Function at 0x1400e3260
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push r13
push r14
push r15
sub rsp, 0x670
mov qword [r11 - 0x518], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
mov rax, qword [0x14016b400]
xor rax, rsp
mov qword [rsp + 0x660], rax
lea rdi, str.base_stor_vssmodules_registry_registry.cxx
mov qword [r11 - 0x4f8], rdi
lea rsi, str.CVssMachineInformation::GetMinDiffAreaForSystem
mov qword [r11 - 0x4f0], rsi
lea r14, str.REGREGSC
mov qword [r11 - 0x4e8], r14
mov dword [rsp + 0x1a8], 0x6c7
mov r15d, reloc.VssTrace.DLL_Ordinal_11
mov dword [r11 - 0x4dc], r15d
mov r12d, 0xff
mov dword [r11 - 0x4d8], r12d
xor ebx, ebx
mov dword [rsp + 0x230], 0x1000000
lea r13d, [r15 + 0x6d]
mov r8d, r13d
xor edx, edx
lea rcx, [r11 - 0x4d0]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x100]
call fcn.14001cce0
nop
lea edx, [r12 + 6]
lea rcx, [rsp + 0x240]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemWindowsDirectoryW]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x6c], r15d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0xf0], 0x1000000
mov r8d, r13d
xor edx, edx
lea rcx, [rsp + 0x78]
test eax, eax
jne 0x1400e33aa
mov dword [rsp + 0x68], 0x6d0
call sub.msvcrt.dll_memset
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x105
lea r9, [rsp + 0x240]
lea r8, str.GetSystemWindowsDirectoryW__s___u_:__u
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.1400ddc40
mov dword [rsp + 0x68], 0x6d2
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x105
lea r9, [rsp + 0x240]
lea r8, str.GetSystemWindowsDirectoryW__s___u_:__u__0x_08lx_
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.14001cc70
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x450]
call sub.msvcrt.dll_memset
mov r8d, 0x105
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x240]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
test eax, eax
jne 0x1400e3498
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], 0x6db
mov dword [rsp + 0x6c], r15d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0xf0], 0x1000000
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x28], 0x105
lea rax, [rsp + 0x450]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x240]
lea r8, str.GetVolumePathNameW__s___p___u_
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.1400ddc40
mov r8d, 0x32
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x450]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x6c], r15d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0xf0], 0x1000000
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x78]
test eax, eax
jne 0x1400e3514
mov dword [rsp + 0x68], 0x6e1
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x450]
lea r8, str.GetVolumeNameForVolumeMountPointW___s__STRING_CCH_PARAM_wszSysVolumeName__
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.1400ddc40
mov dword [rsp + 0x68], 0x6e3
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x190]
lea r8, str.System_volume_name:__s
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.14001cc70
lea rcx, [rsp + 0x190]
call fcn.1400e37a4
mov rbx, rax
lea rcx, [rsp + 0x100]
call fcn.14001ce00
mov rax, rbx
jmp 0x1400e3605
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400321c0
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret