Function at 0x1400098de
Capabilities:
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2f8
lea r13, str.NO_LABEL
movabs rax, 0x726f7475615c3a23
mov qword [rsp + 0x55], rax
mov esi, ecx
mov ecx, 0x20a
mov r12, rdx
movabs rax, 0x666e692e6e7572
mov qword [r8], r13
mov rbp, r8
lea rdi, [rsp + 0xe6]
mov qword [rsp + 0x5c], rax
xor eax, eax
mov r14d, r9d
rep stosb byte [rdi], al
mov ecx, esi
mov dword [rsp + 0x51], 0x5c3a23
lea rdi, [rsp + 0xe6]
call fcn.14000963c
test eax, eax
je 0x140009c54
mov al, byte [r12]
lea rbx, [rsp + 0x64]
test al, al
jne 0x140009a1b
xor r12d, r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
mov ecx, esi
call fcn.140009042
mov dword [rsp + 0x38], 0x40
lea r9, [rsp + 0x44]
mov r8d, 0x40
mov rsi, rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_GetVolumeInformationByHandleW]
test eax, eax
je 0x1400099ff
xor r11d, r11d
lea rbx, [0x1400ce7e0]
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], 0x105
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
cmp byte [0x1400ce7e0], 0
cmove rbx, r13
mov qword [rbp], rbx
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009c2c
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140009c2c
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov ecx, esi
mov byte [rsp + 0x55], al
mov byte [rsp + 0x51], al
call fcn.140007c6c
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
mov qword [rsp + 0x38], r8
mov rdi, rax
xor r8d, r8d
mov edx, 0x2d4800
mov dword [rsp + 0x28], r9d
mov rcx, rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x140009a89
lea rdx, [rsp + 0x55]
mov r8d, 1
lea rcx, str.label
call fcn.1400231ca
mov rbx, rax
jmp 0x140009ab8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test r14d, r14d
jne 0x140009a99
cmp eax, 0x15
je 0x140009a9d
xor ebx, ebx
jmp 0x140009ab8
movsx ecx, byte [r12]
call qword [sym.imp.msvcrt.dll_toupper]
lea rcx, str.Ignoring_autorun.inf_label_for_drive__c:_No_media
mov edx, eax
call fcn.1400380b9
jmp 0x140009a99
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009acb
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rbx, rbx
je 0x140009b4f
test r14d, r14d
jne 0x140009af1
movsx ecx, byte [r12]
call qword [sym.imp.msvcrt.dll_toupper]
mov r8, rbx
lea rcx, str.Using_autorun.inf_label_for_drive__c:__s
mov edx, eax
call fcn.1400380b9
mov rcx, rbx
lea r12, [0x1400ce7e0]
mov rsi, rbx
call sub.msvcrt.dll_strlen
mov rdi, r12
lea rcx, [rax + 1]
mov eax, 0x105
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rdx, [r12 + 0x104]
lea rcx, [rax + 1]
cmp rcx, 0x104
ja 0x140009b3b
lea rdx, [r12 + rax]
mov byte [rdx], 0
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [rbp], r12
jmp 0x140009c2c
lea rcx, [rsp + 0x51]
call fcn.140007124
mov edx, 2
mov ecx, 0x105
mov r14, rax
call sub.msvcrt.dll_calloc
xor ecx, ecx
xor edx, edx
xor r9d, r9d
mov dword [rsp + 0x38], edx
mov r8d, 0x105
mov rdx, rax
mov rdi, rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov r15, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r12d, eax
call r15
mov ebx, eax
test r12d, r12d
je 0x140009bee
xor eax, eax
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], 0x105
mov qword [rsp + 0x38], rax
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
lea rax, [0x1400ce7e0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
test eax, eax
jne 0x140009bee
call r15
xor r12d, r12d
mov ebx, eax
test rdi, rdi
je 0x140009bfb
mov rcx, rdi
call sub.msvcrt.dll_free
test r14, r14
je 0x140009c08
mov rcx, r14
call sub.msvcrt.dll_free
mov ecx, ebx
mov rbx, qword [sym.imp.KERNEL32.DLL_SetLastError]
call rbx
test r12d, r12d
je 0x140009c33
cmp byte [0x1400ce7e0], 0
je 0x140009c33
lea rax, [0x1400ce7e0]
mov qword [rbp], rax
mov eax, 1
jmp 0x140009c54
call r15
xor edx, edx
mov ecx, esi
mov edi, eax
call fcn.140011db7
mov qword [rbp], rax
test rax, rax
jne 0x140009c2c
mov ecx, edi
call rbx
mov qword [rbp], r13
jmp 0x140009c2c
add rsp, 0x2f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret