Function at 0x1400216f0
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6b0]
sub rsp, 0x7b0
mov qword [rbp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x800], rbx
mov rax, qword [0x14016b400]
xor rax, rsp
mov qword [rbp + 0x6a0], rax
mov r14, rdx
mov r15, rcx
lea r13, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], r13
lea rsi, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rsi
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4aa
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
xor r12d, r12d
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [r12 + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.14001cce0
nop
mov rdx, qword [r14 + 0x10]
or rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x1400217a6
cmp rbx, 0x104
jae 0x140053c42
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140054029
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
call qword [0x1400f9ec0]
test al, al
je 0x140054029
lea r8d, [rbx + 1]
lea rdx, [rbp + 0x70]
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
test eax, eax
je 0x140053c52
lea rax, [rbp + 0x70]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140021800
test rbx, rbx
je 0x140021a33
mov rcx, qword [r14 + 0x10]
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140021820
cmp rbx, rax
ja 0x1400219d9
mov r8, rbx
lea rdx, [rbp + 0x70]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x1400219d9
mov rdx, qword [r14 + 0x10]
call fcn.140020920
test al, al
jne 0x140053ccc
mov edx, 0x104
lea rax, [rbp + 0x70]
mov esi, r12d
nop word [rax + rax]
lea rcx, [rdx + 0x7ffffefa]
test rcx, rcx
je 0x140021891
cmp word [rax], r12w
je 0x140021891
add rax, 2
sub rdx, 1
jne 0x140021870
jmp 0x140053d2c
test rdx, rdx
je 0x140053d2c
mov word [rax], r12w
mov dword [rbp - 8], esi
test esi, esi
js 0x140053d3a
add rbx, rbx
cmp word [rbp + rbx + 0x6e], 0x5c
jne 0x140053dae
mov r8d, 0x104
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x140053fc4
mov dword [rbp - 8], r12d
mov qword [rbp - 0x20], r12
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140053eca
mov rax, qword [rcx]
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x490]
mov rax, qword [rax + 0x48]
call qword [0x1400f9ec0]
mov esi, eax
mov dword [rbp - 8], eax
test eax, eax
js 0x140053ed2
mov rcx, qword [r14 + 0x10]
add rcx, rbx
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp - 0x20]
lea r8, [0x1400fd5a8]
mov edx, 0x104
lea rcx, [rbp + 0x280]
call fcn.140027130
mov ebx, eax
mov dword [rbp - 8], eax
test eax, eax
js 0x140053f35
lea rax, [rbp + 0x280]
nop dword [rax]
lea rdi, [rdi + 1]
cmp word [rax + rdi*2], 0
jne 0x140021950
cmp word [rbp + rdi*2 + 0x27e], 0x5c
je 0x140053f9f
lea rcx, [r14 + 8]
lea rdx, [rbp + 0x280]
call fcn.1400189f0
lea rax, str.TRUE
mov qword [rsp + 0x20], rax
lea r9, str.Returning_BOOL:__s
mov r8d, 0xaa
lea rdx, str.RETURN
lea rcx, [rbp - 0x10]
call fcn.14001d380
nop
lea rcx, [rbp - 0x10]
call fcn.14001ce00
mov al, 1
mov rcx, qword [rbp + 0x6a0]
xor rcx, rsp
call fcn.1400321c0
mov rbx, qword [rsp + 0x800]
add rsp, 0x7b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], rsi
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4df
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
lea r8, str.not_a_prefix__so_skipping
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.14001cc70
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.14001cbf4
movzx ebx, al
lea rcx, [rbp - 0x10]
call fcn.14001ce00
movzx eax, bl
jmp 0x1400219af
lea rcx, [rbp - 0x10]
call fcn.14001ce00
xor al, al
jmp 0x1400219af
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], rsi
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4c4
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov rbx, qword [r14 + 0x20]
mov rdi, qword [r14 + 0x10]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9, rdi
lea r8, str.GetVolumePathName__s_s__failed_with__d
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.14001cc70
nop
jmp 0x140021a33
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], rsi
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4e5
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
lea r8, str.reparse_point_found_on_path__so_skipping
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.14001cc70
nop
jmp 0x140021a33
sub rax, 2
mov esi, 0x8007007a
jmp 0x14002189a
mov qword [rsp + 0x38], r13
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4ed
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, esi
lea r8, str.StringCchCopy_failed_with_0x_08lx__winerror__d
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.14001cc70
nop
jmp 0x140021a33
mov ecx, 0x104
lea rax, [rbp + 0x70]
cmp word [rax], 0
je 0x140053dc7
add rax, 2
sub rcx, 1
jne 0x140053db7
mov esi, 0x80070057
test rcx, rcx
cmovne esi, r12d
mov eax, 0x104
sub rax, rcx
mov r8, r12
test rcx, rcx
cmovne r8, rax
je 0x140053e46
mov ecx, 0x104
sub rcx, r8
lea rdx, [rbp + 0x70]
lea rdx, [rdx + r8*2]
je 0x140053e2e
lea rax, [r8 + 0x7ffffefa]
add rax, rcx
lea r9, [0x1400fd76c]
sub r9, rdx
test rax, rax
je 0x140053e2e
movzx r8d, word [r9 + rdx]
test r8w, r8w
je 0x140053e2e
mov word [rdx], r8w
add rdx, 2
dec rax
sub rcx, 1
jne 0x140053e0d
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r12w
mov esi, 0x8007007a
cmovne esi, r12d
mov dword [rbp - 8], esi
mov eax, esi
shr eax, 0x1f
test al, al
je 0x1400218b8
mov qword [rsp + 0x38], r13
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4fb
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, esi
lea r8, str.StringCchCat_failed_with_0x_08lx__winerror__d
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.14001cc70
nop
jmp 0x140021a33
mov esi, 0x80004005
mov dword [rbp - 8], esi
mov qword [rsp + 0x38], r13
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x517
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x490]
lea r8, str.GetSnapshotDeviceName__s__failed_with_0x_08lx
jmp 0x140054082
mov qword [rsp + 0x38], r13
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x529
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov r9d, ebx
lea r8, str.StringCchPrintf_failed_with_0x_08lx
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.14001cc70
nop
jmp 0x140021a33
lea rdi, [rdi*2 - 2]
cmp rdi, 0x208
jae 0x140053fbe
mov word [rbp + rdi + 0x280], r12w
jmp 0x14002196a
call fcn.1400324a4
int3
mov esi, 0x80004005
mov dword [rbp - 8], esi
mov qword [rsp + 0x38], r13
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x50a
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x70]
lea r8, str.GetVolumeNameForVolumeMountPoint__s__failed_with_0x_08lx
jmp 0x140054082
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], rsi
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4b7
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov rax, qword [r14 + 0x20]
mov qword [rsp + 0x20], rax
mov r9, qword [r14 + 0x10]
lea r8, str.skipping_deletion_of__s_s_since_its_not_included_on_a_snapshot
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.14001cc70
nop
jmp 0x140021a33