Function at 0x14009cd40
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x9c0]
sub rsp, 0xac0
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rbp + 0x9a0], rax
mov r15, rdx
mov rdi, rcx
test rdx, rdx
jne 0x14009cd74
xor eax, eax
jmp 0x14009cdf1
mov qword [rsp + 0xae0], rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0xaf0], rsi
mov r8d, 0x20a
mov qword [rsp + 0xab8], r12
xor sil, sil
xor r12d, r12d
mov qword [rsp + 0xab0], r14
mov word [rdx], r12w
xor edx, edx
call fcn.1400b5f30
mov edx, 0x105
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14009ce10
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov r12, qword [rsp + 0xab8]
mov rsi, qword [rsp + 0xaf0]
mov rbx, qword [rsp + 0xae0]
mov r14, qword [rsp + 0xab0]
mov rcx, qword [rbp + 0x9a0]
xor rcx, rsp
call fcn.1400af8c0
add rsp, 0xac0
pop r15
pop rdi
pop rbp
ret
test sil, sil
jne 0x14009cf77
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x14009cf52
mov dword [rsp + 0x38], 0x105
lea rax, [rbp + 0x790]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x14009cf71
test byte [rsp + 0x40], 0x80
je 0x14009cf52
mov r8d, 0x104
lea rdx, [rbp + 0x370]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14009cf52
lea r8, [rsp + 0x50]
mov edx, 0x105
lea rcx, [rbp + 0x160]
call fcn.1400b7b10
lea r8, [rbp + 0x370]
mov edx, 0x105
lea rcx, [rbp + 0x160]
call fcn.1400b7a90
mov r8d, 0x104
lea rdx, [rbp + 0x580]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x14009cf3e
lea r8, [rbp + 0x580]
mov rax, rdi
sub r8, rdi
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14009cf14
add rax, 2
test ecx, ecx
jne 0x14009cf00
test edx, edx
je 0x14009cf39
mov r8d, 0x104
lea rdx, [rbp + 0x370]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
cmp eax, 1
je 0x14009cea5
jmp 0x14009cf44
mov sil, 1
jmp 0x14009cf44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
test sil, sil
jne 0x14009cf77
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, 1
je 0x14009ce10
jmp 0x14009cf77
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
test sil, sil
je 0x14009cdcf
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea r8, [rsp + 0x50]
mov edx, 0x105
mov ebx, eax
lea rcx, [rbp + 0x160]
movabs rax, 0x5c003a0041
mov qword [rsp + 0x48], rax
call fcn.1400b7b10
test ebx, ebx
je 0x14009d039
nop word [rax + rax]
test bl, 1
je 0x14009d018
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x14009d018
mov r8d, 0x104
lea rdx, [rbp + 0x580]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x14009d018
lea rax, [rsp + 0x50]
lea r8, [rbp + 0x580]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14009d014
add rax, 2
test ecx, ecx
jne 0x14009d000
test edx, edx
je 0x14009d023
inc word [rsp + 0x48]
shr ebx, 1
jne 0x14009cfc0
jmp 0x14009d039
lea r8, [rsp + 0x48]
mov edx, 0x105
lea rcx, [rbp + 0x160]
call fcn.1400b7b10
lea r8, [rbp + 0x160]
mov edx, 0x105
mov rcx, r15
call fcn.1400b7b10
lea r8, [rbp + 0x370]
mov edx, 0x105
mov rcx, r15
call fcn.1400b7a90
mov eax, 1
jmp 0x14009cdd1