Function at 0x7ff344770e4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x870
mov rax, qword [0x7ff34484108]
xor rax, rsp
mov qword [rsp + 0x860], rax
lea rdx, [rsp + 0x20]
xor ebx, ebx
mov r12, r8
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x20]
cmp r8d, ebx
je 0x7ff34477329
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
cmp rax, rbx
je 0x7ff34477329
mov eax, dword [0x7ff34485588]
test al, 1
jne 0x7ff34477170
or eax, 1
lea rcx, [0x7ff3447ac24]
mov qword [0x7ff34485580], rbx
mov dword [0x7ff34485588], eax
call fcn.7ff34477c10
mov rax, qword [0x7ff34485580]
cmp rax, rbx
jne 0x7ff34477199
lea rcx, [0x7ff34447c88]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x7ff34485580], rax
cmp rax, rbx
je 0x7ff34477304
lea rdx, [0x7ff34447ca0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
je 0x7ff34477304
mov r14d, 0x104
mov rdx, r12
mov rcx, rsi
mov r8d, r14d
call rax
cmp eax, ebx
je 0x7ff34477304
lea rdx, [rsp + 0x450]
mov ecx, 0x207
mov word [rsp + 0x450], bx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, ebx
je 0x7ff34477304
mov eax, dword [0x7ff34447cbc]
lea rcx, [rsp + 0x24]
mov ebp, ebx
mov dword [rcx], eax
movzx eax, word [0x7ff34447cc0]
lea rdi, [rsp + 0x450]
mov word [rcx + 4], ax
movzx eax, word [rdi]
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x24]
mov r8d, r14d
mov word [rsp + 0x24], ax
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, ebx
je 0x7ff344772e9
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, r14d
jae 0x7ff344772e9
lea rdx, [rsp + 0x240]
mov r8d, eax
mov rcx, r12
mov r13d, eax
call sub.msvcrt.dll__wcsnicmp
mov ebp, ebx
cmp eax, ebx
sete bpl
cmp ebp, ebx
je 0x7ff344772e9
lea r8, [rsp + 0x24]
lea rax, [rsp + 0x30]
mov rdx, r14
sub r8, rax
lea rcx, [rsp + 0x30]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x7ff344772a7
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x7ff344772a7
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x7ff34477284
cmp rdx, rbx
jne 0x7ff344772b0
sub rcx, 2
mov word [rcx], bx
lea r8, [r12 + r13*2]
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.7ff3444bbcc
lea rcx, [rsp + 0x30]
mov r8d, r14d
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, ebx
jne 0x7ff344772e9
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, r12
call fcn.7ff3444bb58
movzx eax, word [rdi]
add rdi, 2
cmp ax, bx
jne 0x7ff344772e9
cmp ebp, ebx
jne 0x7ff3447731e
cmp word [rdi], bx
jne 0x7ff34477210
jmp 0x7ff3447731e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x7ff34477343
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.7ff344779c0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret