Function at 0x1400b46b0
Capabilities:
Get disk information
Inspect section memory permissions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov qword [rsp + 0x300], rbx
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbp, rdx
mov qword [rsp + 0xd0], rdx
mov rdi, rcx
mov qword [rsp + 0xb0], rcx
lea r14, [0x14019cf18]
mov qword [rsp + 0xe0], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov bx, word [rbp]
mov esi, ebx
movsx eax, bl
mov word [rbp], ax
xor r12d, r12d
mov dword [rsp + 0xa8], r12d
lea edx, [r12 + 0x64]
lea rcx, [rsp + 0x78]
call fcn.140063580
nop
xor al, al
movzx eax, al
mov r13d, 1
and esi, 0x100
cmovne eax, r13d
mov ecx, 0x200
test cx, bx
je 0x1400b4762
or al, r13b
or al, r13b
mov dword [rsp + 0x90], eax
mov rcx, rdi
call fcn.14005ec10
test ax, ax
je 0x1400b4797
lea rcx, [rsp + 0x78]
call fcn.14005b520
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x40000000
jmp 0x1400b4e73
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea r11, [rsp + 0xf0]
mov eax, dword [0x140153b84]
mov dword [r11], eax
movzx eax, word [0x140153b88]
mov word [r11 + 4], ax
movabs rax, 0x5c003a0043
mov qword [rsp + 0xf8], rax
mov edx, 0x20010e
lea rcx, [rsp + 0x88]
call fcn.1400632b0
nop
mov rdi, qword [rsp + 0x88]
xor edx, edx
mov r8d, 0x10e
lea rcx, [rdi + 0x100000]
call fcn.14010c6c0
cmp word [rbp], 0
setne bl
mov byte [rsp + 0x44], bl
mov word [rbp], r12w
xor r8d, r8d
mov rdx, rdi
lea rcx, [rdi + 0x100000]
call fcn.1400686b0
movzx r11d, bl
neg r11b
sbb ebp, ebp
and ebp, 0x3e80
mov dword [rsp + 0x48], ebp
mov r14d, r13d
or eax, 0xffffffff
test bl, bl
cmovne r14d, eax
mov dword [rsp + 0xb8], r14d
mov r13d, r12d
movsxd rax, esi
mov qword [rsp + 0xd8], rax
cmp ebp, 0x3e80
jge 0x1400b4e4b
mov rbx, qword [rsp + 0x78]
test ebp, ebp
js 0x1400b4e4b
mov r8d, ebp
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 3]
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
cmove r12, rsi
mov qword [rsp + 0x80], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r12, r12
je 0x1400b4de8
mov r13d, esi
mov dword [rsp + 0x50], esi
lea rdx, [rsp + 0xa8]
mov rcx, r12
call fcn.140069340
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0x40], esi
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, r12
call fcn.14005f290
test rax, rax
jne 0x1400b4930
cmp r12, 0xffffffffffffffff
je 0x1400b4df8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b4df8
lea rcx, [rax + 0x30]
mov qword [rsp + 0x68], rcx
cmp dword [rax], 1
sete sil
mov r13d, dword [rax + 0x28]
mov dword [rsp + 0xa0], r13d
mov rcx, r12
call fcn.14005ec80
movsxd r9, eax
mov dword [rsp + 0x60], r9d
lea rcx, [r9 + rdi + 0x10010e]
lea r11, [r9 + rcx]
mov qword [rsp + 0xc0], r11
test esi, esi
je 0x1400b49a4
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r8d, r13d
lea rdx, [rdi + 0x10010e]
lea rcx, [rsp + 0x80]
call fcn.140068cf0
mov r9d, dword [rsp + 0x60]
mov r11, qword [rsp + 0xc0]
cmp byte [rsp + 0x44], 0
je 0x1400b49ba
mov edx, dword [rsp + 0x40]
lea r13d, [rdx - 1]
mov dword [rsp + 0x4c], r13d
jmp 0x1400b49c6
xor r13d, r13d
mov dword [rsp + 0x4c], r13d
mov edx, dword [rsp + 0x40]
movsxd rax, r13d
movsxd rcx, r14d
movsxd r8, esi
mov qword [rsp + 0x70], r8
cmp r13d, edx
jge 0x1400b4dd2
lea rsi, [rcx + rcx*8]
shl rsi, 4
mov qword [rsp + 0x58], rsi
lea rax, [rax + rax*8]
add rax, rax
mov r10, qword [rsp + 0x68]
lea rsi, [r10 + rax*8 + 0x18]
mov qword [rsp + 0x98], rsi
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
nop dword [rax]
test r8, r8
je 0x1400b4a1d
mov r14d, 0xff07
jmp 0x1400b4a22
movzx r14d, byte [rsi + 8]
movsx esi, word [rsi]
test r8, r8
jne 0x1400b4a47
test r14d, r14d
je 0x1400b4d91
cmp r14d, 5
je 0x1400b4d91
cmp r14d, 0xf
je 0x1400b4d91
mov rax, qword [rsp + 0x98]
cmp qword [rax - 8], 0x200
jg 0x1400b4aa8
test r14b, 0x10
je 0x1400b4d87
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov eax, 1
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, esi
mov edx, ebp
lea rcx, [rdi + 0x100000]
call fcn.14005ecf0
mov r8, qword [rsp + 0x70]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
mov r10, qword [rsp + 0x68]
jmp 0x1400b4d91
mov rdx, qword [rsp + 0xc8]
cmp qword [rax - 0x10], rdx
je 0x1400b4d8d
or r12d, 0xffffffff
xor eax, eax
movzx ecx, ax
nop word [rax + rax]
movsx rax, cx
lea rdx, [rax + rax*4]
movsx eax, word [rdi + rdx*2 + 0x100002]
cmp eax, ebp
jne 0x1400b4af0
movsx eax, word [rdi + rdx*2 + 0x100000]
cmp eax, esi
je 0x1400b4afb
inc cx
cmp cx, 0x1a
jge 0x1400b4aff
jmp 0x1400b4ad0
movzx r12d, cx
xor eax, eax
movzx ebp, ax
test r8, r8
je 0x1400b4b2c
movsxd rax, r13d
lea rcx, [rax + rax*8]
shl rcx, 4
add rcx, r10
mov r8d, dword [rsp + 0xa0]
mov rdx, r11
call fcn.140068b60
mov r13d, eax
jmp 0x1400b4b4b
cmp r13d, 3
jg 0x1400b4b38
lea eax, [r13 + 1]
jmp 0x1400b4b47
mov eax, r13d
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 4
movsx r13d, ax
test r12w, r12w
jns 0x1400b4c17
mov r9d, esi
movsx r8d, word [rsp + 0x48]
lea rdx, str.DeviceHarddisk_dPartition_d
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xa4], eax
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov r8b, 0xff
lea rcx, [rsp + 0xa4]
call fcn.14005ebb0
mov bp, ax
mov word [rsp + 0xf8], ax
mov word [rsp + 0xf0], ax
mov rax, qword [rsp + 0xb0]
mov word [rax], bp
or eax, 0xffffffff
test bp, bp
je 0x1400b4be4
mov eax, dword [rsp + 0x90]
mov byte [rsp + 0x20], al
xor r9d, r9d
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.140068190
movzx r8d, bp
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r13d
mov r9d, dword [rsp + 0x48]
lea rdx, str.MOUN__show_to__c____d_d__0x_lX___d_r_n
lea rcx, [0x14019c170]
call fcn.14002b694
mov rcx, qword [rsp + 0xb0]
jmp 0x1400b4c32
movsx rax, r12w
lea rcx, [rax + rax*4]
movzx eax, word [rdi + rcx*2 + 0x100008]
mov rcx, qword [rsp + 0xb0]
mov word [rcx], ax
test r12w, r12w
jns 0x1400b4c5c
cmp qword [rsp + 0xd8], 0
je 0x1400b4c5c
test r14b, 0x10
je 0x1400b4c5c
cmp r14d, 0x10
je 0x1400b4c5c
test bp, bp
je 0x1400b4c5c
mov r12d, 1
jmp 0x1400b4c61
xor eax, eax
mov r12d, eax
mov esi, r13d
shl esi, 0x10
movzx eax, r14b
or esi, eax
call fcn.1400cf470
test eax, eax
je 0x1400b4d3e
test r12d, r12d
je 0x1400b4d0c
mov eax, r14d
and eax, 0xffffffef
mov dword [rsp + 0x20], eax
mov r9d, r13d
mov r12d, dword [rsp + 0x48]
mov r8d, r12d
lea rdx, str.PART__up__super__d_d_0x_X
lea rcx, [rsp + 0x100]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r8d, r8d
lea rdx, [rsp + 0x108]
lea rcx, [0x14019c170]
call fcn.1400921c0
mov dword [rsp + 0x20], r14d
mov r9d, r13d
mov r8d, r12d
lea rdx, str.PART___super__d_d_0x_X
lea rcx, [rsp + 0x100]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r8d, r8d
lea rdx, [rsp + 0x108]
lea rcx, [0x14019c170]
call fcn.1400921c0
mov r11d, r12d
shl r11d, 8
add r11d, 0x100
or esi, r11d
mov rax, qword [rsp + 0xd0]
mov word [rax], bp
test bp, bp
jne 0x1400b4e0c
mov r13d, dword [rsp + 0x4c]
mov ebp, dword [rsp + 0x48]
mov r8, qword [rsp + 0x70]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
mov r10, qword [rsp + 0x68]
jmp 0x1400b4d91
test bp, bp
je 0x1400b4d69
movzx ecx, bp
call fcn.14005d290
mov r13d, dword [rsp + 0x4c]
mov ebp, dword [rsp + 0x48]
mov r8, qword [rsp + 0x70]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
mov r10, qword [rsp + 0x68]
jmp 0x1400b4d91
mov r13d, dword [rsp + 0x4c]
mov ebp, dword [rsp + 0x48]
mov r8, qword [rsp + 0x70]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
mov r10, qword [rsp + 0x68]
jmp 0x1400b4d91
mov eax, dword [rsp + 0x40]
jmp 0x1400b4d91
mov eax, dword [rsp + 0x40]
mov r14d, dword [rsp + 0xb8]
add r13d, r14d
mov dword [rsp + 0x4c], r13d
mov rsi, qword [rsp + 0x98]
add rsi, rcx
mov qword [rsp + 0x98], rsi
cmp r13d, eax
mov r9d, dword [rsp + 0x60]
mov r11, qword [rsp + 0xc0]
jl 0x1400b4a10
mov r12, qword [rsp + 0x80]
cmp r12, 0xffffffffffffffff
je 0x1400b4df3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13d, dword [rsp + 0x50]
jmp 0x1400b4df8
inc r13d
cmp r13d, 0x20
jge 0x1400b4e4b
jmp 0x1400b4df8
mov r13d, dword [rsp + 0x50]
add ebp, r14d
mov dword [rsp + 0x48], ebp
cmp ebp, 0x3e80
jge 0x1400b4e4b
jmp 0x1400b4864
mov rcx, qword [rsp + 0x80]
cmp rcx, 0xffffffffffffffff
je 0x1400b4e21
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
nop
lea rcx, [rsp + 0x78]
call fcn.14005b520
nop
lea rcx, [0x14019cf18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x1400b4e73
lea rcx, [rsp + 0x88]
call fcn.14005b520
nop
lea rcx, [rsp + 0x78]
call fcn.14005b520
nop
lea rcx, [0x14019cf18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x300]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret