Function at 0x14002bfec
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
xor edi, edi
movzx r13d, di
mov dword [rsp + 0x3c], r13d
mov word [rsp + 0x20], di
cmp dword [0x140041924], edi
je 0x14002c047
xor edx, edx
mov ecx, 0x2335
call fcn.140003240
call fcn.1400158e4
cmp dword [0x14003d110], edi
je 0x14002c6db
cmp dword [0x140045b80], edi
jne 0x14002c067
lea rcx, [0x1400348f0]
call fcn.140013448
cmp byte [0x140045966], dil
je 0x14002c079
lea r15, [0x140058800]
jmp 0x14002c0ab
lea rcx, [0x1400345b0]
call fcn.14001081c
mov r15, rax
test rax, rax
je 0x14002c0ab
mov r8, rax
mov edx, 0x200
lea r15, [0x140058800]
mov rcx, r15
call fcn.1400113e0
mov byte [0x140045966], 1
lea r13, [0x140058250]
mov rcx, r13
mov rax, qword [0x140058458]
test rax, rax
cmovne rcx, rax
xor r8d, r8d
mov edx, dword [0x140058468]
call fcn.14001417c
lea rcx, [rsp + 0x58]
call fcn.14002bf84
mov r12, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14002c6db
mov rsi, rax
mov qword [rsp + 0x30], rax
mov word [rax], di
mov r14, qword [rsp + 0x58]
dec r14
mov qword [rsp + 0x28], r14
test r15, r15
je 0x14002c673
movzx eax, word [r15]
test ax, ax
je 0x14002c673
or rbx, 0xffffffffffffffff
test ax, ax
je 0x14002c6b1
cmp ax, 0x24
je 0x14002c19a
movzx r9d, ax
lea r8, [0x14003612c]
mov rdx, r14
mov rcx, rsi
call fcn.1400133f0
mov rax, rbx
inc rax
cmp word [rsi + rax*2], di
jne 0x14002c146
lea rsi, [rsi + rax*2]
mov qword [rsp + 0x30], rsi
sub r14, rax
mov qword [rsp + 0x28], r14
call fcn.140018438
test al, al
je 0x14002c18a
movzx r13d, word [r15]
mov dword [rsp + 0x3c], r13d
movzx ecx, r13w
call fcn.14002cbd0
test eax, eax
je 0x14002c18a
mov word [rsp + 0x20], r13w
jmp 0x14002c666
mov ecx, edi
mov dword [rsp + 0x3c], ecx
mov word [rsp + 0x20], cx
jmp 0x14002c666
add r15, 2
mov qword [rsp + 0x60], r15
mov r12d, edi
lea r14, [0x140036380]
mov r13d, r12d
lea rax, [r13*2]
add rax, r13
movzx ebx, word [r14 + rax*2]
test bx, bx
je 0x14002c1e2
movzx ecx, word [r15]
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
cmp ax, bx
je 0x14002c1df
inc r12d
jmp 0x14002c1ad
test bx, bx
mov r14, qword [rsp + 0x28]
je 0x14002c6ad
lea rax, [r13*2]
add rax, r13
lea rcx, [0x140036380]
cmp word [rcx + rax*2 + 2], 8
jne 0x14002c234
movzx r9d, word [rcx + rax*2 + 4]
lea r8, [0x14003612c]
mov rdx, r14
mov rcx, rsi
call fcn.1400133f0
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rsi + rax*2], di
jne 0x14002c226
jmp 0x14002c2b8
movzx ecx, word [rcx + rax*2 + 2]
sub ecx, 1
je 0x14002c63c
sub ecx, 1
je 0x14002c628
sub ecx, 1
je 0x14002c5ec
sub ecx, 1
je 0x14002c591
sub ecx, 1
je 0x14002c4bd
sub ecx, 1
je 0x14002c43d
sub ecx, 3
je 0x14002c3f9
cmp ecx, 1
je 0x14002c2ce
lea rcx, [0x140058250]
mov rax, qword [0x140058458]
test rax, rax
cmovne rcx, rax
movzx r9d, word [rcx]
lea r8, [0x14003612c]
mov rdx, r14
mov rcx, rsi
call fcn.1400133f0
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rsi + rax*2], di
jne 0x14002c2af
lea rsi, [rsi + rax*2]
mov qword [rsp + 0x30], rsi
sub r14, rax
mov qword [rsp + 0x28], r14
jmp 0x14002c666
cmp byte [0x140045b25], dil
je 0x14002c662
mov dword [rsp + 0x38], edi
lea r12, [0x140058250]
mov rax, r12
mov rcx, qword [0x140058458]
test rcx, rcx
cmovne rax, rcx
movzx eax, word [rax]
mov word [rsp + 0x70], ax
mov rax, r12
cmovne rax, rcx
movzx eax, word [rax + 2]
mov word [rsp + 0x72], ax
mov dword [rsp + 0x74], 0x5c
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 4
jne 0x14002c662
mov word [rsp + 0x74], di
mov dword [rsp + 0x40], 0x104
call fcn.1400197bc
test al, al
je 0x14002c36b
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ext_ms_win_cmd_util_l1_1_0.dll_WNetGetConnectionWStub]
nop dword [rax + rax]
mov dword [rsp + 0x38], eax
jmp 0x14002c373
mov dword [rsp + 0x38], 0x78
or rbx, 0xffffffffffffffff
jmp 0x14002c397
cmp dword [rsp + 0x38], edi
je 0x14002c3ce
cmp dword [rsp + 0x38], 0x8ca
je 0x14002c666
lea r8, str.Unknown
mov rdx, r14
mov rcx, rsi
call fcn.1400133f0
mov rax, rbx
inc rax
cmp word [rsi + rax*2], di
jne 0x14002c3c0
jmp 0x14002c2b8
lea r9, [rsp + 0xc0]
lea r8, [0x140036308]
mov rdx, r14
mov rcx, rsi
call fcn.1400133f0
mov rax, rbx
inc rax
cmp word [rsi + rax*2], di
jne 0x14002c3eb
jmp 0x14002c2b8
cmp byte [0x140045b25], dil
je 0x14002c662
mov ecx, dword [0x140045b88]
cmp r14, 1
jbe 0x14002c662
mov eax, ecx
dec ecx
test eax, eax
je 0x14002c662
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
mov qword [rsp + 0x30], rsi
dec r14
mov qword [rsp + 0x28], r14
jmp 0x14002c40c
lea rax, [r14 - 1]
mov ecx, edi
mov r8d, 0x7ffffffe
cmp rax, r8
mov eax, 0x80070057
cmova ecx, eax
test ecx, ecx
js 0x14002c4a0
mov rdx, r14
mov rcx, rsi
test r14, r14
je 0x14002c490
sub r8, r14
lea r9, [0x1400348f0]
sub r9, rsi
lea rax, [rdx + r8]
test rax, rax
je 0x14002c490
movzx eax, word [rcx + r9]
test ax, ax
je 0x14002c490
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14002c470
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
jmp 0x14002c4a8
test r14, r14
je 0x14002c4a8
mov word [rsi], di
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rsi + rax*2], di
jne 0x14002c4af
jmp 0x14002c2b8
lea rax, [r14 - 1]
mov ecx, edi
mov r8d, 0x7ffffffe
cmp word [rsp + 0x3c], di
je 0x14002c51d
cmp rax, r8
mov eax, 0x80070057
cmova ecx, eax
test ecx, ecx
js 0x14002c574
mov rdx, r14
mov rcx, rsi
test r14, r14
je 0x14002c564
sub r8, r14
lea r9, str._b_b___b_b
sub r9, rsi
lea rax, [rdx + r8]
test rax, rax
je 0x14002c564
movzx eax, word [rcx + r9]
test ax, ax
je 0x14002c564
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14002c4fb
jmp 0x14002c564
cmp rax, r8
mov eax, 0x80070057
cmova ecx, eax
test ecx, ecx
js 0x14002c574
mov rdx, r14
mov rcx, rsi
test r14, r14
je 0x14002c564
sub r8, r14
lea r9, [0x140036168]
sub r9, rsi
lea rax, [rdx + r8]
test rax, rax
je 0x14002c564
movzx eax, word [rcx + r9]
test ax, ax
je 0x14002c564
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14002c544
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
jmp 0x14002c57c
test r14, r14
je 0x14002c57c
mov word [rsi], di
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rsi + rax*2], di
jne 0x14002c583
jmp 0x14002c2b8
lea rcx, [rsp + 0x80]
call fcn.14000586c
lea rdx, [rsp + 0x80]
mov ecx, 0x2350
call fcn.14001885c
mov rbx, rax
mov r9, rax
lea r8, [0x1400348f8]
mov rdx, r14
mov rcx, rsi
call fcn.1400133f0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rsi + rax*2], di
jne 0x14002c5de
jmp 0x14002c2b8
lea r9, [0x140058250]
mov rax, qword [0x140058458]
test rax, rax
cmovne r9, rax
lea r8, [0x1400348f8]
mov rdx, r14
mov rcx, rsi
call fcn.1400133f0
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rsi + rax*2], di
jne 0x14002c61a
jmp 0x14002c2b8
mov r9d, r14d
mov r8, rsi
mov edx, 1
xor ecx, ecx
call fcn.140006ee4
jmp 0x14002c64e
mov r9d, r14d
mov r8, rsi
mov edx, 1
xor ecx, ecx
call fcn.140013140
movsxd rcx, eax
sub r14, rcx
lea rsi, [rsi + rcx*2]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], rsi
or rbx, 0xffffffffffffffff
add r15, 2
movzx eax, word [r15]
jmp 0x14002c11e
mov rax, qword [0x140058458]
test rax, rax
cmovne r13, rax
mov r9, r13
lea r8, [0x140036110]
mov rdx, r14
mov rcx, r12
call fcn.1400133f0
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [r12 + rax*2], di
jne 0x14002c69d
lea rsi, [r12 + rax*2]
jmp 0x14002c6b6
or rbx, 0xffffffffffffffff
mov r12, qword [rsp + 0x48]
mov word [rsi], di
inc rbx
cmp word [r12 + rbx*2], di
jne 0x14002c6b9
mov rdx, rbx
mov rcx, r12
call fcn.1400134a0
cmp dword [0x140041924], edi
je 0x14002c6db
call fcn.1400158e4
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140018f80
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret