Function at 0x100074c40
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
xor r15d, r15d
mov rsi, rcx
cmp dword [rax - 8], r15d
jne 0x100074c83
lea rcx, [0x100002dec]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [0x100002dec]
lea rcx, [rsi + 0x38]
mov edx, eax
call fcn.100016504
jmp 0x100074ec7
mov rax, qword [0x1000a1180]
mov ebx, 0x32
lea rcx, [rsp + 0x68]
mov edx, ebx
mov qword [rsp + 0x68], rax
call fcn.100016600
mov rcx, qword [rsi + 0x28]
mov r8d, ebx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
lea rcx, [rsp + 0x68]
call fcn.1000166e4
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov dword [rbx - 8], eax
mov word [rbx + rcx*2], r15w
mov rax, qword [0x1000a1180]
mov ebx, 0x50
lea rcx, [rsp + 0x70]
mov edx, ebx
mov qword [rsp + 0x70], rax
call fcn.100016600
mov edx, ebx
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
or r14, 0xffffffffffffffff
mov rbp, rax
cmp rax, r14
jne 0x100074d5f
mov rcx, qword [rsp + 0x70]
lea rdi, [0x1000a1170]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x100074d33
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r15d
jg 0x100074d33
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x100074d55
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r15d
jg 0x100074d55
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, 0x80004005
jmp 0x100074ec9
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rdx, rax
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x100074d82
add rax, 2
test r8d, r8d
jne 0x100074d6c
lea rdi, [0x1000a1170]
jmp 0x100074dc6
mov r8d, ebx
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, r15d
je 0x100074e53
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rdx, rax
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x100074dc6
add rax, 2
test r8d, r8d
jne 0x100074db0
cmp ecx, r15d
jne 0x100074d8b
mov rax, qword [0x1000a1180]
lea rcx, [rsp + 0x78]
mov edx, 0x10
mov qword [rsp + 0x78], rax
call fcn.100016600
lea r9, [rsp + 0x60]
mov r8d, 0x10
mov rcx, r12
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
lea rcx, [rsp + 0x78]
mov word [rbx + 4], r15w
call fcn.1000166e4
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x78]
movsxd rcx, eax
mov dword [rbx - 8], eax
mov word [rbx + rcx*2], r15w
lea rcx, [rsi + 0x38]
call fcn.10001c054
lea rcx, [rbx - 0xc]
cmp rcx, rdi
je 0x100074e53
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r15d
jg 0x100074e53
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
lea rcx, [rsp + 0x70]
call fcn.1000166e4
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov dword [rbx - 8], eax
mov word [rbx + rcx*2], r15w
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
lea rcx, [rbx - 0xc]
cmp eax, r15d
je 0x100074d1a
cmp rcx, rdi
je 0x100074ea5
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r15d
jg 0x100074ea5
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x100074ec7
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r15d
jg 0x100074ec7
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret