Function at 0x1000235c4
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x6e0
mov rax, qword [0x10002e110]
xor rax, rsp
mov qword [rsp + 0x6d0], rax
mov rsi, rcx
mov rcx, qword [0x10002e120]
lea r14, [0x10002e120]
lea r15, [0x100005ed8]
cmp rcx, r14
je 0x100023627
bt dword [rcx + 0x1c], 0x1d
jae 0x100023627
mov rcx, qword [rcx + 0x10]
mov edx, 0x38
mov r9, rsi
mov r8, r15
call fcn.1000209b8
mov ebp, 1
lea rdx, [0x1000083f0]
lea rcx, [rsp + 0x58]
mov r9d, ebp
mov r8d, 0x6a1
call fcn.10001ed8c
xor r12d, r12d
mov eax, 0x6b0
mov rbx, r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x90], r12d
mov qword [rsp + 0x48], rbx
cmp rsi, r12
je 0x100023b0d
lea ecx, [rbp + 0x17]
mov qword [rsi], r12
mov dword [rsp + 0x58], r12d
mov word [rsp + 0x5c], ax
mov edi, r12d
mov qword [rsp + 0x40], r12
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, r12
je 0x10002369e
mov qword [rax], r12
mov dword [rax + 8], r12d
mov dword [rax + 0xc], r12d
mov dword [rax + 0x10], ebp
jmp 0x1000236a1
mov rax, r12
cmp rax, r12
jne 0x1000236ad
mov edi, 0x8007000e
jmp 0x1000236b2
mov qword [rsp + 0x40], rax
cmp edi, r12d
mov dword [rsp + 0x58], edi
mov eax, 0x6b2
jl 0x100023b16
lea rcx, [rsp + 0xa0]
mov edx, 0x104
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1000236ff
call fcn.100020b84
mov ecx, 0x6b5
mov edi, eax
mov dword [rsp + 0x58], eax
mov word [rsp + 0x5e], cx
jmp 0x100023ad7
mov ecx, 0x6b5
mov dword [rsp + 0x58], r12d
mov word [rsp + 0x5c], cx
mov rcx, qword [0x10002e120]
cmp rcx, r14
je 0x10002373a
bt dword [rcx + 0x1c], 0x1b
jae 0x10002373a
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0xa0]
mov edx, 0x39
mov r8, r15
call fcn.10001f2b0
lea rcx, [rsp + 0xa0]
call fcn.1000231fc
mov edi, eax
mov dword [rsp + 0x58], eax
cmp eax, r12d
mov eax, 0x6bb
jl 0x100023ad2
mov word [rsp + 0x5c], ax
cmp edi, r12d
jne 0x100023a97
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov edi, 0x104
lea rdx, [rsp + 0x4c0]
lea rcx, [rsp + 0xa0]
xor r9d, r9d
mov r8d, edi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, r12d
jne 0x1000237fc
mov rax, qword [0x10002e120]
cmp rax, r14
je 0x100023a97
bt dword [rax + 0x1c], 0x19
jae 0x100023a97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x3a
movzx ecx, ax
or ecx, 0x80070000
cmp eax, r12d
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x10002e120]
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0xa0]
mov r8, r15
call fcn.10001f330
jmp 0x100023a97
lea r9, [rsp + 0x90]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0xa0]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
cmp eax, r12d
jne 0x10002384d
mov rax, qword [0x10002e120]
cmp rax, r14
je 0x100023a97
bt dword [rax + 0x1c], 0x19
jae 0x100023a97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x3b
jmp 0x1000237c9
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0xa0]
mov r8d, edi
call fcn.100021fac
cmp eax, r12d
jge 0x100023893
mov rcx, qword [0x10002e120]
cmp rcx, r14
je 0x100023a97
bt dword [rcx + 0x1c], 0x19
jae 0x100023a97
mov edx, 0x3c
mov dword [rsp + 0x20], eax
jmp 0x1000237e3
cmp rbx, r12
je 0x100023932
mov qword [rsp + 0x48], r12
or eax, 0xffffffff
lock xadd dword [rbx], eax
add eax, 0xffffffff
jne 0x1000238e2
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbx + 0x28]
mov qword [rbx + 0x38], r12
mov dword [rbx + 0x40], r12d
call fcn.100027da0
lea rcx, [rbx + 0x18]
call fcn.100027da0
lea rcx, [rbx + 8]
call fcn.100027da0
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x48]
cmp rbx, r12
je 0x100023932
mov qword [rsp + 0x48], r12
or eax, 0xffffffff
lock xadd dword [rbx], eax
add eax, 0xffffffff
jne 0x100023932
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbx + 0x28]
mov qword [rbx + 0x38], r12
mov dword [rbx + 0x40], r12d
call fcn.100027da0
lea rcx, [rbx + 0x18]
call fcn.100027da0
lea rcx, [rbx + 8]
call fcn.100027da0
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x48]
call fcn.1000218ac
mov rbx, qword [rsp + 0x48]
mov edi, eax
mov dword [rsp + 0x58], eax
cmp eax, r12d
mov eax, 0x6d2
jl 0x100023ad2
lea rcx, [rbx + 8]
mov word [rsp + 0x5c], ax
cmp dword [rcx + 8], r12d
je 0x10002396f
mov rax, qword [rcx]
mov dword [rcx + 8], r12d
mov word [rax], r12w
lea rdx, [rsp + 0xa0]
call fcn.10002897c
mov edi, eax
mov dword [rsp + 0x58], eax
cmp eax, r12d
mov eax, 0x6d3
jl 0x100023ad2
lea rcx, [rbx + 0x28]
mov word [rsp + 0x5c], ax
cmp dword [rcx + 8], r12d
je 0x1000239aa
mov rax, qword [rcx]
mov dword [rcx + 8], r12d
mov word [rax], r12w
lea rdx, [rsp + 0x4c0]
call fcn.10002897c
mov edi, eax
mov dword [rsp + 0x58], eax
cmp eax, r12d
mov eax, 0x6d4
jl 0x100023ad2
lea rcx, [rbx + 0x18]
mov word [rsp + 0x5c], ax
cmp dword [rcx + 8], r12d
je 0x1000239e5
mov rax, qword [rcx]
mov dword [rcx + 8], r12d
mov word [rax], r12w
lea rdx, [rsp + 0x2b0]
call fcn.10002897c
mov edi, eax
mov dword [rsp + 0x58], eax
cmp eax, r12d
mov eax, 0x6d5
jl 0x100023ad2
lea r8, [rbx + 0x40]
lea rdx, [rbx + 0x38]
lea rcx, [rsp + 0xa0]
mov word [rsp + 0x5c], ax
call fcn.100022a8c
cmp eax, r12d
jge 0x100023a42
mov rcx, qword [0x10002e120]
cmp rcx, r14
je 0x100023a97
bt dword [rcx + 0x1c], 0x19
jae 0x100023a97
mov edx, 0x3d
jmp 0x10002388a
lea rdx, [rbx + 0x48]
lea rcx, [rsp + 0xa0]
call fcn.100022f48
cmp eax, r12d
jge 0x100023a75
mov rcx, qword [0x10002e120]
cmp rcx, r14
je 0x100023a97
bt dword [rcx + 0x1c], 0x19
jae 0x100023a97
mov edx, 0x3e
jmp 0x10002388a
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call fcn.10002431c
mov edi, eax
mov dword [rsp + 0x58], eax
cmp eax, r12d
mov eax, 0x6e5
jl 0x100023ad2
mov word [rsp + 0x5c], ax
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, r12d
jne 0x10002370e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x100023aec
call fcn.100020b84
mov edi, eax
mov dword [rsp + 0x58], eax
mov eax, 0x6f1
mov word [rsp + 0x5e], ax
cmp rbp, 0xffffffffffffffff
je 0x100023b1b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov edi, dword [rsp + 0x58]
jmp 0x100023b1b
mov eax, 0x6f1
mov edi, r12d
mov dword [rsp + 0x58], r12d
mov word [rsp + 0x5c], ax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rsi], rax
jmp 0x100023ad7
mov edi, 0x80070057
mov dword [rsp + 0x58], edi
mov word [rsp + 0x5e], ax
cmp rbx, r12
je 0x100023b66
or eax, 0xffffffff
lock xadd dword [rbx], eax
add eax, 0xffffffff
jne 0x100023b66
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbx + 0x28]
mov qword [rbx + 0x38], r12
mov dword [rbx + 0x40], r12d
call fcn.100027da0
lea rcx, [rbx + 0x18]
call fcn.100027da0
lea rcx, [rbx + 8]
call fcn.100027da0
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
cmp rcx, r12
je 0x100023b91
or edx, 0xffffffff
lock xadd dword [rcx + 0x10], edx
add edx, 0xffffffff
jne 0x100023b91
mov rcx, qword [rsp + 0x40]
call fcn.100024268
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x58]
call fcn.10001eea4
mov eax, edi
mov rcx, qword [rsp + 0x6d0]
xor rcx, rsp
call fcn.10002a0b0
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret