Function at 0x100074c40
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
xor r15d, r15d
mov rsi, rcx
cmp dword [rax - 8], r15d
jne 0x100074c83
lea rcx, [0x100002dec]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [0x100002dec]
lea rcx, [rsi + 0x38]
mov edx, eax
call fcn.100016504
jmp 0x100074ec7
mov rax, qword [0x1000a1180]
mov ebx, 0x32
lea rcx, [rsp + 0x68]
mov edx, ebx
mov qword [rsp + 0x68], rax
call fcn.100016600
mov rcx, qword [rsi + 0x28]
mov r8d, ebx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
lea rcx, [rsp + 0x68]
call fcn.1000166e4
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov dword [rbx - 8], eax
mov word [rbx + rcx*2], r15w
mov rax, qword [0x1000a1180]
mov ebx, 0x50
lea rcx, [rsp + 0x70]
mov edx, ebx
mov qword [rsp + 0x70], rax
call fcn.100016600
mov edx, ebx
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
or r14, 0xffffffffffffffff
mov rbp, rax
cmp rax, r14
jne 0x100074d5f
mov rcx, qword [rsp + 0x70]
lea rdi, [0x1000a1170]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x100074d33
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r15d
jg 0x100074d33
call fcn.10007a490
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x100074d55
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r15d
jg 0x100074d55
call fcn.10007a490
mov eax, 0x80004005
jmp 0x100074ec9
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rdx, rax
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x100074d82
add rax, 2
test r8d, r8d
jne 0x100074d6c
lea rdi, [0x1000a1170]
jmp 0x100074dc6
mov r8d, ebx
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, r15d
je 0x100074e53
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rdx, rax
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x100074dc6
add rax, 2
test r8d, r8d
jne 0x100074db0
cmp ecx, r15d
jne 0x100074d8b
mov rax, qword [0x1000a1180]
lea rcx, [rsp + 0x78]
mov edx, 0x10
mov qword [rsp + 0x78], rax
call fcn.100016600
lea r9, [rsp + 0x60]
mov r8d, 0x10
mov rcx, r12
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
lea rcx, [rsp + 0x78]
mov word [rbx + 4], r15w
call fcn.1000166e4
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x78]
movsxd rcx, eax
mov dword [rbx - 8], eax
mov word [rbx + rcx*2], r15w
lea rcx, [rsi + 0x38]
call fcn.10001c054
lea rcx, [rbx - 0xc]
cmp rcx, rdi
je 0x100074e53
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r15d
jg 0x100074e53
call fcn.10007a490
lea rcx, [rsp + 0x70]
call fcn.1000166e4
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov dword [rbx - 8], eax
mov word [rbx + rcx*2], r15w
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
lea rcx, [rbx - 0xc]
cmp eax, r15d
je 0x100074d1a
cmp rcx, rdi
je 0x100074ea5
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r15d
jg 0x100074ea5
call fcn.10007a490
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x100074ec7
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
cmp eax, r15d
jg 0x100074ec7
call fcn.10007a490
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret