Function at 0x40d2f0
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov eax, 0x1298
call fcn.0041e040
sub rsp, rax
mov rax, qword [0x0042baf8]
mov qword [rsp + 0x1270], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x12b8], rbx
mov qword [rsp + 0x1290], rbp
cmp dword [rax], 0
mov qword [rsp + 0x1288], rsi
mov ebp, r8d
mov dword [rsp + 0x44], r8d
mov rsi, rdx
mov rbx, rcx
jne 0x40d671
mov rcx, qword [rcx + 0x2b0]
mov rcx, qword [rcx + 0x128]
call qword [rbx + 0x2a8]
lea rdx, [rsp + 0x460]
mov r8d, 0x200
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x40d3d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x40d399
mov r8, qword [rbx + 0x2b0]
mov r9, rsi
xor edx, edx
mov r8, qword [r8 + 0x1c8]
xor ecx, ecx
call qword [rbx + 0x298]
jmp 0x40d671
lea rdx, [rsp + 0x860]
mov ecx, eax
call sym.JkDefragCmd64.exe_SystemErrorStr
mov r8, qword [rbx + 0x2b0]
lea rax, [rsp + 0x860]
mov r8, qword [r8 + 0x140]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [rbx + 0x298]
jmp 0x40d671
lea rcx, [rsp + 0x460]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x40d404
mov rcx, qword [rbx + 0x2b0]
mov rdx, rsi
mov rcx, qword [rcx + 0x118]
call qword [rbx + 0x2a8]
jmp 0x40d671
lea rax, [rsp + 0x40]
mov qword [rsp + 0x1280], rdi
xor edi, edi
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x460]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
bt dword [rsp + 0x40], 0x13
jae 0x40d460
mov rcx, qword [rbx + 0x2b0]
mov rdx, rsi
mov rcx, qword [rcx + 0x120]
call qword [rbx + 0x2a8]
jmp 0x40d669
lea r8, [rsp + 0x460]
lea rcx, [rsp + 0x60]
mov edx, 0x200
call fcn.0040f730
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.004107b0
lea rcx, [rsp + 0x60]
cmp rax, rcx
je 0x40d498
cmp word [rax - 2], 0x5c
jne 0x40d498
mov word [rax - 2], di
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x60]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x40d513
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x860]
mov ecx, eax
call sym.JkDefragCmd64.exe_SystemErrorStr
mov r8, qword [rbx + 0x2b0]
lea rax, [rsp + 0x860]
mov r8, qword [r8 + 0xf0]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea ecx, [rdi + 2]
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [rbx + 0x298]
jmp 0x40d669
xor ecx, ecx
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov edx, 0x90028
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x40d575
mov r8, qword [rbx + 0x2b0]
lea r9, [rsp + 0x60]
xor edx, edx
mov r8, qword [r8 + 0xf8]
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [rbx + 0x298]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d669
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call fcn.0040c7b0
lea rdx, [rsp + 0xc60]
lea rcx, [rsp + 0x460]
mov r8d, 0x304
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x40d669
nop
nop
nop
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
lea rdi, [rsp + 0xc60]
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rax, [rdx + rcx]
mov qword [rsp + 0x48], rax
lea rcx, [rax + rax]
call fcn.00410900
test rax, rax
mov rdi, rax
je 0x40d641
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0xc60]
lea r8, [0x004225a8]
mov r9, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.0040f7a0
mov r8d, dword [rsp + 0x44]
mov rdx, rdi
mov rcx, rbx
call fcn.0040d2f0
mov rcx, rdi
call fcn.004109b0
lea rdx, [rsp + 0xc60]
mov r8d, 0x304
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
test eax, eax
jne 0x40d5c0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
mov rdi, qword [rsp + 0x1280]
mov rsi, qword [rsp + 0x1288]
mov rbp, qword [rsp + 0x1290]
mov rbx, qword [rsp + 0x12b8]
mov rcx, qword [rsp + 0x1270]
call fcn.0041e010
add rsp, 0x1298
ret