Function at 0x180013300
Capabilities:
Get disk information
Get disk size

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x700]
sub rsp, 0x800
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x850], rbx
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rbp + 0x6f0], rax
mov r13, rdx
mov r12, rcx
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
lea rcx, str.Shell32.dll
call fcn.1800429cc
mov r15, rax
movabs rsi, 0x7ffffffffffffffe
movabs r9, 0x7fffffffffffffff
lea r8, [rdi - 1]
mov r14, qword [rsp + 0x58]
cmp rax, r14
ja 0x1800133c8
lea rdi, [rsp + 0x40]
cmp r14, 8
cmovae rdi, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.Shell32.dll
mov rcx, rdi
call fcn.180039130
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x1800134bd
cmp r15, rsi
ja 0x180013b73
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x1800133e2
mov rbx, rsi
jmp 0x180013403
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x1800133f8
mov rbx, rsi
jmp 0x180013403
lea rax, [rcx + r14]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r9
jbe 0x180013415
mov rdx, r8
jmp 0x18001341e
cmp rdx, 0x1000
jb 0x180013445
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.18003762c
test rax, rax
je 0x180013b79
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180013455
test rdx, rdx
je 0x180013455
mov rcx, rdx
call fcn.18003762c
mov rdi, rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.Shell32.dll
mov rcx, rdi
call fcn.180039130
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x1800134b8
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800134b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013b7f
call fcn.180037624
mov qword [rsp + 0x40], rdi
call fcn.18001b4d0
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18001b570
mov rbx, rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180013514
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001350f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013b85
call fcn.180037624
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
test rbx, rbx
je 0x1800135da
lea rdx, str.SHGetFileInfoW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1800135da
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], di
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], di
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], di
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rbp + 0x10]
call fcn.1800395c0
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x1800135b6
mov rcx, qword [r12]
mov dword [rsp + 0x20], 0x610
mov r9d, 0x2b8
lea r8, [rbp + 0x10]
xor edx, edx
call rbx
test rax, rax
jne 0x1800135e1
lea rcx, [rbp - 0x70]
call fcn.180013bc0
xor al, al
jmp 0x180013b43
lea rcx, [rbp + 0x20]
call fcn.1800429cc
mov r15, rax
mov r14, qword [rbp - 0x58]
cmp rax, r14
ja 0x180013625
lea rdi, [rbp - 0x70]
cmp r14, 8
cmovae rdi, qword [rbp - 0x70]
mov qword [rbp - 0x60], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.180039130
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x18001372b
cmp r15, rsi
ja 0x180013b8b
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x18001363f
mov rbx, rsi
jmp 0x180013660
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180013655
mov rbx, rsi
jmp 0x180013660
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180013683
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180013693
cmp rdx, 0x1000
jb 0x1800136ba
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003762c
test rax, rax
je 0x180013b91
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800136ca
test rdx, rdx
je 0x1800136ca
mov rcx, rdx
call fcn.18003762c
mov rdi, rax
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.180039130
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x180013727
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013722
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013b97
call fcn.180037624
mov qword [rbp - 0x70], rdi
lea rcx, [rbp + 0x228]
call fcn.1800429cc
mov r15, rax
mov r14, qword [rbp - 0x38]
cmp rax, r14
ja 0x180013777
lea rdi, [rbp - 0x50]
cmp r14, 8
cmovae rdi, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [rbp + 0x228]
mov rcx, rdi
call fcn.180039130
xor r15d, r15d
mov word [rbx + rdi], r15w
jmp 0x180013886
cmp r15, rsi
ja 0x180013b9d
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x180013791
mov rbx, rsi
jmp 0x1800137b2
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x1800137a7
mov rbx, rsi
jmp 0x1800137b2
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x1800137d5
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x1800137e5
cmp rdx, 0x1000
jb 0x18001380c
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003762c
test rax, rax
je 0x180013ba3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180013820
test rdx, rdx
je 0x18001381b
mov rcx, rdx
call fcn.18003762c
jmp 0x18001381d
xor eax, eax
mov rdi, rax
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, [rbp + 0x228]
mov rcx, rdi
call fcn.180039130
xor r15d, r15d
mov word [rbx + rdi], r15w
cmp r14, 8
jb 0x180013882
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001387d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013ba9
call fcn.180037624
mov qword [rbp - 0x50], rdi
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x4e0]
call fcn.1800395c0
mov dword [rbp - 0x80], r15d
mov dword [rsp + 0x7c], r15d
mov dword [rsp + 0x78], r15d
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x2d0]
call fcn.1800395c0
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x1800138cb
mov rcx, qword [r12]
mov dword [rsp + 0x38], 0x104
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov r8d, 0x104
lea rdx, [rbp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x180013ae3
mov word [rbp + 0x4d8], r15w
lea rcx, [rbp + 0x2d0]
call fcn.1800429cc
mov rbx, rax
mov r14, qword [rbp - 0x18]
cmp rax, r14
ja 0x180013962
lea rdi, [rbp - 0x30]
cmp r14, 8
cmovae rdi, qword [rbp - 0x30]
mov qword [rbp - 0x20], rax
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call fcn.180039130
mov word [rbx + rdi], r15w
jmp 0x180013a67
cmp rbx, rsi
ja 0x180013baf
mov rcx, rbx
or rcx, 7
cmp rcx, rsi
ja 0x180013996
mov rdx, r14
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp r14, rax
ja 0x180013996
lea rax, [r14 + rdx]
mov rsi, rcx
cmp rcx, rax
cmovb rsi, rax
lea rax, [rsi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x1800139b9
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x1800139c9
cmp rdx, 0x1000
jb 0x1800139f0
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003762c
test rax, rax
je 0x180013bb5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180013a05
test rdx, rdx
je 0x180013a02
mov rcx, rdx
call fcn.18003762c
mov rdi, rax
jmp 0x180013a05
mov rdi, r15
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call fcn.180039130
mov word [rbx + rdi], r15w
cmp r14, 8
jb 0x180013a63
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013a5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013b6d
call fcn.180037624
mov qword [rbp - 0x30], rdi
mov byte [rbp + 8], 1
mov dword [rsp + 0x6c], r15d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x74], r15d
mov dword [rsp + 0x70], r15d
cmp qword [r12 + 0x18], 8
jb 0x180013a8b
mov r12, qword [r12]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x6c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x180013af3
mov edx, dword [rsp + 0x68]
mov eax, edx
mov ecx, dword [rsp + 0x6c]
imul eax, ecx
mov dword [rbp - 0x10], eax
mov eax, dword [rsp + 0x70]
imul rax, rcx
imul rax, rdx
mov qword [rbp - 8], rax
mov eax, dword [rsp + 0x74]
imul rax, rcx
imul rax, rdx
mov qword [rbp], rax
jmp 0x180013af3
mov dword [rbp - 0x10], r15d
mov qword [rbp - 8], r15
mov qword [rbp], r15
mov byte [rbp + 8], 0
lea rdx, [rbp - 0x70]
mov rcx, r13
call fcn.1800077b0
lea rcx, [r13 + 0x20]
lea rdx, [rbp - 0x50]
call fcn.1800077b0
lea rcx, [r13 + 0x40]
lea rdx, [rbp - 0x30]
call fcn.1800077b0
mov eax, dword [rbp - 0x10]
mov dword [r13 + 0x60], eax
mov rax, qword [rbp - 8]
mov qword [r13 + 0x68], rax
mov rax, qword [rbp]
mov qword [r13 + 0x70], rax
movzx eax, byte [rbp + 8]
mov byte [r13 + 0x78], al
lea rcx, [rbp - 0x70]
call fcn.180013bc0
mov al, 1
mov rcx, qword [rbp + 0x6f0]
xor rcx, rsp
call fcn.180037600
mov rbx, qword [rsp + 0x850]
add rsp, 0x800
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180042954
nop
call fcn.180001eb0
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180042954
nop
call fcn.180001eb0
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180001eb0
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180001eb0
int3
call fcn.180042954
int3