Function at 0x140029504
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r14, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rax + 0x10], r12d
mov qword [rax - 0x58], r12
mov dword [rax + 0x20], r12d
mov qword [rdx], r12
lea r8, str.CVdsVolume::QueryAccessPathsToVolume__
lea ebp, [r12 + 0x5e]
mov edx, ebp
lea rcx, [rax - 0x48]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64]
nop dword [rax + rax]
nop
lea r9, [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x88]
add rbx, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rbx
lea ebx, [rbp - 0x56]
mov edx, ebx
call qword [sym.imp.vdsutil.dll_VdsHeapAlloc]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140029706
lea r9, [rsp + 0x98]
mov r8d, dword [rsp + 0x88]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140029616
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov r9d, eax
lea r8, str.CVdsVolume::QueryAccessPathsToVolume:_GetVolumePathNamesForVolumeName_failed:__X
xor edx, edx
mov ecx, ebp
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
jmp 0x140029706
mov rax, rsi
mov edi, r12d
cmp word [rsi], r12w
je 0x140029703
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x14002962a
lea rax, [rax + rcx*2]
add rax, 2
inc edi
cmp word [rax], r12w
jne 0x140029626
test edi, edi
je 0x140029703
mov ebp, edi
shl rbp, 3
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [r14], rax
test rax, rax
je 0x140029706
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r13, rsi
mov r15d, r12d
test edi, edi
je 0x1400296f9
xor eax, eax
or rbp, 0xffffffffffffffff
inc rbp
cmp word [r13 + rbp*2], ax
jne 0x14002968a
lea rcx, [rbp*2 + 2]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [r14]
mov qword [r12 + rax], rcx
mov rcx, qword [r14]
mov rax, qword [r12 + rcx]
test rax, rax
je 0x14002975d
lea rdx, [rbp + 1]
mov r9, rbp
mov r8, r13
mov rcx, rax
call fcn.14001f28c
mov rax, qword [r14]
mov rcx, qword [r12 + rax]
xor eax, eax
mov word [rcx + rbp*2], ax
lea r13, [r13 + rbp*2]
add r13, 2
inc r15d
add r12, rbx
cmp r15d, edi
jb 0x140029686
xor r12d, r12d
mov rax, qword [rsp + 0x90]
mov dword [rax], edi
mov ebx, r12d
lea rcx, [rsp + 0x30]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
test rsi, rsi
je 0x140029742
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.vdsutil.dll_VdsHeapFree]
nop dword [rax + rax]
mov qword [rsp + 0x20], r12
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r12d, r12d
test r15d, r15d
je 0x14002979c
mov edi, r12d
mov ebp, r15d
mov rax, rcx
mov rdx, qword [rdi + rax]
test rdx, rdx
je 0x140029793
mov rcx, rdx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [r14]
mov qword [rdi + rax], r12
mov rax, qword [r14]
mov rcx, rax
add rdi, rbx
sub rbp, 1
jne 0x14002976e
test rcx, rcx
je 0x140029706
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [r14], r12
jmp 0x140029706