Function at 0x140005bf0
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x170
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor bpl, bpl
mov r14d, r9d
mov r12d, r8d
mov r13d, edx
mov rdi, rcx
mov rax, 0xffffffffffffffff
test rcx, rcx
je 0x140005e1c
inc rax
cmp byte [rcx + rax], bpl
jne 0x140005c31
cmp rax, 5
jb 0x140005f78
cmp byte [rcx], 0x5c
jne 0x140005f78
cmp byte [rcx + 1], 0x5c
jne 0x140005f78
cmp byte [rcx + 3], 0x5c
jne 0x140005f78
mov qword [rsp + 0x1a8], rbx
lea rdx, str._GLOBALROOT
mov qword [rsp + 0x168], rsi
mov r8d, 0xe
mov qword [rsp + 0x160], r15
call fcn.1400fe370
test eax, eax
jne 0x140005ccf
lea rdx, [rdi + 0xe]
test rdx, rdx
jne 0x140005c9c
xor eax, eax
jmp 0x140005cac
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], bpl
jne 0x140005ca3
inc rax
lea rcx, [rsp + 0x40]
mov ebx, 0x104
cmp rax, rbx
cmovb rbx, rax
mov r8, rbx
call fcn.140135ea0
mov byte [rsp + rbx + 0x3f], bpl
jmp 0x140005cf6
lea rcx, [rdi + 4]
mov r8d, 0x104
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov ecx, dword [rsp + 0x40]
mov edx, 0x3f3f3f
test eax, eax
cmove ecx, edx
mov dword [rsp + 0x40], ecx
xor ebx, ebx
mov eax, 0xc0000000
test r12d, r12d
mov r15d, 0x80000000
cmovne r15d, eax
mov eax, 3
nop
mov r8d, 1
mov qword [rsp + 0x30], 0
test r14d, r14d
mov dword [rsp + 0x28], 0x80
mov edx, r15d
mov dword [rsp + 0x20], eax
cmovne r8d, eax
mov rcx, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140005e3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x140005d68
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140005dea
test ebx, ebx
jne 0x140005d9e
lea rdx, [rsp + 0x40]
lea rcx, str.Notice:_Volume_Device_Path_is__s
call fcn.14004f2f0
mov rdx, rdi
lea rcx, str.Waiting_for_access_on__s...
call fcn.14004f2f0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x140005d0a
test r14d, r14d
jne 0x140005dcc
cmp ebx, 0x32
jle 0x140005dcc
lea rcx, str.Warning:_Could_not_obtain_exclusive_rights._Retrying_with_write_sharing_enabled...
call fcn.14004f2f0
xor r8d, r8d
mov dl, 7
mov ecx, 0x1388
mov r14d, 1
call fcn.14002d0c0
movzx ebp, al
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
mov eax, 3
cmp ebx, 0x96
jl 0x140005d10
call fcn.14004fba0
mov r8, rax
lea rcx, [0x140155ba8]
mov rdx, rdi
call fcn.14004f2f0
mov rbx, qword [rsp + 0x1a8]
mov rax, rsi
mov rsi, qword [rsp + 0x168]
mov r15, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400b2a30
add rsp, 0x170
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
test r12d, r12d
je 0x140005e65
test r14d, r14d
lea rax, str.shared
lea r8, str.exclusive
mov rdx, rdi
cmovne r8, rax
lea rcx, str.Opened__s_for__s_write_access
call fcn.14004f2f0
test r13d, r13d
je 0x140005e01
xor r14d, r14d
xor r9d, r9d
mov qword [rsp + 0x38], r14
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov edx, 0x90083
mov dword [rsp + 0x28], r14d
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140005ea5
lea rcx, str.I_O_boundary_checks_disabled
call fcn.14004f2f0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rbx, [rax + 0x3a98]
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov edx, 0x90018
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140005e01
test dword [0x14019f120], 0x80000000
jne 0x140005f12
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
jb 0x140005ec0
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_lock_access_to__s:__s
mov rdx, rdi
call fcn.14004f2f0
test dword [0x14019f120], 0x80000000
jne 0x140005f4c
test bpl, bpl
jne 0x140005f4c
xor r8d, r8d
mov dl, 7
mov ecx, 0x1388
call fcn.14002d0c0
movzx ebp, al
and bpl, 7
cmp bpl, 1
je 0x140005e01
test rsi, rsi
je 0x140005e01
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, 0xffffffffffffffff
jmp 0x140005e01
mov rax, 0xffffffffffffffff
jmp 0x140005e1c