Function at 0x100045384
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebp, ebp
mov rax, r8
mov rbx, rdx
mov qword [rsp + 0x58], rdx
mov r14, rcx
mov qword [rsp + 0x50], rax
mov r13d, ebp
mov dword [rsp + 0x38], ebp
mov r12d, ebp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x34], bp
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x100045413
bt dword [rcx + 0x1c], 9
jae 0x100045413
cmp byte [rcx + 0x19], 4
jb 0x100045413
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x36]
lea r8, [0x100003cb8]
call fcn.10001c854
mov rax, qword [rsp + 0x50]
mov dil, bpl
mov byte [rsp + 0x30], bpl
mov r15d, 1
cmp rbx, rbp
jne 0x1000454f9
mov ebx, 0x80004003
lea r14, [0x1001653b8]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.100144c10
mov rax, qword [rsp + 0x48]
cmp rax, rbp
je 0x100045458
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp ebx, ebp
jge 0x10004548c
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000454ba
test byte [rcx + 0x1c], r15b
je 0x100045493
cmp byte [rcx + 0x19], 2
jb 0x100045493
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cb8]
mov edx, 0x40
mov r9d, ebx
call fcn.10001c878
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000454ba
bt dword [rcx + 0x1c], 9
jae 0x1000454ba
cmp byte [rcx + 0x19], 4
jb 0x1000454ba
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cb8]
mov edx, 0x41
call fcn.10001c854
cmp dil, bpl
je 0x1000454cc
lea rcx, [0x1001665a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10014e600
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbx], ebp
cmp rax, rbp
je 0x10004542a
mov rcx, r14
mov qword [rax], rbp
call fcn.100059564
cmp eax, ebp
mov ebx, eax
jl 0x10004542f
test byte [0x100166664], r15b
je 0x100045559
lea rcx, [0x100000000]
lea rax, [rcx + 0x166a30]
lea rcx, [rcx + 0xf0f8]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x10004554d
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x10004554d
mov eax, ebp
jmp 0x100045552
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x100045559
mov bpl, r15b
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x48]
call fcn.1000a1180
xor ebx, ebx
cmp eax, ebx
jge 0x10004559c
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10004559c
test byte [rcx + 0x1c], r15b
je 0x10004559c
cmp byte [rcx + 0x19], 3
jb 0x10004559c
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x37]
lea r8, [0x100003cb8]
mov r9d, eax
call fcn.10001c878
mov edi, 0x104
lea rcx, [rsp + 0x60]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x100045603
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000455ee
test byte [rcx + 0x1c], 1
je 0x1000455ee
cmp byte [rcx + 0x19], 2
jb 0x1000455ee
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x39]
lea r8, [0x100003cb8]
mov r9d, eax
call fcn.10001c878
movzx ebx, di
xor ebp, ebp
or ebx, 0x80070000
cmp edi, ebp
cmovle ebx, edi
jmp 0x100045973
mov esi, 1
lea rdx, [rsp + 0x60]
mov r8d, edi
mov rcx, r15
add r13d, esi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, ebx
jne 0x100045608
mov dword [rsp + 0x38], r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
jne 0x100045a65
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov r15d, esi
cmp bpl, bl
je 0x10004564f
add r13d, esi
mov dword [rsp + 0x38], r13d
mov ebx, r13d
imul rbx, rbx, 0x78
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
xor edi, edi
mov rsi, rax
mov qword [rsp + 0x40], rax
cmp rax, rdi
jne 0x10004567a
mov ebx, 0x8007000e
xor ebp, ebp
jmp 0x10004542f
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
cmp bpl, dil
je 0x10004578d
xor ebp, ebp
cmp r13d, ebp
ja 0x1000456af
lea r8, [0x100005f48]
lea rcx, [0x100005e40]
mov edx, 0x39e
call fcn.10009a050
lea rcx, [0x1001665a0]
mov bl, bpl
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [r14 + 0x68]
mov dil, r15b
cmp rcx, rbp
je 0x100045727
mov rdx, rsi
call fcn.100145360
cmp eax, ebp
mov ebx, eax
jge 0x100045721
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x100045436
test byte [rcx + 0x1c], r15b
je 0x100045436
cmp byte [rcx + 0x19], 2
jb 0x100045436
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cb8]
mov edx, 0x3a
mov r9d, eax
call fcn.10001c878
