Function at 0x7de163f3
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x7de16412
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
xor eax, eax
jmp 0x7de16701
push ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
test eax, eax
jge 0x7de16429
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7de1640b
movzx eax, word [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
push esi
push 0x5c
shr eax, 1
pop esi
cmp word [ecx + eax*2 - 2], si
je 0x7de16449
push 0xc0000033
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7de1645c
push ebx
call fcn.7dd74298
cmp eax, 4
jne 0x7de16463
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
xor eax, eax
jmp 0x7de16700
cmp word [ebp - 0x10], 6
jne 0x7de16507
mov eax, dword [ebp - 0xc]
cmp word [eax + 2], 0x3a
je 0x7de16554
push edi
or edi, 0xffffffff
push edi
push 0x80
push 3
push 0
push 3
mov esi, 0xc0000000
push esi
push 0x7dd804d8
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
cmp eax, edi
je 0x7de166fd
push eax
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
push edi
push 0x2200080
push 3
push 0
push 7
push esi
push ebx
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov dword [ebp - 4], eax
cmp eax, edi
je 0x7de166fd
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov ecx, dword fs:[0x18]
mov esi, 0x4000
push esi
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x7de1655f
push dword [ebp - 4]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
push 8
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7de166fd
cmp word [ebp - 0x10], 0xe
jne 0x7de1647c
mov eax, dword [ebp - 0xc]
cmp word [eax], si
jne 0x7de1647c
cmp word [eax + 2], si
jne 0x7de1647c
movzx ecx, word [eax + 4]
cmp cx, 0x2e
je 0x7de1653c
cmp cx, 0x3f
jne 0x7de1647c
cmp word [eax + 6], si
jne 0x7de1647c
cmp word [eax + 0xa], 0x3a
jne 0x7de1647c
add ebx, 8
push ebx
call fcn.7de16255
jmp 0x7de16700
push ebx
lea eax, [ebp - 8]
push eax
push esi
push edi
push ebx
push ebx
push 0x900a8
push dword [ebp - 4]
call sub.API_MS_Win_Core_IO_L1_1_0.dll_DeviceIoControl
test eax, eax
je 0x7de166e1
cmp dword [edi], 0xa0000003
jne 0x7de166e1
movzx eax, word [edi + 8]
mov dx, word [edi + 0xa]
lea esi, [eax + edi + 0x10]
cmp dx, 0x60
je 0x7de165b0
cmp dx, 0x62
jne 0x7de166be
cmp word [esi + 0x60], 0x5c
jne 0x7de166be
cmp word [esi], 0x5c
jne 0x7de166be
movzx ecx, word [esi + 2]
cmp cx, 0x3f
je 0x7de165ce
cmp cx, 0x5c
jne 0x7de166be
cmp word [esi + 4], 0x3f
jne 0x7de166be
cmp word [esi + 6], 0x5c
jne 0x7de166be
cmp word [esi + 8], 0x56
jne 0x7de166be
cmp word [esi + 0xa], 0x6f
jne 0x7de166be
cmp word [esi + 0xc], 0x6c
jne 0x7de166be
cmp word [esi + 0xe], 0x75
jne 0x7de166be
cmp word [esi + 0x10], 0x6d
jne 0x7de166be
cmp word [esi + 0x12], 0x65
jne 0x7de166be
cmp word [esi + 0x14], 0x7b
jne 0x7de166be
push 0x2d
pop eax
cmp word [esi + 0x26], ax
jne 0x7de166be
cmp word [esi + 0x30], ax
jne 0x7de166be
cmp word [esi + 0x3a], ax
jne 0x7de166be
cmp word [esi + 0x44], ax
jne 0x7de166be
cmp word [esi + 0x5e], 0x7d
jne 0x7de166be
cmp dx, 0x62
jne 0x7de166be
cmp cx, 0x3f
jne 0x7de166be
push ebx
xor eax, eax
mov word [edi + 4], ax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 8
push edi
push 0x900ac
push dword [ebp - 4]
call sub.API_MS_Win_Core_IO_L1_1_0.dll_DeviceIoControl
push dword [ebp - 4]
mov ebx, eax
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
test ebx, ebx
je 0x7de166a5
push 0x5c
pop eax
mov word [esi + 2], ax
xor eax, eax
push eax
push esi
push dword [ebp + 8]
mov word [esi + 0x62], ax
call fcn.7de160f9
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
jmp 0x7de166ff
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 4]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
push 0x57
jmp 0x7de164fc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 4]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4