Function at 0x140005dd0
Capabilities:
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov qword [rsp + 0xd0], rcx
movsxd rcx, edx
call fcn.1400a5d10
call fcn.1400a5a20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x30]
mov qword [0x14029c7cb], rax
lea rdi, [rsp + 0x38]
mov qword [0x14029c7e2], rdi
lea r14, [rsp + 0x40]
mov qword [0x14029c7fc], r14
lea rax, [rsp + 0xd0]
mov qword [0x14029c80f], rax
lea r12, [rsp + 0x48]
mov qword [0x14029c820], r12
lea rax, [rsp + 0x50]
mov qword [0x14029c837], rax
lea rbx, [rsp + 0x58]
mov qword [0x14029c84a], rbx
lea rax, [rsp + 0x60]
mov qword [0x14029c85a], rax
lea rbp, [rsp + 0x68]
mov qword [0x14029c871], rbp
lea r13, [rsp + 0x70]
mov qword [0x14029c885], r13
lea rsi, [rsp + 0x78]
mov qword [0x14029c7ab], rsi
xor edx, edx
mov ecx, 0x12c
call fcn.1400a6a30
xor edx, edx
xor ecx, ecx
call fcn.1400a86c0
xor edx, edx
mov ecx, 0x92
call fcn.1400a6650
xor edx, edx
mov ecx, __WSAFDIsSet
call fcn.1400a6650
cmp qword [rsp + 0xd0], 0
jne 0x140005fa0
xor edx, edx
mov ecx, 0xba
call fcn.1400a6650
xor edx, edx
mov ecx, 0xbb
call fcn.1400a6650
call fcn.1400a5c20
mov rcx, qword [rsp + 0x48]
call fcn.1400a5e10
call fcn.1400a5bf0
mov rbx, rax
call fcn.1400a6e00
mov rcx, qword [rsp + 0x38]
call fcn.1400a5ce0
mov rcx, qword [rsp + 0x40]
call fcn.1400a5ce0
mov rcx, qword [rsp + 0x48]
call fcn.1400a5ce0
mov rcx, qword [rsp + 0x68]
call fcn.1400a5ce0
mov rcx, qword [rsp + 0x70]
call fcn.1400a5ce0
mov rcx, qword [rsp + 0x78]
call fcn.14009992c
mov rax, rbx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
mov ecx, __WSAFDIsSet
call fcn.1400a6650
call fcn.140090114
mov r15, rax
xor edx, edx
mov ecx, reloc.WS2_32.dll___WSAFDIsSet
call fcn.1400a6650
xor edx, edx
mov ecx, reloc.WS2_32.dll___WSAFDIsSet
call fcn.1400a6650
xor edx, edx
cmp r15, 0x3c
je 0x140006120
mov ecx, 0xb1
call fcn.1400a6650
xor edx, edx
mov ecx, 0xb2
call fcn.1400a6650
cmp qword [0x1402a7490], 0
je 0x1400060df
xor edx, edx
mov ecx, 0xb3
call fcn.1400a6650
mov qword [rsp + 0x58], 0x104
xor edx, edx
mov ecx, 0xb4
call fcn.1400a6650
call fcn.1400a5c20
call fcn.1400a5c20
call fcn.1400a5b30
mov esi, eax
mov rcx, qword [rsp + 0x58]
mov edx, eax
call fcn.1400a13a0
mov rcx, qword [rsp + 0x58]
mov edx, esi
call fcn.1400a1f30
call fcn.1400a5b30
mov edx, eax
mov rcx, r13
call fcn.1400a5d50
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a83e0
xor edx, edx
mov ecx, 0xb5
call fcn.1400a6650
mov r9, rbx
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [0x1402a7490]
mov ecx, 0xb5
call fcn.1400a7440
xor edx, edx
mov ecx, 0xb6
call fcn.1400a6650
call fcn.1400a5c20
call fcn.1400a5c20
call fcn.1400a5b30
mov ebx, eax
mov edx, eax
mov rcx, qword [rsp + 0x70]
call fcn.1400a14e0
mov edx, ebx
mov rcx, qword [rsp + 0x70]
call fcn.1400a1f90
call fcn.1400a5b30
mov edx, eax
mov rcx, r12
call fcn.1400a5d50
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a83e0
xor edx, edx
mov ecx, 0xb7
call fcn.1400a6650
xor edx, edx
mov ecx, 0xb9
call fcn.1400a6650
mov rcx, qword [rsp + 0xd0]
call sub.KERNEL32.dll_CloseHandle
mov ecx, 0xb9
call fcn.1400a7440
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a83e0
jmp 0x140005f15
mov ecx, 0x98
call fcn.1400a6650
cmp qword [0x1402a7488], 0
je 0x140006537
xor edx, edx
mov ecx, 0x99
call fcn.1400a6650
mov qword [rsp + 0x60], 0x104
xor edx, edx
mov ecx, 0x9a
call fcn.1400a6650
mov rax, qword [rsp + 0x60]
lea rdx, [rax + 1]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, reloc.WS2_32.dll_inet_addr
mov ecx, 2
call fcn.1400999d8
xor edx, edx
mov ecx, 0x9b
call fcn.1400a6650
call fcn.1400a5c20
call fcn.1400a5c20
call fcn.1400a5b30
mov ebx, eax
mov edx, eax
mov rcx, qword [rsp + 0x60]
call fcn.1400a13a0
mov edx, ebx
mov rcx, qword [rsp + 0x60]
call fcn.1400a1f30
call fcn.1400a5b30
mov edx, eax
mov rcx, r14
call fcn.1400a5d50
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a83e0
xor edx, edx
mov ecx, 0x9c
call fcn.1400a6650
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xd0]
call qword [0x1402a7488]
mov ecx, 0x9c
call fcn.1400a7440
xor edx, edx
mov ecx, 0x9d
call fcn.1400a6650
xor edx, edx
mov rcx, rsi
call fcn.1400a7a60
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call sub.KERNEL32.dll_GetLogicalDriveStringsW
mov rbx, rax
mov ecx, 0x9d
call fcn.1400a7440
mov qword [rsp + 0x50], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a83e0
jmp 0x1400063a9
mov ecx, 0xa6
call fcn.1400a6650
call fcn.1400a5c20
call fcn.1400a5c20
mov rcx, qword [rsp + 0x38]
call fcn.1400a16f0
mov rbx, rax
call fcn.1400a5b30
lea rdx, [rbx - 1]
mov r8d, eax
mov rcx, qword [rsp + 0x38]
call fcn.1400a1880
call fcn.1400a5b30
mov edx, eax
mov rcx, rdi
call fcn.1400a5d50
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a83e0
xor edx, edx
mov ecx, 0xa7
call fcn.1400a6650
call fcn.1400a5c20
call fcn.1400a5c20
call fcn.1400a5b30
mov ebx, eax
mov edx, eax
mov rcx, qword [rsp + 0x60]
call fcn.1400a13a0
mov edx, ebx
mov rcx, qword [rsp + 0x60]
call fcn.1400a1f30
call fcn.1400a5b30
mov edx, eax
mov rcx, rbp
call fcn.1400a5d50
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a83e0
xor edx, edx
mov ecx, 0xa8
call fcn.1400a6650
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_QueryDosDeviceW
mov ecx, 0xa8
call fcn.1400a7440
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a83e0
xor edx, edx
mov ecx, 0xaa
call fcn.1400a6650
call fcn.1400a5c20
call fcn.1400a5c20
mov rcx, qword [rsp + 0x68]
call fcn.1400a16f0
mov rbx, rax
call fcn.1400a5b30
mov r8d, eax
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call fcn.1400a1880
call fcn.1400a5c80
call fcn.1400a5bb0
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400a5ca0
xor edx, edx
test eax, eax
jne 0x140006499
mov ecx, 0xad
call fcn.1400a6650
xor edx, edx
mov ecx, 0xae
call fcn.1400a6650
add qword [rsp + 0x30], 1
xor edx, edx
mov ecx, 0xaf
call fcn.1400a6650
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x30], rax
jge 0x140006537
xor edx, edx
mov ecx, 0x9f
call fcn.1400a6650
xor edx, edx
mov ecx, 0xa0
call fcn.1400a6650
xor edx, edx
mov rcx, rdi
call fcn.1400a5e80
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.1400a7a60
xor edx, edx
mov ecx, SHCreateDirectory
call fcn.1400a6650
mov rax, qword [rsp + 0x78]
xor edx, edx
cmp word [rax + rbx*2], 0
je 0x140006240
mov ecx, SHCreateDirectory
call fcn.1400a6650
call fcn.1400a5c20
mov rcx, qword [rsp + 0x38]
call fcn.1400a5e10
call fcn.1400a5c20
call fcn.1400a5c20
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.1400a7a60
mov rax, qword [rsp + 0x78]
movzx r13d, word [rax + rbx*2]
call fcn.1400a5b30
mov ebx, eax
mov edx, eax
mov rcx, r13
call fcn.1400a1140
mov edx, ebx
mov rcx, r13
call fcn.1400a2190
call fcn.1400a5b30
call fcn.1400a5b30
mov edx, eax
mov rcx, rdi
call fcn.1400a5d50
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a83e0
xor edx, edx
mov ecx, SHCreateDirectory
call fcn.1400a6650
add qword [rsp + 0x30], 1
xor edx, edx
mov ecx, reloc.SHELL32.dll_SHCreateDirectory
call fcn.1400a6650
jmp 0x1400063d0
mov ecx, 0xab
call fcn.1400a6650
call fcn.1400a5c20
call fcn.1400a5c20
call fcn.1400a5c20
call fcn.1400a5c20
call fcn.1400a5b30
mov rbx, rax
mov r9d, eax
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
call fcn.1400a1370
mov r9d, ebx
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
call fcn.1400a21c0
call fcn.1400a5bf0
mov rbx, rax
call fcn.1400a5b30
mov esi, eax
mov edx, eax
mov rcx, rbx
call fcn.1400a14e0
mov edx, esi
mov rcx, rbx
call fcn.1400a1f90
call fcn.1400a5b30
mov edx, eax
mov rcx, r12
call fcn.1400a5d50
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a83e0
xor edx, edx
mov ecx, 0xac
call fcn.1400a6650
xor edx, edx
mov ecx, 0xb0
call fcn.1400a6650
xor edx, edx
mov ecx, 0xb1
call fcn.1400a6650
jmp 0x1400060eb