Function at 0x1400971f0
Capabilities:
Get common file path
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x318
mov r12, rcx
lea rcx, [rax - 0x270]
mov rsi, r9
call fcn.14004be6c
lea rcx, [rsp + 0x368]
xor r15d, r15d
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], r15
call fcn.140044ef4
lea eax, [r15 - 8]
mov qword [rsp + 0xc8], r15
mov qword [rsp + 0xd0], r15
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x368]
mov qword [rsp + 0xd8], r15
mov dword [rsp + 0x88], 2
mov edi, r15d
mov dword [rsp + 0x58], r15d
mov r13d, r15d
mov ebp, r15d
mov ebx, r15d
mov dword [rsp + 0x8c], r15d
mov dword [rsp + 0x70], r15d
lea r14d, [r15 + 1]
cmp word [rax], r15w
je 0x1400974e8
lea edi, [r15 + 0x20]
lea esi, [rdi - 0x17]
lea rdx, [rsp + 0x368]
lea rcx, [0x1400e1048]
or r8d, 0xffffffff
call fcn.14004e558
cmp al, r15b
jne 0x1400974c6
lea rdx, [rsp + 0x368]
lea rcx, [0x1400e1044]
or r8d, 0xffffffff
call fcn.14004e558
cmp al, r15b
jne 0x1400974c6
lea rdx, [rsp + 0x368]
lea rcx, [0x1400db2d4]
or r8d, 0xffffffff
call fcn.14004e558
cmp al, r15b
jne 0x1400974c1
lea rdx, [rsp + 0x368]
lea rcx, [0x1400d7440]
or r8d, 0xffffffff
call fcn.14004e558
cmp al, r15b
jne 0x1400974c1
lea rdx, [rsp + 0x368]
lea rcx, [0x1400d9934]
or r8d, 0xffffffff
call fcn.14004e558
cmp al, r15b
je 0x14009735b
mov dword [rsp + 0x8c], r14d
jmp 0x1400974ca
lea rdx, [rsp + 0x368]
lea rcx, [0x1400e1040]
or r8d, 0xffffffff
call fcn.14004e558
cmp al, r15b
je 0x140097380
or ebp, 0x10
jmp 0x1400974ca
mov r11, qword [rsp + 0x368]
lea rcx, [0x1400e103c]
mov r8d, 3
mov rdx, r11
call fcn.140045fc8
cmp al, r15b
je 0x1400973cb
add r11, 6
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x368]
or ebp, 0x10
mov qword [rsp + 0x368], r11
call fcn.14004fc04
jmp 0x1400974ca
lea rdx, [rsp + 0x368]
lea rcx, str._O:N
or r8d, 0xffffffff
call fcn.14004e558
cmp al, r15b
je 0x1400973ef
mov ebx, edi
jmp 0x1400974ca
lea rdx, [rsp + 0x368]
lea rcx, str._O:_N
or r8d, 0xffffffff
call fcn.14004e558
cmp al, r15b
je 0x140097416
mov ebx, 0x60
jmp 0x1400974ca
lea rdx, [rsp + 0x368]
lea rcx, str.cur
or r8d, 0xffffffff
call fcn.14004e558
cmp al, r15b
je 0x14009743d
mov dword [rsp + 0x70], r14d
jmp 0x1400974ca
mov r11, qword [rsp + 0x368]
lea rcx, str._size:
mov r8d, 6
mov rdx, r11
call fcn.140045fc8
cmp al, r15b
je 0x1400974dc
add r11, 0xc
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x368]
mov qword [rsp + 0x368], r11
call fcn.140051edc
mov r11, qword [rsp + 0x368]
cmp word [r11], r15w
je 0x1400974dc
cmp si, word [r11]
ja 0x14009749b
cmp word [r11], 0xd
jbe 0x1400974ca
cmp di, word [r11]
je 0x1400974ca
add qword [rsp + 0x368], 2
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x368]
call fcn.140051edc
jmp 0x1400974ca
or r13d, r14d
jmp 0x1400974ca
or r13d, 2
mov rax, qword [rsp + 0x368]
cmp word [rax], r15w
jne 0x1400972ad
mov rsi, qword [rsp + 0x378]
mov edi, dword [rsp + 0x58]
lea rcx, [rsp + 0xb0]
or ebp, ebx
mov dword [rsp + 0x80], ebp
call fcn.14004be6c
lea rbx, [0x1400d63f4]
lea rcx, [rsp + 0xa8]
mov rdx, rbx
call fcn.140058920
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.140058920
lea rcx, [rsp + 0x78]
mov rdx, rbx
call fcn.140058920
mov ebx, 0x2c
lea rdx, [rsp + 0x368]
lea rcx, [rsp + 0xe8]
mov r8d, ebx
mov r9b, r14b
call fcn.14005add0
lea rdx, [rsp + 0xb0]
xor r8d, r8d
mov rcx, rax
call fcn.14004f5d4
mov r11, qword [rsp + 0xb0]
lea r8d, [rbx + 0x30]
mov qword [rsp + 0x360], r11
cmp r13d, r15d
jne 0x140097612
movzx eax, word [r11]
cmp ax, r15w
je 0x140097612
lea ebx, [r8 - 0x3c]
lea esi, [rbx - 0x17]
cmp si, ax
ja 0x14009759f
cmp ax, 0xd
jbe 0x1400975f5
cmp bx, ax
je 0x1400975f5
mov ecx, 0x40
cmp cx, ax
jne 0x1400975b8
mov dword [rsp + 0x88], r14d
jmp 0x1400975e7
mov ecx, 0x24
cmp cx, ax
jne 0x1400975cf
mov dword [rsp + 0x88], 3
jmp 0x1400975e7
cmp r8w, ax
jne 0x1400975da
or edi, r14d
jmp 0x1400975e7
mov ecx, 0x21
cmp cx, ax
jne 0x1400975f5
or edi, 2
add r11, 2
mov ax, word [r11]
cmp ax, r15w
jne 0x140097594
mov rsi, qword [rsp + 0x378]
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x360], r11
mov dword [rsp + 0x58], edi
mov ebx, 0x2c
lea rcx, [rsp + 0x360]
call fcn.140044ef4
cmp edi, r15d
je 0x14009763a
mov rdx, qword [rsp + 0x360]
jmp 0x140097632
add rdx, 2
cmp word [rdx], r8w
je 0x14009762e
jmp 0x14009765b
cmp r13d, r15d
jne 0x140097653
mov rcx, qword [rsp + 0x360]
lea rdx, [rsp + 0x60]
call fcn.1400160d8
jmp 0x140097665
mov rdx, qword [rsp + 0x360]
lea rcx, [rsp + 0x60]
call fcn.1400589a0
mov rcx, qword [rsp + 0x368]
cmp bx, word [rcx]
jne 0x1400976b4
add rcx, 2
lea rdx, [rsp + 0x368]
mov r8d, ebx
mov qword [rsp + 0x368], rcx
lea rcx, [rsp + 0xe8]
mov r9b, r14b
call fcn.14005add0
lea rdx, [rsp + 0xa8]
xor r8d, r8d
mov rcx, rax
call fcn.14004f5d4
mov rcx, qword [rsp + 0x368]
cmp r13d, r15d
jne 0x140097701
cmp bx, word [rcx]
jne 0x140097701
add rcx, 2
lea rdx, [rsp + 0x368]
mov r8d, ebx
mov qword [rsp + 0x368], rcx
lea rcx, [rsp + 0xe8]
mov r9b, r14b
call fcn.14005add0
lea rdx, [rsp + 0xc8]
movzx r8d, bx
mov rcx, rax
call fcn.14004f968
mov rcx, qword [rsp + 0x368]
mov eax, dword [rsp + 0xc8]
mov edx, 0xfffffff8
cmp eax, r15d
cmovle eax, edx
mov dword [rsp + 0xc8], eax
cmp word [rcx], bx
jne 0x140097ee4
add rcx, 2
mov qword [rsp + 0x368], rcx
lea rcx, [rsp + 0x368]
call fcn.140044ef4
mov rdx, qword [rsp + 0x368]
lea rcx, [rsp + 0x78]
call fcn.140058a38
mov rbp, qword [rsp + 0x78]
cmp word [rbp], 0x2a
jne 0x140097764
mov bl, r14b
cmp word [rbp + 2], r15w
je 0x140097767
mov bl, r15b
lea rcx, [rsp + 0xb8]
mov byte [rsp + 0x360], bl
call fcn.14004be6c
mov rdi, qword [rsp + 0xa8]
mov dword [rsp + 0xc0], r15d
mov dword [rsp + 0xc4], r15d
cmp bl, r15b
jne 0x1400977a8
lea rcx, [rsp + 0xb8]
mov rdx, rdi
call fcn.140058a38
mov qword [rsp + 0xa0], r15
cmp rsi, r15
je 0x1400977ba
mov rax, qword [rsi]
jmp 0x1400977bd
mov rax, r15
mov qword [rsp + 0x98], rax
cmp word [rbp], r15w
jne 0x1400977f0
cmp rax, r15
je 0x1400977f0
movzx eax, word [rax]
cmp word [r12 + 0x96], ax
jne 0x1400977f0
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call fcn.14004adb0
lea rcx, [rsp + 0xe0]
mov edx, 0x32a
call fcn.14004bedc
mov rbx, qword [rsp + 0xe0]
xor r8d, r8d
mov eax, 0x8b
mov qword [rsp + 0x68], r8
mov rsi, r8
and word [r12 + 0xc8], ax
lea r15, [rbx + 4]
mov dword [rsp + 0x5c], r8d
mov dword [rsp + 0x54], r8d
lea ecx, [rax + 0x75]
cmp word [rbp], r8w
jne 0x140097858
mov rax, qword [rsp + 0x98]
cmp rax, r8
je 0x140097858
movzx eax, word [rax]
mov ebp, ecx
cmp word [r12 + 0x96], ax
je 0x14009785b
mov ebp, r8d
mov dword [rsp + 0x368], ebp
cmp word [rdi], r8w
je 0x14009787d
mov rax, qword [rsp + 0x78]
cmp word [rax], r8w
jne 0x14009787d
mov dword [rsp + 0x50], r14d
cmp ebp, r8d
je 0x140097882
mov dword [rsp + 0x50], r8d
movsxd r14, ebp
test r13b, 2
je 0x140097a7a
lea rsi, [0x1400f2c58]
mov qword [rsp + 0x368], r8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rsp + 0x60]
or r9d, 0xffffffff
xor r8d, r8d
mov rcx, r12
call fcn.140017d60
xor edx, edx
cmp rax, rdx
jne 0x1400978e6
mov rcx, rsi
lea ebx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x368]
call fcn.140044f24
mov eax, dword [rsp + 0x50]
xor edx, edx
jmp 0x140097a47
mov rdx, qword [rax]
lea rcx, [rsp + 0x368]
call fcn.140058a38
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x368]
xor ecx, ecx
mov qword [rsp + 0x80], rcx
cmp word [rbx], cx
je 0x140097a23
mov rbp, qword [rsp + 0x380]
mov r15, qword [rsp + 0x98]
lea edx, [rcx + 0xa]
mov r13d, 0xfeff
test byte [r12 + 0xc8], 0xef
jne 0x140097a23
mov r8, rbx
jmp 0x140097956
cmp ax, 0xd
je 0x14009795e
cmp ax, dx
je 0x14009795e
add rbx, 2
movzx eax, word [rbx]
cmp ax, cx
jne 0x140097947
movzx esi, word [rbx]
mov word [rbx], cx
mov rdx, rdi
mov rcx, r12
call fcn.14004b578
cmp si, 0xd
jne 0x140097986
mov eax, 0xa
cmp ax, word [rbx + 2]
jne 0x14009798d
add rbx, 4
jmp 0x140097991
xor edx, edx
cmp si, dx
je 0x140097991
add rbx, 2
inc dword [rsp + 0x5c]
xor ecx, ecx
cmp r14, rcx
je 0x1400979d1
mov rdx, qword [rsp + 0x370]
lea rax, [r15 + 2]
lea r8, [rsp + 0xa0]
mov qword [rsp + 0xa0], rax
lea rax, [0x1400d63f4]
xor r9d, r9d
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.14008e1e8
jmp 0x1400979f3
mov rdx, qword [rsp + 0x78]
cmp word [rdx], cx
je 0x1400979f5
mov r8, qword [rsp + 0x370]
xor r9d, r9d
mov rcx, r12
mov qword [rsp + 0x20], rbp
call fcn.1400367d4
xor ecx, ecx
movzx eax, word [r12 + 0xc8]
mov edx, pe_nt_image_headers64
test dx, ax
je 0x140097a15
and ax, r13w
mov word [r12 + 0xc8], ax
mov edx, 0xa
cmp word [rbx], cx
jne 0x140097933
lea rcx, [rsp + 0x80]
call fcn.140044f24
lea rcx, [rsp + 0x368]
call fcn.140044f24
mov eax, dword [rsp + 0x50]
xor edx, edx
mov ebx, dword [rsp + 0x54]
mov ecx, 0x8b
and word [r12 + 0xc8], cx
cmp byte [rsp + 0x360], dl
je 0x140097eaa
mov r8, qword [rsp + 0xb8]
mov rdx, rdi
mov rcx, r12
call fcn.14004b578
jmp 0x140097ebd
cmp r13d, 1
jne 0x140097bd5
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x368], rax
cmp word [rax], r8w
je 0x140097bc8
mov rbx, qword [rsp + 0x380]
mov r15, qword [rsp + 0x98]
lea ebp, [r13 + 0x1f]
lea r13d, [rbp - 0x17]
mov esi, 0xfeff
test byte [r12 + 0xc8], 0xef
jne 0x140097bc8
mov rdx, rax
jmp 0x140097af1
cmp r13w, cx
ja 0x140097ae0
cmp cx, 0xd
jbe 0x140097afa
cmp bp, cx
je 0x140097afa
add rax, 2
mov qword [rsp + 0x368], rax
movzx ecx, word [rax]
cmp cx, r8w
jne 0x140097ad4
sub rax, rdx
lea rcx, [rsp + 0x80]
sar rax, 1
mov r8d, eax
call fcn.14004c0cc
lea rcx, [rsp + 0x368]
call fcn.140044ef4
mov r8, qword [rsp + 0x80]
mov rdx, rdi
mov rcx, r12
call fcn.14004b578
inc dword [rsp + 0x5c]
xor r8d, r8d
cmp r14, r8
je 0x140097b71
mov rdx, qword [rsp + 0x370]
lea rax, [r15 + 2]
lea r8, [rsp + 0xa0]
mov qword [rsp + 0xa0], rax
lea rax, [0x1400d63f4]
xor r9d, r9d
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.14008e1e8
jmp 0x140097b94
mov rdx, qword [rsp + 0x78]
cmp word [rdx], r8w
je 0x140097b97
mov r8, qword [rsp + 0x370]
xor r9d, r9d
mov rcx, r12
mov qword [rsp + 0x20], rbx
call fcn.1400367d4
xor r8d, r8d
movzx eax, word [r12 + 0xc8]
mov ecx, pe_nt_image_headers64
test cx, ax
je 0x140097bb6
and ax, si
mov word [r12 + 0xc8], ax
mov rax, qword [rsp + 0x368]
cmp word [rax], r8w
jne 0x140097ac0
lea rcx, [rsp + 0x80]
jmp 0x140097a38
mov rcx, qword [rsp + 0x60]
call fcn.140015cb4
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.1400589a0
mov r11, qword [rsp + 0x60]
xor edx, edx
cmp word [r11], dx
je 0x140097e9f
movzx r13d, dx
mov r14d, 0xfeff
cmp dword [rsp + 0x58], edx
je 0x140097cc0
cmp dword [rsp + 0x70], edx
je 0x140097c54
mov word [rsp + 0x100], dx
lea rdx, [rsp + 0x100]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13w, word [rsp + 0x100]
cmp r13w, 0x61
jb 0x140097c52
cmp r13w, 0x7a
ja 0x140097c52
mov eax, 0xffdf
and r13w, ax
xor edx, edx
mov word [r15 + 2], dx
mov word [r15], dx
mov word [rbx + 2], dx
mov word [rbx], dx
mov ecx, 0x324
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov r14b, byte [rsp + 0x58]
xor edx, edx
and r14b, 2
mov rbp, r15
mov rbx, r15
cmp word [r15], dx
je 0x140097ca4
mov rcx, rbx
mov rbp, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
inc eax
cdqe
lea rbx, [rbx + rax*2]
cmp word [rbx], dx
jne 0x140097c89
cmp r14b, dl
mov rsi, r15
mov r14d, 0xfeff
cmovne rsi, rbp
mov ebp, dword [rsp + 0x368]
jmp 0x140097de5
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x60], rax
cmp ebp, edx
jne 0x140097ce9
mov rax, qword [rsp + 0x78]
cmp word [rax], dx
jne 0x140097ce9
mov eax, dword [rsp + 0x50]
cmp eax, edx
je 0x140097a43
cmp dword [rsp + 0x8c], edx
je 0x140097d12
movzx ecx, word [r11]
cmp cx, dx
je 0x140097d12
cmp word [r11 + 2], 0x3a
jne 0x140097d12
call fcn.1400b89dc
xor edx, edx
cmp eax, edx
je 0x140097ddb
lea rcx, [rsp + 0x368]
call fcn.14004be6c
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x368]
xor r8d, r8d
call fcn.1400a6f3c
mov rax, qword [rsp + 0x380]
mov r9, qword [rsp + 0x370]
mov r8, qword [rsp + 0x368]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0xc8]
mov r11d, ebp
or r11d, dword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
or r11d, dword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
mov dword [rsp + 0x28], r11d
lea rdx, [rsp + 0xb8]
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140096948
mov ecx, pe_nt_image_headers64
add dword [rsp + 0x5c], eax
movzx eax, word [r12 + 0xc8]
test cx, ax
je 0x140097dcc
and ax, r14w
mov word [r12 + 0xc8], ax
lea rcx, [rsp + 0x368]
call fcn.140044f24
xor edx, edx
cmp dword [rsp + 0x58], edx
je 0x140097e96
movsxd rbx, dword [rsp + 0x70]
cmp word [rsi], dx
je 0x140097e96
lea rax, [rsp + 0xc8]
cmp dword [rax], edx
je 0x140097e96
test byte [r12 + 0xc8], 0xef
jne 0x140097e96
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.140058a38
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.14004bfa8
xor edx, edx
cmp rbx, rdx
jne 0x140097e7f
test byte [rsp + 0x58], 2
je 0x140097e58
sub rsi, 2
cmp rsi, r15
jbe 0x140097e6b
lea rax, [rsi - 2]
cmp word [rax], dx
je 0x140097e6b
mov rsi, rax
cmp rax, r15
ja 0x140097e45
jmp 0x140097e6b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
xor edx, edx
cdqe
lea rsi, [rsi + rax*2]
mov r11, qword [rsp + 0x68]
cmp r13w, word [r11]
jne 0x140097ccf
jmp 0x140097dea
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0x70], edx
mov word [rax], r13w
mov r11, qword [rsp + 0x68]
jmp 0x140097ccf
mov eax, dword [rsp + 0x50]
jmp 0x140097a43
mov eax, dword [rsp + 0x50]
mov ebx, edx
jmp 0x140097a47
cmp eax, edx
je 0x140097ebd
mov edx, dword [rsp + 0x5c]
mov r8, rdi
mov rcx, r12
call fcn.14004ed64
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0xe0]
call fcn.140044f24
lea rcx, [rsp + 0xb8]
call fcn.140044f24
mov r14d, ebx
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x60]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0xb0]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
mov eax, r14d
add rsp, 0x318
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret