Function at 0x140025880
Capabilities:
Get disk information
Get disk size

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x120], xmm6
mov qword [rbp + 0x118], 0xfffffffffffffffe
mov rsi, rcx
xor ecx, ecx
xor edx, edx
call sub.KERNEL32.dll_GetLogicalDriveStringsW
mov r14d, eax
mov ebx, eax
test eax, eax
mov qword [rbp + 0xc8], rbx
je 0x1400258ef
lea rdi, [rbx + rbx]
movzx eax, byte [0x140331341]
mov edx, 2
mov rcx, rdi
call fcn.140022d40
test rax, rax
je 0x14002606e
mov rdx, rax
jmp 0x1400258f4
mov edx, 2
mov dword [rbp + 0x104], r14d
mov ecx, r14d
mov qword [rbp + 0xd0], rdx
call sub.KERNEL32.dll_GetLogicalDriveStringsW
inc eax
cmp eax, dword [rbp + 0x104]
jne 0x140025f14
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 8
mov qword [rbp + 0xc0], 0
lea r13, [rbp + 0x20]
xor edi, edi
xorps xmm6, xmm6
mov r14, qword [rbp + 0xc8]
mov rbx, qword [rbp + 0xd0]
mov rax, r14
mov r8, rbx
mov ecx, edi
jmp 0x14002596f
mov dil, 1
xor eax, eax
mov r8, r12
xor edx, edx
test rdx, rdx
jne 0x1400259e0
test cl, cl
jne 0x140025f76
mov r12, r8
mov cl, 1
test rax, rax
je 0x140025960
lea r9, [rax + rax]
mov r8, 0xfffffffffffffffe
xor edx, edx
nop
cmp word [r12 + rdx*2], 0
je 0x1400259c0
inc rdx
lea r10, [r9 + r8]
add r10, 0xfffffffffffffffe
add r8, 0xfffffffffffffffe
cmp r10, 0xfffffffffffffffe
jne 0x140025990
mov dil, 1
mov r8, r12
mov rdx, rax
jmp 0x14002596a
mov r14, rdx
not r14
add r14, rax
mov rbx, r12
sub rbx, r8
xor ecx, ecx
mov rax, r14
mov r8, rbx
jmp 0x14002596a
test r12, r12
je 0x140025f76
lea rax, [r12 + rdx*2]
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], rax
mov word [rbp - 0x18], 0
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
call fcn.140025240
movzx eax, byte [0x140331341]
mov ecx, 0x1fe
mov edx, 2
call fcn.140022d40
mov qword [rbp + 0x108], rax
test rax, rax
je 0x14002609d
movzx eax, byte [0x140331341]
mov ecx, 0x1fe
mov edx, 2
call fcn.140022d40
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x14002608c
movzx eax, byte [0x140331341]
mov ecx, 0x3fc
mov edx, 4
call fcn.140022d40
test rax, rax
je 0x14002607b
mov r9, rax
mov dword [rbp + 0xf0], 0
mov dword [rbp + 0x78], 0
mov rax, qword [rbp + 0xe8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0xff
mov rcx, r12
mov rdx, qword [rbp + 0x108]
mov r8d, 0xff
mov qword [rbp + 0x70], r9
call sub.KERNEL32.dll_GetVolumeInformationW
test eax, eax
je 0x140025c59
mov eax, dword [rbp + 0xf0]
mov dword [rbp + 0xf4], eax
mov rax, qword [rbp + 0xe8]
add rax, 0xfffffffffffffffe
nop dword [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140025af0
mov rcx, qword [rbp + 0xe8]
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rax
mov word [rbp - 0x18], 0
lea rcx, [rbp + 0x58]
lea rdx, [rbp - 0x28]
call fcn.140025240
mov rax, qword [rbp + 0x108]
add rax, 0xfffffffffffffffe
nop dword [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140025b30
mov rcx, qword [rbp + 0x108]
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rax
mov word [rbp - 0x18], 0
lea rcx, [rbp + 0x80]
lea rdx, [rbp - 0x28]
call fcn.140025240
mov r15, qword [rbp + 0x58]
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xa0], rax
mov edx, 0x3fc
mov r8d, 4
mov rcx, qword [rbp + 0x70]
call fcn.140022d50
mov edx, 0x1fe
mov r8d, 2
mov rcx, qword [rbp + 0xe8]
call fcn.140022d50
mov edx, 0x1fe
mov r8d, 2
mov rcx, qword [rbp + 0x108]
call fcn.140022d50
movabs rax, 0x8000000000000000
cmp r15, rax
je 0x140025fa4
mov qword [rbp + 0x108], r15
cmp dword [rbp + 0xf4], 0
je 0x140025d31
mov byte [rbp + 0x116], 0
mov rcx, r12
lea rdx, [rbp + 0x78]
lea r8, [rbp + 0x58]
lea r9, [rbp - 0x28]
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
mov r11, qword [rbp + 0xa0]
mov r10, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0xf4]
je 0x140025fbe
mov rax, qword [rbp + 0x78]
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp - 0x28]
mov r8d, r8d
jmp 0x140025d48
mov rcx, r12
call sub.KERNEL32.dll_GetDriveTypeW
cmp eax, 2
je 0x140025e38
cmp eax, 5
jne 0x140025ef1
mov eax, dword [rbp + 0xf0]
mov dword [rbp + 0xf4], eax
movzx eax, byte [0x140331341]
mov ecx, 5
mov edx, 1
call fcn.140022d40
test rax, rax
je 0x1400260b5
mov byte [rax + 4], 0x4d
mov qword [rbp + 0xf8], rax
mov dword [rax], 0x4f524443
mov rax, qword [rbp + 0x108]
add rax, 0xfffffffffffffffe
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140025cc0
mov rcx, qword [rbp + 0x108]
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rax
mov word [rbp - 0x18], 0
lea rcx, [rbp + 0x80]
lea rdx, [rbp - 0x28]
call fcn.140025240
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xa0], rax
mov eax, 5
mov qword [rbp + 0xa8], rax
mov r15d, 5
jmp 0x140025ba4
xor edx, edx
xor eax, eax
xor ecx, ecx
xor r8d, r8d
mov r11, qword [rbp + 0xa0]
mov r10, qword [rbp + 0xa8]
mov r9, qword [rbp - 0x30]
mov qword [rbp + 0x90], r9
movups xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp + 0x80], xmm0
mov r15, qword [rbp + 0x108]
mov qword [rbp - 0x28], r15
mov r12, qword [rbp + 0xf8]
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r10
mov r10, qword [rbp + 0xe0]
mov qword [rbp - 0x10], r10
mov r10, qword [rbp + 0xd8]
mov qword [rbp - 8], r10
mov qword [rbp], r11
mov qword [r13 - 8], r9
movups xmmword [r13 - 0x18], xmm0
movups xmmword [r13], xmm6
mov qword [r13 + 0x10], 0
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], r8
mov r12, qword [rbp + 0xc0]
cmp r12, qword [rbp + 0xb0]
jne 0x140025dd4
lea rcx, [rbp + 0xb0]
call fcn.1400257d0
mov rax, qword [rbp + 0xb8]
mov rcx, r12
shl rcx, 7
movups xmm0, xmmword [rbp + 0x48]
movups xmmword [rax + rcx + 0x70], xmm0
movups xmm0, xmmword [rbp + 0x38]
movups xmmword [rax + rcx + 0x60], xmm0
movups xmm0, xmmword [rbp + 0x28]
movups xmmword [rax + rcx + 0x50], xmm0
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rax + rcx + 0x40], xmm0
movups xmm0, xmmword [rbp - 0x28]
movups xmm1, xmmword [rbp - 0x18]
movups xmm2, xmmword [rbp - 8]
movups xmm3, xmmword [rbp + 8]
movups xmmword [rax + rcx + 0x30], xmm3
movups xmmword [rax + rcx + 0x20], xmm2
movups xmmword [rax + rcx + 0x10], xmm1
movups xmmword [rax + rcx], xmm0
inc r12
mov qword [rbp + 0xc0], r12
jmp 0x140025950
mov eax, dword [rbp + 0xf0]
mov dword [rbp + 0xf4], eax
movzx eax, byte [0x140331341]
mov ecx, 3
mov edx, 1
call fcn.140022d40
test rax, rax
je 0x1400260c6
mov byte [rax + 2], 0x4d
mov qword [rbp + 0xf8], rax
mov word [rax], 0x4552
mov rax, qword [rbp + 0x108]
add rax, 0xfffffffffffffffe
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140025e80
mov rcx, qword [rbp + 0x108]
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rax
mov word [rbp - 0x18], 0
lea rcx, [rbp + 0x80]
lea rdx, [rbp - 0x28]
call fcn.140025240
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xa0], rax
mov eax, 3
mov qword [rbp + 0xa8], rax
mov r15d, 3
jmp 0x140025ba4
call fcn.1401e2760
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xf8], rax
movabs r15, 0x8000000000000000
jmp 0x140025ba4
call fcn.1401e2760
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0xd0]
mov eax, dword [rbp + 0x104]
test eax, eax
je 0x140025f58
add rdx, rdx
mov r8d, 2
call fcn.140022d50
mov rax, rsi
movaps xmm6, xmmword [rbp + 0x120]
add rsp, 0x1b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [rbp + 0xc0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp + 0xb0]
movups xmmword [rsi], xmm0
cmp dword [rbp + 0x104], 0
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0xd0]
jne 0x140025f4a
jmp 0x140025f58
mov rax, qword [rbp + 0xf8]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x14002601f
mov byte [rbp + 0x116], 0
call fcn.1401e2760
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0xe0]
test rdx, rdx
je 0x140026001
mov r8d, 1
mov rcx, qword [rbp + 0xd8]
call fcn.140022d50
mov rdx, qword [rbp + 0x108]
test rdx, rdx
je 0x14002601f
mov r8d, 1
mov rcx, qword [rbp + 0xf8]
call fcn.140022d50
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x140026037
mov rcx, qword [rbp - 0x38]
mov r8d, 1
call fcn.140022d50
lea rcx, [rbp + 0xb0]
call fcn.140023620
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
je 0x140025f32
mov rcx, qword [rbp + 0xb8]
shl rdx, 7
mov r8d, 8
call fcn.140022d50
jmp 0x140025f32
mov ecx, 2
mov rdx, rdi
call fcn.140215f80
mov ecx, 4
mov edx, 0x3fc
call fcn.140215f80
jmp 0x1400260d5
mov ecx, 2
mov edx, 0x1fe
call fcn.140215f80
jmp 0x1400260d5
mov byte [rbp + 0x117], 0
mov ecx, 2
mov edx, 0x1fe
call fcn.140215f80
jmp 0x1400260d5
mov ecx, 1
mov edx, 5
call fcn.140215f80
jmp 0x1400260d5
mov ecx, 1
mov edx, 3
call fcn.140215f80
ud2