Function at 0x4ad0cecc
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xac0
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0xab0], rax
xor ebx, ebx
mov rbp, rcx
mov qword [rsp + 0x50], rcx
lea ecx, [rbx + 0x48]
mov rdi, r9
mov r13b, r8b
mov byte [rsp + 0x41], r8b
mov byte [rsp + 0x40], dl
mov dword [0x4ad2e13c], ebx
call fcn.4ad017b8
lea r14d, [rbx + 1]
lea r15, [rbp + 0x88]
mov qword [rdi], rax
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov ebx, r14d
mov dword [rax + 0x10], r14d
mov r12, rax
mov dword [rsp + 0x44], ebx
cmp dword [rbp + 0x80], r14d
jb 0x4ad0d221
mov rsi, qword [r15]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
lea r8, [rsp + 0x690]
mov r9d, 0x106
repne scasw ax, word [rdi]
xor edi, edi
not rcx
mov dword [0x4ad2e13c], edi
sub rcx, r14
mov edx, ecx
mov rcx, rsi
call fcn.4ad0d260
cmp al, dil
je 0x4ad0d057
lea rdi, [rsp + 0x690]
lea rax, [rsp + 0x480]
mov r10d, 0x106
sub rdi, rax
xor r9d, r9d
mov rdx, r10
lea rcx, [rsp + 0x480]
lea rax, [rdx + 0x7ffffef8]
cmp rax, r9
je 0x4ad0cfd3
movzx eax, word [rdi + rcx]
cmp ax, r9w
je 0x4ad0cfd3
mov word [rcx], ax
add rcx, 2
sub rdx, r14
jne 0x4ad0cfb1
xor edi, edi
cmp rdx, rdi
je 0x4ad1fa5a
mov word [rcx], di
lea r8, [0x4ad29784]
lea rcx, [rsp + 0x480]
mov rdx, r10
call fcn.4ad01ac0
mov dword [rsp + 0x38], 0x106
lea rax, [rsp + 0x8a0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
lea rcx, [rsp + 0x480]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, edi
je 0x4ad1fa7c
lea rdx, [0x4ad299a8]
lea rcx, [rsp + 0x8a0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, edi
je 0x4ad1fa63
mov eax, dword [0x4ad2e13c]
mov r14b, dil
cmp eax, edi
jne 0x4ad1fc8d
mov byte [r15 + 0x10], r14b
cmp r13b, dil
jne 0x4ad131af
mov rcx, rsi
mov dword [0x4ad2e13c], edi
call fcn.4ad0b6a4
mov r10d, 1
mov r11, rax
cmp rax, r10
je 0x4ad1fc6b
lea rdi, [0x4ad3c0a0]
lea rcx, [rsp + 0x60]
mov eax, 0x106
sub rdi, rcx
xor esi, esi
lea rdx, [rsp + 0x60]
lea rcx, [rax + 0x7ffffef8]
cmp rcx, rsi
je 0x4ad0d0d1
movzx ecx, word [rdi + rdx]
cmp cx, si
je 0x4ad0d0d1
mov word [rdx], cx
add rdx, 2
sub rax, r10
jne 0x4ad0d0b0
cmp rax, rsi
je 0x4ad1fb51
mov word [rdx], si
call fcn.4ad0b850
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
sub rcx, r10
mov r8, rcx
cmp ecx, 3
jbe 0x4ad0d110
cmp r14b, sil
jne 0x4ad1fb5a
lea eax, [r8 - 1]
mov word [rsp + rax*2 + 0x60], si
cmp r8d, 0x103
jae 0x4ad1fc5d
mov rdi, qword [r11 + 0x20]
mov edx, 0x106
lea rcx, [rsp + 0x270]
movzx r9d, word [rdi]
lea rax, [rsp + 0x270]
cmp r9w, si
je 0x4ad1fb92
sub rdi, rax
lea rax, [rdx + 0x7ffffef8]
cmp rax, rsi
je 0x4ad0d168
movzx eax, word [rdi + rcx]
cmp ax, si
je 0x4ad0d168
mov word [rcx], ax
add rcx, 2
sub rdx, r10
jne 0x4ad0d147
cmp rdx, rsi
je 0x4ad1fbca
mov word [rcx], si
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x270]
repne scasw ax, word [rdi]
mov eax, r8d
mov edi, 0x104
not rcx
sub rcx, r10
lea rdx, [rax + rcx + 1]
cmp rdx, rdi
ja 0x4ad1fc4f
cmp r9w, si
je 0x4ad0d1bd
mov rax, qword [r11 + 0x28]
cmp rax, rsi
je 0x4ad12bb4
cmp word [rax], si
je 0x4ad12bb4
lea rcx, [rsp + 0x270]
call fcn.4ad07b58
lea rcx, [rsp + 0x60]
mov qword [r15], rax
call fcn.4ad07b58
mov qword [r15 + 8], rax
mov rcx, qword [r12 + 8]
cmp rcx, rsi
jne 0x4ad1fbfb
mov rcx, rax
call fcn.4ad07b58
mov r14d, 1
mov qword [r12 + 8], rax
mov al, byte [r15 + 0x10]
mov qword [r12 + 0x18], r15
mov byte [r12 + 0x20], al
mov r15, qword [r15 + 0x18]
add ebx, r14d
mov dword [rsp + 0x44], ebx
cmp ebx, dword [rbp + 0x80]
jbe 0x4ad0cf4c
xor eax, eax
mov rcx, qword [rsp + 0xab0]
xor rcx, rsp
call entry0
mov rbx, qword [rsp + 0xb08]
add rsp, 0xac0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rcx + 2]
cmp rax, rdi
jae 0x4ad0d1bd
cmp r14b, sil
je 0x4ad0d1bd
jmp 0x4ad1fbd3
or rcx, 0xffffffffffffffff
xor eax, eax
mov edx, 0x106
lea ebx, [rax + 1]
mov rdi, rsi
repne scasw ax, word [rdi]
mov rax, rdx
not rcx
sub rcx, rbx
add rcx, 2
cmp rcx, rdx
cmova rax, rcx
lea edi, [rax + rax]
mov ecx, edi
call fcn.4ad017b8
mov edx, edi
mov r13d, edi
shr rdx, 1
mov rbp, rax
je 0x4ad1fa95
cmp rdx, 0x7fffffff
ja 0x4ad1fa95
mov edi, 0x7ffffffe
mov r8, rsi
mov rcx, rax
sub rdi, rdx
sub r8, rax
xor r9d, r9d
lea rax, [rdx + rdi]
cmp rax, r9
je 0x4ad13233
movzx eax, word [r8 + rcx]
cmp ax, r9w
je 0x4ad13233
mov word [rcx], ax
add rcx, 2
sub rdx, rbx
jne 0x4ad13213
xor edi, edi
cmp rdx, rdi
je 0x4ad1fa73
mov word [rcx], di
jmp 0x4ad13243
cmp r14b, dil
jne 0x4ad1fa9c
mov rcx, rsi
call fcn.4ad01040
mov ebx, dword [rsp + 0x44]
mov r13b, byte [rsp + 0x41]
mov rsi, rbp
mov rbp, qword [rsp + 0x50]
jmp 0x4ad0d075
sub rcx, 2
jmp 0x4ad0cfde
cmp dword [rsp + 0x48], 0xc
jne 0x4ad0d057
jmp 0x4ad0d068
sub rcx, 2
jmp 0x4ad1323e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x90
cmove eax, edi
mov dword [0x4ad2e13c], eax
jmp 0x4ad0d05d
xor edi, edi
jmp 0x4ad13243
cmp rsi, rdi
je 0x4ad1fb01
mov edx, 0x5c
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rbx, rax
cmp rax, rdi
je 0x4ad1fb01
cmp word [rax + 2], 0x2e
jne 0x4ad1324c
cmp word [rax + 4], di
je 0x4ad1324c
cmp word [rax + 4], 0x2e
je 0x4ad1324c
sub rbx, rsi
mov rdx, rsi
mov rcx, rbp
sar rbx, 1
inc bx
movzx eax, bx
lea rdi, [rax + rax]
mov r8, rdi
call sub.msvcrt.dll_memmove
xor r9d, r9d
mov word [rdi + rbp], r9w
xor edi, edi
jmp 0x4ad1fb27
cmp word [rsi], 0x2e
jne 0x4ad1324c
cmp word [rsi + 2], di
je 0x4ad1324c
cmp word [rsi + 2], 0x2e
je 0x4ad1324c
mov word [rbp], di
mov bx, di
lea r8, [0x4ad299b0]
mov rdx, r13
mov rcx, rbp
call fcn.4ad01ac0
movzx eax, bx
mov rdx, r13
lea r8, [rsi + rax*2]
mov rcx, rbp
call fcn.4ad01ac0
nop
jmp 0x4ad1324c
sub rdx, 2
jmp 0x4ad0d0da
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x60]
cmp word [rsp + 0x60], si
je 0x4ad1fb7f
mov rdx, rcx
mov rcx, rax
add rax, 2
cmp word [rax], si
jne 0x4ad1fb70
cmp word [rdx], 0x2e
lea eax, [r8 - 2]
jne 0x4ad0d107
jmp 0x4ad0d10b
lea rdi, [0x4ad299b0]
sub rdi, rax
lea rax, [rdx + 0x7ffffef8]
cmp rax, rsi
je 0x4ad0d168
movzx eax, word [rdi + rcx]
cmp ax, si
je 0x4ad0d168
mov word [rcx], ax
add rcx, 2
sub rdx, r10
jne 0x4ad1fb9c
jmp 0x4ad0d168
sub rcx, 2
jmp 0x4ad0d171
cmp r13b, sil
je 0x4ad0d1bd
lea r8, [0x4ad29800]
lea rcx, [rsp + 0x270]
mov edx, 0x106
call fcn.4ad01ac0
nop
jmp 0x4ad0d1bd
mov rdx, rax
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
je 0x4ad1fc3f
mov ecx, 0x48
call fcn.4ad017b8
mov qword [r12], rax
mov rcx, qword [r15 + 8]
mov r12, rax
call fcn.4ad07b58
mov r14d, 1
mov qword [r12], rsi
mov qword [r12 + 8], rax
mov al, byte [r15 + 0x10]
mov dword [r12 + 0x10], r14d
jmp 0x4ad0d200
mov r14d, 1
add dword [r12 + 0x10], r14d
jmp 0x4ad0d20a
cmp byte [rsp + 0x40], sil
je 0x4ad1fc85
mov ecx, 0x6f
jmp 0x4ad1fc78
cmp byte [rsp + 0x40], sil
je 0x4ad1fc85
mov ecx, 2
jmp 0x4ad1fc78
cmp byte [rsp + 0x40], dil
je 0x4ad1fc85
mov ecx, dword [0x4ad2e13c]
xor edx, edx
call fcn.4ad0b8b0
mov r10d, 1
mov eax, r10d
jmp 0x4ad0d223
cmp byte [rsp + 0x40], dil
je 0x4ad1fc9d
xor edx, edx
mov ecx, eax
call fcn.4ad0b8b0
mov eax, 1
jmp 0x4ad0d223