Function at 0x1400047d0
Capabilities:
Get common file path
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov rsi, rcx
test rcx, rcx
je 0x1400047fe
cmp word [rcx], 0x5c
jne 0x1400047fe
cmp word [rcx + 2], 0x5c
jne 0x1400047fe
xor edi, edi
xor eax, eax
mov dword [rdx], edi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], r13
xor edi, edi
mov qword [rsp + 0x58], r14
lea r13, [0x14001f740]
lea r14, [0x14001e440]
cmp dword [0x14001e51c], edi
jne 0x14000499e
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea r8d, [rdi + 0x6c]
xor edx, edx
mov rcx, r13
mov dword [0x14001e51c], eax
call fcn.14000aee0
mov rax, r14
lea ecx, [rdi + 3]
nop
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
add rax, 0x40
dec rcx
mov qword [rax - 0x28], rdi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x10], rdi
mov qword [rax - 8], rdi
jne 0x140004850
mov qword [rax], rdi
mov qword [rax + 8], rdi
xor edx, edx
mov qword [rax + 0x10], rdi
mov qword [0x14001e510], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r12d, eax
nop word [rax + rax]
mov rcx, qword [0x14001e510]
test rcx, rcx
je 0x1400048b2
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [r12 + r12]
mov ecx, 0x40
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, r12d
mov rdx, rax
mov qword [0x14001e510], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r12d, eax
cmp eax, ebx
ja 0x1400048a0
mov rdx, qword [0x14001e510]
mov r12, qword [rsp + 0x48]
dec eax
mov dword [0x14001e518], eax
mov rbx, rdx
test rdx, rdx
jne 0x14000491a
lea rdx, [0x14001c9a8]
lea rcx, [0x14001c9c8]
mov r8d, 0x241
call fcn.14000a0c4
mov rdx, qword [0x14001e510]
cmp word [rbx], 0x5c
jne 0x140004936
cmp word [rbx + 2], 0x5c
jne 0x140004936
mov r8d, 0x1a
mov dword [0x14001c8dc], r8d
jmp 0x14000498a
test rdx, rdx
jne 0x140004941
or r8d, 0xffffffff
jmp 0x140004983
movzx ecx, word [rdx]
test cx, cx
je 0x14000497c
cmp word [rdx + 2], 0x3a
jne 0x14000497c
call fcn.14000aec0
lea ecx, [rax - 0x61]
cmp cx, 0x19
ja 0x14000496f
mov rdx, qword [0x14001e510]
movzx r8d, ax
sub r8d, 0x61
jmp 0x140004983
mov rdx, qword [0x14001e510]
or r8d, 0xffffffff
jmp 0x140004983
mov r8d, dword [0x14001c8dc]
mov dword [0x14001c8dc], r8d
mov eax, dword [0x14001e518]
mov ecx, r8d
mov dword [r13 + rcx*4], eax
mov qword [r14 + rcx*8], rdx
jmp 0x1400049ac
mov rdx, qword [0x14001e510]
mov r8d, dword [0x14001c8dc]
test rsi, rsi
jne 0x1400049bf
mov ecx, dword [0x14001e518]
mov rax, rdx
mov dword [rbp], ecx
jmp 0x140004a3e
movzx ecx, word [rsi]
test cx, cx
je 0x1400049e4
cmp word [rsi + 2], 0x3a
jne 0x1400049e4
call fcn.14000aec0
lea ecx, [rax - 0x61]
cmp cx, 0x19
ja 0x140004a39
movzx r8d, ax
sub r8d, 0x61
cmp r8d, 0xffffffff
je 0x140004a39
cmp r8d, 0x1a
je 0x140004a04
lea eax, [r8 + 1]
test eax, eax
je 0x140004a04
mov eax, dword [0x14001e51c]
bt eax, r8d
jae 0x140004a39
mov ebx, r8d
mov rdx, qword [r14 + rbx*8]
test rdx, rdx
jne 0x140004a2c
mov rdx, rbp
mov ecx, r8d
call fcn.1400046a0
mov qword [r14 + rbx*8], rax
mov ecx, dword [rbp]
mov rdx, rax
mov dword [r13 + rbx*4], ecx
jmp 0x140004a3e
mov eax, dword [r13 + rbx*4]
mov dword [rbp], eax
mov rax, rdx
jmp 0x140004a3e
mov dword [rbp], edi
xor eax, eax
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret