Function at 0x1400ec314
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x14015d3e0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r13d, r8d
mov r14, rdx
mov rbp, rcx
xor esi, esi
lea rcx, str.GetVolumeNameFromDeviceName
mov ebx, esi
lea edi, [rsi + 1]
call fcn.1400ed218
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
call sub.msvcrt.dll_memset
test rbp, rbp
jne 0x1400ec3a9
lea r9d, [rsi + 0x57]
mov edi, esi
mov ebx, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ec5a2
test byte [rcx + 0x1c], 8
je 0x1400ec5a2
lea edx, [rsi + 0x16]
lea rax, str.pwszDeviceName
jmp 0x1400ec58d
test r14, r14
jne 0x1400ec3e8
lea r9d, [r14 + 0x57]
mov edi, esi
mov ebx, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ec5a2
test byte [rcx + 0x1c], 8
je 0x1400ec5a2
lea edx, [r14 + 0x17]
lea rax, str.pwszVolumeName
jmp 0x1400ec58d
mov word [r14], si
lea r8, str._GLOBALROOT_s
mov esi, 0x105
lea rcx, [rsp + 0x30]
mov edx, esi
mov r9, rbp
call fcn.1400053e0
xor r11d, r11d
test eax, eax
jns 0x1400ec481
mov ecx, eax
mov edi, r11d
call fcn.1400ed2a0
mov ebx, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ec5a2
test byte [rcx + 0x1c], 8
je 0x1400ec5a2
mov r9, rbp
lea r8, str._GLOBALROOT_s
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.1400053e0
lea rcx, str.DevicePathToWin32Path___WCHAR_pwszDeviceName__ARRAY_COUNT_PARAM_wszPath__
mov edx, 0x19
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov rcx, qword [section..data]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14013f150]
call fcn.1400d9dd4
jmp 0x1400ec5a2
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r11w
jne 0x1400ec48a
cmp word [rsp + rax*2 + 0x2e], 0x5c
je 0x1400ec527
mov rcx, rsi
lea rax, [rsp + 0x30]
cmp word [rax], r11w
je 0x1400ec4b7
add rax, 2
sub rcx, rdi
jne 0x1400ec4a8
lea r12, [0x1401035b0]
mov ebp, 0x80070057
mov r15d, 0x7ffffffe
test rcx, rcx
je 0x1400ec5ea
mov rax, rsi
lea rdx, [rsp + 0x30]
sub rax, rcx
mov r10, r12
mov r8d, r15d
lea rdx, [rdx + rax*2]
mov eax, r11d
sub r10, rdx
test r8, r8
je 0x1400ec50d
movzx r9d, word [r10 + rdx]
test r9w, r9w
je 0x1400ec50d
mov word [rdx], r9w
dec r8
add rdx, 2
sub rcx, rdi
jne 0x1400ec4ed
test rcx, rcx
jne 0x1400ec51b
add rdx, 0xfffffffffffffffe
mov eax, 0x8007007a
mov word [rdx], r11w
test eax, eax
js 0x1400ec5ec
mov r8d, r13d
lea rcx, [rsp + 0x30]
mov rdx, r14
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
xor esi, esi
test eax, eax
jne 0x1400ec5a2
mov edi, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ec5a2
test byte [rcx + 0x1c], 8
je 0x1400ec5a2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [section..data]
lea edx, [rsi + 0x1b]
mov r9d, eax
lea rax, str.::GetVolumeNameForVolumeMountPoint__wszPath__pwszVolumeName__cchVolumeName__
mov rcx, qword [rcx + 0x10]
lea r8, [0x14013f150]
mov qword [rsp + 0x20], rax
call fcn.1400d9dd4
lea rcx, str.GetVolumeNameFromDeviceName
call fcn.1400ed25c
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400164a0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebp
mov ecx, eax
mov edi, r11d
call fcn.1400ed2a0
mov ebx, eax
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x1400ec5a2
test byte [r10 + 0x1c], 8
je 0x1400ec5a2
mov rcx, rsi
lea rax, [rsp + 0x30]
xor r8d, r8d
cmp word [rax], r8w
je 0x1400ec62d
add rax, 2
sub rcx, 1
jne 0x1400ec61d
test rcx, rcx
je 0x1400ec675
sub rsi, rcx
lea rax, [rsp + 0x30]
mov ebp, r8d
lea rax, [rax + rsi*2]
sub r12, rax
test r15, r15
je 0x1400ec663
movzx edx, word [r12 + rax]
test dx, dx
je 0x1400ec663
mov word [rax], dx
dec r15
add rax, 2
sub rcx, 1
jne 0x1400ec644
test rcx, rcx
jne 0x1400ec671
add rax, 0xfffffffffffffffe
mov ebp, 0x8007007a
mov word [rax], r8w
mov rcx, qword [r10 + 0x10]
lea rax, str.::StringCchCat__wszPath__ARRAYSIZE_wszPath___L____
mov qword [rsp + 0x20], rax
mov edx, 0x1a
mov r9d, ebp
jmp 0x1400ec470