Function at 0x1400a0b00
Capabilities:
Get disk information

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r14d, r14d
mov qword [rsp + 0x48], rdx
cmp dword [0x140228bf8], r14d
mov rdi, r8
mov rbx, rcx
mov esi, r14d
lea r12d, [r14 + 1]
jne 0x1400a0b4f
call fcn.1400a0930
test eax, eax
je 0x1400a0b79
mov r15d, 2
test rbx, rbx
je 0x1400a0cc5
cmp byte [rbx], sil
je 0x1400a0cc5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
cmp eax, 0x104
jbe 0x1400a0b80
xor eax, eax
jmp 0x1400a0fa9
lea r8d, [rsi + 1]
mov edx, r14d
cmp r8d, 0x10
jb 0x1400a0c1c
lea r9, [rsp + 0x60]
add r9, rsi
lea rcx, [rsi + rbx]
lea rax, [rsp + 0x60]
cmp rax, rcx
ja 0x1400a0bac
cmp r9, rbx
jae 0x1400a0c1c
mov eax, r8d
movaps xmmword [rsp + 0x180], xmm6
and eax, 0xf
mov ecx, esi
sub ecx, eax
movdqa xmm5, xmmword [0x1401ffc10]
movdqa xmm6, xmmword [0x1401ffc20]
nop
movdqu xmm3, xmmword [rdx + rbx]
movdqu xmm0, xmmword [rsp + rdx + 0x60]
movdqa xmm4, xmm3
pcmpeqb xmm4, xmm5
movdqa xmm2, xmm4
movdqa xmm1, xmm4
pandn xmm2, xmm0
pand xmm1, xmm6
por xmm2, xmm1
pand xmm2, xmm4
pandn xmm4, xmm3
por xmm2, xmm4
movdqu xmmword [rsp + rdx + 0x60], xmm2
add edx, 0x10
cmp edx, ecx
jbe 0x1400a0bd0
movaps xmm6, xmmword [rsp + 0x180]
cmp edx, esi
ja 0x1400a0c38
mov r9d, 0x5c
mov ecx, edx
movzx eax, byte [rcx + rbx]
cmp al, 0x2f
cmove eax, r9d
inc edx
mov byte [rsp + rcx + 0x60], al
cmp edx, esi
jbe 0x1400a0c22
cmp byte [rsp + 0x60], 0x5c
movzx eax, byte [rsp + 0x61]
jne 0x1400a0cab
cmp al, 0x5c
jne 0x1400a0cab
mov ecx, r14d
mov eax, r15d
cmp esi, r15d
jbe 0x1400a0cc5
lea rdx, [rsp + 0x62]
cmp byte [rdx], 0x5c
jne 0x1400a0c64
inc ecx
cmp ecx, r15d
je 0x1400a0c95
inc eax
inc rdx
cmp eax, esi
jb 0x1400a0c58
cmp ecx, r12d
jne 0x1400a0cc5
cmp byte [rsp + rsi + 0x60], 0x5c
je 0x1400a0cc5
mov byte [rsp + rsi + 0x60], 0x5c
cmp r8d, 0x105
jae 0x1400a0fc7
mov byte [rsp + r8 + 0x60], r14b
mov esi, r8d
jmp 0x1400a0cc5
inc eax
cmp eax, 0x105
jae 0x1400a0fc7
mov byte [rsp + rax + 0x60], r14b
mov esi, eax
jmp 0x1400a0cc5
cmp al, 0x3a
jne 0x1400a0cbd
mov word [rsp + 0x62], 0x5c
mov esi, 3
jmp 0x1400a0cc5
mov byte [rsp + 0x60], r14b
mov esi, r14d
lea rcx, [0x1402b8760]
mov qword [rsp + 0x1e8], r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x140285d80], r14d
je 0x1400a0cfd
lea rdx, [rsp + 0x60]
lea rcx, [0x140285d98]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400a0f0b
lea rcx, [0x1402b8760]
mov r13d, r14d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [rsp + 0x60], r14b
lea rax, [rsp + 0x50]
mov dword [rsp + 0x38], r14d
lea rcx, [rsp + 0x60]
cmove rcx, r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [rsp + 0x40], eax
mov r12d, eax
test eax, eax
je 0x1400a0ebd
test byte [rsp + 0x50], 8
je 0x1400a0ebd
cmp dword [rdi + 4], r14d
je 0x1400a0ebd
cmp byte [rsp + 0x60], r13b
lea rcx, [rsp + 0x60]
cmove rcx, r14
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x1400a0ebd
mov rbx, qword [rsp + 0x48]
lea r8d, [rax + 1]
mov qword [rsp + 0x30], r14
lea r13d, [rax - 3]
mov rcx, rbx
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x10e0000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400a0e7a
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], r14d
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r13 + 0xe]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400a0e5d
mov ebx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400a0e5d
mov r9d, dword [rsp + 0x48]
lea rax, [rsp + 0x48]
mov r8, rbx
mov qword [rsp + 0x20], rax
lea edx, [r13 + 0xe]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
test eax, eax
je 0x1400a0e49
mov r8, rbx
lea edx, [r13 + 0xe]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
cmovne r14d, r15d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1402b8760]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r12d, dword [rsp + 0x40]
jmp 0x1400a0ed3
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov edx, 0x1000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1400a0eb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, 4
jmp 0x1400a0e66
mov r12d, dword [rsp + 0x40]
lea rcx, [0x1402b8760]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test r12d, r12d
je 0x1400a0f87
lea r8d, [rsi + 1]
lea rdx, [rsp + 0x60]
lea rcx, [0x140285d98]
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [rsp + 0x50]
mov dword [0x140285d88], eax
mov dword [0x140285d8c], r13d
mov dword [0x140285d90], r14d
mov dword [0x140285d80], 1
mov eax, dword [rdi + 4]
mov dword [0x140285d84], eax
mov eax, dword [rdi + 0x14]
mov dword [0x140285d94], eax
lea rax, [0x140285d80]
lea rdi, [rdi + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rdi - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rdi - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdi - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdi - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdi - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdi - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdi - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdi - 0x10], xmm1
sub r15, 1
jne 0x1400a0f24
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
jmp 0x1400a0f91
mov dword [0x140285d80], 0
lea rcx, [0x1402b8760]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r13, qword [rsp + 0x1e8]
mov eax, r12d
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x190
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140147c98
int3