Function at 0x1400069ec
Capabilities:
Enumerate disk volumes
Get disk information via ioctl

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x158
lea rcx, [rax - 0xb8]
mov edx, 0x467c
mov rsi, r9
call fcn.1400613a8
mov rax, qword [rsp + 0xe0]
xor ebx, ebx
lea rcx, [rax + 0x5a0]
lea rbp, [rax + 0x708]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xd8], rcx
lea rcx, [rax + 0x618]
lea r13, [rbp + 0x320]
mov qword [rsp + 0x108], rcx
lea rcx, [rax + 0x690]
lea rdi, [rax + 0x398]
mov qword [rsp + 0x88], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x90], r13
call fcn.140061344
lea r15, [rbp + 0x334]
add rbp, 0x3f4
xor edx, edx
mov r8d, 0x3b80
mov rcx, rbp
mov qword [rsp + 0x60], 0xffffffffffffff9c
mov qword [rsp + 0x118], r15
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xf0], rbp
call fcn.1400f8760
mov r14, rdi
lea r11d, [rbx - 2]
mov dword [rbp + 4], r11d
mov dword [rbp], r11d
mov word [rdi], bx
mov rdi, qword [rsp + 0x1b0]
cmp rsi, rbx
mov dword [rsp + 0x7c], 2
cmovne r14, rsi
shr rdi, 0x10
mov word [rsp + 0x50], bx
and edi, 8
mov rbp, rbx
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xe8], r14
mov r12, rbx
mov qword [rsp + 0x98], rbx
cmp rsi, rbx
jne 0x140006b54
mov edx, 0x103
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov r12, rax
mov qword [rsp + 0x98], rax
cmp rax, 0xffffffffffffffff
jne 0x140006bcc
jmp 0x14000746d
lea rcx, [0x140112fc0]
mov r8d, 4
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCmpNW]
cmp eax, ebx
jne 0x140006b94
lea rax, [rsi + 8]
cmp word [rax], bx
je 0x140006b94
mov ecx, 0x3a
cmp cx, word [rsi + 0xa]
jne 0x140006b94
mov qword [rsp + 0xb8], rax
movzx eax, word [rax]
mov word [rsp + 0x50], ax
jmp 0x140006bcc
lea rcx, [0x140112fb0]
mov r8d, 0xb
mov rdx, rsi
call fcn.14005a5c4
cmp al, bl
je 0x140006bcc
lea rax, [rsi + 0x16]
cmp word [rax], bx
je 0x140006bcc
cmp word [rsi + 0x18], bx
je 0x140006bcc
cmp word [rsi + 0x1a], bx
cmovne rbp, rax
mov qword [rsp + 0xb8], rbp
movsxd rax, edi
mov ebp, 0x5c
mov edi, 0x80000000
mov qword [rsp + 0x120], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov qword [rsp + 0x100], r14
sub eax, 1
js 0x140006c06
movsxd rcx, eax
cmp bp, word [r14 + rcx*2]
jne 0x140006c06
mov word [r14 + rcx*2], bx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rsi, rbx
je 0x140006c32
mov rcx, r14
call fcn.140006998
cmp eax, ebx
je 0x140006c32
mov r8d, 7
mov rdx, rdi
mov rcx, r14
call fcn.14001d0d0
jmp 0x140006c59
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, edi
lea r8d, [r9 + 7]
mov rcx, r14
mov dword [rsp + 0x28], 0x2000080
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140007434
cmp rax, rbx
je 0x140007434
mov ebp, 0xc
xor edx, edx
mov rcx, r13
mov r8, rbp
call fcn.1400f8760
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x110]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, rdi
mov dword [rsp + 0x28], ebp
mov dword [r13 + 8], 0xffffffaa
mov dword [r13 + 4], 0xffffffaa
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, ebx
je 0x140006cd2
cmp dword [r13 + 4], ebx
jge 0x140006ce2
mov dword [r13 + 8], 0xffffffaa
mov dword [r13 + 4], 0xffffffaa
mov ebp, 0x90
xor edx, edx
mov rcx, r15
mov r8, rbp
call fcn.1400f8760
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70048
mov rcx, rdi
mov dword [rsp + 0x28], ebp
mov dword [r15 + 0x18], 0xffffffaa
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, ebx
mov r12d, ebx
cmp eax, ebx
je 0x140006d36
mov esi, dword [r15]
movzx r12d, byte [r15 + 0x20]
jmp 0x140006d46
mov qword [r15 + 0x10], rbx
mov qword [r15 + 8], rbx
mov dword [r15 + 0x18], 0xffffffaa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
mov ebp, ebx
sete bpl
cmp dword [r13 + 4], ebx
jl 0x140006d68
cmp dword [r13 + 8], ebx
jge 0x140006f8d
mov rsi, qword [rsp + 0xb8]
lea rcx, [rsp + 0xb0]
call fcn.140061620
lea rcx, [rsp + 0xa0]
call fcn.140061620
mov ax, word [rsp + 0x50]
cmp ax, bx
je 0x140006e93
lea rdx, [rsp + 0xb0]
movzx ecx, ax
call fcn.14005dda8
mov rcx, qword [rsp + 0x58]
mov edx, 0x103
add rcx, 0x398
mov rsi, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140006e93
mov rcx, qword [rsp + 0x58]
add rcx, 0x398
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, 0x5c
dec eax
movsxd rcx, eax
mov rax, qword [rsp + 0x58]
cmp r8w, word [rax + rcx*2 + 0x398]
jne 0x140006e04
mov word [rax + rcx*2 + 0x398], bx
mov ecx, 0x3f
lea r8, [rax + 0x398]
lea rdx, [rsp + 0xa0]
mov word [rax + 0x39a], cx
lea rcx, [rax + 0x398]
call fcn.14008a710
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
je 0x140006e70
mov rcx, qword [rsp + 0x58]
mov r8d, 0x103
lea rdx, [rcx + 0x398]
mov word [rcx + 0x398], bx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, ebx
je 0x140006e8a
jmp 0x140006dcf
mov rax, qword [rsp + 0x58]
add rax, 0x398
mov r14, rax
mov qword [rsp + 0xe8], rax
lea rsi, [rax + 0x16]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rax, qword [rsp + 0x60]
cmp rax, 0xffffffffffffff9c
jg 0x140006eb8
mov rcx, qword [rsp + 0x1a8]
lea rdx, [rsp + 0x70]
mov r8, rsi
call fcn.14008a230
mov qword [rsp + 0x60], rax
cmp rax, rbx
jle 0x140006f73
mov rdi, qword [rsp + 0x70]
add rdi, 4
cmp rsi, rbx
jne 0x140006f47
lea rcx, [0x140112f98]
mov r8d, 0xb
mov rdx, r14
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebx
jne 0x140006f73
lea rax, [r14 + 0x16]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x68]
mov r8d, 1
mov qword [rsp + 0x68], rax
call fcn.140074c3c
cmp al, bl
jle 0x140006f73
cmp qword [rsp + 0x60], rbx
mov esi, ebx
jle 0x140006f73
lea rdx, [rsp + 0x140]
mov r8d, 0x10
mov rcx, rdi
call fcn.140058f2c
cmp eax, ebx
je 0x140006f47
inc esi
add rdi, 0x34
movsxd rax, esi
cmp rax, qword [rsp + 0x60]
jl 0x140006f1b
jmp 0x140006f73
mov eax, dword [rdi + 0x10]
or ebp, 0x10
mov dword [r13 + 4], eax
mov eax, dword [rdi + 0x14]
mov dword [r13 + 8], eax
mov eax, dword [rdi + 0x18]
mov dword [r13], eax
mov rax, qword [rdi + 0x20]
mov r12d, dword [rdi + 0x1c]
mov qword [r15 + 8], rax
mov rax, qword [rdi + 0x28]
mov qword [r15 + 0x10], rax
lea rcx, [rsp + 0xa0]
call fcn.140058efc
lea rcx, [rsp + 0xb0]
call fcn.140058efc
mov rax, qword [rsp + 0x1b0]
cmp ax, bx
jl 0x140006fa5
cwde
cmp eax, dword [r13 + 8]
jne 0x14000741f
mov rcx, qword [rsp + 0x1a8]
cmp rcx, rbx
jl 0x140006fbf
movsxd rax, dword [r13 + 4]
cmp rcx, rax
jne 0x14000741f
mov rdi, qword [rsp + 0xd8]
mov rdx, qword [r15 + 8]
mov rcx, rdi
call fcn.1400dde98
mov rsi, qword [rsp + 0x108]
mov rdx, qword [r15 + 0x10]
mov rcx, rsi
call fcn.1400dde98
mov rcx, qword [rsp + 0x88]
cmp ebp, 1
jne 0x140007002
lea rdx, [r15 + 0x20]
xor r8d, r8d
call fcn.14005d988
jmp 0x140007012
lea rdx, [0x140112f8c]
mov r8d, r12d
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [r13]
mov r8, qword [rsp + 0x88]
or edx, 0xffffffff
cmp dword [r13 + 4], ebx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
cmovge edx, dword [r13 + 4]
mov qword [rsp + 0x38], r8
mov r8, qword [rsp + 0x100]
mov dword [rsp + 0x30], ecx
or eax, 0xffffffff
cmp dword [r13 + 8], ebx
cmovge eax, dword [r13 + 8]
mov dword [rsp + 0xa8], ecx
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x20], edx
lea rdx, str._r_n_s_s__d__d__d__s__s__s
lea r9, [0x140112598]
mov dword [rsp + 0xc8], eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x1a0]
or esi, 0xffffffff
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbp, dword [r13 + 4]
lea r9, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov r15d, eax
mov dword [rsp + 0xac], eax
mov rdi, r14
call fcn.14001d188
cmp rax, rbx
je 0x1400070da
mov rcx, qword [rsp + 0xd0]
cmp rcx, rbx
je 0x1400070da
cmp word [rcx], bx
cmovne rdi, rcx
cmp qword [rsp + 0x120], rbx
je 0x1400073d8
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x20
movsxd rcx, eax
lea rax, [rsi + rcx*2]
mov word [rax], dx
add rax, 2
mov rcx, rax
mov word [rax], bx
sub rcx, rsi
mov rsi, rax
sar rcx, 1
mov qword [rsp + 0x68], rcx
mov cx, word [rsp + 0x50]
cmp cx, bx
je 0x14000713a
mov word [rax], cx
lea ecx, [rdx + 0x1a]
add rax, 4
mov word [rax - 2], cx
mov word [rax], bx
jmp 0x140007160
movsxd r8, dword [r13 + 8]
mov r9, qword [rsp + 0xf0]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdx
mov rcx, rax
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call fcn.1400744f4
sub rax, rsi
sar rax, 1
cmp eax, ebx
ja 0x1400073d3
mov r12, qword [rsp + 0x60]
mov word [rsi - 2], bx
cmp r12, 0xffffffffffffff9c
jg 0x14000719a
mov rcx, qword [rsp + 0x1a8]
lea rdx, [rsp + 0x70]
xor r8d, r8d
call fcn.14008a230
mov r12, rax
mov qword [rsp + 0x60], rax
cmp r12, rbx
jle 0x1400073d3
mov r13, qword [rsp + 0x70]
lea rcx, [0x140112f98]
mov r8d, 0xb
mov rdx, r14
add r13, 4
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebx
jne 0x1400073cb
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0x78], ebx
call fcn.140061344
mov eax, 0x3f
lea r9, [rsp + 0xc0]
mov word [r14 + 2], ax
lea rax, [rsp + 0x78]
lea rdx, str.SYSTEMMountedDevices
mov r8, r14
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.140066e80
cmp dword [rsp + 0x78], 0x18
mov rdi, qword [rsp + 0xc0]
jne 0x140007256
lea rcx, str.DMIO:ID:
mov r8d, 8
mov rdx, rdi
call fcn.140058f2c
cmp eax, ebx
jne 0x140007256
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x128]
mov r8d, 0x10
call fcn.14001d04c
mov dil, 2
jmp 0x140007280
lea rax, [r14 + 0x16]
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x138]
mov r8d, 1
mov qword [rsp + 0x138], rax
call fcn.140074c3c
mov rdi, rax
lea rcx, [rsp + 0xc0]
call fcn.140058efc
cmp dil, bl
jle 0x1400073cb
cmp qword [rsp + 0x60], rbx
mov r12d, ebx
jle 0x1400073cb
mov r14d, dword [rsp + 0xc8]
mov r15d, dword [rsp + 0xa8]
lea rdi, [r13 + 0x14]
lea rdx, [rsp + 0x128]
mov r8d, 0x10
mov rcx, r13
call fcn.140058f2c
cmp eax, ebx
jne 0x1400073a2
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x128]
xor r8d, r8d
call fcn.14008a980
mov ebp, eax
mov eax, dword [rsp + 0x80]
cmp eax, ebx
jl 0x140007307
cmp r14d, ebx
jl 0x140007316
cmp r15d, ebx
jge 0x140007382
jmp 0x140007311
mov eax, dword [rdi - 4]
mov dword [rsp + 0x80], eax
cmp r14d, ebx
jge 0x140007319
mov r14d, dword [rdi]
cmp r15d, ebx
jge 0x140007322
mov r15d, dword [rdi + 4]
mov rcx, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x100]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0xd8]
lea r9, [0x140112598]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x88]
lea rdx, str._r_n_s_s__d__d__d__s__s__s
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], r15d
mov rcx, rsi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
movsxd rcx, eax
lea rsi, [rsi + rcx*2]
cmp ebp, ebx
jle 0x1400073a2
mov word [rsi], bp
mov eax, 0x20
add rsi, 4
mov word [rsi - 6], ax
mov eax, 0x3a
mov word [rsi - 2], ax
mov word [rsi], bx
inc r12d
add r13, 0x34
add rdi, 0x34
movsxd rax, r12d
cmp rax, qword [rsp + 0x60]
jl 0x1400072b8
mov r14, qword [rsp + 0xe8]
mov r15d, dword [rsp + 0xac]
mov r13, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
movsxd rdi, dword [rsp + 0x7c]
mov rbp, qword [rsp + 0x1a0]
lea rdx, [rcx + rdi*2]
mov rcx, rbp
call fcn.14006175c
cmp esi, ebx
jl 0x140007413
mov rax, qword [rbp]
sub r15d, edi
add r15d, esi
movsxd rcx, r15d
lea rax, [rax + rcx*2]
mov qword [rsp + 0xf8], rax
mov r15, qword [rsp + 0x118]
mov dword [rsp + 0x7c], ebx
mov rsi, qword [rsp + 0x1b8]
mov r12, qword [rsp + 0x98]
mov ebp, 0x5c
cmp r12, rbx
je 0x140007465
mov r8d, 0x103
mov rdx, r14
mov rcx, r12
mov word [r14], bx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov edi, 0x80000000
cmp eax, ebx
jne 0x140006be1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rbx, qword [rsp + 0xf8]
lea rcx, [rsp + 0xd0]
call fcn.140058efc
lea rcx, [rsp + 0x70]
call fcn.140058efc
lea rcx, [rsp + 0xe0]
call fcn.140058efc
mov rax, rbx
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret