Function at 0x14015e424
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rdx
mov r14, rcx
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
mov edx, 4
cmp rcx, rax
je 0x14015e488
test byte [rcx + 0x1c], 1
je 0x14015e488
cmp byte [rcx + 0x19], dl
jb 0x14015e488
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400162a0]
mov edx, 0xa
call fcn.14001dd24
xor ebx, ebx
lea rcx, [rbp + 0xb]
xor edx, edx
and dword [rbp + 7], ebx
lea r8d, [rbx + 0x1c]
call sub.msvcrt.dll_memset
and dword [rbp - 0x19], ebx
xor eax, eax
and qword [rsp + 0x30], rax
and dword [rsp + 0x28], eax
and dword [rsi], eax
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, r14
mov dword [rsp + 0x20], 3
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x14015e53c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x14017d3a8]
lea r15, [0x14017d3a8]
lea edi, [rbx + 2]
cmp rcx, r15
je 0x14015e529
test byte [rcx + 0x1c], 1
je 0x14015e529
cmp byte [rcx + 0x19], dil
jb 0x14015e529
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xb]
lea r8, [0x1400162a0]
mov r9, r14
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x14015e7ba
xor eax, eax
lea r8, [rbp - 0x29]
mov r9d, reloc.ADVAPI32.dll_GetTraceLoggerHandle
and qword [rsp + 0x38], rax
mov qword [rbp - 0x29], rax
and dword [rbp - 0x25], eax
mov dword [rbp - 0x21], eax
lea rax, [rbp - 0x39]
mov edx, 0x2d1400
mov qword [rsp + 0x30], rax
lea rax, [rbp + 7]
mov rcx, r15
mov dword [rsp + 0x28], 0x20
mov dword [rbp - 0x29], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14015e5ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
mov edi, 2
cmp rcx, rax
je 0x14015e701
test byte [rcx + 0x1c], 1
je 0x14015e701
cmp byte [rcx + 0x19], dil
jb 0x14015e701
lea edx, [rdi + 0xa]
jmp 0x14015e6ea
cmp dword [rbp - 0x39], 0x20
je 0x14015e5e8
lea r8, [0x140016230]
lea rcx, [0x140016250]
mov edx, reloc.ADVAPI32.dll_EventWrite
call fcn.1400a8be8
xor eax, eax
xor r9d, r9d
xor r8d, r8d
and qword [rsp + 0x38], rax
lea edi, [rax + 8]
mov qword [rbp - 0x31], rax
lea rax, [rbp - 0x39]
mov edx, 0x2d0c14
mov rcx, r15
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x31]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x31], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14015e667
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
mov edi, 2
cmp rcx, rax
je 0x14015e701
test byte [rcx + 0x1c], 1
je 0x14015e701
cmp byte [rcx + 0x19], dil
jb 0x14015e701
lea edx, [rdi + 0xb]
jmp 0x14015e6ea
cmp dword [rbp - 0x39], edi
je 0x14015e684
lea r8, [0x140016280]
lea rcx, [0x140016250]
mov edx, DeleteCriticalSection
call fcn.1400a8be8
and qword [rsp + 0x38], rbx
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x19]
xor r8d, r8d
mov edx, 0x70214
mov rcx, r15
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14015e714
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
mov edi, 2
cmp rcx, rax
je 0x14015e701
test byte [rcx + 0x1c], 1
je 0x14015e701
cmp byte [rcx + 0x19], dil
jb 0x14015e701
lea edx, [rdi + 0xc]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400162a0]
mov r9, r14
mov dword [rsp + 0x20], esi
call fcn.14001ecbc
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x14015e7a3
mov al, byte [rbp - 0x11]
mov r8b, byte [rbp - 0x2b]
xor ecx, ecx
mov edi, 2
and al, dil
cmp al, dil
lea edx, [rdi + 0x3e]
lea r9d, [rdi + 2]
cmove ecx, edx
mov dl, byte [rbp + 0x1f]
xor eax, eax
cmp dl, 7
cmove eax, edi
or ecx, eax
xor eax, eax
cmp dl, r9b
cmove eax, r9d
or ecx, eax
xor eax, eax
test r8b, r8b
setne al
or ecx, eax
or dword [rsi], ecx
mov r10d, dword [rsi]
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14015e7a3
test byte [rcx + 0x1c], 1
je 0x14015e7a3
cmp byte [rcx + 0x19], r9b
jb 0x14015e7a3
mov rcx, qword [rcx + 0x10]
xor eax, eax
cmp dl, r9b
sete al
xor r9d, r9d
cmp dl, 7
mov dword [rsp + 0x28], r10d
movzx r8d, r8b
sete r9b
mov rdx, r14
mov dword [rsp + 0x20], eax
call fcn.14015e340
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14017d3a8]
lea r15, [0x14017d3a8]
test ebx, ebx
jns 0x14015e7f2
cmp rcx, r15
je 0x14015e818
test byte [rcx + 0x1c], 1
je 0x14015e7f2
cmp byte [rcx + 0x19], dil
jb 0x14015e7f2
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400162a0]
mov edx, CoRevokeClassObject
mov r9, r14
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x14015e818
test byte [rcx + 0x1c], 1
je 0x14015e818
cmp byte [rcx + 0x19], 4
jb 0x14015e818
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400162a0]
mov edx, reloc.ole32.dll_CoRevokeClassObject
call fcn.14001dd24
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140168920
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret