Function at 0x140031f74
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r14, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rax + 0x10], r12d
mov qword [rax - 0x58], r12
mov dword [rax + 0x20], r12d
mov qword [rdx], r12
lea r8, str.CVdsVolume::QueryAccessPathsToVolume__
lea ebp, [r12 + 0x5e]
mov edx, ebp
lea rcx, [rax - 0x48]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64]
nop dword [rax + rax]
nop
lea r9, [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x88]
add rbx, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rbx
lea ebx, [rbp - 0x56]
mov edx, ebx
call qword [sym.imp.vdsutil.dll_VdsHeapAlloc]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140032176
lea r9, [rsp + 0x98]
mov r8d, dword [rsp + 0x88]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140032086
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov r9d, eax
lea r8, str.CVdsVolume::QueryAccessPathsToVolume:_GetVolumePathNamesForVolumeName_failed:__X
xor edx, edx
mov ecx, ebp
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
jmp 0x140032176
mov rax, rsi
mov edi, r12d
cmp word [rsi], r12w
je 0x140032173
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x14003209a
lea rax, [rax + rcx*2]
add rax, 2
inc edi
cmp word [rax], r12w
jne 0x140032096
test edi, edi
je 0x140032173
mov ebp, edi
shl rbp, 3
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [r14], rax
test rax, rax
je 0x140032176
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r13, rsi
mov r15d, r12d
test edi, edi
je 0x140032169
xor eax, eax
or rbp, 0xffffffffffffffff
inc rbp
cmp word [r13 + rbp*2], ax
jne 0x1400320fa
lea rcx, [rbp*2 + 2]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [r14]
mov qword [r12 + rax], rcx
mov rcx, qword [r14]
mov rax, qword [r12 + rcx]
test rax, rax
je 0x1400321cd
lea rdx, [rbp + 1]
mov r9, rbp
mov r8, r13
mov rcx, rax
call fcn.140027bec
mov rax, qword [r14]
mov rcx, qword [r12 + rax]
xor eax, eax
mov word [rcx + rbp*2], ax
lea r13, [r13 + rbp*2]
add r13, 2
inc r15d
add r12, rbx
cmp r15d, edi
jb 0x1400320f6
xor r12d, r12d
mov rax, qword [rsp + 0x90]
mov dword [rax], edi
mov ebx, r12d
lea rcx, [rsp + 0x30]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
test rsi, rsi
je 0x1400321b2
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.vdsutil.dll_VdsHeapFree]
nop dword [rax + rax]
mov qword [rsp + 0x20], r12
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r12d, r12d
test r15d, r15d
je 0x14003220c
mov edi, r12d
mov ebp, r15d
mov rax, rcx
mov rdx, qword [rdi + rax]
test rdx, rdx
je 0x140032203
mov rcx, rdx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [r14]
mov qword [rdi + rax], r12
mov rax, qword [r14]
mov rcx, rax
add rdi, rbx
sub rbp, 1
jne 0x1400321de
test rcx, rcx
je 0x140032176
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [r14], r12
jmp 0x140032176