Function at 0x140071b60
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x370
mov rax, qword [0x1400d1548]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rdx
xor edi, edi
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x48]
call fcn.14009bf10
mov ebx, eax
test eax, eax
js 0x140071efd
lea rdx, [0x1400d2518]
lea rcx, [rsp + 0x38]
call fcn.14001a960
nop
cmp byte [rsi + 0x38], dil
je 0x140071e1d
xor edx, edx
mov r8d, 0xd0
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x30]
call fcn.14006c9bc
mov ebx, eax
test eax, eax
js 0x140071cbd
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetLogicalDrives]
nop dword [rax + rax]
mov r12d, eax
mov esi, edi
cmp esi, 0x1a
jae 0x140071ce4
bt r12d, esi
jae 0x140071cb3
lea r14d, [rsi + 0x41]
movabs rax, 0x5c003a0020
mov qword [rsp + 0x140], rax
mov word [rsp + 0x140], r14w
lea rcx, [rsp + 0x140]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 3
jne 0x140071cb3
lea r9, [rsp + 0x150]
lea r8, [0x1400aa4b0]
movzx edx, word [rsp + 0x30]
movzx ecx, r14w
call fcn.14006ca5c
mov ebx, eax
test eax, eax
js 0x140071cb3
mov rdx, r15
lea rcx, [rsp + 0x150]
call fcn.14006c5bc
mov ebx, eax
cmp eax, 1
jne 0x140071c8e
mov ebx, edi
jmp 0x140071cb3
test eax, eax
js 0x140071cb3
mov eax, esi
lea rdx, [rsp + 0x70]
lea rdx, [rdx + rax*8]
lea rcx, [rsp + 0x150]
call qword [sym.imp.SHCORE.dll_SHStrDupW]
nop dword [rax + rax]
mov ebx, eax
inc esi
test ebx, ebx
jns 0x140071c05
lea rsi, [rsp + 0x70]
mov r14d, 0x1a
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rsi], rdi
lea rsi, [rsi + 8]
sub r14, 1
jne 0x140071cc8
mov dword [rsp + 0x30], ebx
test ebx, ebx
js 0x140071eee
mov r14d, edi
mov dword [rsp + 0x40], edi
lea r12, str.SOFTWAREMicrosoftWindows_SearchCrawlScopeManager_
cmp r14d, 0x1a
jae 0x140071dfd
mov esi, edi
mov r13d, r14d
mov rdx, qword [rsp + r13*8 + 0x70]
test rdx, rdx
je 0x140071de7
mov qword [rsp + 0x140], rdi
lea r8, [rsp + 0x140]
mov rcx, qword [rsp + 0x48]
call fcn.14009bdd8
mov esi, eax
cmp eax, 1
jne 0x140071d46
mov esi, 0x80004005
jmp 0x140071dda
test eax, eax
js 0x140071dda
mov rdx, r15
mov rcx, qword [rsp + 0x140]
call fcn.14009bb58
mov esi, eax
test eax, eax
js 0x140071dda
mov r8d, 0x34
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140016a94
mov rdx, qword [rsp + r13*8 + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140023e08
lea rdx, [0x1400aa520]
lea rcx, [rsp + 0x38]
call fcn.140023e08
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.140023e08
mov rdx, qword [rsp + 0x38]
call fcn.14006c4a8
mov esi, eax
test eax, eax
jle 0x140071dbd
movzx esi, ax
or esi, 0x80070000
jmp 0x140071dda
lea rcx, [rsp + 0x140]
call fcn.140003bbc
test ebx, ebx
cmovns ebx, esi
mov dword [rsp + 0x30], ebx
inc r14d
mov dword [rsp + 0x40], r14d
jmp 0x140071cfe
cmp edi, 0x1a
jae 0x140071eee
mov ecx, edi
mov rcx, qword [rsp + rcx*8 + 0x70]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
inc edi
jmp 0x140071dfd
mov qword [rsp + 0x140], rdi
lea r8, [rsp + 0x140]
lea rdx, [0x1400aa4b0]
mov rcx, qword [rsp + 0x48]
call fcn.14009bdd8
mov ebx, eax
cmp eax, 1
jne 0x140071e4f
mov ebx, 0x80004005
jmp 0x140071ee0
test eax, eax
js 0x140071ee0
mov rdx, r15
mov rcx, qword [rsp + 0x140]
call fcn.14009bb58
mov ebx, eax
test eax, eax
js 0x140071ee0
lea r12, str.SOFTWAREMicrosoftWindows_SearchCrawlScopeManager_
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], di
jne 0x140071e78
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140016a94
lea rdx, [0x1400aa4b0]
lea rcx, [rsp + 0x38]
call fcn.140023e08
lea rdx, [0x1400aa520]
lea rcx, [rsp + 0x38]
call fcn.140023e08
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.140023e08
mov rdx, qword [rsp + 0x38]
call fcn.14006c4a8
mov ebx, eax
test eax, eax
jle 0x140071eda
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140071ee0
lea rcx, [rsp + 0x140]
call fcn.140003bbc
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.1400182a0
nop
lea rcx, [rsp + 0x48]
call fcn.140003bbc
mov eax, ebx
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140036e80
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret