Function at 0x1400ec230
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov qword [r11 - 0x70], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1401ff978]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbp, rcx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
xor eax, eax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
lea rcx, [r11 - 0x48]
call sym.RstMwService.exe_public:_void___cdecl_CConsolidatedError::constructor_void____ptr64
nop
mov edi, 0x100
movsxd rcx, edi
call fcn.14011a650
mov rsi, rax
mov r8d, edi
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_file_ansi_l1_1_0.dll_QueryDosDeviceA]
test eax, eax
jne 0x1400ec2c6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.140122318
add edi, edi
cmp ebx, 0x7a
je 0x1400ec290
jmp 0x1400ec2cb
test rsi, rsi
jne 0x1400ec2e6
lea r8, str.UnKnown_Error_in_flushing_OS_Cache_for_Volume
mov edx, 0xa0000003
lea rcx, [rsp + 0x70]
call sym.RstMwService.exe_public:_void___cdecl_CConsolidatedError::SetError_enum_CConsolidatedErrorGenerated::ISDI2_ERRORS__char_const____ptr64____ptr64
jmp 0x1400ec41b
mov rdi, rsi
cmp byte [rsi], 0
je 0x1400ec413
mov rcx, rdi
call fcn.140133ee8
lea rdx, str.volume
mov rcx, rdi
call fcn.14011ab64
test rax, rax
je 0x1400ec3e3
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov r8d, 4
lea rdx, [0x14018f9b8]
lea rcx, [rsp + 0x50]
call fcn.14000cf30
nop
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x1400ec341
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14000d030
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileA]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x1400ec3e3
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x1400ec3de
test cl, 0x1f
jne 0x1400ec40d
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400ec407
sub rcx, rax
cmp rcx, 8
jb 0x1400ec401
cmp rcx, 0x27
ja 0x1400ec3fb
mov rcx, rax
call fcn.1400f87e0
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenA]
inc eax
cdqe
add rdi, rax
cmp byte [rdi], 0
jmp 0x1400ec2ec
call fcn.1401221c0
int3
call fcn.1401221c0
int3
call fcn.1401221c0
int3
call fcn.1401221c0
int3
mov rcx, rsi
call fcn.140122318
lea rdx, [rsp + 0x70]
mov rcx, rbp
call sym.RstMwService.exe_public:_void___cdecl_CConsolidatedError::constructor_class_CConsolidatedError_const____ptr64____ptr64
nop
lea rcx, [rsp + 0x70]
call sym.RstMwService.exe_public:_void___cdecl_CConsolidatedError::destructor_void____ptr64
mov rax, rbp
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400f84a0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret