Function at 0x100005090
Capabilities:
Get disk information
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x100011100]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
xor eax, eax
mov qword [rdx + 8], rdx
mov qword [rdx], rdx
or r12, 0xffffffffffffffff
mov rdi, rbx
mov rcx, r12
mov rbp, rdx
xor esi, esi
repne scasw ax, word [rdi]
xor r14d, r14d
xor r15d, r15d
not rcx
lea rdi, [rcx + rcx]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
lea edi, [rsi + 8]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x100005111
xor ebx, ebx
mov esi, edi
jmp 0x100005413
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
mov r8, rbx
not rcx
mov rdx, rcx
mov rcx, r9
call fcn.100003abc
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea rdx, [0x1000023b8]
mov r8, rbx
mov rcx, rbp
call fcn.10000565c
mov ebx, eax
test eax, eax
je 0x10000539a
mov cl, 1
call fcn.1000060f8
mov r14, rax
test rax, rax
jne 0x100005187
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x1000023d0]
lea ecx, [rbx + 4]
mov r8d, eax
mov esi, eax
call fcn.100006a9c
jmp 0x1000053a2
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea rdx, [0x100002438]
mov r8, r14
mov rcx, rbp
call fcn.10000565c
mov ebx, eax
test eax, eax
je 0x10000539a
mov edi, 1
lea rdx, [rsp + 0x50]
xor r9d, r9d
lea r8d, [rdi + 0x13]
lea ecx, [rdi + 0x59]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1000051d6
xor edi, edi
cmp dword [rsp + 0x60], 3
cmovl edi, dword [rsp + 0x60]
mov ecx, edi
sub ecx, 1
je 0x100005203
cmp ecx, 1
je 0x1000051ec
xor ebx, ebx
lea esi, [rbx + 0x1f]
jmp 0x1000053a2
lea r8, [0x100002448]
lea r12, [0x100002450]
lea r13, [0x100002478]
jmp 0x100005218
lea r8, [0x100002498]
lea r12, [0x1000024a8]
lea r13, [0x1000023a8]
lea rdx, [0x1000024b8]
mov rcx, rbp
call fcn.10000565c
mov ebx, eax
test eax, eax
je 0x10000539a
lea r8, [0x1000024c8]
lea rdx, [0x1000024d8]
mov rcx, rbp
call fcn.10000565c
mov ebx, eax
test eax, eax
je 0x10000539a
lea rdx, [0x1000024e8]
mov r8, r12
mov rcx, rbp
call fcn.10000565c
mov ebx, eax
test eax, eax
je 0x10000539a
lea rdx, [0x1000024f8]
mov r8, r13
mov rcx, rbp
call fcn.10000565c
mov ebx, eax
test eax, eax
je 0x10000539a
cmp edi, 1
jne 0x1000052ae
lea r8, [0x100002508]
lea rdx, [0x1000016e0]
mov rcx, rbp
call fcn.10000565c
mov ebx, eax
test eax, eax
je 0x10000539a
lea rdx, [0x100002510]
mov rcx, rbp
call fcn.1000057c4
mov r15, rax
test rax, rax
jne 0x1000052cc
xor ebx, ebx
jmp 0x10000539a
lea rdx, [rsp + 0x70]
mov r8d, 0x105
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x10000534e
and dword [rsp + 0x38], esi
and qword [rsp + 0x30], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov r12d, eax
test eax, eax
je 0x10000534e
test byte [rsp + 0x40], 8
jne 0x10000532b
xor r12d, r12d
lea ecx, [r12 + 0x32]
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r12d, r12d
je 0x10000534e
lea r8, [0x100002508]
lea rdx, [0x1000016f0]
mov rcx, rbp
call fcn.10000565c
mov ebx, eax
test eax, eax
jne 0x10000535d
jmp 0x10000539a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x32
jne 0x1000052c5
cmp edi, 2
jne 0x1000053a2
lea r8, [0x100002528]
lea rdx, [0x100002540]
mov rcx, rbp
call fcn.10000565c
mov ebx, eax
test eax, eax
je 0x10000539a
lea r8, [0x100002558]
lea rdx, [0x100002570]
mov rcx, rbp
call fcn.10000565c
mov ebx, eax
test eax, eax
jne 0x1000053a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14, r14
je 0x1000053d1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r15, r15
je 0x1000053ea
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x100005421
jmp 0x100005413
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov qword [rbp], rax
mov qword [rax + 8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp], rbp
jne 0x1000053f0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.10000a2e0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret