Function at 0x180013310
Capabilities:
Get disk information
Get disk size

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x700]
sub rsp, 0x800
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x850], rbx
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rbp + 0x6f0], rax
mov r13, rdx
mov r12, rcx
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
lea rcx, str.Shell32.dll
call fcn.1800429ec
mov r15, rax
movabs rsi, 0x7ffffffffffffffe
movabs r9, 0x7fffffffffffffff
lea r8, [rdi - 1]
mov r14, qword [rsp + 0x58]
cmp rax, r14
ja 0x1800133d8
lea rdi, [rsp + 0x40]
cmp r14, 8
cmovae rdi, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.Shell32.dll
mov rcx, rdi
call fcn.180039150
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x1800134cd
cmp r15, rsi
ja 0x180013b83
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x1800133f2
mov rbx, rsi
jmp 0x180013413
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180013408
mov rbx, rsi
jmp 0x180013413
lea rax, [rcx + r14]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r9
jbe 0x180013425
mov rdx, r8
jmp 0x18001342e
cmp rdx, 0x1000
jb 0x180013455
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.18003764c
test rax, rax
je 0x180013b89
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180013465
test rdx, rdx
je 0x180013465
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.Shell32.dll
mov rcx, rdi
call fcn.180039150
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x1800134c8
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800134c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013b8f
call fcn.180037644
mov qword [rsp + 0x40], rdi
call fcn.18001b4e0
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18001b580
mov rbx, rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180013524
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001351f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013b95
call fcn.180037644
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
test rbx, rbx
je 0x1800135ea
lea rdx, str.SHGetFileInfoW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1800135ea
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], di
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], di
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], di
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rbp + 0x10]
call fcn.1800395e0
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x1800135c6
mov rcx, qword [r12]
mov dword [rsp + 0x20], 0x610
mov r9d, 0x2b8
lea r8, [rbp + 0x10]
xor edx, edx
call rbx
test rax, rax
jne 0x1800135f1
lea rcx, [rbp - 0x70]
call fcn.180013bd0
xor al, al
jmp 0x180013b53
lea rcx, [rbp + 0x20]
call fcn.1800429ec
mov r15, rax
mov r14, qword [rbp - 0x58]
cmp rax, r14
ja 0x180013635
lea rdi, [rbp - 0x70]
cmp r14, 8
cmovae rdi, qword [rbp - 0x70]
mov qword [rbp - 0x60], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.180039150
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x18001373b
cmp r15, rsi
ja 0x180013b9b
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x18001364f
mov rbx, rsi
jmp 0x180013670
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180013665
mov rbx, rsi
jmp 0x180013670
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180013693
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x1800136a3
cmp rdx, 0x1000
jb 0x1800136ca
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003764c
test rax, rax
je 0x180013ba1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800136da
test rdx, rdx
je 0x1800136da
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.180039150
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x180013737
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013732
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013ba7
call fcn.180037644
mov qword [rbp - 0x70], rdi
lea rcx, [rbp + 0x228]
call fcn.1800429ec
mov r15, rax
mov r14, qword [rbp - 0x38]
cmp rax, r14
ja 0x180013787
lea rdi, [rbp - 0x50]
cmp r14, 8
cmovae rdi, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [rbp + 0x228]
mov rcx, rdi
call fcn.180039150
xor r15d, r15d
mov word [rbx + rdi], r15w
jmp 0x180013896
cmp r15, rsi
ja 0x180013bad
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x1800137a1
mov rbx, rsi
jmp 0x1800137c2
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x1800137b7
mov rbx, rsi
jmp 0x1800137c2
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x1800137e5
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x1800137f5
cmp rdx, 0x1000
jb 0x18001381c
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003764c
test rax, rax
je 0x180013bb3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180013830
test rdx, rdx
je 0x18001382b
mov rcx, rdx
call fcn.18003764c
jmp 0x18001382d
xor eax, eax
mov rdi, rax
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, [rbp + 0x228]
mov rcx, rdi
call fcn.180039150
xor r15d, r15d
mov word [rbx + rdi], r15w
cmp r14, 8
jb 0x180013892
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001388d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013bb9
call fcn.180037644
mov qword [rbp - 0x50], rdi
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x4e0]
call fcn.1800395e0
mov dword [rbp - 0x80], r15d
mov dword [rsp + 0x7c], r15d
mov dword [rsp + 0x78], r15d
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x2d0]
call fcn.1800395e0
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x1800138db
mov rcx, qword [r12]
mov dword [rsp + 0x38], 0x104
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov r8d, 0x104
lea rdx, [rbp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x180013af3
mov word [rbp + 0x4d8], r15w
lea rcx, [rbp + 0x2d0]
call fcn.1800429ec
mov rbx, rax
mov r14, qword [rbp - 0x18]
cmp rax, r14
ja 0x180013972
lea rdi, [rbp - 0x30]
cmp r14, 8
cmovae rdi, qword [rbp - 0x30]
mov qword [rbp - 0x20], rax
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call fcn.180039150
mov word [rbx + rdi], r15w
jmp 0x180013a77
cmp rbx, rsi
ja 0x180013bbf
mov rcx, rbx
or rcx, 7
cmp rcx, rsi
ja 0x1800139a6
mov rdx, r14
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp r14, rax
ja 0x1800139a6
lea rax, [r14 + rdx]
mov rsi, rcx
cmp rcx, rax
cmovb rsi, rax
lea rax, [rsi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x1800139c9
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x1800139d9
cmp rdx, 0x1000
jb 0x180013a00
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003764c
test rax, rax
je 0x180013bc5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180013a15
test rdx, rdx
je 0x180013a12
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
jmp 0x180013a15
mov rdi, r15
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call fcn.180039150
mov word [rbx + rdi], r15w
cmp r14, 8
jb 0x180013a73
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013a6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013b7d
call fcn.180037644
mov qword [rbp - 0x30], rdi
mov byte [rbp + 8], 1
mov dword [rsp + 0x6c], r15d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x74], r15d
mov dword [rsp + 0x70], r15d
cmp qword [r12 + 0x18], 8
jb 0x180013a9b
mov r12, qword [r12]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x6c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x180013b03
mov edx, dword [rsp + 0x68]
mov eax, edx
mov ecx, dword [rsp + 0x6c]
imul eax, ecx
mov dword [rbp - 0x10], eax
mov eax, dword [rsp + 0x70]
imul rax, rcx
imul rax, rdx
mov qword [rbp - 8], rax
mov eax, dword [rsp + 0x74]
imul rax, rcx
imul rax, rdx
mov qword [rbp], rax
jmp 0x180013b03
mov dword [rbp - 0x10], r15d
mov qword [rbp - 8], r15
mov qword [rbp], r15
mov byte [rbp + 8], 0
lea rdx, [rbp - 0x70]
mov rcx, r13
call fcn.1800077b0
lea rcx, [r13 + 0x20]
lea rdx, [rbp - 0x50]
call fcn.1800077b0
lea rcx, [r13 + 0x40]
lea rdx, [rbp - 0x30]
call fcn.1800077b0
mov eax, dword [rbp - 0x10]
mov dword [r13 + 0x60], eax
mov rax, qword [rbp - 8]
mov qword [r13 + 0x68], rax
mov rax, qword [rbp]
mov qword [r13 + 0x70], rax
movzx eax, byte [rbp + 8]
mov byte [r13 + 0x78], al
lea rcx, [rbp - 0x70]
call fcn.180013bd0
mov al, 1
mov rcx, qword [rbp + 0x6f0]
xor rcx, rsp
call fcn.180037620
mov rbx, qword [rsp + 0x850]
add rsp, 0x800
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180042974
nop
call fcn.180001eb0
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
nop
call fcn.180001eb0
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180001eb0
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180001eb0
int3
call fcn.180042974
int3