Function at 0x1400b2744
Capabilities:
Get disk information
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x278
mov rdi, rcx
lea rcx, [0x140136070]
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bx, word [rbp]
lea rcx, [rsp + 0x70]
movsx eax, bl
mov esi, ebx
mov word [rbp], ax
or rax, 0xffffffffffffffff
and esi, 0x100
lea edx, [rax + 0x65]
mov qword [rsp + 0xa8], rax
call fcn.14006170c
xor r15d, r15d
mov eax, 0x200
cmp esi, r15d
lea r12d, [r15 + 1]
movzx r13d, r15b
cmovne r13d, r12d
test ax, bx
je 0x1400b27bf
or r13b, r12b
or r13b, r12b
mov rcx, rdi
mov dword [rsp + 0x58], r13d
call fcn.14005d870
cmp ax, r15w
je 0x1400b27df
mov esi, 0x40000000
jmp 0x1400b2e28
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov eax, dword [0x140122604]
lea r11, [rsp + 0x9c]
mov dword [r11], eax
movzx eax, word [0x140122608]
lea rcx, [rsp + 0x68]
mov word [r11 + 4], ax
movabs rax, 0x5c003a0043
mov edx, 0x10f960
mov qword [rsp + 0xb0], rax
call fcn.140061420
cmp word [rbp], r15w
mov rdi, qword [rsp + 0x68]
setne bl
mov r8d, r12d
lea rcx, [rdi + 0x100000]
mov rdx, rdi
mov byte [rsp + 0x2d0], bl
mov word [rbp], r15w
call fcn.1400740cc
mov ecx, 0x3e80
mov al, bl
mov r11b, bl
neg r11b
sbb ebp, ebp
and ebp, ecx
neg al
movsxd rax, esi
sbb r14d, r14d
mov qword [rsp + 0xc0], rax
and r14d, 0xfffffffe
add r14d, r12d
mov r12d, r15d
cmp ebp, ecx
mov dword [rsp + 0x94], r14d
jge 0x1400b2e1b
cmp ebp, r15d
jl 0x1400b2e1b
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0x1a0]
mov r8d, ebp
call qword [sym.imp.USER32.dll_wsprintfW]
xor ecx, ecx
mov qword [rsp + 0x48], r15
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x20000000
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x48]
mov r9d, 3
mov r8d, 0x80000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r15
call fcn.1400037fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x48]
cmp rbx, r15
je 0x1400b2e0e
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x2d8]
mov rcx, rbx
mov r12d, r15d
mov dword [rsp + 0x78], r15d
call fcn.140075234
lea r8, [rsp + 0x2d8]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0x2d8], r15d
call fcn.14005dec0
cmp rax, r15
jne 0x1400b2966
or rax, 0xffffffffffffffff
cmp rbx, rax
je 0x1400b2b0e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b2b0e
lea rcx, [rax + 0x30]
mov esi, r15d
mov r15d, dword [rax + 0x28]
mov qword [rsp + 0x60], rcx
mov ecx, 1
mov edx, 0x200
cmp dword [rax], ecx
mov rcx, rbx
mov dword [rsp + 0x98], r15d
sete sil
call fcn.14005d8d8
xor r9d, r9d
movsxd r10, eax
mov dword [rsp + 0x54], r10d
lea rcx, [rdi + r10*2 + 0x103960]
mov qword [rsp + 0xb8], rcx
cmp esi, r9d
je 0x1400b29e4
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
lea rdx, [rdi + 0x103960]
lea rcx, [rsp + 0x48]
mov r9d, r10d
mov r8d, r15d
call fcn.140067744
mov r10d, dword [rsp + 0x54]
xor r9d, r9d
mov al, byte [rsp + 0x2d0]
mov r8d, dword [rsp + 0x2d8]
movsxd rdx, esi
neg al
lea ecx, [r8 - 1]
mov qword [rsp + 0x80], rdx
sbb r15d, r15d
and r15d, ecx
movsxd rcx, r14d
cmp r15d, r8d
movsxd rax, r15d
jge 0x1400b2af9
mov r11, qword [rsp + 0x60]
lea r8, [rcx + rcx*8]
lea rax, [rax + rax*8]
shl r8, 4
add rax, rax
lea rsi, [r11 + rax*8 + 0x18]
mov eax, dword [rsp + 0x2d8]
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x88], rsi
mov rcx, r8
mov r14d, 0xff07
cmp rdx, r9
jne 0x1400b2a59
movzx r14d, byte [rsi + 8]
movsx r8d, word [rsi]
mov dword [rsp + 0x50], r8d
cmp rdx, r9
jne 0x1400b2a78
cmp r14d, r9d
je 0x1400b2ad0
cmp r14d, 5
je 0x1400b2ad0
cmp r14d, 0xf
je 0x1400b2ad0
cmp qword [rsi - 8], 0x200
jg 0x1400b2b1c
test r14b, 0x10
je 0x1400b2ad0
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rdi + 0x100000]
xor r9d, r9d
mov edx, ebp
mov dword [rsp + 0x20], eax
call fcn.14005d95c
mov rdx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x48]
mov r11, qword [rsp + 0x60]
xor r9d, r9d
mov r14d, dword [rsp + 0x94]
mov r10d, dword [rsp + 0x54]
add rsi, rcx
add r15d, r14d
mov qword [rsp + 0x88], rsi
cmp r15d, eax
jl 0x1400b2a49
mov r12d, dword [rsp + 0x78]
or rax, 0xffffffffffffffff
cmp rbx, rax
je 0x1400b2b0b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r15d, r15d
add ebp, r14d
cmp ebp, 0x3e80
jmp 0x1400b2883
mov r9, qword [rsp + 0xc8]
cmp qword [rsi - 0x10], r9
je 0x1400b2acd
mov r9, qword [rsp + 0xa8]
cmp qword [rsi - 0x10], r9
je 0x1400b2acd
or rax, 0xffffffffffffffff
xor ecx, ecx
lea r9, [rdi + 0x100000]
movzx esi, ax
movzx eax, cx
movsx rcx, ax
imul rcx, rcx, 0x220
cmp dword [rcx + r9 + 4], ebp
jne 0x1400b2b63
cmp dword [rcx + r9], r8d
je 0x1400b2b6e
inc ax
cmp ax, 0x1a
jge 0x1400b2b71
jmp 0x1400b2b4b
mov si, ax
xor eax, eax
movzx r12d, ax
cmp rdx, rax
je 0x1400b2bb9
mov r8d, dword [rsp + 0x98]
mov rdx, qword [rsp + 0xb8]
movsxd rax, r15d
lea rcx, [rax + rax*8]
mov eax, 1
mov r9d, r10d
shl rcx, 4
mov dword [rsp + 0x20], eax
add rcx, r11
call fcn.140067484
mov r8d, dword [rsp + 0x50]
lea r9, [rdi + 0x100000]
jmp 0x1400b2bd5
cmp r15d, 3
jg 0x1400b2bc5
lea eax, [r15 + 1]
jmp 0x1400b2bd4
mov eax, r15d
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 4
cwde
mov dword [rsp + 0x40], eax
xor eax, eax
cmp si, ax
jge 0x1400b2cb3
mov rcx, qword [rsp + 0x70]
movsx r9d, r8w
lea rdx, str.DeviceHarddisk_dPartition_d
movsx r8d, bp
call qword [sym.imp.USER32.dll_wsprintfW]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x90], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rcx, [rsp + 0x50]
mov edx, 0xc
xor r9d, r9d
mov r8b, 0xff
mov dword [rsp + 0x50], eax
call fcn.14005d7d4
xor ecx, ecx
mov r12w, ax
mov word [rsp + 0xb0], ax
mov word [rsp + 0x9c], ax
mov rax, qword [rsp + 0x2c0]
mov word [rax], r12w
or rax, 0xffffffffffffffff
cmp r12w, cx
je 0x1400b2c78
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x9c]
xor r9d, r9d
mov byte [rsp + 0x20], r13b
call fcn.14007355c
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
lea rdx, str.MOUN__show_to__c____d_d__0x_lX___d_r_n
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x40]
lea rcx, [0x1401350d0]
movzx r8d, r12w
mov r9d, ebp
mov dword [rsp + 0x20], eax
call fcn.140018a7c
mov rcx, qword [rsp + 0x2c0]
jmp 0x1400b2ccf
mov rcx, qword [rsp + 0x2c0]
movsx rax, si
imul rax, rax, 0x220
movzx eax, word [rax + r9 + 0x10]
mov word [rcx], ax
xor eax, eax
cmp si, ax
jge 0x1400b2cf6
cmp qword [rsp + 0xc0], rax
je 0x1400b2cf6
test r14b, 0x10
je 0x1400b2cf6
cmp r14d, 0x10
je 0x1400b2cf6
lea r13d, [rax + 1]
cmp r12w, ax
jne 0x1400b2cf9
mov r13d, eax
mov esi, dword [rsp + 0x40]
movzx eax, r14b
shl esi, 0x10
or esi, eax
call fcn.1400fa23c
xor r9d, r9d
cmp eax, r9d
je 0x1400b2dc2
cmp r13d, r9d
je 0x1400b2dac
mov r13d, dword [rsp + 0x40]
mov eax, r14d
lea rdx, str.PART__up__super__d_d_0x_X
and eax, 0xffffffef
lea rcx, [rsp + 0xd0]
mov r8d, ebp
mov r9d, r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xd8]
lea rcx, [0x1401350d0]
xor r8d, r8d
call fcn.14008c300
lea rdx, str.PART___super__d_d_0x_X
lea rcx, [rsp + 0xd0]
mov r9d, r13d
mov r8d, ebp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xd8]
lea rcx, [0x1401350d0]
xor r8d, r8d
call fcn.14008c300
mov r11d, ebp
shl r11d, 8
add r11d, 0x100
or esi, r11d
xor r9d, r9d
mov rax, qword [rsp + 0x2c8]
mov word [rax], r12w
cmp r12w, r9w
jne 0x1400b2e55
cmp r12w, r9w
je 0x1400b2de3
movzx ecx, r12w
call fcn.14005b558
mov r13d, dword [rsp + 0x58]
mov rsi, qword [rsp + 0x88]
jmp 0x1400b2ab4
mov r13d, dword [rsp + 0x58]
mov rsi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x48]
mov r11, qword [rsp + 0x60]
jmp 0x1400b2ad0
inc r12d
cmp r12d, 0x20
jl 0x1400b2b0e
lea rcx, [rsp + 0x68]
call fcn.1400591f8
mov esi, r15d
lea rcx, [rsp + 0x70]
call fcn.1400591f8
lea rcx, [0x140136070]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
add rsp, 0x278
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
or rax, 0xffffffffffffffff
cmp rbx, rax
je 0x1400b2e67
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x68]
call fcn.1400591f8
jmp 0x1400b2e28