Function at 0x10005efcc
Capabilities:
Get disk information
Get system information on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x7c0
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x100176150]
xor rax, rsp
mov qword [rsp + 0x7b0], rax
mov r12, rdx
lea r15, [0x1000091d0]
mov qword [rsp + 0x40], r15
lea rdi, [0x10000c3b0]
mov qword [rsp + 0x48], rdi
lea rbx, [0x1000091b8]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], 0xe55
mov ebp, 1
mov dword [rsp + 0x5c], ebp
mov esi, 0xff
mov dword [rsp + 0x60], esi
xor r13d, r13d
mov word [r11 - 0x708], r13w
mov byte [r11 - 0x706], r13b
mov byte [rsp + 0xe3], bpl
xor edx, edx
lea r8d, [rbp + 0x77]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xf0]
call fcn.1000e8000
nop
xor r9d, r9d
mov r8d, 0x228
lea rdx, [rsp + 0x580]
lea ecx, [rbp + 0x11]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, r13d
je 0x10005f152
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], 0xe5f
mov dword [rsp + 0x5c], ebp
mov dword [rsp + 0x60], esi
mov word [rsp + 0xe0], r13w
mov byte [rsp + 0xe2], r13b
mov byte [rsp + 0xe3], bpl
xor edx, edx
lea r8d, [rbp + 0x77]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x10000c400]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xf0]
call fcn.1000e91dc
lea rdx, [0x100008440]
mov qword [rsp + 0x20], rdx
lea r9, [0x100008450]
lea r8d, [rsi - 0x55]
lea rdx, [0x100008420]
lea rcx, [rsp + 0xf0]
call fcn.1000e8634
nop
lea rcx, [rsp + 0xf0]
call fcn.1000e80ec
xor al, al
jmp 0x10005f379
lea rsi, [rsp + 0x580]
cmp dword [rsi + 4], r13d
je 0x10005f2c5
mov qword [rsp + 0x38], r13
lea rax, [0x100035878]
mov qword [rsp + 0x30], rax
lea rdx, [0x1000063a0]
lea rcx, [rsp + 0x30]
call fcn.1000612f4
mov rdx, qword [rsi + 0x18]
lea rcx, [rsp + 0x30]
call fcn.1000613b8
xor eax, eax
or rcx, 0xffffffffffffffff
mov rbx, qword [rsp + 0x38]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
cmp word [rbx + rcx*2 - 2], 0x5c
je 0x10005f1c9
lea rdx, [0x1000021a0]
lea rcx, [rsp + 0x30]
call fcn.1000613b8
mov rbx, qword [rsp + 0x38]
mov r8d, 0x104
lea rdx, [rsp + 0x370]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
cmp eax, r13d
je 0x10005f21c
mov r8d, 0x104
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, r13d
je 0x10005f21c
mov rdx, r12
lea rcx, [rsp + 0x160]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r13d
je 0x10005f24d
mov rdi, rsi
mov eax, dword [rsi]
add rsi, rax
cmp rbx, r13
je 0x10005f232
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x38], r13
lea rax, [0x10003a7e0]
mov qword [rsp + 0x30], rax
cmp rsi, rdi
je 0x10005f28f
jmp 0x10005f15a
lea rax, [0x100008430]
mov qword [rsp + 0x20], rax
lea r9, [0x100008450]
mov r8d, 0xaa
lea rdx, [0x100008420]
lea rcx, [rsp + 0xf0]
call fcn.1000e8634
nop
cmp rbx, r13
je 0x10005f28a
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
jmp 0x10005f369
lea rdx, [0x100008440]
mov qword [rsp + 0x20], rdx
lea r9, [0x100008450]
mov r8d, 0xaa
lea rdx, [0x100008420]
lea rcx, [rsp + 0xf0]
call fcn.1000e8634
nop
mov bpl, r13b
jmp 0x10005f369
mov qword [rsp + 0x40], r15
lea rax, [0x10000c3b0]
mov qword [rsp + 0x48], rax
lea rax, [0x1000091b8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0xe6b
mov dword [rsp + 0x5c], ebp
mov dword [rsp + 0x60], 0xff
mov word [rsp + 0xe0], r13w
mov byte [rsp + 0xe2], r13b
mov byte [rsp + 0xe3], bpl
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll_memset
lea r8, [0x10000c460]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xf0]
call fcn.1000e91dc
lea rdx, [0x100008440]
mov qword [rsp + 0x20], rdx
lea r9, [0x100008450]
mov r8d, 0xaa
lea rdx, [0x100008420]
lea rcx, [rsp + 0xf0]
call fcn.1000e8634
nop
mov bpl, r13b
lea rcx, [rsp + 0xf0]
call fcn.1000e80ec
mov al, bpl
mov rcx, qword [rsp + 0x7b0]
xor rcx, rsp
call fcn.100130830
lea r11, [rsp + 0x7c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret