Function at 0x140001e70
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [0x14002f008]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor esi, esi
movzx ebx, si
mov dword [rsp + 0x34], ebx
mov word [rsp + 0x24], bx
cmp dword [0x14002f70c], esi
jne 0x14001d5d0
cmp dword [0x14002f020], esi
je 0x140002089
cmp dword [0x140030390], esi
jne 0x140001edc
lea rcx, [0x1400283c0]
call fcn.14000ed0c
cmp byte [0x14003e8a6], sil
jne 0x14001d5e7
lea rcx, [0x140028600]
call fcn.1400086f4
mov r15, rax
test rax, rax
je 0x140001f1b
mov r8, rax
mov edx, 0x200
lea r15, [0x14002f720]
mov rcx, r15
call fcn.14000dc10
mov byte [0x14003e8a6], 1
xor r8d, r8d
mov edx, 0x104
lea rcx, [0x140032600]
call fcn.1400115f0
lea r13, [0x14002fb20]
mov rdi, r13
mov qword [rsp + 0x28], r13
mov word [0x14002fb20], si
mov r14d, 0x3ff
mov dword [rsp + 0x20], r14d
test r15, r15
je 0x14001d8d6
cmp word [r15], si
je 0x14001d8d6
or r12, 0xffffffffffffffff
cmp word [r15], si
je 0x140002061
cmp word [r15], 0x24
jne 0x14001d5f3
add r15, 2
mov qword [rsp + 0x40], r15
mov ebx, esi
lea r12, [0x140028d60]
mov eax, ebx
lea rcx, [rax + rax*2]
movzx r13d, word [r12 + rcx*2]
test r13w, r13w
je 0x140001fb7
movzx ecx, word [r15]
call qword [sym.imp.msvcrt.dll_towupper]
cmp ax, r13w
je 0x140001fb3
inc ebx
jmp 0x140001f8e
test r13w, r13w
mov r12, 0xffffffffffffffff
je 0x140002061
mov eax, ebx
lea rcx, [rax + rax*2]
lea rax, [0x140028d60]
cmp word [rax + rcx*2 + 2], 8
jne 0x14000201a
movzx r9d, word [rax + rcx*2 + 4]
movsxd rdx, r14d
lea r8, [0x140028ab4]
mov rcx, rdi
call fcn.140011b7c
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], si
jne 0x140001ff4
movsxd rax, ecx
lea rdi, [rdi + rax*2]
sub r14d, ecx
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x28], rdi
add r15, 2
jmp 0x140001f67
movzx ecx, word [rax + rcx*2 + 2]
sub ecx, 1
je 0x14001d8b5
sub ecx, 1
je 0x14001d8a1
sub ecx, 1
jne 0x14001d660
movsxd rdx, r14d
lea r9, [0x140032600]
lea r8, [0x140028a48]
mov rcx, rdi
call fcn.140011b7c
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], si
jne 0x140002056
jmp 0x140001ffd
lea r13, [0x14002fb20]
mov word [rdi], si
inc r12
cmp word [r13 + r12*2], si
jne 0x14000206b
mov rdx, r12
mov rcx, r13
call fcn.14000ed80
cmp dword [0x14002f70c], esi
jne 0x1400020bb
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400151c0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140006068
jmp 0x140002089
xor edx, edx
mov ecx, 0x2335
call fcn.140004ae0
call fcn.140006068
nop
jmp 0x140001ebc
lea r15, [0x14002f720]
jmp 0x140001f1b
movzx r9d, word [r15]
movsxd rdx, r14d
lea r8, [0x140028ab4]
mov rcx, rdi
call fcn.140011b7c
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], si
jne 0x14001d60c
movsxd rax, ecx
lea rdi, [rdi + rax*2]
mov qword [rsp + 0x28], rdi
sub r14d, ecx
mov dword [rsp + 0x20], r14d
call fcn.140007170
test al, al
je 0x14001d650
movzx ebx, word [r15]
mov dword [rsp + 0x34], ebx
movzx ecx, bx
call fcn.140022e40
test eax, eax
je 0x14001d650
mov word [rsp + 0x24], bx
jmp 0x140002011
mov eax, esi
mov dword [rsp + 0x34], eax
mov word [rsp + 0x24], ax
jmp 0x140002011
sub ecx, 1
je 0x14001d856
sub ecx, 1
je 0x14001d825
sub ecx, 1
je 0x14001d802
sub ecx, 3
je 0x14001d7be
cmp ecx, 1
je 0x14001d6b4
movzx r9d, word [0x140032600]
movsxd rdx, r14d
lea r8, [0x140028ab4]
mov rcx, rdi
call fcn.140011b7c
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], si
jne 0x14001d6a6
jmp 0x140001ffd
cmp byte [0x140046d39], sil
je 0x140002011
mov dword [rsp + 0x30], esi
movzx eax, word [0x140032600]
mov word [rsp + 0x50], ax
movzx eax, word [0x140032602]
mov word [rsp + 0x52], ax
mov dword [rsp + 0x54], 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDriveTypeW]
cmp eax, 4
jne 0x140002011
mov word [rsp + 0x54], si
mov dword [rsp + 0x38], 0x104
call fcn.1400158e4
test al, al
je 0x14001d72d
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ext_ms_win_cmd_util_l1_1_0.dll_WNetGetConnectionWStub]
mov dword [rsp + 0x30], eax
jmp 0x14001d735
mov dword [rsp + 0x30], 0x78
jmp 0x14001d75c
cmp dword [rsp + 0x30], esi
je 0x14001d793
cmp dword [rsp + 0x30], 0x8ca
je 0x140002011
movsxd rdx, r14d
lea r8, str.Unknown
mov rcx, rdi
call fcn.140011b7c
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], si
jne 0x14001d785
jmp 0x140001ffd
movsxd rdx, r14d
lea r9, [rsp + 0xa0]
lea r8, [0x140029528]
mov rcx, rdi
call fcn.140011b7c
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], si
jne 0x14001d7b0
jmp 0x140001ffd
cmp byte [0x140046d39], sil
je 0x140002011
mov ecx, dword [0x140046d80]
cmp r14d, 1
jle 0x140002011
mov eax, ecx
dec ecx
test eax, eax
je 0x140002011
mov eax, 0x2b
mov word [rdi], ax
add rdi, 2
mov qword [rsp + 0x28], rdi
dec r14d
mov dword [rsp + 0x20], r14d
jmp 0x14001d7d1
movsxd rdx, r14d
lea r8, [0x1400283c0]
mov rcx, rdi
call fcn.14000dc10
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], si
jne 0x14001d817
jmp 0x140001ffd
movsxd rdx, r14d
mov rcx, rdi
cmp word [rsp + 0x34], si
lea r8, str._b_b___b_b
jne 0x14001d840
lea r8, [0x1400292f8]
call fcn.14000dc10
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], si
jne 0x14001d848
jmp 0x140001ffd
lea rcx, [rsp + 0x60]
call fcn.140001008
lea rdx, [rsp + 0x60]
mov ecx, 0x2350
call fcn.140002b44
mov rbx, rax
movsxd rdx, r14d
mov r9, rax
lea r8, [0x140028a48]
mov rcx, rdi
call fcn.140011b7c
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], si
jne 0x14001d893
jmp 0x140001ffd
mov r9d, r14d
mov r8, rdi
mov edx, 1
xor ecx, ecx
call fcn.140002ba0
jmp 0x14001d8c7
mov r9d, r14d
mov r8, rdi
mov edx, 1
xor ecx, ecx
call fcn.1400020c8
movsxd rcx, eax
sub r14d, eax
lea rdi, [rdi + rcx*2]
jmp 0x140002007
lea r9, [0x140032600]
lea r8, [0x1400293c0]
mov rdx, r14
mov rcx, r13
call fcn.140011b7c
or r12, 0xffffffffffffffff
mov rax, r12
inc rax
cmp word [r13 + rax*2], si
jne 0x14001d8f6
cdqe
lea rdi, [rax*2]
add rdi, r13
jmp 0x140002068