Function at 0x1000d05c0
Capabilities:
Get disk size
Unmount volume via ioctl

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor esi, esi
mov rbx, r9
mov r13b, r8b
mov r14, rdx
mov rbp, rcx
mov dword [rax + 0x20], esi
mov qword [rax - 0x48], rsi
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
mov dil, 4
cmp rcx, r12
je 0x1000d062f
test byte [rcx + 0x1c], dil
je 0x1000d062f
cmp byte [rcx + 0x19], dil
jb 0x1000d062f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x18a
call fcn.10001c854
mov rcx, qword [0x1001653b8]
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x58], sil
cmp rcx, r12
je 0x1000d0667
test byte [rcx + 0x1c], dil
je 0x1000d0667
cmp byte [rcx + 0x19], 5
jb 0x1000d0667
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x18b
mov r9, rbp
mov qword [rsp + 0x20], r14
call fcn.10001df74
mov r15, qword [rsp + 0xb0]
mov qword [r15], rsi
mov rsi, qword [rsp + 0xb8]
and dword [rsi], 0
cmp rbx, 0xffffffffffffffff
je 0x1000d06e7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x1000d06e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [0x1001653b8]
mov ebx, 0x13
cmp rcx, r12
je 0x1000d0d97
test byte [rcx + 0x1c], dil
je 0x1000d0d97
cmp byte [rcx + 0x19], 2
jb 0x1000d0d97
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x18c
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.10001d914
jmp 0x1000d0d97
mov byte [rsp + 0x58], 1
lea rdx, [rsp + 0x40]
mov r8, rsi
mov rcx, r14
call fcn.1000d04a4
mov ebx, eax
test eax, eax
je 0x1000d0748
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x1000d0d97
test byte [rcx + 0x1c], dil
je 0x1000d0d97
cmp byte [rcx + 0x19], 2
jb 0x1000d0d97
mov edx, 0x18d
mov r9, r14
mov eax, dword [rsi]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
call fcn.1000c2750
jmp 0x1000d0d97
mov rcx, qword [0x1001653b8]
mov r12, qword [rsp + 0x40]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d0784
test byte [rcx + 0x1c], dil
je 0x1000d0784
cmp byte [rcx + 0x19], dil
jb 0x1000d0784
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x18e
mov r9, r12
call fcn.10001d71c
lea rcx, [rsp + 0x50]
call fcn.1000c2e50
mov ebx, 0x218
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x1000d07b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [rdi + 3]
mov dword [rsi], eax
jmp 0x1000d0d97
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r8, rsi
mov rcx, rbp
movdqu xmm5, xmmword [0x10000cfe0]
mov byte [rdi + 0x19], r13b
lea r13, [rdi + 0x1f8]
movdqu xmmword [rdi], xmm5
mov rdx, r13
call fcn.1000c3a50
mov ebx, eax
test eax, eax
je 0x1000d0840
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d0d97
test byte [rcx + 0x1c], 4
je 0x1000d0d97
cmp byte [rcx + 0x19], 2
jb 0x1000d0d97
mov eax, dword [rsi]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov dword [rsp + 0x28], eax
mov edx, 0x18f
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001e4b0
jmp 0x1000d0d97
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d087f
test byte [rcx + 0x1c], 4
je 0x1000d087f
cmp byte [rcx + 0x19], 4
jb 0x1000d087f
mov eax, dword [r13]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x190
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
and qword [rsp + 0x30], 0
mov ebx, 3
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, rbp
mov r8d, ebx
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x10], rax
cmp rax, 0xffffffffffffffff
jne 0x1000d0902
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
mov ebx, 0xd
cmp rcx, rax
je 0x1000d0d97
test byte [rcx + 0x1c], 4
je 0x1000d0d97
cmp byte [rcx + 0x19], 2
jb 0x1000d0d97
mov edx, 0x191
mov r9, rbp
jmp 0x1000d0729
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
mov r13b, 4
cmp rcx, rdx
je 0x1000d0941
test byte [rcx + 0x1c], r13b
je 0x1000d0941
cmp byte [rcx + 0x19], r13b
jb 0x1000d0941
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x192
mov r9, rbp
mov qword [rsp + 0x20], rax
call fcn.10001e82c
and qword [rsp + 0x38], 0
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7405c
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1000d09d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
mov ebx, 0xd
cmp rcx, rax
je 0x1000d0d97
test byte [rcx + 0x1c], r13b
je 0x1000d0d97
cmp byte [rcx + 0x19], 2
jb 0x1000d0d97
mov edx, 0x193
jmp 0x1000d08fa
mov rax, qword [rsp + 0x48]
cmp rax, r12
jge 0x1000d0a41
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000d0a24
test byte [rcx + 0x1c], r13b
je 0x1000d0a24
cmp byte [rcx + 0x19], 2
jb 0x1000d0a24
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], r12
lea r8, [0x100003158]
mov edx, 0x194
mov r9, rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1000c2800
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 0xe
jmp 0x1000d0d97
mov rcx, qword [rdi + 0x10]
xor r12d, r12d
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90018
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
jne 0x1000d0ac3
mov rax, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rax, r14
je 0x1000d0aca
test byte [rax + 0x1c], r13b
je 0x1000d0aca
cmp byte [rax + 0x19], bl
jb 0x1000d0aca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003158]
mov rcx, qword [rcx + 0x10]
mov edx, 0x195
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
jmp 0x1000d0aca
lea r14, [0x1001653b8]
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
mov dword [rsp + 0xa8], r12d
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90020
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
jne 0x1000d0b56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
mov ebx, 0xd
cmp rcx, r14
je 0x1000d0d97
test byte [rcx + 0x1c], r13b
je 0x1000d0d97
cmp byte [rcx + 0x19], 2
jb 0x1000d0d97
mov edx, 0x196
jmp 0x1000d08fa
mov rcx, qword [rdi + 0x10]
mov rdx, rsi
call fcn.1000cffb0
mov rcx, qword [rdi + 0x10]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x1000d0bc3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000d0d94
test byte [rcx + 0x1c], r13b
je 0x1000d0d94
cmp byte [rcx + 0x19], 2
jb 0x1000d0d94
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x197
mov r9, rbp
mov dword [rsp + 0x20], r12d
call fcn.10001ddb0
jmp 0x1000d0d94
xor r12d, r12d
xor r9d, r9d
mov r8d, ebx
mov qword [rsp + 0x30], r12
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x10], rax
cmp rax, 0xffffffffffffffff
jne 0x1000d0c39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
lea ebx, [r12 + 0xd]
cmp rcx, r14
je 0x1000d0d97
test byte [rcx + 0x1c], r13b
je 0x1000d0d97
cmp byte [rcx + 0x19], 2
jb 0x1000d0d97
mov edx, 0x198
jmp 0x1000d08fa
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000d0c6e
test byte [rcx + 0x1c], r13b
je 0x1000d0c6e
cmp byte [rcx + 0x19], r13b
jb 0x1000d0c6e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x199
mov r9, rbp
mov qword [rsp + 0x20], rax
call fcn.10001e82c
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90018
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
jne 0x1000d0ce4
mov rax, qword [0x1001653b8]
cmp rax, r14
je 0x1000d0ce4
test byte [rax + 0x1c], r13b
je 0x1000d0ce4
cmp byte [rax + 0x19], bl
jb 0x1000d0ce4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003158]
mov rcx, qword [rcx + 0x10]
mov edx, 0x19a
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
mov dword [rsp + 0xa8], r12d
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90020
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
jne 0x1000d0d64
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
mov ebx, 0xd
cmp rcx, r14
je 0x1000d0d97
test byte [rcx + 0x1c], r13b
je 0x1000d0d97
cmp byte [rcx + 0x19], 2
jb 0x1000d0d97
mov edx, 0x19b
jmp 0x1000d08fa
mov qword [r15], rdi
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000d0d94
test byte [rcx + 0x1c], r13b
je 0x1000d0d94
cmp byte [rcx + 0x19], r13b
jb 0x1000d0d94
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x19c
call fcn.10001c854
mov ebx, r12d
lea rcx, [rsp + 0x50]
call fcn.1000c2e50
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret