Function at 0x1400117b0
Capabilities:
Check os version
Enumerate disk volumes
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x378
movaps xmmword [rsp + 0x360], xmm6
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov ecx, 0x3f
mov rax, qword [rsi]
mov qword [rsp + 0x358], rax
xor eax, eax
mov rbp, r8
lea rdi, [rsp + 0x160]
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0
lea rdx, [rsp + 0xb0]
rep stosq qword [rdi], rax
lea rdi, [rsp + 0xb8]
mov ecx, 0x11
mov qword [rsp + 0xb4], 0
mov qword [rsp + 0x13c], 0
rep stosq qword [rdi], rax
mov rcx, rdx
mov dword [rsp + 0xb0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0xb4], 6
ja 0x14001186c
jne 0x140011ba0
cmp dword [rsp + 0xb8], 1
jbe 0x140011ba0
lea rbx, [rsp + 0x150]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140011bf8
lea rax, [0x14008a006]
mov ecx, 8
lea rbp, [rsp + 0x7c]
lea rdi, str.defrag.exe
movq xmm1, rax
movq xmm6, rdi
punpcklqdq xmm6, xmm1
call sym.g_malloc0
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov r15, rax
lea rax, [rsp + 0x88]
mov r12, qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov qword [rsp + 0x50], rax
jmp 0x1400118ff
mov r8d, 0x104
mov rdx, rbx
mov rcx, rsi
call r12
test eax, eax
je 0x140011ad0
xor r8d, r8d
xor edx, edx
mov r9, rbp
mov rcx, rbx
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x88], 0
call rdi
call r13
cmp eax, 0xea
jne 0x1400118e8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1400118e8
mov ecx, dword [rsp + 0x7c]
mov edx, 2
call sym.g_malloc_n
mov r8d, dword [rsp + 0x7c]
mov r9, rbp
mov rcx, rbx
mov r14, rax
mov rdx, rax
call rdi
test eax, eax
je 0x140011a90
cmp word [r14], 0
je 0x140011a90
mov ecx, 0x38
call sym.g_malloc0
mov edx, dword [rsp + 0x7c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x50]
mov rcx, r14
mov qword [rsp + 0x20], rax
call sym.g_utf16_to_utf8
mov rcx, r14
mov qword [rsp + 0x60], rax
call sym.g_free
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140011a9d
mov r14, qword [rsp + 0x58]
mov ecx, 0x10
mov qword [rsp + 0x60], rdx
mov qword [r14], rdx
call sym.g_malloc
mov rdx, qword [rsp + 0x60]
xor r8d, r8d
xor ecx, ecx
movq xmm0, qword [r15]
mov qword [r15], rax
movq xmm2, r14
mov r9d, 4
mov qword [rsp + 0xa0], rdx
mov rdx, qword [rsp + 0x50]
punpcklqdq xmm0, xmm2
movaps xmmword [rsp + 0x90], xmm6
movups xmmword [rax], xmm0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x30], rdx
mov rdx, rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0xa8], 0
call sym.g_spawn_sync
test eax, eax
jne 0x140011b10
mov rax, qword [rsp + 0x88]
mov byte [r14 + 0x28], 1
mov rcx, qword [rax + 8]
call sym.g_strdup
mov rcx, qword [rsp + 0x88]
mov qword [r14 + 0x30], rax
call sym.g_error_free
jmp 0x1400118e8
mov rcx, r14
call sym.g_free
jmp 0x1400118e8
mov rdi, qword [rsp + 0x58]
mov rax, qword [rsp + 0x88]
mov byte [rdi + 0x28], 1
mov rcx, qword [rax + 8]
call sym.g_strdup
mov rcx, qword [rsp + 0x88]
mov qword [rdi + 0x30], rax
call sym.g_error_free
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsp + 0x358]
sub rax, qword [rdi]
jne 0x140011c2c
movaps xmm6, xmmword [rsp + 0x360]
mov rax, r15
add rsp, 0x378
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x80]
xor r8d, r8d
lea rdx, [0x14008a009]
call sym.g_strsplit
mov rcx, qword [rsp + 0x80]
mov r14, rax
call sym.g_free
mov rcx, qword [r14]
xor r8d, r8d
test rcx, rcx
je 0x140011b91
mov qword [rsp + 0x60], rsi
mov esi, r8d
mov qword [rsp + 0x68], rbx
mov rbx, r14
lea r8, [0x14008a00c]
mov rdx, 0xffffffffffffffff
call sym.g_strstr_len
test rax, rax
je 0x140011bd0
mov rax, qword [rsp + 0x58]
mov rdx, rbx
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov byte [rax + 0x28], 1
mov rcx, qword [rdx]
call sym.g_strdup
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x30], rax
mov rcx, r14
call sym.g_strfreev
jmp 0x1400118e8
lea rax, str.fstrim_is_only_supported_for_Win8
mov r8d, 0x546
mov rcx, rbp
mov qword [rsp + 0x20], rax
lea r9, global___func__.220
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
xor r15d, r15d
jmp 0x140011ad9
add esi, 1
movsxd rax, esi
lea rbx, [r14 + rax*8]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140011b52
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
jmp 0x140011b91
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, str.failed_to_find_any_volume
mov rcx, rbp
lea r9, global___func__.220
mov qword [rsp + 0x28], rsi
mov r8d, 0x54c
lea rdx, str..._qga_commands_win32.c
mov dword [rsp + 0x20], eax
call dbg.error_setg_win32_internal
jmp 0x140011bc8
call sym.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]