Function at 0x140071b70
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x370
mov rax, qword [0x1400d1548]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rdx
xor edi, edi
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x48]
call fcn.14009bf30
mov ebx, eax
test eax, eax
js 0x140071f0d
lea rdx, [0x1400d2518]
lea rcx, [rsp + 0x38]
call fcn.14001a960
nop
cmp byte [rsi + 0x38], dil
je 0x140071e2d
xor edx, edx
mov r8d, 0xd0
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x30]
call fcn.14006c9cc
mov ebx, eax
test eax, eax
js 0x140071ccd
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetLogicalDrives]
nop dword [rax + rax]
mov r12d, eax
mov esi, edi
cmp esi, 0x1a
jae 0x140071cf4
bt r12d, esi
jae 0x140071cc3
lea r14d, [rsi + 0x41]
movabs rax, 0x5c003a0020
mov qword [rsp + 0x140], rax
mov word [rsp + 0x140], r14w
lea rcx, [rsp + 0x140]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 3
jne 0x140071cc3
lea r9, [rsp + 0x150]
lea r8, [0x1400aa5d0]
movzx edx, word [rsp + 0x30]
movzx ecx, r14w
call fcn.14006ca6c
mov ebx, eax
test eax, eax
js 0x140071cc3
mov rdx, r15
lea rcx, [rsp + 0x150]
call fcn.14006c5cc
mov ebx, eax
cmp eax, 1
jne 0x140071c9e
mov ebx, edi
jmp 0x140071cc3
test eax, eax
js 0x140071cc3
mov eax, esi
lea rdx, [rsp + 0x70]
lea rdx, [rdx + rax*8]
lea rcx, [rsp + 0x150]
call qword [sym.imp.SHCORE.dll_SHStrDupW]
nop dword [rax + rax]
mov ebx, eax
inc esi
test ebx, ebx
jns 0x140071c15
lea rsi, [rsp + 0x70]
mov r14d, 0x1a
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rsi], rdi
lea rsi, [rsi + 8]
sub r14, 1
jne 0x140071cd8
mov dword [rsp + 0x30], ebx
test ebx, ebx
js 0x140071efe
mov r14d, edi
mov dword [rsp + 0x40], edi
lea r12, str.SOFTWAREMicrosoftWindows_SearchCrawlScopeManager_
cmp r14d, 0x1a
jae 0x140071e0d
mov esi, edi
mov r13d, r14d
mov rdx, qword [rsp + r13*8 + 0x70]
test rdx, rdx
je 0x140071df7
mov qword [rsp + 0x140], rdi
lea r8, [rsp + 0x140]
mov rcx, qword [rsp + 0x48]
call fcn.14009bdf8
mov esi, eax
cmp eax, 1
jne 0x140071d56
mov esi, 0x80004005
jmp 0x140071dea
test eax, eax
js 0x140071dea
mov rdx, r15
mov rcx, qword [rsp + 0x140]
call fcn.14009bb78
mov esi, eax
test eax, eax
js 0x140071dea
mov r8d, 0x34
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140016a94
mov rdx, qword [rsp + r13*8 + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140023bd8
lea rdx, [0x1400aa640]
lea rcx, [rsp + 0x38]
call fcn.140023bd8
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.140023bd8
mov rdx, qword [rsp + 0x38]
call fcn.14006c4b8
mov esi, eax
test eax, eax
jle 0x140071dcd
movzx esi, ax
or esi, 0x80070000
jmp 0x140071dea
lea rcx, [rsp + 0x140]
call fcn.140003bbc
test ebx, ebx
cmovns ebx, esi
mov dword [rsp + 0x30], ebx
inc r14d
mov dword [rsp + 0x40], r14d
jmp 0x140071d0e
cmp edi, 0x1a
jae 0x140071efe
mov ecx, edi
mov rcx, qword [rsp + rcx*8 + 0x70]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
inc edi
jmp 0x140071e0d
mov qword [rsp + 0x140], rdi
lea r8, [rsp + 0x140]
lea rdx, [0x1400aa5d0]
mov rcx, qword [rsp + 0x48]
call fcn.14009bdf8
mov ebx, eax
cmp eax, 1
jne 0x140071e5f
mov ebx, 0x80004005
jmp 0x140071ef0
test eax, eax
js 0x140071ef0
mov rdx, r15
mov rcx, qword [rsp + 0x140]
call fcn.14009bb78
mov ebx, eax
test eax, eax
js 0x140071ef0
lea r12, str.SOFTWAREMicrosoftWindows_SearchCrawlScopeManager_
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], di
jne 0x140071e88
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140016a94
lea rdx, [0x1400aa5d0]
lea rcx, [rsp + 0x38]
call fcn.140023bd8
lea rdx, [0x1400aa640]
lea rcx, [rsp + 0x38]
call fcn.140023bd8
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.140023bd8
mov rdx, qword [rsp + 0x38]
call fcn.14006c4b8
mov ebx, eax
test eax, eax
jle 0x140071eea
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140071ef0
lea rcx, [rsp + 0x140]
call fcn.140003bbc
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.1400182a0
nop
lea rcx, [rsp + 0x48]
call fcn.140003bbc
mov eax, ebx
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140036b90
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret