Function at 0x1400048b8
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x140036068]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r15d, r15d
mov qword [rdx + 8], rdx
or rbp, 0xffffffffffffffff
mov qword [rdx], rdx
mov rbx, rbp
mov rsi, rdx
mov r14, rcx
mov edi, r15d
mov r12d, r15d
mov r13d, r15d
inc rbx
cmp word [rcx + rbx*2], r15w
jne 0x140004901
lea rbx, [rbx*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x48], rax
mov rbx, rax
test rax, rax
jne 0x140004942
mov ebx, r15d
lea edi, [rax + 8]
jmp 0x140004c57
inc rbp
cmp word [r14 + rbp*2], r15w
jne 0x140004942
lea rdx, [rbp + 1]
mov r8, r14
mov rcx, rbx
call fcn.1400019b8
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov r8, rbx
lea rdx, str.SOURCE
mov rcx, rsi
call fcn.14000bbbc
mov ebx, eax
test eax, eax
je 0x140004c03
mov rbx, qword [rsp + 0x48]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x14000499c
mov word [rax], r15w
mov r8, rbx
lea rdx, [0x1400267c0]
mov rcx, rsi
call fcn.14000bbbc
mov ebx, eax
test eax, eax
je 0x140004c03
mov cl, 1
call fcn.140002698
mov r12, rax
test rax, rax
jne 0x1400049eb
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_get_system_partition__Last_Error___x
lea ecx, [r12 + 4]
mov edi, eax
call fcn.14000b134
jmp 0x140004c0b
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov r8, r12
lea rdx, [0x140026840]
mov rcx, rsi
call fcn.14000bbbc
mov ebx, eax
test eax, eax
je 0x140004c03
call fcn.140004c9c
mov edx, eax
mov ebp, eax
sub edx, 1
je 0x140004a47
cmp edx, 1
je 0x140004a30
mov ebx, r15d
mov edi, 0x1f
jmp 0x140004c0b
lea r8, [0x140026850]
lea r14, str.EFIMicrosoftBoot
lea r15, str.bootmgfw.efi
jmp 0x140004a5c
lea r8, str.PCAT
lea r14, str.Boot
lea r15, str.bootmgr
lea rdx, str.FWTYPE
mov rcx, rsi
call fcn.14000bbbc
mov ebx, eax
test eax, eax
je 0x140004c03
lea r8, str.Fonts
mov rcx, rsi
lea rdx, str.FONTS
call fcn.14000bbbc
mov ebx, eax
test eax, eax
je 0x140004c03
lea r8, str.Resources
mov rcx, rsi
lea rdx, str.RESOURCES
call fcn.14000bbbc
mov ebx, eax
test eax, eax
je 0x140004c03
mov r8, r14
lea rdx, str.DEST
mov rcx, rsi
call fcn.14000bbbc
mov ebx, eax
test eax, eax
je 0x140004c03
mov r8, r15
lea rdx, [0x140026940]
mov rcx, rsi
call fcn.14000bbbc
xor r15d, r15d
mov ebx, eax
test eax, eax
je 0x140004c03
cmp ebp, 1
jne 0x140004b15
lea r8, [0x1400253c8]
mov rcx, rsi
lea rdx, str.ISPCAT
call fcn.14000bbbc
mov ebx, eax
test eax, eax
je 0x140004c03
lea rdx, str.SYSPART_
mov rcx, rsi
call fcn.14000bd98
mov r13, rax
test rax, rax
jne 0x140004b34
mov ebx, r15d
jmp 0x140004c03
mov r8d, 0x105
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x140004bb7
mov dword [rsp + 0x38], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov r14d, eax
test eax, eax
je 0x140004bb7
test byte [rsp + 0x40], 8
jne 0x140004b94
mov ecx, 0x32
mov r14d, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14d, r14d
je 0x140004bb7
lea r8, [0x1400253c8]
mov rcx, rsi
lea rdx, str.ACLS
call fcn.14000bbbc
mov ebx, eax
test eax, eax
jne 0x140004bc6
jmp 0x140004c03
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x32
jne 0x140004b2c
cmp ebp, 2
jne 0x140004c0b
lea r8, str.EFIBoot
mov rcx, rsi
lea rdx, str.EFIDEFAULT
call fcn.14000bbbc
mov ebx, eax
test eax, eax
je 0x140004c03
lea r8, str.bootx64.efi
mov rcx, rsi
lea rdx, str.DEFAULTAPP
call fcn.14000bbbc
mov ebx, eax
test eax, eax
jne 0x140004c0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r12, r12
je 0x140004c3a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x140004c53
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x140004c67
mov rcx, rsi
call fcn.14000bd38
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14001fbe0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret