Function at 0x140032050
Capabilities:
Get common file path
Get disk information

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x848]
sub rsp, 0x920
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rbp + 0x810], rax
movzx r15d, r8b
mov byte [rsp + 0x40], dl
mov r13, rcx
mov qword [rsp + 0x78], rcx
xor edi, edi
mov dword [rsp + 0x4c], edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov eax, 1
mov dword [rsp + 0x4c], eax
mov r14d, edi
mov r12, qword [rsp + 0x78]
movzx ebx, byte [rbp + 0x870]
mov esi, edi
nop word [rax + rax]
mov dword [rsp + 0x20], esi
mov r9d, r14d
lea r8, str.DeviceHarddisk_dPartition_d
mov edx, 0x40
lea rcx, [rbp + 0x540]
call section..text
mov word [rbp + 0x2c0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x2c2]
call fcn.1400a4ea0
xor edx, edx
lea r8d, [rdx + 0x5c]
lea rcx, [rbp + 0x4c8]
call fcn.1400a4ea0
test bl, bl
je 0x14003212a
test esi, esi
mov r8d, 1
jne 0x14003212d
mov r8d, edi
xor r9d, r9d
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x540]
call fcn.14001d5c0
test eax, eax
jne 0x140032154
test esi, esi
je 0x14003272e
jmp 0x140032625
mov dword [rbp - 0x70], 0
mov word [rbp - 0x6c], 0
mov byte [rbp - 0x6a], 0
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rdi
mov word [rbp - 0x68], di
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], rdi
mov word [rbp - 0x40], di
mov qword [rbp], 7
mov qword [rbp - 8], rdi
mov word [rbp - 0x18], di
mov byte [rbp + 0x10], 0
mov qword [rbp + 0x18], rdi
mov byte [rbp + 0x64], 0
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], rdi
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rbp + 0x24]
call fcn.1400a4ea0
nop
mov dword [rbp + 0x20], r14d
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x540]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x540]
lea rcx, [rbp - 0x18]
call fcn.140006260
xor edx, edx
mov r8d, 0x230
lea rcx, [rbp + 0x90]
call fcn.1400a4ea0
mov edx, 0x104
lea rcx, [rbp + 0x90]
lea rdi, [rbp + 0x540]
lea rax, [rbp + 0x90]
sub rdi, rax
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140032243
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140032243
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140032220
jmp 0x140032248
test rdx, rdx
jne 0x14003224c
sub rcx, 2
xor edi, edi
mov word [rcx], di
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x230
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x230
lea r8, [rbp + 0x90]
mov edx, 0x222038
mov rcx, qword [0x140148300]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400322b1
mov rax, qword [rbp + 0x2b0]
shr rax, 8
test al, al
setne byte [rbp - 0x70]
mov rax, qword [rbp + 0x2a0]
jmp 0x1400322fb
xor eax, eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x540]
call fcn.14001f0c0
test eax, eax
jne 0x1400322f6
test esi, esi
jne 0x1400322ff
lea rdx, [rsp + 0x50]
mov ecx, r14d
call fcn.14001f200
test eax, eax
je 0x1400322ff
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x18], rax
test bl, bl
je 0x14003230f
cmp dword [rbp + 0x4d4], edi
mov byte [rbp - 0x6a], 1
jne 0x140032313
mov byte [rbp - 0x6a], dil
cmp byte [rsp + 0x40], dil
jne 0x1400324dd
lea rcx, [rbp + 0x540]
call fcn.14001f450
mov ebx, eax
test eax, eax
js 0x1400324b9
or rcx, 0xffffffffffffffff
mov rdx, qword [rbp - 0x58]
sub rcx, rdx
cmp rcx, 1
jbe 0x140032749
lea rdi, [rdx + 1]
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
ja 0x14003273c
mov r8, qword [rbp - 0x50]
cmp r8, rdi
jae 0x140032382
mov r8, rdx
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.1400055a0
mov r8, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
jmp 0x1400323a9
test rdi, rdi
jne 0x1400323a9
xor r9d, r9d
mov qword [rbp - 0x58], r9
lea rax, [rbp - 0x68]
cmp r8, 8
cmovae rax, qword [rbp - 0x68]
mov word [rax], r9w
mov r8, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
jmp 0x1400323ac
xor r9d, r9d
test rdi, rdi
setne al
test al, al
je 0x1400323e1
lea ecx, [rbx + 0x41]
lea rax, [rbp - 0x68]
cmp r8, 8
cmovae rax, qword [rbp - 0x68]
mov word [rax + rdx*2], cx
mov qword [rbp - 0x58], rdi
lea rax, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rax, qword [rbp - 0x68]
mov word [rax + rdi*2], r9w
mov r8d, 1
lea rdx, [0x1400ce250]
lea rcx, [rbp - 0x68]
call fcn.14000b850
lea edx, [rbx + 0x41]
mov word [rbp + 0x530], dx
mov eax, 0x3a
mov word [rbp + 0x532], ax
xor edi, edi
mov dword [rbp + 0x534], 0x5c
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8d, [rdi + 0x40]
lea rdx, [rbp + 0x580]
lea rcx, [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140032479
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x580]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x580]
lea rcx, [rbp - 0x40]
call fcn.140006260
xor edi, edi
mov edx, 0x104
lea rcx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400324a0
movzx ecx, word [rbp + 0x600]
call fcn.1400a7290
movzx edx, ax
jmp 0x1400324a2
mov edx, edi
lea ecx, [rbx + 0x41]
movzx eax, dx
movzx edx, byte [rbp - 0x6f]
cmp eax, ecx
mov eax, 1
cmove edx, eax
mov byte [rbp - 0x6f], dl
test esi, esi
jne 0x140032517
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x540]
call fcn.14001f0c0
test eax, eax
je 0x1400324e1
cmp dword [rsp + 0x58], 0xb
sete byte [rbp + 0x10]
jmp 0x1400324e1
test esi, esi
jne 0x140032517
lea rdx, [rbp - 0x70]
mov rcx, r13
call fcn.140031be0
mov rcx, qword [r13 + 8]
sub rcx, qword [r13]
movabs rax, 0x8421084210842109
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
lea r12, [rdx + rax - 1]
jmp 0x14003258e
cmp esi, 1
jne 0x14003253c
mov rdx, r12
imul rdx, rdx, 0xf8
mov rcx, qword [r13]
mov rax, qword [rbp + 0x18]
cmp qword [rdx + rcx + 0x88], rax
je 0x140032635
mov byte [rbp - 0x6c], 1
mov dword [rbp + 0x20], esi
mov rdi, r12
imul rdi, rdi, 0xf8
mov rcx, qword [r13]
movzx eax, byte [rdi + rcx + 0x80]
mov byte [rbp + 0x10], al
cmp byte [rbp - 0x6f], 0
je 0x140032567
mov byte [rdi + rcx + 1], 1
test r15b, r15b
je 0x140032578
lea rdx, [rbp - 0x70]
mov rcx, r13
call fcn.140031be0
mov rax, qword [r13]
lea rcx, [rdi + rax + 0xd8]
lea rdx, [rbp - 0x70]
call fcn.140031be0
nop
mov rdi, qword [rbp + 0x68]
test rdi, rdi
je 0x1400325c0
mov rbx, qword [rbp + 0x70]
cmp rdi, rbx
je 0x1400325b8
mov rcx, rdi
call fcn.140005b70
add rdi, 0xf8
cmp rdi, rbx
jne 0x1400325a0
mov rdi, qword [rbp + 0x68]
mov rcx, rdi
call fcn.1400a58b8
xor edi, edi
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], rdi
cmp qword [rbp], 8
jb 0x1400325de
mov rcx, qword [rbp - 0x18]
call fcn.1400a58b8
mov qword [rbp], 7
mov qword [rbp - 8], rdi
mov word [rbp - 0x18], di
cmp qword [rbp - 0x28], 8
jb 0x1400325fe
mov rcx, qword [rbp - 0x40]
call fcn.1400a58b8
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], rdi
mov word [rbp - 0x40], di
cmp qword [rbp - 0x50], 8
jb 0x14003261e
mov rcx, qword [rbp - 0x68]
call fcn.1400a58b8
movzx ebx, byte [rbp + 0x870]
inc esi
cmp esi, 0x20
jge 0x14003272e
jmp 0x1400320d0
mov rdi, r12
imul rdi, rdi, 0xf8
mov byte [rdi + rcx + 5], 1
mov rax, qword [r13]
lea rcx, [rdi + rax + 8]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x68]
call fcn.140006130
mov rdx, qword [r13]
lea rcx, [rdi + rdx + 0x30]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x40]
call fcn.140006130
mov rdx, qword [r13]
lea rcx, [rdi + rdx + 0x58]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x18]
call fcn.140006130
mov rdx, qword [r13]
movzx eax, byte [rbp - 0x6a]
mov byte [rdi + rdx + 6], al
mov rdi, qword [rbp + 0x68]
test rdi, rdi
je 0x1400326d0
mov rbx, qword [rbp + 0x70]
cmp rdi, rbx
je 0x1400326c8
nop dword [rax]
mov rcx, rdi
call fcn.140005b70
add rdi, 0xf8
cmp rdi, rbx
jne 0x1400326b0
mov rdi, qword [rbp + 0x68]
mov rcx, rdi
call fcn.1400a58b8
xor edi, edi
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], rdi
cmp qword [rbp], 8
jb 0x1400326ee
mov rcx, qword [rbp - 0x18]
call fcn.1400a58b8
mov qword [rbp], 7
mov qword [rbp - 8], rdi
mov word [rbp - 0x18], di
cmp qword [rbp - 0x28], 8
jb 0x14003270e
mov rcx, qword [rbp - 0x40]
call fcn.1400a58b8
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], rdi
mov word [rbp - 0x40], di
cmp qword [rbp - 0x50], 8
jb 0x14003272e
mov rcx, qword [rbp - 0x68]
call fcn.1400a58b8
inc r14d
cmp r14d, 0x40
jge 0x140032756
jmp 0x1400320c1
lea rcx, str.string_too_long
call fcn.1400c33ac
int3
lea rcx, str.string_too_long
call fcn.1400c33ac
nop
cmp dword [0x140196f30], 6
jl 0x140032b97
mov esi, edi
movzx r14d, byte [rbp + 0x870]
mov r12d, r14d
mov r9d, esi
lea r8, str.DeviceHarddiskVolume_d
mov edx, 0x40
lea rcx, [rbp + 0x540]
call section..text
mov word [rbp + 0x2c0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x2c2]
call fcn.1400a4ea0
xor edx, edx
lea r8d, [rdx + 0x5c]
lea rcx, [rbp + 0x4c8]
call fcn.1400a4ea0
xor r9d, r9d
mov r8d, r12d
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x540]
call fcn.14001d5c0
test eax, eax
je 0x140032b6e
xor edx, edx
mov r8d, 0x230
lea rcx, [rbp + 0x90]
call fcn.1400a4ea0
mov edx, 0x104
lea rcx, [rbp + 0x90]
lea rdi, [rbp + 0x540]
lea rax, [rbp + 0x90]
sub rdi, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140032833
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140032833
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140032810
jmp 0x140032838
test rdx, rdx
jne 0x14003283c
sub rcx, 2
xor edi, edi
mov word [rcx], di
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x230
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x230
lea r8, [rbp + 0x90]
mov edx, 0x222038
mov rcx, qword [0x140148300]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140032b6e
cmp dword [rbp + 0x2bc], edi
je 0x140032b6e
mov word [rbp - 0x70], di
mov byte [rbp - 0x6d], dil
mov word [rbp - 0x6b], di
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rdi
mov word [rbp - 0x68], di
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], rdi
mov word [rbp - 0x40], di
mov qword [rbp], 7
mov qword [rbp - 8], rdi
mov word [rbp - 0x18], di
mov byte [rbp + 0x10], dil
mov qword [rbp + 0x18], rdi
mov byte [rbp + 0x64], dil
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], rdi
xor edx, edx
lea r8d, [rdi + 0x40]
lea rcx, [rbp + 0x24]
call fcn.1400a4ea0
nop
mov byte [rbp - 0x6e], 1
mov byte [rbp - 0x6c], 1
mov dword [rbp + 0x20], esi
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x540]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x540]
lea rcx, [rbp - 0x18]
call fcn.140006260
mov rdx, qword [rbp + 0x2a0]
mov qword [rbp + 0x18], rdx
test r14b, r14b
je 0x14003294a
cmp dword [rbp + 0x4d4], 0
mov byte [rbp - 0x6a], 1
jne 0x14003294e
mov byte [rbp - 0x6a], 0
cmp byte [rsp + 0x40], 0
jne 0x140032acd
lea rcx, [rbp + 0x540]
call fcn.14001f450
mov ebx, eax
test eax, eax
js 0x140032acd
or rcx, 0xffffffffffffffff
mov rdx, qword [rbp - 0x58]
sub rcx, rdx
cmp rcx, 1
jbe 0x140032b8a
lea rdi, [rdx + 1]
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
ja 0x140032b7d
mov r8, qword [rbp - 0x50]
cmp r8, rdi
jae 0x1400329bd
mov r8, rdx
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.1400055a0
mov r8, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
jmp 0x1400329e4
test rdi, rdi
jne 0x1400329e4
xor r15d, r15d
mov qword [rbp - 0x58], r15
lea rax, [rbp - 0x68]
cmp r8, 8
cmovae rax, qword [rbp - 0x68]
mov word [rax], r15w
mov r8, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
jmp 0x1400329e7
xor r15d, r15d
test rdi, rdi
setne al
test al, al
je 0x140032a1c
lea ecx, [rbx + 0x41]
lea rax, [rbp - 0x68]
cmp r8, 8
cmovae rax, qword [rbp - 0x68]
mov word [rax + rdx*2], cx
mov qword [rbp - 0x58], rdi
lea rax, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rax, qword [rbp - 0x68]
mov word [rax + rdi*2], r15w
mov r8d, 1
lea rdx, [0x1400ce250]
lea rcx, [rbp - 0x68]
call fcn.14000b850
lea edx, [rbx + 0x41]
mov word [rbp + 0x530], dx
mov eax, 0x3a
mov word [rbp + 0x532], ax
mov dword [rbp + 0x534], 0x5c
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8d, [r9 + 0x40]
lea rdx, [rbp + 0x580]
lea rcx, [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140032ab1
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x580]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x580]
lea rcx, [rbp - 0x40]
call fcn.140006260
call fcn.14001a9e0
movzx edx, ax
lea eax, [rbx + 0x41]
movzx ecx, byte [rbp - 0x6f]
cmp edx, eax
mov eax, 1
cmove ecx, eax
mov byte [rbp - 0x6f], cl
lea rdx, [rbp - 0x70]
mov rcx, r13
call fcn.140031be0
nop
mov rdi, qword [rbp + 0x68]
test rdi, rdi
je 0x140032b10
mov rbx, qword [rbp + 0x70]
cmp rdi, rbx
je 0x140032b08
nop dword [rax]
mov rcx, rdi
call fcn.140005b70
add rdi, 0xf8
cmp rdi, rbx
jne 0x140032af0
mov rdi, qword [rbp + 0x68]
mov rcx, rdi
call fcn.1400a58b8
xor edi, edi
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], rdi
cmp qword [rbp], 8
jb 0x140032b2e
mov rcx, qword [rbp - 0x18]
call fcn.1400a58b8
mov qword [rbp], 7
mov qword [rbp - 8], rdi
mov word [rbp - 0x18], di
cmp qword [rbp - 0x28], 8
jb 0x140032b4e
mov rcx, qword [rbp - 0x40]
call fcn.1400a58b8
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], rdi
mov word [rbp - 0x40], di
cmp qword [rbp - 0x50], 8
jb 0x140032b6e
mov rcx, qword [rbp - 0x68]
call fcn.1400a58b8
inc esi
cmp esi, 0x100
jge 0x140032b97
jmp 0x140032770
lea rcx, str.string_too_long
call fcn.1400c33ac
int3
lea rcx, str.string_too_long
call fcn.1400c33ac
nop
mov rax, r13
mov rcx, qword [rbp + 0x810]
xor rcx, rsp
call fcn.1400a4e70
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret