Function at 0x1400882dc
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1400dc7b8]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rsi, r8
mov qword [rbp - 0x80], r8
movzx edi, dx
mov word [rsp + 0x38], dx
mov r13, rcx
mov qword [rsp + 0x78], rcx
xor r15d, r15d
mov qword [r8], r15
movabs rbx, 0x5c003a0020
mov qword [rbp - 0x78], rbx
mov word [rbp - 0x78], dx
lea r12, [rcx + 0x78]
lea rcx, [rbp - 0x78]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 3
je 0x14008835c
mov r14d, 0x80004001
jmp 0x1400883a2
lea r9, [rbp + 0x1a0]
mov r8, qword [r13 + 0x28]
movzx edx, word [r12]
movzx ecx, di
call fcn.14006ad00
mov r14d, eax
test eax, eax
js 0x1400883a2
mov rdx, qword [r13 + 0x20]
lea rcx, [rbp + 0x1a0]
call fcn.14006a828
mov r14d, eax
cmp eax, 1
jne 0x140088398
mov r14d, r15d
jmp 0x1400883a2
test eax, eax
js 0x1400883a2
mov r14d, 0x80004005
mov rcx, r15
mov qword [rsp + 0x48], rcx
test r14d, r14d
js 0x1400883c1
lea rcx, [rsp + 0x48]
call fcn.1400a3f74
mov r14d, eax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], r15
test r14d, r14d
js 0x14008872c
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1a0]
call fcn.1400a3e3c
mov r14d, eax
cmp eax, 1
jne 0x1400886ce
mov qword [rbp - 0x70], rbx
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x68]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov edx, 0x104
cmp word [r12], di
jne 0x140088425
lea r8, str._ProgramData_MicrosoftSearchDataApplications_
lea rcx, [rbp - 0x70]
call fcn.14000b8b0
mov r14d, eax
jmp 0x1400884c6
mov word [rbp - 0x70], di
mov r8, rdx
lea rax, [rbp - 0x70]
cmp word [rax], r15w
je 0x140088440
add rax, 2
sub r8, 1
jne 0x140088430
mov rax, r8
mov rcx, rdx
sub rcx, r8
neg rax
sbb r9, r9
and r9, rcx
mov rax, r8
neg rax
sbb r14d, r14d
not r14d
and r14d, 0x80070057
test r8, r8
je 0x1400884c6
sub rdx, r9
lea rcx, [rbp - 0x70]
lea rcx, [rcx + r9*2]
je 0x1400884a7
mov eax, 0x7ffffffe
lea r8, str.System_Volume_InformationMicrosoftWindows_Search_
sub r8, rcx
test rax, rax
je 0x1400884a7
movzx r9d, word [rcx + r8]
test r9w, r9w
je 0x1400884a7
mov word [rcx], r9w
add rcx, 2
dec rax
sub rdx, 1
jne 0x140088486
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r15w
neg rdx
sbb r14d, r14d
not r14d
and r14d, 0x8007007a
test r14d, r14d
js 0x1400884f9
xor r8d, r8d
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.api_ms_win_shell_shdirectory_l1_1_0.dll_Ordinal_290]
nop dword [rax + rax]
test eax, eax
je 0x1400884f6
cmp eax, 0x50
je 0x1400884f6
cmp eax, 0xb7
mov r14d, 0x80070003
jne 0x1400884f9
mov r14d, r15d
mov rsi, r15
mov qword [rbp - 0x78], r15
test r14d, r14d
js 0x14008851c
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x78]
call fcn.14002fde0
mov r14d, eax
mov rsi, qword [rbp - 0x78]
mov rdi, r15
mov qword [rsp + 0x60], r15
test r14d, r14d
js 0x14008853f
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.14002fde0
mov r14d, eax
mov rdi, qword [rsp + 0x60]
mov rbx, r15
mov qword [rsp + 0x50], rbx
test r14d, r14d
js 0x1400885a2
lea rdx, str.Search.Gatherer
lea rcx, [rsp + 0x50]
call fcn.14002fde0
mov r14d, eax
test eax, eax
js 0x14008859d
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
movabs r10, 0x95709ef530db7970
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov rbx, qword [rsp + 0x50]
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rax, qword [rax + 0x50]
call qword [case.0x140001f80.0]
mov r14d, eax
jmp 0x1400885a2
mov rbx, qword [rsp + 0x50]
mov dword [rsp + 0x30], r15d
test r14d, r14d
js 0x140088696
lea rsi, str.Search.TripoliIndexer
mov r13d, r15d
cmp r13d, 2
jae 0x14008868d
mov qword [rsp + 0x58], r15
mov eax, r13d
shl rax, 4
mov qword [rsp + 0x70], rax
mov rdx, qword [rax + rsi]
lea rcx, [rsp + 0x58]
call fcn.14002fde0
mov r14d, eax
mov qword [rsp + 0x30], r15
test eax, eax
js 0x140088657
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
movabs r10, 0xf914bf5c385cbb70
lea rdx, [rsp + 0x30]
mov rax, qword [rax + 0x90]
call qword [case.0x140001f80.0]
mov r14d, eax
test eax, eax
js 0x140088657
mov qword [rsp + 0x68], r15
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
movabs r10, 0xf7fdb61858dc9970
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rax + 0x50]
call qword [case.0x140001f80.0]
mov r14d, eax
lea rcx, [rsp + 0x68]
call fcn.14000376c
test r14d, r14d
jns 0x140088665
mov rax, qword [rsp + 0x70]
cmp dword [rax + rsi + 8], r15d
cmovne r14d, r15d
lea rcx, [rsp + 0x30]
call fcn.14000376c
nop
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
inc r13d
test r14d, r14d
jns 0x1400885ba
mov rsi, qword [rbp - 0x78]
mov r13, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
nop
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
movzx edi, word [rsp + 0x38]
mov rsi, qword [rbp - 0x80]
test r14d, r14d
js 0x14008872c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x1400886e7
call fcn.1400a81dc
mov rcx, qword [rsp + 0x40]
mov qword [rbp - 0x78], r15
mov rax, qword [rcx]
movabs r10, 0xdee01e7974d59970
lea r8, [rbp - 0x78]
lea rdx, [0x1400b3770]
mov rax, qword [rax]
call qword [case.0x140001f80.0]
mov r14d, eax
test eax, eax
js 0x140088723
mov rdx, qword [r13 + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.1400a38b0
mov r14d, eax
lea rcx, [rbp - 0x78]
call fcn.14000376c
mov rbx, r15
mov qword [rsp + 0x30], rbx
test r14d, r14d
js 0x14008877d
lea r9, [rbp + 0x1a0]
lea r8, [rsp + 0x30]
movzx edx, di
mov rcx, r13
call fcn.1400895cc
mov r14d, eax
mov rbx, qword [rsp + 0x30]
test eax, eax
js 0x14008877d
cmp word [r12], di
sete dl
mov rcx, rbx
call fcn.1400a363c
mov r14d, eax
test eax, eax
js 0x14008877d
mov qword [rsp + 0x30], r15
mov qword [rsi], rbx
jmp 0x1400887ca
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140088790
mov rdx, qword [r13 + 0x20]
call fcn.1400a3bd4
test rbx, rbx
je 0x1400887ca
cmp qword [r13 + 0x60], r15
jbe 0x1400887ca
mov rdi, r15
mov rdx, rdi
lea rcx, [r13 + 0x58]
call fcn.1400877b0
cmp qword [rax], rbx
je 0x1400887bd
inc r15d
mov edi, r15d
cmp rdi, qword [r13 + 0x60]
jb 0x14008879e
jmp 0x1400887ca
mov rdx, rdi
lea rcx, [r13 + 0x58]
call fcn.1400898b0
nop
lea rcx, [rsp + 0x30]
call fcn.14000376c
nop
lea rcx, [rsp + 0x40]
call fcn.14000376c
nop
lea rcx, [rsp + 0x48]
call fcn.14000376c
mov eax, r14d
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140024990
mov rbx, qword [rsp + 0x518]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret