Function at 0x1400d1680
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1401ad640
sub rsp, rax
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15d, ecx
mov dword [rsp + 0x30], ecx
call fcn.1400b3770
xor esi, esi
xor ecx, ecx
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, eax
mov dword [rsp + 0x54], eax
or ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [rsp + 0x180]
call fcn.1400012c0
mov r14, qword [0x14020af80]
test r14, r14
je 0x1400d18a8
movsx eax, byte [r14 + 0x28]
mov r9, qword [r14 + 0x10]
mov r8, qword [r14 + 8]
mov dword [rsp + 0x28], eax
mov rax, qword [r14 + 0x18]
lea rdx, str.config_volume:__s___s___s___d_n
mov ecx, 0xffff00ff
mov qword [rsp + 0x20], rax
call fcn.1400b3610
mov rbx, qword [r14 + 8]
cmp byte [rbx], 0
mov qword [rsp + 0x5e0], rbx
jne 0x1400d17c1
lea rcx, [rsp + 0x3c0]
call fcn.1400012c0
mov rdx, qword [r14 + 0x10]
lea rcx, [rsp + 0x3c0]
call fcn.14017bfd0
mov rcx, qword [rsp + 0x3c8]
lea rdx, [rsp + 0xc20]
mov r8d, 0x104
call qword [0x1402009b0]
test eax, eax
je 0x1400d17a9
lea rdx, [rsp + 0xc20]
lea rcx, [rsp + 0x180]
call fcn.1401760b0
mov rbx, qword [rsp + 0x188]
jmp 0x1400d17ac
mov rbx, rsi
lea rcx, [rsp + 0x3c0]
mov qword [rsp + 0x5e0], rbx
call fcn.140175010
test rbx, rbx
je 0x1400d1897
movsx r13d, byte [r14 + 0x29]
movsx r12d, byte [r14 + 0x2a]
mov rbp, qword [r14 + 0x20]
movsx esi, byte [r14 + 0x28]
mov rdi, qword [r14 + 0x18]
mov rbx, qword [r14 + 0x10]
mov ecx, 0x40
call fcn.1400ce030
mov rcx, rbx
mov r15, rax
call fcn.140174560
mov rbx, qword [rsp + 0x5e0]
mov rcx, rbx
mov qword [r15 + 8], rax
call fcn.140174560
mov rcx, rdi
mov qword [r15 + 0x10], rax
call fcn.14016bb20
mov rcx, rbx
mov qword [r15 + 0x18], rax
call fcn.1400db390
mov rcx, rbp
test eax, eax
mov byte [r15 + 0x38], sil
setne al
mov byte [r15 + 0x20], al
call fcn.14016bb20
mov r9, qword [r15 + 8]
mov r8, qword [r15 + 0x10]
mov qword [r15 + 0x28], rax
mov rax, qword [r15 + 0x18]
lea rdx, str.add_volume:__s___s___s_n
xor esi, esi
mov ecx, 0xffffff00
mov qword [rsp + 0x20], rax
mov byte [r15 + 0x30], r12b
mov dword [r15 + 0x34], r13d
mov dword [r15 + 0x3c], esi
mov byte [r15 + 0x39], 1
call fcn.1400b3610
cmp qword [rsp + 0x38], rsi
je 0x1400d1885
mov rax, qword [rsp + 0x40]
mov qword [rax], r15
jmp 0x1400d188a
mov qword [rsp + 0x38], r15
add dword [rsp + 0x48], 1
mov qword [r15], rsi
mov qword [rsp + 0x40], r15
mov r14, qword [r14]
test r14, r14
jne 0x1400d1710
mov r15d, dword [rsp + 0x30]
lea rcx, [rsp + 0x180]
call fcn.140175010
lea rcx, [rsp + 0x800]
mov edx, 0x104
call qword [0x140200998]
lea rcx, str.VEH__d_n
mov rdx, rax
mov r12, rax
call fcn.1400b35e0
cmp r12, 0xffffffffffffffff
lea r13, [0x1401aef92]
mov ebp, 0x41
je 0x1400d1c99
lea rcx, [rsp + 0x60]
call fcn.1400012c0
lea rcx, [rsp + 0x2a0]
call fcn.1400012c0
jmp 0x1400d1912
xor esi, esi
lea rdx, [rsp + 0x800]
lea rcx, [rsp + 0x60]
call fcn.1401760b0
mov rcx, qword [rsp + 0x68]
call fcn.1400d6d50
mov rdx, qword [rsp + 0x68]
lea rcx, str.volume__s:_drive_type__d_n
mov r8d, eax
mov edi, eax
call fcn.1400b35e0
cmp edi, 3
je 0x1400d1957
cmp edi, 2
je 0x1400d1957
cmp edi, 6
jne 0x1400d1c5a
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x800]
xor r8d, r8d
xor edx, edx
call fcn.1400d63f0
test eax, eax
jne 0x1400d1c5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetVolumePathNamesForVolumeName__d_n
mov edx, eax
mov ebx, eax
call fcn.1400b35e0
cmp ebx, 0xea
jne 0x1400d1a51
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400d1c5a
mov rcx, rax
add rcx, rcx
call fcn.1400ce030
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x800]
mov rdx, rax
mov rsi, rax
call fcn.1400d63f0
test eax, eax
je 0x1400d1a44
cmp word [rsi], 0
mov rbx, rsi
je 0x1400d1a44
nop
nop
lea rcx, [rsp + 0x2a0]
mov rdx, rbx
call fcn.1401760b0
mov rdx, qword [rsp + 0x2a8]
lea rcx, str.GetVolumePathNamesForVolumeName__s_n
call fcn.1400b35e0
mov r9, qword [rsp + 0x2a8]
mov r8, qword [rsp + 0x68]
lea rcx, [rsp + 0x38]
mov edx, edi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], r13
call fcn.1400d1310
cmp word [rbx], 0
je 0x1400d1a3a
add rbx, 2
cmp word [rbx], 0
jne 0x1400d1a30
add rbx, 2
cmp word [rbx], 0
jne 0x1400d19e0
mov rcx, rsi
call fcn.1400ce0b0
jmp 0x1400d1c5a
lea rcx, [rsp + 0x180]
call fcn.1400012c0
mov ebx, ebp
lea rdx, [rsp + 0x5e0]
lea rcx, str.GetVolumeNameForVolumeMountPoint__S_n
mov word [rsp + 0x5e0], bx
mov word [rsp + 0x5e2], 0x3a
mov word [rsp + 0x5e4], 0x5c
mov word [rsp + 0x5e6], 0
call fcn.1400b35e0
lea rdx, [rsp + 0x5f0]
lea rcx, [rsp + 0x5e0]
mov r8d, 0x104
call qword [0x1402009b0]
test eax, eax
je 0x1400d1afe
lea rdx, [rsp + 0x5f0]
lea rcx, [rsp + 0x180]
call fcn.1401760b0
mov r8, qword [rsp + 0x188]
mov rdx, qword [rsp + 0x68]
lea rcx, str.GetVolumeNameForVolumeMountPoint_ok__s__s_n
call fcn.1400b35e0
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x68]
call fcn.14016cd50
test eax, eax
je 0x1400d1b0f
add ebx, 1
cmp ebx, 0x5a
jle 0x1400d1a60
jmp 0x1400d1c4d
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x2a0]
call fcn.1401760b0
mov r9, qword [rsp + 0x2a8]
mov r8, qword [rsp + 0x188]
lea rcx, [rsp + 0x38]
mov edx, edi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r13
call fcn.1400d1310
cmp edi, 2
mov word [rsp + 0x5f0], bx
mov word [rsp + 0x5f2], 0x3a
mov word [rsp + 0x5f4], 0x5c
jne 0x1400d1b77
cmp byte [0x14020ac86], 0
je 0x1400d1c4d
lea rdx, [rsp + 0x5f6]
lea rcx, [rsp + 0x800]
mov r8d, 0x101
call qword [0x1402009b8]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x1400d1c4d
lea rdx, [rsp + 0x5f0]
lea rcx, [rsp + 0x2a0]
call fcn.1401760b0
lea rdx, [rsp + 0x800]
lea rcx, [rsp + 0x5f0]
mov r8d, 0x104
call qword [0x1402009b0]
test eax, eax
je 0x1400d1c25
lea rdx, [rsp + 0x800]
lea rcx, [rsp + 0x60]
call fcn.1401760b0
mov rcx, qword [rsp + 0x2a8]
call fcn.1400d6d50
cmp eax, 3
je 0x1400d1c03
cmp eax, 2
je 0x1400d1c03
cmp eax, 6
jne 0x1400d1c25
mov r9, qword [rsp + 0x2a8]
mov r8, qword [rsp + 0x68]
lea rcx, [rsp + 0x38]
mov edx, eax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r13
call fcn.1400d1310
lea rdx, [rsp + 0x5f6]
mov r8d, 0x101
mov rcx, rbx
call qword [0x1402009c0]
test eax, eax
jne 0x1400d1ba0
mov rcx, rbx
call qword [0x1402009c8]
lea rcx, [rsp + 0x180]
call fcn.140175010
lea rdx, [rsp + 0x800]
mov r8d, 0x104
mov rcx, r12
call qword [0x1402009a0]
test eax, eax
jne 0x1400d1910
lea rcx, [rsp + 0x2a0]
call fcn.140175010
lea rcx, [rsp + 0x60]
call fcn.140175010
mov rcx, r12
call qword [0x1402009a8]
lea rcx, [rsp + 0x180]
call fcn.1400012c0
lea rcx, [rsp + 0x3c0]
call fcn.1400012c0
lea rcx, [rsp + 0x5f0]
call fcn.1400012c0
lea rcx, [rsp + 0x800]
call fcn.1400012c0
mov byte [rsp + 0x31], 0x3a
mov byte [rsp + 0x32], 0
lea rdi, [0x1401cd8bc]
nop
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], bpl
call fcn.1400d6d50
cmp eax, 3
mov ebx, eax
je 0x1400d1d04
cmp eax, 2
je 0x1400d1d04
cmp eax, 6
jne 0x1400d1f71
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x3c0]
call fcn.14017c0f0
mov rcx, qword [rsp + 0x3c8]
lea rdx, [rsp + 0xe30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1400d1f71
mov rdx, qword [rsp + 0x3c8]
mov eax, eax
lea r8, [rsp + 0xe30]
lea rcx, str.QueryDosDevice__S__S_n
mov word [rsp + rax*2 + 0xe30], 0
call fcn.1400b35e0
lea rdx, [rsp + 0xe30]
lea rcx, [rsp + 0x5f0]
call fcn.140176160
mov rax, qword [rsp + 0x5f8]
mov r11, rdi
mov rdx, rax
mov cl, 0x5c
sub rdx, rdi
nop
nop
cmp byte [r11 + rdx], cl
jne 0x1400d1e2e
movzx ecx, byte [r11 + 1]
add r11, 1
test cl, cl
jne 0x1400d1d90
mov rax, qword [rsp + 0x3c8]
lea r9, [rsp + 0xc20]
lea rdx, [rsp + 0xe30]
movzx ecx, word [rax]
mov r8d, 0x104
mov dword [rsp + 0x20], 0x104
call fcn.1400dabe0
test eax, eax
je 0x1400d1f71
lea rdx, [rsp + 0xe30]
lea rcx, [rsp + 0x180]
call fcn.1401760b0
lea rdx, [rsp + 0xc20]
lea rcx, [rsp + 0x800]
call fcn.140175db0
mov rax, qword [rsp + 0x808]
mov r8, qword [rsp + 0x188]
mov dword [rsp + 0x28], 0
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
jmp 0x1400d1f65
lea rdx, str.DeviceHarddiskVolume
mov cl, 0x5c
sub rdx, rax
nop
nop
cmp byte [rax], cl
jne 0x1400d1e56
movzx ecx, byte [rdx + rax + 1]
add rax, 1
test cl, cl
jne 0x1400d1e40
jmp 0x1400d1f71
lea rdx, [rsp + 0xc20]
lea rcx, [rsp + 0xa10]
mov r8d, 0x104
mov word [rsp + 0xa10], bp
mov word [rsp + 0xa12], 0x3a
mov word [rsp + 0xa14], 0x5c
mov word [rsp + 0xa16], 0
call qword [0x1402009b0]
test eax, eax
je 0x1400d1ef3
lea rdx, [rsp + 0xc20]
lea rcx, [rsp + 0x180]
call fcn.1401760b0
lea r8, [rsp + 0xc20]
lea rdx, [rsp + 0xa10]
lea rcx, str._S_GetVolumeNameForVolumeMountPoint__S__d_n
mov r9d, ebx
call fcn.1400b35e0
lea rdx, [rsp + 0xa10]
lea rcx, str._S_is_ntfs_n
call fcn.1400b35e0
mov r8, qword [rsp + 0x188]
lea r9, [rsp + 0x30]
jmp 0x1400d1f58
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xa10]
lea rcx, str._S_GetVolumeNameForVolumeMountPoint_FAILED__d_n
mov r8d, eax
call fcn.1400b35e0
mov byte [rsp + 0x2a0], bpl
mov byte [rsp + 0x2a1], 0x3a
mov byte [rsp + 0x2a2], 0
mov byte [rsp + 0x60], 0x5c
mov byte [rsp + 0x61], 0x5c
mov byte [rsp + 0x62], 0x2e
mov byte [rsp + 0x63], 0x5c
mov byte [rsp + 0x64], bpl
mov byte [rsp + 0x65], 0x3a
mov byte [rsp + 0x66], 0
lea r9, [rsp + 0x2a0]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
lea rcx, [rsp + 0x38]
mov edx, ebx
call fcn.1400d1310
add ebp, 1
cmp ebp, 0x5a
jle 0x1400d1ce0
lea rcx, [rsp + 0x800]
call fcn.140175010
lea rcx, [rsp + 0x5f0]
call fcn.140175010
lea rcx, [rsp + 0x3c0]
call fcn.140175010
lea rcx, [rsp + 0x180]
call fcn.140175010
movsxd r11, dword [rsp + 0x48]
test r11d, r11d
je 0x1400d21b3
mov rcx, r11
shl rcx, 3
call fcn.1400ce030
cmp byte [reloc.WS2_32.dll_accept], 0
mov rbx, qword [rsp + 0x38]
mov r13, rax
je 0x1400d2097
test rbx, rbx
mov r9, rbx
je 0x1400d2097
nop
cmp byte [r9 + 0x20], 0
jne 0x1400d2085
mov rcx, qword [r9 + 8]
cmp byte [rcx], 0
je 0x1400d2085
cmp byte [rcx + 1], 0x3a
jne 0x1400d2085
cmp byte [rcx + 2], 0
jne 0x1400d2085
mov r8, rbx
cmp r8, r9
je 0x1400d207d
cmp byte [r8 + 0x20], 0
je 0x1400d207d
mov rcx, qword [r9 + 0x10]
mov rax, qword [r8 + 0x10]
movzx edx, byte [rcx]
cmp dl, byte [rax]
jne 0x1400d2045
test dl, dl
je 0x1400d204f
mov dl, byte [rcx + 1]
add rcx, 1
add rax, 1
cmp dl, byte [rax]
je 0x1400d2032
movzx eax, byte [rax]
movzx ecx, byte [rcx]
cmp ecx, eax
jne 0x1400d207d
mov rcx, qword [r9 + 0x18]
mov rax, qword [r8 + 0x18]
movzx edx, byte [rcx]
cmp dl, byte [rax]
jne 0x1400d2073
nop
test dl, dl
je 0x1400d20b5
mov dl, byte [rcx + 1]
add rcx, 1
add rax, 1
cmp dl, byte [rax]
je 0x1400d2060
movzx eax, byte [rax]
movzx ecx, byte [rcx]
sub ecx, eax
je 0x1400d20b5
mov r8, qword [r8]
test r8, r8
jne 0x1400d2017
xor eax, eax
mov byte [r9 + 0x21], al
mov r9, qword [r9]
test r9, r9
jne 0x1400d1ff0
xor ebp, ebp
test rbx, rbx
je 0x1400d2131
mov rdi, r13
test r15d, r15d
mov rsi, qword [rbx]
je 0x1400d20bc
cmp byte [rbx + 0x38], 0
je 0x1400d20ed
jmp 0x1400d20c2
mov eax, 1
jmp 0x1400d2087
cmp byte [rbx + 0x38], 0
je 0x1400d211b
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400d20d1
cmp byte [rbx + 0x21], 0
jne 0x1400d20ed
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400d211b
cmp byte [rbx + 0x20], 0
jne 0x1400d211b
mov rcx, qword [rbx + 0x10]
call fcn.1400db390
test eax, eax
jne 0x1400d211b
mov rcx, qword [rbx + 8]
call fcn.1400ce0b0
mov rcx, qword [rbx + 0x10]
call fcn.1400ce0b0
mov rcx, qword [rbx + 0x18]
call fcn.1400ce0b0
mov rcx, qword [rbx + 0x28]
call fcn.1400ce0b0
mov rcx, rbx
call fcn.1400ce0b0
jmp 0x1400d2125
mov qword [rdi], rbx
add ebp, 1
add rdi, 8
test rsi, rsi
mov rbx, rsi
jne 0x1400d20a5
lea r8, [0x1400d1590]
mov edx, ebp
mov rcx, r13
call fcn.1400e1740
xor edi, edi
xor ecx, ecx
xor ebx, ebx
test ebp, ebp
movsxd rsi, ebp
jle 0x1400d21a9
nop
test rdi, rdi
je 0x1400d215f
mov rax, qword [r13 + rbx*8]
mov qword [rcx], rax
jmp 0x1400d2164
mov rdi, qword [r13 + rbx*8]
mov r8, qword [r13 + rbx*8]
lea rdx, str.volume:__s___s___s_found__d_n
mov ecx, 0xffffff00
movsx eax, byte [r8 + 0x20]
mov r9, qword [r8 + 8]
mov dword [rsp + 0x28], eax
mov rax, qword [r8 + 0x18]
mov r8, qword [r8 + 0x10]
mov qword [rsp + 0x20], rax
call fcn.1400b3610
mov rcx, qword [r13 + rbx*8]
add rbx, 1
mov qword [rcx], 0
cmp rbx, rsi
jl 0x1400d2150
mov rcx, r13
call fcn.1400ce0b0
jmp 0x1400d21b8
mov rdi, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.1400b3770
lea rcx, str.ntfs_volume_create_list__f_seconds_n
sub eax, dword [rsp + 0x58]
mov edx, eax
call fcn.1400b35e0
mov rax, rdi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1401a6ae0
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret