Function at 0x14000eb4c
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x900
mov qword [r11 - 0x4f8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14007c478]
xor rax, rsp
mov qword [rsp + 0x8f8], rax
mov r13, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x200], rcx
mov qword [rsp + 0x210], r8
lea rsi, str.base_stor_vss_tools_vssagent_vsdoc.cpp
mov qword [r11 - 0x708], rsi
lea r12, str.CVssXmlDiagDocument::GetVolumes
mov qword [r11 - 0x700], r12
lea rax, str.TST__
mov qword [r11 - 0x6f8], rax
mov dword [rsp + 0x238], 0x564
mov dword [rsp + 0x23c], 9
mov dword [rsp + 0x240], 0xdc
xor edi, edi
mov dword [rsp + 0x2c0], 0x1000000
xor edx, edx
lea r8d, [rdi + 0x78]
lea rcx, [r11 - 0x6e0]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x180]
call fcn.14004058c
nop
lea rax, str.Volume_Devices
test rbx, rbx
cmove rbx, rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.VolumeDevices
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.14001f25c
nop
lea rdx, str.__Getting_the_list_of_volumes...
lea rcx, [rsp + 0x180]
call fcn.140041860
nop
movups xmm0, xmmword [0x140054510]
movdqu xmmword [rsp + 0x498], xmm0
lea r9d, [rdi + 0x12]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x498]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
nop dword [rax + rax]
mov r15, rax
mov qword [rsp + 0x1f0], rax
cmp rax, 0xffffffffffffffff
je 0x1400102c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x478], xmm0
movups xmmword [rsp + 0x488], xmm0
mov dword [rsp + 0x478], 0x20
mov ebx, edi
mov dword [rsp + 0x90], ebx
lea rax, [rsp + 0x478]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rsp + 0x498]
xor edx, edx
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
nop dword [rax + rax]
test eax, eax
jne 0x14000ed0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x103
jne 0x140010309
jmp 0x14001014f
mov qword [rsp + 0x88], rdi
lea rax, vtable.CVssAutoCppPtr_struct__SP_DEVICE_INTERFACE_DETAIL_DATA_W____ptr64_.0
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x4d0], xmm0
movups xmmword [rsp + 0x4e0], xmm0
mov dword [rsp + 0x4d0], 0x20
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x478]
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailW]
nop dword [rax + rax]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x14001042e
cmp dword [rsp + 0x68], edi
je 0x14001042e
mov ecx, dword [rsp + 0x68]
lea rdx, [0x140054410]
call fcn.140043b28
mov r12, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140010356
mov dword [rax], 8
lea rax, [rsp + 0x4d0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, dword [rsp + 0x68]
mov r8, r12
lea rdx, [rsp + 0x478]
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailW]
nop dword [rax + rax]
test eax, eax
je 0x140010375
lea rsi, [r12 + 4]
lea rbx, str.base_stor_vss_tools_vssagent_vsdoc.cpp
mov qword [rsp + 0xb0], rbx
lea rax, str.CVssXmlDiagDocument::GetVolumes
mov qword [rsp + 0xb8], rax
lea rax, str.TST__
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], 0x5c3
mov dword [rsp + 0xcc], 9
mov dword [rsp + 0xd0], 0xdc
mov dword [rsp + 0x150], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xd8]
call sub.msvcrt.dll_memset
mov r9, rsi
lea r8, str.PATH:__s
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x180]
call fcn.140041324
lea rcx, [rsi + 8]
mov r8d, reloc.OLEAUT32.dll_SetErrorInfo
lea rdx, [rsp + 0x680]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
nop dword [rax + rax]
test eax, eax
jne 0x14000f0ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov dword [rsp + 0x188], ebx
lea rax, str.base_stor_vss_tools_vssagent_vsdoc.cpp
mov qword [rsp + 0xb0], rax
lea rax, str.CVssXmlDiagDocument::GetVolumes
mov qword [rsp + 0xb8], rax
lea rax, str.TST__
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], 0x5ce
mov dword [rsp + 0xcc], 9
mov dword [rsp + 0xd0], 0xdc
mov dword [rsp + 0x150], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xd8]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], ebx
mov r9, rsi
lea r8, str.Error_getting_the_DOS_device_for__s__0x_08lx__n
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x180]
call fcn.140041324
mov qword [rsp + 0x28], rsi
lea rax, str.__s_
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.Volume
lea rdx, [rsp + 0x170]
mov rcx, r14
call fcn.14001f25c
nop
mov r8, rsi
lea rdx, str.StorageDevice
lea rcx, [rsp + 0x170]
call fcn.140004f4c
lea rax, [rsp + 0x388]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x388], rcx
test rcx, rcx
je 0x14000efd4
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x390], rcx
test rcx, rcx
je 0x14000eff7
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x20], eax
lea r9, str.0x_08lx
lea r8, str.Error_QueryDosDeviceW
lea rdx, [rsp + 0x388]
mov rcx, r14
call fcn.14001f4fc
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x3f8]
lea rcx, [rsp + 0x70]
call fcn.140005fe8
nop
mov rcx, qword [rsp + 0x400]
test rcx, rcx
je 0x14000f056
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x3f8]
test rcx, rcx
je 0x14000f071
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x14000f08c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x14000f0a7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
jmp 0x1400100fa
mov qword [rsp + 0xb0], rbx
lea rax, str.CVssXmlDiagDocument::GetVolumes
mov qword [rsp + 0xb8], rax
lea rax, str.TST__
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], 0x5d8
mov dword [rsp + 0xcc], 9
mov dword [rsp + 0xd0], 0xdc
mov dword [rsp + 0x150], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xd8]
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x680]
lea r8, str.DOS_Device:__s_n
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x180]
call fcn.140041324
mov qword [rsp + 0x428], 7
mov qword [rsp + 0x420], rdi
mov word [rsp + 0x410], di
lea rax, [rsp + 0x680]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x14000f15d
lea rdx, [rsp + 0x680]
lea rcx, [rsp + 0x408]
call fcn.140021944
lea r8, [rsp + 0x408]
lea rdx, [rsp + 0x4a8]
mov rcx, r14
call fcn.14001c440
nop
lea rdx, [rax + 8]
cmp qword [rax + 0x20], 8
jb 0x14000f1a3
mov rdx, qword [rdx]
mov qword [rsp + 0x470], 7
mov qword [rsp + 0x468], rdi
mov word [rsp + 0x458], di
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], di
jne 0x14000f1c3
lea rcx, [rsp + 0x450]
call fcn.140021944
nop
cmp qword [rsp + 0x4c8], 8
jb 0x14000f1f3
mov rcx, qword [rsp + 0x4b0]
call fcn.1400434b8
mov qword [rsp + 0x4c8], 7
mov qword [rsp + 0x4c0], rdi
mov word [rsp + 0x4b0], di
lea rax, [rsp + 0x458]
cmp qword [rsp + 0x470], 8
cmovae rax, qword [rsp + 0x458]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x680]
mov qword [rsp + 0x28], rax
lea rax, str._s___s_
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.Volume
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.14001f25c
nop
lea r8, [rsp + 0x680]
lea rdx, str.Device
lea rcx, [rsp + 0x58]
call fcn.140004f4c
mov r8, rsi
lea rdx, str.StorageDevice
lea rcx, [rsp + 0x58]
call fcn.140004f4c
lea r9, [rsp + 0x680]
lea r8, str._GLOBALROOT_s
mov edx, reloc.OLEAUT32.dll_SetErrorInfo
lea rcx, [rsp + 0x4f0]
call fcn.140002d64
mov dword [rsp + 0x188], eax
test eax, eax
js 0x1400103c3
lea r8, [rsp + 0x4f0]
lea rdx, str.UserModeDevice
lea rcx, [rsp + 0x58]
call fcn.140004f4c
mov qword [rsp + 0x220], rdi
mov word [rsp + 0x248], di
mov qword [rsp + 0x24c], rdi
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x260], rdi
mov dword [rsp + 0x268], edi
mov qword [rsp + 0x270], rdi
mov word [rsp + 0x278], di
mov qword [rsp + 0x288], rdi
lea rax, vtable.CVssAutoString_class_CVssAutoCOMPtr_unsigned_short_int____ptr64__.0
mov qword [rsp + 0x280], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x228], xmm0
movups xmmword [rsp + 0x238], xmm0
mov dword [rsp + 0x30], 0x80000000
xor r9d, r9d
lea r8, [rsp + 0x4f0]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x220]
call fcn.140023e60
mov dword [rsp + 0x188], eax
test eax, eax
jns 0x14000f58d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov dword [rsp + 0x188], ebx
lea rsi, str.base_stor_vss_tools_vssagent_vsdoc.cpp
mov qword [rsp + 0xb0], rsi
lea rax, str.CVssXmlDiagDocument::GetVolumes
mov qword [rsp + 0xb8], rax
lea rax, str.TST__
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], 0x5f6
mov dword [rsp + 0xcc], 9
mov dword [rsp + 0xd0], 0xdc
mov dword [rsp + 0x150], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xd8]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x4f0]
lea r8, str.CreateFile__s___0x_08lx____ld_
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x180]
call fcn.140041324
lea rax, [rsp + 0x398]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x398], rcx
test rcx, rcx
je 0x14000f46a
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x3a0], rcx
test rcx, rcx
je 0x14000f48a
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, str._s__0x_08lx_
lea r8, str.Error_CreateFile
lea rdx, [rsp + 0x398]
mov rcx, r14
call fcn.14001f4fc
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x3a8]
lea rcx, [rsp + 0x70]
call fcn.140005fe8
nop
mov rcx, qword [rsp + 0x3b0]
test rcx, rcx
je 0x14000f4f3
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x3a8]
test rcx, rcx
je 0x14000f50e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
lea rcx, [rsp + 0x220]
call fcn.1400242a8
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000f534
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000f54c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
cmp qword [rsp + 0x470], 8
jb 0x14000f564
mov rcx, qword [rsp + 0x458]
call fcn.1400434b8
mov qword [rsp + 0x470], 7
mov qword [rsp + 0x468], rdi
mov word [rsp + 0x458], di
mov rcx, r12
call fcn.1400434b8
jmp 0x140010109
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x28], dil
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, 0x560038
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x220]
call fcn.140024474
mov dword [rsp + 0x188], eax
test eax, eax
jns 0x14000f798
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov dword [rsp + 0x188], ebx
lea rsi, str.base_stor_vss_tools_vssagent_vsdoc.cpp
mov qword [rsp + 0xb0], rsi
lea rax, str.CVssXmlDiagDocument::GetVolumes
mov qword [rsp + 0xb8], rax
lea rax, str.TST__
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], 0x60a
mov dword [rsp + 0xcc], 9
mov dword [rsp + 0xd0], 0xdc
mov dword [rsp + 0x150], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xd8]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.DeviceIoControl_IOCTL_VOLUME_GET_GPT_ATTRIBUTES___0x_08lx____ld_
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x180]
call fcn.140041324
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x2d0], rcx
test rcx, rcx
je 0x14000f6b1
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x2d8], rcx
test rcx, rcx
je 0x14000f6d1
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, str._s__0x_08lx_
lea r8, str.Error_IOCTL_VOLUME_GET_GPT_ATTRIBUTES
lea rdx, [rsp + 0x2d0]
mov rcx, r14
call fcn.14001f4fc
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x3b8]
lea rcx, [rsp + 0x70]
call fcn.140005fe8
nop
mov rcx, qword [rsp + 0x3c0]
test rcx, rcx
je 0x14000f73a
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x3b8]
test rcx, rcx
je 0x14000f755
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
lea rcx, [rsp + 0x220]
call fcn.1400242a8
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000f77b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000f793
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
jmp 0x14000f54c
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x220]
call fcn.140021f28
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x2e0], rcx
test rcx, rcx
je 0x14000f7e2
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x2e8], rcx
test rcx, rcx
je 0x14000f802
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rbx, qword [rsp + 0x98]
mov qword [rsp + 0x20], rbx
lea r9, str.0x_016I64x
lea r8, str.GptFlags
lea rdx, [rsp + 0x2e0]
mov rcx, r14
call fcn.14001f4fc
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x2f0], rcx
test rcx, rcx
je 0x14000f85a
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x2f8], rcx
test rcx, rcx
je 0x14000f87a
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
movabs rax, 0x1000000000000000
test rax, rbx
lea r9, [0x140057a90]
lea rsi, [0x140057a88]
cmovne r9, rsi
lea r8, str.GptReadonly
lea rdx, [rsp + 0x2f0]
mov rcx, r14
call fcn.14001f4fc
lea rax, [rsp + 0x300]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x300], rcx
test rcx, rcx
je 0x14000f8dd
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x308], rcx
test rcx, rcx
je 0x14000f8fd
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
movabs rax, 0x4000000000000000
test rax, rbx
lea r9, [0x140057a90]
cmovne r9, rsi
lea r8, str.GptHidden
lea rdx, [rsp + 0x300]
mov rcx, r14
call fcn.14001f4fc
lea rax, [rsp + 0x310]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x310], rcx
test rcx, rcx
je 0x14000f959
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x318], rcx
test rcx, rcx
je 0x14000f979
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
lea r9, [0x140057a90]
test rbx, rbx
cmovs r9, rsi
lea r8, str.GptNoDriveLetter
lea rdx, [rsp + 0x310]
mov rcx, r14
call fcn.14001f4fc
lea rcx, [rsp + 0x4f0]
call fcn.140023cf0
mov ebx, 0x64
mov r8d, ebx
lea rdx, [rsp + 0x810]
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
jne 0x14000f9e9
lea r8, str._none_
mov edx, ebx
lea rcx, [rsp + 0x810]
call fcn.140002de8
lea r8, [rsp + 0x810]
lea rdx, str.VolumeName
lea rcx, [rsp + 0x58]
call fcn.140004f4c
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0x70]
call fcn.140005fe8
nop
mov rcx, qword [rsp + 0x3d0]
test rcx, rcx
je 0x14000fa35
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x3c8]
test rcx, rcx
je 0x14000fa50
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov dword [rsp + 0x24c], edi
mov dword [rsp + 0x260], edi
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x28], dil
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, 0x560000
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x220]
call fcn.140024474
mov dword [rsp + 0x188], eax
test eax, eax
jns 0x14000fc69
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov dword [rsp + 0x188], ebx
lea rsi, str.base_stor_vss_tools_vssagent_vsdoc.cpp
mov qword [rsp + 0xb0], rsi
lea rax, str.CVssXmlDiagDocument::GetVolumes
mov qword [rsp + 0xb8], rax
lea rax, str.TST__
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], 0x635
mov dword [rsp + 0xcc], 9
mov dword [rsp + 0xd0], 0xdc
mov dword [rsp + 0x150], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xd8]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.DeviceIoControl_IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS___0x_08lx____ld_
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x180]
call fcn.140041324
lea rax, [rsp + 0x320]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x320], rcx
test rcx, rcx
je 0x14000fb82
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x328], rcx
test rcx, rcx
je 0x14000fba2
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, str._s__0x_08lx_
lea r8, str.Error_IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS
lea rdx, [rsp + 0x320]
mov rcx, r14
call fcn.14001f4fc
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x70]
call fcn.140005fe8
nop
mov rcx, qword [rsp + 0x3e0]
test rcx, rcx
je 0x14000fc0b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x3d8]
test rcx, rcx
je 0x14000fc26
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
lea rcx, [rsp + 0x220]
call fcn.1400242a8
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000fc4c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000fc64
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
jmp 0x14000f54c
mov rax, qword [rsp + 0x270]
lea rbx, [rax + 8]
mov eax, dword [rax]
lea rcx, [rax + rax*2]
lea rsi, [rbx + rcx*8]
cmp rbx, rsi
jae 0x14000fe3c
mov eax, dword [rbx]
mov dword [rsp + 0x28], eax
lea rax, str..PHYSICALDRIVE_d
mov qword [rsp + 0x20], rax
mov r9d, 0xd
lea r8, str.Extent
lea rdx, [rsp + 0x160]
mov rcx, r14
call fcn.14001f25c
nop
lea rax, [rsp + 0x330]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x330], rcx
test rcx, rcx
je 0x14000fce8
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x338], rcx
test rcx, rcx
je 0x14000fd0b
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rax, qword [rbx + 8]
mov qword [rsp + 0x20], rax
lea r9, str.0x_016I64x
lea r8, str.StartingOffset
lea rdx, [rsp + 0x330]
mov rcx, r14
call fcn.14001f4fc
lea rax, [rsp + 0x340]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x340], rcx
test rcx, rcx
je 0x14000fd62
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x348], rcx
test rcx, rcx
je 0x14000fd85
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
lea r9, str.0x_016I64x
lea r8, str.ExtentLength
lea rdx, [rsp + 0x340]
mov rcx, r14
call fcn.14001f4fc
lea r8, [rsp + 0x160]
lea rdx, [rsp + 0x3e8]
lea rcx, [rsp + 0x58]
call fcn.140005fe8
nop
mov rcx, qword [rsp + 0x3f0]
test rcx, rcx
je 0x14000fde2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x3e8]
test rcx, rcx
je 0x14000fdfd
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x14000fe18
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x160]
test rcx, rcx
je 0x14000fe33
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
add rbx, 0x18
jmp 0x14000fc7f
mov dword [rsp + 0x24c], edi
mov dword [rsp + 0x260], edi
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x28], dil
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, 0x560030
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x220]
call fcn.140024474
mov dword [rsp + 0x188], eax
mov rcx, qword [rsp + 0x58]
test eax, eax
js 0x14000feee
lea rax, [rsp + 0x350]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x350], rcx
test rcx, rcx
je 0x14000feae
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x358], rcx
test rcx, rcx
je 0x14000fece
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
lea r9, [0x140057a88]
lea r8, str.Cluster.IsClustered
lea rdx, [rsp + 0x350]
mov rcx, r14
call fcn.14001f4fc
jmp 0x14000ff5f
lea rax, [rsp + 0x360]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x360], rcx
test rcx, rcx
je 0x14000ff16
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x368], rcx
test rcx, rcx
je 0x14000ff36
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x20], eax
lea r9, str.No__0x_08lx_
lea r8, str.Cluster.IsClustered
lea rdx, [rsp + 0x360]
mov rcx, r14
call fcn.14001f4fc
mov dword [rsp + 0x24c], edi
mov dword [rsp + 0x260], edi
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x28], dil
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, 0x560010
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x220]
call fcn.140024474
mov dword [rsp + 0x188], eax
mov rcx, qword [rsp + 0x58]
test eax, eax
js 0x140010011
lea rax, [rsp + 0x370]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x370], rcx
test rcx, rcx
je 0x14000ffd1
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x378], rcx
test rcx, rcx
je 0x14000fff1
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
lea r9, [0x140057a88]
lea r8, str.Cluster.IsOffline
lea rdx, [rsp + 0x370]
mov rcx, r14
call fcn.14001f4fc
jmp 0x140010083
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xa0], rcx
test rcx, rcx
je 0x140010039
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0xa8], rcx
test rcx, rcx
je 0x140010059
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x20], eax
lea r9, str.No__0x_08lx_
lea r8, str.Cluster.IsOffline
lea rdx, [rsp + 0xa0]
mov rcx, r14
call fcn.14001f4fc
nop
lea rcx, [rsp + 0x220]
call fcn.1400242a8
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400100a9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400100c1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
cmp qword [rsp + 0x470], 8
jb 0x1400100d9
mov rcx, qword [rsp + 0x458]
call fcn.1400434b8
mov qword [rsp + 0x470], 7
mov qword [rsp + 0x468], rdi
mov word [rsp + 0x458], di
test r12, r12
je 0x140010102
mov rcx, r12
call fcn.1400434b8
lea rsi, str.base_stor_vss_tools_vssagent_vsdoc.cpp
lea rax, [0x1400531a0]
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x80], rax
mov ebx, dword [rsp + 0x90]
inc ebx
lea r12, str.CVssXmlDiagDocument::GetVolumes
jmp 0x14000ecbf
cmp dword [rsp + 0x188], edi
jge 0x1400101ce
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rcx
test rcx, rcx
je 0x140010185
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0xa8], rcx
test rcx, rcx
je 0x1400101a5
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x20], eax
lea r9, str.Error:_0x_08lx
lea r8, str.FAILURE_GetVolumes
lea rdx, [rsp + 0xa0]
mov rcx, r14
call fcn.14001f4fc
cmp r15, 0xffffffffffffffff
je 0x1400101e3
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
nop dword [rax + rax]
test r13, r13
jne 0x140010247
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rcx
test rcx, rcx
je 0x140010215
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0xa8], rcx
test rcx, rcx
je 0x140010235
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140053f18]
nop
lea rdx, [rsp + 0xa0]
mov rcx, r14
call fcn.14001f468
jmp 0x140010255
lea r8, [rsp + 0x70]
mov rdx, r13
call fcn.14002bf68
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14001026d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140010285
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140053f18]
nop
lea rcx, [rsp + 0x180]
call fcn.1400406a0
mov rcx, qword [rsp + 0x8f8]
xor rcx, rsp
call fcn.1400438c0
lea r11, [rsp + 0x900]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [rsp + 0x30], 0xff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x57b
mov r9, r12
lea r8, str.VHWDOCC
mov rdx, rsi
lea rcx, [rsp + 0xb0]
call fcn.1400400dc
lea r8, str.SetupDiGetClassDevs___NULL__NULL__DIGCF_DEVICEINTERFACE__DIGCF_PRESENT_
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.140041e40
mov dword [rsp + 0x30], 0xff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x58d
mov r9, r12
lea r8, str.VHWDOCC
mov rdx, rsi
lea rcx, [rsp + 0xb0]
call fcn.1400400dc
mov r9d, ebx
lea r8, str.SetupDiEnumDeviceInterfaces_devInfo__NULL______d____
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.140041e40
nop
mov dword [rsp + 0x158], 0x8007000e
lea rdx, [0x1400793e8]
lea rcx, [rsp + 0x158]
call sub.msvcrt.dll__CxxThrowException
mov dword [rsp + 0x30], 0xff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x5be
lea r9, str.CVssXmlDiagDocument::GetVolumes
lea r8, str.VHWDOCC
mov rdx, rsi
lea rcx, [rsp + 0xb0]
call fcn.1400400dc
lea r8, str.SetupDiGetDeviceInterfaceDetail_devInfo____detail__dwBytes__NULL___
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.140041e40
nop
mov dword [rsp + 0x30], 0xdc
mov dword [rsp + 0x28], 9
mov dword [rsp + 0x20], 0x5ec
lea r9, str.CVssXmlDiagDocument::GetVolumes
lea r8, str.TST__
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.1400400dc
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.1400046e0
mov r8d, eax
lea rax, [rsp + 0x680]
mov qword [rsp + 0x20], rax
lea r9, str.StringCchPrintfW__s_
lea rcx, [rsp + 0x180]
call fcn.140042060
nop
mov dword [rsp + 0x30], 0xff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x5ad
mov r9, r12
lea r8, str.VHWDOCC
mov rdx, rsi
lea rcx, [rsp + 0xb0]
call fcn.1400400dc
lea rcx, str.TRUE
lea r9, str.FALSE
test ebx, ebx
cmovne r9, rcx
lea r8, str.SetupDiGetDeviceInterfaceDetail_devInfo____NULL__0____NULL_:__s
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.140041e40
int3