Function at 0x1400e5a20
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor esi, esi
mov dword [rbp - 0x6d], esi
mov rdi, qword [rbp + 0x67]
mov rcx, rdi
call fcn.14000c7d0
mov dword [rbp - 0x6d], 1
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x49], rax
lea rdx, [0x14012c8f0]
test rdx, 0xffffffffffff0000
jne 0x1400e5aca
movzx ebx, dx
mov ecx, ebx
call fcn.14001df50
test rax, rax
je 0x1400e5ad7
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x49]
call fcn.14001e130
jmp 0x1400e5ad7
xor r8d, r8d
lea rcx, [rbp - 0x49]
call fcn.14001e490
nop
mov word [rbp - 0x41], si
mov qword [rbp - 0x3d], rsi
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], rsi
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x19], rax
mov byte [rbp - 0x11], 0
mov rcx, qword [rsp + 0x20]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, 0x104
or eax, edx
jge 0x1400e5b4a
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.14001e8d0
mov rcx, qword [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov r14, rax
mov rcx, qword [rsp + 0x20]
movsxd rdx, dword [rcx - 0xc]
call fcn.14005e508
mov r11, rax
test eax, eax
js 0x1400e6101
mov rax, qword [rsp + 0x20]
cmp r11d, dword [rax - 0xc]
jg 0x1400e6101
mov dword [rax - 0x10], r11d
movsxd rcx, r11d
mov rax, qword [rsp + 0x20]
mov word [rax + rcx*2], si
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400e58f0
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14000f990
mov r8, rax
lea rdx, [rbp + 0x27]
mov rcx, rdi
call fcn.14000ffd0
or r15d, 0xffffffff
cmp r14, 0xffffffffffffffff
je 0x1400e5e21
nop word [rax + rax]
mov rdx, qword [rsp + 0x20]
mov ecx, 1
sub ecx, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400e5bfd
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.14001e8d0
mov rdx, qword [rsp + 0x20]
mov r8d, 0x104
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov ebx, eax
mov rcx, qword [rsp + 0x20]
movsxd rdx, dword [rcx - 0xc]
call fcn.14005e508
mov r11, rax
test eax, eax
js 0x1400e5e16
mov rax, qword [rsp + 0x20]
cmp r11d, dword [rax - 0xc]
jg 0x1400e5e16
mov dword [rax - 0x10], r11d
movsxd rcx, r11d
mov rax, qword [rsp + 0x20]
mov word [rax + rcx*2], si
test ebx, ebx
je 0x1400e5e0b
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x59]
call fcn.1400e58f0
nop
mov r12, qword [rax]
lea rdx, [r12 - 0x18]
mov rcx, qword [rsp + 0x28]
lea rbx, [rcx - 0x18]
cmp rdx, rbx
je 0x1400e5d9f
cmp dword [rbx + 0x10], 0
jl 0x1400e5cb9
mov rax, qword [rbx]
cmp qword [rdx], rax
jne 0x1400e5cb9
mov rcx, rdx
call fcn.14001e5d0
mov rdi, rax
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400e5cab
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x1400e5d9b
movsxd rdi, dword [r12 - 0x10]
test edi, edi
jne 0x1400e5d1d
mov rdi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x1400e5d9b
cmp dword [rbx + 0x10], 0
jge 0x1400e5cef
cmp dword [rcx - 0xc], 0
jl 0x1400e5ddf
mov dword [rcx - 0x10], esi
mov rax, qword [rsp + 0x28]
mov word [rax], si
jmp 0x1400e5d9b
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e5d09
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
jmp 0x1400e5d9b
test r12, r12
je 0x1400e5e00
mov r13d, dword [rcx - 0x10]
mov rsi, r12
sub rsi, rcx
sar rsi, 1
test edi, edi
js 0x1400e5df5
mov edx, 1
sub edx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, edi
or eax, edx
jge 0x1400e5d5d
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.14001e8d0
mov rcx, qword [rsp + 0x28]
lea rbx, [rdi + rdi]
movsxd rdx, dword [rcx - 0xc]
mov r9, rbx
add rdx, rdx
cmp rsi, r13
ja 0x1400e5d7b
lea r8, [rcx + rsi*2]
call fcn.14005e528
jmp 0x1400e5d83
mov r8, r12
call fcn.14005e228
mov rax, qword [rsp + 0x28]
cmp edi, dword [rax - 0xc]
jg 0x1400e5dea
mov dword [rax - 0x10], edi
mov rax, qword [rsp + 0x28]
xor esi, esi
mov word [rbx + rax], si
mov rdi, qword [rbp + 0x67]
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e5dbe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14000f990
mov r8, rax
lea rdx, [rbp + 7]
mov rcx, rdi
call fcn.14000ffd0
jmp 0x1400e5bd0
mov ecx, 0x80070057
call fcn.14001e940
int3
mov ecx, 0x80070057
call fcn.14001e940
int3
mov ecx, 0x80070057
call fcn.14001e940
int3
mov ecx, 0x80070057
call fcn.14001e940
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
jmp 0x1400e5e21
mov ecx, 0x80070057
call fcn.14001e940
int3
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rbp - 0x71], eax
mov r14d, 0x41
movzx ecx, r14w
sub ecx, 0x41
bt eax, ecx
jae 0x1400e6015
movzx edx, r14w
lea rcx, [rbp - 0x79]
call fcn.14001efc0
nop
lea r13, [0x14011bc34]
lea rdi, [0x14011bc34]
mov rax, qword [rbp - 0x79]
sub rdi, rax
sar rdi, 1
mov esi, dword [rax - 0x10]
mov edx, 1
lea rcx, [0x14011bc34]
call fcn.14005e508
mov r12, rax
mov ecx, 0x7fffffff
sub ecx, eax
xor edx, edx
cmp ecx, esi
setge dl
test edx, edx
je 0x1400e6051
lea ebx, [rsi + rax]
test ebx, ebx
js 0x1400e6046
mov rax, qword [rbp - 0x79]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, ebx
or ecx, edx
jge 0x1400e5ec2
mov edx, ebx
lea rcx, [rbp - 0x79]
call fcn.14001e8d0
mov rax, qword [rbp - 0x79]
cmp rdi, rsi
ja 0x1400e5ecb
lea r13, [rax + rdi*2]
movsxd rdx, r12d
add rdx, rdx
lea rcx, [rax + rsi*2]
mov r9, rdx
mov r8, r13
call fcn.14005e228
mov r11, qword [rbp - 0x79]
cmp ebx, dword [r11 - 0xc]
jg 0x1400e603b
mov dword [r11 - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rbp - 0x79]
xor esi, esi
mov word [rax + rcx*2], si
mov rdi, qword [rbp + 0x67]
mov rdx, qword [rdi + 8]
mov r9, qword [rdx + 8]
mov r11, rdx
mov rcx, qword [rbp - 0x79]
cmp byte [r9 + 0x21], sil
jne 0x1400e5f6b
mov ebx, esi
test rcx, rcx
setne bl
test ebx, ebx
je 0x1400e6025
mov rax, qword [r9 + 0x18]
mov r10, rcx
sub r10, rax
movzx r8d, word [rax]
cmp r8w, word [rax + r10]
jne 0x1400e5f4b
add rax, 2
test r8w, r8w
jne 0x1400e5f32
mov eax, esi
jmp 0x1400e5f50
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sets al
test al, al
je 0x1400e5f5f
mov r9, qword [r9 + 0x10]
jmp 0x1400e5f65
mov r11, r9
mov r9, qword [r9]
cmp byte [r9 + 0x21], sil
je 0x1400e5f20
mov qword [rbp - 0x69], r11
cmp r11, rdx
je 0x1400e5fc4
mov r10, qword [r11 + 0x18]
mov r8d, esi
test r10, r10
setne r8b
test r8d, r8d
je 0x1400e6030
mov r8, rcx
sub r10, rcx
movzx r9d, word [r8]
cmp r9w, word [r8 + r10]
jne 0x1400e5fab
add r8, 2
test r9w, r9w
jne 0x1400e5f91
mov r8d, esi
jmp 0x1400e5fb2
sbb r8d, r8d
sbb r8d, 0xffffffff
test r8d, r8d
sets r8b
test r8b, r8b
jne 0x1400e5fc4
lea rax, [rbp - 0x69]
jmp 0x1400e5fcc
mov qword [rbp - 0x61], rdx
lea rax, [rbp - 0x61]
mov rax, qword [rax]
mov qword [rbp - 9], rax
cmp rax, rdx
jne 0x1400e5ff7
lea rdx, [rbp - 0x79]
mov rcx, rdi
call fcn.14000f990
mov r8, rax
lea rdx, [rbp + 0x17]
mov rcx, rdi
call fcn.14000ffd0
mov rcx, qword [rbp - 0x79]
lea rdx, [rcx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e6012
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, dword [rbp - 0x71]
inc r14w
cmp r14w, 0x5a
ja 0x1400e605c
jmp 0x1400e5e30
mov ecx, 0x80004005
call fcn.14001e940
int3
mov ecx, 0x80004005
call fcn.14001e940
int3
mov ecx, 0x80070057
call fcn.14001e940
int3
mov ecx, 0x80070057
call fcn.14001e940
int3
mov ecx, 0x80070057
call fcn.14001e940
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e607d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e609c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e60bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e60db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
dec r15d
test r15d, r15d
jg 0x1400e60fc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rdi
jmp 0x1400e610c
mov ecx, 0x80070057
call fcn.14001e940
nop
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret