Function at 0x1800644d0
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r12d, r12d
mov r14d, r8d
mov r15, rdx
mov rbx, rcx
test rcx, rcx
je 0x180064721
mov rdx, rcx
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
test eax, eax
jns 0x180064527
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x180064732
movzx ecx, word [rbp - 0x20]
mov rax, qword [rbp - 0x18]
shr rcx, 1
cmp word [rax + rcx*2 - 2], 0x5c
jne 0x180064717
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 4
je 0x180064721
lea rdx, str._Extend_Reparse:_R:_INDEX_ALLOCATION
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
movzx edx, word [rbp - 0x20]
movzx ecx, word [rbp - 0x10]
add edx, 2
add edx, ecx
cmp edx, 0xffff
ja 0x180064717
mov word [rbp - 0x2e], dx
mov word [rbp - 0x30], r12w
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
movzx r8d, word [rbp - 0x2e]
mov edx, dword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x28], rax
test rax, rax
jne 0x1800645cc
lea ecx, [rax + 8]
jmp 0x180064726
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
nop dword [rax + rax]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
movzx ecx, word [rbp - 0x30]
xor r9d, r9d
mov rax, qword [rbp - 0x28]
mov edx, 0x80000000
shr rcx, 1
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2020000
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], 3
mov word [rax + rcx*2], r12w
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x28]
mov rsi, rax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
or rbx, 0xffffffffffffffff
cmp rsi, rbx
jne 0x180064668
mov rax, rbx
jmp 0x180064736
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8d, 0x18
mov edx, dword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1800646bd
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
lea ecx, [rdi + 8]
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x180064660
mov qword [rax + 8], r12
mov r9d, 1
mov qword [rax + 0x10], r12
mov r8d, r14d
mov rdx, r15
mov qword [rax], rsi
mov rcx, rdi
call fcn.180064a98
test eax, eax
jne 0x180064712
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x180064660
mov rax, rdi
jmp 0x180064736
mov ecx, 0xc0000033
jmp 0x18006451d
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
or rax, 0xffffffffffffffff
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret