Function at 0x1400053e0
Capabilities:
Enumerate disk volumes
Get disk information via ioctl

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xb40
mov rbp, rcx
xor r12d, r12d
lea rcx, [rax - 0x8d8]
mov edx, 0x103
mov word [rax - 0x8d8], r12w
lea esi, [r12 + 2]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005670
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov word [rsp + rcx*2 + 0x26e], r12w
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r9d, r9d
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x270]
lea r8d, [r9 + 7]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005639
lea rcx, [rsp + 0x484]
xor edx, edx
mov r8d, 0x31c
mov dword [rsp + 0x480], r12d
call fcn.1400b93b0
xor r11d, r11d
xor ecx, ecx
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x54], r11d
mov dword [rsp + 0x58], r11d
call qword [sym.imp.KERNEL32.dll_SetLastError]
or dword [rsp + 0x54], 0xffffffff
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x480]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, rdi
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x90
call fcn.1400b93b0
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x90
call fcn.1400b93b0
or dword [rsp + 0x78], 0xffffffff
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x480]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov edx, 0x70048
mov rcx, rdi
mov dword [rsp + 0x28], 0x90
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp rdi, r12
je 0x14000556f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x170]
call fcn.1400a9350
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x1f0]
call fcn.1400a9350
cmp dword [rsp + 0x60], 1
lea rcx, [rsp + 0xf0]
jne 0x1400055b4
lea rdx, [rsp + 0x80]
xor r8d, r8d
call fcn.14004903c
jmp 0x1400055ca
movzx r8d, byte [rsp + 0x80]
lea rdx, [0x1400d6908]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, dword [rsp + 0x54]
lea rax, [rsp + 0x1f0]
lea r8, [rsp + 0x270]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x170]
lea rdx, str._r_n_s__d__d__d__s__s__s
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xf0]
lea rcx, [rsp + 0x7a0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
movsxd r11, esi
lea rdx, [rsp + r11*2 + 0x7a0]
mov rcx, rbp
call fcn.14004bfa8
mov esi, r12d
lea rdx, [rsp + 0x270]
mov r8d, 0x103
mov rcx, rbx
mov word [rsp + 0x270], r12w
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, r12d
jne 0x14000542e
cmp rbx, r12
je 0x140005670
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
lea r11, [rsp + 0xb40]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret