Function at 0x1400307b4
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r14, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rax + 0x10], r12d
mov qword [rax - 0x58], r12
mov dword [rax + 0x20], r12d
mov qword [rdx], r12
lea r8, str.CVdsVolume::QueryAccessPathsToVolume__
lea ebp, [r12 + 0x5e]
mov edx, ebp
lea rcx, [rax - 0x48]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64]
nop dword [rax + rax]
nop
lea r9, [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x88]
add rbx, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rbx
lea ebx, [rbp - 0x56]
mov edx, ebx
call qword [sym.imp.vdsutil.dll_VdsHeapAlloc]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400309b6
lea r9, [rsp + 0x98]
mov r8d, dword [rsp + 0x88]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
test eax, eax
jne 0x1400308c6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov r9d, eax
lea r8, str.CVdsVolume::QueryAccessPathsToVolume:_GetVolumePathNamesForVolumeName_failed:__X
xor edx, edx
mov ecx, ebp
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
jmp 0x1400309b6
mov rax, rsi
mov edi, r12d
cmp word [rsi], r12w
je 0x1400309b3
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1400308da
lea rax, [rax + rcx*2]
add rax, 2
inc edi
cmp word [rax], r12w
jne 0x1400308d6
test edi, edi
je 0x1400309b3
mov ebp, edi
shl rbp, 3
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [r14], rax
test rax, rax
je 0x1400309b6
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r13, rsi
mov r15d, r12d
test edi, edi
je 0x1400309a9
xor eax, eax
or rbp, 0xffffffffffffffff
inc rbp
cmp word [r13 + rbp*2], ax
jne 0x14003093a
lea rcx, [rbp*2 + 2]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [r14]
mov qword [r12 + rax], rcx
mov rcx, qword [r14]
mov rax, qword [r12 + rcx]
test rax, rax
je 0x140030a0d
lea rdx, [rbp + 1]
mov r9, rbp
mov r8, r13
mov rcx, rax
call fcn.14002642c
mov rax, qword [r14]
mov rcx, qword [r12 + rax]
xor eax, eax
mov word [rcx + rbp*2], ax
lea r13, [r13 + rbp*2]
add r13, 2
inc r15d
add r12, rbx
cmp r15d, edi
jb 0x140030936
xor r12d, r12d
mov rax, qword [rsp + 0x90]
mov dword [rax], edi
mov ebx, r12d
lea rcx, [rsp + 0x30]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
test rsi, rsi
je 0x1400309f2
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.vdsutil.dll_VdsHeapFree]
nop dword [rax + rax]
mov qword [rsp + 0x20], r12
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r12d, r12d
test r15d, r15d
je 0x140030a4c
mov edi, r12d
mov ebp, r15d
mov rax, rcx
mov rdx, qword [rdi + rax]
test rdx, rdx
je 0x140030a43
mov rcx, rdx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [r14]
mov qword [rdi + rax], r12
mov rax, qword [r14]
mov rcx, rax
add rdi, rbx
sub rbp, 1
jne 0x140030a1e
test rcx, rcx
je 0x1400309b6
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [r14], r12
jmp 0x1400309b6