Function at 0x140001a80
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x670
mov rax, qword [0x140016020]
xor rax, rsp
mov qword [rsp + 0x660], rax
xor r14d, r14d
mov rsi, rcx
mov edi, r14d
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x140001ae4
nop dword [rax]
movsxd rax, ebx
cmp word [rsi + rax*2], 0x5c
jne 0x140001ad1
inc edi
cmp edi, 3
je 0x140001ae2
mov rcx, rsi
inc ebx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp ebx, eax
jl 0x140001ac0
jmp 0x140001ae4
mov edi, ebx
movsxd rax, edi
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov word [rsi + rax*2], r14w
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140001b1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.FindFirstVolumeW_failed_with_error_code__d_n
call fcn.140001020
jmp 0x140001c33
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140001b30
dec rax
cmp word [rsp + 0x30], 0x5c
jne 0x140001c19
nop dword [rax]
cmp word [rsp + 0x32], 0x5c
jne 0x140001c19
cmp word [rsp + 0x34], 0x3f
jne 0x140001c19
cmp word [rsp + 0x36], 0x5c
jne 0x140001c19
add rax, rax
lea rbx, [rsp + 0x30]
add rbx, rax
cmp word [rbx], 0x5c
jne 0x140001c19
cmp rax, 0x208
jae 0x140001d14
mov r8d, 0x64
mov word [rbx], r14w
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov dword [rsp + 0x20], eax
test eax, eax
je 0x140001ce7
mov rdx, rsi
lea rcx, [rsp + 0x450]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001c76
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
je 0x140001c5d
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140001c00
dec rax
cmp word [rsp + 0x30], 0x5c
je 0x140001b50
lea rdx, [rsp + 0x30]
lea rcx, str.FindFirstVolumeW_FindNextVolumeW_returned_a_bad_path:__s_n
call fcn.140001020
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor eax, eax
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.14000e7e0
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x12
je 0x140001c2a
lea rcx, str.FindNextVolumeW_failed_with_error_code__d_n
jmp 0x140001cf6
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x240]
mov word [rbx], 0x5c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x140001cab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetVolumePathNamesForVolumeNameW_failed_with_error_code__d_n
jmp 0x140001cf4
lea eax, [rdi + 1]
movsxd rdx, eax
lea rcx, [rsp + 0x240]
lea rdx, [rsi + rdx*2]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x240]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov eax, 1
jmp 0x140001c35
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.QueryDosDeviceW_failed_with_error_code__d_n
mov ebx, eax
mov edx, eax
call fcn.140001020
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
test ebx, ebx
sete r14b
mov eax, r14d
jmp 0x140001c35
call fcn.14000e908
int3