Function at 0x140179c90
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x1b0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rdx
mov rdi, rcx
mov word [rsp + 0xa0], 0
xor edx, edx
mov r8d, 0xfe
lea rcx, [rsp + 0xa2]
call sub.ntdll.dll_memset
mov r8d, 0x100
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x140179e44
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x78]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
mov r9, qword [rsp + 0x90]
add r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_AEBV01__Z]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov edx, 1
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP80.dll_public:_wchar_t____ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov word [rax], 0x5c
mov edx, 2
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP80.dll_public:_wchar_t____ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov word [rax], 0x2e
xor ebx, ebx
mov qword [rdi], rbx
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rbx + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
jne 0x140179de4
mov qword [rdi], rbx
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x140179e44
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x56c008
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rdi + 8], reloc.MFC80U.DLL_Ordinal_512
mov dword [rsp + 0x40], ebx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1401796d0
test al, al
je 0x140179e37
mov eax, dword [rsp + 0x40]
mov dword [rdi + 8], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1b0
pop rdi
ret