Function at 0x1400b10f4
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov qword [rbp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x2f0], rbx
mov rax, qword [0x14016b400]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
movzx r12d, r9b
mov r13, r8
mov rdi, rdx
mov qword [rsp + 0x30], rdx
lea rbx, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rbx
lea r14, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], r14
lea r15, str.CORHIMPC
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], 0x831
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
xor esi, esi
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rsi + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.14001cce0
nop
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], 0x835
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rsi + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov r8d, 0x1a3
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.14001d400
mov r15d, esi
cmp dword [r13], esi
jbe 0x1400b175c
mov eax, r15d
lea r14, [rax + rax*4]
shl r14, 4
add r14, qword [r13 + 8]
mov rbx, qword [r14 + 0x38]
test rbx, rbx
je 0x1400b146a
lea rax, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x83f
mov dword [rsp + 0x64], 6
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov r9, rbx
lea r8, str.INFO:_Attempting_to_create_a_Volume_Name_for_hidden_volume_device__s...
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.14001cc70
mov rcx, qword [r14 + 0x38]
or rdi, 0xffffffffffffffff
mov rax, rdi
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400b1297
lea edx, [rax + 2]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
mov qword [rbp - 8], rax
mov r9, qword [r14 + 0x38]
mov rdx, rdi
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1400b12bb
add rdx, 2
lea r8, [0x14010e6f8]
mov rcx, rbx
call fcn.140027130
mov edi, eax
mov dword [rbp + 8], eax
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x1400b18ec
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp + 0x120]
call sub.msvcrt.dll_memset
mov r8d, 0x40
lea rdx, [rbp + 0x120]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x1400b1869
lea rcx, [rbp + 0x120]
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400b1328
cmp word [rbp + rax*2 + 0x11e], 0x5c
jne 0x1400b135a
lea rax, [rax*2 - 2]
cmp rax, 0x80
jae 0x1400b178f
mov word [rbp + rax + 0x120], si
lea rdi, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rdi
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x857
mov dword [rsp + 0x64], 6
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov rax, qword [r14 + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x120]
lea r8, str.Found_volume_name__s_for_device__s
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.14001cc70
lea rax, [rbp + 0x120]
or r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400b13e0
inc rcx
mov eax, 2
mul rcx
cmovo rax, r8
lea rdx, [0x140102ed8]
mov rcx, rax
call fcn.140032688
mov rsi, rax
test rax, rax
je 0x1400b1801
lea rax, [rbp + 0x120]
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400b141f
inc rdx
lea r8, [rbp + 0x120]
mov rcx, rsi
call fcn.1400109f0
mov edi, eax
mov dword [rbp + 8], eax
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x1400b1795
mov rcx, qword [r14 + 0x38]
call fcn.140031d4c
mov qword [r14 + 0x38], rsi
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rdi, qword [rsp + 0x30]
xor esi, esi
mov qword [rsp + 0x40], rsi
mov rax, qword [rdi]
lea r8, [rsp + 0x40]
mov edx, r15d
mov rcx, rdi
mov rax, qword [rax + 0x70]
call qword [0x1400f9ec0]
mov ebx, eax
mov dword [rbp + 8], eax
lea rax, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x86c
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov eax, ebx
shr eax, 0x1f
test al, al
jne 0x1400b1a21
cmp byte [rbp - 0x15], al
je 0x1400b1525
lea rbx, [rsp + 0x70]
mov edi, 0xf
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400b1516
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], rsi
add rbx, 8
sub rdi, 1
jne 0x1400b1505
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, qword [r14 + 0x38]
mov rax, qword [rax + 0x88]
call qword [0x1400f9ec0]
mov ebx, eax
mov dword [rbp + 8], eax
lea r14, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], r14
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x86e
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov eax, ebx
shr eax, 0x1f
test al, al
jne 0x1400b19de
cmp byte [rbp - 0x15], al
je 0x1400b15dc
lea rbx, [rsp + 0x70]
mov edi, 0xf
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400b15cd
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], rsi
add rbx, 8
sub rdi, 1
jne 0x1400b15bc
mov rdi, qword [rsp + 0x30]
test r12b, r12b
je 0x1400b1745
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rbp - 0x10]
mov rax, qword [rax + 0x40]
call qword [0x1400f9ec0]
mov ebx, eax
mov dword [rbp + 8], eax
mov qword [rsp + 0x48], r14
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x874
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov eax, ebx
shr eax, 0x1f
test al, al
jne 0x1400b199b
cmp byte [rbp - 0x15], al
je 0x1400b1692
lea rbx, [rsp + 0x70]
mov edi, 0xf
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400b1683
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], rsi
add rbx, 8
sub rdi, 1
jne 0x1400b1672
mov rdi, qword [rsp + 0x30]
mov edx, dword [rbp - 0x10]
bts edx, 0x13
mov dword [rbp - 0x10], edx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1400f9ec0]
mov ebx, eax
mov dword [rbp + 8], eax
mov qword [rsp + 0x48], r14
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x877
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov eax, ebx
shr eax, 0x1f
test al, al
jne 0x1400b1958
cmp byte [rbp - 0x15], al
je 0x1400b1745
lea rbx, [rsp + 0x70]
mov edi, 0xf
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400b1736
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], rsi
add rbx, 8
sub rdi, 1
jne 0x1400b1725
mov rdi, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140003878
inc r15d
cmp r15d, dword [r13]
jb 0x1400b1205
lea rcx, [rbp]
call fcn.14001ce00
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400321c0
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400324a4
nop
lea rax, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x862
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r9, str.StringCchPrintf
mov r8d, edi
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.1400dcb7c
int3
mov qword [rsp + 0x48], rdi
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x85c
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r9, str.cant_allocate_device_name
mov r8d, 0x8007000e
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.1400dc25c
int3
lea rax, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x850
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1400b18ce
movzx eax, ax
or eax, 0x80070000
mov qword [rsp + 0x20], rbx
lea r9, str.GetVolumeNameForVolumeMountPoint__s_
mov r8d, eax
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.1400dcb7c
int3
lea rax, str.base_stor_vssmodulescoord_srchwimport.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssHardwareProviderWrapper::WriteDeviceNames
mov qword [rsp + 0x50], rax
lea rax, str.CORHIMPC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x849
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r9, str.StringCchPrintf
mov r8d, edi
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.1400dcb7c
nop
cmp ebx, 0x8000ffff
jne 0x1400b1976
mov dword [rsp + 0x30], ebx
lea rdx, [0x140167770]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll__CxxThrowException
int3
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x78]
call fcn.14000aeb0
lea r9, str.IVssSnapshotDescription::SetAttributes
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp]
call fcn.1400dc9fc
nop
cmp ebx, 0x8000ffff
jne 0x1400b19b9
mov dword [rsp + 0x30], ebx
lea rdx, [0x140167770]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll__CxxThrowException
int3
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x78]
call fcn.14000aeb0
lea r9, str.IVssSnapshotDescription::GetAttributes
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp]
call fcn.1400dc9fc
nop
cmp ebx, 0x8000ffff
jne 0x1400b19fc
mov dword [rsp + 0x30], ebx
lea rdx, [0x140167770]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll__CxxThrowException
int3
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x78]
call fcn.14000aeb0
lea r9, str.IVssSnapshotSetDescription::SetDeviceName
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp]
call fcn.1400dc9fc
nop
cmp ebx, 0x8000ffff
jne 0x1400b1a3f
mov dword [rsp + 0x30], ebx
lea rdx, [0x140167770]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll__CxxThrowException
int3
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x78]
call fcn.14000aeb0
lea r9, str.IVssSnapshotSetDescription::GetSnasphotDescription
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp]
call fcn.1400dc9fc
int3