Function at 0x1400e6168
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x1401563f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r13d, r8d
mov r14, rdx
mov rbx, rcx
xor edi, edi
lea rcx, str.GetVolumeNameFromDeviceName
mov esi, edi
lea ebp, [rdi + 1]
call fcn.1400e6f98
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
call sub.msvcrt.dll_memset
test rbx, rbx
jne 0x1400e61fd
lea r9d, [rdi + 0x57]
mov ebp, edi
mov esi, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400e63e9
test byte [rcx + 0x1c], 8
je 0x1400e63e9
lea edx, [rdi + 0x16]
lea rax, str.pwszDeviceName
jmp 0x1400e63d4
test r14, r14
jne 0x1400e623c
lea r9d, [r14 + 0x57]
mov ebp, edi
mov esi, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400e63e9
test byte [rcx + 0x1c], 8
je 0x1400e63e9
lea edx, [r14 + 0x17]
lea rax, str.pwszVolumeName
jmp 0x1400e63d4
mov word [r14], di
lea r8, str._GLOBALROOT_s
mov edi, 0x105
lea rcx, [rsp + 0x30]
mov edx, edi
mov r9, rbx
call fcn.140004a40
xor r11d, r11d
test eax, eax
jns 0x1400e62d5
mov ecx, eax
mov ebp, r11d
call fcn.1400e7018
mov esi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400e63e9
test byte [rcx + 0x1c], 8
je 0x1400e63e9
mov r9, rbx
lea r8, str._GLOBALROOT_s
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140004a40
lea rcx, str.DevicePathToWin32Path___WCHAR_pwszDeviceName__ARRAY_COUNT_PARAM_wszPath__
mov edx, 0x19
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov rcx, qword [section..data]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140137230]
call fcn.1400d4cec
jmp 0x1400e63e9
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r11w
jne 0x1400e62de
cmp word [rsp + rax*2 + 0x2e], 0x5c
je 0x1400e6380
mov rcx, rdi
lea rax, [rsp + 0x30]
cmp word [rax], r11w
je 0x1400e630b
add rax, 2
sub rcx, rbp
jne 0x1400e62fc
lea r12, [0x1400fb610]
mov ebx, 0x80070057
mov r15d, 0x7ffffffe
test rcx, rcx
je 0x1400e642a
mov rax, rdi
lea rdx, [rsp + 0x30]
sub rax, rcx
lea rdx, [rdx + rax*2]
mov eax, r11d
test rcx, rcx
je 0x1400e636b
mov r10, r12
mov r8d, r15d
sub r10, rdx
test r8, r8
je 0x1400e6366
movzx r9d, word [r10 + rdx]
test r9w, r9w
je 0x1400e6366
mov word [rdx], r9w
dec r8
add rdx, 2
sub rcx, rbp
jne 0x1400e6346
test rcx, rcx
jne 0x1400e6374
sub rdx, 2
mov eax, 0x8007007a
mov word [rdx], r11w
test eax, eax
js 0x1400e642c
mov r8d, r13d
lea rcx, [rsp + 0x30]
mov rdx, r14
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
xor edi, edi
test eax, eax
jne 0x1400e63e9
mov ebp, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400e63e9
test byte [rcx + 0x1c], 8
je 0x1400e63e9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [section..data]
lea edx, [rdi + 0x1b]
mov r9d, eax
lea rax, str.::GetVolumeNameForVolumeMountPoint__wszPath__pwszVolumeName__cchVolumeName__
mov rcx, qword [rcx + 0x10]
lea r8, [0x140137230]
mov qword [rsp + 0x20], rax
call fcn.1400d4cec
lea rcx, str.GetVolumeNameFromDeviceName
call fcn.1400e6fd8
mov ecx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, ebp
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400140f0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
mov ecx, eax
mov ebp, r11d
call fcn.1400e7018
mov esi, eax
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x1400e63e9
test byte [r10 + 0x1c], 8
je 0x1400e63e9
mov rcx, rdi
lea rax, [rsp + 0x30]
xor r8d, r8d
cmp word [rax], r8w
je 0x1400e646d
add rax, 2
sub rcx, 1
jne 0x1400e645d
test rcx, rcx
je 0x1400e64ba
sub rdi, rcx
lea rax, [rsp + 0x30]
mov ebx, r8d
lea rax, [rax + rdi*2]
test rcx, rcx
je 0x1400e64ad
sub r12, rax
test r15, r15
je 0x1400e64a8
movzx edx, word [r12 + rax]
test dx, dx
je 0x1400e64a8
mov word [rax], dx
dec r15
add rax, 2
sub rcx, 1
jne 0x1400e6489
test rcx, rcx
jne 0x1400e64b6
sub rax, 2
mov ebx, 0x8007007a
mov word [rax], r8w
mov rcx, qword [r10 + 0x10]
lea rax, str.::StringCchCat__wszPath__ARRAYSIZE_wszPath___L____
mov qword [rsp + 0x20], rax
mov edx, 0x1a
mov r9d, ebx
jmp 0x1400e62c4