Function at 0x14002a630
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x258
mov rax, qword [0x14016b400]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r13d, r8d
mov r14, rdx
mov rbx, rcx
nop dword [rax]
xor edi, edi
lea rcx, str.GetVolumeNameFromDeviceName
mov ebp, edi
lea r12d, [rdi + 1]
call fcn.140029428
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
call sub.msvcrt.dll_memset
test rbx, rbx
je 0x14005909a
test r14, r14
je 0x1400590f9
mov qword [rsp + 0x250], r15
lea r8, str._GLOBALROOT_s
mov r15d, 0x105
mov word [r14], di
mov edx, r15d
lea rcx, [rsp + 0x30]
mov r9, rbx
call fcn.140027130
test eax, eax
js 0x140059124
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x14002a6d2
cmp word [rsp + rax*2 + 0x2e], 0x5c
mov qword [rsp + 0x2a8], rsi
je 0x14002a787
mov rcx, r15
lea rax, [rsp + 0x30]
nop dword [rax]
cmp word [rax], di
je 0x14002a713
add rax, 2
sub rcx, r12
jne 0x14002a700
jmp 0x1400591a0
test rcx, rcx
je 0x1400591a0
mov rax, r15
lea rdx, [rsp + 0x30]
sub rax, rcx
lea rsi, [0x1400fd76c]
mov r10d, edi
mov edi, 0x7ffffffe
lea rdx, [rdx + rax*2]
test rcx, rcx
je 0x14002a766
mov r8, rsi
mov r9d, edi
sub r8, rdx
test r9, r9
je 0x14002a772
movzx eax, word [r8 + rdx]
test ax, ax
je 0x14002a772
mov word [rdx], ax
dec r9
add rdx, 2
sub rcx, r12
jne 0x14002a748
sub rdx, 2
mov r10d, 0x8007007a
jmp 0x14002a777
test rcx, rcx
je 0x14002a766
xor eax, eax
mov word [rdx], ax
test r10d, r10d
js 0x140059199
xor edi, edi
mov r8d, r13d
lea rcx, [rsp + 0x30]
mov rdx, r14
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x140059278
mov rsi, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x250]
lea rcx, str.GetVolumeNameFromDeviceName
call fcn.140027f60
mov ecx, ebp
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, r12d
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400321c0
add rsp, 0x258
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
mov r12d, edi
mov ebp, 0x57
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14002a7b0
test byte [rcx + 0x1c], 8
je 0x14002a7b0
lea edx, [rbp - 0x41]
lea rax, str.pwszDeviceName
jmp 0x1400590db
mov edx, 0x17
lea rax, str.pwszVolumeName
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401406f0]
mov r9d, ebp
mov qword [rsp + 0x20], rax
call fcn.1400e4514
nop
jmp 0x14002a7b0
mov r12d, edi
mov ebp, 0x57
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14002a7b0
test byte [rcx + 0x1c], 8
je 0x14002a7b0
jmp 0x1400590cf
mov ecx, eax
mov r12d, edi
call fcn.1400f2b1c
mov ebp, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14002a7a8
test byte [rcx + 0x1c], 8
je 0x14002a7a8
mov r9, rbx
lea r8, str._GLOBALROOT_s
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140027130
lea rcx, str.DevicePathToWin32Path___WCHAR_pwszDeviceName__ARRAY_COUNT_PARAM_wszPath__
mov edx, 0x19
mov qword [rsp + 0x20], rcx
lea r8, [0x1401406f0]
mov rcx, qword [section..data]
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.1400e4514
nop
jmp 0x14002a7a8
mov ebx, 0x80070057
jmp 0x1400591b4
mov ebx, 0x80070057
lea rsi, [0x1400fd76c]
mov r10d, ebx
mov edi, 0x7ffffffe
xor r14d, r14d
mov ecx, r10d
mov r12d, r14d
call fcn.1400f2b1c
mov ebp, eax
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x14002a7a0
test byte [r10 + 0x1c], 8
je 0x14002a7a0
mov rcx, r15
lea rax, [rsp + 0x30]
cmp word [rax], r12w
je 0x140059200
add rax, 2
sub rcx, 1
jne 0x1400591ee
jmp 0x14005924e
test rcx, rcx
je 0x14005924e
sub r15, rcx
lea rax, [rsp + 0x30]
mov ebx, r14d
lea rax, [rax + r15*2]
test rcx, rcx
je 0x140059241
sub rsi, rax
test rdi, rdi
je 0x14005923c
movzx edx, word [rsi + rax]
test dx, dx
je 0x14005923c
mov word [rax], dx
dec rdi
add rax, 2
sub rcx, 1
jne 0x14005921c
jmp 0x140059241
test rcx, rcx
jne 0x14005924a
sub rax, 2
mov ebx, 0x8007007a
mov word [rax], r14w
mov rcx, qword [r10 + 0x10]
lea rax, str.::StringCchCat__wszPath__ARRAYSIZE_wszPath___L____
mov edx, 0x1a
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [0x1401406f0]
call fcn.1400e4514
nop
jmp 0x14002a7a0
mov r12d, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebp, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14002a7a0
test byte [rcx + 0x1c], 8
je 0x14002a7a0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [section..data]
lea r8, [0x1401406f0]
mov r9d, eax
mov edx, 0x1b
lea rax, str.::GetVolumeNameForVolumeMountPoint__wszPath__pwszVolumeName__cchVolumeName__
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.1400e4514
nop
jmp 0x14002a7a0