Function at 0x14000caf6
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3c8
xor eax, eax
mov ebp, ecx
lea rdi, [rsp + 0x70]
mov ecx, 0x20
mov r12, rdx
rep stosd dword [rdi], eax
mov edx, 0x10
lea rcx, [rsp + 0x60]
mov ebx, r9d
mov dword [rsp + 0x420], r8d
xor r8d, r8d
mov dword [rsp + 0x5c], r8d
call fcn.14003523d
test ebp, ebp
jns 0x14000cb49
xor esi, esi
jmp 0x14000cfd2
lea eax, [rbp - 0x80]
mov r8d, 0x10c
lea rdx, str.drive.c
mov dword [rsp + 0x48], eax
lea rcx, str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
cmp eax, 0x40
ja 0x14000cc33
xor ecx, ecx
mov r13d, 1
mov qword [rsp + 0x40], 0xffffffffffffffff
mov dword [rsp + 0x4c], ecx
cmp dword [rsp + 0x4c], 0
lea r14, [rsp + 0x1b8]
jne 0x14000cbc6
mov edx, 0x104
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_FindFirstVolumeA]
mov qword [rsp + 0x40], rax
inc rax
jne 0x14000cc0e
test ebx, ebx
jne 0x14000cb42
call fcn.140036bd7
lea rcx, str.Could_not_access_first_GUID_volume:__s
mov rdx, rax
call fcn.140036717
jmp 0x14000cb42
mov rcx, qword [rsp + 0x40]
mov r8d, 0x104
mov rdx, r14
call qword [sym.imp.KERNEL32.DLL_FindNextVolumeA]
test eax, eax
jne 0x14000cc0e
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
je 0x14000cef8
test ebx, ebx
jne 0x14000cef8
call fcn.140036bd7
lea rcx, str.Could_not_access_next_GUID_volume:__s
mov rdx, rax
call fcn.140036717
jmp 0x14000cef8
mov rcx, r14
call sub.msvcrt.dll_strlen
mov rdi, rax
cmp rax, 4
ja 0x14000cc39
mov r8d, 0x120
lea rdx, str.drive.c
lea rcx, str.len___4
call qword [sym.imp.msvcrt.dll__wassert]
mov rsi, qword [sym.imp.msvcrt.dll__strnicmp]
mov r8d, 4
lea rdx, [0x14008305a]
mov rcx, r14
call rsi
test eax, eax
je 0x14000cc6c
mov r8d, 0x121
lea rdx, str.drive.c
lea rcx, str.safe_strnicmp_volume_name__volume_start__4___0
jmp 0x14000cc33
cmp byte [rsp + rdi + 0x1b7], 0x5c
lea r15, [rdi - 1]
je 0x14000cc90
mov r8d, 0x122
lea rdx, str.drive.c
lea rcx, str.volume_name_len___1___
jmp 0x14000cc33
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
sub eax, 2
cmp eax, 1
ja 0x14000cd16
lea rdi, [rsp + 0x2bc]
lea rcx, [rsp + 0x1bc]
mov byte [rsp + r15 + 0x1b8], 0
mov r8d, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
test eax, eax
je 0x14000ccfb
mov r8d, 0xd
lea rdx, str.DeviceCdRom
mov rcx, rdi
call rsi
test eax, eax
je 0x14000cd5f
mov r8d, 0xe
lea rdx, str.DeviceFloppy
mov rcx, rdi
call rsi
test eax, eax
jne 0x14000cd1f
jmp 0x14000cd5f
test ebx, ebx
jne 0x14000cd16
call fcn.140036bd7
mov rdx, r14
lea rcx, str.Failed_to_get_device_path_for_GUID_volume__s:__s
mov r8, rax
call fcn.140036717
or rdi, 0xffffffffffffffff
jmp 0x14000ceeb
xor edx, edx
mov dword [rsp + 0x38], 0xbb8
xor r9d, r9d
mov rcx, r14
mov qword [rsp + 0x30], rdx
mov r8d, 3
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call fcn.14003802b
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000cd8c
jmp 0x14000cd74
test ebx, ebx
jne 0x14000cd16
mov rdx, rdi
lea rcx, str.Skipping_GUID_volume_for__s
call fcn.140036717
jmp 0x14000cd16
test ebx, ebx
jne 0x14000cd16
call fcn.140036bd7
mov rdx, r14
lea rcx, str.Could_not_open_GUID_volume__s:__s
mov r8, rax
jmp 0x14000cd11
xor eax, eax
mov dword [rsp + 0x28], 0xc8
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x5c]
mov rcx, rsi
lea r14, [rsi - 1]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf0]
mov edx, 0x560000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x14000cfc4
cmp dword [rsp + 0x5c], 0
je 0x14000cf93
xor edi, edi
cmp r14, 0xfffffffffffffffd
ja 0x14000cdf2
mov rcx, rsi
or rdi, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [rsp + 0xf0]
test eax, eax
jne 0x14000ce16
lea rdx, [rsp + 0x1b8]
lea rcx, str.Ignoring_volume__s_because_it_has_no_extents...
test ebx, ebx
jne 0x14000ceeb
jmp 0x14000ce31
dec eax
je 0x14000ce3b
test ebx, ebx
jne 0x14000ceeb
lea rdx, [rsp + 0x1b8]
lea rcx, str.Ignoring_volume__s_because_it_has_more_than_one_extent__RAID__...
call fcn.140036717
jmp 0x14000ceeb
mov eax, dword [rsp + 0x48]
cmp eax, dword [rsp + 0xf8]
jne 0x14000ceeb
mov eax, dword [rsp + 0x68]
cmp eax, 0x10
jne 0x14000ce6d
mov edx, 0x10
lea rcx, str.Error:_Trying_to_process_a_disk_with_more_than__d_partitions_
xor esi, esi
call fcn.140036717
jmp 0x14000cf7e
cmp dword [rsp + 0x420], 0
je 0x14000ce80
mov byte [rsp + r15 + 0x1b8], 0x5c
mov rdx, qword [rsp + 0x100]
lea rsi, [rsp + 0x1b8]
lea rcx, [rsp + 0x60]
mov r8d, 1
mov qword [rsp + rax*8 + 0x70], rdx
mov rdx, rsi
call fcn.14003527d
test ebx, ebx
jne 0x14000ceeb
mov r14, qword [0x1400b1dc0]
mov eax, dword [r14]
test r13d, r13d
je 0x14000cecb
test eax, eax
je 0x14000cee8
lea rcx, str.Windows_volumes_from_this_device:
call fcn.140036717
cmp dword [r14], 0
je 0x14000cee8
mov r8, qword [rsp + 0x100]
mov rdx, rsi
lea rcx, str.__s___lld
call fcn.140036717
xor r13d, r13d
inc dword [rsp + 0x4c]
inc rdi
je 0x14000cb82
mov edx, dword [rsp + 0x68]
xor esi, esi
test edx, edx
je 0x14000cf7e
xor eax, eax
lea r8, [rsp + 0x70]
mov ecx, eax
test r12, r12
je 0x14000cf23
cmp edx, eax
jbe 0x14000cf23
lea rcx, [rax + 1]
cmp qword [r8 + rax*8], r12
je 0x14000cf27
mov rax, rcx
jmp 0x14000cf09
cmp ecx, edx
jae 0x14000cf43
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + rax*8]
test rsi, rsi
je 0x14000cf7e
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__strdup]
mov rsi, rax
jmp 0x14000cf7e
mov r8d, dword [rsp + 0x420]
mov r9d, ebx
mov rdx, r12
mov ecx, ebp
call fcn.14000c95a
mov rsi, rax
test rax, rax
je 0x14000cf7e
mov edx, 0x20
mov rcx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14000cf7e
lea rcx, str.Warning:_Using_physical_device_to_access_partition_data
call fcn.140036717
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x14000cfd2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_FindVolumeClose]
jmp 0x14000cfd2
lea rdx, str._empty_data_
test ebx, ebx
jne 0x14000cfaa
lea rcx, str.Could_not_get_Disk_Extents:__s
call fcn.140036717
xor edi, edi
cmp r14, 0xfffffffffffffffd
ja 0x14000ceeb
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14000cd16
test ebx, ebx
jne 0x14000cfaa
call fcn.140036bd7
mov rdx, rax
jmp 0x14000cf9e
lea rcx, [rsp + 0x60]
call fcn.1400353aa
mov rax, rsi
add rsp, 0x3c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret