Function at 0x1400d5ddc
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3d8]
sub rsp, 0x4b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov qword [rsp + 0x50], rcx
xor ebx, ebx
lea rcx, str.BuildStateInfo
mov esi, ebx
mov dword [rsp + 0x40], ebx
lea edi, [rbx + 1]
call fcn.140007418
lea r14d, [rbx + 0x11]
mov qword [rsp + 0x58], rbx
mov ecx, r14d
mov qword [rsp + 0x48], rbx
mov r13d, ebx
mov qword [rsp + 0x38], rbx
call fcn.1400d6e88
test eax, eax
je 0x1400d5e61
lea r14d, [rbx + 0x12]
mov ecx, r14d
call fcn.1400d6e88
test eax, eax
jne 0x1400d5e9c
mov r9d, 0x522
mov edi, ebx
mov esi, r9d
mov rcx, qword [0x14015a290]
lea rbx, [0x14015a290]
cmp rcx, rbx
je 0x1400d6adc
test byte [rcx + 0x1c], 8
je 0x1400d6adc
mov edx, r14d
lea rax, str.ERROR_PRIVILEGE_NOT_HELD
jmp 0x1400d5f39
call fcn.140004c28
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x1400d5eed
mov edi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x14015a290]
lea rbx, [0x14015a290]
cmp rcx, rbx
je 0x1400d6adc
test byte [rcx + 0x1c], 8
je 0x1400d6adc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0x13
lea r8, [0x14012e920]
jmp 0x1400d65b3
mov ecx, 0x448
call fcn.140005bd0
xor r10d, r10d
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1400d5f45
lea r9d, [rax + 0xe]
mov edi, r10d
mov esi, r9d
mov rcx, qword [0x14015a290]
lea rbx, [0x14015a290]
cmp rcx, rbx
je 0x1400d6adc
test byte [rcx + 0x1c], 8
je 0x1400d6adc
lea edx, [rax + 0x14]
lea rax, str.pMpInfoList
lea r8, [0x14012e920]
jmp 0x1400d65c4
mov rax, qword [rsp + 0x58]
cmp dword [rax + 4], r10d
jbe 0x1400d5fa4
mov r13, qword [rsp + 0x48]
mov rsi, rax
mov eax, ebx
mov qword [rsp + 0x28], r10
lea rcx, [rax + rax*2]
movzx eax, word [rsi + rcx*8 + 0xc]
mov r9d, dword [rsi + rcx*8 + 8]
movzx r8d, word [rsi + rcx*8 + 0x1c]
add r9, rsi
mov edx, dword [rsi + rcx*8 + 0x18]
mov rcx, r13
shr ax, 1
add rdx, rsi
shr r8w, 1
mov word [rsp + 0x20], ax
call fcn.14000825c
add ebx, edi
mov r10d, 0
cmp ebx, dword [rsi + 4]
jb 0x1400d5f58
mov esi, r10d
mov r13d, esi
mov r15, qword [rsp + 0x48]
lea rbx, [0x14015a290]
lea r14, [0x14012e920]
cmp qword [r15 + 8], r10
je 0x1400d6464
mov r8, qword [r15 + 0x10]
test r8, r8
je 0x1400d6464
movzx r12d, word [r15 + 0x2e]
lea rcx, [rbp - 0x70]
mov r9d, r12d
mov edx, 0x105
call fcn.140006720
xor ecx, ecx
test eax, eax
js 0x1400d6a83
lea eax, [rcx + 0x5c]
lea rcx, [rbp - 0x70]
mov word [rbp - 0x6e], ax
call fcn.1400d5d48
xor r10d, r10d
test eax, eax
jne 0x1400d6464
lea ecx, [rax + 0x5c]
mov word [rbp + r12*2 - 0x70], cx
lea ecx, [r12 + 1]
add rcx, rcx
cmp rcx, 0x20a
jae 0x1400d6a7d
mov word [rbp + rcx - 0x70], r10w
mov eax, r10d
cmp dword [r15 + 0x30], r10d
jne 0x1400d61c4
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDriveTypeW]
xor r10d, r10d
cmp dword [r15 + 0x30], r10d
jne 0x1400d61c4
cmp eax, 3
je 0x1400d61cd
test eax, eax
je 0x1400d6464
mov r12, qword [r15 + 0x18]
test r12, r12
jne 0x1400d60ff
mov ecx, 0x1090
call fcn.140005bd0
xor ecx, ecx
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400d6552
mov qword [rax], rcx
mov r12d, 0x40
movzx r9d, word [r15 + 0x2e]
lea rcx, [rax + 0x80c]
mov r8, qword [r15 + 0x10]
mov edx, r12d
call fcn.140006720
xor ecx, ecx
test eax, eax
js 0x1400d64fc
mov r12, qword [rsp + 0x38]
mov edx, 0x400
movzx r9d, word [r15 + 0x2c]
mov r8, qword [r15 + 8]
lea rcx, [r12 + 0xc]
call fcn.140006720
xor r10d, r10d
test eax, eax
js 0x1400d64aa
mov rcx, qword [rsp + 0x50]
mov rdx, r12
add rcx, 0x10
call fcn.1400d5d2c
test eax, eax
je 0x1400d6475
mov qword [rsp + 0x38], r10
jmp 0x1400d6464
mov ecx, 0x1090
call fcn.140005bd0
xor ecx, ecx
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400d66ca
mov qword [rax], rcx
mov edx, 0x40
movzx r9d, word [r15 + 0x2e]
lea rcx, [rax + 0x80c]
mov r8, qword [r15 + 0x10]
call fcn.140006720
xor ecx, ecx
test eax, eax
js 0x1400d667c
mov rcx, qword [rsp + 0x38]
mov edx, 0x400
movzx r9d, word [r12 + 8]
add rcx, 0x88c
mov r8, qword [r12]
call fcn.140006720
xor ecx, ecx
test eax, eax
js 0x1400d6623
mov rcx, qword [rsp + 0x38]
mov edx, 0x400
movzx r9d, word [r15 + 0x2c]
add rcx, 0xc
mov r8, qword [r15 + 8]
call fcn.140006720
xor r10d, r10d
test eax, eax
js 0x1400d65d7
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
add rcx, 0x10
call fcn.1400d5d2c
test eax, eax
je 0x1400d6580
mov r12, qword [r12 + 0x10]
mov qword [rsp + 0x38], r10
test r12, r12
jne 0x1400d60ff
jmp 0x1400d6464
cmp eax, 3
jne 0x1400d6267
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x30], r10b
lea rcx, [rbp - 0x70]
call fcn.1400d6cb4
xor r10d, r10d
test eax, eax
jne 0x1400d622f
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6464
test byte [rax + 0x1c], 4
je 0x1400d6464
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x14015a290]
lea r9, [rbp - 0x70]
mov edx, 0x16
mov dword [rsp + 0x20], eax
mov r8, r14
mov rcx, qword [rcx + 0x10]
call fcn.1400d5bd4
xor r10d, r10d
jmp 0x1400d6464
cmp byte [rsp + 0x30], r10b
je 0x1400d6267
mov rcx, qword [0x14015a290]
cmp rcx, rbx
je 0x1400d6464
test byte [rcx + 0x1c], 4
je 0x1400d6464
mov rcx, qword [rcx + 0x10]
lea r9, [rbp - 0x70]
mov edx, 0x17
mov r8, r14
call fcn.1400d5b58
jmp 0x1400d6227
cmp dword [r15 + 0x30], r10d
jne 0x1400d628e
lea rax, [rsp + 0x40]
lea r9, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.1400d6be4
jmp 0x1400d62dd
mov r12d, 0x10
lea r8, [r15 + 0x34]
mov edx, r12d
lea rcx, [rsp + 0x68]
call fcn.140005350
xor ecx, ecx
test eax, eax
js 0x1400d6a36
mov r12d, 0x100
lea r8, [r15 + 0x23e]
mov edx, r12d
lea rcx, [rbp + 0x1a0]
call fcn.140005350
xor ecx, ecx
test eax, eax
js 0x1400d69e7
mov eax, dword [r15 + 0x28]
mov dword [rsp + 0x40], eax
mov r12, qword [r15 + 0x18]
test r12, r12
jne 0x1400d6390
mov ecx, 0xab8
call fcn.140005bd0
mov r13, rax
xor eax, eax
test r13, r13
je 0x1400d6828
mov qword [r13], rax
lea rcx, [r13 + 0xc]
movzx r9d, word [r15 + 0x2e]
lea edx, [rax + 0x40]
mov r8, qword [r15 + 0x10]
call fcn.140006720
xor ecx, ecx
test eax, eax
js 0x1400d67d8
lea rcx, [r13 + 0x88c]
lea r8, [rsp + 0x68]
lea edx, [r12 + 0x10]
call fcn.140005350
xor ecx, ecx
test eax, eax
js 0x1400d6789
lea rcx, [r13 + 0x8ac]
mov edx, 0x100
lea r8, [rbp + 0x1a0]
call fcn.140005350
xor r10d, r10d
test eax, eax
js 0x1400d6737
mov eax, dword [rsp + 0x40]
mov rdx, r13
mov rcx, qword [rsp + 0x50]
mov dword [r13 + 0xaac], eax
call fcn.1400d5d2c
test eax, eax
je 0x1400d6702
mov r13d, r10d
jmp 0x1400d6464
mov ecx, 0xab8
call fcn.140005bd0
mov r13, rax
xor eax, eax
test r13, r13
je 0x1400d69b2
mov qword [r13], rax
lea rcx, [r13 + 0xc]
movzx r9d, word [r15 + 0x2e]
lea edx, [rax + 0x40]
mov r8, qword [r15 + 0x10]
call fcn.140006720
xor ecx, ecx
test eax, eax
js 0x1400d696c
movzx r9d, word [r12 + 8]
lea rcx, [r13 + 0x8c]
mov r8, qword [r12]
mov edx, 0x400
call fcn.140006720
xor ecx, ecx
test eax, eax
js 0x1400d6918
lea rcx, [r13 + 0x88c]
mov edx, 0x10
lea r8, [rsp + 0x68]
call fcn.140005350
xor ecx, ecx
test eax, eax
js 0x1400d68d3
lea rcx, [r13 + 0x8ac]
mov edx, 0x100
lea r8, [rbp + 0x1a0]
call fcn.140005350
xor r10d, r10d
test eax, eax
js 0x1400d688b
mov eax, dword [rsp + 0x40]
mov rdx, r13
mov rcx, qword [rsp + 0x50]
mov dword [r13 + 0xaac], eax
call fcn.1400d5d2c
test eax, eax
je 0x1400d6856
mov r12, qword [r12 + 0x10]
mov r13d, r10d
test r12, r12
jne 0x1400d6390
mov r15, qword [r15]
test r15, r15
jne 0x1400d5fb7
jmp 0x1400d6adc
mov edi, r10d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0x28
jmp 0x1400d65b0
mov ecx, eax
mov edi, r10d
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
movzx r9d, word [r15 + 0x2c]
lea rcx, [r12 + 0xc]
mov r8, qword [r15 + 8]
mov edx, 0x400
call fcn.140006720
mov edx, 0x27
mov r9d, eax
lea rax, str.::StringCchCopyN_ARRAY_COUNT_PARAM_pNewMedia__szDevicePath___pMp__pDeviceName__pMp__cchDeviceName_
jmp 0x1400d6ac4
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
mov rcx, qword [rsp + 0x38]
mov rdx, r12
movzx r9d, word [r15 + 0x2e]
add rcx, 0x80c
mov r8, qword [r15 + 0x10]
call fcn.140006720
mov edx, 0x26
mov r9d, eax
lea rax, str.::StringCchCopyN_ARRAY_COUNT_PARAM_pNewMedia__szVolumeGuid___pMp__pVolumeGuid__pMp__cchVolumeGuid_
jmp 0x1400d6ac4
mov r9d, 0xe
mov edi, ecx
mov esi, r9d
mov rcx, qword [0x14015a290]
cmp rcx, rbx
je 0x1400d6adc
test byte [rcx + 0x1c], 8
je 0x1400d6adc
lea edx, [r9 + 0x17]
jmp 0x1400d66f3
mov edi, r10d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0x2d
mov r8, r14
mov rcx, qword [0x14015a290]
mov r9d, eax
lea rax, str.GetLastError___
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
call fcn.1400d5cb0
jmp 0x1400d6adc
mov ecx, eax
mov edi, r10d
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
mov rcx, qword [rsp + 0x38]
mov edx, 0x400
movzx r9d, word [r15 + 0x2c]
add rcx, 0xc
mov r8, qword [r15 + 8]
call fcn.140006720
mov edx, 0x2c
jmp 0x1400d64ed
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
mov rcx, qword [rsp + 0x38]
mov edx, 0x400
movzx r9d, word [r12 + 8]
add rcx, 0x88c
mov r8, qword [r12]
call fcn.140006720
mov r9d, eax
mov edx, 0x2b
lea rax, str.::StringCchCopyN_ARRAY_COUNT_PARAM_pNewMedia__szDosPath___pCurrentLink__pLink__pCurrentLink__cchLink_
jmp 0x1400d6ac4
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
mov rcx, qword [rsp + 0x38]
mov edx, 0x40
movzx r9d, word [r15 + 0x2e]
add rcx, 0x80c
mov r8, qword [r15 + 0x10]
call fcn.140006720
mov edx, 0x2a
jmp 0x1400d6543
mov r9d, 0xe
mov edi, ecx
mov esi, r9d
mov rcx, qword [0x14015a290]
cmp rcx, rbx
je 0x1400d6adc
test byte [rcx + 0x1c], 8
je 0x1400d6adc
lea edx, [r9 + 0x1b]
lea rax, str.pNewMedia
mov r8, r14
jmp 0x1400d65c4
mov edi, r10d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0x1e
jmp 0x1400d65b0
mov ecx, eax
mov edi, r10d
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
lea rcx, [r13 + 0x8ac]
mov edx, 0x100
lea r8, [rbp + 0x1a0]
call fcn.140005350
mov edx, 0x1d
mov r9d, eax
lea rax, str.::StringCchCopy_ARRAY_COUNT_PARAM_pNewVolume__szLabel___szLabel_
jmp 0x1400d6ac4
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
lea rcx, [r13 + 0x88c]
mov edx, 0x10
lea r8, [rsp + 0x68]
call fcn.140005350
mov edx, 0x1c
mov r9d, eax
lea rax, str.::StringCchCopy_ARRAY_COUNT_PARAM_pNewVolume__szFsName___szFsName_
jmp 0x1400d6ac4
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
movzx r9d, word [r15 + 0x2e]
lea rcx, [r13 + 0xc]
mov r8, qword [r15 + 0x10]
mov edx, 0x40
call fcn.140006720
mov edx, 0x1b
mov r9d, eax
lea rax, str.::StringCchCopyN_ARRAY_COUNT_PARAM_pNewVolume__szGuid___pMp__pVolumeGuid__pMp__cchVolumeGuid_
jmp 0x1400d6ac4
mov r9d, 0xe
mov edi, eax
mov esi, r9d
mov rcx, qword [0x14015a290]
cmp rcx, rbx
je 0x1400d6adc
test byte [rcx + 0x1c], 8
je 0x1400d6adc
lea edx, [r9 + 0xc]
jmp 0x1400d69db
mov edi, r10d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0x24
jmp 0x1400d65b0
mov ecx, eax
mov edi, r10d
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
lea rcx, [r13 + 0x8ac]
mov edx, 0x100
lea r8, [rbp + 0x1a0]
call fcn.140005350
mov edx, 0x23
jmp 0x1400d677a
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
lea rcx, [r13 + 0x88c]
mov edx, 0x10
lea r8, [rsp + 0x68]
call fcn.140005350
mov edx, 0x22
jmp 0x1400d67c9
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
movzx r9d, word [r12 + 8]
lea rcx, [r13 + 0x8c]
mov r8, qword [r12]
mov edx, 0x400
call fcn.140006720
mov r9d, eax
mov edx, 0x21
lea rax, str.::StringCchCopyN_ARRAY_COUNT_PARAM_pNewVolume__szDosPath___pCurrentLink__pLink__pCurrentLink__cchLink_
jmp 0x1400d6ac4
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
movzx r9d, word [r15 + 0x2e]
lea rcx, [r13 + 0xc]
mov r8, qword [r15 + 0x10]
mov edx, 0x40
call fcn.140006720
mov edx, 0x20
jmp 0x1400d6819
mov r9d, 0xe
mov edi, eax
mov esi, r9d
mov rcx, qword [0x14015a290]
cmp rcx, rbx
je 0x1400d6adc
test byte [rcx + 0x1c], 8
je 0x1400d6adc
lea edx, [r9 + 0x11]
lea rax, str.pNewVolume
jmp 0x1400d66fa
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
lea r8, [r15 + 0x23e]
mov rdx, r12
lea rcx, [rbp + 0x1a0]
call fcn.140005350
mov r9d, eax
mov edx, 0x19
lea rax, str.::StringCchCopy_ARRAY_COUNT_PARAM_szLabel___pMp__szLabel_
jmp 0x1400d6ac4
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
lea r8, [r15 + 0x34]
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.140005350
mov r9d, eax
mov edx, 0x18
lea rax, str.::StringCchCopy_ARRAY_COUNT_PARAM_szFsName___pMp__szFsName_
jmp 0x1400d6ac4
call fcn.140030a08
int3
mov edi, ecx
mov ecx, eax
call fcn.1400e32f8
mov esi, eax
mov rax, qword [0x14015a290]
cmp rax, rbx
je 0x1400d6adc
test byte [rax + 0x1c], 8
je 0x1400d6adc
mov r8, qword [r15 + 0x10]
lea rcx, [rbp - 0x70]
mov r9, r12
mov edx, 0x105
call fcn.140006720
mov r9d, eax
mov edx, 0x15
lea rax, str.::StringCchCopyN_ARRAY_COUNT_PARAM_szVolumeGuid___pMp__pVolumeGuid__cchGuid_
mov rcx, qword [0x14015a290]
mov r8, r14
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.1400d5cb0
mov rcx, r13
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
cmp qword [rsp + 0x48], 0
je 0x1400d6b0d
lea rcx, [rsp + 0x48]
call fcn.140004e54
lea rcx, str.BuildStateInfo
call fcn.1400073f0
mov ecx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov eax, edi
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400305f0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret