Function at 0x140098f80
Capabilities:
Get disk information
Get disk size

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rsp + 0x180], rbx
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r15, rcx
mov qword [rsp + 0x50], rdx
lea r13, [0x14019cf50]
mov qword [rsp + 0x90], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsp + 0x50]
call fcn.14005b560
mov edx, 5
lea rcx, [rsp + 0x58]
call fcn.140063580
nop
mov edx, 0x14
lea rcx, [rsp + 0x60]
call fcn.140063580
nop
lea rcx, [rsp + 0x48]
call fcn.140063500
nop
mov r12b, 0xff
mov byte [rsp + 0x40], 0
mov rax, qword [rsp + 0x50]
cmp word [rax], 0x2d
jne 0x1400990fa
mov ebx, 9
lea edi, [rbx + 0x17]
nop
mov r8d, ebx
lea rdx, [rsp + 0x50]
lea rcx, str._userfree
call fcn.140065780
test al, al
je 0x140099050
xor r12b, r12b
jmp 0x1400990eb
mov r8d, 8
lea rdx, [rsp + 0x50]
lea rcx, str._userall
call fcn.140065780
test al, al
je 0x140099070
mov r12b, 1
jmp 0x1400990eb
mov r8d, 5
lea rdx, [rsp + 0x50]
lea rcx, str._free
call fcn.140065780
test al, al
je 0x140099090
mov r12b, 2
jmp 0x1400990eb
mov r8d, 4
lea rdx, [rsp + 0x50]
lea rcx, str._raw
call fcn.140065780
test al, al
je 0x1400990b2
mov byte [rsp + 0x40], 1
jmp 0x1400990eb
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx]
test ax, ax
je 0x1400990e1
nop
cmp bx, ax
ja 0x1400990cb
cmp ax, 0xd
jbe 0x1400990dc
cmp di, ax
je 0x1400990dc
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x1400990c0
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
call fcn.14005b560
mov rax, qword [rsp + 0x50]
cmp word [rax], 0x2d
je 0x140099030
mov edi, 0x3d
mov r8d, edi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140066780
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
xor ebp, ebp
mov qword [rsp + 0x60], rbp
cmp byte [r15 + 0xba], bpl
jne 0x140099157
test byte [r15 + 0xf], 0xf
jne 0x140099157
mov byte [rsp + 0x20], bpl
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, r15
call fcn.14006d6c0
nop
lea rcx, [rsp + 0x68]
call fcn.14005b520
jmp 0x14009919e
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, r15
call fcn.14006bc40
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x60], rbx
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rcx, r15
call fcn.14006bc40
nop
lea rcx, [rsp + 0x68]
call fcn.14005b520
mov rax, qword [rsp + 0x50]
cmp di, word [rax]
jne 0x1400991c6
add rax, 2
mov qword [rsp + 0x50], rax
mov r8d, 0x2c
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140066780
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rbp
call fcn.14002e004
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140071360
nop
lea rcx, [rsp + 0x68]
call fcn.14005b520
mov rdi, qword [rsp + 0x60]
mov rax, rdi
movzx ecx, word [rdi]
test cx, cx
je 0x140099237
cmp cx, 0x2c
je 0x140099216
add rax, 2
mov cx, word [rax]
test cx, cx
jne 0x140099202
jmp 0x140099237
mov word [rax], bp
add rax, 2
mov qword [rsp + 0x50], rax
mov r8d, 0x2c
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.140066780
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x48], rbp
cmp byte [r15 + 0xba], 0
jne 0x14009927c
test byte [r15 + 0xf], 0xf
jne 0x14009927c
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, r15
call fcn.14006d6c0
nop
lea rcx, [rsp + 0x68]
call fcn.14005b520
jmp 0x1400992c3
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, r15
call fcn.14006bc40
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x48]
mov rcx, r15
call fcn.14006bc40
nop
lea rcx, [rsp + 0x68]
call fcn.14005b520
mov rcx, rdi
call fcn.14002b47c
mov rbx, qword [rsp + 0x48]
cmp word [rdi], 0
jne 0x1400992dc
cmp word [rbx], 0
je 0x1400992e8
mov r9, qword [rsp + 0x58]
cmp word [r9], 0
jne 0x14009931c
lea rcx, [rsp + 0x48]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x14009972f
mov rdx, r9
lea rcx, [0x140140438]
call fcn.14005c550
test al, al
je 0x1400993a2
mov edx, 0xca
lea rcx, [rsp + 0x48]
call fcn.1400635c0
mov rax, qword [rsp + 0x48]
mov word [rax], bp
mov edx, 0x7c
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8d, [rdx - 0x7b]
lea rcx, [rsp + 0x58]
call fcn.140069650
mov r8, qword [rsp + 0x58]
mov rdx, rdi
mov rcx, r15
call fcn.140061290
nop
lea rcx, [rsp + 0x48]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x14009972f
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea edx, [rax + 0x19]
lea rcx, [rsp + 0x58]
call fcn.1400635c0
test r12b, r12b
js 0x1400994f1
mov rcx, qword [rsp + 0x58]
cmp esi, 1
jne 0x1400993eb
cmp word [rcx], 0x2e
je 0x140099404
mov eax, 0x3a
mov word [rcx + 2], ax
mov eax, 0x5c
mov word [rcx + 4], ax
mov word [rcx + 6], bp
jmp 0x140099404
cmp esi, 2
jne 0x140099404
cmp word [rcx + 2], 0x3a
jne 0x140099404
mov eax, 0x5c
mov word [rcx + 4], ax
mov word [rcx + 6], bp
lea rdx, [rsp + 0xa0]
mov eax, dword [0x140151b64]
mov dword [rdx], eax
movzx eax, word [0x140151b68]
mov word [rdx + 4], ax
xor eax, eax
mov qword [rsp + 0xa6], rax
mov qword [rsp + 0xae], rax
mov qword [rsp + 0xb6], rax
mov qword [rsp + 0xbe], rax
mov qword [rsp + 0xc6], rax
mov qword [rsp + 0xce], rax
mov qword [rsp + 0xd6], rax
mov word [rsp + 0xde], ax
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebx, eax
test eax, eax
je 0x1400994a7
movsx rdx, r12b
mov rdx, qword [rsp + rdx*8 + 0x70]
lea rcx, [rsp + 0xa0]
call fcn.140062c80
lea r8, [rsp + 0xa0]
mov rdx, rdi
mov rcx, r15
call fcn.140061290
test ebx, ebx
sete bpl
lea rcx, [rsp + 0x48]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebp
jmp 0x14009972f
lea rdx, str..C:
lea rcx, [rsp + 0x68]
call fcn.140071240
nop
mov r10, qword [rsp + 0x58]
movzx eax, word [r10]
mov rsi, qword [rsp + 0x68]
mov word [rsi + 8], ax
mov word [rsi + 0xe], bp
mov word [rsi + 0xc], bp
or r14d, 0xffffffff
mov r12d, r14d
mov r13d, r14d
lea r8d, [r14 + 5]
mov rdx, r10
lea rcx, str.._
call fcn.14005c510
test al, al
jne 0x1400995d7
lea r8d, [r14 + 9]
mov rdx, r10
lea rcx, str.Device_
call fcn.14005c510
test al, al
jne 0x1400995d7
mov eax, 0x3a
mov word [r10 + 2], ax
mov word [r10 + 6], bp
mov word [r10 + 4], bp
cmp word [rdi], 0
je 0x14009957f
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov r12d, eax
cmp word [rbx], 0
jne 0x1400995a3
movzx ebp, byte [rsp + 0x40]
test bpl, bpl
jne 0x1400995b5
cmp r12d, 2
je 0x1400995a8
cmp r12d, 3
je 0x1400995a8
cmp r12d, 5
jne 0x1400995b5
jmp 0x1400995a8
mov bpl, byte [rsp + 0x40]
xor edx, edx
mov rcx, rsi
call fcn.1400653c0
mov r13d, eax
test bpl, bpl
cmove r14d, r13d
mov r8d, r14d
lea rdx, [rsp + 0xe0]
mov ecx, r12d
call fcn.14005f330
mov rsi, rax
jmp 0x140099669
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x20000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
cmove rsi, rbp
cmp word [rdi], 0
je 0x140099622
mov r8b, 1
xor edx, edx
mov rcx, rsi
call fcn.140068eb0
mov r12d, eax
cmp word [rbx], 0
je 0x140099635
mov rdx, rsi
xor ecx, ecx
call fcn.1400653c0
mov r13d, eax
test rsi, rsi
je 0x140099649
cmp rsi, 0xffffffffffffffff
je 0x140099649
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [rsp + 0xe0]
mov r8d, r12d
lea rdx, [0x140142b58]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.USER32.dll_wsprintfW]
cmp word [rdi], 0
je 0x14009967d
mov r8, rsi
mov rdx, rdi
mov rcx, r15
call fcn.140061290
cmp word [rbx], 0
je 0x1400996ae
mov r8d, r13d
lea rdx, [0x140142b58]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0xe0]
mov rdx, rbx
mov rcx, r15
call fcn.140061290
cmp word [rsi], 0
jne 0x1400996f4
lea rcx, [rsp + 0x68]
call fcn.14005b520
nop
lea rcx, [rsp + 0x48]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x14009972f
lea rcx, [rsp + 0x68]
call fcn.14005b520
nop
lea rcx, [rsp + 0x48]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x180]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret