Function at 0x140001990
Capabilities:
Get disk information
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xe8], rdx
mov rsi, r8
mov qword [rsp + 0xf8], r9
call fcn.140061090
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
call fcn.140061120
lea rcx, [rsp + 0xe8]
mov rdx, qword [rsp + 0xe8]
call fcn.140061120
lea rcx, [rsp + 0xf8]
mov rdx, qword [rsp + 0xf8]
call fcn.140061120
lea rcx, [rsp + 0x100]
mov rdx, qword [rsp + 0x100]
call fcn.140061120
mov qword [rsp + 0x50], 0
call fcn.1400612c0
lea rcx, [0x1400e383a]
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call sub.KERNEL32.dll_GetCurrentProcessId
mov rbx, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rbx
call fcn.140058d00
call fcn.140061290
mov rbx, rax
call fcn.1400611d0
mov r9d, eax
lea r8, [0x1400e3976]
mov edx, 4
mov rcx, rbx
call fcn.140058bf0
call fcn.1400611d0
lea rcx, [0x1400e393a]
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call sub.KERNEL32.dll_GetCurrentThreadId
mov rbx, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rbx
call fcn.140058d00
call fcn.140061290
mov rbx, rax
call fcn.1400611d0
mov r9d, eax
lea r8, [0x1400e3976]
mov edx, 4
mov rcx, rbx
call fcn.140058bf0
call fcn.1400611d0
lea rcx, [0x1400e3836]
call fcn.140061430
call fcn.1400611d0
lea rbx, [rsp + 0x50]
mov edx, eax
mov rcx, rbx
call fcn.140061320
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.140061290
mov rdi, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rdi
call fcn.14005ad98
call fcn.140061290
mov rdi, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rdi
call fcn.140058ed0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
lea rcx, [0x1400e3078]
call fcn.140061190
lea rdi, [0x1400e6010]
lea rbp, [0x1400e3936]
test eax, eax
jne 0x140001d20
call fcn.1400612c0
mov rcx, qword [rsp + 0x50]
call fcn.140061430
mov rcx, rbp
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.140061290
mov r12, rax
call fcn.1400611d0
mov edx, eax
mov rcx, r12
call fcn.14005ae48
call fcn.1400611d0
call fcn.1400611d0
mov edx, eax
mov rcx, rbx
call fcn.140061320
call fcn.1400612c0
mov rcx, qword [rsp + 0x50]
call fcn.140061430
mov rcx, rbp
call fcn.140061430
mov rcx, qword [rsp + 0xe8]
call fcn.140061430
lea rcx, [0x1400e38ea]
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov rcx, rsi
call fcn.140058b90
call fcn.1400611d0
call fcn.1400611d0
mov edx, eax
mov rcx, rbx
call fcn.140061320
mov rdx, qword [rsp + 0xf8]
mov rcx, rdi
call fcn.140061190
test eax, eax
je 0x140002290
mov rdx, qword [rsp + 0x100]
mov rcx, rdi
call fcn.140061190
test eax, eax
je 0x1400022d8
call fcn.1400612c0
mov rcx, qword [rsp + 0x50]
call fcn.140061430
lea rcx, [0x1400e3708]
call fcn.140061430
mov rcx, qword [rsp + 0xe0]
call fcn.140061430
call fcn.1400611d0
mov edx, eax
mov rcx, rbx
call fcn.140061320
cmp byte [0x1400e5da9], 0
je 0x140002320
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_OutputDebugStringW
mov rcx, qword [rsp + 0xf8]
call fcn.1400613b0
mov rcx, qword [rsp + 0xe8]
call fcn.1400613b0
mov rcx, qword [rsp + 0x100]
call fcn.1400613b0
mov rcx, qword [rsp + 0x50]
call fcn.1400613b0
mov rcx, qword [rsp + 0xe0]
call fcn.1400613b0
nop
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400612c0
mov rcx, qword [rsp + 0x50]
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
movsxd rcx, eax
call fcn.1400613f0
call fcn.140061090
mov rdx, qword [0x1400e5d00]
mov rcx, rdi
call fcn.140061190
test eax, eax
jne 0x140001dc0
call fcn.1400612c0
mov rcx, qword [0x1400e5d00]
call fcn.140061430
call fcn.140061290
call fcn.140061290
mov rbp, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rbp
call fcn.14005ae48
call fcn.1400611d0
lea rbp, [0x1400e3936]
mov rcx, rbp
call fcn.140061430
call fcn.1400611d0
mov edx, eax
mov rcx, rbx
call fcn.140061320
jmp 0x140001b8c
call sub.KERNEL32.dll_GetCurrentProcessId
mov r8, rax
xor edx, edx
mov ecx, 0x410
call sub.KERNEL32.dll_OpenProcess
mov r12, rax
test rax, rax
jne 0x140001e10
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.1400611d0
mov edx, eax
lea rcx, [0x1400e5d00]
call fcn.140061320
jmp 0x140001d68
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
movsxd rcx, eax
call fcn.1400613f0
call fcn.140061090
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call fcn.1400368e0
cmp rax, 0x3c
je 0x140001f28
lea rdx, str.kernel32.dll
mov rcx, 0xffffffffffffffff
call fcn.140054e04
mov rbp, rax
mov rcx, rax
call fcn.140054e8c
test rax, rax
jne 0x1400021e0
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
call fcn.1400612c0
mov rcx, qword [rsp + 0x68]
call fcn.140061430
call fcn.140061290
mov rcx, qword [rsp + 0x58]
call fcn.1400613b0
mov rcx, qword [rsp + 0x60]
call fcn.1400613b0
mov rcx, qword [rsp + 0x68]
call fcn.1400613b0
mov rcx, qword [rsp + 0x78]
call fcn.1400613b0
mov rcx, qword [rsp + 0x80]
call fcn.1400613b0
mov rcx, qword [rsp + 0x88]
call fcn.140060790
call fcn.1400611d0
mov edx, eax
lea rcx, [0x1400e5d00]
call fcn.140061320
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
jmp 0x140001d68
lea rdx, str.psapi.dll
mov rcx, 0xffffffffffffffff
call fcn.140054e04
mov r14, rax
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.140054e8c
test rax, rax
je 0x140001ea7
lea rdx, str.GetProcessImageFileNameW
mov rcx, r14
call fcn.140054e9c
mov qword [0x1400e5e08], rax
test rax, rax
je 0x1400021cd
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xb
mov edx, 0x105
mov ecx, 2
call fcn.14006083c
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov ecx, 0x104
call fcn.140058f60
call fcn.1400611d0
lea rcx, [rsp + 0x60]
mov edx, eax
call fcn.140061320
mov r8d, 0x104
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call qword [0x1400e5e08]
mov rdx, qword [rsp + 0x88]
mov ecx, 0x104
call sub.KERNEL32.dll_GetLogicalDriveStringsW
mov qword [rsp + 0x40], rax
xor r13d, r13d
lea r14, [rsp + 0x58]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
jmp 0x1400020e7
call fcn.1400612c0
call fcn.1400612c0
mov rcx, qword [rsp + 0x58]
call fcn.140058b70
mov rbp, rax
call fcn.1400611d0
lea rdx, [rbp - 1]
mov r8d, eax
mov rcx, qword [rsp + 0x58]
call fcn.140058fc0
call fcn.1400611d0
mov edx, eax
mov rcx, r14
call fcn.140061320
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov ecx, 0x104
call fcn.140058f60
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0x38]
call fcn.140061320
mov r8d, 0x104
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_QueryDosDeviceW
call fcn.1400612c0
call fcn.1400612c0
mov rcx, qword [rsp + 0x78]
call fcn.140058b70
mov rbp, rax
call fcn.1400611d0
mov r8d, eax
mov rdx, rbp
mov rcx, qword [rsp + 0x60]
call fcn.140058fc0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140061190
test eax, eax
jne 0x140002175
add r13, 1
cmp qword [rsp + 0x40], r13
jle 0x1400021cd
xor edx, edx
mov rcx, r14
call fcn.1400614a0
lea rbp, [r13 + r13]
mov rax, qword [rsp + 0x88]
cmp word [rax + r13*2], 0
je 0x140002010
nop word [rax + rax]
call fcn.1400612c0
mov rcx, qword [rsp + 0x58]
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
mov rax, qword [rsp + 0x88]
movzx r15d, word [rax + rbp]
call fcn.1400611d0
mov edx, eax
mov rcx, r15
call fcn.140059060
call fcn.1400611d0
call fcn.1400611d0
mov edx, eax
mov rcx, r14
call fcn.140061320
add r13, 1
add rbp, 2
mov rax, qword [rsp + 0x88]
cmp word [rax + rbp], 0
jne 0x140002110
jmp 0x140002010
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov r9d, eax
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call fcn.140059090
call fcn.140061290
mov rbp, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rbp
call fcn.1400594e0
call fcn.1400611d0
lea rcx, [rsp + 0x68]
mov edx, eax
call fcn.140061320
mov rcx, qword [rsp + 0x48]
call fcn.140054f48
jmp 0x140001ea7
lea rdx, [0x1400e2220]
mov rcx, rbp
call fcn.140054e9c
mov qword [0x1400e5e10], rax
test rax, rax
je 0x14000227a
mov qword [rsp + 0x70], 0x104
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov rcx, qword [rsp + 0x70]
mov edx, eax
call fcn.140058f60
call fcn.1400611d0
lea rcx, [rsp + 0x80]
mov edx, eax
call fcn.140061320
lea r9, [rsp + 0x70]
mov r8, qword [rsp + 0x80]
xor edx, edx
mov rcx, r12
call qword [0x1400e5e10]
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0x80]
call fcn.1400594e0
call fcn.1400611d0
lea rcx, [rsp + 0x68]
mov edx, eax
call fcn.140061320
mov rcx, rbp
call fcn.140054f48
jmp 0x140001ea7
call fcn.1400612c0
mov rcx, qword [rsp + 0x50]
call fcn.140061430
mov rcx, rbp
call fcn.140061430
mov rcx, qword [rsp + 0xf8]
call fcn.140061430
lea rcx, [0x1400e29a8]
call fcn.140061430
call fcn.1400611d0
mov edx, eax
mov rcx, rbx
call fcn.140061320
jmp 0x140001c63
call fcn.1400612c0
mov rcx, qword [rsp + 0x50]
call fcn.140061430
mov rcx, rbp
call fcn.140061430
mov rcx, qword [rsp + 0x100]
call fcn.140061430
lea rcx, [0x1400e2d8a]
call fcn.140061430
call fcn.1400611d0
mov edx, eax
mov rcx, rbx
call fcn.140061320
jmp 0x140001c7b
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov r8d, eax
mov edx, 1
mov rcx, qword [rsp + 0xe0]
call fcn.140058fc0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
lea rbx, [0x1400e3982]
mov rcx, rbx
call fcn.140061190
test eax, eax
jne 0x140001cc9
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov r8d, eax
mov edx, 1
mov rcx, qword [rsp + 0xe0]
call fcn.140058fc0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
mov rcx, rbx
call fcn.140061190
test eax, eax
jne 0x140001cc9
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov r8d, eax
mov edx, 1
mov rcx, qword [rsp + 0xe0]
call fcn.140058fc0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
mov rcx, rbp
call fcn.140061190
test eax, eax
je 0x140001cbf
jmp 0x140001cc9