Function at 0x140007e51
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3c8
xor eax, eax
mov ebp, ecx
lea rdi, [rsp + 0x70]
mov ecx, 0x20
mov r12, rdx
rep stosd dword [rdi], eax
mov edx, 0x10
lea rcx, [rsp + 0x60]
mov ebx, r9d
mov dword [rsp + 0x420], r8d
xor r8d, r8d
mov dword [rsp + 0x5c], r8d
call fcn.140036916
test ebp, ebp
jns 0x140007ea4
xor esi, esi
jmp 0x14000832d
lea eax, [rbp - 0x80]
mov r8d, 0x109
lea rdx, str.drive.c
mov dword [rsp + 0x48], eax
lea rcx, str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
cmp eax, 0x40
ja 0x140007f8e
xor ecx, ecx
mov r13d, 1
mov qword [rsp + 0x40], 0xffffffffffffffff
mov dword [rsp + 0x4c], ecx
cmp dword [rsp + 0x4c], 0
lea r14, [rsp + 0x1b8]
jne 0x140007f21
mov edx, 0x104
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_FindFirstVolumeA]
mov qword [rsp + 0x40], rax
inc rax
jne 0x140007f69
test ebx, ebx
jne 0x140007e9d
call fcn.140038579
lea rcx, str.Could_not_access_first_GUID_volume:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x140007e9d
mov rcx, qword [rsp + 0x40]
mov r8d, 0x104
mov rdx, r14
call qword [sym.imp.KERNEL32.DLL_FindNextVolumeA]
test eax, eax
jne 0x140007f69
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
je 0x140008253
test ebx, ebx
jne 0x140008253
call fcn.140038579
lea rcx, str.Could_not_access_next_GUID_volume:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x140008253
mov rcx, r14
call sub.msvcrt.dll_strlen
mov rdi, rax
cmp rax, 4
ja 0x140007f94
mov r8d, 0x11d
lea rdx, str.drive.c
lea rcx, str.len___4
call qword [sym.imp.msvcrt.dll__wassert]
mov rsi, qword [sym.imp.msvcrt.dll__strnicmp]
mov r8d, 4
lea rdx, [0x1400889ba]
mov rcx, r14
call rsi
test eax, eax
je 0x140007fc7
mov r8d, 0x11e
lea rdx, str.drive.c
lea rcx, str.safe_strnicmp_volume_name__volume_start__4___0
jmp 0x140007f8e
cmp byte [rsp + rdi + 0x1b7], 0x5c
lea r15, [rdi - 1]
je 0x140007feb
mov r8d, 0x11f
lea rdx, str.drive.c
lea rcx, str.volume_name_len___1___
jmp 0x140007f8e
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
sub eax, 2
cmp eax, 1
ja 0x140008071
lea rdi, [rsp + 0x2bc]
lea rcx, [rsp + 0x1bc]
mov byte [rsp + r15 + 0x1b8], 0
mov r8d, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
test eax, eax
je 0x140008056
mov r8d, 0xd
lea rdx, str.DeviceCdRom
mov rcx, rdi
call rsi
test eax, eax
je 0x1400080ba
mov r8d, 0xe
lea rdx, str.DeviceFloppy
mov rcx, rdi
call rsi
test eax, eax
jne 0x14000807a
jmp 0x1400080ba
test ebx, ebx
jne 0x140008071
call fcn.140038579
mov rdx, r14
lea rcx, str.Failed_to_get_device_path_for_GUID_volume__s:__s
mov r8, rax
call fcn.1400380b9
or rdi, 0xffffffffffffffff
jmp 0x140008246
xor edx, edx
mov dword [rsp + 0x38], 0xbb8
xor r9d, r9d
mov rcx, r14
mov qword [rsp + 0x30], rdx
mov r8d, 3
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call fcn.140038f13
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400080e7
jmp 0x1400080cf
test ebx, ebx
jne 0x140008071
mov rdx, rdi
lea rcx, str.Skipping_GUID_volume_for__s
call fcn.1400380b9
jmp 0x140008071
test ebx, ebx
jne 0x140008071
call fcn.140038579
mov rdx, r14
lea rcx, str.Could_not_open_GUID_volume__s:__s
mov r8, rax
jmp 0x14000806c
xor eax, eax
mov dword [rsp + 0x28], 0xc8
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x5c]
mov rcx, rsi
lea r14, [rsi - 1]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf0]
mov edx, 0x560000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x14000831f
cmp dword [rsp + 0x5c], 0
je 0x1400082ee
xor edi, edi
cmp r14, 0xfffffffffffffffd
ja 0x14000814d
mov rcx, rsi
or rdi, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [rsp + 0xf0]
test eax, eax
jne 0x140008171
lea rdx, [rsp + 0x1b8]
lea rcx, str.Ignoring_volume__s_because_it_has_no_extents...
test ebx, ebx
jne 0x140008246
jmp 0x14000818c
dec eax
je 0x140008196
test ebx, ebx
jne 0x140008246
lea rdx, [rsp + 0x1b8]
lea rcx, str.Ignoring_volume__s_because_it_has_more_than_one_extent__RAID__...
call fcn.1400380b9
jmp 0x140008246
mov eax, dword [rsp + 0x48]
cmp eax, dword [rsp + 0xf8]
jne 0x140008246
mov eax, dword [rsp + 0x68]
cmp eax, 0x10
jne 0x1400081c8
mov edx, 0x10
lea rcx, str.Error:_Trying_to_process_a_disk_with_more_than__d_partitions_
xor esi, esi
call fcn.1400380b9
jmp 0x1400082d9
cmp dword [rsp + 0x420], 0
je 0x1400081db
mov byte [rsp + r15 + 0x1b8], 0x5c
mov rdx, qword [rsp + 0x100]
lea rsi, [rsp + 0x1b8]
lea rcx, [rsp + 0x60]
mov r8d, 1
mov qword [rsp + rax*8 + 0x70], rdx
mov rdx, rsi
call fcn.140036956
test ebx, ebx
jne 0x140008246
mov r14, qword [0x1400b4fe0]
mov eax, dword [r14]
test r13d, r13d
je 0x140008226
test eax, eax
je 0x140008243
lea rcx, str.Windows_volumes_from_this_device:
call fcn.1400380b9
cmp dword [r14], 0
je 0x140008243
mov r8, qword [rsp + 0x100]
mov rdx, rsi
lea rcx, str.__s___lld
call fcn.1400380b9
xor r13d, r13d
inc dword [rsp + 0x4c]
inc rdi
je 0x140007edd
mov edx, dword [rsp + 0x68]
xor esi, esi
test edx, edx
je 0x1400082d9
xor eax, eax
lea r8, [rsp + 0x70]
mov ecx, eax
test r12, r12
je 0x14000827e
cmp edx, eax
jbe 0x14000827e
lea rcx, [rax + 1]
cmp qword [r8 + rax*8], r12
je 0x140008282
mov rax, rcx
jmp 0x140008264
cmp ecx, edx
jae 0x14000829e
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + rax*8]
test rsi, rsi
je 0x1400082d9
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__strdup]
mov rsi, rax
jmp 0x1400082d9
mov r8d, dword [rsp + 0x420]
mov r9d, ebx
mov rdx, r12
mov ecx, ebp
call fcn.140007cb5
mov rsi, rax
test rax, rax
je 0x1400082d9
mov edx, 0x20
mov rcx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1400082d9
lea rcx, str.Warning:_Using_physical_device_to_access_partition_data
call fcn.1400380b9
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x14000832d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_FindVolumeClose]
jmp 0x14000832d
lea rdx, str._empty_data_
test ebx, ebx
jne 0x140008305
lea rcx, str.Could_not_get_Disk_Extents:__s
call fcn.1400380b9
xor edi, edi
cmp r14, 0xfffffffffffffffd
ja 0x140008246
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140008071
test ebx, ebx
jne 0x140008305
call fcn.140038579
mov rdx, rax
jmp 0x1400082f9
lea rcx, [rsp + 0x60]
call fcn.140036a83
mov rax, rsi
add rsp, 0x3c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret