Function at 0x1400d13e4
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x558]
sub rsp, 0x620
mov qword [rbp + 0x90], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14015d3e0]
xor rax, rsp
mov qword [rbp + 0x510], rax
mov dil, r9b
mov byte [rsp + 0x40], r9b
mov qword [rbp], r8
mov rbx, rdx
mov qword [rbp - 8], rdx
mov r14, rcx
mov qword [rbp + 8], rcx
lea r15, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], r15
lea r12, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], r12
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x332
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
xor r13d, r13d
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [r13 + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.1400bec34
nop
test dil, dil
jne 0x1400d179a
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xf0]
call sub.msvcrt.dll_memset
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x300]
call sub.msvcrt.dll_memset
mov edx, 0x104
lea rcx, [rbp + 0xf0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstVolumeW]
nop dword [rax + rax]
mov rsi, rax
lea rax, [0x1400f6448]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rsi
mov r14, qword [rbp + 0x598]
mov r15, qword [rbp + 0x590]
mov r12, qword [rbp + 0x588]
mov r13b, byte [rbp + 0x580]
xor edi, edi
cmp rsi, 0xffffffffffffffff
jne 0x1400d1539
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x12
je 0x1400d1786
cmp rsi, rsi
setne al
test al, al
jne 0x1400d15cb
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x347
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
mov ebx, dword [rbp + 0x28]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.FindFirstVolumeW_FindNextVolumeW_fails_with_0x_08lx_winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.140009fb0
mov rbx, qword [rbp - 8]
jmp 0x1400d1762
lea rcx, [rbp + 0xf0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 3
jne 0x1400d1762
lea rcx, [rbp + 0xf0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x1400d15f2
lea ecx, [rax - 1]
add rcx, rcx
cmp word [rbp + rcx + 0xf0], 0x5c
jne 0x1400d1621
cmp rcx, 0x208
jae 0x1400d1794
mov word [rbp + rcx + 0xf0], di
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400d16fa
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xf0]
lea r8, [0x1400f9fa8]
mov edx, 0x104
lea rcx, [rbp + 0x300]
call fcn.1400053e0
mov edi, eax
mov dword [rbp + 0x28], eax
mov ecx, eax
shr ecx, 0x1f
test cl, cl
je 0x1400d16f8
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x367
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
mov rbx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0xf0]
lea r8, str.StringCchPrintf_fails_for__s_s_with_0x_08lx_winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.140009fb0
mov rbx, qword [rbp - 8]
xor edi, edi
jmp 0x1400d1762
xor edi, edi
mov rax, qword [rbx + 0x20]
mov rcx, qword [rbp]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x300]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov dl, byte [rbx]
lea rcx, [rbp + 0xa0]
call fcn.1400d014c
nop
mov byte [rsp + 0x30], r13b
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r9, qword [rbp + 0x5a0]
xor r8d, r8d
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 8]
call fcn.1400d1c60
nop
lea rcx, [rbp + 0xa0]
call fcn.1400d0420
mov r8d, 0x104
lea rdx, [rbp + 0xf0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextVolumeW]
nop dword [rax + rax]
test eax, eax
jne 0x1400d151b
lea rcx, [rbp + 0x10]
call fcn.1400d0338
jmp 0x1400d1bf4
call fcn.1400167c8
nop
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400d1b99
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400f7e80]
mov rsi, rax
test rax, rax
je 0x1400d1b99
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400d1b4b
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x40]
call qword [0x1400f7e80]
mov r14d, eax
test eax, eax
je 0x1400d1b4b
mov r12d, 0x208
mov r8d, r12d
xor edx, edx
lea rcx, [rbp + 0xf0]
call sub.msvcrt.dll_memset
mov r15d, r13d
test r14d, r14d
je 0x1400d1bf4
mov edi, 0x104
mov r13, qword [rbp - 8]
mov r8, qword [rsi]
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.14002d18c
mov ebx, eax
mov dword [rbp + 0x28], eax
shr eax, 0x1f
xor r10d, r10d
test al, al
je 0x1400d18b6
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3a8
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [r10 + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.StringCchCopy_fails_with_0x_08lx__winerror__d
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.140009fb0
jmp 0x1400d1b30
lea rcx, [rbp + 0xf0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r10w
jne 0x1400d18c1
dec eax
add rax, rax
movzx ecx, word [rbp + rax + 0xf0]
cmp qword [r13 + 0x10], r10
je 0x1400d1a92
cmp cx, 0x5c
je 0x1400d1a04
mov rcx, rdi
lea rax, [rbp + 0xf0]
cmp word [rax], r10w
je 0x1400d1906
add rax, 2
sub rcx, 1
jne 0x1400d18f6
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x1400d1923
mov rax, rdi
sub rax, rcx
jmp 0x1400d1926
mov rax, r10
test rcx, rcx
je 0x1400d198d
mov rcx, rdi
sub rcx, rax
lea rdx, [rbp + 0xf0]
lea rdx, [rdx + rax*2]
je 0x1400d1971
lea r8, [rax + 0x7ffffefa]
add r8, rcx
lea r9, [0x1401035b0]
sub r9, rdx
test r8, r8
je 0x1400d1971
movzx eax, word [r9 + rdx]
test ax, ax
je 0x1400d1971
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x1400d1952
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r10w
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov dword [rbp + 0x28], ebx
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x1400d1a04
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3bd
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.StringCchCat_fails_with_0x_08lx__winerror__d
jmp 0x1400d189c
mov r8, qword [r13 + 0x10]
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.14002d088
mov ebx, eax
mov dword [rbp + 0x28], eax
shr eax, 0x1f
test al, al
je 0x1400d1aaa
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3cd
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.StringCchCat_failed_with_0x_08lx__winerror__d
jmp 0x1400d189c
cmp cx, 0x5c
jne 0x1400d1aaa
cmp rax, r12
jae 0x1400d1b45
mov word [rbp + rax + 0xf0], r10w
mov rax, qword [r13 + 0x20]
mov rcx, qword [rbp]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x588]
mov qword [rsp + 0x20], rax
mov dl, byte [r13]
lea rcx, [rbp + 0xa0]
call fcn.1400d014c
nop
mov al, byte [rbp + 0x580]
mov byte [rsp + 0x30], al
mov rax, qword [rbp + 0x598]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x590]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x5a0]
mov r8b, byte [rsp + 0x40]
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 8]
call fcn.1400d1c60
nop
lea rcx, [rbp + 0xa0]
call fcn.1400d0420
inc r15d
add rsi, 8
cmp r15d, r14d
jb 0x1400d1811
jmp 0x1400d1bf4
call fcn.1400167c8
int3
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r12
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x398
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, str.GetCurrentVolumeArray_returns_0
jmp 0x1400d1be5
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r12
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x391
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, str.GetCurrentVolumeArray_returns_NULL
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.140009fb0
nop
lea rcx, [rbp + 0x20]
call fcn.140009990
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.1400164a0
mov rbx, qword [rsp + 0x678]
add rsp, 0x620
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret