Function at 0x4d0600
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov rax, rsp
sub rsp, 0xb38
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0xb00], rax
mov rdi, rcx
mov eax, dword [0x00647968]
test al, 1
jne 0x4d0674
or eax, 1
mov dword [0x00647968], eax
lea rcx, [0x00647938]
call fcn.004cb1a0
lea rcx, [0x005a9660]
call fcn.0056a510
nop
mov rsi, qword [0x00647958]
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x80], 0xb75
lea r15, str..OSAccessor.cpp
mov qword [rsp + 0x88], r15
test rsi, rsi
je 0x4d06b0
mov r8, r15
mov edx, 0xb75
mov rcx, rsi
call fcn.004a4240
nop
mov qword [rsp + 0xb0], 7
xor r14d, r14d
mov qword [rsp + 0xa8], r14
mov word [rsp + 0x98], r14w
lea r9d, [r14 + 5]
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.0040be90
nop
mov r9, qword [rax + 0x18]
cmp r9, r9
cmovb r9, r9
cmp qword [rax + 0x20], 8
jb 0x4d06fd
mov rcx, qword [rax + 8]
jmp 0x4d0701
lea rcx, [rax + 8]
mov r8d, 5
cmp r9, r8
cmovb r8, r9
lea rdx, str.file:
mov r13d, 1
lea r12, [r13 - 2]
test r8, r8
je 0x4d0747
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x4d073b
add rcx, 2
add rdx, 2
sub r8, r13
jne 0x4d0724
jmp 0x4d0747
mov r8d, r13d
cmp word [rcx], ax
cmovb r8d, r12d
jmp 0x4d074a
mov r8d, r14d
movsxd rax, r8d
test r8d, r8d
jne 0x4d0767
cmp r9, 5
jae 0x4d075d
mov eax, r12d
jmp 0x4d0767
mov eax, r14d
cmp r9, 5
setne al
test eax, eax
sete bl
cmp qword [rsp + 0x68], 8
jb 0x4d077e
mov rcx, qword [rsp + 0x50]
call fcn.00568830
test bl, bl
je 0x4d0877
cmp qword [rdi + 0x18], 5
jae 0x4d0792
call fcn.0056a700
cmp qword [rdi + 0x20], 8
jb 0x4d07a2
lea rbx, [rdi + 8]
mov rax, qword [rbx]
jmp 0x4d07a9
lea rbx, [rdi + 8]
mov rax, rbx
cmp word [rax + 0xa], 0x2f
jne 0x4d0835
cmp qword [rdi + 0x18], 6
jae 0x4d07c0
call fcn.0056a700
cmp qword [rdi + 0x20], 8
jb 0x4d07cc
mov rax, qword [rbx]
jmp 0x4d07cf
mov rax, rbx
cmp word [rax + 0xc], 0x2f
jne 0x4d0835
cmp qword [rdi + 0x18], 7
jae 0x4d07e2
call fcn.0056a700
cmp qword [rdi + 0x20], 8
jb 0x4d07ec
mov rbx, qword [rbx]
cmp word [rbx + 0xe], 0x2f
jne 0x4d0835
mov r9, r12
mov r8d, 8
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.0040be90
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.00546900
nop
cmp qword [rsp + 0x68], 8
jb 0x4d088d
mov rcx, qword [rsp + 0x50]
call fcn.00568830
jmp 0x4d088d
mov r9, r12
mov r8d, 5
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.0040be90
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.00546900
nop
cmp qword [rsp + 0x68], 8
jb 0x4d088d
mov rcx, qword [rsp + 0x50]
call fcn.00568830
jmp 0x4d088d
mov r9, r12
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.00546900
lea rax, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rax, qword [rsp + 0x98]
cmp word [rax], 0x2f
jne 0x4d095e
cmp qword [rsp + 0xa8], 1
jae 0x4d08c1
call fcn.0056a700
lea rax, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rax, qword [rsp + 0x98]
cmp word [rax + 2], 0x2f
jne 0x4d095e
cmp qword [rsp + 0xa8], 2
jae 0x4d08f2
call fcn.0056a700
lea rax, [rsp + 0x98]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax + 4], 0x2f
je 0x4d095e
cmp rdx, 8
jb 0x4d0924
call fcn.00568830
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r14
mov word [rsp + 0x98], 0
test rsi, rsi
je 0x4d0957
mov r8, r15
mov edx, 0xb75
mov rcx, rsi
call fcn.004a5090
xor al, al
jmp 0x4d0dd0
cmp byte [0x00647116], 0
jne 0x4d0ae0
mov byte [0x00647116], 1
mov byte [0x00647117], 1
mov edx, 0x104
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x4d0ae0
mov ebp, 0x80
nop
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4d0aaf
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmove ecx, ebp
mov dword [rsp + 0x40], ecx
test cl, cl
jns 0x4d0aaf
mov r8d, 0x104
lea rdx, [rsp + 0x4e0]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x4d0aaf
nop
nop
nop
mov r9, r12
lea r8, [rsp + 0x2d0]
mov edx, 0x208
lea rcx, [rsp + 0x6f0]
call fcn.00568da0
mov r9, r12
lea r8, [rsp + 0x4e0]
mov edx, 0x208
lea rcx, [rsp + 0x6f0]
call fcn.00570b20
lea rcx, [rsp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x4d0a9f
cmp eax, 5
je 0x4d0a9f
mov r8d, 0x104
lea rdx, [rsp + 0x4e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
test eax, eax
je 0x4d0aa6
jmp 0x4d0a30
mov byte [0x00647117], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
cmp byte [0x00647117], 0
je 0x4d0ad7
mov r8d, 0x104
lea rdx, [rsp + 0x2d0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x4d09a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
movzx edi, byte [0x00647117]
test dil, dil
jne 0x4d0b8e
mov eax, dword [0x00647968]
test al, 1
jne 0x4d0b1c
or eax, 1
mov dword [0x00647968], eax
lea rcx, [0x00647938]
call fcn.004cb1a0
lea rcx, [0x005a9660]
call fcn.0056a510
nop
mov rbx, qword [0x00647960]
test rbx, rbx
je 0x4d0b38
mov r8, r15
mov edx, 0xb92
mov rcx, rbx
call fcn.004a4240
lea rcx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rcx, qword [rsp + 0x98]
mov r8d, 0x208
lea rdx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
movzx edi, dil
test eax, eax
cmove edi, r13d
test rbx, rbx
je 0x4d0b85
mov r8, r15
mov edx, 0xb92
mov rcx, rbx
call fcn.004a5090
test dil, dil
je 0x4d0d65
mov word [rsp + 0x40], 0x3a
mov rcx, qword [rsp + 0xa8]
cmp rcx, 1
jb 0x4d0d2c
add rcx, 0xffffffffffffffff
cmp rcx, 0xffffffffffffffff
cmova rcx, r12
lea rax, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rax, qword [rsp + 0x98]
lea rbx, [rax + rcx*2]
cmp word [rbx], 0x3a
jne 0x4d0c0a
mov rcx, r13
lea rdx, [rsp + 0x40]
mov r8, rbx
movzx eax, word [rdx]
cmp word [r8], ax
jne 0x4d0bfb
add r8, 2
add rdx, 2
sub rcx, 1
je 0x4d0c26
jmp 0x4d0be2
mov ecx, r13d
cmp word [r8], ax
cmovb ecx, r12d
test ecx, ecx
je 0x4d0c26
lea rcx, [rsp + 0x90]
call fcn.00406690
cmp rbx, rax
je 0x4d0d2c
sub rbx, 2
jmp 0x4d0bd1
lea rax, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rax, qword [rsp + 0x98]
sub rbx, rax
sar rbx, 1
cmp rbx, 0xffffffffffffffff
je 0x4d0d2c
test rbx, rbx
je 0x4d0d2c
lea rdi, [rbx - 1]
cmp rdi, qword [rsp + 0xa8]
jbe 0x4d0c6c
call fcn.0056a700
lea rax, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rax, qword [rsp + 0x98]
movzx ecx, word [rax + rdi*2]
call fcn.0056c280
test eax, eax
je 0x4d0d2c
cmp rbx, 1
jbe 0x4d0cd7
add rbx, 0xfffffffffffffffe
cmp rbx, qword [rsp + 0xa8]
jbe 0x4d0cb0
call fcn.0056a700
lea rax, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rax, qword [rsp + 0x98]
movzx ecx, word [rax + rbx*2]
call fcn.0056c280
test eax, eax
jne 0x4d0d2c
cmp rdi, qword [rsp + 0xa8]
jbe 0x4d0ce6
call fcn.0056a700
lea rax, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rax, qword [rsp + 0x98]
movzx eax, word [rax + rdi*2]
mov word [rsp + 0xc0], ax
mov word [rsp + 0xc2], 0x3a
mov word [rsp + 0xc4], 0x5c
mov word [rsp + 0xc6], 0
jmp 0x4d0d65
lea r8, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae r8, qword [rsp + 0x98]
mov r9, r12
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call fcn.00568da0
mov word [rsp + 0x2c6], 0
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x4d0d81
cmp eax, 5
je 0x4d0d81
xor bl, bl
jmp 0x4d0d83
mov bl, 1
cmp qword [rsp + 0xb0], 8
jb 0x4d0d9b
mov rcx, qword [rsp + 0x98]
call fcn.00568830
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r14
mov word [rsp + 0x98], 0
test rsi, rsi
je 0x4d0dce
mov r8, r15
mov edx, 0xb75
mov rcx, rsi
call fcn.004a5090
mov al, bl
mov rcx, qword [rsp + 0xb00]
xor rcx, rsp
call fcn.00568fb0
mov rbx, qword [rsp + 0xb48]
mov rbp, qword [rsp + 0xb50]
mov rsi, qword [rsp + 0xb58]
mov rdi, qword [rsp + 0xb30]
mov r12, qword [rsp + 0xb28]
mov r13, qword [rsp + 0xb20]
mov r14, qword [rsp + 0xb18]
mov r15, qword [rsp + 0xb10]
add rsp, 0xb38
ret