Function at 0x1101087a0
Capabilities:
Get disk information

Disassembly:
jmp 0x110109c64
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor r12d, r12d
mov rdi, rdx
mov r14, rcx
test rcx, rcx
jne 0x110109cd1
call sym.msvcrt.dll___doserrno
mov dword [rax], r12d
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
jmp 0x11010a0c0
test rdi, rdi
je 0x110109ca5
lea rdx, [0x110179028]
call sym.msvcrt.dll__mbspbrk
test rax, rax
je 0x110109cff
call sym.msvcrt.dll__errno
mov edi, 2
mov dword [rax], edi
call sym.msvcrt.dll___doserrno
mov dword [rax], edi
jmp 0x11010a0c0
cmp byte [r14 + 1], 0x3a
jne 0x110109d20
cmp byte [r14], r12b
je 0x110109d11
cmp byte [r14 + 2], r12b
je 0x110109ce7
movsx ecx, byte [r14]
call sym.msvcrt.dll__mbctolower
lea r13d, [rax - 0x60]
jmp 0x110109d28
call sym.msvcrt.dll__getdrive
mov r13d, eax
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x110109f04
lea rdx, [0x11017902c]
mov rcx, r14
mov r15, r12
call sym.msvcrt.dll__mbspbrk
test rax, rax
je 0x110109ce7
call sym.msvcrt.dll__errno
mov r12d, dword [rax]
call sym.msvcrt.dll__errno
mov r8d, 0x104
lea rcx, [rbp + 0xa0]
mov rdx, r14
and dword [rax], r15d
call sym.msvcrt.dll__fullpath
mov rsi, rax
test rax, rax
je 0x110109d91
call sym.msvcrt.dll__errno
mov dword [rax], r12d
jmp 0x110109dba
call sym.msvcrt.dll__errno
cmp dword [rax], 0x22
jne 0x110109ce7
call sym.msvcrt.dll__errno
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
mov dword [rax], r12d
call sym.msvcrt.dll__fullpath
mov r15, rax
mov rsi, rax
xor r12d, r12d
test rsi, rsi
je 0x110109eee
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rsi + rcx], r12b
jne 0x110109dca
cmp rcx, 3
je 0x110109e8c
or rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], r12b
jne 0x110109de1
cmp rax, 5
jb 0x110109eee
mov r9b, 0x5c
mov r8b, 0x2f
cmp byte [rsi], r9b
je 0x110109e08
cmp byte [rsi], r8b
jne 0x110109eee
mov al, byte [rsi + 1]
cmp al, r9b
je 0x110109e19
cmp al, r8b
jne 0x110109eee
mov al, byte [rsi + 2]
cmp al, r9b
je 0x110109eee
cmp al, r8b
je 0x110109eee
lea rdx, [rsi + 3]
mov al, byte [rdx]
test al, al
je 0x110109eee
mov cl, al
mov al, cl
cmp cl, r9b
je 0x110109e55
cmp cl, r8b
je 0x110109e55
inc rdx
mov al, byte [rdx]
mov cl, al
test al, al
jne 0x110109e3e
test al, al
je 0x110109eee
lea rcx, [rdx + 1]
mov al, byte [rcx]
test al, al
je 0x110109eee
mov dl, al
cmp al, r9b
je 0x110109e82
cmp al, r8b
je 0x110109e82
inc rcx
mov al, byte [rcx]
mov dl, al
test al, al
jne 0x110109e6b
test dl, dl
je 0x110109e8c
cmp byte [rcx + 1], r12b
jne 0x110109eee
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeA]
mov esi, 1
cmp eax, esi
jbe 0x110109eee
test r15, r15
je 0x110109eab
mov rcx, r15
call sym.msvcrt.dll_free
or dword [rsp + 0x30], 0xffffffff
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov r8d, esi
mov edx, esi
mov dword [rsp + 0x20], r12d
mov ecx, 0x7bc
mov dword [rsp + 0x60], 0x10
mov qword [rsp + 0x7c], r12
mov byte [rbp - 0x74], r12b
call fcn.110165164
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x28], rax
jmp 0x11010a076
test r15, r15
je 0x110109ce7
mov rcx, r15
call sym.msvcrt.dll_free
jmp 0x110109ce7
cmp dword [rsp + 0x74], r12d
jne 0x110109f17
cmp dword [rsp + 0x78], r12d
jne 0x110109f17
mov rax, r12
jmp 0x110109f7b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x74]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x11010a0aa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNELBASE.dll_FileTimeToSystemTime]
test eax, eax
je 0x11010a0aa
or dword [rsp + 0x30], 0xffffffff
movzx eax, word [rsp + 0x54]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
movzx r8d, word [rsp + 0x4e]
movzx edx, word [rsp + 0x4a]
movzx ecx, word [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.110165164
mov qword [rdi + 0x20], rax
cmp dword [rsp + 0x6c], r12d
jne 0x110109f8d
cmp dword [rsp + 0x70], r12d
je 0x110109ff1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x11010a0aa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNELBASE.dll_FileTimeToSystemTime]
test eax, eax
je 0x11010a0aa
or dword [rsp + 0x30], 0xffffffff
movzx eax, word [rsp + 0x54]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
movzx r8d, word [rsp + 0x4e]
movzx edx, word [rsp + 0x4a]
movzx ecx, word [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.110165164
mov qword [rdi + 0x18], rax
cmp dword [rsp + 0x64], r12d
jne 0x11010a009
cmp dword [rsp + 0x68], r12d
jne 0x11010a009
mov rax, qword [rdi + 0x20]
jmp 0x11010a069
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x64]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x11010a0aa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNELBASE.dll_FileTimeToSystemTime]
test eax, eax
je 0x11010a0aa
or dword [rsp + 0x30], 0xffffffff
movzx eax, word [rsp + 0x54]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
movzx r8d, word [rsp + 0x4e]
movzx edx, word [rsp + 0x4a]
movzx ecx, word [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.110165164
mov rcx, rsi
mov qword [rdi + 0x28], rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov ecx, dword [rsp + 0x60]
mov rdx, r14
call fcn.1101086b8
mov word [rdi + 6], ax
mov eax, dword [rbp - 0x80]
mov dword [rdi + 0x14], eax
lea eax, [r13 - 1]
mov dword [rdi], eax
mov dword [rdi + 0x10], eax
xor eax, eax
mov dword [rdi + 8], 1
mov word [rdi + 4], r12w
mov word [rdi + 0xc], r12w
jmp 0x11010a0c3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.110107d08
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
or eax, 0xffffffff
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1101303f0
lea r11, [rsp + 0x2c0]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret