Function at 0x140024d54
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r14, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rax + 0x10], r12d
mov qword [rax - 0x58], r12
mov dword [rax + 0x20], r12d
mov qword [rdx], r12
lea r8, str.CVdsVolume::QueryAccessPathsToVolume__
lea ebp, [r12 + 0x5e]
mov edx, ebp
lea rcx, [rax - 0x48]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64]
nop
lea r9, [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, dword [rsp + 0x88]
add rbx, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
lea ebx, [rbp - 0x56]
mov edx, ebx
call qword [sym.imp.vdsutil.dll_VdsHeapAlloc]
mov rsi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140024f1a
lea r9, [rsp + 0x98]
mov r8d, dword [rsp + 0x88]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x140024e36
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov r9d, eax
lea r8, str.CVdsVolume::QueryAccessPathsToVolume:_GetVolumePathNamesForVolumeName_failed:__X
xor edx, edx
mov ecx, ebp
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
jmp 0x140024f1a
mov rax, rsi
mov edi, r12d
cmp word [rsi], r12w
je 0x140024f17
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x140024e4a
lea rax, [rax + rcx*2]
add rax, 2
inc edi
cmp word [rax], r12w
jne 0x140024e46
test edi, edi
je 0x140024f17
mov ebp, edi
shl rbp, 3
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [r14], rax
test rax, rax
je 0x140024f1a
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r13, rsi
mov r15d, r12d
test edi, edi
je 0x140024f0d
xor eax, eax
or rbp, 0xffffffffffffffff
inc rbp
cmp word [r13 + rbp*2], ax
jne 0x140024ea4
lea rcx, [rbp*2 + 2]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rcx, rax
mov rax, qword [r14]
mov qword [r12 + rax], rcx
mov rcx, qword [r14]
mov rax, qword [r12 + rcx]
test rax, rax
je 0x140024f5e
lea rdx, [rbp + 1]
mov r9, rbp
mov r8, r13
mov rcx, rax
call fcn.14001bfcc
mov rax, qword [r14]
mov rcx, qword [r12 + rax]
xor eax, eax
mov word [rcx + rbp*2], ax
lea r13, [r13 + rbp*2]
add r13, 2
inc r15d
add r12, rbx
cmp r15d, edi
jb 0x140024ea0
xor r12d, r12d
mov rax, qword [rsp + 0x90]
mov dword [rax], edi
mov ebx, r12d
lea rcx, [rsp + 0x30]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop
test rsi, rsi
je 0x140024f44
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.vdsutil.dll_VdsHeapFree]
mov qword [rsp + 0x20], r12
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r12d, r12d
test r15d, r15d
je 0x140024f97
mov edi, r12d
mov ebp, r15d
mov rax, rcx
mov rdx, qword [rdi + rax]
test rdx, rdx
je 0x140024f8e
mov rcx, rdx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [r14]
mov qword [rdi + rax], r12
mov rax, qword [r14]
mov rcx, rax
add rdi, rbx
sub rbp, 1
jne 0x140024f6f
test rcx, rcx
je 0x140024f1a
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [r14], r12
jmp 0x140024f1a