLOBALROOT_s
mov edx, r15d
lea rcx, [rsp + 0x30]
call fcn.140006550
lea rcx, str.DevicePathToWin32Path___WCHAR_pwszDeviceName__ARRAY_COUNT_PARAM_wszPath__
mov edx, 0x19
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov rcx, qword [0x140154180]
lea r8, [0x14012caf0]
mov rcx, qword [rcx + 0x10]
call fcn.1400cc0d8
jmp 0x1400dd6e4
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400dd5f9
cmp word [rsp + rax*2 + 0x2e], 0x5c
je 0x1400dd67b
lea r8, [0x1400e84e8]
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.14004b4c0
test eax, eax
jns 0x1400dd67b
mov ecx, eax
mov edi, ebx
call fcn.1400de1e4
mov ebx, eax
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dd6e4
test byte [rcx + 0x1c], 8
je 0x1400dd6e4
lea r8, [0x1400e84e8]
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.14004b4c0
mov r9d, eax
mov edx, 0x1a
lea rax, str.::StringCchCat__wszPath__ARRAYSIZE_wszPath___L____
mov qword [rsp + 0x20], rax
jmp 0x1400dd5d4
mov r8d, r14d
lea rcx, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x1400dd6e4
mov edi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dd6e4
test byte [rcx + 0x1c], 8
je 0x1400dd6e4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x140154180]
mov edx, 0x1b
mov r9d, eax
lea rax, str.::GetVolumeNameForVolumeMountPoint__wszPath__pwszVolumeName__cchVolumeName__
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012caf0]
mov qword [rsp + 0x20], rax
call fcn.1400cc0d8
lea rcx, str.GetVolumeNameFromDeviceName
call fcn.1400084a8
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001ff30
mov rbx, qword [rsp + 0x298]
add rsp, 0x250
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret