Function at 0x180009410
Capabilities:
Get disk information
Get storage device properties

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e00]
mov eax, 0x2f00
call fcn.1800d3260
sub rsp, rax
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rbp + 0x2df0], rax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x5c], rax
xor r14d, r14d
mov eax, 1
cpuid
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], ebx
mov dword [rsp + 0x64], edx
test ecx, ecx
js 0x18000a052
xor r15b, r15b
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x40], r15d
mov edi, r14d
test r15b, r15b
jne 0x18000a0f3
mov r8d, edi
lea rdx, str..PhysicalDrive_d
lea rcx, [rbp + 0x3a0]
call fcn.18000a130
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x3a0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800097c1
xor eax, eax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x54]
mov dword [rsp + 0x54], r14d
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], Ordinal_27
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x74080
mov rcx, rbx
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800097b8
mov ecx, 0x221
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x38], r14
mov r9d, reloc.WLDAP32.dll_Ordinal_33
mov r13, rax
mov edx, 0x7c088
mov r8, r13
mov rcx, rbx
mov byte [rax + 0xa], 0xec
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x221
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x44], r14d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800097af
lea rdx, [r13 + 0x10]
mov rcx, r14
lea rax, [rdx + 0x1fe]
lea rbx, [rbp - 0x60]
cmp rbx, rax
ja 0x1800095c6
lea rax, [rbp + 0x39c]
cmp rax, rdx
jb 0x1800095c6
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
mov dword [rbp + rcx*4 - 0x60], eax
inc rcx
cmp rcx, 0x100
jl 0x1800095b0
jmp 0x18000961c
lea rax, [rbp - 0x40]
add rdx, 0x10
mov ecx, reloc.WS2_32.dll_recv
movq xmm1, qword [rdx - 0x10]
xorps xmm0, xmm0
movq xmm2, qword [rdx - 8]
lea rax, [rax + 0x40]
punpcklwd xmm1, xmm0
lea rdx, [rdx + 0x20]
punpcklwd xmm2, xmm0
movdqu xmmword [rax - 0x60], xmm1
movq xmm1, qword [rdx - 0x20]
punpcklwd xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm2
movq xmm2, qword [rdx - 0x18]
punpcklwd xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmmword [rax - 0x30], xmm2
sub rcx, 1
jne 0x1800095d3
mov ecx, 0x400
call fcn.1800d25b4
xor edx, edx
mov r8d, 0x3eb
mov rdi, rax
lea rcx, [rax + 0x15]
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rbp - 0x38]
lea rbx, [rdi + 0x13]
mov eax, ecx
shr eax, 8
mov byte [rdi], al
mov byte [rdi + 1], cl
mov ecx, dword [rbp - 0x34]
mov eax, ecx
shr eax, 8
mov byte [rdi + 2], al
mov byte [rdi + 3], cl
mov ecx, dword [rbp - 0x30]
mov eax, ecx
shr eax, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], cl
mov ecx, dword [rbp - 0x2c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 6], al
mov byte [rdi + 7], cl
mov ecx, dword [rbp - 0x28]
mov eax, ecx
shr eax, 8
mov byte [rdi + 8], al
mov byte [rdi + 9], cl
mov ecx, dword [rbp - 0x24]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], cl
mov ecx, dword [rbp - 0x20]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], cl
mov ecx, dword [rbp - 0x1c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xe], al
mov byte [rdi + 0xf], cl
mov ecx, dword [rbp - 0x18]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], cl
mov ecx, dword [rbp - 0x14]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x12], al
mov byte [rbx], cl
mov byte [rdi + 0x14], r14b
nop dword [rax]
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x1800096ee
mov byte [rbx], r14b
dec rbx
mov rax, rbx
sub rax, rdi
test rax, rax
jg 0x1800096d0
movzx ebx, byte [rdi]
mov rsi, r14
mov r12, qword [0x180119990]
test bl, bl
je 0x180009731
mov r15, rdi
movsx ecx, bl
lea r15, [r15 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
jne 0x18000971d
cmp bl, 0x5f
je 0x18000971d
cmp bl, 0x2d
jne 0x180009724
mov byte [rsi + r12], bl
inc rsi
movzx ebx, byte [r15]
test bl, bl
jne 0x180009702
mov r15d, dword [rsp + 0x40]
mov rcx, rdi
mov byte [rsi + r12], r14b
call fcn.1800d25ac
mov rdx, qword [0x180119990]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009750
cmp rax, 4
jb 0x1800097a6
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009766
cmp rax, 5
jae 0x18000977a
mov ecx, r14d
jmp 0x180009792
mov r8d, 5
lea rcx, str.ARRAY
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
sete cl
test cl, cl
movzx r15d, r15b
mov eax, 1
cmove r15d, eax
mov dword [rsp + 0x40], r15d
mov edi, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
mov dword [rsp + 0x50], edi
cmp edi, 0x10
jl 0x180009485
test r15b, r15b
jne 0x18000a0f3
xor r12b, r12b
mov r13d, r14d
nop
test r12b, r12b
jne 0x18000a0f3
mov r8d, r13d
lea rdx, str..Scsi_d:
lea rcx, [rbp + 0x3a0]
call fcn.18000a130
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x3a0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x180009afc
xor edx, edx
lea rcx, [rbp + 0x4b0]
mov r8d, 0x22d
call sub.VCRUNTIME140.dll_memset
mov r9d, 8
mov dword [rbp + 0x4b0], Ordinal_33
lea r8, str.SCSIDISK
mov dword [rbp + 0x4bc], 0x2710
lea rcx, [rbp + 0x4b4]
mov dword [rbp + 0x4c8], 0x211
mov dword [rbp + 0x4c0], 0x1b0501
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x4b0]
mov qword [rsp + 0x30], rax
mov r9d, reloc.WLDAP32.dll_Ordinal_60
lea rax, [rbp + 0x4b0]
mov dword [rsp + 0x28], 0x22d
mov edx, 0x4d008
mov qword [rsp + 0x20], rax
mov byte [rbp + 0x4d6], 0xec
mov byte [rbp + 0x4d8], r14b
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180009af1
cmp byte [rbp + 0x512], r14b
je 0x180009af1
lea rax, [rbp + 0x700]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x4ec]
nop dword [rax]
movq xmm1, qword [rcx - 0x10]
xorps xmm0, xmm0
movq xmm2, qword [rcx - 8]
lea rax, [rax + 0x40]
punpcklwd xmm1, xmm0
lea rcx, [rcx + 0x20]
punpcklwd xmm2, xmm0
movdqu xmmword [rax - 0x60], xmm1
movq xmm1, qword [rcx - 0x20]
punpcklwd xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm2
movq xmm2, qword [rcx - 0x18]
punpcklwd xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmmword [rax - 0x30], xmm2
sub rdx, 1
jne 0x180009910
mov ecx, 0x400
call fcn.1800d25b4
xor edx, edx
mov r8d, 0x3eb
mov rdi, rax
lea rcx, [rax + 0x15]
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rbp + 0x708]
lea rbx, [rdi + 0x13]
mov ecx, edx
shr ecx, 8
mov byte [rdi], cl
mov byte [rdi + 1], dl
mov edx, dword [rbp + 0x70c]
mov ecx, edx
shr ecx, 8
mov byte [rdi + 2], cl
mov ecx, dword [rbp + 0x710]
mov eax, ecx
mov byte [rdi + 3], dl
shr eax, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], cl
mov ecx, dword [rbp + 0x714]
mov eax, ecx
shr eax, 8
mov byte [rdi + 6], al
mov byte [rdi + 7], cl
mov ecx, dword [rbp + 0x718]
mov eax, ecx
shr eax, 8
mov byte [rdi + 8], al
mov byte [rdi + 9], cl
mov ecx, dword [rbp + 0x71c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], cl
mov ecx, dword [rbp + 0x720]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], cl
mov ecx, dword [rbp + 0x724]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xe], al
mov byte [rdi + 0xf], cl
mov ecx, dword [rbp + 0x728]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], cl
mov ecx, dword [rbp + 0x72c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x12], al
mov byte [rbx], cl
mov byte [rdi + 0x14], r14b
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x180009a45
mov byte [rbx], r14b
dec rbx
mov rax, rbx
sub rax, rdi
test rax, rax
jg 0x180009a27
movzx ebx, byte [rdi]
mov rsi, r14
mov r15, qword [0x180119990]
test bl, bl
je 0x180009a89
nop word [rax + rax]
movsx ecx, bl
lea rdi, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
jne 0x180009a7b
cmp bl, 0x5f
je 0x180009a7b
cmp bl, 0x2d
jne 0x180009a82
mov byte [rsi + r15], bl
inc rsi
movzx ebx, byte [rdi]
test bl, bl
jne 0x180009a60
mov byte [rsi + r15], r14b
mov rax, 0xffffffffffffffff
mov rdx, qword [0x180119990]
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009aa0
cmp rax, 4
jb 0x180009af1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009ab6
cmp rax, 5
jae 0x180009aca
mov ecx, r14d
jmp 0x180009ae2
mov r8d, 5
lea rcx, str.ARRAY
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
sete cl
test cl, cl
movzx r12d, r12b
mov eax, 1
cmove r12d, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13d
cmp r13d, 0x10
jl 0x1800097e0
test r12b, r12b
jne 0x18000a0f3
xor r13b, r13b
lea rsi, [0x1801195a0]
mov r12d, r14d
lea rdi, [0x1801197c0]
mov r15d, 0xa1
nop dword [rax]
test r13b, r13b
jne 0x18000a0f3
mov r8d, r12d
lea rdx, str..PhysicalDrive_d
lea rcx, [rbp + 0x3a0]
call fcn.18000a130
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x3a0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x180009ea0
xor ecx, ecx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x68], rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x30], rcx
xor r9d, r9d
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], Ordinal_27
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov edx, 0x74080
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180009e95
movzx eax, byte [rsp + 0x5b]
test al, al
je 0x180009e95
xorps xmm0, xmm0
movzx ecx, r12b
shr al, cl
mov ebx, 0xec
test al, 0x10
mov r8d, 0x210
mov rcx, rsi
cmovne ebx, r15d
xor eax, eax
xor edx, edx
mov byte [rbp - 0x70], al
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], r14
movzx eax, r12b
and al, 1
mov dword [rsp + 0x70], 0x200
or al, 0xfa
mov word [rsp + 0x74], 0x100
shl al, 4
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0x79], al
mov edx, 0x7c088
lea rax, [rsp + 0x40]
mov word [rsp + 0x77], r14w
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x210
mov qword [rsp + 0x20], rsi
mov byte [rsp + 0x7a], bl
mov byte [rsp + 0x7c], r12b
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180009e95
lea rcx, [rbp + 0x700]
lea rax, [0x1801195c0]
nop dword [rax]
nop word [rax + rax]
movq xmm1, qword [rax - 0x10]
lea rcx, [rcx + 0x40]
movq xmm2, qword [rax - 8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
movdqu xmmword [rcx - 0x60], xmm1
movq xmm1, qword [rax]
punpcklwd xmm2, xmm0
movdqu xmmword [rcx - 0x50], xmm2
movq xmm2, qword [rax + 8]
add rax, 0x20
punpcklwd xmm1, xmm0
punpcklwd xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmmword [rcx - 0x30], xmm2
cmp rax, rdi
jl 0x180009ca0
mov ecx, 0x400
call fcn.1800d25b4
xor edx, edx
mov r8d, 0x3eb
mov rdi, rax
lea rcx, [rax + 0x15]
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rbp + 0x708]
lea rbx, [rdi + 0x13]
mov ecx, edx
shr ecx, 8
mov byte [rdi], cl
mov byte [rdi + 1], dl
mov edx, dword [rbp + 0x70c]
mov ecx, edx
shr ecx, 8
mov byte [rdi + 2], cl
mov ecx, dword [rbp + 0x710]
mov eax, ecx
mov byte [rdi + 3], dl
shr eax, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], cl
mov ecx, dword [rbp + 0x714]
mov eax, ecx
shr eax, 8
mov byte [rdi + 6], al
mov byte [rdi + 7], cl
mov ecx, dword [rbp + 0x718]
mov eax, ecx
shr eax, 8
mov byte [rdi + 8], al
mov byte [rdi + 9], cl
mov ecx, dword [rbp + 0x71c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], cl
mov ecx, dword [rbp + 0x720]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], cl
mov ecx, dword [rbp + 0x724]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xe], al
mov byte [rdi + 0xf], cl
mov ecx, dword [rbp + 0x728]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], cl
mov ecx, dword [rbp + 0x72c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x12], al
mov byte [rbx], cl
mov byte [rdi + 0x14], r14b
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x180009dd3
mov byte [rbx], r14b
dec rbx
mov rax, rbx
sub rax, rdi
test rax, rax
jg 0x180009db5
movzx ebx, byte [rdi]
mov rsi, r14
mov r15, qword [0x180119990]
test bl, bl
je 0x180009e19
nop dword [rax]
nop dword [rax + rax]
movsx ecx, bl
lea rdi, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
jne 0x180009e0b
cmp bl, 0x5f
je 0x180009e0b
cmp bl, 0x2d
jne 0x180009e12
mov byte [rsi + r15], bl
inc rsi
movzx ebx, byte [rdi]
test bl, bl
jne 0x180009df0
mov byte [rsi + r15], r14b
mov rax, 0xffffffffffffffff
mov rdx, qword [0x180119990]
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009e30
cmp rax, 4
jb 0x180009e81
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009e46
cmp rax, 5
jae 0x180009e5a
mov ecx, r14d
jmp 0x180009e72
mov r8d, 5
lea rcx, str.ARRAY
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
sete cl
test cl, cl
movzx r13d, r13b
mov eax, 1
cmove r13d, eax
mov r15d, 0xa1
lea rsi, [0x1801195a0]
lea rdi, [0x1801197c0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12d
cmp r12d, 0x10
jl 0x180009b30
test r13b, r13b
jne 0x18000a0f3
xor r12b, r12b
mov r13d, r14d
nop dword [rax]
test r12b, r12b
jne 0x18000a0f3
mov r8d, r13d
lea rdx, str..PhysicalDrive_d
lea rcx, [rbp + 0x3a0]
call fcn.18000a130
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x3a0]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x18000a03c
xor edx, edx
mov dword [rsp + 0x44], r14d
mov r8d, 0x2710
mov qword [rsp + 0x5c], r14
lea rcx, [rbp + 0x6e0]
mov dword [rsp + 0x58], r14d
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov r9d, listen
lea rax, [rbp + 0x6e0]
mov dword [rsp + 0x28], 0x2710
mov edx, 0x2d1400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18000a031
movsxd rax, dword [rbp + 0x6f8]
lea rsi, [rbp + 0x6e0]
mov r15, qword [0x180119990]
add rsi, rax
mov rdi, r14
movzx ebx, byte [rsi]
test bl, bl
je 0x180009fca
movsx ecx, bl
lea rsi, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
jne 0x180009fbc
cmp bl, 0x5f
je 0x180009fbc
cmp bl, 0x2d
jne 0x180009fc3
mov byte [rdi + r15], bl
inc rdi
movzx ebx, byte [rsi]
test bl, bl
jne 0x180009fa1
mov byte [rdi + r15], r14b
mov rax, 0xffffffffffffffff
mov rdx, qword [0x180119990]
nop dword [rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009fe0
cmp rax, 4
jb 0x18000a031
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009ff6
cmp rax, 5
jae 0x18000a00a
mov ecx, r14d
jmp 0x18000a022
mov r8d, 5
lea rcx, str.ARRAY
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
sete cl
test cl, cl
movzx r12d, r12b
mov eax, 1
cmove r12d, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13d
cmp r13d, 0x10
jl 0x180009ec0
test r12b, r12b
jne 0x18000a0f3
xor edx, edx
lea rcx, [rbp + 0x4b0]
mov r8d, 0x105
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x105
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x38], 0x105
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x4b0]
lea rax, [rsp + 0x54]
mov dword [rsp + 0x54], r14d
mov r8d, 0x105
mov qword [rsp + 0x20], rax
lea rcx, [0x1800f5ba4]
mov dword [rsp + 0x44], r14d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov rcx, qword [0x180119990]
lea r8, str.VM__lu
test eax, eax
mov edx, 0x400
cmovne r14d, dword [rsp + 0x40]
mov r9d, r14d
call fcn.180004d80
mov rcx, qword [rbp + 0x2df0]
xor rcx, rsp
call fcn.1800d2550
lea r11, [rsp + 0x2f00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret