Function at 0x14005efa0
Capabilities:
Check if file exists
Get disk information

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbp, rcx
mov ecx, edx
mov r12d, r9d
mov r15, r8
mov r14d, edx
call fcn.140119fd0
mov dword [rbp], eax
call fcn.140049400
mov rdx, qword [rax]
mov rcx, rax
mov rdi, rax
call qword [rdx + 0x80]
mov r13, qword [rsp + 0x4d0]
mov word [rsp + 0x40], 0
mov r10, qword [rdi]
lea rdx, [rsp + 0x40]
mov r9, r13
mov r8d, r12d
mov rcx, rdi
movzx ebx, ax
call qword [r10 + 0x50]
movzx r11d, word [rsp + 0x40]
cmp r11w, bx
jne 0x14005f02c
mov eax, 1
jmp 0x14005f550
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_1216], rsi
xor esi, esi
test r11w, r11w
lea ebx, [rsi + 1]
je 0x14005f04a
cmp r11w, 0x2a
jne 0x14005f117
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, 2
bt eax, ecx
jae 0x14005f06c
add ecx, ebx
cmp ecx, 0x1a
jl 0x14005f055
mov r11w, word [rsp + 0x40]
jmp 0x14005f117
add cx, 0x41
mov word [rsp + 0x40], cx
call fcn.140049400
movzx edx, word [rsp + 0x40]
mov r10, qword [rax]
mov r9, r13
mov r8d, r12d
mov rcx, rax
mov rsi, rax
call qword [r10 + 0x18]
test eax, eax
jne 0x14005f10f
lea edi, [rax + 0x64]
nop
nop
mov rax, qword [rsi]
movzx edx, word [rsp + 0x40]
mov rcx, rsi
call qword [rax + 0x20]
mov r11, qword [rsi]
movzx edx, word [rsp + 0x40]
mov r9, r13
mov r8d, r12d
mov rcx, rsi
call qword [r11 + 0x18]
test eax, eax
jne 0x14005f0d8
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, ebx
test edi, edi
jg 0x14005f0a0
jmp 0x14005f0dc
test edi, edi
jg 0x14005f10f
call fcn.140049470
lea rcx, str..._reg.cpp
mov edx, 0xe6
mov rdi, qword [rax]
mov rbx, rax
call fcn.14005ae30
lea rdx, str._s:_Failed_to_MountVolume_in_SetPartitionPos.
mov rcx, rbx
mov r8, rax
call qword [rdi + 0x10]
xor eax, eax
jmp 0x14005f548
mov r11w, word [rsp + 0x40]
mov esi, ebx
xor eax, eax
lea rdx, [0x140000000]
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x52], rax
mov qword [rsp + 0x5a], rax
mov qword [rsp + 0x62], rax
mov qword [rsp + 0x6a], rax
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov qword [rsp + 0x82], rax
mov dword [rsp + 0x8a], eax
mov word [rsp + 0x8e], ax
mov rax, qword [rdx + 0x2e0b70]
mov qword [rcx], rax
mov rax, qword [rdx + 0x2e0b78]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0x2e0b80]
mov qword [rcx + 0x10], rax
mov rax, qword [rdx + 0x2e0b88]
mov qword [rcx + 0x18], rax
mov rax, qword [rdx + 0x2e0b90]
mov qword [rcx + 0x20], rax
mov rax, qword [rdx + 0x2e0b98]
mov qword [rcx + 0x28], rax
mov rax, qword [rdx + 0x2e0ba0]
mov qword [rcx + 0x30], rax
mov rax, qword [rdx + 0x2e0ba8]
mov qword [rcx + 0x38], rax
mov eax, dword [rdx + 0x2e0bb0]
mov dword [rcx + 0x40], eax
mov rax, qword [rdx + 0x2e0b30]
lea rcx, [rsp + 0xd0]
mov qword [rcx], rax
mov rax, qword [rdx + 0x2e0b38]
mov word [rsp + 0x110], r11w
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0x2e0b40]
mov qword [rcx + 0x10], rax
mov rax, qword [rdx + 0x2e0b48]
mov qword [rcx + 0x18], rax
mov rax, qword [rdx + 0x2e0b50]
mov qword [rcx + 0x20], rax
mov rax, qword [rdx + 0x2e0b58]
mov qword [rcx + 0x28], rax
mov rax, qword [rdx + 0x2e0b60]
mov qword [rcx + 0x30], rax
mov rax, qword [rdx + 0x2e0b68]
mov qword [rcx + 0x38], rax
xor ecx, ecx
nop
nop
nop
movzx eax, word [rcx + rdx + 0x2e0b10]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x4e], ax
jne 0x14005f230
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x110]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0
mov word [rsp + 0x50], r11w
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x14005f37b
cmp rdi, 0xffffffffffffffff
jne 0x14005f372
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14005f2bd
cmp eax, 3
je 0x14005f2bd
cmp eax, 0x3ed
je 0x14005f2bd
cmp eax, 0x570
jne 0x14005f372
movzx eax, word [rsp + 0x40]
lea rcx, [rsp + 0xd0]
xor r9d, r9d
mov word [rsp + 0xd0], ax
xor eax, eax
mov edx, 0x80000000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea r8d, [rax + 3]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x14005f342
cmp rdi, 0xffffffffffffffff
jne 0x14005f339
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14005f546
cmp eax, 3
je 0x14005f546
cmp eax, 0x3ed
je 0x14005f546
cmp eax, 0x570
je 0x14005f546
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
lea rdx, [0x140000000]
nop
nop
movzx eax, word [rcx + rdx + 0x2e0af8]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x4e], ax
jne 0x14005f350
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x50], ax
jmp 0x14005f37b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.14005c040
test eax, eax
je 0x14005f546
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8d, Ordinal_512
mov word [rsp + 0x260], 0
call sub.ntdll.dll_memset
lea r8, [rsp + 0x50]
lea rdx, str._sSystem32ConfigSystem
lea rcx, [rsp + 0x260]
call qword [sym.imp.MSVCR80.dll__swprintf]
xor eax, eax
mov word [rsp + 0x90], 0
mov qword [rsp + 0x92], rax
mov qword [rsp + 0x9a], rax
mov qword [rsp + 0xa2], rax
mov qword [rsp + 0xaa], rax
mov qword [rsp + 0xb2], rax
mov qword [rsp + 0xba], rax
mov qword [rsp + 0xc2], rax
mov dword [rsp + 0xca], eax
mov word [rsp + 0xce], ax
nop
lea rdx, str.MySystem_d
lea rcx, [rsp + 0x90]
mov r8d, ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x90]
mov rcx, rbp
call fcn.14005b310
test eax, eax
jne 0x14005f45c
add ebx, 1
cmp ebx, 0xa
jle 0x14005f420
mov edx, r14d
mov rcx, rbp
call fcn.14005b270
mov edx, r12d
mov rcx, rbp
mov edi, eax
call fcn.14005b270
lea rcx, [rsp + 0x162]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x160], 0
mov ebx, eax
call sub.ntdll.dll_memset
lea r8, [rsp + 0x90]
lea rdx, str._sMountedDevices
lea rcx, [rsp + 0x160]
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rdx, [rsp + 0x160]
mov r9, r15
mov r8d, edi
mov rcx, rbp
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], ebx
call fcn.14005c300
lea rdx, [rsp + 0x160]
mov ebx, eax
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005f51e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x90]
mov rcx, rbp
call fcn.14005b510
test esi, esi
je 0x14005f546
call fcn.140049400
movzx edx, word [rsp + 0x40]
mov r8, qword [rax]
mov rcx, rax
call qword [r8 + 0x20]
mov eax, ebx
mov rsi, qword [rsp + reloc.MFC80U.DLL_Ordinal_1216]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140161080
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret