Function at 0x180008e20
Capabilities:
Get disk information
Get storage device properties

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e00]
mov eax, 0x2f00
call fcn.1800d3020
sub rsp, rax
mov rax, qword [0x18012c070]
xor rax, rsp
mov qword [rbp + 0x2df0], rax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x5c], rax
xor r14d, r14d
mov eax, 1
cpuid
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], ebx
mov dword [rsp + 0x64], edx
test ecx, ecx
js 0x180009a62
xor r15b, r15b
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x40], r15d
mov edi, r14d
test r15b, r15b
jne 0x180009b03
mov r8d, edi
lea rdx, str..PhysicalDrive_d
lea rcx, [rbp + 0x3a0]
call fcn.180009b40
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x3a0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800091d1
xor eax, eax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x54]
mov dword [rsp + 0x54], r14d
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], Ordinal_27
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x74080
mov rcx, rbx
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800091c8
mov ecx, 0x221
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x38], r14
mov r9d, reloc.WLDAP32.dll_Ordinal_33
mov r13, rax
mov edx, 0x7c088
mov r8, r13
mov rcx, rbx
mov byte [rax + 0xa], 0xec
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x221
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x44], r14d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800091bf
lea rdx, [r13 + 0x10]
mov rcx, r14
lea rax, [rdx + 0x1fe]
lea rbx, [rbp - 0x60]
cmp rbx, rax
ja 0x180008fd6
lea rax, [rbp + 0x39c]
cmp rax, rdx
jb 0x180008fd6
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
mov dword [rbp + rcx*4 - 0x60], eax
inc rcx
cmp rcx, 0x100
jl 0x180008fc0
jmp 0x18000902c
lea rax, [rbp - 0x40]
add rdx, 0x10
mov ecx, reloc.WS2_32.dll_recv
movq xmm1, qword [rdx - 0x10]
xorps xmm0, xmm0
movq xmm2, qword [rdx - 8]
lea rax, [rax + 0x40]
punpcklwd xmm1, xmm0
lea rdx, [rdx + 0x20]
punpcklwd xmm2, xmm0
movdqu xmmword [rax - 0x60], xmm1
movq xmm1, qword [rdx - 0x20]
punpcklwd xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm2
movq xmm2, qword [rdx - 0x18]
punpcklwd xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmmword [rax - 0x30], xmm2
sub rcx, 1
jne 0x180008fe3
mov ecx, 0x400
call fcn.1800d2498
xor edx, edx
mov r8d, 0x3eb
mov rdi, rax
lea rcx, [rax + 0x15]
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rbp - 0x38]
lea rbx, [rdi + 0x13]
mov eax, ecx
shr eax, 8
mov byte [rdi], al
mov byte [rdi + 1], cl
mov ecx, dword [rbp - 0x34]
mov eax, ecx
shr eax, 8
mov byte [rdi + 2], al
mov byte [rdi + 3], cl
mov ecx, dword [rbp - 0x30]
mov eax, ecx
shr eax, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], cl
mov ecx, dword [rbp - 0x2c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 6], al
mov byte [rdi + 7], cl
mov ecx, dword [rbp - 0x28]
mov eax, ecx
shr eax, 8
mov byte [rdi + 8], al
mov byte [rdi + 9], cl
mov ecx, dword [rbp - 0x24]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], cl
mov ecx, dword [rbp - 0x20]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], cl
mov ecx, dword [rbp - 0x1c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xe], al
mov byte [rdi + 0xf], cl
mov ecx, dword [rbp - 0x18]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], cl
mov ecx, dword [rbp - 0x14]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x12], al
mov byte [rbx], cl
mov byte [rdi + 0x14], r14b
nop dword [rax]
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x1800090fe
mov byte [rbx], r14b
dec rbx
mov rax, rbx
sub rax, rdi
test rax, rax
jg 0x1800090e0
movzx ebx, byte [rdi]
mov rsi, r14
mov r12, qword [0x180136c40]
test bl, bl
je 0x180009141
mov r15, rdi
movsx ecx, bl
lea r15, [r15 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
jne 0x18000912d
cmp bl, 0x5f
je 0x18000912d
cmp bl, 0x2d
jne 0x180009134
mov byte [rsi + r12], bl
inc rsi
movzx ebx, byte [r15]
test bl, bl
jne 0x180009112
mov r15d, dword [rsp + 0x40]
mov rcx, rdi
mov byte [rsi + r12], r14b
call fcn.1800d2490
mov rdx, qword [0x180136c40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009160
cmp rax, 4
jb 0x1800091b6
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009176
cmp rax, 5
jae 0x18000918a
mov ecx, r14d
jmp 0x1800091a2
mov r8d, 5
lea rcx, str.ARRAY
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
sete cl
test cl, cl
movzx r15d, r15b
mov eax, 1
cmove r15d, eax
mov dword [rsp + 0x40], r15d
mov edi, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
mov dword [rsp + 0x50], edi
cmp edi, 0x10
jl 0x180008e95
test r15b, r15b
jne 0x180009b03
xor r12b, r12b
mov r13d, r14d
nop
test r12b, r12b
jne 0x180009b03
mov r8d, r13d
lea rdx, str..Scsi_d:
lea rcx, [rbp + 0x3a0]
call fcn.180009b40
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x3a0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x18000950c
xor edx, edx
lea rcx, [rbp + 0x4b0]
mov r8d, 0x22d
call sub.VCRUNTIME140.dll_memset
mov r9d, 8
mov dword [rbp + 0x4b0], Ordinal_33
lea r8, str.SCSIDISK
mov dword [rbp + 0x4bc], 0x2710
lea rcx, [rbp + 0x4b4]
mov dword [rbp + 0x4c8], 0x211
mov dword [rbp + 0x4c0], 0x1b0501
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x4b0]
mov qword [rsp + 0x30], rax
mov r9d, reloc.WLDAP32.dll_Ordinal_60
lea rax, [rbp + 0x4b0]
mov dword [rsp + 0x28], 0x22d
mov edx, 0x4d008
mov qword [rsp + 0x20], rax
mov byte [rbp + 0x4d6], 0xec
mov byte [rbp + 0x4d8], r14b
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180009501
cmp byte [rbp + 0x512], r14b
je 0x180009501
lea rax, [rbp + 0x700]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x4ec]
nop dword [rax]
movq xmm1, qword [rcx - 0x10]
xorps xmm0, xmm0
movq xmm2, qword [rcx - 8]
lea rax, [rax + 0x40]
punpcklwd xmm1, xmm0
lea rcx, [rcx + 0x20]
punpcklwd xmm2, xmm0
movdqu xmmword [rax - 0x60], xmm1
movq xmm1, qword [rcx - 0x20]
punpcklwd xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm2
movq xmm2, qword [rcx - 0x18]
punpcklwd xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmmword [rax - 0x30], xmm2
sub rdx, 1
jne 0x180009320
mov ecx, 0x400
call fcn.1800d2498
xor edx, edx
mov r8d, 0x3eb
mov rdi, rax
lea rcx, [rax + 0x15]
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rbp + 0x708]
lea rbx, [rdi + 0x13]
mov ecx, edx
shr ecx, 8
mov byte [rdi], cl
mov byte [rdi + 1], dl
mov edx, dword [rbp + 0x70c]
mov ecx, edx
shr ecx, 8
mov byte [rdi + 2], cl
mov ecx, dword [rbp + 0x710]
mov eax, ecx
mov byte [rdi + 3], dl
shr eax, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], cl
mov ecx, dword [rbp + 0x714]
mov eax, ecx
shr eax, 8
mov byte [rdi + 6], al
mov byte [rdi + 7], cl
mov ecx, dword [rbp + 0x718]
mov eax, ecx
shr eax, 8
mov byte [rdi + 8], al
mov byte [rdi + 9], cl
mov ecx, dword [rbp + 0x71c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], cl
mov ecx, dword [rbp + 0x720]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], cl
mov ecx, dword [rbp + 0x724]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xe], al
mov byte [rdi + 0xf], cl
mov ecx, dword [rbp + 0x728]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], cl
mov ecx, dword [rbp + 0x72c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x12], al
mov byte [rbx], cl
mov byte [rdi + 0x14], r14b
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x180009455
mov byte [rbx], r14b
dec rbx
mov rax, rbx
sub rax, rdi
test rax, rax
jg 0x180009437
movzx ebx, byte [rdi]
mov rsi, r14
mov r15, qword [0x180136c40]
test bl, bl
je 0x180009499
nop word [rax + rax]
movsx ecx, bl
lea rdi, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
jne 0x18000948b
cmp bl, 0x5f
je 0x18000948b
cmp bl, 0x2d
jne 0x180009492
mov byte [rsi + r15], bl
inc rsi
movzx ebx, byte [rdi]
test bl, bl
jne 0x180009470
mov byte [rsi + r15], r14b
mov rax, 0xffffffffffffffff
mov rdx, qword [0x180136c40]
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x1800094b0
cmp rax, 4
jb 0x180009501
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r14b
jne 0x1800094c6
cmp rax, 5
jae 0x1800094da
mov ecx, r14d
jmp 0x1800094f2
mov r8d, 5
lea rcx, str.ARRAY
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
sete cl
test cl, cl
movzx r12d, r12b
mov eax, 1
cmove r12d, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13d
cmp r13d, 0x10
jl 0x1800091f0
test r12b, r12b
jne 0x180009b03
xor r13b, r13b
lea rsi, [0x180136850]
mov r12d, r14d
lea rdi, [0x180136a70]
mov r15d, 0xa1
nop dword [rax]
test r13b, r13b
jne 0x180009b03
mov r8d, r12d
lea rdx, str..PhysicalDrive_d
lea rcx, [rbp + 0x3a0]
call fcn.180009b40
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x3a0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x1800098b0
xor ecx, ecx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x68], rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x30], rcx
xor r9d, r9d
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], Ordinal_27
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov edx, 0x74080
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800098a5
movzx eax, byte [rsp + 0x5b]
test al, al
je 0x1800098a5
xorps xmm0, xmm0
movzx ecx, r12b
shr al, cl
mov ebx, 0xec
test al, 0x10
mov r8d, 0x210
mov rcx, rsi
cmovne ebx, r15d
xor eax, eax
xor edx, edx
mov byte [rbp - 0x70], al
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], r14
movzx eax, r12b
and al, 1
mov dword [rsp + 0x70], 0x200
or al, 0xfa
mov word [rsp + 0x74], 0x100
shl al, 4
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0x79], al
mov edx, 0x7c088
lea rax, [rsp + 0x40]
mov word [rsp + 0x77], r14w
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x210
mov qword [rsp + 0x20], rsi
mov byte [rsp + 0x7a], bl
mov byte [rsp + 0x7c], r12b
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800098a5
lea rcx, [rbp + 0x700]
lea rax, [0x180136870]
nop dword [rax]
nop word [rax + rax]
movq xmm1, qword [rax - 0x10]
lea rcx, [rcx + 0x40]
movq xmm2, qword [rax - 8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
movdqu xmmword [rcx - 0x60], xmm1
movq xmm1, qword [rax]
punpcklwd xmm2, xmm0
movdqu xmmword [rcx - 0x50], xmm2
movq xmm2, qword [rax + 8]
add rax, 0x20
punpcklwd xmm1, xmm0
punpcklwd xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmmword [rcx - 0x30], xmm2
cmp rax, rdi
jl 0x1800096b0
mov ecx, 0x400
call fcn.1800d2498
xor edx, edx
mov r8d, 0x3eb
mov rdi, rax
lea rcx, [rax + 0x15]
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rbp + 0x708]
lea rbx, [rdi + 0x13]
mov ecx, edx
shr ecx, 8
mov byte [rdi], cl
mov byte [rdi + 1], dl
mov edx, dword [rbp + 0x70c]
mov ecx, edx
shr ecx, 8
mov byte [rdi + 2], cl
mov ecx, dword [rbp + 0x710]
mov eax, ecx
mov byte [rdi + 3], dl
shr eax, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], cl
mov ecx, dword [rbp + 0x714]
mov eax, ecx
shr eax, 8
mov byte [rdi + 6], al
mov byte [rdi + 7], cl
mov ecx, dword [rbp + 0x718]
mov eax, ecx
shr eax, 8
mov byte [rdi + 8], al
mov byte [rdi + 9], cl
mov ecx, dword [rbp + 0x71c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], cl
mov ecx, dword [rbp + 0x720]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], cl
mov ecx, dword [rbp + 0x724]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xe], al
mov byte [rdi + 0xf], cl
mov ecx, dword [rbp + 0x728]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], cl
mov ecx, dword [rbp + 0x72c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x12], al
mov byte [rbx], cl
mov byte [rdi + 0x14], r14b
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x1800097e3
mov byte [rbx], r14b
dec rbx
mov rax, rbx
sub rax, rdi
test rax, rax
jg 0x1800097c5
movzx ebx, byte [rdi]
mov rsi, r14
mov r15, qword [0x180136c40]
test bl, bl
je 0x180009829
nop dword [rax]
nop dword [rax + rax]
movsx ecx, bl
lea rdi, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
jne 0x18000981b
cmp bl, 0x5f
je 0x18000981b
cmp bl, 0x2d
jne 0x180009822
mov byte [rsi + r15], bl
inc rsi
movzx ebx, byte [rdi]
test bl, bl
jne 0x180009800
mov byte [rsi + r15], r14b
mov rax, 0xffffffffffffffff
mov rdx, qword [0x180136c40]
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009840
cmp rax, 4
jb 0x180009891
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009856
cmp rax, 5
jae 0x18000986a
mov ecx, r14d
jmp 0x180009882
mov r8d, 5
lea rcx, str.ARRAY
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
sete cl
test cl, cl
movzx r13d, r13b
mov eax, 1
cmove r13d, eax
mov r15d, 0xa1
lea rsi, [0x180136850]
lea rdi, [0x180136a70]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12d
cmp r12d, 0x10
jl 0x180009540
test r13b, r13b
jne 0x180009b03
xor r12b, r12b
mov r13d, r14d
nop dword [rax]
test r12b, r12b
jne 0x180009b03
mov r8d, r13d
lea rdx, str..PhysicalDrive_d
lea rcx, [rbp + 0x3a0]
call fcn.180009b40
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x3a0]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x180009a4c
xor edx, edx
mov dword [rsp + 0x44], r14d
mov r8d, 0x2710
mov qword [rsp + 0x5c], r14
lea rcx, [rbp + 0x6e0]
mov dword [rsp + 0x58], r14d
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov r9d, ntohs
lea rax, [rbp + 0x6e0]
mov dword [rsp + 0x28], 0x2710
mov edx, 0x2d1400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180009a41
movsxd rax, dword [rbp + 0x6f8]
lea rsi, [rbp + 0x6e0]
mov r15, qword [0x180136c40]
add rsi, rax
mov rdi, r14
movzx ebx, byte [rsi]
test bl, bl
je 0x1800099da
movsx ecx, bl
lea rsi, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
jne 0x1800099cc
cmp bl, 0x5f
je 0x1800099cc
cmp bl, 0x2d
jne 0x1800099d3
mov byte [rdi + r15], bl
inc rdi
movzx ebx, byte [rsi]
test bl, bl
jne 0x1800099b1
mov byte [rdi + r15], r14b
mov rax, 0xffffffffffffffff
mov rdx, qword [0x180136c40]
nop dword [rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x1800099f0
cmp rax, 4
jb 0x180009a41
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r14b
jne 0x180009a06
cmp rax, 5
jae 0x180009a1a
mov ecx, r14d
jmp 0x180009a32
mov r8d, 5
lea rcx, str.ARRAY
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
sete cl
test cl, cl
movzx r12d, r12b
mov eax, 1
cmove r12d, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13d
cmp r13d, 0x10
jl 0x1800098d0
test r12b, r12b
jne 0x180009b03
xor edx, edx
lea rcx, [rbp + 0x4b0]
mov r8d, 0x105
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x105
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x38], 0x105
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x4b0]
lea rax, [rsp + 0x54]
mov dword [rsp + 0x54], r14d
mov r8d, 0x105
mov qword [rsp + 0x20], rax
lea rcx, [0x180112cf4]
mov dword [rsp + 0x44], r14d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov rcx, qword [0x180136c40]
lea r8, str.VM__lu
test eax, eax
mov edx, 0x400
cmovne r14d, dword [rsp + 0x40]
mov r9d, r14d
call fcn.1800046e0
mov rcx, qword [rbp + 0x2df0]
xor rcx, rsp
call fcn.1800d2160
lea r11, [rsp + 0x2f00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret