Function at 0x1400ebc2c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x14015d3e0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12, r8
mov qword [rsp + 0x38], rdx
mov r15, rdx
mov rbx, rcx
xor edi, edi
lea rcx, str.GetVolumeNameAndRelativeFilePath
mov ebp, edi
lea r14d, [rdi + 1]
call fcn.1400ed218
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
mov esi, edi
call sub.msvcrt.dll_memset
mov r13d, edi
test r15, r15
jne 0x1400ebd5d
lea r9d, [r15 + 0x57]
mov r14d, edi
mov ebp, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ebcd9
test byte [rcx + 0x1c], 8
je 0x1400ebcd9
lea edx, [rdi + 0x1c]
lea rax, str.pwszVolumeName
mov rcx, qword [rcx + 0x10]
lea r8, [0x14013f150]
mov qword [rsp + 0x20], rax
call fcn.1400d9dd4
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, r13
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
lea rcx, str.GetVolumeNameAndRelativeFilePath
call fcn.1400ed25c
mov ecx, ebp
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov eax, r14d
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400164a0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rbx, rbx
jne 0x1400ebd9c
lea r9d, [rbx + 0x57]
mov r14d, edi
mov ebp, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ebcd9
test byte [rcx + 0x1c], 8
je 0x1400ebcd9
lea edx, [rbx + 0x1d]
lea rax, str.wszFileName
jmp 0x1400ebcc4
test r12, r12
jne 0x1400ebdde
lea r9d, [r12 + 0x57]
mov r14d, edi
mov ebp, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ebcd9
test byte [rcx + 0x1c], 8
je 0x1400ebcd9
lea edx, [r12 + 0x1e]
lea rax, str.pwszRelativeFilePath
jmp 0x1400ebcc4
mov qword [r15], rdi
lea rdx, str.__
mov r8d, 4
mov qword [r12], rdi
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400ebe57
mov rdx, rbx
lea rcx, str.__
call fcn.1400ecdf0
mov r13, rax
test rax, rax
jne 0x1400ebe98
lea r9d, [rax + 0xe]
mov r14d, edi
mov ebp, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ebcd9
test byte [rcx + 0x1c], 8
je 0x1400ebcd9
lea edx, [r13 + 0x1f]
lea rax, str.wszSSQMSPrependedFileName
jmp 0x1400ebcc4
mov rcx, rbx
call fcn.1400ec990
mov r13, rax
test rax, rax
jne 0x1400ebe98
lea r9d, [rax + 0xe]
mov r14d, edi
mov ebp, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ebcd9
test byte [rcx + 0x1c], 8
je 0x1400ebcd9
lea edx, [r13 + 0x20]
jmp 0x1400ebe4b
or rdi, 0xffffffffffffffff
mov rbx, rdi
xor eax, eax
inc rbx
cmp word [r13 + rbx*2], ax
jne 0x1400ebea1
add ebx, 2
lea ecx, [rbx + rbx]
call fcn.1400ecee0
mov rsi, rax
xor eax, eax
test rsi, rsi
jne 0x1400ebf0b
lea r9d, [rax + 0xe]
mov r14d, eax
mov ebp, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ebf03
test byte [rcx + 0x1c], 8
je 0x1400ebf03
lea edx, [rsi + 0x21]
lea rax, str.wszVolumePathBuffer
mov rcx, qword [rcx + 0x10]
lea r8, [0x14013f150]
mov qword [rsp + 0x20], rax
call fcn.1400d9dd4
mov rcx, r14
jmp 0x1400ebcdc
mov r8d, ebx
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
nop dword [rax + rax]
xor r10d, r10d
test eax, eax
jne 0x1400ebf78
mov r14d, r10d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebp, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ebf03
test byte [rcx + 0x1c], 8
je 0x1400ebf03
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [section..data]
mov edx, 0x22
mov r9d, eax
lea rax, str.GetVolumePathNameW__wszSSQMSPrependedFileName__wszVolumePathBuffer__cchPathLength_
jmp 0x1400ebeee
mov rax, rdi
inc rax
cmp word [rsi + rax*2], r10w
jne 0x1400ebf7b
cmp word [rsi + rax*2 - 2], 0x5c
je 0x1400ec16a
lea rax, [rbx - 1]
mov ecx, r10d
cmp rax, 0x7ffffffe
mov edx, 0x80070057
cmova ecx, edx
test ecx, ecx
js 0x1400ebfdd
mov r8, rbx
mov rax, rsi
test rbx, rbx
je 0x1400ebfc4
cmp word [rax], r10w
je 0x1400ebfc4
add rax, 2
sub r8, r14
jne 0x1400ebfb5
mov rax, r8
neg rax
sbb ecx, ecx
not ecx
and ecx, edx
test r8, r8
je 0x1400ebfdd
mov rdx, rbx
sub rdx, r8
jmp 0x1400ebfe0
mov rdx, r10
lea r15, [0x1401035b0]
test ecx, ecx
js 0x1400ec052
mov r8, rbx
lea rcx, [rsi + rdx*2]
sub r8, rdx
je 0x1400ec02a
lea r9, [rdx + 0x7ffffffe]
mov rax, r8
sub rax, rbx
mov rdx, r15
add r9, rax
sub rdx, rcx
test r9, r9
je 0x1400ec02a
movzx eax, word [rcx + rdx]
test ax, ax
je 0x1400ec02a
mov word [rcx], ax
dec r9
add rcx, 2
sub r8, r14
jne 0x1400ec00d
lea rax, [rcx - 2]
test r8, r8
cmovne rax, rcx
mov word [rax], r10w
mov rax, r8
neg rax
sbb ecx, ecx
not ecx
and ecx, 0x8007007a
test r8, r8
jne 0x1400ec165
mov r14d, r10d
call fcn.1400ed2a0
mov ebp, eax
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x1400ebf03
test byte [r10 + 0x1c], 8
je 0x1400ebf03
xor r11d, r11d
lea rax, [rbx - 1]
cmp rax, 0x7ffffffe
mov r9d, r11d
mov edx, 0x80070057
cmova r9d, edx
test r9d, r9d
js 0x1400ec0d3
mov rcx, rbx
mov rax, rsi
test rbx, rbx
je 0x1400ec0b7
cmp word [rax], r11w
je 0x1400ec0b7
add rax, 2
sub rcx, 1
jne 0x1400ec0a7
mov rax, rcx
neg rax
sbb r9d, r9d
not r9d
and r9d, edx
test rcx, rcx
je 0x1400ec0d3
mov r8, rbx
sub r8, rcx
jmp 0x1400ec0d6
mov r8, r11
test r9d, r9d
js 0x1400ec13f
mov rcx, rbx
lea rdx, [rsi + r8*2]
sub rcx, r8
je 0x1400ec119
mov rax, rcx
lea r9, [r8 + 0x7ffffffe]
sub rax, rbx
add r9, rax
sub r15, rdx
test r9, r9
je 0x1400ec119
movzx eax, word [rdx + r15]
test ax, ax
je 0x1400ec119
mov word [rdx], ax
dec r9
add rdx, 2
sub rcx, 1
jne 0x1400ec0fa
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb r9d, r9d
not r9d
mov word [rax], r11w
and r9d, 0x8007007a
mov r10, qword [section..data]
mov rcx, qword [r10 + 0x10]
lea rax, str.::StringCchCat__wszVolumePathBuffer__cchPathLength__L____
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea r8, [0x14013f150]
call fcn.1400d9dd4
jmp 0x1400ebf03
mov r15, qword [rsp + 0x38]
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
jne 0x1400ec1f1
mov r14d, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebp, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ec1e9
test byte [rcx + 0x1c], 8
je 0x1400ec1e9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [section..data]
lea edx, [rbx + 0x24]
mov r9d, eax
lea r8, [0x14013f150]
lea rax, str.GetVolumeNameForVolumeMountPoint_wszVolumePathBuffer__wszVolumeNameBuffer__ARRAYSIZE_wszVolumeNameBuffer__
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.1400d9dd4
mov rcx, rbx
jmp 0x1400ebcdc
lea rcx, [rsp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400ec1f9
cmp word [rsp + rax*2 + 0x3e], 0x5c
jne 0x1400ec223
lea rax, [rax*2 - 2]
cmp rax, 0x208
jae 0x1400ec2a9
mov word [rsp + rax + 0x40], bx
mov rax, rdi
inc rax
cmp word [rsi + rax*2], bx
jne 0x1400ec226
cmp word [rsi + rax*2 - 2], 0x5c
jne 0x1400ec248
mov rax, rdi
inc rax
cmp word [rsi + rax*2], bx
jne 0x1400ec23a
mov word [rsi + rax*2 - 2], bx
lea rcx, [rsp + 0x40]
call fcn.1400ec990
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1400ec2af
lea r9d, [rax + 0xe]
mov r14d, ebx
mov ebp, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ec29f
test byte [rcx + 0x1c], 8
je 0x1400ec29f
lea edx, [r9 + 0x17]
lea rax, str.wszVolumeName
mov rcx, qword [rcx + 0x10]
lea r8, [0x14013f150]
mov qword [rsp + 0x20], rax
call fcn.1400d9dd4
mov rcx, qword [rsp + 0x30]
jmp 0x1400ebcdc
call fcn.1400167c8
int3
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x1400ec2af
lea rcx, [rdi*2]
add rcx, r13
call fcn.1400ec990
test rax, rax
jne 0x1400ec2fd
lea r9d, [rax + 0xe]
mov r14d, ebx
mov ebp, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400ec29f
test byte [rcx + 0x1c], 8
je 0x1400ec29f
lea edx, [r9 + 0x18]
lea rax, str.wszRelativeFilePath
jmp 0x1400ec28a
mov rcx, qword [rsp + 0x30]
mov qword [r12], rax
mov qword [r15], rcx
jmp 0x1400ec1e9