Function at 0x10005df24
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x160
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rsi, r8
mov rbp, rdx
lea r14, [0x1000091d0]
mov qword [rsp + 0x30], r14
lea r15, [0x10000bf20]
mov qword [rsp + 0x38], r15
lea rbx, [0x1000091b8]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], 0xd5d
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
xor r12d, r12d
mov word [rax - 0xb8], r12w
mov byte [rax - 0xb6], r12b
mov byte [rax - 0xb5], 1
xor edx, edx
lea r8d, [r12 + 0x78]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xf0]
call fcn.1000e842c
nop
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov rdi, rax
lea rax, [0x100008078]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rdi
cmp rdi, r12
jne 0x10005e063
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], 0xd61
mov dword [rsp + 0x4c], 2
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], r12w
mov byte [rsp + 0xd2], r12b
mov byte [rsp + 0xd3], 1
xor edx, edx
lea r8d, [r12 + 0x78]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
lea r8, [0x10000bf70]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xf0]
call fcn.1000ea04c
int3
mov qword [rsp + 0x1a8], 0xffffffffffb3b4c0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, 0x1f4
lea rdx, [rsp + 0x1a8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
cmp eax, r12d
jne 0x10005e102
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], 0xd66
mov dword [rsp + 0x4c], 2
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], r12w
mov byte [rsp + 0xd2], r12b
mov byte [rsp + 0xd3], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
lea r8, [0x10000bfc0]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xf0]
call fcn.1000ea04c
int3
mov ebx, r12d
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, r12d
jne 0x10005e1ab
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, r12d
jne 0x10005e13a
inc ebx
cmp ebx, 0x64
jl 0x10005e105
jmp 0x10005e1ab
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
lea rax, [0x1000091b8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0xd70
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], r12w
mov byte [rsp + 0xd2], r12b
mov byte [rsp + 0xd3], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
lea r8, [0x10000bff0]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xf0]
call fcn.1000ea04c
int3
cmp ebx, 0x64
jne 0x10005e227
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
lea rax, [0x1000091b8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0xd73
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], r12w
mov byte [rsp + 0xd2], r12b
mov byte [rsp + 0xd3], 1
xor edx, edx
lea r8d, [rbx + 0x14]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
lea r9, [0x10000c030]
mov r8d, 0x80042308
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xf0]
call fcn.1000e97ec
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xf0]
call fcn.1000e8518
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret