Function at 0x140009400
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
mov r15d, 0x104
mov esi, edx
mov rdi, rcx
mov qword [rbp + 0x388], r15
xor r14d, r14d
lea rcx, [rbp + 0x170]
mov bl, 1
mov qword [rbp + 0x378], r14
mov r8d, r15d
mov byte [rbp + 0x380], bl
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, r15d
mov qword [rbp + 0x158], r14
xor edx, edx
mov byte [rbp + 0x160], bl
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x168], r15
call sub.msvcrt.dll_memset
mov r8d, r15d
mov qword [rbp + 0x598], r14
xor edx, edx
mov byte [rbp + 0x5a0], bl
lea rcx, [rbp + 0x390]
mov qword [rbp + 0x5a8], r15
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x380]
lea rcx, [rbp + 0x170]
neg al
mov r12d, 0x7ee3
sbb rdx, rdx
and rdx, r12
add rdx, r15
call fcn.14000ca40
test eax, eax
js 0x14001b69a
mov al, byte [rbp + 0x160]
lea rcx, [rsp + 0x50]
neg al
sbb rdx, rdx
and rdx, r12
add rdx, r15
call fcn.14000ca40
test eax, eax
js 0x14001b69a
mov al, byte [rbp + 0x160]
lea rcx, [rsp + 0x50]
neg al
sbb rdx, rdx
and rdx, r12
add rdx, r15
call fcn.14000ca40
test eax, eax
js 0x14001b69a
mov rax, qword [rbp + 0x598]
lea r8, [rbp + 0x390]
mov r9d, dword [rbp + 0x5a8]
test rax, rax
mov edx, esi
mov dword [0x140045ba8], r14d
cmovne r8, rax
mov rcx, rdi
call fcn.140015ee4
test al, al
je 0x140009617
mov rax, qword [rbp + 0x598]
lea rdx, [rbp + 0x390]
test rax, rax
lea rcx, [rsp + 0x50]
cmovne rdx, rax
call fcn.14000b364
lea rdx, [0x140034540]
lea rcx, [rsp + 0x50]
call fcn.140008940
mov rax, qword [rbp + 0x378]
lea rdx, [rbp + 0x170]
test rax, rax
lea rcx, [rsp + 0x50]
cmovne rdx, rax
mov rax, qword [rbp + 0x158]
test rax, rax
cmovne rcx, rax
mov eax, dword [rbp + 0x388]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], r14
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
nop dword [rax + rax]
test eax, eax
je 0x14001b67a
mov rax, qword [rbp + 0x378]
lea rcx, [rbp + 0x170]
test rax, rax
lea rdx, [0x140034238]
cmovne rcx, rax
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14001b66a
mov bl, r14b
mov rcx, qword [rbp + 0x598]
test rcx, rcx
jne 0x14001b6a9
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r14
test rcx, rcx
je 0x140009649
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x378]
mov qword [rbp + 0x378], r14
test rcx, rcx
je 0x140009668
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov al, bl
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.140018f80
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
cmp dword [rsp + 0x40], 0xc
je 0x14000961a
jmp 0x140009617
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x90
cmove eax, r14d
mov dword [0x140045ba8], eax
jmp 0x140009617
mov dword [0x140045ba8], 8
jmp 0x140009617
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
nop
jmp 0x14000962a