Function at 0x1400dfa90
Capabilities:
Get disk information
Get disk size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa78]
sub rsp, 0xb78
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rbp + 0xa60], rax
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x44], r8d
mov rdi, rdx
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x640]
call fcn.1401a8d80
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.14000fcc0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
mov r8d, 0x105
lea rdx, [rbp + 0x640]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov esi, eax
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x1400dfb58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dfb53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e03a4
call fcn.1401853a0
xor ebx, ebx
test esi, esi
je 0x1400e0289
lea r14, [rdi + 0x10]
lea rax, [rbp + 0x640]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x1400dfb80
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 7
lea rdx, [rbp + 0x640]
lea rcx, [rsp + 0x50]
call fcn.14000b550
lea rax, [rsp + 0x50]
cmp r14, rax
je 0x1400dfbe0
mov rcx, r14
call fcn.140010b20
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [r14 + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x50], bx
jmp 0x1400dfbe5
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400dfc22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dfc1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e03aa
call fcn.1401853a0
lea rcx, [rbp + 0x640]
call qword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
mov dword [rdi + 0x74], eax
mov r15, qword [r14 + 0x10]
mov r13, r14
cmp qword [r14 + 0x18], 8
jb 0x1400dfc43
mov r13, qword [r14]
movabs rax, 0x7ffffffffffffffe
movabs rdx, 0x7fffffffffffffff
cmp r15, 8
jae 0x1400dfc76
movups xmm0, xmmword [r13]
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], 7
lea rcx, [rsp + 0x70]
jmp 0x1400dfcce
mov r12, r15
or r12, 7
cmp r12, rax
cmova r12, rax
mov rcx, r12
add rcx, 1
cmovb rcx, rsi
cmp rcx, rdx
ja 0x1400e03b0
lfence
add rcx, rcx
call fcn.140012d70
mov qword [rsp + 0x70], rax
lea r8, [r15*2 + 2]
mov rdx, r13
mov rcx, rax
call fcn.1401a9040
mov qword [rbp - 0x78], r12
lea rcx, [rsp + 0x70]
cmp r12, 8
cmovae rcx, qword [rsp + 0x70]
mov qword [rbp - 0x80], r15
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rdi + 0x78], eax
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400dfd1c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dfd17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e03b6
call fcn.1401853a0
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x430]
call fcn.1401a8d80
mov r15, qword [r14 + 0x10]
mov r13, r14
cmp qword [r14 + 0x18], 8
jb 0x1400dfd41
mov r13, qword [r14]
cmp r15, 8
jae 0x1400dfd5e
movups xmm0, xmmword [r13]
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x58], 7
lea rcx, [rbp - 0x70]
jmp 0x1400dfdc7
mov r12, r15
or r12, 7
movabs rax, 0x7ffffffffffffffe
cmp r12, rax
cmova r12, rax
mov rcx, r12
add rcx, 1
cmovb rcx, rsi
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400e03bc
lfence
add rcx, rcx
call fcn.140012d70
mov qword [rbp - 0x70], rax
lea r8, [r15*2 + 2]
mov rdx, r13
mov rcx, rax
call fcn.1401a9040
mov qword [rbp - 0x58], r12
lea rcx, [rbp - 0x70]
cmp r12, 8
cmovae rcx, qword [rbp - 0x70]
mov qword [rbp - 0x60], r15
mov r8d, 0x105
lea rdx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
mov r15d, eax
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1400dfe21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dfe1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e03c2
call fcn.1401853a0
test r15d, r15d
je 0x1400e0289
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
add rax, rax
cmp rax, 0x20a
jae 0x1400e039e
mov word [rbp + rax + 0x430], bx
lea rax, [rbp + 0x430]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400dfe60
lea r13, [rdi + 0x30]
lea rdx, [rbp + 0x430]
mov rcx, r13
call fcn.14000b550
mov r15, qword [r14 + 0x10]
mov rax, r14
mov qword [rsp + 0x48], rax
cmp qword [r14 + 0x18], 8
jb 0x1400dfe99
mov rax, qword [r14]
mov qword [rsp + 0x48], rax
cmp r15, 8
jae 0x1400dfeb4
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x38], 7
lea rcx, [rbp - 0x50]
jmp 0x1400dff1f
mov r12, r15
or r12, 7
movabs rax, 0x7ffffffffffffffe
cmp r12, rax
cmova r12, rax
mov rcx, r12
add rcx, 1
cmovb rcx, rsi
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400e03c8
lfence
add rcx, rcx
call fcn.140012d70
mov qword [rbp - 0x50], rax
lea r8, [r15*2 + 2]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.1401a9040
mov qword [rbp - 0x38], r12
lea rcx, [rbp - 0x50]
cmp r12, 8
cmovae rcx, qword [rbp - 0x50]
mov qword [rbp - 0x40], r15
lea r8, [rdi + 0x88]
lea rdx, [rdi + 0x7c]
mov qword [rsp + 0x20], r8
lea r9, [rdi + 0x8c]
lea r8, [rdi + 0x80]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r15d, eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x1400dff8a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dff85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e03ce
call fcn.1401853a0
test r15d, r15d
je 0x1400e0289
mov eax, dword [rdi + 0x7c]
imul eax, dword [rdi + 0x80]
mov dword [rdi + 0x84], eax
mov eax, dword [rdi + 0x88]
sub eax, dword [rdi + 0x8c]
mov dword [rdi + 0x90], eax
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x850]
call fcn.1401a8d80
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x220]
call fcn.1401a8d80
mov r12, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x1400dffeb
mov r14, qword [r14]
cmp r12, 8
jae 0x1400e0007
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x18], 7
lea rcx, [rbp - 0x30]
jmp 0x1400e0070
mov r15, r12
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
mov rcx, r15
add rcx, 1
cmovb rcx, rsi
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400e03d4
lfence
add rcx, rcx
call fcn.140012d70
mov qword [rbp - 0x30], rax
lea r8, [r12*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.1401a9040
mov qword [rbp - 0x18], r15
lea rcx, [rbp - 0x30]
cmp r15, 8
cmovae rcx, qword [rbp - 0x30]
mov qword [rbp - 0x20], r12
lea rax, [rdi + 0x98]
lea r9, [rdi + 0x70]
mov dword [rsp + 0x38], 0x82
lea rdx, [rbp + 0x220]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r8d, 0x82
lea rdx, [rbp + 0x850]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov r14d, eax
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400e00f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e00ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e0398
call fcn.1401853a0
test r14d, r14d
je 0x1400e0289
cmp word [rbp + 0x850], 0
je 0x1400e012d
lea rax, [rbp + 0x850]
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400e0110
lea rcx, [rdi + 0x50]
mov r8, rsi
lea rdx, [rbp + 0x850]
call fcn.14000b550
cmp qword [r13 + 0x18], 8
jb 0x1400e0138
mov r13, qword [r13]
mov qword [rsp + 0x30], rbx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, dword [rsp + 0x44]
mov edx, 0x80000000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov rcx, qword [rdi]
cmp rcx, 0xffffffffffffffff
je 0x1400e0176
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rdi], rsi
cmp rsi, 0xffffffffffffffff
je 0x1400e0289
mov dword [rdi + 0x94], ebx
lea rdx, [0x140248560]
lea rcx, [rbp + 0x220]
call fcn.1401c83b0
test eax, eax
jne 0x1400e01b1
mov dword [rdi + 0x94], 1
mov al, 1
jmp 0x1400e028b
lea rdx, [0x140248558]
lea rcx, [rbp + 0x220]
call fcn.1401c83b0
test eax, eax
je 0x1400e0259
lea rdx, str.FAT32
lea rcx, [rbp + 0x220]
call fcn.1401c83b0
test eax, eax
je 0x1400e0259
lea rdx, str.exFAT
lea rcx, [rbp + 0x220]
call fcn.1401c83b0
test eax, eax
jne 0x1400e020b
mov dword [rdi + 0x94], 2
mov al, 1
jmp 0x1400e028b
lea rdx, str.HPFS
lea rcx, [rbp + 0x220]
call fcn.1401c83b0
test eax, eax
jne 0x1400e0230
mov dword [rdi + 0x94], 6
mov al, 1
jmp 0x1400e028b
lea rdx, str.CDFS
lea rcx, [rbp + 0x220]
call fcn.1401c83b0
test eax, eax
jne 0x1400e0391
mov dword [rdi + 0x94], 7
mov al, 1
jmp 0x1400e028b
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x20]
call fcn.1401a8d80
mov dword [rbp + 0x10], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [rdi + 0x94], 0
je 0x1400e02ae
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rcx, qword [rbp + 0xa60]
xor rcx, rsp
call fcn.140185380
add rsp, 0xb78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rdi]
cmp rcx, 0xffffffffffffffff
jne 0x1400e02be
mov ecx, 6
jmp 0x1400e0283
mov qword [rdi + 8], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400e0289
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x10]
mov r8d, 0x200
lea rdx, [rbp + 0x20]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e0289
cmp dword [rbp + 0x10], 0x200
jne 0x1400e0289
mov eax, 0xaa55
cmp word [rbp + 0x21e], ax
jne 0x1400e031a
movzx eax, byte [rbp + 0x20]
cmp al, 0xeb
jne 0x1400e0324
cmp byte [rbp + 0x22], 0x90
je 0x1400e0328
mov ecx, 0xd
jmp 0x1400e0283
cmp al, 0xe9
jne 0x1400e031a
movzx r8d, word [rbp + 0x2b]
movzx eax, word [rbp + 0x31]
shl eax, 5
dec eax
add eax, r8d
cdq
idiv r8d
movzx edx, word [rbp + 0x36]
test edx, edx
jne 0x1400e034c
mov edx, dword [rbp + 0x44]
test edx, edx
je 0x1400e031a
movzx ecx, byte [rbp + 0x30]
imul ecx, edx
movzx edx, word [rbp + 0x2e]
add eax, ecx
add eax, edx
imul eax, r8d
mov qword [rdi + 8], rax
mov eax, dword [rdi + 0x88]
cmp eax, 0xff5
jae 0x1400e0381
mov dword [rdi + 0x94], 3
mov al, 1
jmp 0x1400e028b
cmp eax, 0xfff5
sbb eax, eax
add eax, 5
mov dword [rdi + 0x94], eax
mov al, 1
jmp 0x1400e028b
call fcn.1401b3c00
int3
call fcn.140185d74
int3
call fcn.1401b3c00
int3
call fcn.1401b3c00
int3
call fcn.140008770
int3
call fcn.1401b3c00
int3
call fcn.140008770
int3
call fcn.1401b3c00
int3
call fcn.140008770
int3
call fcn.1401b3c00
int3
call fcn.140008770
int3