jmp 0x100045436
mov r12d, r15d
mov bl, r15b
lea rcx, [0x1001665a0]
mov byte [rsp + 0x30], bpl
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp bl, bpl
jne 0x10004578f
mov r8, rsi
mov dl, r15b
xor ecx, ecx
call fcn.1000519ec
cmp eax, ebp
jge 0x100045788
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x100045796
test byte [rcx + 0x1c], r15b
je 0x100045796
cmp byte [rcx + 0x19], 3
jb 0x100045796
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cb8]
mov edx, 0x3b
mov r9d, eax
call fcn.10001c878
jmp 0x100045796
add r12d, r15d
jmp 0x10004578f
xor ebp, ebp
lea r14, [0x1001653b8]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1000457f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000457e6
test byte [rcx + 0x1c], 1
je 0x1000457e6
cmp byte [rcx + 0x19], 2
jb 0x1000457e6
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x3d]
lea r8, [0x100003cb8]
mov r9d, eax
call fcn.10001c878
movzx ebx, di
or ebx, 0x80070000
cmp edi, ebp
cmovle ebx, edi
jmp 0x10004597a
movzx r14d, word [rsp + 0x34]
movsxd rbp, r12d
imul rbp, rbp, 0x78
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor edx, edx
cmp eax, 3
lea eax, [rdx + 1]
movzx ecx, dl
cmove ecx, eax
mov ebx, edx
cmp cl, dl
je 0x10004591e
cmp r12d, r13d
jb 0x10004587d
lea ebx, [r13 + 8]
mov rcx, rsi
mov edx, ebx
imul rdx, rdx, 0x78
call qword [sym.imp.ole32.dll_CoTaskMemRealloc]
mov rsi, rax
test rax, rax
je 0x100045999
mov r8d, ebx
mov ecx, r13d
xor edx, edx
sub r8d, r13d
imul rcx, rcx, 0x78
add rcx, rax
imul r8, r8, 0x78
call sub.msvcrt.dll_memset
mov r13d, ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x40], rsi
cmp r12d, ebx
jae 0x10004596c
lea rdi, [rsi + rbp]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8, rdi
call fcn.1000519ec
xor ecx, ecx
cmp eax, ecx
mov ebx, eax
jge 0x1000458e9
cmp eax, 0x8007000e
je 0x100045971
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000458e5
bt dword [rcx + 0x1c], 9
jae 0x1000458e5
cmp byte [rcx + 0x19], 3
jb 0x1000458e5
mov rcx, qword [rcx + 0x10]
lea rax, [rsp + 0x60]
lea r8, [0x100003cb8]
mov edx, 0x3d
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.10001d9dc
xor ebx, ebx
jmp 0x10004591e
mov rax, qword [rsp + 0x48]
cmp rax, rcx
je 0x100045917
mov rdx, qword [rdi + 0x60]
cmp rdx, rcx
je 0x100045917
cmp r14w, word [rdi + 0x5c]
jne 0x100045917
movzx r8d, r14w
mov rcx, rax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x100045917
or dword [rdi + 0x58], 2
inc r12d
add rbp, 0x78
lea rdx, [rsp + 0x60]
mov r8d, 0x104
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x100045806
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
jne 0x100045a1c
xor ebp, ebp
cmp r12d, ebp
jne 0x1000459a0
cmp rsi, rbp
je 0x1000459ea
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, rbp
jmp 0x100045a02
mov ebx, 0x8000ffff
xor ebp, ebp
lea r14, [0x1001653b8]
cmp r15, 0xffffffffffffffff
je 0x100045989
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov dil, byte [rsp + 0x30]
mov r15d, 1
jmp 0x100045436
mov ebx, 0x8007000e
jmp 0x100045971
cmp r12d, r13d
jbe 0x1000459ea
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x1000459e3
mov eax, 1
test byte [rcx + 0x1c], al
je 0x1000459e3
cmp byte [rcx + 0x19], 2
jb 0x1000459e3
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x3e]
lea r8, [0x100003cb8]
mov r9d, r12d
mov dword [rsp + 0x20], r13d
call fcn.10001d914
mov ebx, 0x8000ffff
jmp 0x10004597a
xor r8d, r8d
mov edx, r12d
mov rcx, rsi
call fcn.10011d610
cmp eax, ebp
mov ebx, eax
jl 0x100045973
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rbp
mov dword [rax], r12d
mov rax, qword [rsp + 0x50]
mov qword [rax], rsi
jmp 0x100045973
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x100045a55
mov eax, 1
test byte [rcx + 0x1c], al
je 0x100045a55
cmp byte [rcx + 0x19], 2
jb 0x100045a55
lea edx, [rax + 0x3d]
mov r9d, edi
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cb8]
call fcn.10001c878
movzx ebx, di
or ebx, 0x80070000
xor ebp, ebp
jmp 0x1000457ef
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x100045a55
test byte [rcx + 0x1c], sil
je 0x100045a55
cmp byte [rcx + 0x19], 2
jb 0x100045a55
mov edx, 0x39
mov r9d, eax
jmp 0x100045a45