Function at 0x14000e583
Capabilities:
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2f8
lea r13, str.NO_LABEL
movabs rax, 0x726f7475615c3a23
mov qword [rsp + 0x55], rax
mov esi, ecx
mov ecx, 0x20a
mov r12, rdx
movabs rax, 0x666e692e6e7572
mov qword [r8], r13
mov rbp, r8
lea rdi, [rsp + 0xe6]
mov qword [rsp + 0x5c], rax
xor eax, eax
rep stosb byte [rdi], al
mov ecx, esi
mov dword [rsp + 0x51], 0x5c3a23
lea rdi, [rsp + 0xe6]
call fcn.14000e2e1
test eax, eax
je 0x14000e8e6
mov al, byte [r12]
lea r14, [rsp + 0x64]
test al, al
jne 0x14000e6bb
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov ecx, esi
call fcn.14000dce7
mov dword [rsp + 0x38], 0x40
lea r9, [rsp + 0x44]
mov r8d, 0x40
mov rbx, rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], r14
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_GetVolumeInformationByHandleW]
test eax, eax
je 0x14000e69f
xor r11d, r11d
lea rsi, [0x1400fab00]
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], 0x105
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
cmp byte [0x1400fab00], 0
cmove rsi, r13
mov qword [rbp], rsi
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000e8be
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14000e8be
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov ecx, esi
mov byte [rsp + 0x55], al
mov byte [rsp + 0x51], al
call fcn.14000c911
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
mov qword [rsp + 0x38], r8
mov rdi, rax
xor r8d, r8d
mov edx, 0x2d4800
mov dword [rsp + 0x28], r9d
mov rcx, rax
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x14000e729
lea rdx, [rsp + 0x55]
mov r8d, 1
lea rcx, str.label
call fcn.14002284a
mov rbx, rax
jmp 0x14000e74f
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x15
jne 0x14000e74d
movsx ecx, byte [r12]
call qword [sym.imp.msvcrt.dll_toupper]
lea rcx, str.Ignoring_autorun.inf_label_for_drive__c:_No_media
mov edx, eax
call fcn.140036717
xor ebx, ebx
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000e762
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rbx, rbx
je 0x14000e7e1
movsx ecx, byte [r12]
lea r12, [0x1400fab00]
mov rsi, rbx
call qword [sym.imp.msvcrt.dll_toupper]
mov r8, rbx
lea rcx, str.Using_autorun.inf_label_for_drive__c:__s
mov rdi, r12
mov edx, eax
call fcn.140036717
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rcx, [rax + 1]
mov eax, 0x105
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rdx, [r12 + 0x104]
lea rcx, [rax + 1]
cmp rcx, 0x104
ja 0x14000e7cd
lea rdx, [r12 + rax]
mov byte [rdx], 0
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [rbp], r12
jmp 0x14000e8be
lea rcx, [rsp + 0x51]
call fcn.14000bdc9
mov edx, 2
mov ecx, 0x105
mov r14, rax
call sub.msvcrt.dll_calloc
xor ecx, ecx
xor edx, edx
xor r9d, r9d
mov dword [rsp + 0x38], edx
mov r8d, 0x105
mov rdx, rax
mov rdi, rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov r15, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r12d, eax
call r15
mov ebx, eax
test r12d, r12d
je 0x14000e880
xor eax, eax
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], 0x105
mov qword [rsp + 0x38], rax
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
lea rax, [0x1400fab00]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
test eax, eax
jne 0x14000e880
call r15
xor r12d, r12d
mov ebx, eax
test rdi, rdi
je 0x14000e88d
mov rcx, rdi
call sub.msvcrt.dll_free
test r14, r14
je 0x14000e89a
mov rcx, r14
call sub.msvcrt.dll_free
mov ecx, ebx
mov rbx, qword [sym.imp.KERNEL32.DLL_SetLastError]
call rbx
test r12d, r12d
je 0x14000e8c5
cmp byte [0x1400fab00], 0
je 0x14000e8c5
lea rax, [0x1400fab00]
mov qword [rbp], rax
mov eax, 1
jmp 0x14000e8e6
call r15
xor edx, edx
mov ecx, esi
mov edi, eax
call fcn.140016c17
mov qword [rbp], rax
test rax, rax
jne 0x14000e8be
mov ecx, edi
call rbx
mov qword [rbp], r13
jmp 0x14000e8be
add rsp, 0x2f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret