Function at 0x14001e8d4
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
xor edi, edi
movzx r12d, di
mov dword [rsp + 0x3c], r12d
mov word [rsp + 0x20], di
cmp dword [0x1400449b4], edi
je 0x14001e92f
xor edx, edx
mov ecx, 0x2335
call fcn.140002bc4
call fcn.140013ed4
cmp dword [0x1400400e0], edi
je 0x14001efd2
cmp dword [0x14004cc28], edi
jne 0x14001e94f
lea rcx, [0x140037cf8]
call fcn.14000dc90
cmp byte [0x140050d80], dil
je 0x14001e961
lea r15, [0x14005b860]
jmp 0x14001e993
lea rcx, [0x140038618]
call fcn.1400149d8
mov r15, rax
test rax, rax
je 0x14001e993
mov r8, rax
mov edx, 0x200
lea r15, [0x14005b860]
mov rcx, r15
call fcn.1400158f0
mov byte [0x140050d80], 1
mov r8, qword [0x14005b848]
test r8, r8
setne al
lea r12, [0x14005b640]
mov rcx, r12
test al, al
cmovne rcx, r8
xor r8d, r8d
mov edx, dword [0x14005b858]
call fcn.14001a478
lea rcx, [rsp + 0x58]
call fcn.14001f00c
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14001efd2
mov rsi, rax
mov qword [rsp + 0x28], rax
mov word [rax], di
mov r14, qword [rsp + 0x58]
dec r14
mov qword [rsp + 0x30], r14
test r15, r15
je 0x14001ef6a
movzx eax, word [r15]
test ax, ax
je 0x14001ef6a
or r13, 0xffffffffffffffff
test ax, ax
je 0x14001efa8
cmp ax, 0x24
je 0x14001ea9e
movzx r9d, ax
lea r8, [0x140038708]
mov rdx, r14
mov rcx, rsi
call fcn.14000daf0
mov rax, r13
inc rax
cmp word [rsi + rax*2], di
jne 0x14001ea37
lea rsi, [rsi + rax*2]
mov qword [rsp + 0x28], rsi
sub r14, rax
mov qword [rsp + 0x30], r14
mov eax, dword [0x1400449b8]
sub eax, 0x3a4
je 0x14001ea6d
sub eax, 4
je 0x14001ea6d
sub eax, 0xd
je 0x14001ea6d
cmp eax, 1
jne 0x14001ea8e
movzx r12d, word [r15]
mov dword [rsp + 0x3c], r12d
movzx ecx, r12w
call fcn.140030574
test eax, eax
je 0x14001ea8e
mov word [rsp + 0x20], r12w
jmp 0x14001ef5d
mov ecx, edi
mov dword [rsp + 0x3c], ecx
mov word [rsp + 0x20], cx
jmp 0x14001ef5d
add r15, 2
mov qword [rsp + 0x60], r15
mov ebx, edi
lea r13, [0x140039030]
mov r12, r13
movzx ecx, word [r15]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_towupper]
nop dword [rax + rax]
cmp ax, word [r12]
je 0x14001eae2
inc ebx
lea rcx, [rbx + rbx*2]
lea r12, [rcx*2]
add r12, r13
cmp word [r12], di
jne 0x14001eab3
mov eax, ebx
lea rcx, [rax + rax*2]
cmp word [r13 + rcx*2], di
mov r13, 0xffffffffffffffff
je 0x14001efa8
lea rdx, [0x140039030]
movzx eax, word [rdx + rcx*2 + 2]
cmp eax, 8
jne 0x14001eb3c
movzx r9d, word [rdx + rcx*2 + 4]
lea r8, [0x140038708]
mov rdx, r14
mov rcx, rsi
call fcn.14000daf0
mov rax, r13
inc rax
cmp word [rsi + rax*2], di
jne 0x14001eb27
lea rsi, [rsi + rax*2]
sub r14, rax
jmp 0x14001ef53
mov ecx, eax
sub ecx, 1
je 0x14001ef37
sub ecx, 1
je 0x14001ef23
sub ecx, 1
je 0x14001eee6
sub ecx, 1
je 0x14001ee8f
sub ecx, 1
je 0x14001edba
sub ecx, 1
je 0x14001ed3c
sub ecx, 3
je 0x14001ecf7
cmp ecx, 1
je 0x14001ebc3
mov rdx, qword [0x14005b848]
test rdx, rdx
setne al
lea rcx, [0x14005b640]
test al, al
cmovne rcx, rdx
movzx r9d, word [rcx]
lea r8, [0x140038708]
mov rdx, r14
mov rcx, rsi
call fcn.14000daf0
mov rax, r13
inc rax
cmp word [rsi + rax*2], di
jne 0x14001ebb5
jmp 0x14001eb30
cmp byte [0x14004cbc5], dil
je 0x14001ef5d
mov dword [rsp + 0x38], edi
mov rdx, qword [0x14005b848]
test rdx, rdx
setne al
lea rbx, [0x14005b640]
mov rcx, rbx
test al, al
cmovne rcx, rdx
movzx eax, word [rcx]
mov word [rsp + 0x70], ax
test rdx, rdx
setne al
mov rcx, rbx
test al, al
cmovne rcx, rdx
movzx eax, word [rcx + 2]
mov word [rsp + 0x72], ax
mov dword [rsp + 0x74], 0x5c
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 4
jne 0x14001ef5d
mov word [rsp + 0x74], di
mov dword [rsp + 0x40], 0x104
call fcn.140020bec
test al, al
je 0x14001ec6d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ext_ms_win_cmd_util_l1_1_0.dll_WNetGetConnectionWStub]
nop dword [rax + rax]
mov dword [rsp + 0x38], eax
jmp 0x14001ec75
mov dword [rsp + 0x38], 0x78
jmp 0x14001ec95
cmp dword [rsp + 0x38], edi
je 0x14001eccc
cmp dword [rsp + 0x38], 0x8ca
je 0x14001ef5d
lea r8, str.Unknown
mov rdx, r14
mov rcx, rsi
call fcn.14000daf0
mov rax, r13
inc rax
cmp word [rsi + rax*2], di
jne 0x14001ecbe
jmp 0x14001eb30
lea r9, [rsp + 0xc0]
lea r8, [0x140039878]
mov rdx, r14
mov rcx, rsi
call fcn.14000daf0
mov rax, r13
inc rax
cmp word [rsi + rax*2], di
jne 0x14001ece9
jmp 0x14001eb30
cmp byte [0x14004cbc5], dil
je 0x14001ef5d
mov ecx, dword [0x14004cc30]
jmp 0x14001ed31
mov eax, ecx
dec ecx
test eax, eax
je 0x14001ef5d
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
mov qword [rsp + 0x28], rsi
dec r14
mov qword [rsp + 0x30], r14
cmp r14, 1
ja 0x14001ed0c
jmp 0x14001ef5d
lea rax, [r14 - 1]
mov ecx, edi
mov ebx, 0x7ffffffe
cmp rax, rbx
mov eax, 0x80070057
cmova ecx, eax
test ecx, ecx
js 0x14001eda1
mov rdx, r14
mov rcx, rsi
test r14, r14
je 0x14001ed91
mov r8d, ebx
sub r8, r14
lea r9, [0x140037cf8]
sub r9, rsi
lea rax, [rdx + r8]
test rax, rax
je 0x14001ed91
movzx eax, word [rcx + r9]
test ax, ax
je 0x14001ed91
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14001ed71
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
jmp 0x14001eda9
test r14, r14
je 0x14001eda9
mov word [rsi], di
mov rax, r13
inc rax
cmp word [rsi + rax*2], di
jne 0x14001edac
jmp 0x14001eb30
lea rax, [r14 - 1]
mov ecx, edi
mov ebx, 0x7ffffffe
cmp word [rsp + 0x3c], di
je 0x14001ee1c
cmp rax, rbx
mov eax, 0x80070057
cmova ecx, eax
test ecx, ecx
js 0x14001ee76
mov rdx, r14
mov rcx, rsi
test r14, r14
je 0x14001ee66
mov r8d, ebx
sub r8, r14
lea r9, str._b_b___b_b
sub r9, rsi
lea rax, [r8 + rdx]
test rax, rax
je 0x14001ee66
movzx eax, word [r9 + rcx]
test ax, ax
je 0x14001ee66
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14001edfa
jmp 0x14001ee66
cmp rax, rbx
mov eax, 0x80070057
cmova ecx, eax
test ecx, ecx
js 0x14001ee76
mov rdx, r14
mov rcx, rsi
test r14, r14
je 0x14001ee66
mov r8, rbx
sub r8, r14
lea r9, [0x140039710]
sub r9, rsi
lea rax, [rdx + r8]
test rax, rax
je 0x14001ee66
movzx eax, word [rcx + r9]
test ax, ax
je 0x14001ee66
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14001ee46
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
jmp 0x14001ee7e
test r14, r14
je 0x14001ee7e
mov word [rsi], di
mov rax, r13
inc rax
cmp word [rsi + rax*2], di
jne 0x14001ee81
jmp 0x14001eb30
lea rcx, [rsp + 0x80]
call fcn.1400072d8
lea rdx, [rsp + 0x80]
mov ecx, 0x2350
call fcn.14001e548
mov rbx, rax
mov r9, rax
lea r8, [0x140038920]
mov rdx, r14
mov rcx, rsi
call fcn.14000daf0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rax, r13
inc rax
cmp word [rsi + rax*2], di
jne 0x14001eed8
jmp 0x14001eb30
mov rcx, qword [0x14005b848]
test rcx, rcx
setne al
lea r9, [0x14005b640]
test al, al
cmovne r9, rcx
lea r8, [0x140038920]
mov rdx, r14
mov rcx, rsi
call fcn.14000daf0
mov rax, r13
inc rax
cmp word [rsi + rax*2], di
jne 0x14001ef15
jmp 0x14001eb30
mov r9d, r14d
mov r8, rsi
mov edx, 1
xor ecx, ecx
call fcn.140008f5c
jmp 0x14001ef49
mov r9d, r14d
mov r8, rsi
mov edx, 1
xor ecx, ecx
call fcn.14000d9a8
movsxd rcx, eax
sub r14, rcx
lea rsi, [rsi + rcx*2]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rsi
add r15, 2
movzx eax, word [r15]
jmp 0x14001ea0b
mov rcx, qword [0x14005b848]
test rcx, rcx
setne al
test al, al
cmovne r12, rcx
mov r9, r12
lea r8, [0x1400396c0]
mov rdx, r14
mov rcx, rbx
call fcn.14000daf0
or r13, 0xffffffffffffffff
mov rax, r13
inc rax
cmp word [rbx + rax*2], di
jne 0x14001ef99
lea rsi, [rbx + rax*2]
jmp 0x14001efad
mov rbx, qword [rsp + 0x48]
mov word [rsi], di
inc r13
cmp word [rbx + r13*2], di
jne 0x14001efb0
mov rdx, r13
mov rcx, rbx
call fcn.14000dd4c
cmp dword [0x1400449b4], edi
je 0x14001efd2
call fcn.140013ed4
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.14001f920
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret