Function at 0x100045334
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebp, ebp
mov rax, r8
mov rbx, rdx
mov qword [rsp + 0x58], rdx
mov r14, rcx
mov qword [rsp + 0x50], rax
mov r13d, ebp
mov dword [rsp + 0x38], ebp
mov r12d, ebp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x34], bp
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000453c3
bt dword [rcx + 0x1c], 9
jae 0x1000453c3
cmp byte [rcx + 0x19], 4
jb 0x1000453c3
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x36]
lea r8, [0x100003cf8]
call fcn.10001c7b8
mov rax, qword [rsp + 0x50]
mov dil, bpl
mov byte [rsp + 0x30], bpl
mov r15d, 1
cmp rbx, rbp
jne 0x1000454a9
mov ebx, 0x80004003
lea r14, [0x1001653b8]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.1001449c4
mov rax, qword [rsp + 0x48]
cmp rax, rbp
je 0x100045408
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp ebx, ebp
jge 0x10004543c
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x10004546a
test byte [rcx + 0x1c], r15b
je 0x100045443
cmp byte [rcx + 0x19], 2
jb 0x100045443
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cf8]
mov edx, 0x40
mov r9d, ebx
call fcn.10001c7dc
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x10004546a
bt dword [rcx + 0x1c], 9
jae 0x10004546a
cmp byte [rcx + 0x19], 4
jb 0x10004546a
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cf8]
mov edx, 0x41
call fcn.10001c7b8
cmp dil, bpl
je 0x10004547c
lea rcx, [0x1001665a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10014e480
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbx], ebp
cmp rax, rbp
je 0x1000453da
mov rcx, r14
mov qword [rax], rbp
call fcn.10005921c
cmp eax, ebp
mov ebx, eax
jl 0x1000453df
test byte [0x100166664], r15b
je 0x100045509
lea rcx, [0x100000000]
lea rax, [rcx + 0x166a30]
lea rcx, [rcx + 0x1fe0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x1000454fd
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x1000454fd
mov eax, ebp
jmp 0x100045502
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x100045509
mov bpl, r15b
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x48]
call fcn.1000a0ba4
xor ebx, ebx
cmp eax, ebx
jge 0x10004554c
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10004554c
test byte [rcx + 0x1c], r15b
je 0x10004554c
cmp byte [rcx + 0x19], 3
jb 0x10004554c
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x37]
lea r8, [0x100003cf8]
mov r9d, eax
call fcn.10001c7dc
mov edi, 0x104
lea rcx, [rsp + 0x60]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1000455b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10004559e
test byte [rcx + 0x1c], 1
je 0x10004559e
cmp byte [rcx + 0x19], 2
jb 0x10004559e
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x39]
lea r8, [0x100003cf8]
mov r9d, eax
call fcn.10001c7dc
movzx ebx, di
xor ebp, ebp
or ebx, 0x80070000
cmp edi, ebp
cmovle ebx, edi
jmp 0x100045923
mov esi, 1
lea rdx, [rsp + 0x60]
mov r8d, edi
mov rcx, r15
add r13d, esi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, ebx
jne 0x1000455b8
mov dword [rsp + 0x38], r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
jne 0x100045a15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov r15d, esi
cmp bpl, bl
je 0x1000455ff
add r13d, esi
mov dword [rsp + 0x38], r13d
mov ebx, r13d
imul rbx, rbx, 0x78
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
xor edi, edi
mov rsi, rax
mov qword [rsp + 0x40], rax
cmp rax, rdi
jne 0x10004562a
mov ebx, 0x8007000e
xor ebp, ebp
jmp 0x1000453df
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
cmp bpl, dil
je 0x10004573d
xor ebp, ebp
cmp r13d, ebp
ja 0x10004565f
lea r8, [0x100005fb8]
lea rcx, [0x100005eb0]
mov edx, 0x39e
call fcn.100099ad8
lea rcx, [0x1001665a0]
mov bl, bpl
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [r14 + 0x68]
mov dil, r15b
cmp rcx, rbp
je 0x1000456d7
mov rdx, rsi
call fcn.100145114
cmp eax, ebp
mov ebx, eax
jge 0x1000456d1
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x1000453e6
test byte [rcx + 0x1c], r15b
je 0x1000453e6
cmp byte [rcx + 0x19], 2
jb 0x1000453e6
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cf8]
mov edx, 0x3a
mov r9d, eax
call fcn.10001c7dc
jmp 0x1000453e6
mov r12d, r15d
mov bl, r15b
lea rcx, [0x1001665a0]
mov byte [rsp + 0x30], bpl
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp bl, bpl
jne 0x10004573f
mov r8, rsi
mov dl, r15b
xor ecx, ecx
call fcn.10005199c
cmp eax, ebp
jge 0x100045738
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x100045746
test byte [rcx + 0x1c], r15b
je 0x100045746
cmp byte [rcx + 0x19], 3
jb 0x100045746
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cf8]
mov edx, 0x3b
mov r9d, eax
call fcn.10001c7dc
jmp 0x100045746
add r12d, r15d
jmp 0x10004573f
xor ebp, ebp
lea r14, [0x1001653b8]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1000457a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x100045796
test byte [rcx + 0x1c], 1
je 0x100045796
cmp byte [rcx + 0x19], 2
jb 0x100045796
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x3d]
lea r8, [0x100003cf8]
mov r9d, eax
call fcn.10001c7dc
movzx ebx, di
or ebx, 0x80070000
cmp edi, ebp
cmovle ebx, edi
jmp 0x10004592a
movzx r14d, word [rsp + 0x34]
movsxd rbp, r12d
imul rbp, rbp, 0x78
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor edx, edx
cmp eax, 3
lea eax, [rdx + 1]
movzx ecx, dl
cmove ecx, eax
mov ebx, edx
cmp cl, dl
je 0x1000458ce
cmp r12d, r13d
jb 0x10004582d
lea ebx, [r13 + 8]
mov rcx, rsi
mov edx, ebx
imul rdx, rdx, 0x78
call qword [sym.imp.ole32.dll_CoTaskMemRealloc]
mov rsi, rax
test rax, rax
je 0x100045949
mov r8d, ebx
mov ecx, r13d
xor edx, edx
sub r8d, r13d
imul rcx, rcx, 0x78
add rcx, rax
imul r8, r8, 0x78
call sub.msvcrt.dll_memset
mov r13d, ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x40], rsi
cmp r12d, ebx
jae 0x10004591c
lea rdi, [rsi + rbp]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8, rdi
call fcn.10005199c
xor ecx, ecx
cmp eax, ecx
mov ebx, eax
jge 0x100045899
cmp eax, 0x8007000e
je 0x100045921
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100045895
bt dword [rcx + 0x1c], 9
jae 0x100045895
cmp byte [rcx + 0x19], 3
jb 0x100045895
mov rcx, qword [rcx + 0x10]
lea rax, [rsp + 0x60]
lea r8, [0x100003cf8]
mov edx, 0x3d
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.10001d8f8
xor ebx, ebx
jmp 0x1000458ce
mov rax, qword [rsp + 0x48]
cmp rax, rcx
je 0x1000458c7
mov rdx, qword [rdi + 0x60]
cmp rdx, rcx
je 0x1000458c7
cmp r14w, word [rdi + 0x5c]
jne 0x1000458c7
movzx r8d, r14w
mov rcx, rax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1000458c7
or dword [rdi + 0x58], 2
inc r12d
add rbp, 0x78
lea rdx, [rsp + 0x60]
mov r8d, 0x104
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x1000457b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
jne 0x1000459cc
xor ebp, ebp
cmp r12d, ebp
jne 0x100045950
cmp rsi, rbp
je 0x10004599a
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, rbp
jmp 0x1000459b2
mov ebx, 0x8000ffff
xor ebp, ebp
lea r14, [0x1001653b8]
cmp r15, 0xffffffffffffffff
je 0x100045939
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov dil, byte [rsp + 0x30]
mov r15d, 1
jmp 0x1000453e6
mov ebx, 0x8007000e
jmp 0x100045921
cmp r12d, r13d
jbe 0x10004599a
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x100045993
mov eax, 1
test byte [rcx + 0x1c], al
je 0x100045993
cmp byte [rcx + 0x19], 2
jb 0x100045993
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x3e]
lea r8, [0x100003cf8]
mov r9d, r12d
mov dword [rsp + 0x20], r13d
call fcn.10001e8b4
mov ebx, 0x8000ffff
jmp 0x10004592a
xor r8d, r8d
mov edx, r12d
mov rcx, rsi
call fcn.10011d56c
cmp eax, ebp
mov ebx, eax
jl 0x100045923
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rbp
mov dword [rax], r12d
mov rax, qword [rsp + 0x50]
mov qword [rax], rsi
jmp 0x100045923
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x100045a05
mov eax, 1
test byte [rcx + 0x1c], al
je 0x100045a05
cmp byte [rcx + 0x19], 2
jb 0x100045a05
lea edx, [rax + 0x3d]
mov r9d, edi
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cf8]
call fcn.10001c7dc
movzx ebx, di
or ebx, 0x80070000
xor ebp, ebp
jmp 0x10004579f
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x100045a05
test byte [rcx + 0x1c], sil
je 0x100045a05
cmp byte [rcx + 0x19], 2
jb 0x100045a05
mov edx, 0x39
mov r9d, eax
jmp 0x1000459f5