Function at 0x140027bd0
Capabilities:
Unmount volume via ioctl

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov esi, dword [rsp + 0xb8]
mov rbx, rdx
lea rdx, [0x140000000]
mov eax, dword [rdx + 0xed678]
mov ebp, ecx
lea rcx, [rsp + 0x40]
mov dword [rcx], eax
movzx eax, word [rdx + 0xed67c]
xor r12d, r12d
and esi, 0x10
mov r13d, r8d
mov word [rcx + 4], ax
je 0x140027c37
cmp rbx, r12
je 0x140027c37
movzx eax, word [rbx]
cmp ax, 0x41
jb 0x140027c37
cmp ax, 0x5a
ja 0x140027c37
or ax, 0x20
mov word [rbx], ax
mov r14d, dword [rsp + 0xb0]
mov edi, 2
cmp r9d, r12d
je 0x140027c79
mov edx, ebp
xor ecx, ecx
call qword [0x140106e60]
cmp eax, r12d
jne 0x140028138
lea rax, str.Error
cmp rbx, r12
cmove rbx, rax
mov rcx, rbx
call fcn.140019474
mov eax, edi
jmp 0x140028275
lea rcx, [rsp + 0x48]
mov edx, 0x448
call fcn.140055ddc
mov r12, qword [rsp + 0x48]
test rbx, rbx
jne 0x140027cd8
mov edx, 0xc0000000
mov ecx, ebp
call qword [0x140106e90]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140027ef0
mov edx, 0x80000000
mov ecx, ebp
call qword [0x140106e90]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140027ef0
mov edx, 0x80
mov ecx, ebp
call qword [0x140106e90]
jmp 0x140027e20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
jne 0x140027cf3
xor ecx, ecx
lea ebp, [rcx + 0x3a]
cmp word [rbx + 2], bp
sete cl
jmp 0x140027d21
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jne 0x140027d1a
lea rcx, [rbx + 2]
lea rdx, [0x1400ec498]
call fcn.1400cdbfc
xor ecx, ecx
test eax, eax
sete cl
jmp 0x140027d1c
xor ecx, ecx
mov ebp, 0x3a
test ecx, ecx
je 0x140027e4b
lea rdx, [0x140000000]
lea rcx, [rsp + 0x50]
mov rax, qword [rdx + 0xec488]
mov qword [rcx], rax
mov eax, dword [rdx + 0xec490]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0xec494]
movzx edx, word [rbx]
mov word [rcx + 0xc], ax
mov word [rsp + 0x58], dx
test esi, esi
jne 0x140027d8c
xor ecx, ecx
cmp dx, 0x5a
setbe cl
xor eax, eax
cmp dx, 0x41
setae al
test eax, ecx
je 0x140027d8c
test byte [rsp + 0xb8], 0x11
jne 0x140027d8c
movzx ecx, dx
mov r8d, r14d
xor edx, edx
call fcn.1400192c0
and qword [rsp + 0x30], 0
mov eax, 3
mov ebp, 0x20000000
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, eax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140027ef0
and qword [rsp + 0x30], 0
lea eax, [rsi + 4]
lea rcx, [rsp + 0x50]
mov r8d, eax
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140027ef0
and qword [rsp + 0x30], 0
lea eax, [rsi + 4]
lea rcx, [rsp + 0x50]
lea edx, [rax + 0x7d]
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140027ef0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x140027e3f
lea edi, [rsi + 2]
jmp 0x1400280e6
lea rcx, str.Error_opening_device:
jmp 0x1400280e1
mov edx, 0xc0000000
mov rcx, rbx
call qword [0x140106e98]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140027ef0
mov edx, 0x80000000
mov rcx, rbx
call qword [0x140106e98]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140027ef0
mov edx, 0x80
mov rcx, rbx
call qword [0x140106e98]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140027ef0
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 1
je 0x140027edc
sub eax, 0x56
je 0x140027edc
sub eax, ebp
je 0x140027ec4
sub eax, 0x7a
je 0x140027ec4
cmp eax, 0x101b
je 0x140027ec4
mov rcx, rbx
call fcn.140019474
lea edi, [rsi + 0xa]
jmp 0x1400280e6
call fcn.1400cd9d8
lea rdx, str.Not_a_mount_point:__1_ws__n
mov r8, rbx
lea rcx, [rax + 0x60]
call fcn.1400193ec
lea rcx, [rsp + 0x48]
call fcn.14004ea6c
mov eax, 9
jmp 0x140028275
mov rcx, rsi
call fcn.1400194f0
mov rcx, rsi
test eax, eax
jne 0x140027f0f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 5
jmp 0x1400280e6
and qword [rsp + 0x38], 0
lea rax, [rsp + 0xa8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x83722008
mov dword [rsp + 0x28], 0x448
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140027f69
mov rcx, rbx
call fcn.140019474
call fcn.1400cd9d8
lea rdx, str._1_ws_:_Is_that_drive_really_an_ImDisk_drive_
mov r8, rbx
lea rcx, [rax + 0x60]
call fcn.1400193ec
jmp 0x1400280e6
cmp dword [rsp + 0xa8], 0x36
jb 0x140027f4c
movzx edx, word [r12 + 0x2c]
xor r12d, r12d
cmp dx, r12w
mov ecx, r12d
mov eax, r12d
setne cl
cmp rbx, r12
sete al
test eax, ecx
je 0x140027f9d
mov word [rsp + 0x40], dx
lea rbx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov ebp, 0x90018
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov edx, ebp
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
jne 0x140028043
cmp r13d, r12d
je 0x1400280d0
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
lea edx, [rbp + 8]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x140028078
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x90020
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
je 0x1400280d0
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x2d4808
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
jne 0x1400280f5
cmp r13d, r12d
je 0x1400280c8
xor edx, edx
mov rcx, rsi
call qword [0x140106e60]
mov ecx, r12d
cmp eax, r12d
sete cl
jmp 0x1400280cb
mov ecx, r12d
cmp ecx, r12d
je 0x1400280f5
lea rax, str.Error
cmp rbx, r12
cmove rbx, rax
mov rcx, rbx
call fcn.140019474
lea rcx, [rsp + 0x48]
call fcn.14004ea6c
jmp 0x140027c72
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9001c
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x48]
call fcn.14004ea6c
cmp rbx, r12
je 0x140028273
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
jne 0x14002815f
mov esi, 0x3a
mov ecx, r12d
cmp word [rbx + 2], si
sete cl
jmp 0x140028190
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jne 0x140028188
lea rcx, [rbx + 2]
lea rdx, [0x1400ec498]
call fcn.1400cdbfc
mov ecx, r12d
cmp eax, r12d
sete cl
jmp 0x14002818b
mov ecx, r12d
mov esi, 0x3a
cmp ecx, r12d
je 0x140028223
lea rcx, [rsp + 0x48]
lea rdx, [0x140000000]
xor r8d, r8d
mov eax, dword [rdx + 0xed678]
mov dword [rcx], eax
movzx eax, word [rdx + 0xed67c]
lea rdx, [rsp + 0x48]
mov word [rcx + 4], ax
movzx eax, word [rbx]
mov ecx, edi
mov word [rsp + 0x48], ax
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
cmp eax, r12d
jne 0x1400281dd
mov rcx, rbx
call fcn.140019474
movzx ecx, word [rbx]
call fcn.1400529e8
test byte [rsp + 0xb8], 0x11
jne 0x140028273
xor r9d, r9d
lea rax, [rsp + 0x50]
mov edx, 0x219
mov qword [rsp + 0x30], rax
lea r8d, [r9 + 7]
mov ecx, 0xffff
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x140028273
mov rcx, rbx
call qword [0x140106ea0]
cmp eax, r12d
jne 0x140028273
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 1
je 0x140028273
sub eax, 0x56
je 0x140028273
sub eax, esi
je 0x14002825b
sub eax, 0x7a
je 0x14002825b
cmp eax, 0x101b
je 0x14002825b
mov rcx, rbx
call fcn.140019474
jmp 0x140028273
call fcn.1400cd9d8
lea rdx, str.Not_a_mount_point:__1_ws__n
mov r8, rbx
lea rcx, [rax + 0x60]
call fcn.1400193ec
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret