Function at 0x14005e800
Capabilities:
Check if file exists
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xfd8
mov qword [rsp + 0xfc0], 0xfffffffffffffffe
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0xfc8], rax
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
call fcn.140001a40
lea rcx, [rsp + 0x154]
call fcn.14005b670
nop
lea rcx, [rsp + 0x154]
call fcn.14005b820
mov byte [rsp + 0x50], 0
lea rdi, [rsp + 0x51]
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
mov dword [rsp + 0x150], 0xff
lea rdx, [rsp + 0x50]
mov ecx, dword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x150]
cmp dword [rsp + 0x40], eax
jg 0x14005e8a0
cmp dword [rsp + 0x40], 0
jne 0x14005e8dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xff0]
add rcx, 0x15d
mov r9d, eax
mov r8d, dword [rsp + 0x40]
lea rdx, str._GetWinInstallPath__GetLogicalDriveStrings_nRes:_d__Err:_d__n
call fcn.140025b64
nop
lea rcx, [rsp + 0x154]
call fcn.14005b660
jmp 0x14005f100
mov dword [rsp + 0x970], 0
jmp 0x14005e8fa
mov eax, dword [rsp + 0x970]
add eax, 1
mov dword [rsp + 0x970], eax
mov eax, dword [rsp + 0x40]
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp dword [rsp + 0x970], eax
jge 0x14005eb4b
mov eax, dword [rsp + 0x970]
shl eax, 2
cdqe
movsx eax, byte [rsp + rax + 0x50]
cmp eax, 0x78
je 0x14005e940
mov eax, dword [rsp + 0x970]
shl eax, 2
cdqe
movsx eax, byte [rsp + rax + 0x50]
cmp eax, 0x58
jne 0x14005e942
jmp 0x14005e8e9
mov r8d, 0x400
xor edx, edx
lea rcx, [rsp + 0x360]
call fcn.1400258a0
mov eax, dword [rsp + 0x970]
shl eax, 2
cdqe
movsx r8d, byte [rsp + rax + 0x50]
lea rdx, str._C:WINDOWS_system32configSAM
lea rcx, [rsp + 0x360]
call fcn.140025b64
lea rcx, [rsp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14005e9ee
mov r8d, 0x210
xor edx, edx
lea rcx, [rsp + 0x760]
call fcn.1400258a0
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x760]
call fcn.140026030
lea rdx, [rsp + 0x360]
mov rcx, qword [rsp + 0xff0]
call fcn.14005e630
mov byte [rsp + 0x968], al
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
lea rdx, [rsp + 0x760]
call fcn.140001960
mov r8d, 0x400
xor edx, edx
lea rcx, [rsp + 0x360]
call fcn.1400258a0
mov eax, dword [rsp + 0x970]
shl eax, 2
cdqe
movsx r8d, byte [rsp + rax + 0x50]
lea rdx, str._C:WINNT_system32configSAM
lea rcx, [rsp + 0x360]
call fcn.140025b64
lea rcx, [rsp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14005ea9a
mov r8d, 0x210
xor edx, edx
lea rcx, [rsp + 0x760]
call fcn.1400258a0
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x760]
call fcn.140026030
lea rdx, [rsp + 0x360]
mov rcx, qword [rsp + 0xff0]
call fcn.14005e630
mov byte [rsp + 0x968], al
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
lea rdx, [rsp + 0x760]
call fcn.140001960
mov r8d, 0x400
xor edx, edx
lea rcx, [rsp + 0x360]
call fcn.1400258a0
mov eax, dword [rsp + 0x970]
shl eax, 2
cdqe
movsx r8d, byte [rsp + rax + 0x50]
lea rdx, str._C:WINNT35_system32configSAM
lea rcx, [rsp + 0x360]
call fcn.140025b64
lea rcx, [rsp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14005eb46
mov r8d, 0x210
xor edx, edx
lea rcx, [rsp + 0x760]
call fcn.1400258a0
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x760]
call fcn.140026030
lea rdx, [rsp + 0x360]
mov rcx, qword [rsp + 0xff0]
call fcn.14005e630
mov byte [rsp + 0x968], al
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
lea rdx, [rsp + 0x760]
call fcn.140001960
jmp 0x14005e8e9
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
call fcn.1400018f0
mov dword [rsp + 0x158], eax
mov dword [rsp + 0x974], 0
jmp 0x14005eb81
mov eax, dword [rsp + 0x974]
add eax, 1
mov dword [rsp + 0x974], eax
mov eax, dword [rsp + 0x158]
cmp dword [rsp + 0x974], eax
jge 0x14005f038
movsxd rdx, dword [rsp + 0x974]
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
call fcn.140001920
movzx eax, byte [rax + 0x209]
test eax, eax
je 0x14005ebbb
jmp 0x14005eb70
movsxd rdx, dword [rsp + 0x974]
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
call fcn.140001920
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.140026030
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0xff0]
call fcn.14005bdd0
lea rdx, [0x140083a50]
lea rcx, [rsp + 0x160]
call fcn.140025f90
xor edx, edx
lea rcx, [rsp + 0x160]
call fcn.14004e880
mov qword [rsp + 0x980], rax
cmp qword [rsp + 0x980], 0
jne 0x14005ec34
jmp 0x14005eb70
mov r9d, 0x81
lea r8, str.SelectDefault
xor edx, edx
mov rcx, qword [rsp + 0x980]
call fcn.14004e090
mov dword [rsp + 0x978], eax
mov r9d, dword [rsp + 0x978]
lea r8, [rsp + 0x160]
lea rdx, str._GetWinInstallPath__system:_s__nID:_d._n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov byte [rsp + 0x990], 0
lea rdi, [rsp + 0x991]
xor eax, eax
mov ecx, 0x1ff
rep stosb byte [rdi], al
mov r8d, dword [rsp + 0x978]
lea rdx, str.ControlSet_03dServicesNTDSParametersDSA_Database_file
lea rcx, [rsp + 0x990]
call fcn.140025b64
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x990]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x980]
call fcn.14004d710
mov qword [rsp + 0xb90], rax
cmp qword [rsp + 0xb90], 0
jne 0x14005ecfe
mov rcx, qword [rsp + 0x980]
call fcn.14004acd0
jmp 0x14005eb70
mov rax, qword [rsp + 0xb90]
mov eax, dword [rax]
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
mov r8, qword [rsp + 0xb90]
add r8, 4
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
lea rax, [rsp + 0x990]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rsp + 0xb90]
mov eax, dword [rdx]
cdq
sub eax, edx
sar eax, 1
cdqe
mov byte [rsp + rax + 0x990], 0
movsx eax, byte [rsp + 0x990]
test eax, eax
je 0x14005f002
lea rcx, [rsp + 0x990]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14005ee2f
mov r8d, 0x210
xor edx, edx
lea rcx, [rsp + 0x760]
call fcn.1400258a0
mov edx, dword [rsp + 0x978]
mov dword [rsp + 0x96c], edx
movsxd rdx, dword [rsp + 0x974]
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
call fcn.140001920
mov rdx, rax
lea rcx, [rsp + 0x760]
call fcn.140026030
lea rdx, [rsp + 0x990]
lea rcx, [rsp + 0x864]
call fcn.140026030
lea rdx, [rsp + 0x760]
mov rcx, qword [rsp + 0xff0]
call fcn.14005e630
mov byte [rsp + 0x968], al
mov byte [rsp + 0x969], 1
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
lea rdx, [rsp + 0x760]
call fcn.140001960
jmp 0x14005f002
movzx eax, byte [rsp + 0x160]
mov byte [rsp + 0x990], al
lea rcx, [rsp + 0x990]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14005eef7
mov r8d, 0x210
xor edx, edx
lea rcx, [rsp + 0x760]
call fcn.1400258a0
mov edx, dword [rsp + 0x978]
mov dword [rsp + 0x96c], edx
movsxd rdx, dword [rsp + 0x974]
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
call fcn.140001920
mov rdx, rax
lea rcx, [rsp + 0x760]
call fcn.140026030
lea rdx, [rsp + 0x990]
lea rcx, [rsp + 0x864]
call fcn.140026030
lea rdx, [rsp + 0x760]
mov rcx, qword [rsp + 0xff0]
call fcn.14005e630
mov byte [rsp + 0x968], al
mov byte [rsp + 0x969], 1
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
lea rdx, [rsp + 0x760]
call fcn.140001960
jmp 0x14005f002
mov dword [rsp + 0xb98], 0
jmp 0x14005ef15
mov eax, dword [rsp + 0xb98]
add eax, 1
mov dword [rsp + 0xb98], eax
mov eax, dword [rsp + 0x40]
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp dword [rsp + 0xb98], eax
jge 0x14005f002
mov eax, dword [rsp + 0xb98]
shl eax, 2
cdqe
movzx eax, byte [rsp + rax + 0x50]
mov byte [rsp + 0x990], al
lea rcx, [rsp + 0x990]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14005effd
mov r8d, 0x210
xor edx, edx
lea rcx, [rsp + 0x760]
call fcn.1400258a0
mov edx, dword [rsp + 0x978]
mov dword [rsp + 0x96c], edx
movsxd rdx, dword [rsp + 0x974]
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
call fcn.140001920
mov rdx, rax
lea rcx, [rsp + 0x760]
call fcn.140026030
lea rdx, [rsp + 0x990]
lea rcx, [rsp + 0x864]
call fcn.140026030
lea rdx, [rsp + 0x760]
mov rcx, qword [rsp + 0xff0]
call fcn.14005e630
mov byte [rsp + 0x968], al
mov byte [rsp + 0x969], 1
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
lea rdx, [rsp + 0x760]
call fcn.140001960
jmp 0x14005f002
jmp 0x14005ef04
cmp qword [rsp + 0xb90], 0
je 0x14005f026
mov rcx, qword [rsp + 0xb90]
call fcn.140025614
mov qword [rsp + 0xb90], 0
mov rcx, qword [rsp + 0x980]
call fcn.14004acd0
jmp 0x14005eb70
mov dword [rsp + 0xb9c], 0
jmp 0x14005f056
mov eax, dword [rsp + 0xb9c]
add eax, 1
mov dword [rsp + 0xb9c], eax
movsxd rdi, dword [rsp + 0xb9c]
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
call fcn.1400018f0
cmp rdi, rax
jae 0x14005f0f3
movsxd rdx, dword [rsp + 0xb9c]
mov rcx, qword [rsp + 0xff0]
add rcx, 0x30
call fcn.140001920
lea rdi, [rsp + 0xdb0]
mov rsi, rax
mov ecx, 0x210
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xba0]
lea rsi, [rsp + 0xdb0]
mov ecx, 0x210
rep movsb byte [rdi], byte [rsi]
movzx eax, byte [rsp + 0xda9]
test eax, eax
je 0x14005f0d9
lea rdx, [rsp + 0xca4]
mov rcx, qword [rsp + 0xff0]
call fcn.14005c4f0
jmp 0x14005f0ee
lea rdx, [rsp + 0xba0]
mov rcx, qword [rsp + 0xff0]
call fcn.14005c4f0
jmp 0x14005f045
lea rcx, [rsp + 0x154]
call fcn.14005b660
mov rcx, qword [rsp + 0xfc8]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0xfd8
pop rdi
pop rsi
ret