Function at 0x1000d046c
Capabilities:
Get disk size
Unmount volume via ioctl

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor esi, esi
mov rbx, r9
mov r13b, r8b
mov r14, rdx
mov rbp, rcx
mov dword [rax + 0x20], esi
mov qword [rax - 0x48], rsi
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
mov dil, 4
cmp rcx, r12
je 0x1000d04db
test byte [rcx + 0x1c], dil
je 0x1000d04db
cmp byte [rcx + 0x19], dil
jb 0x1000d04db
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x18a
call fcn.10001c7b8
mov rcx, qword [0x1001653b8]
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x58], sil
cmp rcx, r12
je 0x1000d0513
test byte [rcx + 0x1c], dil
je 0x1000d0513
cmp byte [rcx + 0x19], 5
jb 0x1000d0513
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x18b
mov r9, rbp
mov qword [rsp + 0x20], r14
call fcn.10001df38
mov r15, qword [rsp + 0xb0]
mov qword [r15], rsi
mov rsi, qword [rsp + 0xb8]
and dword [rsi], 0
cmp rbx, 0xffffffffffffffff
je 0x1000d0593
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x1000d058e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [0x1001653b8]
mov ebx, 0x13
cmp rcx, r12
je 0x1000d0c43
test byte [rcx + 0x1c], dil
je 0x1000d0c43
cmp byte [rcx + 0x19], 2
jb 0x1000d0c43
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x18c
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.10001e8b4
jmp 0x1000d0c43
mov byte [rsp + 0x58], 1
lea rdx, [rsp + 0x40]
mov r8, rsi
mov rcx, r14
call fcn.1000d0350
mov ebx, eax
test eax, eax
je 0x1000d05f4
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x1000d0c43
test byte [rcx + 0x1c], dil
je 0x1000d0c43
cmp byte [rcx + 0x19], 2
jb 0x1000d0c43
mov edx, 0x18d
mov r9, r14
mov eax, dword [rsi]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
call fcn.1000c25f0
jmp 0x1000d0c43
mov rcx, qword [0x1001653b8]
mov r12, qword [rsp + 0x40]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d0630
test byte [rcx + 0x1c], dil
je 0x1000d0630
cmp byte [rcx + 0x19], dil
jb 0x1000d0630
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x18e
mov r9, r12
call fcn.10001d680
lea rcx, [rsp + 0x50]
call fcn.1000c2cfc
mov ebx, 0x218
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x1000d0662
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [rdi + 3]
mov dword [rsi], eax
jmp 0x1000d0c43
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r8, rsi
mov rcx, rbp
movdqu xmm5, xmmword [0x10000d0f0]
mov byte [rdi + 0x19], r13b
lea r13, [rdi + 0x1f8]
movdqu xmmword [rdi], xmm5
mov rdx, r13
call fcn.1000c38fc
mov ebx, eax
test eax, eax
je 0x1000d06ec
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d0c43
test byte [rcx + 0x1c], 4
je 0x1000d0c43
cmp byte [rcx + 0x19], 2
jb 0x1000d0c43
mov eax, dword [rsi]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov dword [rsp + 0x28], eax
mov edx, 0x18f
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001dd64
jmp 0x1000d0c43
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d072b
test byte [rcx + 0x1c], 4
je 0x1000d072b
cmp byte [rcx + 0x19], 4
jb 0x1000d072b
mov eax, dword [r13]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x190
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10001daa4
and qword [rsp + 0x30], 0
mov ebx, 3
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, rbp
mov r8d, ebx
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x10], rax
cmp rax, 0xffffffffffffffff
jne 0x1000d07ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
mov ebx, 0xd
cmp rcx, rax
je 0x1000d0c43
test byte [rcx + 0x1c], 4
je 0x1000d0c43
cmp byte [rcx + 0x19], 2
jb 0x1000d0c43
mov edx, 0x191
mov r9, rbp
jmp 0x1000d05d5
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
mov r13b, 4
cmp rcx, rdx
je 0x1000d07ed
test byte [rcx + 0x1c], r13b
je 0x1000d07ed
cmp byte [rcx + 0x19], r13b
jb 0x1000d07ed
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x192
mov r9, rbp
mov qword [rsp + 0x20], rax
call fcn.100059300
and qword [rsp + 0x38], 0
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7405c
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1000d0880
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
mov ebx, 0xd
cmp rcx, rax
je 0x1000d0c43
test byte [rcx + 0x1c], r13b
je 0x1000d0c43
cmp byte [rcx + 0x19], 2
jb 0x1000d0c43
mov edx, 0x193
jmp 0x1000d07a6
mov rax, qword [rsp + 0x48]
cmp rax, r12
jge 0x1000d08ed
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000d08d0
test byte [rcx + 0x1c], r13b
je 0x1000d08d0
cmp byte [rcx + 0x19], 2
jb 0x1000d08d0
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], r12
lea r8, [0x100003198]
mov edx, 0x194
mov r9, rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1000c26a0
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 0xe
jmp 0x1000d0c43
mov rcx, qword [rdi + 0x10]
xor r12d, r12d
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90018
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
jne 0x1000d096f
mov rax, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rax, r14
je 0x1000d0976
test byte [rax + 0x1c], r13b
je 0x1000d0976
cmp byte [rax + 0x19], bl
jb 0x1000d0976
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003198]
mov rcx, qword [rcx + 0x10]
mov edx, 0x195
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10001daa4
jmp 0x1000d0976
lea r14, [0x1001653b8]
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
mov dword [rsp + 0xa8], r12d
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90020
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
jne 0x1000d0a02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
mov ebx, 0xd
cmp rcx, r14
je 0x1000d0c43
test byte [rcx + 0x1c], r13b
je 0x1000d0c43
cmp byte [rcx + 0x19], 2
jb 0x1000d0c43
mov edx, 0x196
jmp 0x1000d07a6
mov rcx, qword [rdi + 0x10]
mov rdx, rsi
call fcn.1000cfe5c
mov rcx, qword [rdi + 0x10]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x1000d0a6f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000d0c40
test byte [rcx + 0x1c], r13b
je 0x1000d0c40
cmp byte [rcx + 0x19], 2
jb 0x1000d0c40
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x197
mov r9, rbp
mov dword [rsp + 0x20], r12d
call fcn.10001daa4
jmp 0x1000d0c40
xor r12d, r12d
xor r9d, r9d
mov r8d, ebx
mov qword [rsp + 0x30], r12
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x10], rax
cmp rax, 0xffffffffffffffff
jne 0x1000d0ae5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
lea ebx, [r12 + 0xd]
cmp rcx, r14
je 0x1000d0c43
test byte [rcx + 0x1c], r13b
je 0x1000d0c43
cmp byte [rcx + 0x19], 2
jb 0x1000d0c43
mov edx, 0x198
jmp 0x1000d07a6
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000d0b1a
test byte [rcx + 0x1c], r13b
je 0x1000d0b1a
cmp byte [rcx + 0x19], r13b
jb 0x1000d0b1a
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x199
mov r9, rbp
mov qword [rsp + 0x20], rax
call fcn.100059300
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90018
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
jne 0x1000d0b90
mov rax, qword [0x1001653b8]
cmp rax, r14
je 0x1000d0b90
test byte [rax + 0x1c], r13b
je 0x1000d0b90
cmp byte [rax + 0x19], bl
jb 0x1000d0b90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003198]
mov rcx, qword [rcx + 0x10]
mov edx, 0x19a
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10001daa4
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xa8]
mov dword [rsp + 0xa8], r12d
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90020
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r12d
jne 0x1000d0c10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
mov ebx, 0xd
cmp rcx, r14
je 0x1000d0c43
test byte [rcx + 0x1c], r13b
je 0x1000d0c43
cmp byte [rcx + 0x19], 2
jb 0x1000d0c43
mov edx, 0x19b
jmp 0x1000d07a6
mov qword [r15], rdi
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000d0c40
test byte [rcx + 0x1c], r13b
je 0x1000d0c40
cmp byte [rcx + 0x19], r13b
jb 0x1000d0c40
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x19c
call fcn.10001c7b8
mov ebx, r12d
lea rcx, [rsp + 0x50]
call fcn.1000c2cfc
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret