Function at 0x180032f20
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x770
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov rax, qword [0x1800791a8]
xor rax, rsp
mov qword [rbp + 0x620], rax
mov r13d, r9d
mov dword [rbp - 0x54], r9d
xor ebx, ebx
mov qword [rbp - 0x70], rdx
mov r15, rcx
mov r12, r8
mov r9, rdx
lea rcx, [0x180000000]
lea esi, [r13 - 0x12]
mov edi, r13d
cmp r13d, esi
jbe 0x18003329f
mov r14d, dword [rbp - 0x78]
lea ebx, [r13 - 0xe2]
movsd xmm7, qword [rbp - 0x50]
mov edx, 0x5f
movsd xmm8, qword [rbp - 0x50]
mov r8d, 0x5f44
xorps xmm9, xmm9
lea r10d, [rdx - 0x2d]
lea r11d, [rdx - 0x18]
nop dword [rax]
cmp ebx, 0x49
ja case.default.0x180032fe2
movzx eax, byte [rcx + rbx + 0x33bb0]
mov ecx, dword [rcx + rax*4 + 0x33b68]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
test r9, r9
jne 0x18003300f
xor edx, edx
mov dword [rbp - 0x80], r9d
lea rax, str.a___NULL
lea r9, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea rcx, [0x18006d014]
lea r8d, [rdx + 0x33]
call fcn.18002d470
mov eax, dword [r12]
lea r9, [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov edx, 0xfa
xor ecx, ecx
mov dword [rbp - 0x80], eax
call fcn.180051b90
mov r14d, eax
jmp 0x180033272
mov word [rbp + 0x1e6], r8w
mov dword [rbp + 0x1e8], 0x33493256
jmp case.0x180032fe2.17
cmp r14d, 0xffffffff
je 0x1800333a4
test r14d, r14d
je 0x1800333c5
cmp r14d, 1
je 0x1800333b8
mov dword [rsp + 0x68], 0
jmp case.0x180032fe2.17
mov r8d, 2
lea rdx, [0x18006d7d1]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [str.Check_for_updates_returned_SUCCESS]
mov dword [rbp + 0x1a6], eax
movzx eax, byte [0x18006d80c]
mov byte [rbp + 0x1aa], al
mov byte [rbp + 0x1ab], 0
jmp 0x180033272
mov dword [rbp + 0x1a0], 0x65636341
mov byte [rbp + 0x1a4], 0
jmp case.0x180032fe2.17
mov r8d, 3
mov word [rbp + 0x1af], 0x70
lea rdx, [0x18006d861]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180033272
mov dword [rbp + 0x1e0], 0x494749
mov dword [rbp + 0x1e3], 0x4c5f4c
jmp case.0x180032fe2.17
mov r8d, 3
lea rdx, [0x18006d896]
lea rcx, [rbp + 0x1ac]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180033272
mov word [rbp + 0x1ab], 0x42
jmp case.0x180032fe2.17
movsd xmm7, qword [r9]
movsd xmm8, qword [r12]
jmp case.0x180032fe2.17
mov eax, 0x53
mov word [rbp + 0x1f2], ax
mov eax, 0x3253
mov dword [rbp + 0x1f3], 0x5f4249
mov word [rbp + 0x1f6], ax
jmp case.0x180032fe2.17
mov word [rbp + 0x1ed], dx
jmp case.0x180032fe2.17
mov word [rbp + 0x1ec], r10w
jmp case.0x180032fe2.17
mov word [rbp + 0x1ee], r11w
mov dword [rbp + 0x1ef], 0x5f4c42
jmp case.0x180032fe2.17
mov edx, dword [r9]
cmp edx, 3
jg 0x180033209
mov ecx, 0x81
nop word [rax + rax]
mov eax, ecx
sub eax, 0x81
je 0x1800331f5
cmp eax, 0x7e
jne 0x1800331fe
cmp edx, 2
jne 0x180033332
movsd xmm3, qword [0x180071df0]
movsd xmm0, qword [r12]
movaps xmm1, xmm3
addsd xmm0, xmm3
divsd xmm3, qword [r12]
divsd xmm1, xmm0
addsd xmm1, xmm3
movsd qword [rsp + 0x68], xmm1
jmp case.0x180033782.0
cmp edx, 1
jle 0x180033374
add ecx, 0x7e
cmp ecx, 0x17d
jb 0x1800331b0
movsd xmm6, qword [r15]
comisd xmm6, xmm9
ja 0x18003323c
movsd xmm0, qword [r12]
lea r8, [rbp - 0x68]
mov r9d, 0x80
movsd qword [rbp - 0x68], xmm0
xor edx, edx
xor ecx, ecx
call fcn.180032270
mov r9, qword [rbp - 0x70]
movq xmm6, rax
movd xmm0, dword [r9]
lea r8, [rbp - 0x68]
cvtdq2pd xmm0, xmm0
mov r9d, 0x80
xor edx, edx
xor ecx, ecx
addsd xmm0, qword [r12]
movsd qword [rbp - 0x68], xmm0
call fcn.180032270
movq xmm0, rax
subsd xmm0, xmm6
movsd qword [rsp + 0x68], xmm0
mov r9, qword [rbp - 0x70]
mov r11d, 0x47
mov r8d, 0x5f44
lea r10d, [r11 - 0x15]
lea edx, [r11 + 0x18]
lea rcx, [0x180000000]
dec edi
dec ebx
cmp edi, esi
ja 0x180032fc0
xor ebx, ebx
imul eax, r13d, 0x231
mov r14d, r13d
mov dword [rbp - 0x78], eax
cmp r13d, eax
ja case.0x180033782.0
mov r13d, dword [rbp - 0x78]
lea rdx, str.ws2_32.dll
mov r15d, dword [rbp - 0x78]
mov ecx, 0x16
movabs rax, 0x7fffffffffffffff
cmp r14d, 0x7f49
ja 0x18003360d
je 0x180033b32
cmp r14d, 0x401f
ja 0x180033599
je 0x18003343d
mov eax, r14d
sub eax, 0xf5
je 0x1800333f6
sub eax, 0x36
je 0x1800333e0
sub eax, 0x1f5f
je 0x1800333d2
cmp eax, 0x72c
jne 0x180033b32
mov byte [rbp + 0x1c4], 0
jmp 0x180033b32
movsd xmm2, qword [0x180071df0]
movsd xmm3, qword [r12]
movaps xmm1, xmm2
movaps xmm0, xmm3
addsd xmm0, xmm2
divsd xmm1, xmm0
movaps xmm0, xmm2
divsd xmm0, xmm3
addsd xmm3, qword [0x180071e10]
addsd xmm1, xmm0
divsd xmm2, xmm3
addsd xmm1, xmm2
movsd qword [rsp + 0x68], xmm1
jmp case.0x180033782.0
test edx, edx
jne 0x180033384
movsd qword [rsp + 0x68], xmm9
jmp case.0x180033782.0
movsd xmm0, qword [0x180071df0]
divsd xmm0, qword [r12]
movsd qword [rsp + 0x68], xmm0
jmp case.0x180033782.0
comisd xmm7, xmm8
jbe 0x1800333b1
mov dword [rsp + 0x68], 0xffffffff
jmp case.0x180033782.0
comisd xmm8, xmm7
jbe 0x1800333c5
mov dword [rsp + 0x68], 1
jmp case.0x180033782.0
mov dword [rsp + 0x68], 0
jmp case.0x180033782.0
mov word [rbp + 0x1ba], 0x74
jmp 0x180033b32
mov byte [rbp + 0x1f8], 0
mov dword [rbp + 0x1c0], 0x53415357
jmp 0x180033b32
mov r8d, 5
mov byte [rbp + 0x1b3], 0
lea rdx, [0x18006d96b]
lea rcx, [rbp + 0x1b3]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 2
mov byte [rbp + 0x1b8], 0
lea rdx, [0x18006d997]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180033b26
mov rsi, qword [r9 + 0x10]
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
cmp rsi, 0xf
ja 0x180033477
mov r8, rsi
mov qword [rbp - 0x20], rsi
xor edx, edx
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + rsi - 0x30], 0
mov rdi, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x30]
jmp 0x1800334fc
cmp rsi, rax
ja 0x180033b53
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x180033491
mov rdi, rax
jmp 0x180033499
cmp rdi, 0x16
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800334d2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033b5f
mov rcx, rax
call fcn.18006881c
test rax, rax
je 0x180033b4c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800334df
test rcx, rcx
je 0x1800334df
call fcn.18006881c
mov rbx, rax
mov r8, rsi
mov qword [rbp - 0x20], rsi
xor edx, edx
mov qword [rbp - 0x18], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rsi], 0
mov qword [rbp - 0x30], rbx
lea rax, [rbp - 0x30]
cmp r12, rax
je 0x180033559
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x180033541
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x18003353c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180033b4c
mov rcx, r8
call fcn.180068858
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [r12], xmm0
movups xmmword [r12 + 0x10], xmm1
jmp 0x180033b24
cmp rdi, 0x10
jb 0x180033b24
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18003358c
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180033b4c
mov rcx, rbx
call fcn.180068858
jmp 0x180033b24
cmp r14d, 0x4e41
je 0x1800335ef
cmp r14d, 0x5fb4
je 0x1800335e7
cmp r14d, 0x74cc
jne 0x180033b32
mov r8d, 1
mov byte [rbp + 0x1c9], 0
lea rdx, str.pageant_Fatal_Error
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rsp + 0x60], 1
mov qword [rbp - 0x38], rbx
jmp 0x180033b26
mov dword [rbp - 0x60], ebx
jmp 0x180033b32
mov eax, dword [0x18006da32]
mov dword [rbp + 0x1c4], eax
movzx eax, byte [0x18006da36]
mov byte [rbp + 0x1c8], al
jmp 0x180033b32
cmp r14d, 0xe86d
ja 0x18003390d
je 0x18003374d
cmp r14d, 0x9ede
je 0x18003373b
cmp r14d, 0xbe73
je 0x1800336a6
cmp r14d, 0xc1e2
jne 0x180033b32
mov qword [rsp + 0x58], rbx
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x50], rbx
xor r9d, r9d
mov qword [rsp + 0x48], rbx
xor r8d, r8d
mov qword [rsp + 0x40], rbx
xor ecx, ecx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x31
mov qword [rsp + 0x20], rax
call fcn.180006e90
mov rcx, qword [rbp - 0x38]
lea rdx, [rbp - 0x5c]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x5c], ebx
call qword [sym.imp.WINMM.dll_midiInGetID]
mov r13d, eax
mov byte [rsp + 0x78], 0x69
jmp 0x180033b26
cmp qword [r12 + 0x18], 0x10
mov rdx, r12
jb 0x1800336b5
mov rdx, qword [r12]
cmp qword [r9 + 0x18], 0x10
mov rcx, r9
jb 0x1800336c2
mov rcx, qword [r9]
mov eax, dword [r9 + 0x10]
mov r8d, 0xb7
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
mov byte [rsp + 0x70], 0
mov dword [rbp - 0x80], eax
call fcn.1800259e0
test al, al
je 0x18003371f
mov eax, dword [rbp - 0x60]
cmp qword [r12 + 0x10], rax
jb 0x180033b59
mov qword [r12 + 0x10], rax
mov rcx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180033716
mov rcx, qword [r12]
mov byte [rcx + rax], 0
jmp 0x180033b26
mov qword [r12 + 0x10], rbx
mov rax, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180033733
mov rax, qword [r12]
mov byte [rax], 0
jmp 0x180033b26
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
jmp 0x180033b26
mov ecx, 0x202
lea rdx, [rbp]
call qword [rbp - 0x50]
test eax, eax
je 0x1800338f7
mov ebx, 8
cmp ebx, 8
ja case.default.0x180033782
lea rdx, [0x180000000]
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0x33bfc]
add rcx, rdx
jmp rcx
xorps xmm0, xmm0
lea rdx, [rbp + 0x410]
mov r8d, 0x104
lea rcx, [rbp + 0x200]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov qword [rbp - 0x68], rax
cmp rax, 0xffffffffffffffff
jne case.default.0x180033782
mov byte [rsp + 0x61], 0
jmp case.default.0x180033782
mov r8d, 0xa
lea rdx, [rbp + 0x21c]
lea ecx, [r8 + 0x12]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
mov r8d, 2
lea rdx, [0x18006d90c]
jmp 0x1800338d5
cmp byte [rsp + 0x61], 0
mov dword [rbp - 0x30], 0x30
je case.default.0x180033782
mov rcx, qword [rbp - 0x68]
lea rdx, [rbp + 0x410]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
jmp case.default.0x180033782
lea rcx, [rbp + 0x200]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180033831
mov eax, dword [0x18006d914]
mov dword [rcx], eax
mov eax, dword [0x18006d918]
mov dword [rbp + 0x214], eax
mov eax, dword [0x18006d920]
mov dword [rbp + 0x218], eax
movzx eax, word [0x18006d924]
mov word [rbp + 0x21c], ax
jmp case.default.0x180033782
movups xmm0, xmmword [str.ALUE_TYP]
movzx eax, word [0x18006d938]
lea rdx, [0x18006d93c]
mov word [rbp + 0x234], ax
mov r8d, 1
movups xmmword [rbp + 0x224], xmm0
jmp 0x1800338d5
mov ecx, dword [rbp - 0x58]
lea rdx, [rbp - 0x30]
call qword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov byte [rsp + 0x68], 0
jmp case.default.0x180033782
mov byte [rsp + 0x61], 1
mov dword [rbp - 0x58], 7
mov qword [rbp - 0x68], 0xffffffffffffffff
jmp case.default.0x180033782
xor eax, eax
lea rdx, [0x18006d940]
mov word [rbp + 0x200], ax
lea r8d, [rax + 9]
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
dec ebx
lea eax, [rbx + 0x11a]
cmp eax, 0x119
ja 0x180033766
xor ebx, ebx
movzx eax, byte [rsp + 0x60]
test r13d, r13d
mov ecx, ebx
cmovne ecx, eax
mov byte [rsp + 0x60], cl
jmp 0x180033b26
cmp r14d, 0x10ef8
je 0x180033959
cmp r14d, 0x13583
je 0x180033931
cmp r14d, 0x15c0e
je case.0x180033782.0
jmp 0x180033b32
movsx edx, byte [rsp + 0x78]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_StrChrIA]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x41]
call fcn.18000dfe0
mov byte [rsp + 0x68], al
jmp 0x180033b26
xor r8d, r8d
mov edx, 0x112
mov rcx, r9
call fcn.1800189c0
test al, al
jne 0x180033ae3
mov ebx, 4
nop word [rax + rax]
cmp ebx, 0xb8
ja 0x180033a1c
je 0x1800339f3
cmp ebx, 4
je 0x1800339ca
cmp ebx, 0x40
je 0x1800339be
cmp ebx, 0x7c
jne 0x180033ad4
lea r8d, [rbx - 0x7b]
lea rdx, [0x18006da0c]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180033ad4
mov byte [rbp + 0x1d6], 0
jmp 0x180033ad4
mov r8d, 2
lea rdx, str._Pname__operation_is_invalid_because_a_required_extension__ARB_texture_buffer_range__is_not_supported.
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp + 0x1d2], 0x4c656761
jmp 0x180033ad4
mov r8d, 1
lea rdx, [0x18006da26]
lea rcx, [rbp + 0x1d7]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp + 0x1d8], 0x3e74756f
jmp 0x180033ad4
mov eax, ebx
sub eax, 0xf4
je 0x180033acd
sub eax, 0x3c
je 0x180033a7f
cmp eax, 0x3c
jne 0x180033ad4
mov byte [rsp + 0x68], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.180068d70
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x38], 0x104
lea rax, [rbp + 0x410]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x48]
mov r8d, 0x104
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x200]
lea rax, [rbp - 0x44]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathIsNetworkPathA]
jmp 0x180033ad4
mov byte [rbp + 0x1dc], 0
add ebx, 0x3c
cmp ebx, 0x1a4
jbe 0x180033980
cmp byte [rsp + 0x60], 0
je 0x180033b24
mov ebx, 0x11f
nop
mov eax, ebx
sub eax, 0x11f
je 0x180033b13
cmp eax, 0x20
jne 0x180033b19
mov r8d, r15d
lea rdx, [rbp + 0x410]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_midiInGetErrorTextW]
jmp 0x180033b19
mov r15d, 0x104
add ebx, 0x20
cmp ebx, 0x15f
jb 0x180033af0
xor ebx, ebx
mov ecx, 0x16
lea rdx, str.ws2_32.dll
imul eax, dword [rbp - 0x54], 0x21
add r14d, eax
cmp r14d, dword [rbp - 0x78]
ja case.0x180033782.0
mov r9, qword [rbp - 0x70]
jmp 0x1800332c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180025240
int3
call fcn.180025280
int3
call fcn.180025100
int3