Function at 0x140021120
Capabilities:
Get disk information via ioctl

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x100
mov rax, qword [0x14005d338]
xor rax, rsp
mov qword [rbp - 9], rax
mov rbx, qword [rbp + 0x6f]
mov r14d, r8d
mov dword [rbp - 0x71], r8d
mov rsi, rdx
mov qword [rbp - 0x61], rdx
mov r15, rcx
mov rdx, qword [rdx]
mov r8d, 0x781
mov qword [rbp - 0x49], rcx
mov r13, r9
lea rcx, [rbp - 0x41]
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x51], r9
mov qword [rbp - 0x41], 0xffffffffffffffff
call qword [sym.imp.VBoxRT.dll_RTFileOpen]
mov edi, eax
test eax, eax
jns 0x1400211dd
mov rdx, qword [rsi]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxStorageVMDK.cpp
mov rcx, qword [r15 + 0x20]
mov r9d, 0xfa4
mov dword [rsp + 0x50], eax
lea rax, str.VMDK:_Image_path:__s._Failed_to_open_partition__u_on__s_via__s___Rrc_
mov qword [rsp + 0x48], rdx
mov rdx, qword [r15]
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rdx
mov edx, edi
mov qword [rsp + 0x28], rax
lea rax, str.int___cdecl_vmdkRawDescVerifyPartitionPath_struct_VMDKIMAGE__struct_VDISKRAWPARTDESC__unsigned_int_const_char__struct_RTFILEINT__unsigned_int_struct_RTDVMVOLUMEINTERNAL__
mov qword [rsp + 0x20], rax
call fcn.140015a10
jmp 0x140021b43
xor eax, eax
mov qword [rsp + 0xf8], r12
mov rcx, rbx
mov qword [rbp - 0x19], rax
mov dword [rbp - 0x11], eax
call qword [sym.imp.VBoxRT.dll_RTFileToNative]
xor r12d, r12d
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x59]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov edx, 0x2d1080
lea rax, [rbp - 0x19]
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea r14, str.int___cdecl_vmdkRawDescVerifyPartitionPath_struct_VMDKIMAGE__struct_VDISKRAWPARTDESC__unsigned_int_const_char__struct_RTFILEINT__unsigned_int_struct_RTDVMVOLUMEINTERNAL__
test eax, eax
jne 0x14002128a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [r15]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
mov dword [rsp + 0x40], ebx
lea rcx, str.VMDK:_Image_path:__s._IOCTL_STORAGE_GET_DEVICE_NUMBER_failed_on__s:__u
mov qword [rsp + 0x38], r13
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxStorageVMDK.cpp
mov qword [rsp + 0x30], rdi
mov r9d, 0xfb3
mov qword [rsp + 0x28], rcx
mov edx, eax
mov rcx, qword [r15 + 0x20]
mov qword [rsp + 0x20], r14
call fcn.140015a10
mov edi, eax
mov rcx, qword [rbp - 0x41]
xor eax, eax
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
call qword [sym.imp.VBoxRT.dll_RTFileToNative]
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
lea rax, [rbp - 0x59]
mov edx, 0x2d1080
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x29]
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14002132d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsi]
mov ebx, eax
mov rsi, qword [r15]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
mov dword [rsp + 0x40], ebx
lea rcx, str.VMDK:_Image_path:__s._IOCTL_STORAGE_GET_DEVICE_NUMBER_failed_on__s:__u
mov qword [rsp + 0x38], rdi
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxStorageVMDK.cpp
mov qword [rsp + 0x30], rsi
mov r9d, 0xfbb
mov qword [rsp + 0x28], rcx
mov edx, eax
mov rcx, qword [r15 + 0x20]
mov qword [rsp + 0x20], r14
call fcn.140015a10
mov rsi, qword [rbp - 0x61]
mov edi, eax
test edi, edi
js 0x140021b2f
mov edx, dword [rbp - 0x15]
mov r8d, dword [rbp - 0x25]
mov eax, dword [rbp - 0x19]
mov ecx, dword [rbp - 0x29]
cmp edx, r8d
jne 0x14002134b
cmp eax, ecx
je 0x1400213ae
mov dword [rsp + 0x68], ecx
mov r9d, 0xfc1
mov rcx, qword [r15 + 0x20]
mov dword [rsp + 0x60], eax
mov rax, qword [rsi]
mov dword [rsp + 0x58], r8d
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxStorageVMDK.cpp
mov dword [rsp + 0x50], edx
mov edx, 0xffffa878
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x71]
mov dword [rsp + 0x38], eax
mov rax, qword [r15]
mov qword [rsp + 0x30], rax
lea rax, str.VMDK:_Image_path:__s._Partition__u_path___s__verification_failed_on__s___x____x___x____x_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call fcn.140015a10
mov edi, eax
test eax, eax
js 0x140021b2f
mov rcx, qword [rbp - 0x39]
mov dword [rbp - 0x69], r12d
call qword [sym.imp.VBoxRT.dll_RTFileToNative]
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
lea rax, [rbp - 0x69]
mov edx, 0x70050
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400213f6
mov eax, dword [rbp - 0x69]
cmp eax, 0xc0
jae 0x1400213fb
mov eax, 0x2430
add eax, 0x120
lea rdx, [0x140046f00]
mov ecx, eax
mov dword [rbp - 0x69], eax
call qword [sym.imp.VBoxRT.dll_RTMemTmpAllocZTag]
mov r13, rax
test rax, rax
je 0x140021b2a
mov rcx, qword [rbp - 0x39]
mov ebx, dword [rbp - 0x69]
mov dword [rbp - 0x59], r12d
call qword [sym.imp.VBoxRT.dll_RTFileToNative]
mov qword [rsp + 0x38], r12
lea rcx, [rbp - 0x59]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov rcx, rax
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov edx, 0x70050
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140021767
mov edx, dword [r13 + 4]
mov r8d, dword [rbp - 0x21]
mov eax, r12d
test edx, edx
je 0x140021487
lea rcx, [r13 + 0x48]
cmp dword [rcx], r8d
je 0x140021487
inc eax
add rcx, 0x90
cmp eax, edx
jb 0x140021475
mov rbx, qword [rbp - 0x51]
cmp eax, edx
jae 0x140021524
mov rcx, qword [rsi + 0x18]
lea rax, [rax + rax*8]
add rax, rax
mov rdx, qword [r13 + rax*8 + 0x38]
cmp rdx, rcx
je 0x1400214dd
mov rax, qword [rsi]
mov r9d, 0xfe0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x71]
mov dword [rsp + 0x38], eax
mov rax, qword [r15]
mov qword [rsp + 0x30], rax
lea rax, str.VMDK:_Image_path:__s._Partition__u_path___s__verification_failed_on__s:_StartingOffset__RU64__expected__RU64
jmp 0x140021556
mov rcx, qword [rsi + 0x20]
mov rdx, qword [r13 + rax*8 + 0x40]
cmp rdx, rcx
je 0x140021577
mov rax, qword [rsi]
mov r9d, 0xfe5
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x71]
mov dword [rsp + 0x38], eax
mov rax, qword [r15]
mov qword [rsp + 0x30], rax
lea rax, str.VMDK:_Image_path:__s._Partition__u_path___s__verification_failed_on__s:_PartitionLength__RU64__expected__RU64
jmp 0x140021556
mov rax, qword [rsi]
mov r9d, 0xfed
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x50], r8d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x71]
mov dword [rsp + 0x38], eax
mov rax, qword [r15]
mov qword [rsp + 0x30], rax
lea rax, str.VMDK:_Image_path:__s._Partition__u_path___s__verification_failed_on__s:_PartitionCount___x_vs__x_
mov rcx, qword [r15 + 0x20]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxStorageVMDK.cpp
mov qword [rsp + 0x28], rax
mov edx, 0xffffa878
mov qword [rsp + 0x20], r14
call fcn.140015a10
mov edi, eax
test edi, edi
jns 0x1400217e1
mov ecx, 0x1950010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400215b7
mov ecx, dword [r13 + 4]
lea r9, str.VMDK:_Windows_reports__u_partitions_for__s:_n
mov qword [rsp + 0x28], rbx
mov edx, 0x10
mov dword [rsp + 0x20], ecx
mov r8d, 0x195
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
lea rbx, [r13 + 0x30]
mov esi, r12d
cmp dword [r13 + 4], r12d
jbe 0x14002170a
nop dword [rax + rax]
mov ecx, 0x1950010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x140021626
movzx ecx, byte [rbx + 0x1c]
lea r9, str.VMDK:__u__u:__016RU64_LB__016RU64_style_d_rewrite_d
mov dword [rsp + 0x48], ecx
mov edx, 0x10
mov ecx, dword [rbx]
mov r8d, 0x195
mov dword [rsp + 0x40], ecx
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x30], rcx
mov ecx, dword [rbx + 0x18]
mov dword [rsp + 0x28], ecx
mov rcx, rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov eax, dword [rbx]
mov ecx, 0x1950010
test eax, eax
jne 0x140021680
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400216f7
movzx edx, byte [rbx + 0x22]
mov ecx, dword [rbx + 0x24]
movzx r8d, byte [rbx + 0x21]
movzx r9d, byte [rbx + 0x20]
mov dword [rsp + 0x38], ecx
mov rcx, rax
mov dword [rsp + 0x30], edx
mov edx, 0x10
mov dword [rsp + 0x28], r8d
mov r8d, 0x195
mov dword [rsp + 0x20], r9d
lea r9, str._type_x_boot_d_rec_d_hidden_u_n
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x1400216f7
cmp eax, 1
jne 0x1400216d1
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400216f7
lea rdx, [rbx + 0x30]
lea r8, [rbx + 0x20]
lea rcx, [rbx + 0x48]
mov qword [rsp + 0x38], rcx
lea r9, str._type_RTuuid_id_RTuuid_aatrib_RX64_name_.36ls_n
mov rcx, qword [rbx + 0x40]
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rdx
mov edx, 0x10
mov qword [rsp + 0x20], r8
mov r8d, 0x195
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x1400216f7
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400216f7
lea r9, [0x14004b194]
mov edx, 0x10
mov r8d, 0x195
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
inc esi
add rbx, 0x90
cmp esi, dword [r13 + 4]
jb 0x1400215d0
mov ecx, 0x1950010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rsi, qword [rbp - 0x61]
test rax, rax
je 0x1400217e1
mov rcx, qword [rsi + 0x20]
lea r9, str.VMDK:_Looked_for_partition__u___u___s__at__RU64_LB__RU64_n
mov qword [rsp + 0x40], rcx
mov edx, 0x10
mov rcx, qword [rsi + 0x18]
mov r8d, 0x195
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rcx
mov ecx, dword [rbp - 0x71]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rbp - 0x21]
mov dword [rsp + 0x20], ecx
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x1400217e1
mov r14d, dword [rbp - 0x59]
mov r15d, dword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsi]
mov ebx, eax
mov rsi, qword [rbp - 0x49]
mov rsi, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
mov dword [rsp + 0x50], r14d
lea rcx, str.VMDK:_Image_path:__s._IOCTL_DISK_GET_DRIVE_LAYOUT_EX_failed_on__s:__u__cb__u__cbRet__u_
mov dword [rsp + 0x48], r15d
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxStorageVMDK.cpp
mov r15, qword [rbp - 0x49]
mov r9d, 0x100a
mov dword [rsp + 0x40], ebx
mov edx, eax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rcx
lea rcx, str.int___cdecl_vmdkRawDescVerifyPartitionPath_struct_VMDKIMAGE__struct_VDISKRAWPARTDESC__unsigned_int_const_char__struct_RTFILEINT__unsigned_int_struct_RTDVMVOLUMEINTERNAL__
mov qword [rsp + 0x20], rcx
mov rcx, qword [r15 + 0x20]
call fcn.140015a10
mov rsi, qword [rbp - 0x61]
mov edi, eax
mov rcx, r13
call qword [sym.imp.VBoxRT.dll_RTMemTmpFree]
test edi, edi
js 0x140021b2f
mov ebx, dword [rbp + 0x77]
xor edx, edx
mov rax, qword [rsi + 0x20]
mov ecx, 0x20
div rbx
lea rdx, [0x140046f00]
cmp rax, rcx
cmovbe rcx, rax
imul rbx, rcx
lea rdi, [rbx + rbx]
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTMemTmpAllocTag]
mov r14, rax
test rax, rax
je 0x140021ae6
lea rdi, [rax + rbx]
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x69], rdi
mov r15, r12
mov esi, r12d
mov r13d, r12d
jmp 0x140021854
mov rdi, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x61]
mov r9, rbx
mov rcx, qword [rbp - 0x39]
mov r8, r14
mov qword [rsp + 0x20], r12
mov rdx, qword [rdx + 0x18]
call qword [sym.imp.VBoxRT.dll_RTFileReadAt]
mov edx, eax
test eax, eax
mov rax, qword [rbp - 0x61]
js 0x14002196e
mov rdx, qword [rax + 0x10]
mov r9, rbx
mov rcx, qword [rbp - 0x41]
mov r8, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.VBoxRT.dll_RTFileReadAt]
mov edx, eax
test eax, eax
js 0x14002195b
mov r8, rbx
mov rdx, rdi
mov rcx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14002194a
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.VBoxRT.dll_RTCrc64]
mov rcx, qword [rbp - 0x69]
mov rdx, rbx
mov rdi, rax
call qword [sym.imp.VBoxRT.dll_RTCrc64]
cmp qword [rbp - 0x31], rdi
jne 0x14002192e
cmp r15, rax
jne 0x14002192e
inc esi
cmp esi, 4
jbe 0x140021931
mov r15, qword [rbp - 0x49]
lea r13, str.int___cdecl_vmdkRawDescVerifyPartitionPath_struct_VMDKIMAGE__struct_VDISKRAWPARTDESC__unsigned_int_const_char__struct_RTFILEINT__unsigned_int_struct_RTDVMVOLUMEINTERNAL__
mov rdi, qword [rbp - 0x69]
test rbx, rbx
je 0x140021916
mov rdx, rdi
mov rcx, r14
sub rdx, r14
movzx eax, byte [rdx + rcx]
cmp byte [rcx], al
jne 0x140021916
inc r12
inc rcx
cmp r12, rbx
jb 0x140021903
mov rax, rbx
sub rax, r12
cmp rax, 0x10
ja 0x1400219d5
sub ebx, r12d
jmp 0x1400219da
mov esi, r12d
inc r13d
mov qword [rbp - 0x31], rdi
mov r15, rax
cmp r13d, 0x100
jb 0x140021850
jmp 0x1400218e6
mov rcx, r14
mov edi, r12d
call qword [sym.imp.VBoxRT.dll_RTMemTmpFree]
jmp 0x140021b2f
mov rax, qword [rbp - 0x61]
mov r9d, 0x116b
mov rcx, qword [rax]
mov r8, qword [rax + 0x10]
jmp 0x14002197c
mov rcx, qword [rbp - 0x51]
mov r9d, 0x1170
mov r8, qword [rax + 0x18]
mov r15, qword [rbp - 0x49]
lea r13, str.int___cdecl_vmdkRawDescVerifyPartitionPath_struct_VMDKIMAGE__struct_VDISKRAWPARTDESC__unsigned_int_const_char__struct_RTFILEINT__unsigned_int_struct_RTDVMVOLUMEINTERNAL__
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x48], r8
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxStorageVMDK.cpp
mov qword [rsp + 0x40], rcx
mov rax, qword [r15]
mov rcx, qword [r15 + 0x20]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, str.VMDK:_Image_path:__s._Error_reading__zu_bytes_from__s_at_offset__RU64___Rrc_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call fcn.140015a10
mov edi, eax
cmp eax, 0xffffa878
jne 0x140021adb
jmp 0x1400218f1
mov ebx, 0x10
test esi, esi
je 0x140021a65
lea rax, [r12 + rdi]
mov r9d, 0x117e
mov qword [rsp + 0x78], rax
lea rcx, [r12 + r14]
mov rax, qword [rbp - 0x51]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxStorageVMDK.cpp
mov dword [rsp + 0x70], ebx
mov edx, 0xffffa878
mov qword [rsp + 0x68], rcx
mov rcx, qword [r15 + 0x20]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x61]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x71]
mov dword [rsp + 0x38], eax
mov rax, qword [r15]
mov qword [rsp + 0x30], rax
lea rax, str.VMDK:_Image_path:__s._Partition__u_path___s__verification_failed_on__s__cStable_d___zx:__.Rhxs_vs__.Rhxs_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call fcn.140015a10
mov rcx, r14
mov edi, eax
call qword [sym.imp.VBoxRT.dll_RTMemTmpFree]
jmp 0x140021b2f
mov ecx, 0x1950010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov r10, rax
test rax, rax
je 0x140021ad6
mov rax, qword [rbp - 0x51]
lea rcx, [r12 + rdi]
mov qword [rsp + 0x60], rcx
lea r9, [r12 + r14]
mov dword [rsp + 0x58], ebx
mov edx, 0x10
mov qword [rsp + 0x50], r9
mov r8d, 0x195
mov dword [rsp + 0x48], ebx
lea r9, str.VMDK:_Image_path:__s._Partition__u_path___s__verification_undecided_on__s_because_of_unstable_data_____zx:__.Rhxs_vs__.Rhxs__n
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x61]
mov rcx, qword [rax]
mov eax, dword [rbp - 0x71]
mov qword [rsp + 0x30], rcx
mov rcx, r10
mov dword [rsp + 0x28], eax
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov edi, 0x5788
mov rcx, r14
call qword [sym.imp.VBoxRT.dll_RTMemTmpFree]
jmp 0x140021b2f
mov rax, qword [r15]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxStorageVMDK.cpp
mov rcx, qword [r15 + 0x20]
mov r9d, 0x118e
mov qword [rsp + 0x38], rdi
mov edx, 0xffffffec
mov qword [rsp + 0x30], rax
lea rax, str.VMDK:_Image_path:__s._Failed_to_allocate__zu_bytes_for_a_temporary_read_buffer_n
mov qword [rsp + 0x28], rax
lea rax, str.int___cdecl_vmdkRawDescVerifyPartitionPath_struct_VMDKIMAGE__struct_VDISKRAWPARTDESC__unsigned_int_const_char__struct_RTFILEINT__unsigned_int_struct_RTDVMVOLUMEINTERNAL__
mov qword [rsp + 0x20], rax
call fcn.140015a10
mov edi, eax
jmp 0x140021b2f
mov edi, 0xffffffec
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.VBoxRT.dll_RTFileClose]
mov r12, qword [rsp + 0xf8]
mov eax, edi
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140044280
add rsp, 0x100
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret