Function at 0x14000c9dc
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x140015048]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [0x140015038]
lea r15, [0x140015038]
cmp rcx, r15
je 0x14000ca44
test dword [rcx + 0x1c], 0x20000000
je 0x14000ca44
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400122a8]
mov edx, 0x12
mov r9, rbx
call fcn.1400049dc
mov r9d, 1
lea rdx, str.SxGetUniqueVolumeForPath
mov r8d, 0x1fe
lea rcx, [rsp + 0x30]
call fcn.14000ab2c
and qword [rsp + 0x70], 0
lea rax, [0x1400122e0]
mov edi, 0x20a
mov qword [rsp + 0x68], rax
mov r8d, edi
lea rcx, [rbp - 0x80]
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, edi
lea rcx, [rbp + 0x190]
xor edx, edx
call sub.msvcrt.dll_memset
lea eax, [rdi - 6]
test rbx, rbx
jne 0x14000caae
mov ebx, 0x80070057
mov word [rsp + 0x36], ax
jmp 0x14000ccad
mov word [rsp + 0x34], ax
test rsi, rsi
jne 0x14000cabf
mov eax, 0x205
jmp 0x14000ca9f
and dword [rsp + 0x30], 0
mov eax, 0x206
mov word [rsp + 0x34], ax
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14000dee8
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
mov eax, 0x208
jns 0x14000caf4
mov word [rsp + 0x36], ax
jmp 0x14000ccb1
cmp dword [rsp + 0x70], 0
mov word [rsp + 0x34], ax
mov eax, 0x209
je 0x14000ca9f
and dword [rsp + 0x30], 0
lea rcx, [rsp + 0x68]
mov word [rsp + 0x34], ax
call fcn.14000e094
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
mov eax, 0x20b
js 0x14000caea
mov rdi, qword [rsp + 0x68]
lea rdx, [rbp - 0x80]
mov ebx, 0x105
mov word [rsp + 0x34], ax
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
nop dword [rax + rax]
test eax, eax
jne 0x14000cbaa
call fcn.14000c0f8
mov ebx, eax
mov dword [rsp + 0x30], eax
mov eax, 0x211
mov word [rsp + 0x36], ax
mov rcx, qword [0x140015038]
cmp rcx, r15
je 0x14000ccb1
test dword [rcx + 0x1c], 0x2000000
je 0x14000ccb1
mov dword [rsp + 0x28], ebx
lea r9, str.::GetVolumePathName__strPath__STRING_CCH_PARAM__wszRootPath____
mov qword [rsp + 0x20], rdi
mov edx, 0x13
mov rcx, qword [rcx + 0x10]
call fcn.14000bfa0
mov ebx, dword [rsp + 0x30]
jmp 0x14000ccb1
and dword [rsp + 0x30], 0
lea rdx, [rbp + 0x190]
mov eax, 0x211
lea rcx, [rbp - 0x80]
mov r8d, ebx
mov word [rsp + 0x34], ax
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
jne 0x14000cc27
call fcn.14000c0f8
mov ebx, eax
mov dword [rsp + 0x30], eax
mov eax, 0x218
mov word [rsp + 0x36], ax
mov rcx, qword [0x140015038]
cmp rcx, r15
je 0x14000ccb1
test dword [rcx + 0x1c], 0x2000000
je 0x14000ccb1
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9, str.::GetVolumeNameForVolumeMountPoint__wszRootPath__STRING_CCH_PARAM__wszVolume____
mov edx, 0x14
jmp 0x14000cb98
and dword [rsp + 0x30], 0
lea rcx, [rbp + 0x190]
mov eax, 0x218
mov r8d, 0x104
mov rdx, rsi
mov word [rsp + 0x34], ax
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
jne 0x14000cca1
call fcn.14000c0f8
mov ebx, eax
mov dword [rsp + 0x30], eax
mov eax, 0x21e
mov word [rsp + 0x36], ax
mov rcx, qword [0x140015038]
cmp rcx, r15
je 0x14000ccb1
test dword [rcx + 0x1c], 0x2000000
je 0x14000ccb1
lea rax, [rbp + 0x190]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9, str.::GetVolumeNameForVolumeMountPoint__wszVolume__pwszUnique__cchUnique__
mov edx, 0x15
jmp 0x14000cb98
mov eax, 0x21e
xor ebx, ebx
mov word [rsp + 0x34], ax
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x68]
call fcn.14000d4e8
lea rcx, [rsp + 0x30]
call fcn.14000ac34
mov eax, ebx
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14000e5c0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret