Function at 0x18000cb90
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x4e0]
sub rsp, 0x5e0
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov r14, rdx
mov r13, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
lea ecx, [rax + 1]
call fcn.18001ab88
lea rdx, [rbp + 0x170]
mov rcx, r13
mov r12, rax
xor eax, eax
mov qword [r12], rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x18000ce31
test byte [rbp + 0x170], 0x10
jne 0x18000ce31
mov qword [rsp + 0x620], rbx
mov rdx, r12
mov ecx, edi
mov qword [rsp + 0x5d8], rsi
mov qword [rsp + 0x5d0], r15
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x18000cd6a
xor r15d, r15d
mov esi, r15d
cmp byte [r12], sil
je 0x18000cd6a
mov rbx, r12
nop
movsxd rdi, esi
lea rdx, [0x180039b40]
add rdi, r12
mov rcx, rdi
call fcn.18001cd3c
test eax, eax
je 0x18000cd5a
lea rdx, [0x180039b44]
mov rcx, rdi
call fcn.18001cd3c
test eax, eax
je 0x18000cd5a
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x44]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x18000cd5a
mov eax, dword [rbp + 0x18c]
cmp dword [rsp + 0x44], eax
jne 0x18000cd5a
xor eax, eax
lea rcx, [rsp + 0x40]
mov r8, rdi
lea edx, [rax + 4]
mov dword [rsp + 0x40], eax
call fcn.18001d360
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
lea rax, [rsp + 0x40]
not rcx
mov byte [rcx + rax - 2], r15b
lea rcx, [0x180039b48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x18000cd5a
xor eax, eax
lea rcx, [rsp + 0x64]
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x50], rax
call fcn.180021060
lea rdx, str.ZwQueryInformationFile
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000cd51
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x48]
mov r9d, 0x20c
mov rcx, r13
mov dword [rsp + 0x20], 9
call rax
test eax, eax
je 0x18000cdb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rbx, 4
add esi, 4
cmp byte [rbx], r15b
jne 0x18000cc40
test r12, r12
je 0x18000cd77
mov rcx, r12
call fcn.18001c9dc
xor eax, eax
mov rsi, qword [rsp + 0x5d8]
mov rbx, qword [rsp + 0x620]
mov r15, qword [rsp + 0x5d0]
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.18001be70
add rsp, 0x5e0
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov eax, dword [rsp + 0x60]
lea rcx, [rbp + 0x1b0]
xor edx, edx
shr rax, 1
mov r8d, 0x30c
mov word [rsp + rax*2 + 0x64], r15w
call fcn.180021060
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x64]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x30b
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rbp + 0x1b0]
lea r9, [rsp + 0x40]
lea r8, str._s_s
mov qword [rsp + 0x20], rdx
mov edx, 0x410
mov rcx, r14
call fcn.18001cd84
mov eax, 1
jmp 0x18000cd79
xor eax, eax
jmp 0x18000cd91