Function at 0x140098228
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x158]
sub rsp, 0x220
mov qword [rbp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14015d3e0]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov byte [rsp + 0x30], r9b
mov r13, r8
mov r14, rdx
mov qword [rbp - 8], rdx
lea rbx, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rbx
lea rdi, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rdi
lea rsi, str.CORHIMPC
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], 0x831
mov dword [rsp + 0x64], 1
mov r12d, 0xff
mov dword [rsp + 0x68], r12d
xor r15d, r15d
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [r15 + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.1400bec34
nop
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], 0x835
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], r12d
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [r15 + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov r8d, 0x1a3
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.140002f20
mov r12d, r15d
cmp dword [r13], r15d
jbe 0x1400987c6
mov eax, r12d
lea rdi, [rax + rax*4]
add rdi, rdi
mov rsi, qword [r13 + 8]
mov rbx, qword [rsi + rdi*8 + 0x38]
test rbx, rbx
je 0x1400985b5
lea rax, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x83f
mov dword [rsp + 0x64], 6
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov r9, rbx
lea r8, str.INFO:_Attempting_to_create_a_Volume_Name_for_hidden_volume_device__s...
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.140009fb0
mov rcx, qword [rsi + rdi*8 + 0x38]
or r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400983cd
lea edx, [rax + 2]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp], rax
mov r9, qword [rsi + rdi*8 + 0x38]
mov rdx, r14
inc rdx
cmp word [r9 + rdx*2], r15w
jne 0x1400983f7
add rdx, 2
lea r8, [0x140106438]
mov rcx, rbx
call fcn.1400053e0
mov r14d, eax
mov dword [rbp + 0x18], eax
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x14009895d
mov r14d, 0x80
mov r8d, r14d
xor edx, edx
lea rcx, [rbp + 0x90]
call sub.msvcrt.dll_memset
lea r8d, [r14 - 0x40]
lea rdx, [rbp + 0x90]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
je 0x1400988d4
lea rcx, [rbp + 0x90]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x14009846b
cmp word [rbp + rax*2 + 0x8e], 0x5c
jne 0x14009849a
lea rax, [rax*2 - 2]
cmp rax, r14
jae 0x1400987fa
mov word [rbp + rax + 0x90], r15w
lea r14, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], r14
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x857
mov dword [rsp + 0x64], 6
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov rax, qword [rsi + rdi*8 + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x90]
lea r8, str.Found_volume_name__s_for_device__s
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.140009fb0
lea rax, [rbp + 0x90]
or r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp word [rax + rcx*2], r15w
jne 0x140098521
inc rcx
mov eax, 2
mul rcx
cmovo rax, r8
lea rdx, [0x1400fb65a]
mov rcx, rax
call fcn.1400169cc
mov r15, rax
xor ecx, ecx
test rax, rax
je 0x14009886c
lea rax, [rbp + 0x90]
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], cx
jne 0x140098562
inc rdx
lea r8, [rbp + 0x90]
mov rcx, r15
call fcn.14002d18c
mov r14d, eax
mov dword [rbp + 0x18], eax
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140098800
mov rcx, qword [rsi + rdi*8 + 0x38]
call fcn.140015ff8
mov qword [rsi + rdi*8 + 0x38], r15
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
mov r14, qword [rbp - 8]
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov rax, qword [r14]
lea r8, [rsp + 0x40]
mov edx, r12d
mov rcx, r14
mov rax, qword [rax + 0x70]
call qword [0x1400f7e80]
mov dword [rbp + 0x18], eax
lea rax, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x86c
mov ebx, 1
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rbx + 0x77]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r8, str.IVssSnapshotSetDescription::GetSnasphotDescription
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.140031318
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, qword [rsi + rdi*8 + 0x38]
mov rax, qword [rax + 0x88]
call qword [0x1400f7e80]
mov dword [rbp + 0x18], eax
lea rdi, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rdi
lea rsi, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rsi
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x86e
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rbx + 0x77]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r8, str.IVssSnapshotSetDescription::SetDeviceName
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.140031318
cmp byte [rsp + 0x30], r15b
je 0x1400987af
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rbp - 0x10]
mov rax, qword [rax + 0x40]
call qword [0x1400f7e80]
mov dword [rbp + 0x18], eax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rsi
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x874
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rbx + 0x77]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r8, str.IVssSnapshotDescription::GetAttributes
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.140031318
mov edx, dword [rbp - 0x10]
bts edx, 0x13
mov dword [rbp - 0x10], edx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1400f7e80]
mov dword [rbp + 0x18], eax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rsi
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x877
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rbx + 0x77]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r8, str.IVssSnapshotDescription::SetAttributes
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.140031318
nop
lea rcx, [rsp + 0x40]
call fcn.140026d78
add r12d, ebx
cmp r12d, dword [r13]
jb 0x14009833a
lea rcx, [rbp + 0x10]
call fcn.140009990
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1400164a0
mov rbx, qword [rsp + 0x260]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400167c8
nop
lea rax, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x862
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r9, str.StringCchPrintf
mov r8d, r14d
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.1400c2a9c
int3
mov qword [rsp + 0x48], r14
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x85c
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r9, str.cant_allocate_device_name
mov r8d, 0x8007000e
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.1400c2090
int3
lea rax, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x850
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14009893f
movzx eax, ax
or eax, 0x80070000
mov qword [rsp + 0x20], rbx
lea r9, str.GetVolumeNameForVolumeMountPoint__s_
mov r8d, eax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.1400c2a9c
int3
lea rax, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x849
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r9, str.StringCchPrintf
mov r8d, r14d
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.1400c2a9c
int3