Function at 0x140221768
Capabilities:
Enumerate disk volumes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x448]
sub rsp, 0x520
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov r14, rcx
mov edx, 0x104
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
nop dword [rax + rax]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
setbe al
xor r12d, r12d
test al, al
je 0x140221e4b
mov ecx, 0x130
call fcn.140356b9c
mov rcx, rax
call fcn.1402247c8
xorps xmm0, xmm0
mov qword [rsp + 0x48], r12
xor r8d, r8d
movss dword [rsp + 0x40], xmm0
xor edx, edx
mov qword [rsp + 0x50], r12
lea rcx, [rax + 0x10]
mov r13, rax
mov qword [rbp - 0x48], rcx
call fcn.1401b3854
movss xmm1, dword [0x140420290]
lea edx, [r12 + 8]
xorps xmm0, xmm0
movss dword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], r12
call fcn.14005e790
lea rdx, [rbp + 0x200]
mov qword [rbp + 0x10], r12
lea rcx, [rbp]
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
call fcn.140055574
lea rdx, [rbp]
lea rcx, [rbp + 0x20]
call fcn.140222b08
mov ecx, 0x108
mov rdi, rax
call fcn.140356b9c
mov r15, rax
mov rdx, rdi
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rsi, [r15 + 0x10]
lea rax, vtable.std::_Ref_count_obj_class_sense::Common::StorageVolume_.0
mov rcx, rsi
mov qword [r15], rax
call fcn.14022490c
lea rcx, [rbp + 0xe8]
call fcn.140055f70
lea rcx, [rbp + 0xc8]
call fcn.140055f70
lea rcx, [rbp + 0xa8]
call fcn.140055f70
lea rcx, [rbp + 0x88]
call fcn.140055f70
lea rcx, [rbp + 0x60]
call fcn.140055f70
lea rcx, [rbp + 0x40]
call fcn.140055f70
lea rcx, [rbp + 0x20]
call fcn.140055f70
lea rcx, [rbp]
call fcn.140055f70
test rsi, rsi
je 0x140221c03
cmp qword [rsi + 0x50], r12
je 0x140221c03
xorps xmm0, xmm0
mov edi, 1
movdqu xmmword [rbp - 0x68], xmm0
lock add dword [r15 + 8], edi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], r15
movdqu xmmword [rbp - 0x58], xmm0
test r13, r13
je 0x140221931
lock add dword [r13 + 8], edi
mov rax, qword [rbp - 0x48]
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x40]
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x50], r13
call fcn.140220cdc
call fcn.1400550c0
mov r11d, 4
mov r10, qword [rax + 8]
cmp dword [r10], r11d
jbe 0x140221c03
lea rax, str.Storage_volume_discovered
mov qword [rbp + 0x148], 0x34
mov qword [rbp + 0x140], rax
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14022198d
mov rcx, qword [rsi]
or r8, 0xffffffffffffffff
lea r9, [0x1403cb630]
mov rdx, r9
mov rax, r12
test rcx, rcx
je 0x1402219b3
mov rdx, rcx
mov rax, r8
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1402219a9
lea eax, [rax*2 + 2]
mov qword [rbp + 0x150], rdx
mov dword [rbp + 0x158], eax
lea rax, [rsi + 0x40]
mov dword [rbp + 0x15c], r12d
cmp qword [rax + 0x18], 8
jb 0x1402219dc
mov rax, qword [rax]
mov rdx, r9
mov rcx, r12
test rax, rax
je 0x1402219f7
mov rdx, rax
mov rcx, r8
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1402219ed
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x160], rdx
mov dword [rbp + 0x168], eax
lea rax, [rsi + 0x20]
mov dword [rbp + 0x16c], r12d
cmp qword [rax + 0x18], 8
jb 0x140221a20
mov rax, qword [rax]
mov rdx, r9
mov rcx, r12
test rax, rax
je 0x140221a3b
mov rdx, rax
mov rcx, r8
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x140221a31
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x170], rdx
mov dword [rbp + 0x178], eax
mov dword [rbp + 0x17c], r12d
mov al, byte [rsi + 0x60]
mov byte [rsp + 0x30], al
lea rax, [rsp + 0x30]
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], rdi
mov eax, dword [rsi + 0x64]
mov dword [rbp - 0x80], eax
lea rax, [rbp - 0x80]
mov qword [rbp + 0x190], rax
lea rax, [rsi + 0x88]
mov qword [rbp + 0x198], r11
cmp qword [rax + 0x18], 8
jb 0x140221a99
mov rax, qword [rax]
mov rdx, r9
mov rcx, r12
test rax, rax
je 0x140221ab4
mov rdx, rax
mov rcx, r8
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x140221aaa
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x1a0], rdx
mov dword [rbp + 0x1a8], eax
lea rax, [rsi + 0xc8]
mov dword [rbp + 0x1ac], r12d
cmp qword [rax + 0x18], 8
jb 0x140221ae0
mov rax, qword [rax]
mov rdx, r9
mov rcx, r12
test rax, rax
je 0x140221afb
mov rdx, rax
mov rcx, r8
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x140221af1
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x1b0], rdx
mov dword [rbp + 0x1b8], eax
lea rax, [rsi + 0xa8]
mov dword [rbp + 0x1bc], r12d
cmp qword [rax + 0x18], 8
jb 0x140221b27
mov rax, qword [rax]
mov rdx, r9
mov rcx, r12
test rax, rax
je 0x140221b42
mov rdx, rax
mov rcx, r8
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x140221b38
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x1c0], rdx
mov dword [rbp + 0x1c8], eax
lea rax, [rsi + 0x68]
mov dword [rbp + 0x1cc], r12d
cmp qword [rax + 0x18], 8
jb 0x140221b6b
mov rax, qword [rax]
mov rdx, r9
mov rcx, r12
test rax, rax
je 0x140221b86
mov rdx, rax
mov rcx, r8
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x140221b7c
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x1d0], rdx
mov dword [rbp + 0x1d8], eax
mov dword [rbp + 0x1dc], r12d
mov al, byte [rsi + 0xe8]
mov byte [rsp + 0x31], al
lea rax, [rsp + 0x31]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], rdi
movzx eax, byte [rsi + 0xf0]
mov dword [rbp - 0x7c], eax
lea rax, [rbp - 0x7c]
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x1f8], r11
lea rax, [rbp + 0x120]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140483fbf]
xor r8d, r8d
mov dword [rsp + 0x20], SafeArrayLock
mov rcx, r10
call fcn.140001208
or eax, 0xffffffff
lock xadd dword [r15 + 8], eax
cmp eax, 1
jne 0x140221c3e
mov rax, qword [r15]
mov rcx, r15
mov rax, qword [rax]
call qword [str.p76_]
or eax, 0xffffffff
lock xadd dword [r15 + 0xc], eax
cmp eax, 1
jne 0x140221c3e
mov rax, qword [r15]
mov rcx, r15
mov rax, qword [rax + 8]
call qword [str.p76_]
mov r8d, 0x104
lea rdx, [rbp + 0x200]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
nop dword [rax + rax]
test eax, eax
jne 0x14022183c
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
lea rsi, [r14 + 0x28]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
lea rdx, [r14 + 0x40]
lea rax, [rsp + 0x40]
cmp rdx, rax
je 0x140221d61
movss xmm1, dword [rdx]
lea r8, [rdx + 8]
movss xmm0, dword [rsp + 0x40]
lea rax, [rsp + 0x48]
movss dword [rbp - 0x70], xmm1
movss dword [rdx], xmm0
movss dword [rsp + 0x40], xmm1
cmp r8, rax
je 0x140221ce7
mov rcx, qword [r8]
mov rax, qword [rsp + 0x48]
mov qword [r8], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x38], rcx
mov qword [rsp + 0x48], rcx
mov rcx, qword [r8 + 8]
mov qword [rbp - 0x30], rcx
mov qword [r8 + 8], rax
mov qword [rsp + 0x50], rcx
lea r8, [rdx + 0x18]
lea rax, [rsp + 0x58]
cmp r8, rax
je 0x140221d35
mov rcx, qword [r8]
mov rax, qword [rsp + 0x58]
mov qword [r8], rax
mov rax, qword [rsp + 0x60]
mov qword [rbp - 0x28], rcx
mov qword [rsp + 0x58], rcx
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x20], rcx
mov qword [rsp + 0x60], rcx
mov rcx, qword [r8 + 0x10]
mov qword [rbp - 0x18], rcx
mov qword [r8 + 0x10], rax
mov qword [rsp + 0x68], rcx
mov rcx, qword [rdx + 0x30]
mov rax, qword [rsp + 0x70]
mov qword [rdx + 0x30], rax
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x10], rcx
mov qword [rsp + 0x70], rcx
mov rcx, qword [rdx + 0x38]
mov qword [rbp - 8], rcx
mov qword [rdx + 0x38], rax
mov qword [rsp + 0x78], rcx
mov rax, qword [rbp - 0x48]
mov qword [r14 + 0x30], rax
mov rdi, qword [r14 + 0x38]
mov qword [rbp - 0x78], rdi
mov qword [r14 + 0x38], r13
test rsi, rsi
je 0x140221d89
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140221040
test r14, r14
je 0x140221daa
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140221e01
mov rdx, qword [rsp + 0x68]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140221dee
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140221dee
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop dword [rax + rax]
int3
call fcn.140356b5c
xorps xmm0, xmm0
mov qword [rsp + 0x58], r12
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x48]
call fcn.140222f00
test rdi, rdi
je 0x140221e4b
or eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140221e4b
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [str.p76_]
or eax, 0xffffffff
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x140221e4b
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.p76_]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
setbe al
test al, al
je 0x140221e69
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret