Function at 0x18001af58
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r14d, r14d
mov dword [rbp - 0x24], r8d
mov qword [rbp - 0x38], r14
mov r12d, edx
mov dword [rbp - 0x40], r14d
mov r15, rcx
test rcx, rcx
jne 0x18001afa1
xor eax, eax
jmp 0x18001b386
cmp r12d, 0x20
je 0x18001afc0
cmp r12d, 0x40
je 0x18001afb7
mov eax, 1
jmp 0x18001b386
lea rsi, [0x18007c570]
jmp 0x18001afc7
lea rsi, [0x18007c4b8]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.18000db84
mov edi, eax
test eax, eax
je 0x18001afff
lea r9, str.TOKEN
mov r8d, 0x1c6d
mov edx, eax
mov ecx, 1
call fcn.180038d90
mov ecx, edi
call fcn.18000ec90
jmp 0x18001b386
mov r13, qword [rbp - 0x30]
mov ebx, 1
mov r8, r13
mov edx, ebx
lea ecx, [rbx + 7]
call fcn.18000ca28
test eax, eax
je 0x18001b02f
lea r9, str.SE_SECURITY_PRIVILEGE
mov r8d, 0x1c5b
mov edx, eax
mov ecx, ebx
call fcn.180038d90
mov ecx, dword [0x18008b2a0]
mov r9, rsi
mov rax, qword gs:[0x58]
mov r8d, ebx
mov r14d, 0x20
mov rax, qword [rax + rcx*8]
add r14, rax
mov ecx, 0x10
mov rdx, r14
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], r14
mov rcx, qword [rcx + rax]
call fcn.180044a68
mov edi, eax
test eax, eax
je 0x18001b085
mov ecx, eax
call fcn.180011120
mov r9, rsi
mov r8d, 0x1c4d
jmp 0x18001b33c
xor esi, esi
mov ecx, 0x3a
cmp r12d, 0x40
jne 0x18001b1a0
mov al, byte [r15 + 8]
test al, 0xf9
jne 0x18001b1a0
cmp al, 6
je 0x18001b1a0
mov rax, qword [r15]
cmp word [rax + 2], si
je 0x18001b0ed
cmp word [rax + 2], cx
je 0x18001b0ed
lea edx, [rcx - 0x2d]
mov r9, rax
mov ecx, ebx
mov r8d, 0x1c57
call fcn.180038d90
mov rdx, qword [r15]
mov r9b, 5
mov rcx, qword [r14]
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call fcn.1800448bc
mov edi, eax
jmp 0x18001b31d
movzx eax, word [rax]
lea rcx, [rbp - 0x18]
mov word [rbp - 0x18], ax
mov dword [rbp - 0x16], 0x5c003a
mov word [rbp - 0x12], si
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 3
je 0x18001b119
cmp eax, 6
jne 0x18001b157
mov dword [rsp + 0x38], esi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
nop dword [rax + rax]
test eax, eax
je 0x18001b181
test byte [rbp - 0x28], 8
jne 0x18001b1a0
mov byte [r15 + 8], 3
mov r9b, 3
lea rdx, [rbp - 0x18]
mov rcx, qword [r14]
mov r8d, ebx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call fcn.1800448bc
mov edi, eax
test eax, eax
jne 0x18001b347
jmp 0x18001b31d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r9, [rbp - 0x18]
mov r8d, 0x1c74
mov edx, eax
mov ecx, ebx
call fcn.180038d90
mov al, byte [r15 + 8]
test al, 0xf9
jne 0x18001b312
cmp al, 6
je 0x18001b312
mov eax, dword [rbp - 0x24]
mov edx, r12d
mov r8, qword [r15]
neg eax
lea rax, [rbp - 0x38]
mov ecx, 0x10
sbb r9d, r9d
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x30]
and r9d, 0xfffffffc
add r9d, 0x132
mov rcx, qword [rcx + rax]
call fcn.18003da58
mov edi, eax
test eax, eax
jne 0x18001b347
mov rsi, qword [rbp - 0x38]
xor edx, edx
test rsi, rsi
je 0x18001b31d
mov rcx, qword [rsi]
test rcx, rcx
je 0x18001b2ee
cmp r12d, 0x40
jne 0x18001b24b
mov rax, qword [rcx + 8]
lea r8d, [r12 - 6]
cmp word [rax + 2], r8w
jne 0x18001b240
cmp word [rax + 4], dx
jne 0x18001b240
lea ecx, [r12 + 0x1c]
mov word [rax + 4], cx
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
mov word [rcx + 6], dx
mov rcx, qword [rsi]
lea r9, [0x18008ac18]
mov edx, ebx
jmp 0x18001b25d
cmp r12d, 0x20
jne 0x18001b269
lea r9, [0x18008ac28]
lea edx, [r12 - 0x1c]
mov r8, r13
call fcn.18006040c
xor edx, edx
mov edi, eax
mov r14, qword [rsi]
test edi, edi
jne 0x18001b32b
mov rax, qword [rbp - 0x30]
mov ecx, 0x9c
mov dword [rcx + rax], edx
mov rcx, r14
cmp r12d, 0x40
jne 0x18001b29c
lea r9, [0x18008ac18]
mov edx, ebx
mov r8, r13
call fcn.18001b3b4
jmp 0x18001b2b5
cmp r12d, 0x20
jne 0x18001b2b0
lea r9, [0x18008ac28]
lea edx, [r12 - 0x1c]
jmp 0x18001b292
call fcn.1800330d0
mov edi, eax
mov r8d, 0x1ce6
mov rax, qword [rsi]
mov edx, edi
mov rcx, qword [rax + 8]
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov ecx, 0x9c
mov r9d, dword [rcx + rax]
xor ecx, ecx
call fcn.180038d90
mov ecx, edi
call fcn.18000ec90
xor edx, edx
mov edi, eax
test eax, eax
jne 0x18001b2fb
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x18001b201
mov rcx, qword [rbp - 0x38]
xor edx, edx
call fcn.180060db4
mov r14, qword [rbp - 0x20]
xor esi, esi
mov qword [rbp - 0x38], rsi
jmp 0x18001b31d
mov rdx, qword [r15]
mov r9b, 4
jmp 0x18001b15e
mov r15, qword [r15 + 0x18]
test r15, r15
je 0x18001b347
jmp 0x18001b087
mov ecx, edi
call fcn.180011120
mov r9, qword [r14 + 8]
mov r8d, 0x1c61
mov edx, eax
mov ecx, ebx
call fcn.180038d90
xor esi, esi
xor edx, edx
mov r8, r13
lea ecx, [rdx + 8]
call fcn.18000ca28
cmp dword [rbp - 0x40], esi
je 0x18001b365
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
nop dword [rax + rax]
mov rcx, r13
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x18001b384
xor edx, edx
call fcn.180060db4
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180002a90
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret