Function at 0x140009210
Capabilities:
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1f8
xor eax, eax
cmp qword [0x1400ce8e8], 0
mov r12d, ecx
mov ecx, 0x40
mov rbp, rdx
mov rsi, r8
lea rdi, [rsp + 0xf0]
mov dword [rsp + 0x61], 0x5c2e5c5c
rep stosd dword [rdi], eax
mov dword [rsp + 0x64], 0x3a235c
jne 0x140009366
xor r8d, r8d
xor r9d, r9d
mov r13, qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
xor edx, edx
mov dword [rsp + 0x28], r8d
mov ecx, 0xfde9
lea r8, [0x140089084]
mov qword [rsp + 0x20], r9
or r9d, 0xffffffff
call r13
mov ebx, eax
cmp eax, 1
jg 0x140009292
xor edi, edi
jmp 0x1400092c9
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_calloc
mov rdi, rax
test rax, rax
je 0x14000928e
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
lea r8, [0x140089084]
call r13
cmp ebx, eax
je 0x1400092cd
xor ebx, ebx
jmp 0x140009347
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x140009347
mov r13, qword [0x1400b4410]
cmp word [r13], 0x3f
jbe 0x1400092fb
lea rcx, [0x14008908a]
call fcn.1400380b9
jmp 0x1400092c9
mov r8d, 0x800
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x14000932e
movzx eax, word [r13]
lea edx, [rax + 1]
mov word [r13], dx
mov rdx, qword [0x1400b4400]
mov qword [rdx + rax*8], rbx
jmp 0x140009347
call fcn.140038579
mov rdx, rdi
lea rcx, [0x1400890b3]
mov r8, rax
call fcn.1400380b9
jmp 0x1400092c9
mov rcx, rdi
call sub.msvcrt.dll_free
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1400ce8e8], rax
test rbp, rbp
je 0x14000936f
mov byte [rbp], 0
test rsi, rsi
je 0x140009378
xor ecx, ecx
mov dword [rsi], ecx
test r12d, r12d
js 0x1400093d9
lea eax, [r12 - 0x80]
mov dword [rsp + 0x4c], eax
cmp eax, 0x40
jbe 0x1400093a5
mov r8d, 0x45a
lea rdx, str.drive.c
lea rcx, str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
call qword [sym.imp.msvcrt.dll__wassert]
lea rbx, [rsp + 0x87]
mov ecx, 0x69
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
mov dword [rsp + 0x5c], eax
mov edx, eax
test eax, eax
jne 0x1400093e2
call fcn.140038579
lea rcx, str.GetLogicalDriveStrings_failed:__s
mov rdx, rax
call fcn.1400380b9
xor edi, edi
xor ebx, ebx
jmp 0x140009619
cmp eax, 0x69
jbe 0x1400093fb
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
call fcn.1400380b9
jmp 0x1400093d9
xor r14d, r14d
xor edi, edi
movsx r13d, byte [rbx]
test r13b, r13b
je 0x140009573
mov ecx, r13d
call qword [sym.imp.msvcrt.dll_isalpha]
test eax, eax
je 0x140009561
mov ecx, r13d
call qword [sym.imp.msvcrt.dll_toupper]
mov rcx, rbx
mov byte [rbx], al
call qword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
mov r13d, eax
lea eax, [rax - 2]
cmp eax, 1
ja 0x140009561
movsx ecx, byte [rbx]
call qword [sym.imp.msvcrt.dll_toupper]
lea r8, str.._c:
mov edx, 7
mov r9d, eax
lea rax, [rsp + 0x61]
mov rcx, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.msvcrt.dll__snprintf]
xor edx, edx
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rdx
mov r8d, 3
mov edx, 0x80000000
mov dword [rsp + 0x38], 0xbb8
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov byte [rsp + 0x67], 0
call fcn.140038f13
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1400094de
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x102
jne 0x140009561
movsx ecx, byte [rbx]
call qword [sym.imp.msvcrt.dll_toupper]
lea rcx, str.Warning:_Time_out_while_trying_to_query_drive__c
mov edx, eax
call fcn.1400380b9
jmp 0x140009561
mov rax, qword [0x1400ce8e8]
test rax, rax
jne 0x140009516
mov rdx, qword [rsp + 0x40]
mov rcx, r15
call fcn.1400090f4
mov edx, eax
lea rax, [r15 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009540
mov dword [rsp + 0x40], edx
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [rsp + 0x40]
jmp 0x140009540
mov dword [rsp + 0x20], 4
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x68]
mov rcx, r15
mov r9d, 8
call rax
test eax, eax
jne 0x1400094ea
test byte [rsp + 0x6c], 4
je 0x1400094ea
jmp 0x140009561
cmp dword [rsp + 0x4c], edx
jne 0x140009561
test rbp, rbp
je 0x140009556
mov dl, byte [rbx]
movsxd rax, edi
inc edi
mov byte [rbp + rax], dl
test rsi, rsi
je 0x14000955e
mov dword [rsi], r13d
inc r14d
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rbx, [rbx + rax + 1]
jmp 0x140009400
test r14d, r14d
jne 0x140009614
test rsi, rsi
je 0x140009614
mov ecx, r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.140007c6c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x700a0
mov r12, rax
xor eax, eax
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x5c]
mov rcx, r12
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov ebx, eax
lea rax, [r12 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400095e8
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test ebx, ebx
je 0x140009619
cmp dword [rsp + 0x5c], 0
je 0x140009619
mov eax, dword [rsp + 0xf8]
cmp eax, 0xc
jne 0x140009607
mov dword [rsi], 3
jmp 0x140009619
cmp eax, 0xb
jne 0x140009619
mov dword [rsi], 2
jmp 0x140009619
mov ebx, 1
test rbp, rbp
je 0x140009626
movsxd rdi, edi
mov byte [rbp + rdi], 0
mov eax, ebx
add rsp, 0x1f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret