Function at 0x140032370
Capabilities:
Get disk information
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x570], rbx
mov rax, qword [0x140132088]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rsi, rdx
mov qword [rsp + 0x28], rdx
mov r13, rcx
mov qword [rsp + 0x68], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
lea rcx, [rbp - 0x68]
call fcn.140008ad0
nop
test rsi, rsi
jne 0x1400323e5
lea rdx, [rbp - 0x68]
mov rcx, r13
call fcn.140008aa0
jmp 0x140032843
lea rdx, str.Kernel32.dll
lea rcx, [rsp + 0x70]
call fcn.140002330
nop
call fcn.14002d210
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.14002d2b0
mov rdi, rax
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x70]
call fcn.140002320
lea rdx, str.Psapi.dll
lea rcx, [rsp + 0x40]
call fcn.140002330
nop
call fcn.14002d210
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.14002d2b0
mov r14, rax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.140002320
test r14, r14
je 0x140032837
test rdi, rdi
je 0x140032837
lea rcx, [rbp - 0x10]
call fcn.140027b20
cmp dword [rbp - 0xc], 6
jb 0x1400324ed
lea rdx, str.QueryFullProcessImageNameW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400324ed
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp - 0x10]
call fcn.1400a7960
mov dword [rbp - 0x70], 0x208
lea r9, [rbp - 0x70]
lea r8, [rbp - 0x10]
xor edx, edx
mov rcx, rsi
call rbx
test eax, eax
je 0x1400324ed
mov eax, dword [rbp - 0x70]
cmp eax, 0x208
jae 0x1400324d4
add rax, rax
cmp rax, 0x412
jae 0x14003288d
mov word [rbp + rax - 0x10], r15w
lea rcx, [rbp - 0x10]
call fcn.140002620
mov r8, rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x68]
call fcn.140002400
lea rcx, [rbp - 0x68]
call fcn.140002300
test al, al
je 0x140032773
lea rdx, str.GetProcessImageFileNameW
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x14003252e
lea rdx, str.GetProcessImageFileNameW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14003258c
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp - 0x10]
call fcn.1400a7960
mov r8d, 0x208
lea rdx, [rbp - 0x10]
mov rcx, rsi
call rbx
lea ecx, [rax - 1]
cmp ecx, 0x206
ja 0x14003258c
mov eax, eax
add rax, rax
cmp rax, 0x412
jae 0x140032881
xor ebx, ebx
mov word [rbp + rax - 0x10], bx
lea rcx, [rbp - 0x10]
call fcn.140002620
mov r8, rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x68]
call fcn.140002400
jmp 0x14003258e
xor ebx, ebx
lea rcx, [rbp - 0x68]
call fcn.140002300
test al, al
jne 0x140032770
mov ecx, 0x410
call fcn.1400a5f88
mov rdi, rax
xor edx, edx
mov r8d, 0x410
mov rcx, rax
call fcn.1400a7960
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x48]
call fcn.140008970
nop
lea rcx, [rbp - 0x48]
call fcn.140033bc0
mov r12, rbx
lea rcx, [rbp - 0x48]
call fcn.14000a670
test rax, rax
je 0x140032759
lea rcx, [rbp - 0x48]
call fcn.140002370
mov qword [rbp - 0x70], rax
mov r15, rbx
mov rsi, qword [rax]
add rsi, r15
mov rcx, rsi
call fcn.1400023f0
cmp rax, 3
jb 0x140032642
mov rcx, rsi
call fcn.140002370
mov rcx, rax
mov rdx, qword [rax + 0x18]
cmp rdx, 8
jb 0x14003262e
mov rcx, qword [rax]
cmp word [rcx + 4], 0x5c
jne 0x140032642
cmp rdx, 8
jb 0x14003263e
mov rax, qword [rax]
mov word [rax + 4], bx
mov rcx, rsi
call fcn.140002310
mov rcx, rax
mov r8d, 0x208
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x140032663
mov word [rdi], bx
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140032670
test ebx, ebx
je 0x1400326aa
mov r14d, ebx
lea rcx, [rbp - 0x68]
call fcn.1400023f0
cmp r14, rax
jae 0x1400326aa
lea rcx, [rbp - 0x68]
call fcn.140002310
mov rcx, rax
mov r8d, r14d
mov rdx, rdi
call fcn.1400b1504
test eax, eax
je 0x1400326ce
inc r12
add r15, 0x20
lea rcx, [rbp - 0x48]
call fcn.14000a670
cmp r12, rax
jae 0x14003274f
mov rax, qword [rbp - 0x70]
xor ebx, ebx
jmp 0x140032602
lea rcx, [rbp - 0x30]
call fcn.140008ad0
nop
lea rcx, [rbp - 0x68]
call fcn.140002310
mov ecx, ebx
lea rbx, [rax + rcx*2]
mov rcx, rsi
call fcn.140002310
mov r8, rax
mov r9, rbx
lea rdx, str._s_s
lea rcx, [rbp - 0x30]
call fcn.14001fc80
lea rcx, [rbp - 0x68]
call fcn.140002370
mov rcx, rax
call fcn.140002370
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140002370
mov rcx, rax
call fcn.140002370
movups xmm2, xmmword [rbx]
movups xmm3, xmmword [rbx + 0x10]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rax], xmm2
movups xmmword [rax + 0x10], xmm3
lea rcx, [rbp - 0x30]
call fcn.140002320
mov r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.1400a5a4c
nop
lea rcx, [rbp - 0x48]
call fcn.140008960
mov rdi, qword [rsp + 0x38]
xor r15d, r15d
lea rcx, [rbp - 0x68]
call fcn.140002300
test al, al
je 0x140032811
lea rdx, str.GetModuleFileNameExW
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x1400327b4
lea rdx, str.GetModuleFileNameExW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140032811
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp - 0x10]
call fcn.1400a7960
mov r9d, 0x208
lea r8, [rbp - 0x10]
xor edx, edx
mov rcx, rsi
call rbx
lea ecx, [rax - 1]
cmp ecx, 0x206
ja 0x140032811
mov eax, eax
add rax, rax
cmp rax, 0x412
jae 0x140032887
mov word [rbp + rax - 0x10], r15w
lea rcx, [rbp - 0x10]
call fcn.140002620
mov r8, rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x68]
call fcn.140002400
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x40]
call fcn.140021150
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140008a50
nop
lea rcx, [rsp + 0x40]
call fcn.140002320
lea rdx, [rbp - 0x68]
mov rcx, r13
call fcn.140008aa0
mov dword [rsp + 0x20], 1
lea rcx, [rbp - 0x68]
call fcn.140002320
mov rax, r13
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.1400a5660
mov rbx, qword [rsp + 0x570]
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a5b88
int3
call fcn.1400a5b88
int3
call fcn.1400a5b88
int3