Function at 0x100023d00
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x10002e110]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rcx
mov rcx, qword [0x10002e120]
lea rax, [0x10002e120]
cmp rcx, rax
je 0x100023d5d
bt dword [rcx + 0x1c], 0x1d
jae 0x100023d5d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005ed8]
mov edx, 0x40
call fcn.10001031c
lea rdx, [0x100008430]
lea rcx, [rsp + 0x40]
mov r9d, 1
mov r8d, 0x842
call fcn.10001ed8c
lea rcx, [rsp + 0x82]
xor r12d, r12d
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x80], r12w
call fcn.10002a670
lea rcx, [rsp + 0x80]
mov rbx, r12
mov edx, 0x105
mov qword [rsp + 0x28], rbx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x100023dd9
call fcn.100020b84
mov edi, eax
mov dword [rsp + 0x40], eax
mov eax, 0x84a
mov word [rsp + 0x46], ax
jmp 0x100023fdb
mov eax, 0x84a
mov dword [rsp + 0x40], r12d
lea edi, [rax + 0xb]
lea r15d, [rax + 9]
lea r14d, [rax + 0x10]
mov word [rsp + 0x44], ax
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x100023f68
cmp rbx, r12
je 0x100023e81
mov qword [rsp + 0x28], r12
or eax, 0xffffffff
lock xadd dword [rbx], eax
add eax, 0xffffffff
jne 0x100023e43
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbx + 8]
mov qword [rbx + 0x20], r12
mov dword [rbx + 0x18], r12d
call fcn.100027da0
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x28]
cmp rbx, r12
je 0x100023e81
mov qword [rsp + 0x28], r12
or eax, 0xffffffff
lock xadd dword [rbx], eax
add eax, 0xffffffff
jne 0x100023e81
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbx + 8]
mov qword [rbx + 0x20], r12
mov dword [rbx + 0x18], r12d
call fcn.100027da0
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x28]
call fcn.100021930
mov rbx, qword [rsp + 0x28]
cmp eax, r12d
mov dword [rsp + 0x40], eax
jl 0x100023fb3
lea rcx, [rbx + 8]
mov word [rsp + 0x44], r15w
cmp dword [rcx + 8], r12d
je 0x100023eb8
mov rax, qword [rcx]
mov dword [rcx + 8], r12d
mov word [rax], r12w
lea rdx, [rsp + 0x80]
call fcn.10002897c
cmp eax, r12d
mov dword [rsp + 0x40], eax
jl 0x100023fac
lea r8, [rbx + 0x18]
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x80]
mov word [rsp + 0x44], di
call fcn.100022a8c
cmp eax, r12d
jl 0x100023f68
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x38], rbx
mov edi, r12d
mov byte [rsp + 0x20], r12b
cmp rbx, r12
jne 0x100023f0e
mov edi, 0x80070057
jmp 0x100023f54
lock add dword [rcx + 8], 1
mov rcx, qword [rcx]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x38]
mov r8d, 8
call qword [sym.imp.ntdll.dll_RtlInsertElementGenericTableAvl]
cmp rax, r12
jne 0x100023f38
mov edi, 0x8007000e
jmp 0x100023f4f
cmp byte [rsp + 0x20], r12b
je 0x100023f4a
mov rax, qword [rsp + 0x38]
lock add dword [rax], 1
jmp 0x100023f4f
mov edi, 1
mov rbx, qword [rsp + 0x28]
cmp edi, r12d
mov dword [rsp + 0x40], edi
jl 0x100023fa4
mov word [rsp + 0x44], r14w
mov edi, 0x855
lea rdx, [rsp + 0x80]
mov r8d, 0x105
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, r12d
jne 0x100023df3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x100023fbb
mov eax, 0x861
mov dword [rsp + 0x40], r12d
mov word [rsp + 0x44], ax
jmp 0x100023fce
mov word [rsp + 0x46], r14w
jmp 0x100023fce
mov word [rsp + 0x46], di
jmp 0x100023fce
mov word [rsp + 0x46], r15w
jmp 0x100023fce
call fcn.100020b84
mov dword [rsp + 0x40], eax
mov eax, 0x861
mov word [rsp + 0x46], ax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov edi, dword [rsp + 0x40]
cmp rbx, r12
je 0x100024014
or eax, 0xffffffff
lock xadd dword [rbx], eax
add eax, 0xffffffff
jne 0x100024014
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbx + 8]
mov qword [rbx + 0x20], r12
mov dword [rbx + 0x18], r12d
call fcn.100027da0
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x40]
call fcn.10001eea4
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.10002a0b0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret