Function at 0x14006e500
Capabilities:
Get disk information
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x570], rbx
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rsi, rdx
mov qword [rsp + 0x28], rdx
mov r13, rcx
mov qword [rsp + 0x68], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
lea rcx, [rbp - 0x70]
call fcn.140002670
nop
test rsi, rsi
jne 0x14006e575
lea rdx, [rbp - 0x70]
mov rcx, r13
call fcn.140004af0
jmp 0x14006e9fa
lea rdx, str.Kernel32.dll
lea rcx, [rsp + 0x70]
call fcn.140002630
nop
call fcn.140070510
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.1400705b0
mov rdi, rax
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x70]
call fcn.140002550
lea rdx, str.Psapi.dll
lea rcx, [rsp + 0x40]
call fcn.140002630
nop
call fcn.140070510
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.1400705b0
mov r14, rax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.140002550
test r14, r14
je 0x14006e9ee
test rdi, rdi
je 0x14006e9ee
lea rcx, [rbp - 0x10]
call fcn.140065e20
cmp dword [rbp - 0xc], 6
jb 0x14006e67d
lea rdx, str.QueryFullProcessImageNameW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14006e67d
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp - 0x10]
call fcn.140177d50
mov dword [rbp - 0x50], 0x208
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x10]
xor edx, edx
mov rcx, rsi
call rbx
test eax, eax
je 0x14006e67d
mov eax, dword [rbp - 0x50]
cmp eax, 0x208
jae 0x14006e664
add rax, rax
cmp rax, 0x412
jae 0x14006ea44
mov word [rbp + rax - 0x10], r15w
lea rcx, [rbp - 0x10]
call fcn.140002910
mov r8, rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.140002710
lea rcx, [rbp - 0x70]
call fcn.1400030a0
test al, al
je 0x14006e903
lea rdx, str.GetProcessImageFileNameW
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x14006e6be
lea rdx, str.GetProcessImageFileNameW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14006e71c
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp - 0x10]
call fcn.140177d50
mov r8d, 0x208
lea rdx, [rbp - 0x10]
mov rcx, rsi
call rbx
lea ecx, [rax - 1]
cmp ecx, 0x206
ja 0x14006e71c
mov eax, eax
add rax, rax
cmp rax, 0x412
jae 0x14006ea38
xor ebx, ebx
mov word [rbp + rax - 0x10], bx
lea rcx, [rbp - 0x10]
call fcn.140002910
mov r8, rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.140002710
jmp 0x14006e71e
xor ebx, ebx
lea rcx, [rbp - 0x70]
call fcn.1400030a0
test al, al
jne 0x14006e900
mov ecx, 0x410
call fcn.140158e14
mov rdi, rax
xor edx, edx
mov r8d, 0x410
mov rcx, rax
call fcn.140177d50
mov edx, 0x18
lea rcx, [rbp - 0x48]
call fcn.140003040
lea rcx, [rbp - 0x48]
call fcn.140003080
nop
lea rcx, [rbp - 0x48]
call fcn.14007d030
mov r12, rbx
lea rcx, [rbp - 0x48]
call fcn.140003060
test rax, rax
je 0x14006e8e9
lea rcx, [rbp - 0x48]
call fcn.140002690
mov qword [rbp - 0x50], rax
mov r15, rbx
mov rsi, qword [rax]
add rsi, r15
mov rcx, rsi
call fcn.140003280
cmp rax, 3
jb 0x14006e7d2
mov rcx, rsi
call fcn.140002690
mov rcx, rax
mov rdx, qword [rax + 0x18]
cmp rdx, 8
jb 0x14006e7be
mov rcx, qword [rax]
cmp word [rcx + 4], 0x5c
jne 0x14006e7d2
cmp rdx, 8
jb 0x14006e7ce
mov rax, qword [rax]
mov word [rax + 4], bx
mov rcx, rsi
call fcn.1400030b0
mov rcx, rax
mov r8d, 0x208
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x14006e7f3
mov word [rdi], bx
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14006e800
test ebx, ebx
je 0x14006e83a
mov r14d, ebx
lea rcx, [rbp - 0x70]
call fcn.140003280
cmp r14, rax
jae 0x14006e83a
lea rcx, [rbp - 0x70]
call fcn.1400030b0
mov rcx, rax
mov r8d, r14d
mov rdx, rdi
call fcn.14017edec
test eax, eax
je 0x14006e85e
inc r12
add r15, 0x20
lea rcx, [rbp - 0x48]
call fcn.140003060
cmp r12, rax
jae 0x14006e8df
mov rax, qword [rbp - 0x50]
xor ebx, ebx
jmp 0x14006e792
lea rcx, [rbp - 0x30]
call fcn.140002670
nop
lea rcx, [rbp - 0x70]
call fcn.1400030b0
mov ecx, ebx
lea rbx, [rax + rcx*2]
mov rcx, rsi
call fcn.1400030b0
mov r8, rax
mov r9, rbx
lea rdx, [0x1401d7238]
lea rcx, [rbp - 0x30]
call fcn.140064620
lea rcx, [rbp - 0x70]
call fcn.140002690
mov rcx, rax
call fcn.140002690
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140002690
mov rcx, rax
call fcn.140002690
movups xmm2, xmmword [rbx]
movups xmm3, xmmword [rbx + 0x10]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rax], xmm2
movups xmmword [rax + 0x10], xmm3
lea rcx, [rbp - 0x30]
call fcn.140002550
mov r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.1401588c0
nop
lea rcx, [rbp - 0x48]
call fcn.140003070
mov rdi, qword [rsp + 0x38]
xor r15d, r15d
lea rcx, [rbp - 0x70]
call fcn.1400030a0
test al, al
je 0x14006e9a1
lea rdx, str.GetModuleFileNameExW
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x14006e944
lea rdx, str.GetModuleFileNameExW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14006e9a1
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp - 0x10]
call fcn.140177d50
mov r9d, 0x208
lea r8, [rbp - 0x10]
xor edx, edx
mov rcx, rsi
call rbx
lea ecx, [rax - 1]
cmp ecx, 0x206
ja 0x14006e9a1
mov eax, eax
add rax, rax
cmp rax, 0x412
jae 0x14006ea3e
mov word [rbp + rax - 0x10], r15w
lea rcx, [rbp - 0x10]
call fcn.140002910
mov r8, rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.140002710
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.1400694f0
mov rbx, rax
lea rax, [rbp - 0x70]
cmp rax, rbx
je 0x14006e9e4
lea rcx, [rbp - 0x70]
call fcn.1400026a0
mov rcx, rbx
call fcn.140002690
mov rcx, rax
call fcn.140002690
mov rdx, rax
xor r8d, r8d
lea rcx, [rbp - 0x70]
call fcn.140004b20
nop
lea rcx, [rsp + 0x40]
call fcn.140002550
lea rdx, [rbp - 0x70]
mov rcx, r13
call fcn.140004af0
mov dword [rsp + 0x20], 1
lea rcx, [rbp - 0x70]
call fcn.140002550
mov rax, r13
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140158860
mov rbx, qword [rsp + 0x570]
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140158f24
int3
call fcn.140158f24
int3
call fcn.140158f24
int3