Function at 0x1400f1d34
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x14016b400]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r13, r8
mov qword [rsp + 0x30], rdx
mov rbp, rdx
mov rdi, rcx
nop word [rax + rax]
xor ebx, ebx
lea rcx, str.GetVolumeNameAndRelativeFilePath
lea r14d, [rbx + 1]
call fcn.140029428
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
mov esi, ebx
call sub.msvcrt.dll_memset
mov r12d, ebx
mov r15d, ebx
test rbp, rbp
jne 0x1400f1df3
mov r14d, ebx
lea ebx, [rbp + 0x57]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
lea edx, [rbp + 0x1c]
lea rax, str.pwszVolumeName
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401406f0]
mov qword [rsp + 0x20], rax
call fcn.1400e4514
jmp 0x1400f2255
test rdi, rdi
jne 0x1400f1e2b
mov r14d, ebx
lea ebx, [rdi + 0x57]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
lea edx, [rdi + 0x1d]
lea rax, str.wszFileName
jmp 0x1400f1dd6
test r13, r13
jne 0x1400f1e67
mov r14d, ebx
lea ebx, [r13 + 0x57]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
lea edx, [rbx - 0x39]
lea rax, str.pwszRelativeFilePath
jmp 0x1400f1dd6
mov qword [rbp], rbx
lea rdx, str.__
mov r8d, 4
mov qword [r13], rbx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x1400f1ed6
mov rdx, rdi
lea rcx, str.__
call fcn.1400f27a0
mov r15, rax
test rax, rax
jne 0x1400f1f1c
mov r14d, ebx
lea ebx, [rax + 0xe]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
lea edx, [rbx + 0x11]
lea rax, str.wszSSQMSPrependedFileName
jmp 0x1400f1dd6
mov rcx, rdi
call fcn.140028f70
mov r15, rax
test rax, rax
jne 0x1400f1f1c
mov r14d, ebx
lea ebx, [rax + 0xe]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
lea edx, [rbx + 0x12]
lea rax, str.wszSSQMSPrependedFileName
jmp 0x1400f1dd6
or rbp, 0xffffffffffffffff
mov rdi, rbp
inc rdi
cmp word [r15 + rdi*2], bx
jne 0x1400f1f23
add edi, 2
lea ecx, [rdi + rdi]
call fcn.1400293f0
mov rsi, rax
test rax, rax
jne 0x1400f1f76
mov r14d, ebx
lea ebx, [rax + 0xe]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
lea edx, [rsi + 0x21]
lea rax, str.wszVolumePathBuffer
jmp 0x1400f1dd6
mov r8d, edi
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
test eax, eax
jne 0x1400f1fd6
mov r14d, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov edx, 0x22
lea rax, str.GetVolumePathNameW__wszSSQMSPrependedFileName__wszVolumePathBuffer__cchPathLength_
mov rcx, qword [section..data]
jmp 0x1400f1dd9
mov rax, rbp
cmp word [rsi + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x1400f1fd9
cmp word [rsi + rax*2 - 2], 0x5c
je 0x1400f2102
lea rax, [rdi - 1]
mov ecx, ebx
cmp rax, 0x7ffffffe
mov edx, 0x80070057
cmova ecx, edx
test ecx, ecx
js 0x1400f2033
mov rax, rdi
mov rcx, rsi
test rdi, rdi
je 0x1400f2021
cmp word [rcx], bx
je 0x1400f2021
add rcx, 2
sub rax, r14
jne 0x1400f2013
test rax, rax
mov ecx, edx
cmovne ecx, ebx
je 0x1400f2033
mov rdx, rdi
sub rdx, rax
jmp 0x1400f2036
mov rdx, rbx
test ecx, ecx
js 0x1400f2095
mov r8, rdi
lea rcx, [rsi + rdx*2]
sub r8, rdx
je 0x1400f207d
lea r9, [rdx + 0x7ffffffe]
mov rax, r8
sub rax, rdi
lea rdx, [0x1400fd76c]
add r9, rax
sub rdx, rcx
test r9, r9
je 0x1400f207d
movzx eax, word [rcx + rdx]
test ax, ax
je 0x1400f207d
mov word [rcx], ax
dec r9
add rcx, 2
sub r8, r14
jne 0x1400f2060
lea rax, [rcx - 2]
test r8, r8
cmovne rax, rcx
mov ecx, 0x8007007a
cmovne ecx, ebx
mov word [rax], bx
jne 0x1400f2102
mov r14d, ebx
call fcn.1400f2b1c
mov ebx, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
lea r8, [0x1400fd76c]
mov rdx, rdi
mov rcx, rsi
call fcn.140029908
mov rcx, qword [section..data]
lea r8, [0x1401406f0]
mov r9d, eax
mov edx, 0x23
lea rax, str.::StringCchCat__wszVolumePathBuffer__cchPathLength__L____
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.1400e4514
jmp 0x1400f2255
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x1400f2160
mov r14d, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov edx, 0x24
lea rax, str.GetVolumeNameForVolumeMountPoint_wszVolumePathBuffer__wszVolumeNameBuffer__ARRAYSIZE_wszVolumeNameBuffer__
jmp 0x1400f1fca
lea rcx, [rsp + 0x40]
mov rax, rbp
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x1400f2168
cmp word [rsp + rax*2 + 0x3e], 0x5c
jne 0x1400f2190
lea rax, [rax*2 - 2]
cmp rax, 0x208
jae 0x1400f21f9
mov word [rsp + rax + 0x40], bx
mov rax, rbp
cmp word [rsi + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x1400f2193
cmp word [rsi + rax*2 - 2], 0x5c
jne 0x1400f21b9
mov rax, rbp
cmp word [rsi + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x1400f21a9
mov word [rsi + rax*2 - 2], bx
lea rcx, [rsp + 0x40]
call fcn.140028f70
mov r12, rax
test rax, rax
jne 0x1400f21ff
mov r14d, ebx
lea ebx, [rax + 0xe]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
lea edx, [rbx + 0x17]
lea rax, str.wszVolumeName
jmp 0x1400f1dd6
call fcn.1400324a4
int3
cmp word [rsi + rbp*2 + 2], bx
lea rbp, [rbp + 1]
jne 0x1400f21ff
lea rcx, [r15 + rbp*2]
call fcn.140028f70
test rax, rax
jne 0x1400f2246
mov r14d, ebx
lea ebx, [rax + 0xe]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f2255
test byte [rcx + 0x1c], 8
je 0x1400f2255
lea edx, [rbx + 0x18]
lea rax, str.wszRelativeFilePath
jmp 0x1400f1dd6
mov qword [r13], rax
mov rax, qword [rsp + 0x30]
mov qword [rax], r12
mov r12, rbx
mov rcx, r12
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
lea rcx, str.GetVolumeNameAndRelativeFilePath
call fcn.140027f60
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, r14d
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400321c0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret