Function at 0x140079280
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x310
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x300], rax
lea rdi, [0x14019cf18]
mov rbx, rdx
mov qword [rsp + 0x210], rdx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 0x2a
cmp ax, word [rbx]
sete al
mov byte [rsp + 0x4a], al
test al, al
je 0x1400792eb
add rbx, 2
mov qword [rsp + 0x210], rbx
lea rcx, [0x140150298]
mov r8d, 2
mov rdx, rbx
call fcn.14005c510
lea rcx, [0x140150294]
mov r8d, 2
mov rdx, rbx
movzx r11d, al
mov byte [rsp + 0x6a], al
call fcn.14005c510
lea rcx, [0x140150290]
mov r8d, 3
mov rdx, rbx
movzx r10d, al
mov byte [rsp + 0x48], al
call fcn.14005c510
lea rcx, [0x14015028c]
mov r8d, 2
mov rdx, rbx
mov byte [rsp + 0x90], al
call fcn.14005c510
mov byte [rsp + 0x68], al
test r11b, r11b
jne 0x14007936d
test r10b, r10b
jne 0x14007936d
mov byte [rsp + 0x40], r10b
test al, al
je 0x140079372
mov byte [rsp + 0x40], 1
movzx eax, word [rbx]
test ax, ax
je 0x1400793a7
mov edx, 9
lea ecx, [rdx + 0x17]
cmp dx, ax
ja 0x14007938d
cmp ax, 0xd
jbe 0x1400793a7
cmp cx, ax
je 0x1400793a7
mov ax, word [rbx + 2]
add rbx, 2
mov qword [rsp + 0x210], rbx
test ax, ax
jne 0x140079382
lea rcx, [rsp + 0x210]
call fcn.14005b560
lea rcx, [rsp + 0x88]
mov edx, 5
call fcn.140063580
lea rcx, [rsp + 0xb0]
mov edx, 0x14
call fcn.140063580
lea rcx, [rsp + 0xb8]
call fcn.140063500
xor r14d, r14d
or eax, 0xffffffff
mov ebx, r14d
lea rdx, [rsp + 0x210]
lea rcx, [0x14014b06c]
lea r8d, [r14 + 6]
xor bpl, bpl
xor r15b, r15b
mov dword [rsp + 0xd8], r14d
mov dword [rsp + 0x74], ebx
mov esi, r14d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0xc0], 0x3e8
mov byte [rsp + 0x4c], bl
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x84], eax
mov r13d, r14d
mov dword [rsp + 0x5c], r14d
mov dword [rsp + 0x80], r14d
mov byte [rsp + 0x42], bpl
mov byte [rsp + 0x41], r15b
mov byte [rsp + 0x58], 0x43
mov byte [rsp + 0x4b], bl
mov byte [rsp + 0x69], bl
call fcn.140065780
mov r10, qword [rsp + 0x210]
lea r8d, [r14 + 6]
lea rcx, str._SKIP
mov rdx, r10
movzx r12d, al
call fcn.14005c510
test al, al
je 0x1400794de
lea rcx, [rsp + 0x210]
add r10, 0xc
mov qword [rsp + 0x210], r10
call fcn.14005b560
lea rdx, [rsp + 0xc4]
lea rcx, [rsp + 0x210]
mov dword [rsp + 0xc4], 0x42
call fcn.140066e40
movzx eax, byte [rsp + 0xc4]
lea rcx, [rsp + 0x210]
mov byte [rsp + 0x69], al
call fcn.14005b560
mov r10, qword [rsp + 0x210]
lea rcx, [0x140150280]
mov r8d, 2
mov rdx, r10
call fcn.14005c4b0
test al, al
je 0x14007951d
add r10, 4
lea rcx, [rsp + 0x210]
mov qword [rsp + 0x210], r10
call fcn.14005b560
mov r10, qword [rsp + 0x210]
mov byte [rsp + 0x4c], 1
movzx eax, word [r10]
mov r8d, 0x2d
lea r9d, [r8 - 0x2c]
test ax, ax
je 0x14007958c
lea edx, [r8 - 7]
mov ecx, 0x2a
nop dword [rax]
cmp cx, ax
jne 0x14007954c
mov byte [rsp + 0x40], r9b
jmp 0x14007956e
cmp dx, ax
jne 0x140079556
or ebx, 8
jmp 0x14007956e
cmp r8w, ax
jne 0x14007957c
movzx eax, word [r10 + 2]
sub ax, 0x30
cmp ax, 9
jbe 0x14007957c
mov esi, r9d
mov ax, word [r10 + 2]
add r10, 2
test ax, ax
jne 0x140079540
mov qword [rsp + 0x210], r10
mov dword [rsp + 0x74], ebx
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x210]
call fcn.14005b560
mov rcx, qword [rsp + 0x210]
movzx eax, word [rcx]
test ax, ax
jne 0x1400795c8
or r13d, 0xffffffff
or ecx, r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x80], r13d
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x84], ecx
mov word [rsp + 0xdc], r14w
test ax, ax
je 0x140079928
mov esi, 0x2c
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x210]
mov r8d, esi
call fcn.140066780
mov rbx, qword [rsp + 0x210]
cmp si, word [rbx]
jne 0x140079661
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x210]
add rbx, 2
mov r8d, esi
mov qword [rsp + 0x210], rbx
call fcn.140066780
mov rbx, qword [rsp + 0x210]
cmp si, word [rbx]
jne 0x140079661
add rbx, 2
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x210]
mov r8d, esi
mov qword [rsp + 0x210], rbx
call fcn.140066b30
mov rbx, qword [rsp + 0x210]
mov eax, 0x2c
mov esi, 0xffdf
cmp ax, word [rbx]
jne 0x1400796db
lea rcx, [rsp + 0xe8]
call fcn.140063500
lea r11, [rbx + 2]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.14005b560
mov rcx, qword [rsp + 0xa8]
movzx eax, word [rcx]
movzx ecx, ax
and cx, si
test r13d, r13d
jg 0x1400796bd
mov edx, 0x2a
cmp dx, ax
jne 0x1400796bd
mov dword [rsp + 0xdc], edx
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x1400796ce
mov byte [rsp + 0x58], cl
mov byte [rsp + 0x4b], cl
lea rcx, [rsp + 0xe8]
call fcn.14005b520
mov rsi, qword [rsp + 0xb8]
mov eax, 0xffdf
mov edx, 0x23
movzx ebx, word [rsi]
mov qword [rsp + 0x210], rsi
movzx ecx, bx
and cx, ax
lea eax, [rbx - 0x30]
cmp ax, 9
jbe 0x14007988a
mov r11d, 0x2d
cmp r11w, bx
jne 0x140079729
movzx eax, word [rsi + 2]
sub ax, 0x30
cmp ax, 9
jbe 0x14007988a
mov eax, 0x46
cmp ax, cx
jne 0x140079809
mov bpl, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
add rsi, 2
mov byte [rsp + 0x42], bpl
mov qword [rsp + 0x210], rsi
mov r10d, dword [rsp + 0x54]
cmp word [rsi], r14w
mov rbx, qword [rsp + 0x88]
mov esi, dword [rsp + 0x50]
jne 0x140079772
cmp word [rbx], r14w
mov eax, 1
cmovne esi, eax
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x210]
call fcn.14005b560
mov rcx, qword [rsp + 0x210]
mov edx, 0x3a
movzx eax, word [rcx]
cmp dx, ax
je 0x1400797aa
mov edx, 0x23
cmp dx, ax
jne 0x140079930
mov r15b, 1
mov byte [rsp + 0x41], r15b
test bpl, bpl
jne 0x1400797b4
test r10d, r10d
jns 0x1400797bc
xor r15b, r15b
mov byte [rsp + 0x41], r15b
add rcx, 2
mov qword [rsp + 0x210], rcx
lea rcx, [rsp + 0x210]
call fcn.14005b560
mov rax, qword [rsp + 0x210]
cmp r11w, word [rax]
jne 0x1400798fe
movzx eax, word [rax + 2]
sub ax, 0x30
cmp ax, 9
jbe 0x1400798fe
mov ebp, 1
mov esi, ebp
mov dword [rsp + 0x50], ebp
jmp 0x140079935
mov eax, 0x55
cmp ax, cx
je 0x140079882
mov eax, 0x52
cmp ax, cx
je 0x140079882
mov eax, 0x3a
cmp ax, bx
je 0x14007974b
cmp dx, bx
je 0x14007974b
cmp dword [rsp + 0x50], r14d
jne 0x14007974b
test bx, bx
je 0x14007974b
lea rcx, [rsp + 0xb8]
call fcn.14005b520
lea rcx, [rsp + 0xb0]
call fcn.14005b520
lea rcx, [rsp + 0x88]
call fcn.14005b520
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x80070057
jmp 0x14007a8da
mov bpl, VariantTimeToDosDateTime
jmp 0x14007973a
lea rdx, [rsp + 0x84]
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0xe8], rsi
call fcn.140066e40
test bx, bx
je 0x1400798d1
nop dword [rax]
cmp bx, 0x3a
je 0x1400798c9
cmp bx, 0x23
je 0x1400798c9
mov bx, word [rsi + 2]
add rsi, 2
test bx, bx
jne 0x1400798b0
mov qword [rsp + 0x210], rsi
lea rcx, [rsp + 0x210]
call fcn.14005b560
mov r10d, dword [rsp + 0x84]
mov rsi, qword [rsp + 0x210]
mov dword [rsp + 0x54], r10d
mov r11d, 0x2d
jmp 0x140079750
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x210]
mov r8d, 0x2c
call fcn.140066b30
mov r13d, dword [rsp + 0x80]
mov dword [rsp + 0x5c], r13d
jmp 0x140079930
mov rbx, qword [rsp + 0x88]
mov ebp, 1
mov dword [rsp + 0x6c], 0xfffffff8
mov dword [rsp + 0xe4], r13d
test r15b, r15b
je 0x14007999e
test r13d, r13d
jg 0x140079986
lea rcx, [rsp + 0xb8]
call fcn.14005b520
lea rcx, [rsp + 0xb0]
call fcn.14005b520
lea rcx, [rsp + 0x88]
call fcn.14005b520
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebp
jmp 0x14007a8da
cmp r13d, 4
jg 0x140079991
dec r13d
jmp 0x140079999
lea r13d, [r13*4 - 0x10]
mov dword [rsp + 0x5c], r13d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x88]
add eax, 5
mov edx, eax
call fcn.1400635c0
mov rbp, qword [rsp + 0x88]
movzx eax, word [rbp]
cmp ax, 0x61
jb 0x1400799da
cmp ax, 0x7a
ja 0x1400799da
mov eax, 0xffe0
add word [rbp], ax
mov byte [rsp + 0x6b], r14b
cmp byte [rsp + 0x42], r14b
jne 0x140079a3a
test esi, esi
jne 0x140079a3a
movzx eax, word [rbp]
mov ecx, 0x100
cmp ax, cx
jae 0x140079a3a
cmp ax, 0x41
jb 0x140079a04
cmp ax, 0x5a
jbe 0x140079a3a
mov ecx, dword [rsp + 0x54]
mov word [rbp], r14w
test ecx, ecx
js 0x140079a22
mov eax, 0xfffffff8
cmp r13d, 1
cmovge eax, r13d
mov dword [rsp + 0x6c], eax
test r15b, r15b
je 0x140079a3a
test ecx, ecx
js 0x140079a3a
test r13d, r13d
js 0x140079a3a
mov dword [rsp + 0x6c], r13d
mov byte [rsp + 0x6b], 1
movzx r15d, word [rbp]
lea rcx, [rsp + 0xb0]
mov edx, 0x64
mov word [rsp + 0x60], r15w
mov dword [rsp + 0x78], r14d
call fcn.1400635c0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
movzx ecx, byte [rsp + 0x4b]
cmp byte [rsp + 0x68], r14b
mov edx, 0x43
mov dword [rsp + 0x80], eax
mov eax, 1
cmovne edx, ecx
mov dword [rsp + 0xd8], eax
movsx ecx, dl
mov word [rsp + 0x98], cx
test esi, esi
jne 0x140079ab2
test r13d, r13d
js 0x140079aa0
test r12b, r12b
jne 0x140079ab2
mov edx, dword [rsp + 0x54]
mov byte [rsp + 0x59], al
test edx, edx
js 0x140079abb
movzx r8d, al
jmp 0x140079abe
mov edx, dword [rsp + 0x54]
mov byte [rsp + 0x59], r14b
xor r8b, r8b
mov rbx, qword [rsp + 0xb0]
movzx r12d, byte [rsp + 0x42]
mov byte [rsp + 0x49], r8b
movzx eax, byte [rsp + 0x41]
mov ecx, dword [rsp + 0x6c]
test al, al
jne 0x140079af3
cmp byte [rsp + 0x4c], al
je 0x140079af3
test edx, edx
js 0x140079af3
test r13d, r13d
cmovg ecx, r13d
mov dword [rsp + 0x6c], ecx
test r8b, r8b
jne 0x140079b38
cmp byte [rsp + 0x4a], r8b
jne 0x140079b38
test r12b, r12b
jne 0x140079b38
test ecx, ecx
jns 0x140079b38
test al, al
jne 0x140079b38
cmp word [rbp], 0
jne 0x140079b1e
test r13d, r13d
je 0x140079b38
cmp r13d, 0xffffffff
je 0x140079b38
test esi, esi
je 0x14007a9af
test edx, edx
js 0x14007a9e1
cmp r13d, 1
jl 0x14007a9c0
lea rcx, [rsp + 0xa8]
mov edx, 0x200000
call fcn.1400632b0
xor eax, eax
lea rcx, [rsp + 0x10a]
xor edx, edx
mov r8d, 0x104
mov word [rsp + 0x100], r14w
mov qword [rsp + 0x102], rax
call fcn.14010c6c0
mov rsi, qword [rsp + 0xa8]
lea rcx, [rsp + 0x100]
mov rdx, rsi
xor r8d, r8d
call fcn.1400686b0
mov eax, 0x3a
mov word [rsp + 0x210], r15w
mov word [rsp + 0x212], ax
mov word [rsp + 0x21a], ax
mov eax, 0x5c
mov word [rsp + 0x21c], ax
mov ax, r14w
mov word [rsp + 0x214], r14w
mov dword [rsp + 0xc4], eax
mov eax, dword [rsp + 0x54]
mov word [rsp + 0x218], r15w
mov word [rsp + 0x21e], r14w
mov dword [rsp + 0xf0], r14d
test eax, eax
js 0x140079bfb
mov r12d, 0x7530
mov dword [rsp + 0x64], r12d
jmp 0x140079c2e
mov r12d, r14d
mov dword [rsp + 0x64], r14d
mov eax, dword [rsp + 0xc0]
dec eax
mov dword [rsp + 0xc0], eax
test eax, eax
jle 0x14007a7a4
mov eax, 0x3e80
cmp r12w, ax
jge 0x14007a7a4
movzx eax, r12w
mov word [rsp + 0x7c], ax
cwde
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0x230]
mov r8d, eax
mov dword [rsp + 0x84], eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x230]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x20000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov r15, rax
cmove r15, r14
mov qword [rsp + 0xd0], r15
test r15, r15
je 0x14007a75b
cmp byte [rsp + 0x59], 0
mov dword [rsp + 0xc4], r14d
mov qword [rsp + 0xf8], 0xffffffffffffffff
mov dword [rsp + 0xc8], 0xffffffff
je 0x140079cdc
lea rdx, [rsp + 0xc8]
mov rcx, r15
call fcn.140069340
mov qword [rsp + 0xf8], rax
cmp byte [rsp + 0x42], 0
je 0x140079d1b
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.140068eb0
movsx edx, byte [rsp + 0x42]
cmp eax, edx
je 0x140079d1b
cmp r15, 0xffffffffffffffff
je 0x140079dc0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12w
mov dword [rsp + 0x64], r12d
jmp 0x140079c03
lea r8, [rsp + 0x70]
mov rdx, rsi
mov rcx, r15
mov dword [rsp + 0x70], r14d
call fcn.14005f290
test rax, rax
je 0x140079cfa
cmp dword [rax], 1
mov r13d, dword [rax + 0x28]
lea rcx, [rax + 0x30]
mov qword [rsp + 0xa0], rcx
mov rcx, r15
sete byte [rsp + 0x5a]
call fcn.14005ec80
cmp byte [rsp + 0x41], 0
lea rdx, [rsi + 0x100000]
movsxd r12, eax
lea r14, [rdx + r12*2]
je 0x140079e49
cmp byte [rsp + 0x5a], 0
je 0x140079e30
xor eax, eax
lea rcx, [rsp + 0xd0]
mov r9d, r12d
mov qword [rsp + 0x28], rax
mov r8d, r13d
mov qword [rsp + 0x20], rax
call fcn.140068cf0
mov ecx, dword [rsp + 0xe4]
cmp ecx, r13d
jle 0x140079dce
cmp r15, 0xffffffffffffffff
je 0x140079db3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13d, dword [rsp + 0x5c]
mov r12d, dword [rsp + 0x64]
xor r14d, r14d
inc r12w
mov dword [rsp + 0x64], r12d
jmp 0x140079c03
mov r8d, dword [rsp + 0x70]
lea eax, [rcx - 1]
mov r9d, r12d
mov r12, qword [rsp + 0xa0]
movsxd rcx, eax
shl rcx, 7
mov rdx, r12
add rcx, r14
call fcn.140068c20
mov r13d, eax
mov dword [rsp + 0x5c], eax
test eax, eax
jns 0x140079e23
cmp r15, 0xffffffffffffffff
je 0x140079db8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, dword [rsp + 0x64]
xor r14d, r14d
inc r12w
mov dword [rsp + 0x64], r12d
jmp 0x140079c03
cmp byte [rsp + 0x6b], 0
je 0x140079e65
mov dword [rsp + 0x6c], eax
jmp 0x140079e65
mov ecx, dword [rsp + 0xe4]
test ecx, ecx
jle 0x140079e50
call fcn.14005f270
mov r13d, eax
mov dword [rsp + 0x5c], eax
jmp 0x140079e55
mov ecx, dword [rsp + 0xe4]
mov r13d, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x70]
cmp ecx, eax
jg 0x140079dfe
mov r12, qword [rsp + 0xa0]
mov rdx, r15
xor ecx, ecx
call fcn.1400653c0
mov r10d, dword [rsp + 0x70]
cmp eax, 7
je 0x140079eb6
cmp byte [rsp + 0x5a], 0
jne 0x140079eb6
cmp r10d, 4
jne 0x140079eb6
mov al, byte [rsp + 0x69]
cmp al, byte [r12 + 0x20]
jne 0x140079eb6
cmp byte [r12 + 0xb0], 0
jne 0x140079eb6
cmp byte [r12 + 0x140], 0
jne 0x140079eb6
cmp byte [r12 + 0x1d0], 0
je 0x140079dfe
mov eax, dword [rsp + 0xc0]
xor r14d, r14d
dec eax
mov dword [rsp + 0xc8], r14d
mov r9d, r14d
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0xc0], eax
test eax, eax
jle 0x14007a734
movsxd r11, dword [rsp + 0x6c]
mov qword [rsp + 0xe8], r11
nop
cmp r9d, r10d
jge 0x14007a72c
mov r8d, r9d
mov dword [rsp + 0xe0], r9d
test rdi, rdi
je 0x140079f35
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8d, dword [rsp + 0xe0]
mov r9d, dword [rsp + 0x44]
mov r10d, dword [rsp + 0x70]
mov r11, qword [rsp + 0xe8]
cmp byte [rsp + 0x41], 0
je 0x140079f61
test r13d, r13d
js 0x140079f61
cmp r13d, r10d
lea r9d, [r10 + 0x186a0]
mov r8d, r13d
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0xe0], r13d
jge 0x14007a72c
cmp byte [rsp + 0x5a], 0
je 0x140079f70
mov r15d, 0xff07
jmp 0x140079f80
movsxd rax, r8d
lea rcx, [rax + rax*8]
add rcx, rcx
movzx r15d, byte [r12 + rcx*8 + 0x20]
movsxd rax, r8d
movzx r8d, byte [rsp + 0x4a]
lea rcx, [rax + rax*8]
shl rcx, 4
movsx edx, word [rcx + r12 + 0x18]
mov dword [rsp + 0x94], edx
test r8b, r8b
je 0x140079fa8
test r13d, r13d
jns 0x140079fb7
mov al, byte [rsp + 0x41]
test al, al
jne 0x140079fec
test r13d, r13d
jle 0x140079fec
jmp 0x140079fbb
mov al, byte [rsp + 0x41]
cmp edx, r13d
jne 0x14007a6fa
test r8b, r8b
je 0x140079fe0
test r15b, 0x10
jne 0x14007a826
cmp r15d, 0x84
je 0x14007a826
lea r9d, [r10 + 0x186a0]
mov dword [rsp + 0x44], r9d
cmp byte [rsp + 0x59], 0
je 0x14007a006
mov r8, qword [rsp + 0xf8]
cmp r8, qword [rcx + r12 + 8]
je 0x14007a6fa
test r15d, r15d
je 0x14007a6fa
test edx, edx
jle 0x14007a6fa
cmp r15d, 5
je 0x14007a6fa
cmp r15d, 0xf
je 0x14007a6fa
test r13d, r13d
jg 0x14007a080
cmp qword [rcx + r12 + 0x10], 0x200
jg 0x14007a080
test r15b, 0x10
je 0x14007a6fa
mov eax, 1
mov qword [rsp + 0x38], r14
mov r8d, edx
mov edx, dword [rsp + 0x84]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x100]
xor r9d, r9d
mov dword [rsp + 0x20], eax
call fcn.14005ecf0
mov r9d, dword [rsp + 0x44]
jmp 0x14007a6fa
mov ecx, dword [rsp + 0xf0]
inc ecx
mov dword [rsp + 0xf0], ecx
test al, al
jne 0x14007a0a4
cmp r11, 1
jl 0x14007a0a4
cmp dword [rsp + 0x6c], edx
jne 0x14007a6fa
test r11, r11
js 0x14007a0b5
lea r9d, [r10 + 0x3e8]
mov dword [rsp + 0x44], r9d
test al, al
je 0x14007a225
movzx eax, byte [rsp + 0x40]
mov r12d, dword [rsp + 0x50]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov r9d, r14d
mov r8d, edx
or r9d, dword [rsp + 0x74]
mov edx, dword [rsp + 0x84]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x20], r12d
call fcn.14005ecf0
cmp word [rsp + 0xdc], 0
jne 0x14007a21b
test r12d, r12d
jne 0x14007a880
cmp byte [rsp + 0x4a], r12b
je 0x14007a134
test r15b, 0x10
jne 0x14007a21b
cmp r15d, 0x84
je 0x14007a21b
test eax, eax
je 0x14007a14f
cmp word [rsp + 0x60], 0
je 0x14007a880
cmp byte [rsp + 0x4c], 0
jne 0x14007a880
mov r12d, dword [rsp + 0x94]
mov r8d, dword [rsp + 0x84]
lea rdx, str.DeviceHarddisk_dPartition_d
movsx r9d, r12w
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
movzx r11d, word [rsp + 0x210]
test r11w, r11w
jne 0x14007a1b4
movzx r8d, byte [rsp + 0x58]
lea rcx, [rsp + 0x80]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
sub r8b, 0x41
call fcn.14005ebb0
mov word [rsp + 0x218], ax
mov r11w, ax
mov word [rsp + 0x210], ax
jmp 0x14007a1bc
movzx eax, word [rsp + 0x218]
cmp r11w, 0x41
jb 0x14007a90b
cmp r11w, 0x5a
ja 0x14007a90b
test ax, ax
je 0x14007a212
movzx eax, byte [rsp + 0x40]
mov r9d, dword [rsp + 0x74]
lea r8, [rsp + 0x218]
lea rdx, [rsp + 0x210]
mov rcx, rbx
mov byte [rsp + 0x20], al
call fcn.140068190
test eax, eax
je 0x14007a208
mov dword [rsp + 0x78], r14d
jmp 0x14007a212
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x78], eax
test r13d, r13d
jns 0x14007a880
mov r9d, dword [rsp + 0x44]
jmp 0x14007a6f2
cmp word [rsp + 0xdc], 0
jne 0x14007a6fa
mov r8d, dword [rsp + 0x50]
test r8d, r8d
jne 0x14007a251
test r11, r11
jns 0x14007a251
test r13d, r13d
jle 0x14007a254
cmp ecx, r13d
jge 0x14007a780
test r13d, r13d
js 0x14007a285
test r8d, r8d
je 0x14007a260
cmp r13d, edx
je 0x14007a285
test r11, r11
jns 0x14007a285
test r13d, r13d
jne 0x14007a6fa
test r15b, 0x10
jne 0x14007a6fa
cmp r15d, 0x84
je 0x14007a6fa
xor r13b, r13b
xor eax, eax
movzx r12d, ax
nop
movsx rax, r12w
lea rcx, [rax + rax*4]
mov ax, word [rsp + 0x7c]
cmp word [rsp + rcx*2 + 0x102], ax
jne 0x14007a359
movsx eax, word [rsp + rcx*2 + 0x100]
cmp eax, edx
jne 0x14007a359
mov r14w, word [rsp + rcx*2 + 0x108]
mov r13b, 1
test r8d, r8d
je 0x14007a376
cmp byte [rsp + 0x40], 0
lea eax, [r10 + 0x3e8]
mov word [rsp + 0x210], r14w
mov dword [rsp + 0x44], eax
mov word [rsp + 0x218], r14w
je 0x14007a30c
lea rcx, [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
test eax, eax
jne 0x14007a30c
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
lea rdx, [rsp + 0x210]
cmp word [rbx], ax
mov r8, rax
mov ecx, eax
cmovne r8, rbx
or ecx, dword [rsp + 0x74]
or ecx, 2
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x14007a339
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsp + 0x40], 0
je 0x14007a34d
movzx ecx, word [rsp + 0x218]
call fcn.14005eb10
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x94]
mov r10d, dword [rsp + 0x70]
inc r12w
cmp r12w, 0x1a
jl 0x14007a290
test r8d, r8d
jne 0x14007a6ea
cmp byte [rsp + 0x4a], 0
je 0x14007a394
test r15b, 0x10
jne 0x14007a6ea
cmp r15d, 0x84
je 0x14007a6ea
cmp byte [rsp + 0x6a], 0
mov r9b, byte [rsp + 0x48]
jne 0x14007a3e0
test r9b, r9b
jne 0x14007a3e0
cmp byte [rsp + 0x68], r9b
jne 0x14007a3e0
mov r15w, word [rsp + 0x60]
test r13b, r13b
je 0x14007a61f
test r15w, r15w
je 0x14007a6ea
xor r14d, r14d
cmp byte [rsp + 0x4c], r14b
jne 0x14007a21b
mov r12d, dword [rsp + 0x94]
jmp 0x14007a62a
mov r8d, dword [rsp + 0xc8]
movzx r10d, word [rsp + 0x98]
mov edx, 1
inc r8d
lea ecx, [r10 - 0x41]
shl edx, cl
cmp byte [rsp + 0x90], 0
mov dword [rsp + 0xc8], r8d
je 0x14007a530
test r9b, r9b
je 0x14007a439
cmp dword [rsp + 0xe0], 4
jle 0x14007a439
inc r8d
mov dword [rsp + 0xc8], r8d
cmp r9b, 1
je 0x14007a6ea
cmp r9b, 2
mov r9d, dword [rsp + 0x44]
jne 0x14007a454
test r14w, r14w
je 0x14007a454
cmp r8d, 1
je 0x14007a6ef
mov r15w, r10w
mov word [rsp + 0x218], r10w
mov word [rsp + 0x210], r10w
mov word [rsp + 0x60], r10w
inc r10w
mov word [rsp + 0x98], r10w
cmp r14w, r15w
je 0x14007a6ef
mov eax, dword [rsp + 0x80]
test eax, edx
je 0x14007a550
lea rcx, [rsp + 0x218]
mov word [rsp + 0x218], r15w
mov word [rsp + 0x210], r15w
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
test eax, eax
jne 0x14007a4c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
lea rdx, [rsp + 0x210]
xor r8d, r8d
or ecx, dword [rsp + 0x74]
or ecx, 2
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x14007a4e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13b, byte [rsp + 0x40]
test r13b, r13b
je 0x14007a4fb
movzx ecx, word [rsp + 0x218]
call fcn.14005eb10
mov r12d, dword [rsp + 0x94]
lea eax, [r15 - 0x41]
movsx rax, ax
lea rcx, [rax + rax*4]
mov ax, word [rsp + 0x7c]
mov word [rsp + rcx*2 + 0x102], ax
mov word [rsp + rcx*2 + 0x100], r12w
mov word [rsp + rcx*2 + 0x108], r15w
jmp 0x14007a55d
cmp r9b, 1
jne 0x14007a439
mov r9d, dword [rsp + 0x70]
add r9d, 0x3e8
mov dword [rsp + 0x44], r9d
jmp 0x14007a454
mov r12d, dword [rsp + 0x94]
mov r13b, byte [rsp + 0x40]
test r14w, r14w
je 0x14007a627
lea rcx, [rsp + 0x218]
mov word [rsp + 0x218], r14w
mov word [rsp + 0x210], r14w
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
test eax, eax
jne 0x14007a591
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
lea rdx, [rsp + 0x210]
xor r8d, r8d
or ecx, dword [rsp + 0x74]
or ecx, 2
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x14007a5b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r13b, r13b
je 0x14007a5c7
movzx ecx, word [rsp + 0x218]
call fcn.14005eb10
movzx ecx, r14w
lea eax, [r14 - 0x41]
mov edx, 1
sub ecx, 0x41
movsx rax, ax
mov word [rsp + 0x218], r15w
shl edx, cl
lea rcx, [rax + rax*4]
mov eax, 0xfffffff1
not edx
mov word [rsp + rcx*2 + 0x100], ax
mov word [rsp + rcx*2 + 0x102], ax
and dword [rsp + 0x80], edx
xor r14d, r14d
mov word [rsp + 0x210], r15w
mov word [rsp + rcx*2 + 0x108], r14w
jmp 0x14007a62a
mov r12d, dword [rsp + 0x94]
xor r14d, r14d
mov r8d, dword [rsp + 0x84]
lea rdx, str.DeviceHarddisk_dPartition_d
movsx r9d, r12w
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
test r15w, r15w
jne 0x14007a67d
movzx r8d, byte [rsp + 0x58]
lea rcx, [rsp + 0x80]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
sub r8b, 0x41
call fcn.14005ebb0
mov word [rsp + 0x218], ax
movzx ecx, ax
mov word [rsp + 0x210], ax
jmp 0x14007a68d
mov cx, word [rsp + 0x210]
movzx eax, word [rsp + 0x218]
sub cx, 0x41
cmp cx, 0x19
ja 0x14007a90b
test ax, ax
je 0x14007a21b
mov al, byte [rsp + 0x40]
mov r9d, dword [rsp + 0x74]
lea r8, [rsp + 0x218]
lea rdx, [rsp + 0x210]
mov rcx, rbx
mov byte [rsp + 0x20], al
call fcn.140068190
test eax, eax
je 0x14007a6d9
mov r9d, dword [rsp + 0x44]
mov dword [rsp + 0x78], r14d
jmp 0x14007a6f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, dword [rsp + 0x44]
mov dword [rsp + 0x78], eax
jmp 0x14007a6f2
mov r9d, dword [rsp + 0x44]
xor r14d, r14d
mov r12, qword [rsp + 0xa0]
mov eax, dword [rsp + 0xc0]
mov r13d, dword [rsp + 0x5c]
mov r10d, dword [rsp + 0x70]
mov r11, qword [rsp + 0xe8]
dec eax
inc r9d
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0xc0], eax
test eax, eax
jg 0x140079ef0
mov r15, qword [rsp + 0xd0]
cmp r15, 0xffffffffffffffff
je 0x14007a743
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, dword [rsp + 0x64]
mov r13d, dword [rsp + 0x5c]
inc r12w
mov dword [rsp + 0x64], r12d
jmp 0x140079c03
mov ecx, dword [rsp + 0xc4]
inc cx
cmp cx, 0x20
mov dword [rsp + 0xc4], ecx
jge 0x14007a7a4
inc r12w
mov dword [rsp + 0x64], r12d
jmp 0x140079c03
movsx ecx, word [rsp + 0x7c]
mov r13d, edx
mov dword [rsp + 0x5c], edx
mov dword [rsp + 0x54], ecx
mov rcx, qword [rsp + 0xd0]
cmp rcx, 0xffffffffffffffff
je 0x14007a7ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [rsp + 0x41]
mov r8d, dword [rsp + 0x50]
mov r10b, byte [rsp + 0x48]
inc dword [rsp + 0xd8]
cmp r10b, 1
jne 0x14007a7f4
mov r10b, 2
xor r12b, r12b
mov byte [rsp + 0x48], r10b
lea rcx, [rsp + 0xa8]
mov byte [rsp + 0x42], r12b
call fcn.14005b520
mov r15w, word [rsp + 0x60]
mov esi, dword [rsp + 0x50]
mov edx, dword [rsp + 0x54]
mov r8b, byte [rsp + 0x49]
jmp 0x140079ad1
cmp byte [rsp + 0x6a], 0
jne 0x14007a804
test r10b, r10b
je 0x14007a96b
movzx ecx, byte [rsp + 0x4b]
test cl, cl
je 0x14007a96b
movsx ecx, cl
mov byte [rsp + 0x4b], 0
mov r12b, VariantTimeToDosDateTime
mov word [rsp + 0x98], cx
jmp 0x14007a7ca
mov rcx, qword [rsp + 0xd0]
cmp rcx, 0xffffffffffffffff
je 0x14007a83a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xa8]
call fcn.14005b520
lea rcx, [rsp + 0xb8]
call fcn.14005b520
lea rcx, [rsp + 0xb0]
call fcn.14005b520
lea rcx, [rsp + 0x88]
call fcn.14005b520
test rdi, rdi
je 0x14007a87c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x14007a8da
mov rcx, qword [rsp + 0xd0]
cmp rcx, 0xffffffffffffffff
je 0x14007a894
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xa8]
call fcn.14005b520
lea rcx, [rsp + 0xb8]
call fcn.14005b520
lea rcx, [rsp + 0xb0]
call fcn.14005b520
lea rcx, [rsp + 0x88]
call fcn.14005b520
test rdi, rdi
je 0x14007a8d6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.14010bcc0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [rsp + 0xd0]
cmp rcx, 0xffffffffffffffff
je 0x14007a91f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xa8]
call fcn.14005b520
lea rcx, [rsp + 0xb8]
call fcn.14005b520
lea rcx, [rsp + 0xb0]
call fcn.14005b520
lea rcx, [rsp + 0x88]
call fcn.14005b520
test rdi, rdi
je 0x14007a961
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x80070057
jmp 0x14007a8da
test r13d, r13d
jle 0x14007a894
cmp dword [rsp + 0x6c], 0
jge 0x14007a894
test r8d, r8d
jne 0x14007a894
test al, al
jne 0x14007a894
cmp byte [rsp + 0x49], al
jne 0x14007a894
lea rcx, [rsp + 0xa8]
call fcn.14005b520
mov esi, dword [rsp + 0x50]
mov edx, dword [rsp + 0x54]
test edx, edx
js 0x14007ab2e
test r13d, r13d
jle 0x14007ab2e
test edx, edx
js 0x14007a9e1
test r13d, r13d
jle 0x14007a9e1
movsx r8d, dx
lea rdx, str.DeviceHarddisk_dPartition_d
movsx r9d, r13w
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x3a
mov ecx, 0x2c
mov word [rbp + 2], dx
movzx eax, word [rbp]
cmp cx, ax
jne 0x14007a9ff
mov eax, 0xff0c
jmp 0x14007aa2b
mov ecx, 0x3b
cmp cx, ax
jne 0x14007aa10
mov eax, 0xff1b
jmp 0x14007aa2b
cmp dx, ax
jne 0x14007aa1c
mov eax, 0xff1a
jmp 0x14007aa2b
mov ecx, 0x3d
cmp cx, ax
jne 0x14007aa2f
mov eax, 0xff1d
mov word [rbp], ax
mov eax, 0x5c
mov word [rbp + 4], ax
mov word [rbp + 6], r14w
movzx eax, word [rbp]
mov word [rsp + 0x222], dx
mov word [rsp + 0x224], r14w
mov word [rsp + 0x220], ax
cmp word [rbx], 0
je 0x14007aa96
test esi, esi
jne 0x14007aa96
mov al, byte [rsp + 0x40]
mov r9d, r14d
lea rdx, [rsp + 0x220]
or r9d, dword [rsp + 0x74]
mov r8, rbp
mov rcx, rbx
mov byte [rsp + 0x20], al
call fcn.140068190
test eax, eax
jne 0x14007aaf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x14007aaf1
mov sil, byte [rsp + 0x40]
test sil, sil
je 0x14007aab3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
test eax, eax
jne 0x14007aab3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp word [rbx], 0
mov ecx, r14d
mov r8, r14
cmovne r8, rbx
or ecx, dword [rsp + 0x74]
lea rdx, [rsp + 0x220]
or ecx, 2
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x14007aae3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test sil, sil
je 0x14007aaf1
movzx ecx, word [rbp]
call fcn.14005eb10
lea rcx, [rsp + 0xb8]
call fcn.14005b520
lea rcx, [rsp + 0xb0]
call fcn.14005b520
lea rcx, [rsp + 0x88]
call fcn.14005b520
test rdi, rdi
je 0x14007ab26
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, r14d
jmp 0x14007a8da
lea rcx, [rsp + 0xb8]
call fcn.14005b520
lea rcx, [rsp + 0xb0]
call fcn.14005b520
lea rcx, [rsp + 0x88]
call fcn.14005b520
test rdi, rdi
je 0x14007ab63
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x14007a8da