Function at 0x14003f288
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rbp + 0x48], r12d
mov qword [rbp - 0x20], r12
mov dword [rbp + 0x58], r12d
mov qword [rdx], r12
lea r8, str.CVdsVolume::QueryAccessPathsToVolume__
lea esi, [r12 + 0x5e]
mov edx, esi
lea rcx, [rbp - 0x18]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64]
nop dword [rax + rax]
nop
lea r9, [rbp + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, dword [rbp + 0x48]
add rbx, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
lea edx, [rsi - 0x56]
mov rcx, rax
call qword [sym.imp.vdsutil.dll_VdsHeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp - 0x20], rax
test rax, rax
jne 0x14003f34b
lea rcx, [rbp - 0x18]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
lea eax, [rsi - 0x56]
jmp 0x14003f537
lea r9, [rbp + 0x58]
mov r8d, dword [rbp + 0x48]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
test eax, eax
jne 0x14003f3c8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov r9d, eax
lea r8, str.CVdsVolume::QueryAccessPathsToVolume:_GetVolumePathNamesForVolumeName_failed:__X
xor edx, edx
mov ecx, esi
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.vdsutil.dll_VdsHeapFree]
nop dword [rax + rax]
jmp 0x14003f5da
mov rax, rbx
mov edi, r12d
cmp word [rbx], r12w
je 0x14003f500
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x14003f3dc
lea rax, [rax + rcx*2]
add rax, 2
inc edi
cmp word [rax], r12w
jne 0x14003f3d8
test edi, edi
je 0x14003f500
mov esi, edi
shl rsi, 3
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [r15], rax
test rax, rax
je 0x14003f5a4
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r13, rbx
mov r14d, r12d
test edi, edi
je 0x14003f4fa
xor r9d, r9d
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r13 + rsi*2], r9w
jne 0x14003f441
lea rcx, [rsi*2 + 2]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rcx, qword [r15]
mov qword [r12 + rcx], rax
mov rcx, qword [r15]
mov rdx, qword [r12 + rcx]
xor r9d, r9d
test rdx, rdx
je 0x14003f550
lea rcx, [rsi + 1]
lea rax, [rcx - 1]
cmp rax, 0x7ffffffe
ja 0x14003f4c9
cmp rsi, 0x7ffffffe
ja 0x14003f4ce
mov r8, r13
sub r8, rdx
lea rax, [rcx - 1]
test rax, rax
je 0x14003f4b8
movzx eax, word [r8 + rdx]
test ax, ax
je 0x14003f4b8
mov word [rdx], ax
add rdx, 2
dec rcx
jmp 0x14003f499
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r9w
jmp 0x14003f4d2
test rcx, rcx
je 0x14003f4d2
mov word [rdx], r9w
mov rax, qword [r15]
mov rcx, qword [r12 + rax]
mov word [rcx + rsi*2], r9w
lea r13, [r13 + rsi*2]
add r13, 2
inc r14d
add r12, 8
cmp r14d, edi
jb 0x14003f43d
xor r12d, r12d
mov rax, qword [rbp + 0x50]
mov dword [rax], edi
lea rcx, [rbp - 0x18]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.vdsutil.dll_VdsHeapFree]
nop dword [rax + rax]
xor eax, eax
mov qword [rbp - 0x20], r12
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r12d, r12d
test r14d, r14d
je 0x14003f590
mov edi, r12d
mov esi, r14d
mov rax, rcx
mov rdx, qword [rdi + rax]
test rdx, rdx
je 0x14003f586
mov rcx, rdx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [r15]
mov qword [rdi + rax], r12
mov rax, qword [r15]
mov rcx, rax
add rdi, 8
sub rsi, 1
jne 0x14003f561
test rcx, rcx
je 0x14003f5a4
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [r15], r12
lea rcx, [rbp - 0x18]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
nop
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.vdsutil.dll_VdsHeapFree]
nop dword [rax + rax]
mov edi, 8
mov eax, edi
jmp 0x14003f533