Function at 0x1400d9370
Capabilities:
Get disk information
Get file system object information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x78]
mov edx, 0x56009944
mov r8d, 0x90
call fcn.140091ab0
lea rdx, [0x1400d9780]
mov r9, rbx
mov rcx, rax
xor r8d, r8d
mov qword [rbx + 0x3f8], rax
call fcn.140009c70
mov rcx, qword [rbx + 0x3f8]
mov r9d, 0x100010
xor r8d, r8d
mov edx, 0x420
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x3f8]
xor r9d, r9d
lea r8d, [r9 + 0x20]
mov edx, 0x41e
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400d9370
push rbx
push r12
push r14
sub rsp, 0x380
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov r12, rcx
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_GetImageLists]
mov r9, qword [rsp + 0x30]
mov rcx, qword [r12 + 0x3f8]
xor r8d, r8d
mov edx, 0x430
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
lea ecx, [rax + 1]
add rcx, rcx
call fcn.14004af90
mov r14, rax
test rax, rax
je 0x1400d9661
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1400d9659
cmp word [r14], 0
mov qword [rsp + 0x3a8], rbp
mov rbp, r14
je 0x1400d9651
mov qword [rsp + 0x3b0], rsi
mov qword [rsp + 0x3b8], rdi
mov qword [rsp + 0x378], r13
mov qword [rsp + 0x370], r15
xor r15d, r15d
nop dword [rax]
lea rax, [rsp + 0x320]
mov r8, rbp
mov esi, r15d
mov edx, 0x20
lea rcx, [rsp + 0x320]
sub r8, rax
nop
lea rax, [rdx + 0x7fffffde]
test rax, rax
je 0x1400d9474
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400d9474
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400d9450
jmp 0x1400d9479
test rdx, rdx
jne 0x1400d947d
sub rcx, 2
mov word [rcx], r15w
lea rcx, [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x31e], 0x5c
jne 0x1400d94b7
lea rcx, [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov word [rsp + rcx*2 + 0x31e], r15w
lea r8, [rsp + 0x60]
mov r9d, 0x2b8
xor edx, edx
mov rcx, rbp
mov dword [rsp + 0x20], 0x4010
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
add rcx, rcx
call fcn.14004af90
mov rcx, rbp
mov r13, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rdx, eax
je 0x1400d954e
cmp rdx, 0x7fffffff
ja 0x1400d954e
mov r8d, 0x7ffffffe
mov r9, rbp
mov rcx, r13
sub r8, rdx
sub r9, r13
nop dword [rax]
lea rax, [r8 + rdx]
test rax, rax
je 0x1400d9541
movzx eax, word [r9 + rcx]
test ax, ax
je 0x1400d9541
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400d9520
jmp 0x1400d9546
test rdx, rdx
jne 0x1400d954a
sub rcx, 2
mov word [rcx], r15w
mov rcx, qword [r12 + 0x3f8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x418
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, r15d
mov rdi, rax
test eax, eax
jle 0x1400d95ba
nop word [rax + rax]
mov rcx, qword [r12 + 0x3f8]
lea r9, [rsp + 0x38]
movsxd r8, ebx
mov edx, 0x417
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400d95b4
mov rdx, qword [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
js 0x1400d95ba
inc esi
inc ebx
cmp ebx, edi
jl 0x1400d9580
mov eax, dword [rsp + 0x68]
mov rcx, qword [r12 + 0x3f8]
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], eax
mov eax, dword [r12 + 0xf290]
movsxd r8, esi
add eax, 0xb798
mov edx, 0x443
mov word [rsp + 0x40], 0x5004
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x320]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400d9614
inc dword [r12 + 0xf290]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rbp, [rbp + rax*2]
cmp word [rbp], r15w
jne 0x1400d9430
mov r15, qword [rsp + 0x370]
mov r13, qword [rsp + 0x378]
mov rdi, qword [rsp + 0x3b8]
mov rsi, qword [rsp + 0x3b0]
mov rbp, qword [rsp + 0x3a8]
mov rcx, r14
call fcn.14004b048
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x380
pop r14
pop r12
pop rbx
ret