Function at 0x164ca66a0
Capabilities:
Get common file path
Get disk information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r12, rcx
mov r14, rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov r15, r8
mov qword [rsp + 0x40], r8
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x38], esi
mov ebx, esi
test rdx, rdx
jne 0x164ca670d
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x164ca6ab5
movups xmm0, xmmword [str.SystemRoot_]
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x164ce0828]
movsd qword [rsp + 0x70], xmm0
movzx eax, word [0x164ce0830]
mov word [rsp + 0x78], ax
mov r8d, 0xc
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x164ca6791
mov edx, r15d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, eax
test rax, rax
je 0x164ca6779
cmp rax, r15
jae 0x164ca6779
lea r8, [r12 + 0x16]
mov rdx, r15
mov rcx, r14
call fcn.164ca78c0
test eax, eax
sete r13b
test r13d, r13d
jne 0x164ca6ab2
lea ecx, [r13 + 0x7a]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x164ca6ab2
mov rax, qword [0x164cf5d30]
test rax, rax
jne 0x164ca67d8
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x164ca67c8
lea rdx, str.GetVolumePathNamesForVolumeNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x164cf5d30], rax
jmp 0x164ca67cf
mov rax, qword [0x164cf5d30]
test rax, rax
je 0x164ca69b3
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x3c], r13d
mov r8d, 0x208
lea rdx, [rsp + 0x80]
mov rcx, r12
call sym.aswCmnBS.dll_ConvertNtPathToGuidPath
test eax, eax
je 0x164ca6706
mov r8d, 4
lea rdx, [0x164ce0880]
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x164ca68ef
lea edx, [rax + 0x5c]
lea rcx, [rsp + 0x88]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbx, rax
test rax, rax
je 0x164ca68ef
movzx edi, word [rax + 2]
xor eax, eax
mov word [rbx + 2], ax
mov dword [rsp + 0x58], eax
lea r9, [rsp + 0x58]
mov r8d, r15d
mov rdx, r14
lea rcx, [rsp + 0x80]
mov rax, qword [0x164cf5d30]
call qword [0x164cdeeb8]
test eax, eax
je 0x164ca68ef
mov word [rbx + 2], di
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x164ca6890
test rax, rax
je 0x164ca68f6
mov rcx, rdi
inc rcx
cmp word [rbx + rcx*2 + 2], 0
jne 0x164ca68a3
inc rax
add rax, rcx
cmp rax, r15
jbe 0x164ca68c4
mov esi, 0x7a
mov dword [rsp + 0x34], esi
jmp 0x164ca68f6
lea r8, [rbx + 2]
mov rdx, r15
mov rcx, r14
call fcn.164ca78c0
mov ebx, dword [rsp + 0x30]
test eax, eax
js 0x164ca68e4
mov r13d, ebx
mov dword [rsp + 0x3c], ebx
jmp 0x164ca68fa
mov esi, 0x7a
mov dword [rsp + 0x34], esi
jmp 0x164ca68fa
mov rdi, 0xffffffffffffffff
mov ebx, dword [rsp + 0x30]
test r13d, r13d
je 0x164ca6909
mov r13d, ebx
xor esi, esi
jmp 0x164ca69ba
test esi, esi
je 0x164ca6921
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r13d, dword [rsp + 0x38]
xor esi, esi
jmp 0x164ca69ba
lea rax, [r15 - 1]
xor esi, esi
mov ecx, esi
mov edx, 0x80070057
mov r8d, 0x7ffffffe
cmp rax, r8
cmova ecx, edx
test ecx, ecx
js 0x164ca698f
mov rdx, r15
mov rcx, r14
test r15, r15
je 0x164ca6977
sub r8, r15
lea r9, [rsp + 0x80]
sub r9, r14
lea rax, [r8 + rdx]
test rax, rax
je 0x164ca6977
movzx eax, word [r9 + rcx]
test ax, ax
je 0x164ca6977
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x164ca6957
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov ecx, 0x8007007a
cmovne ecx, esi
jmp 0x164ca6998
test r15, r15
je 0x164ca6998
mov word [r14], si
test ecx, ecx
js 0x164ca69a1
mov r13d, ebx
jmp 0x164ca69ba
mov ecx, 0x7a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r13d, dword [rsp + 0x38]
jmp 0x164ca69ba
mov rdi, 0xffffffffffffffff
test ebx, ebx
jne 0x164ca6ab2
mov eax, dword [0x164ce088c]
mov dword [rsp + 0x58], eax
movzx eax, word [0x164ce0890]
mov word [rsp + 0x5c], ax
mov rbx, rsi
mov esi, 0x41
xor r14d, r14d
nop dword [rax]
nop word [rax + rax]
mov word [rsp + 0x58], si
mov word [rsp + 0x80], r14w
mov r8d, 0x104
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x164ca6a48
lea rax, [rsp + 0x80]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x164ca6a26
mov r8, rbx
mov rdx, r12
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x164ca6a51
inc si
cmp si, 0x5a
jbe 0x164ca69f0
cmp si, 0x5a
mov r14, qword [rsp + 0x50]
jbe 0x164ca6a70
mov r8, r15
mov rdx, r14
mov rcx, r12
call sym.aswCmnBS.dll_ConvertNtPathToGuidPath
jmp 0x164ca6ab5
inc rdi
cmp word [r12 + rdi*2], 0
jne 0x164ca6a70
cmp rbx, rdi
jae 0x164ca6ab2
sub rdi, rbx
add rdi, 2
cmp r15, rdi
jbe 0x164ca6ab2
mov word [r14], si
mov dword [r14 + 2], 0x3a
xor edi, edi
lea r8, [r12 + rbx*2]
mov rdx, r15
mov rcx, r14
call fcn.164ca78c0
mov r13d, edi
test eax, eax
sete r13b
mov eax, r13d
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.164cd6f70
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret