Function at 0x100051514
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r15, r8
mov rbx, rcx
mov rsi, rdx
lea ebp, [r13 + 0x5e]
lea r8, [0x1000175e8]
lea rcx, [rax - 0x40]
mov edx, ebp
mov dword [rax + 0x20], r13d
mov dword [rax - 0x48], r13d
call sub.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64
lea r9, [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, dword [rsp + 0x88]
add rdi, rdi
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
lea edx, [rbp - 0x56]
mov rcx, rax
mov r8, rdi
call sub.vdsutil.dll_void____ptr64___cdecl_VdsHeapAlloc_void____ptr64__unsigned_long_int__unsigned_long_long_unsigned___int64__
mov r12, rax
cmp rax, r13
jne 0x1000515ae
lea rcx, [rsp + 0x28]
call sub.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64
lea eax, [rbp - 0x56]
jmp 0x1000516e3
mov r8d, dword [rsp + 0x88]
lea r9, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
cmp eax, r13d
jne 0x1000515ec
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
lea r8, [0x100017610]
xor edx, edx
mov r9d, eax
mov ecx, ebp
mov edi, eax
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char____ptr64_
jmp 0x1000516c4
mov rdx, r12
mov ebx, r13d
cmp word [r12], r13w
je 0x1000516c1
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
inc ebx
not rcx
lea rdx, [rdx + rcx*2]
cmp word [rdx], r13w
jne 0x1000515fd
cmp ebx, r13d
je 0x1000516c1
mov edi, ebx
shl rdi, 3
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rsi], rax
cmp rax, r13
jne 0x100051642
mov edi, 8
jmp 0x1000516c4
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r14, r12
mov ebp, r13d
cmp ebx, r13d
jbe 0x1000516be
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdx, qword [rsi]
mov qword [r13 + rdx], rax
mov rcx, qword [rsi]
xor eax, eax
cmp qword [r13 + rcx], rax
je 0x100051701
mov rcx, qword [r13 + rcx]
lea rdx, [rdi + 1]
mov r9, rdi
mov r8, r14
call fcn.100048eb0
mov rdx, qword [rsi]
xor ecx, ecx
mov rax, qword [r13 + rdx]
inc ebp
add r13, 8
mov word [rax + rdi*2], cx
lea r14, [r14 + rdi*2 + 2]
cmp ebp, ebx
jb 0x10005165a
xor r13d, r13d
mov dword [r15], ebx
mov edi, r13d
lea rcx, [rsp + 0x28]
call sub.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
mov r8, r12
mov rcx, rax
xor edx, edx
call sub.vdsutil.dll_int___cdecl_VdsHeapFree_void____ptr64__unsigned_long_int__void____ptr64_
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r13d, r13d
cmp ebp, r13d
jbe 0x100051732
mov rdi, r13
mov ebx, ebp
mov rcx, qword [rsi]
cmp qword [rdi + rcx], r13
je 0x100051728
mov rcx, qword [rdi + rcx]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsi]
mov qword [rdi + rdx], r13
add rdi, 8
sub rbx, 1
jne 0x10005170e
mov rcx, qword [rsi]
cmp rcx, r13
je 0x100051638
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsi], r13
jmp 0x100051638