Function at 0x1400060dc
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
lea rcx, str.GetVolumeNameFromDeviceName
lea edi, [rbx + 1]
call fcn.140007418
xor edx, edx
mov word [rsp + 0x30], bx
mov r8d, 0x208
lea rcx, [rsp + 0x32]
call sub.msvcrt.dll_memset
test rbp, rbp
je 0x14004899a
test rsi, rsi
je 0x1400489d6
mov r15d, 0x105
mov word [rsi], bx
mov edx, r15d
lea r8, str._GLOBALROOT_s
mov r9, rbp
lea rcx, [rsp + 0x30]
call fcn.140008be0
test eax, eax
js 0x140048a12
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140006175
cmp word [rsp + rax*2 + 0x2e], 0x5c
je 0x1400061a2
lea r8, [0x1400f2048]
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140006000
test eax, eax
js 0x140048a6b
mov r8d, r14d
lea rcx, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x140048adc
lea rcx, str.GetVolumeNameFromDeviceName
call fcn.1400073f0
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400305f0
mov rbx, qword [rsp + 0x298]
add rsp, 0x250
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r9d, 0x57
mov edi, ebx
mov ebx, r9d
mov rcx, qword [0x14015a290]
lea rax, [0x14015a290]
cmp rcx, rax
je 0x1400061bb
test byte [rcx + 0x1c], 8
je 0x1400061bb
lea edx, [r9 - 0x41]
lea rax, [0x14012f8a0]
jmp 0x140048b23
mov r9d, 0x57
mov edi, ebx
mov ebx, r9d
mov rcx, qword [0x14015a290]
lea rax, [0x14015a290]
cmp rcx, rax
je 0x1400061bb
test byte [rcx + 0x1c], 8
je 0x1400061bb
lea edx, [r9 - 0x40]
lea rax, str.pwszVolumeName
jmp 0x140048b23
mov ecx, eax
mov edi, ebx
call fcn.1400e32f8
mov ebx, eax
mov rcx, qword [0x14015a290]
lea rax, [0x14015a290]
cmp rcx, rax
je 0x1400061bb
test byte [rcx + 0x1c], 8
je 0x1400061bb
mov r9, rbp
lea r8, str._GLOBALROOT_s
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140008be0
lea rcx, str.DevicePathToWin32Path___WCHAR_pwszDeviceName__ARRAY_COUNT_PARAM_wszPath__
mov edx, 0x19
mov qword [rsp + 0x20], rcx
mov r9d, eax
jmp 0x140048abf
mov ecx, eax
mov edi, ebx
call fcn.1400e32f8
mov ebx, eax
mov rcx, qword [0x14015a290]
lea rax, [0x14015a290]
cmp rcx, rax
je 0x1400061bb
test byte [rcx + 0x1c], 8
je 0x1400061bb
lea r8, [0x1400f2048]
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140006000
mov r9d, eax
mov edx, 0x1a
lea rax, str.::StringCchCat__wszPath__ARRAYSIZE_wszPath___L____
mov qword [rsp + 0x20], rax
mov rcx, qword [0x14015a290]
lea r8, str.yO4
mov rcx, qword [rcx + 0x10]
call fcn.1400d5cb0
nop
jmp 0x1400061bb
mov edi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x14015a290]
lea rax, [0x14015a290]
cmp rcx, rax
je 0x1400061bb
test byte [rcx + 0x1c], 8
je 0x1400061bb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x14015a290]
mov edx, 0x1b
mov r9d, eax
lea rax, str.::GetVolumeNameForVolumeMountPoint__wszPath__pwszVolumeName__cchVolumeName__
mov rcx, qword [rcx + 0x10]
lea r8, str.yO4
mov qword [rsp + 0x20], rax
call fcn.1400d5cb0
nop
jmp 0x1400061bb