Function at 0x180004ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push r12
sub rsp, 0x2d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor eax, eax
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x40], eax
test rdx, rdx
je 0x180004be3
lea rax, [rsp + 0x30]
test rax, rax
je 0x180004be3
lea r12, [rdx + 0x7f]
jmp 0x180004be8
mov r12, qword [rsp + 0x30]
cmp dword [r12 + 4], 0
jbe 0x180004bf7
xor eax, eax
jmp 0x180004e5e
lea rdx, str.FAT_RecognizeDrive:_Testing_drive_for_FAT_presence._n
mov qword [rsp + 0x300], rbp
call fcn.180016b80
lea r11, [rsp + 0x30]
mov ebp, 0x200
lea r9, [rsp + 0x80]
mov r8d, ebp
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r11
call fcn.180002c60
test eax, eax
je 0x180004fbf
cmp dword [rsp + 0x30], ebp
jne 0x180004fbf
lea rdx, [rsp + 0xb6]
lea rcx, [rsp + 0x280]
mov r8d, 9
mov qword [rsp + 0x2c8], rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
lea rdx, [rsp + 0xd2]
lea rcx, [rsp + 0x290]
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
lea rdx, [0x18003eda0]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180004cb4
lea rdx, str.FAT_RecognizeDrive:_Found_bootsector_signature_for_FAT12._n
mov rcx, rbx
call fcn.180016b80
mov edi, 4
mov dword [rsp + 0x40], edi
jmp 0x180004d1c
lea rdx, [0x18003edf0]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180004ce7
lea rdx, str.FAT_RecognizeDrive:_Found_bootsector_signature_for_FAT16._n
mov rcx, rbx
call fcn.180016b80
mov edi, 5
mov dword [rsp + 0x40], edi
jmp 0x180004d1c
lea rdx, [0x18003ee40]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180004f9a
lea rdx, str.FAT_RecognizeDrive:_Found_bootsector_signature_for_FAT32._n
mov rcx, rbx
call fcn.180016b80
mov edi, 6
mov dword [rsp + 0x40], edi
test rsi, rsi
je 0x180004f79
lea rax, [rsp + 0x70]
test rax, rax
je 0x180004f79
mov qword [rsp + 0x2c0], r13
movsx r13d, word [rsp + 0x8b]
mov qword [rsp + 0x2b8], r14
mov r14, qword [rsi + 0x18]
mov qword [rsp + 0x2b0], r15
sub r14, qword [rsi + 0x28]
mov dword [r12], r13d
movzx eax, byte [rsp + 0x8d]
movzx r15d, word [rsp + 0x8e]
imul r13d, eax
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0x90]
mov dword [rsp + 0x44], r13d
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x50], eax
movzx eax, word [rsp + 0x91]
mov dword [rsp + 0x58], eax
test eax, eax
jne 0x180004dc0
mov r8d, 0x10000
cmp edi, 6
lea rdx, str.FAT_RecognizeDrive:_Root_directory_entries_count___d._n
cmovne r8d, ebp
mov rcx, rbx
mov dword [rsp + 0x58], r8d
call fcn.180016b80
movzx eax, word [rsp + 0x96]
test ax, ax
je 0x180004df8
movzx ebp, ax
lea rdx, str.FAT_RecognizeDrive:_Sectors_per_fat:__d._n
mov rcx, rbx
mov r8d, ebp
mov dword [rsp + 0x54], ebp
call fcn.180016b80
cmp edi, 6
je 0x180004e1a
mov dword [rsp + 0x60], 0
jmp 0x180004e96
mov ebp, dword [rsp + 0xa4]
lea rdx, str.FAT_RecognizeDrive:_Sectors_per_fat:__d._n
mov rcx, rbx
mov r8d, ebp
mov dword [rsp + 0x54], ebp
call fcn.180016b80
cmp edi, 6
je 0x180004e7a
lea rdx, str.FAT_RecognizeDrive:_Incompatible_bootsector_field_values._n
mov rcx, rbx
call fcn.180016b80
mov ecx, 0x20000006
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov r14, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x2c0]
mov r15, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x2c8]
mov rbp, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.18002d590
add rsp, 0x2d0
pop r12
pop rsi
pop rbx
ret
mov r8d, dword [rsp + 0xac]
lea rdx, str.FAT_RecognizeDrive:_Root_dir_start_cluster:__d._n
mov rcx, rbx
mov dword [rsp + 0x60], r8d
call fcn.180016b80
mov r12d, dword [r12]
xor edx, edx
mov r8d, 0x1000
mov edi, r12d
imul edi, ebp
imul ebp, dword [rsp + 0x50]
mov dword [rsp + 0x5c], edi
lea ecx, [r15 + rbp]
imul ecx, r12d
imul r12, r15
sub r14, rcx
mov ecx, r13d
mov rax, r14
div rcx
xor ecx, ecx
mov edx, edi
add eax, 2
lea r9d, [rcx + 4]
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x180004ef3
mov dword [rbx], 0x20000008
jmp 0x180004e36
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8d, edi
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov rdx, r12
call fcn.180002c60
test eax, eax
je 0x180004f5d
cmp dword [rsp + 0x30], edi
jne 0x180004f5d
lea r8, [rsp + 0x40]
mov edx, 0x30
mov rcx, rsi
call fcn.180001ca0
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x38]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdx, str.FAT_RecognizeDrive:_Success._n
mov rcx, rbx
call fcn.180016b80
mov eax, 1
jmp 0x180004e36
lea rdx, str.FAT_RecognizeDrive:_Unable_to_allocate_memory_for_examined_clusters_map._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x20000007
xor eax, eax
jmp 0x180004e36
lea rdx, str.FAT_RecognizeDrive:_Unable_to_get_drive_size._n
mov rcx, rbx
call fcn.180016b80
mov ecx, 0x20000012
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180004e4e
lea rdx, str.FAT_RecognizeDrive:_Not_found_FAT_signature_in_the_bootsector._n
mov rcx, rbx
call fcn.180016b80
lea rdx, str.FAT_RecognizeDrive:_Fail._n
mov rcx, rbx
call fcn.180016b80
xor eax, eax
jmp 0x180004e4e
xor eax, eax
jmp 0x180004e56