Function at 0x1400fa3c0
Capabilities:
Enumerate disk volumes
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
mov eax, 0x1c4f0
call fcn.1401da720
sub rsp, rax
mov qword [rsp + 0x1c4e0], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0x1c4e8], rax
mov dword [rsp + 0x184a4], 0
movzx eax, word [0x14021e11c]
mov word [rsp + 0x18080], ax
lea rdi, [rsp + 0x18082]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x1806c], 0
mov qword [rsp + 0x184a8], 0xffffffffffffffff
mov dword [rsp + 0x18060], 0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x184a0], 0
movzx eax, word [0x14021e38c]
mov word [rsp + 0x18290], ax
lea rdi, [rsp + 0x18292]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x184b0], 0
jmp 0x1400fa494
mov eax, dword [rsp + 0x184b0]
add eax, 1
mov dword [rsp + 0x184b0], eax
cmp dword [rsp + 0x184b0], 0x10
jge 0x1400fa4b8
movsxd rcx, dword [rsp + 0x184b0]
mov rax, qword [rsp + 0x1c508]
mov qword [rax + rcx*8], 0xffffffffffffffff
jmp 0x1400fa483
lea rcx, [rsp + 0x48]
call fcn.140002de0
nop
mov r8d, dword [rsp + 0x1c500]
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0x48]
call fcn.140002c70
lea rcx, [rsp + 0x48]
call fcn.14000f8f0
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
mov rcx, rax
call fcn.1400fa1a0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x18068], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x18068]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18000
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70050
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rsp + 0x18070], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x18070], 0
je 0x1400fa56d
cmp dword [rsp + 0x64], 0
jne 0x1400fa58e
mov dword [rsp + 0x1c4d4], 1
lea rcx, [rsp + 0x48]
call fcn.140001490
mov eax, dword [rsp + 0x1c4d4]
jmp 0x1400fa8af
mov dword [rsp + 0x18064], 0
mov dword [rsp + 0x184b4], 0
jmp 0x1400fa5b7
mov eax, dword [rsp + 0x184b4]
add eax, 1
mov dword [rsp + 0x184b4], eax
cmp dword [rsp + 0x184b4], 1
jge 0x1400fa884
cmp dword [rsp + 0x18064], 0
jle 0x1400fa5d4
jmp 0x1400fa884
mov edx, 0x104
lea rcx, [rsp + 0x18290]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov qword [rsp + 0x184a8], rax
cmp qword [rsp + 0x184a8], 0xffffffffffffffff
jne 0x1400fa61b
mov dword [rsp + 0x1c4d8], 0
lea rcx, [rsp + 0x48]
call fcn.140001490
mov eax, dword [rsp + 0x1c4d8]
jmp 0x1400fa8af
lea rcx, [rsp + 0x18290]
call fcn.1400a8944
sub rax, 1
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x18290]
cmp eax, 0x5c
jne 0x1400fa677
movzx eax, word [rsp + 0x18292]
cmp eax, 0x5c
jne 0x1400fa677
movzx eax, word [rsp + 0x18294]
cmp eax, 0x3f
jne 0x1400fa677
movzx eax, word [rsp + 0x18296]
cmp eax, 0x5c
jne 0x1400fa677
mov rax, qword [rsp + 0x50]
movzx eax, word [rsp + rax*2 + 0x18290]
cmp eax, 0x5c
je 0x1400fa69b
mov dword [rsp + 0x1806c], 0xa1
lea rdx, [rsp + 0x18290]
lea rcx, str.FindFirstVolumeW_FindNextVolumeW_returned_a_bad_path:__s_n
call fcn.1400ae410
jmp 0x1400fa806
xor ecx, ecx
mov rax, qword [rsp + 0x50]
mov word [rsp + rax*2 + 0x18290], cx
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, [rsp + 0x18290]
call fcn.1400fa1a0
mov qword [rsp + 0x184b8], rax
cmp qword [rsp + 0x184b8], 0xffffffffffffffff
jne 0x1400fa6dd
jmp 0x1400fa806
mov dword [rsp + 0x1c4d0], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x1c4d0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4000
lea rax, [rsp + 0x184d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x560000
mov rcx, qword [rsp + 0x184b8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400fa743
mov rcx, qword [rsp + 0x184b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400fa806
mov dword [rsp + 0x184c0], 0
mov dword [rsp + 0x184c0], 0
jmp 0x1400fa76c
mov eax, dword [rsp + 0x184c0]
add eax, 1
mov dword [rsp + 0x184c0], eax
mov eax, dword [rsp + 0x184d0]
cmp dword [rsp + 0x184c0], eax
jae 0x1400fa7f8
movsxd rax, dword [rsp + 0x184c0]
imul rax, rax, 0x18
mov eax, dword [rsp + rax + 0x184d8]
cmp dword [rsp + 0x1c500], eax
jne 0x1400fa7f3
mov eax, dword [rsp + 0x1c500]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x18290]
mov r8d, dword [rsp + 0x18064]
lea rdx, str.Volume__d_name_is__s_on_disk__d
mov ecx, 1
call fcn.1400dcf70
movsxd rdx, dword [rsp + 0x18064]
mov rcx, qword [rsp + 0x1c508]
mov rax, qword [rsp + 0x184b8]
mov qword [rcx + rdx*8], rax
mov eax, dword [rsp + 0x18064]
add eax, 1
mov dword [rsp + 0x18064], eax
jmp 0x1400fa806
jmp 0x1400fa75b
mov rcx, qword [rsp + 0x184b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rsp + 0x18290]
mov rcx, qword [rsp + 0x184a8]
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov dword [rsp + 0x184a0], eax
cmp dword [rsp + 0x184a0], 0
jne 0x1400fa86c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1806c], eax
cmp dword [rsp + 0x1806c], 0x12
je 0x1400fa85f
mov edx, dword [rsp + 0x1806c]
lea rcx, str.FindNextVolumeW_failed_with_error_code__d_n
call fcn.1400ae410
jmp 0x1400fa871
mov dword [rsp + 0x1806c], 0
jmp 0x1400fa871
jmp 0x1400fa61b
mov rcx, qword [rsp + 0x184a8]
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
jmp 0x1400fa5a6
mov qword [rsp + 0x184a8], 0xffffffffffffffff
mov eax, dword [rsp + 0x18064]
mov dword [rsp + 0x1c4dc], eax
lea rcx, [rsp + 0x48]
call fcn.140001490
mov eax, dword [rsp + 0x1c4dc]
mov rcx, qword [rsp + 0x1c4e8]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0x1c4f0
pop rdi
ret