Function at 0x140031c50
Capabilities:
Get disk information
Get disk size
Get storage device properties

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x448
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3c0], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp + 0x308], rdx
mov rcx, qword [rdx + 8]
mov qword [rbp + 0x380], rcx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov edi, eax
and eax, 0xfffffffe
cmp eax, 2
jne 0x140032007
lea rbx, [rbp - 0x32]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movaps xmmword [rbp + 0x340], xmm0
movaps xmmword [rbp + 0x330], xmm0
movaps xmmword [rbp + 0x320], xmm0
movaps xmmword [rbp + 0x310], xmm0
mov dword [rbp + 0x37c], 0
lea rax, [rbp + 0x310]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x37c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x380]
mov rdx, rbx
mov r8d, 0x105
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140031fd9
mov dword [rbp + 0x2f0], edi
mov qword [rbp + 0x358], rsi
mov eax, dword [rbp + 0x37c]
mov dword [rbp + 0x2f4], eax
mov ecx, 0x208
mov edx, 2
call fcn.140022d70
test rax, rax
je 0x140032857
mov r12, rax
mov dword [rbp + 0x2a8], 0
xor edi, edi
mov r14d, 0x104
lea rbx, [rbp + 0x2a8]
mov rsi, qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
lea r15, [rbp + 0x388]
nop word cs:[rax + rax]
mov qword [rbp + 0x3b0], r12
cmp edi, 0xa
mov qword [rbp + 0x3a8], r14
jae 0x140031ea2
mov rcx, qword [rbp + 0x380]
mov rdx, qword [rbp + 0x3b0]
mov r8d, r14d
mov r9, rbx
call rsi
test eax, eax
mov r14, qword [rbp + 0x3a8]
jne 0x140031ea2
call fcn.1400460d0
mov r13, rax
mov qword [rbp + 0x2d0], rax
mov dword [rbp + 0x2d8], edx
call fcn.1400460d0
mov r12d, edx
mov qword [rbp + 0x388], rax
mov dword [rbp + 0x390], edx
test rax, rax
je 0x140031e0a
mov rcx, r15
call fcn.1400460b0
mov r13, qword [rbp + 0x2d0]
test r13, r13
je 0x140031e1b
lea rcx, [rbp + 0x2d0]
call fcn.1400460b0
cmp r12d, 0x800700ea
jne 0x14003204d
mov r14d, dword [rbp + 0x2a8]
test r14, r14
je 0x140031e70
lea r13, [r14 + r14]
mov edx, 2
mov rcx, r13
call fcn.140022d70
test rax, rax
je 0x140032830
mov r12, rax
inc edi
mov rdx, qword [rbp + 0x3a8]
test rdx, rdx
jne 0x140031e88
jmp 0x140031d90
mov r12d, 2
inc edi
mov rdx, qword [rbp + 0x3a8]
test rdx, rdx
je 0x140031d90
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x3b0]
call fcn.140022d50
jmp 0x140031d90
mov qword [rbp + 0x388], 0
mov qword [rbp + 0x390], 8
mov qword [rbp + 0x398], 0
test r14, r14
je 0x1400322da
xor eax, eax
mov qword [rbp + 0x2c8], rax
movabs rsi, 0x3ffffffffffffffd
lea r15, [rbp + 0x388]
mov r12, qword [rbp + 0x3b0]
jmp 0x140031f2f
mov rax, r14
sub rax, r13
sub r12, rdi
mov rcx, qword [rbp + 0x390]
lea rdx, [rbx + rbx*2]
mov qword [rcx + rdx*8], r13
mov r8, qword [rbp + 0x2c0]
mov qword [rcx + rdx*8 + 8], r8
mov qword [rcx + rdx*8 + 0x10], r13
inc rbx
mov qword [rbp + 0x398], rbx
cmp r14, r13
mov r14, rax
je 0x140032023
cmp word [r12], 0
je 0x140032023
lea rax, [r14 + r14]
neg rax
mov ecx, 1
mov rdi, 0xfffffffffffffffe
nop
cmp rax, rdi
je 0x140032787
lea r13, [rcx + 1]
add rdi, 0xfffffffffffffffe
cmp word [r12 + rcx*2], 0
mov rcx, r13
jne 0x140031f50
lea rax, [r13 - 2]
cmp rax, rsi
ja 0x140032814
mov rbx, rdi
neg rbx
movzx eax, byte [0x140331341]
mov edx, 2
mov rcx, rbx
call fcn.140022d40
test rax, rax
je 0x140032803
mov qword [rbp + 0x2c0], rax
mov rcx, rax
mov rdx, r12
mov qword [rbp + 0x2a0], rbx
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rbp + 0x398]
cmp rbx, qword [rbp + 0x388]
jne 0x140031ef0
mov rcx, r15
call fcn.140038dc0
jmp 0x140031ef0
call fcn.1400460d0
mov qword [rbp + 0x390], rax
mov dword [rbp + 0x398], edx
mov qword [rbp + 0x388], 1
test rax, rax
je 0x140032007
lea rcx, [rbp + 0x390]
call fcn.1400460b0
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
jmp 0x14003235b
mov rax, qword [rbp + 0x398]
mov qword [rbp + 0x370], rax
movups xmm0, xmmword [rbp + 0x388]
movaps xmmword [rbp + 0x360], xmm0
mov rdx, qword [rbp + 0x3a8]
test rdx, rdx
jne 0x14003207a
jmp 0x14003208f
mov qword [rbp + 0x360], 0
mov qword [rbp + 0x368], 8
mov qword [rbp + 0x370], 0
mov rdx, qword [rbp + 0x3a8]
test rdx, rdx
je 0x14003208f
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x3b0]
call fcn.140022d50
mov r14, qword [rbp + 0x370]
test r14, r14
je 0x140032314
mov rax, qword [rbp + 0x308]
mov rdx, qword [rax + 0x10]
mov rcx, rdx
sub rcx, 2
jb 0x140032870
mov rdx, qword [rbp + 0x380]
lea rax, [rdx + rcx*2]
mov qword [rbp + 0x280], rdx
mov qword [rbp + 0x288], rax
mov qword [rbp + 0x260], 1
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x270], 1
mov word [rbp + 0x278], 0
mov byte [rbp + 0x3bd], 1
lea rcx, [rbp + 0x2a8]
lea rdx, [rbp + 0x260]
call fcn.140033e80
mov rax, qword [rbp + 0x2b0]
mov qword [rbp + 0x3a8], rax
mov byte [rbp + 0x3bf], 1
call fcn.140018590
mov byte [rbp + 0x3bf], 1
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov rcx, qword [rbp + 0x3a8]
xor edx, edx
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffe
jae 0x14003227b
mov qword [rbp + 0x3b0], rax
mov r15, qword [rbp + 0x368]
mov rcx, qword [r15 + 8]
mov qword [rbp + 0x2f8], 0
mov qword [rbp + 0x2d0], 0
mov byte [rbp + 0x3be], 1
lea rbx, [rbp + 0x2f8]
lea r9, [rbp + 0x2d0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140032394
mov r12, qword [rbp + 0x2f8]
test r12, r12
je 0x1400323d0
mov r13, qword [rbp + 0x2d0]
mov qword [rbp + 0x294], 7
mov byte [rbp + 0x29c], 0
mov dword [rbp + 0x300], 0
mov qword [rbp + 0x2f8], 0
mov dword [rbp + 0x378], 0
mov byte [rbp + 0x3be], 1
lea rax, [rbp + 0x378]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0xc
lea r8, [rbp + 0x294]
mov rcx, qword [rbp + 0x3b0]
mov edx, 0x2d1400
mov r9d, 0xc
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140032499
mov ebx, 2
cmp dword [rbp + 0x378], 0xc
jne 0x1400324da
xor ebx, ebx
cmp byte [rbp + 0x300], 0
sete bl
jmp 0x1400324da
mov byte [rbp + 0x3bf], 1
call fcn.1400460d0
mov dword [rbp + 0x398], edx
mov qword [rbp + 0x390], rax
mov qword [rbp + 0x388], 1
test rax, rax
je 0x1400322b7
lea rcx, [rbp + 0x390]
mov byte [rbp + 0x3bf], 1
call fcn.1400460b0
mov rax, qword [rbp + 0x358]
mov qword [rax], 0
mov qword [rax + 8], 8
mov qword [rax + 0x10], 0
jmp 0x140032442
mov rax, qword [rbp + 0x398]
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x388]
mov qword [rbp + 0x360], rax
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0x368], rax
mov r14, qword [rbp + 0x370]
test r14, r14
jne 0x14003209f
mov rax, qword [rbp + 0x358]
mov qword [rax], 0
mov qword [rax + 8], 8
mov qword [rax + 0x10], 0
mov rsi, qword [rbp + 0x368]
mov rax, qword [rbp + 0x360]
test rax, rax
je 0x14003235b
shl rax, 3
lea rdx, [rax + rax*2]
mov r8d, 8
mov rcx, rsi
call fcn.140022d50
mov rax, qword [rbp + 0x308]
mov rdx, qword [rax]
test rdx, rdx
je 0x14003237f
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x380]
call fcn.140022d50
nop
add rsp, 0x448
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov byte [rbp + 0x3be], 1
call fcn.1400460d0
mov qword [rbp + 0x390], rax
mov dword [rbp + 0x398], edx
mov qword [rbp + 0x388], 1
test rax, rax
je 0x1400323d0
lea rcx, [rbp + 0x390]
mov byte [rbp + 0x3be], 1
call fcn.1400460b0
mov rax, qword [rbp + 0x358]
mov qword [rax], 0
mov qword [rax + 8], 8
mov qword [rax + 0x10], 0
mov byte [rbp + 0x3bf], 1
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140032442
mov byte [rbp + 0x3bf], 1
call fcn.1400460d0
mov qword [rbp + 0x390], rax
mov dword [rbp + 0x398], edx
mov qword [rbp + 0x388], 1
test rax, rax
je 0x140032442
lea rcx, [rbp + 0x390]
mov byte [rbp + 0x3bf], 1
call fcn.1400460b0
mov rdx, qword [rbp + 0x2a8]
test rdx, rdx
je 0x140032463
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x3a8]
call fcn.140022d50
mov rsi, qword [rbp + 0x368]
lea rdi, [rsi + 8]
jmp 0x14003247d
add rdi, 0x18
dec r14
je 0x140032339
mov rdx, qword [rdi - 8]
test rdx, rdx
je 0x140032470
mov rcx, qword [rdi]
add rdx, rdx
mov r8d, 2
call fcn.140022d50
jmp 0x140032470
mov byte [rbp + 0x3be], 1
call fcn.1400460d0
mov qword [rbp + 0x390], rax
mov dword [rbp + 0x398], edx
mov qword [rbp + 0x388], 1
test rax, rax
je 0x1400324d5
lea rcx, [rbp + 0x390]
mov byte [rbp + 0x3be], 1
call fcn.1400460b0
mov ebx, 2
mov r8d, 2
mov eax, 0x20a
nop word cs:[rax + rax]
cmp word [rbp + r8*2 - 0x36], 0
je 0x14003251d
cmp word [rbp + r8*2 - 0x34], 0
je 0x140032523
cmp word [rbp + r8*2 - 0x32], 0
je 0x140032526
add r8, 3
add rax, 0xfffffffffffffffa
jne 0x1400324f0
mov r8d, 0x105
jmp 0x140032526
add r8, 0xfffffffffffffffe
jmp 0x140032526
dec r8
mov byte [rbp + 0x3be], 1
lea rcx, [rbp + 0x2d0]
lea rdx, [rbp - 0x32]
call fcn.1401d9170
cmp word [rbp + 0x310], 0
je 0x140032706
cmp word [rbp + 0x312], 0
je 0x14003270e
cmp word [rbp + 0x314], 0
je 0x140032719
cmp word [rbp + 0x316], 0
je 0x140032724
cmp word [rbp + 0x318], 0
je 0x14003272f
cmp word [rbp + 0x31a], 0
je 0x14003273a
cmp word [rbp + 0x31c], 0
je 0x140032745
cmp word [rbp + 0x31e], 0
je 0x140032750
cmp word [rbp + 0x320], 0
je 0x14003275b
cmp word [rbp + 0x322], 0
je 0x140032766
cmp word [rbp + 0x324], 0
je 0x140032771
cmp word [rbp + 0x326], 0
je 0x14003277c
cmp word [rbp + 0x328], 0
je 0x14003279e
cmp word [rbp + 0x32a], 0
je 0x1400327c1
cmp word [rbp + 0x32c], 0
je 0x1400327cc
cmp word [rbp + 0x32e], 0
je 0x1400327d7
cmp word [rbp + 0x330], 0
je 0x1400327e2
cmp word [rbp + 0x332], 0
je 0x1400327ed
cmp word [rbp + 0x334], 0
je 0x1400327f8
cmp word [rbp + 0x336], 0
je 0x140032825
cmp word [rbp + 0x338], 0
je 0x14003283f
cmp word [rbp + 0x33a], 0
je 0x140032847
cmp word [rbp + 0x33c], 0
je 0x14003284f
cmp word [rbp + 0x33e], 0
je 0x140032868
cmp word [rbp + 0x340], 0
je 0x140032885
cmp word [rbp + 0x342], 0
je 0x14003288d
cmp word [rbp + 0x344], 0
je 0x140032895
cmp word [rbp + 0x346], 0
je 0x14003289d
cmp word [rbp + 0x348], 0
je 0x1400328a5
cmp word [rbp + 0x34a], 0
je 0x1400328ad
cmp word [rbp + 0x34c], 0
je 0x1400328b5
cmp word [rbp + 0x34e], 1
mov r8d, 0x20
sbb r8, 0
jmp 0x1400328bb
xor r8d, r8d
jmp 0x1400328bb
mov r8d, 1
jmp 0x1400328bb
mov r8d, 2
jmp 0x1400328bb
mov r8d, 3
jmp 0x1400328bb
mov r8d, 4
jmp 0x1400328bb
mov r8d, 5
jmp 0x1400328bb
mov r8d, 6
jmp 0x1400328bb
mov r8d, 7
jmp 0x1400328bb
mov r8d, 8
jmp 0x1400328bb
mov r8d, 9
jmp 0x1400328bb
mov r8d, 0xa
jmp 0x1400328bb
mov r8d, 0xb
jmp 0x1400328bb
cmp r14, 0xffffffffffffffff
jne 0x1400327a9
lea rcx, [0x14021bd10]
call fcn.1402168a0
jmp 0x140032883
mov r8d, 0xc
jmp 0x1400328bb
lea rcx, [r14 + 1]
lea r8, [0x14021bd10]
mov rdx, r14
call fcn.140216780
jmp 0x140032883
mov r8d, 0xd
jmp 0x1400328bb
mov r8d, 0xe
jmp 0x1400328bb
mov r8d, 0xf
jmp 0x1400328bb
mov r8d, 0x10
jmp 0x1400328bb
mov r8d, 0x11
jmp 0x1400328bb
mov r8d, 0x12
jmp 0x1400328bb
mov eax, 2
mov qword [rbp + 0x2c8], rax
mov rdx, rbx
jmp 0x140032817
mov rdx, r8
mov rcx, qword [rbp + 0x2c8]
call fcn.140215f80
jmp 0x140032883
mov r8d, 0x13
jmp 0x1400328bb
mov ecx, 2
mov rdx, r13
call fcn.140215f80
jmp 0x140032883
mov r8d, 0x14
jmp 0x1400328bb
mov r8d, 0x15
jmp 0x1400328bb
mov r8d, 0x16
jmp 0x1400328bb
mov ecx, 2
mov edx, 0x208
call fcn.140215f80
jmp 0x140032883
mov r8d, 0x17
jmp 0x1400328bb
mov byte [rbp + 0x3bd], 1
lea r8, [0x14021bd28]
call fcn.140216780
ud2
mov r8d, 0x18
jmp 0x1400328bb
mov r8d, 0x19
jmp 0x1400328bb
mov r8d, 0x1a
jmp 0x1400328bb
mov r8d, 0x1b
jmp 0x1400328bb
mov r8d, 0x1c
jmp 0x1400328bb
mov r8d, 0x1d
jmp 0x1400328bb
mov r8d, 0x1e
mov byte [rbp + 0x3bc], 0
mov byte [rbp + 0x3bb], 1
lea rcx, [rbp + 0x388]
lea rdx, [rbp + 0x310]
call fcn.1401d9170
mov edx, dword [rbp + 0x2f4]
shr edx, 0x13
and dl, 1
cmp dword [rbp + 0x2f0], 2
mov rax, qword [rbp + 0x360]
lea rcx, [r14 + r14*2]
lea rcx, [r15 + rcx*8]
movups xmm0, xmmword [rbp + 0x2d0]
movups xmm1, xmmword [rbp + 0x2e0]
movups xmmword [rbp + 0x1e8], xmm0
movups xmmword [rbp + 0x1f8], xmm1
movups xmm0, xmmword [rbp + 0x388]
movups xmm1, xmmword [rbp + 0x398]
movups xmmword [rbp + 0x208], xmm0
movups xmmword [rbp + 0x218], xmm1
mov qword [rbp + 0x240], r15
mov qword [rbp + 0x248], r15
mov qword [rbp + 0x250], rax
mov qword [rbp + 0x258], rcx
mov qword [rbp + 0x1d8], rbx
mov qword [rbp + 0x1e0], 0xffffffffffffffff
mov qword [rbp + 0x228], r12
mov qword [rbp + 0x230], r13
sete byte [rbp + 0x238]
mov byte [rbp + 0x239], dl
mov byte [rbp + 0x3bc], 1
mov byte [rbp + 0x3bb], 0
lea rdx, [rbp + 0x1d8]
mov rcx, qword [rbp + 0x358]
call fcn.1400331a0
mov byte [rbp + 0x3bf], 0
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400329f4
mov byte [rbp + 0x3bf], 0
call fcn.1400460d0
mov qword [rbp + 0x390], rax
mov dword [rbp + 0x398], edx
mov qword [rbp + 0x388], 1
test rax, rax
je 0x1400329f4
lea rcx, [rbp + 0x390]
mov byte [rbp + 0x3bf], 0
call fcn.1400460b0
mov rdx, qword [rbp + 0x2a8]
test rdx, rdx
je 0x14003235b
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x3a8]
jmp 0x140032356