Function at 0x140033dd0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
xor r14d, r14d
mov r15d, 0x104
mov rdi, rdx
mov qword [rbp + 0x598], r14
mov rsi, rcx
mov qword [rbp + 0x5a8], r15
mov r8d, r15d
lea rcx, [rbp + 0x390]
lea ebx, [r14 + 1]
xor edx, edx
mov byte [rbp + 0x5a0], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, r15d
mov qword [rbp + 0x378], r14
xor edx, edx
mov byte [rbp + 0x380], bl
lea rcx, [rbp + 0x170]
mov qword [rbp + 0x388], r15
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, r15d
mov qword [rbp + 0x158], r14
xor edx, edx
mov byte [rbp + 0x160], bl
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x168], r15
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov al, byte [rbp + 0x5a0]
lea rcx, [rbp + 0x390]
neg al
mov r12d, 0x7ee3
sbb rdx, rdx
and rdx, r12
add rdx, r15
call fcn.140010e10
test eax, eax
js 0x140034146
mov al, byte [rbp + 0x380]
lea rcx, [rbp + 0x170]
neg al
sbb rdx, rdx
and rdx, r12
add rdx, r15
call fcn.140010e10
test eax, eax
js 0x140034146
mov al, byte [rbp + 0x160]
lea rcx, [rsp + 0x50]
neg al
sbb rdx, rdx
and rdx, r12
add rdx, r15
call fcn.140010e10
test eax, eax
js 0x140034146
mov rdx, rdi
lea rcx, [rbp + 0x390]
call fcn.140016cc0
mov rax, qword [rbp + 0x158]
lea r8, [rsp + 0x50]
mov rdx, qword [rbp + 0x598]
lea rcx, [rbp + 0x390]
test rax, rax
cmovne r8, rax
test rdx, rdx
cmovne rcx, rdx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140033f30
mov r9d, dword [rbp + 0x168]
lea rcx, [rbp + 0x390]
add eax, ebx
test rdx, rdx
cmovne rcx, rdx
mov edx, eax
call fcn.14001b85c
test al, al
je 0x140034141
lea rdx, [0x140037cbc]
lea rcx, [rsp + 0x50]
call fcn.14001b7dc
mov rax, qword [rbp + 0x378]
lea rdx, [rbp + 0x170]
mov r8d, dword [rbp + 0x388]
lea rcx, [rsp + 0x50]
test rax, rax
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x40]
cmovne rdx, rax
mov qword [rsp + 0x28], r14
mov rax, qword [rbp + 0x158]
test rax, rax
mov qword [rsp + 0x20], r14
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
nop dword [rax + rax]
test eax, eax
jne 0x140033ff3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x90
je 0x140034141
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
jmp 0x14003414b
mov rdx, qword [rbp + 0x158]
lea rax, [rsp + 0x50]
test rdx, rdx
cmovne rax, rdx
cmp word [rax], 0x5c
jne 0x140034023
test rdx, rdx
lea rcx, [rsp + 0x50]
cmovne rcx, rdx
call fcn.140016ca4
mov word [rax], r14w
jmp 0x140034034
test rdx, rdx
lea rax, [rsp + 0x50]
cmovne rax, rdx
mov word [rax + 2], r14w
mov rdx, qword [rbp + 0x378]
lea rax, [rbp + 0x170]
test rdx, rdx
lea r9, [rsp + 0x50]
cmovne rax, rdx
cmp word [rax], r14w
mov rax, qword [rbp + 0x158]
je 0x14003408a
test rdx, rdx
lea rcx, [rbp + 0x170]
mov r8d, 2
cmovne rcx, rdx
test rax, rax
mov qword [rsp + 0x20], rcx
mov edx, 0x235f
cmovne r9, rax
mov rcx, rsi
call fcn.140030778
jmp 0x1400340a1
test rax, rax
mov r8d, ebx
mov edx, 0x235e
mov rcx, rsi
cmovne r9, rax
call fcn.140030778
mov edi, eax
test eax, eax
jne 0x1400340f5
mov rax, qword [rsp + 0x40]
test eax, eax
jne 0x1400340b7
cmp dword [rsp + 0x44], r14d
je 0x1400340f5
movzx r9d, word [rsp + 0x42]
lea r8, str._04X__04X
movzx edx, ax
lea rcx, [rbp + 0x5b0]
mov dword [rsp + 0x20], edx
mov edx, 0x100
call fcn.14000daf0
lea r9, [rbp + 0x5b0]
mov r8d, ebx
mov edx, 0x235b
mov rcx, rsi
call fcn.140030778
mov edi, eax
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], r14
test rcx, rcx
je 0x14003410d
call fcn.14001fe90
mov rcx, qword [rbp + 0x378]
mov qword [rbp + 0x378], r14
test rcx, rcx
je 0x140034125
call fcn.14001fe90
mov rcx, qword [rbp + 0x598]
mov qword [rbp + 0x598], r14
test rcx, rcx
je 0x14003413d
call fcn.14001fe90
mov eax, edi
jmp 0x140034176
mov ebx, r14d
jmp 0x140034152
mov ecx, 8
xor edx, edx
call fcn.140002bfc
lea rcx, [rsp + 0x50]
call fcn.14001e0bc
lea rcx, [rbp + 0x170]
call fcn.14001e0bc
lea rcx, [rbp + 0x390]
call fcn.14001e0bc
mov eax, ebx
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.14001f920
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret