Function at 0x10009a26c
Capabilities:
Get disk information
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x30
mov r12, r8
mov r13b, dl
mov rbx, rcx
test rcx, rcx
jne 0x10009a2a8
lea r8, [0x100009b60]
lea rcx, [0x100009b10]
mov edx, 0xe5
call fcn.10009a050
and qword [rsp + 0x60], 0
or rsi, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
mov rcx, rsi
mov byte [r12], 0
repne scasw ax, word [rdi]
xor bpl, bpl
not rcx
dec rcx
cmp rcx, 5
jb 0x10009a347
lea r8d, [rax + 2]
lea rdx, [0x100009b7c]
mov rcx, rbx
call sub.msvcrt.dll__wcsnicmp
test eax, eax
jne 0x10009a347
cmp word [rbx + 4], 0x2e
je 0x10009a307
cmp word [rbx + 4], 0x3f
je 0x10009a307
lea edx, [rsi + 0x5d]
lea rcx, [rbx + 6]
call sub.msvcrt.dll_wcschr
test rax, rax
jne 0x10009a344
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 8
jbe 0x10009a347
cmp word [rbx + 4], 0x2e
je 0x10009a344
cmp word [rbx + 4], 0x3f
jne 0x10009a347
lea rcx, [rbx + 6]
lea r8d, [rax + 5]
lea rdx, [0x10000a148]
call sub.msvcrt.dll__wcsnicmp
test eax, eax
jne 0x10009a347
mov bpl, 1
mov rcx, qword [0x1001653b8]
lea r15, [0x1001653b8]
cmp rcx, r15
je 0x10009a398
test byte [rcx + 0x1c], 1
je 0x10009a398
cmp byte [rcx + 0x19], 5
jb 0x10009a398
mov rcx, qword [rcx + 0x10]
lea rdx, [0x10000a154]
test bpl, bpl
lea rax, [0x10000a158]
lea r8, [0x100003aa8]
mov r9, rbx
cmovne rax, rdx
mov edx, 0x3d
mov qword [rsp + 0x20], rax
call fcn.10001df74
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.10009b954
mov rsi, qword [rsp + 0x60]
mov edi, eax
test eax, eax
js 0x10009a58f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x10009a465
mov rcx, qword [0x1001653b8]
cmp rcx, r15
je 0x10009a3f4
test byte [rcx + 0x1c], 1
je 0x10009a3f4
cmp byte [rcx + 0x19], 5
jb 0x10009a3f4
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 6]
lea r8, [0x100003ae8]
mov r9, rbx
call fcn.10001db08
test bpl, bpl
jne 0x10009a403
mov edi, 0x8078011a
jmp 0x10009a58f
test r13b, r13b
je 0x10009a45b
mov rcx, rsi
call fcn.10009a124
mov edi, eax
test eax, eax
jns 0x10009a45b
mov rcx, qword [0x1001653b8]
cmp rcx, r15
je 0x10009a58f
test byte [rcx + 0x1c], 1
je 0x10009a58f
cmp byte [rcx + 0x19], 4
jb 0x10009a58f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0xf
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
jmp 0x10009a58f
mov byte [r12], 1
jmp 0x10009a58f
cmp eax, 1
jne 0x10009a55b
test bpl, bpl
jne 0x10009a4a2
mov rcx, qword [0x1001653b8]
cmp rcx, r15
je 0x10009a58f
test byte [rcx + 0x1c], al
je 0x10009a58f
cmp byte [rcx + 0x19], 5
jb 0x10009a58f
lea edx, [rax + 0xa]
mov dword [rsp + 0x20], eax
jmp 0x10009a57c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x10009a524
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x10009a51d
cmp eax, 0x52e
je 0x10009a51d
cmp eax, 0x43
je 0x10009a516
cmp eax, 0x35
je 0x10009a516
cmp eax, 3
je 0x10009a516
mov rcx, qword [0x1001653b8]
cmp rcx, r15
je 0x10009a58f
test byte [rcx + 0x1c], 1
je 0x10009a58f
cmp byte [rcx + 0x19], 4
jb 0x10009a58f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0xc
mov r9d, eax
call fcn.10001c878
jmp 0x10009a58f
mov edi, 0x80780071
jmp 0x10009a58f
mov edi, 0x8078006f
jmp 0x10009a58f
mov rcx, qword [0x1001653b8]
cmp rcx, r15
je 0x10009a554
test byte [rcx + 0x1c], 1
je 0x10009a554
cmp byte [rcx + 0x19], 2
jb 0x10009a554
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0xd
mov r9, rsi
call fcn.10001db08
mov edi, 0x8000ffff
jmp 0x10009a58f
mov rcx, qword [0x1001653b8]
cmp rcx, r15
je 0x10009a58f
test byte [rcx + 0x1c], 1
je 0x10009a58f
cmp byte [rcx + 0x19], 5
jb 0x10009a58f
mov edx, 0xe
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov r9, rbx
call fcn.10001ddb0
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov eax, edi
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret