Function at 0x180013370
Capabilities:
Get disk information
Get disk size

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x700]
sub rsp, 0x800
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x850], rbx
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rbp + 0x6f0], rax
mov r13, rdx
mov r12, rcx
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
lea rcx, str.Shell32.dll
call fcn.180042f9c
mov r15, rax
movabs rsi, 0x7ffffffffffffffe
movabs r9, 0x7fffffffffffffff
lea r8, [rdi - 1]
mov r14, qword [rsp + 0x58]
cmp rax, r14
ja 0x180013438
lea rdi, [rsp + 0x40]
cmp r14, 8
cmovae rdi, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.Shell32.dll
mov rcx, rdi
call fcn.180039700
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x18001352d
cmp r15, rsi
ja 0x180013be3
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x180013452
mov rbx, rsi
jmp 0x180013473
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180013468
mov rbx, rsi
jmp 0x180013473
lea rax, [rcx + r14]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r9
jbe 0x180013485
mov rdx, r8
jmp 0x18001348e
cmp rdx, 0x1000
jb 0x1800134b5
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.180037bfc
test rax, rax
je 0x180013be9
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800134c5
test rdx, rdx
je 0x1800134c5
mov rcx, rdx
call fcn.180037bfc
mov rdi, rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.Shell32.dll
mov rcx, rdi
call fcn.180039700
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x180013528
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013523
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013bef
call fcn.180037bf4
mov qword [rsp + 0x40], rdi
call fcn.180018aa0
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.180018b40
mov rbx, rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180013584
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001357f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013bf5
call fcn.180037bf4
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
test rbx, rbx
je 0x18001364a
lea rdx, str.SHGetFileInfoW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x18001364a
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], di
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], di
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], di
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rbp + 0x10]
call fcn.180039b90
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x180013626
mov rcx, qword [r12]
mov dword [rsp + 0x20], 0x610
mov r9d, 0x2b8
lea r8, [rbp + 0x10]
xor edx, edx
call rbx
test rax, rax
jne 0x180013651
lea rcx, [rbp - 0x70]
call fcn.180013c30
xor al, al
jmp 0x180013bb3
lea rcx, [rbp + 0x20]
call fcn.180042f9c
mov r15, rax
mov r14, qword [rbp - 0x58]
cmp rax, r14
ja 0x180013695
lea rdi, [rbp - 0x70]
cmp r14, 8
cmovae rdi, qword [rbp - 0x70]
mov qword [rbp - 0x60], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.180039700
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x18001379b
cmp r15, rsi
ja 0x180013bfb
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x1800136af
mov rbx, rsi
jmp 0x1800136d0
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x1800136c5
mov rbx, rsi
jmp 0x1800136d0
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x1800136f3
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180013703
cmp rdx, 0x1000
jb 0x18001372a
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.180037bfc
test rax, rax
je 0x180013c01
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18001373a
test rdx, rdx
je 0x18001373a
mov rcx, rdx
call fcn.180037bfc
mov rdi, rax
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.180039700
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x180013797
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013792
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013c07
call fcn.180037bf4
mov qword [rbp - 0x70], rdi
lea rcx, [rbp + 0x228]
call fcn.180042f9c
mov r15, rax
mov r14, qword [rbp - 0x38]
cmp rax, r14
ja 0x1800137e7
lea rdi, [rbp - 0x50]
cmp r14, 8
cmovae rdi, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [rbp + 0x228]
mov rcx, rdi
call fcn.180039700
xor r15d, r15d
mov word [rbx + rdi], r15w
jmp 0x1800138f6
cmp r15, rsi
ja 0x180013c0d
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x180013801
mov rbx, rsi
jmp 0x180013822
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180013817
mov rbx, rsi
jmp 0x180013822
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180013845
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180013855
cmp rdx, 0x1000
jb 0x18001387c
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.180037bfc
test rax, rax
je 0x180013c13
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180013890
test rdx, rdx
je 0x18001388b
mov rcx, rdx
call fcn.180037bfc
jmp 0x18001388d
xor eax, eax
mov rdi, rax
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, [rbp + 0x228]
mov rcx, rdi
call fcn.180039700
xor r15d, r15d
mov word [rbx + rdi], r15w
cmp r14, 8
jb 0x1800138f2
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800138ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013c19
call fcn.180037bf4
mov qword [rbp - 0x50], rdi
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x4e0]
call fcn.180039b90
mov dword [rbp - 0x80], r15d
mov dword [rsp + 0x7c], r15d
mov dword [rsp + 0x78], r15d
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x2d0]
call fcn.180039b90
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x18001393b
mov rcx, qword [r12]
mov dword [rsp + 0x38], 0x104
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov r8d, 0x104
lea rdx, [rbp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x180013b53
mov word [rbp + 0x4d8], r15w
lea rcx, [rbp + 0x2d0]
call fcn.180042f9c
mov rbx, rax
mov r14, qword [rbp - 0x18]
cmp rax, r14
ja 0x1800139d2
lea rdi, [rbp - 0x30]
cmp r14, 8
cmovae rdi, qword [rbp - 0x30]
mov qword [rbp - 0x20], rax
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call fcn.180039700
mov word [rbx + rdi], r15w
jmp 0x180013ad7
cmp rbx, rsi
ja 0x180013c1f
mov rcx, rbx
or rcx, 7
cmp rcx, rsi
ja 0x180013a06
mov rdx, r14
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp r14, rax
ja 0x180013a06
lea rax, [r14 + rdx]
mov rsi, rcx
cmp rcx, rax
cmovb rsi, rax
lea rax, [rsi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180013a29
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180013a39
cmp rdx, 0x1000
jb 0x180013a60
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.180037bfc
test rax, rax
je 0x180013c25
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180013a75
test rdx, rdx
je 0x180013a72
mov rcx, rdx
call fcn.180037bfc
mov rdi, rax
jmp 0x180013a75
mov rdi, r15
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call fcn.180039700
mov word [rbx + rdi], r15w
cmp r14, 8
jb 0x180013ad3
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013ace
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013bdd
call fcn.180037bf4
mov qword [rbp - 0x30], rdi
mov byte [rbp + 8], 1
mov dword [rsp + 0x6c], r15d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x74], r15d
mov dword [rsp + 0x70], r15d
cmp qword [r12 + 0x18], 8
jb 0x180013afb
mov r12, qword [r12]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x6c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x180013b63
mov edx, dword [rsp + 0x68]
mov eax, edx
mov ecx, dword [rsp + 0x6c]
imul eax, ecx
mov dword [rbp - 0x10], eax
mov eax, dword [rsp + 0x70]
imul rax, rcx
imul rax, rdx
mov qword [rbp - 8], rax
mov eax, dword [rsp + 0x74]
imul rax, rcx
imul rax, rdx
mov qword [rbp], rax
jmp 0x180013b63
mov dword [rbp - 0x10], r15d
mov qword [rbp - 8], r15
mov qword [rbp], r15
mov byte [rbp + 8], 0
lea rdx, [rbp - 0x70]
mov rcx, r13
call fcn.1800077e0
lea rcx, [r13 + 0x20]
lea rdx, [rbp - 0x50]
call fcn.1800077e0
lea rcx, [r13 + 0x40]
lea rdx, [rbp - 0x30]
call fcn.1800077e0
mov eax, dword [rbp - 0x10]
mov dword [r13 + 0x60], eax
mov rax, qword [rbp - 8]
mov qword [r13 + 0x68], rax
mov rax, qword [rbp]
mov qword [r13 + 0x70], rax
movzx eax, byte [rbp + 8]
mov byte [r13 + 0x78], al
lea rcx, [rbp - 0x70]
call fcn.180013c30
mov al, 1
mov rcx, qword [rbp + 0x6f0]
xor rcx, rsp
call fcn.180037bd0
mov rbx, qword [rsp + 0x850]
add rsp, 0x800
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180042f24
nop
call fcn.180001ee0
int3
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180042f24
nop
call fcn.180001ee0
int3
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180001ee0
int3
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180001ee0
int3
call fcn.180042f24
int3