Function at 0x14002d27c
Capabilities:
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x208
mov r13, qword [sym.imp.KERNEL32.DLL_GetTickCount64]
mov ebx, ecx
mov r12d, edx
mov byte [rsp + 0x60], 0
mov word [rsp + 0x5e], 0x3a3f
call r13
mov rcx, qword [0x14010e0f0]
xor r9d, r9d
xor r8d, r8d
mov rdi, qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x147
mov rsi, rax
call rdi
mov edx, 0x150
mov rcx, qword [0x14010e0f0]
xor r9d, r9d
movsxd r8, eax
call rdi
lea edx, [rax - 0x80]
mov r15d, eax
xor eax, eax
cmp edx, 0xffffff7e
ja 0x14002d54b
test r12d, r12d
je 0x14002d30a
mov r9d, 0xcce
xor r8d, r8d
xor edx, edx
mov ecx, 1
call fcn.14001d77b
mov ecx, r15d
call fcn.14000c8b2
mov r14, qword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
mov r8d, 0x104
lea rdi, [rax + 4]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xfc]
mov qword [rsp + 0x30], rax
mov rdx, rax
mov rcx, rdi
call r14
test eax, eax
jne 0x14002d349
mov edi, 1
jmp 0x14002d3c3
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x30]
mov edx, ebx
mov r9d, 1
mov r8d, 1
call fcn.1400263f7
mov rdx, qword [0x1400b1100]
mov edx, dword [rdx]
test edx, edx
jns 0x14002d384
cmp dx, 0x4c7
jne 0x14002d384
xor ebx, ebx
jmp 0x14002d52a
test al, al
je 0x14002d342
mov rdx, rdi
lea rcx, str.Found_potentially_blocking_process_es__against__s:
xor ebp, ebp
call fcn.140036717
lea rdi, [0x1400910a6]
cmp ebp, dword [0x14010ce78]
jae 0x14002d3c1
mov rax, qword [0x14010ce70]
mov edx, ebp
mov rcx, rdi
inc ebp
mov rdx, qword [rax + rdx*8]
call fcn.140036717
jmp 0x14002d3a0
xor edi, edi
mov eax, ebx
lea rbp, [rsp + 0x61]
mov ecx, r15d
add rax, rsi
mov rdx, rbp
lea r15, [0x14010ce70]
mov qword [rsp + 0x38], rax
call fcn.14000e2e1
mov al, byte [rbp]
test al, al
je 0x14002d427
mov byte [rsp + 0x5e], al
lea rax, [rsp + 0x5e]
mov rdx, qword [rsp + 0x30]
mov r8d, 0x104
mov qword [rsp + 0x48], rax
mov rcx, rax
call r14
test eax, eax
je 0x14002d4ff
mov rcx, r15
call fcn.140035366
call r13
mov rcx, qword [rsp + 0x38]
cmp rax, rcx
jb 0x14002d485
test r12d, r12d
je 0x14002d515
test edi, 1
jne 0x14002d507
lea r9, [rsp + 0x7c]
mov rcx, qword [0x14010e0f0]
mov r8d, pe_nt_image_headers64
mov rdx, r9
mov qword [rsp + 0x30], r9
call fcn.14002a381
mov ecx, 0xc3c
call fcn.14001d5c1
mov r9, qword [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 4
call fcn.14003dbd8
mov edi, eax
jmp 0x14002d50c
mov edx, dword [rsp + 0x38]
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8d, 1
mov rcx, qword [rsp + 0x30]
sub edx, eax
call fcn.1400263f7
mov rdx, qword [0x1400b1100]
mov edx, dword [rdx]
test edx, edx
jns 0x14002d4c1
cmp dx, 0x4c7
je 0x14002d37d
test al, 6
jne 0x14002d4c9
cmp al, 0x80
jne 0x14002d4ff
mov rdx, qword [rsp + 0x48]
lea rcx, str.Found_potentially_blocking_process_es__against__s
xor edi, edi
call fcn.140036717
cmp edi, dword [0x14010ce78]
jae 0x14002d4fd
mov rax, qword [r15]
mov edx, edi
lea rcx, [0x1400910a6]
inc edi
mov rdx, qword [rax + rdx*8]
call fcn.140036717
jmp 0x14002d4dc
xor edi, edi
inc rbp
jmp 0x14002d3e4
test r12d, r12d
je 0x14002d515
test edi, edi
jne 0x14002d52a
jmp 0x14002d37d
call r13
mov edx, eax
sub edx, esi
cmp edx, ebx
jae 0x14002d37d
add esi, ebx
sub esi, eax
mov ebx, esi
mov r9d, 0xc8a
xor r8d, r8d
xor edx, edx
mov ecx, 1
call fcn.14001d77b
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_free
mov eax, ebx
add rsp, 0x208
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret