Function at 0x140037f98
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rbp + 0x48], r12d
mov qword [rbp - 0x20], r12
mov dword [rbp + 0x58], r12d
mov qword [rdx], r12
lea r8, str.CVdsVolume::QueryAccessPathsToVolume__
lea esi, [r12 + 0x5e]
mov edx, esi
lea rcx, [rbp - 0x18]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64]
nop dword [rax + rax]
nop
lea r9, [rbp + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, dword [rbp + 0x48]
add rbx, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
lea edx, [rsi - 0x56]
mov rcx, rax
call qword [sym.imp.vdsutil.dll_VdsHeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp - 0x20], rax
test rax, rax
jne 0x14003805b
lea rcx, [rbp - 0x18]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
lea eax, [rsi - 0x56]
jmp 0x140038247
lea r9, [rbp + 0x58]
mov r8d, dword [rbp + 0x48]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
test eax, eax
jne 0x1400380d8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov r9d, eax
lea r8, str.CVdsVolume::QueryAccessPathsToVolume:_GetVolumePathNamesForVolumeName_failed:__X
xor edx, edx
mov ecx, esi
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.vdsutil.dll_VdsHeapFree]
nop dword [rax + rax]
jmp 0x1400382ea
mov rax, rbx
mov edi, r12d
cmp word [rbx], r12w
je 0x140038210
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1400380ec
lea rax, [rax + rcx*2]
add rax, 2
inc edi
cmp word [rax], r12w
jne 0x1400380e8
test edi, edi
je 0x140038210
mov esi, edi
shl rsi, 3
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [r15], rax
test rax, rax
je 0x1400382b4
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r13, rbx
mov r14d, r12d
test edi, edi
je 0x14003820a
xor r9d, r9d
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r13 + rsi*2], r9w
jne 0x140038151
lea rcx, [rsi*2 + 2]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rcx, qword [r15]
mov qword [r12 + rcx], rax
mov rcx, qword [r15]
mov rdx, qword [r12 + rcx]
xor r9d, r9d
test rdx, rdx
je 0x140038260
lea rcx, [rsi + 1]
lea rax, [rcx - 1]
cmp rax, 0x7ffffffe
ja 0x1400381d9
cmp rsi, 0x7ffffffe
ja 0x1400381de
mov r8, r13
sub r8, rdx
lea rax, [rcx - 1]
test rax, rax
je 0x1400381c8
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400381c8
mov word [rdx], ax
add rdx, 2
dec rcx
jmp 0x1400381a9
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r9w
jmp 0x1400381e2
test rcx, rcx
je 0x1400381e2
mov word [rdx], r9w
mov rax, qword [r15]
mov rcx, qword [r12 + rax]
mov word [rcx + rsi*2], r9w
lea r13, [r13 + rsi*2]
add r13, 2
inc r14d
add r12, 8
cmp r14d, edi
jb 0x14003814d
xor r12d, r12d
mov rax, qword [rbp + 0x50]
mov dword [rax], edi
lea rcx, [rbp - 0x18]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.vdsutil.dll_VdsHeapFree]
nop dword [rax + rax]
xor eax, eax
mov qword [rbp - 0x20], r12
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r12d, r12d
test r14d, r14d
je 0x1400382a0
mov edi, r12d
mov esi, r14d
mov rax, rcx
mov rdx, qword [rdi + rax]
test rdx, rdx
je 0x140038296
mov rcx, rdx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [r15]
mov qword [rdi + rax], r12
mov rax, qword [r15]
mov rcx, rax
add rdi, 8
sub rsi, 1
jne 0x140038271
test rcx, rcx
je 0x1400382b4
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [r15], r12
lea rcx, [rbp - 0x18]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.vdsutil.dll_VdsHeapFree]
nop dword [rax + rax]
mov edi, 8
mov eax, edi
jmp 0x140038243