Function at 0x140009b70
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov qword [rsp + 0x688], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x520], rax
movzx esi, r9b
mov r14, r8
mov qword [rbp + 8], r8
mov rbx, rdx
mov qword [rsp + 0x40], rdx
mov r15, rcx
mov qword [rbp - 8], rcx
lea r12, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], r12
lea r13, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], r13
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x332
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
xor edi, edi
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdi + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140010990
nop
test sil, sil
jne 0x14000a069
mov word [rbp + 0x100], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x102]
call sub.msvcrt.dll_memset
mov word [rbp + 0x310], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x312]
call sub.msvcrt.dll_memset
mov edx, 0x104
lea rcx, [rbp + 0x100]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindFirstVolumeW]
mov rsi, rax
lea rax, str._C_r_
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rsi
mov r12, qword [rbp + 0x5a8]
mov r13, qword [rbp + 0x5a0]
nop word [rax + rax]
cmp rsi, 0xffffffffffffffff
je 0x14004c56e
mov eax, 1
test al, al
je 0x14004c584
lea rcx, [rbp + 0x100]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDriveTypeW]
cmp eax, 3
jne 0x14000a008
lea rcx, [rbp + 0x100]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140009cf0
lea ecx, [rax - 1]
add rcx, rcx
cmp word [rbp + rcx + 0x100], 0x5c
jne 0x140009d21
cmp rcx, 0x208
jae 0x14000a214
mov word [rbp + rcx + 0x100], di
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14004c699
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x100]
lea r8, [0x1400f2128]
mov edx, 0x104
lea rcx, [rbp + 0x310]
call fcn.140008be0
mov edi, eax
mov dword [rbp + 0x78], eax
xor edx, edx
test eax, eax
js 0x14004c602
mov ecx, edx
test cl, cl
jne 0x14004c60c
mov rdi, qword [rbx + 0x20]
movzx eax, byte [rbx]
mov byte [rbp + 0x20], al
mov word [rbp + 0x21], 0
lea rax, [0x1400f2350]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x598]
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x310]
or rbx, 0xffffffffffffffff
lea rbx, [rbx + 1]
cmp word [rax + rbx*2], 0
jne 0x140009db4
lea rdx, [rbx*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov qword [rbp + 0x30], rax
test rax, rax
je 0x14004c7b2
lea rdx, [rbx + 1]
xor r11d, r11d
mov r10d, r11d
lea rcx, [rdx - 1]
cmp rcx, 0x7ffffffe
ja 0x14004c6a0
test r10d, r10d
js 0x14004c6ba
mov r10d, r11d
test rdx, rdx
je 0x14004c6ab
mov r8d, 0x7ffffffe
sub r8, rdx
lea r9, [rbp + 0x310]
sub r9, rax
nop
lea rcx, [r8 + rdx]
test rcx, rcx
je 0x140009e45
movzx ecx, word [r9 + rax]
test cx, cx
je 0x140009e45
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140009e20
jmp 0x14004c6ab
test rdx, rdx
je 0x14004c6ab
mov word [rax], r11w
test r10d, r10d
js 0x14004c791
or rbx, 0xffffffffffffffff
nop
lea rbx, [rbx + 1]
cmp word [rdi + rbx*2], r11w
jne 0x140009e60
lea rdx, [rbx*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov rdx, rax
mov qword [rbp + 0x40], rax
test rax, rax
je 0x14004c779
lea r8, [rbx + 1]
xor eax, eax
mov r9d, eax
lea rcx, [r8 - 1]
cmp rcx, 0x7ffffffe
ja 0x14004c6c8
test r9d, r9d
js 0x14004c6e2
mov r9d, eax
test r8, r8
je 0x14004c6d3
mov ecx, 0x7ffffffe
sub rcx, r8
sub rdi, rdx
lea rax, [rcx + r8]
test rax, rax
je 0x140009ee9
movzx eax, word [rdi + rdx]
test ax, ax
je 0x140009ee9
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x140009ec5
jmp 0x14004c6d3
test r8, r8
je 0x14004c6d3
xor edi, edi
mov word [rdx], di
test r9d, r9d
js 0x14004c758
or rbx, 0xffffffffffffffff
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x140009f04
lea rdx, [rbx*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov rdx, rax
mov qword [rbp + 0x58], rax
test rax, rax
je 0x14004c740
inc rbx
mov r9d, edi
lea rcx, [rbx - 1]
cmp rcx, 0x7ffffffe
ja 0x14004c6f2
test r9d, r9d
js 0x14004c70c
mov r9d, edi
test rbx, rbx
je 0x14004c6fd
mov ecx, 0x7ffffffe
sub rcx, rbx
mov r8, r14
sub r8, rax
nop dword [rax]
lea rax, [rcx + rbx]
test rax, rax
je 0x140009f95
movzx eax, word [r8 + rdx]
test ax, ax
je 0x140009f95
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x140009f70
jmp 0x14004c6fd
test rbx, rbx
je 0x14004c6fd
mov word [rdx], di
test r9d, r9d
js 0x14004c71d
movzx eax, byte [rbp + 0x590]
mov byte [rsp + 0x30], al
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r9, qword [rbp + 0x5b0]
xor r8d, r8d
lea rdx, [rbp + 0x20]
mov rcx, r15
call fcn.140008f80
nop
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140009fe5
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140009ff4
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14000a003
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rbx, qword [rsp + 0x40]
mov r8d, 0x104
lea rdx, [rbp + 0x100]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindNextVolumeW]
test eax, eax
jne 0x140009cb0
cmp rsi, 0xffffffffffffffff
je 0x14000a036
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindVolumeClose]
nop
lea rcx, [rbp + 0x70]
call fcn.140010ab0
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.1400305f0
mov rbx, qword [rsp + 0x688]
add rsp, 0x630
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdi, qword [r15 + 8]
test rdi, rdi
je 0x14004c9fa
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [fcn.140031010]
mov rcx, rdi
call rbx
mov r14, rax
test rax, rax
je 0x14004c9fa
mov rdi, qword [r15 + 8]
test rdi, rdi
je 0x14004c9ac
mov rdx, qword [rdi]
mov rbx, qword [rdx + 0x40]
mov rcx, rbx
call qword [fcn.140031010]
mov rcx, rdi
call rbx
mov edi, eax
test eax, eax
je 0x14004c9ac
xor ebx, ebx
mov word [rbp + 0x100], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x102]
call sub.msvcrt.dll_memset
mov r15d, ebx
test edi, edi
je 0x14000a036
mov r12, qword [rbp + 0x5a8]
mov r13, qword [rbp + 0x5a0]
mov r8, qword [r14]
mov edx, 0x104
lea rcx, [rbp + 0x100]
call fcn.140005350
mov ebx, eax
mov dword [rbp + 0x78], eax
xor r8d, r8d
test eax, eax
js 0x14004c7ca
mov eax, r8d
test al, al
jne 0x14004c7d4
lea rcx, [rbp + 0x100]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a133
mov rdx, qword [rsp + 0x40]
cmp qword [rdx + 0x10], 0
je 0x14004c97a
dec eax
cmp word [rbp + rax*2 + 0x100], 0x5c
jne 0x14004c84f
mov r8, qword [rdx + 0x10]
mov edx, 0x104
lea rcx, [rbp + 0x100]
call fcn.140006000
mov ebx, eax
mov dword [rbp + 0x78], eax
test eax, eax
js 0x14004c8f5
xor ecx, ecx
mov eax, ecx
test al, al
jne 0x14004c8ff
mov rdx, qword [rsp + 0x40]
mov rax, qword [rdx + 0x20]
mov rcx, qword [rbp + 8]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x598]
mov qword [rsp + 0x20], rax
movzx edx, byte [rdx]
lea rcx, [rbp + 0x20]
call fcn.1400089d4
nop
movzx eax, byte [rbp + 0x590]
mov byte [rsp + 0x30], al
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r9, qword [rbp + 0x5b0]
movzx r8d, sil
lea rdx, [rbp + 0x20]
mov rcx, qword [rbp - 8]
call fcn.140008f80
nop
lea rcx, [rbp + 0x20]
call fcn.140008948
inc r15d
add r14, 8
cmp r15d, edi
jae 0x14000a036
jmp 0x14000a0f9
call fcn.140030a08
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0x12
je 0x14000a026
mov eax, edi
jmp 0x140009cbf
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x347
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
mov ebx, dword [rbp + 0x78]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.FindFirstVolumeW_FindNextVolumeW_fails_with_0x_08lx_winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140010920
nop
jmp 0x14000a003
mov ecx, 1
jmp 0x140009d63
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x367
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
mov rbx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x100]
lea r8, str.StringCchPrintf_fails_for__s_s_with_0x_08lx_winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140010920
xor edi, edi
jmp 0x14000a003
xor edx, edx
jmp 0x140009d6b
mov r10d, 0x80070057
jmp 0x140009df7
sub rax, 2
mov r10d, 0x8007007a
jmp 0x140009e4e
test rdx, rdx
je 0x140009e52
jmp 0x140009e4e
mov r9d, 0x80070057
jmp 0x140009ea5
sub rdx, 2
mov r9d, 0x8007007a
jmp 0x140009ef2
xor edi, edi
test r8, r8
je 0x140009ef7
jmp 0x140009ef4
mov r9d, 0x80070057
jmp 0x140009f46
sub rdx, 2
mov r9d, 0x8007007a
jmp 0x140009f9e
test rbx, rbx
je 0x140009fa1
mov word [rax], di
jmp 0x140009fa1
lea rcx, [rbp + 0x50]
call fcn.14001e0e8
mov dword [rsp + 0x40], 0x8000ffff
lea rdx, [0x140156368]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rbp + 0x10], 0x8007000e
lea rdx, [0x140156368]
lea rcx, [rbp + 0x10]
call sub.msvcrt.dll__CxxThrowException
int3
lea rcx, [rbp + 0x38]
call fcn.14001e0e8
mov dword [rbp], 0x8000ffff
lea rdx, [0x140156368]
lea rcx, [rbp]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rbp + 0x18], 0x8007000e
lea rdx, [0x140156368]
lea rcx, [rbp + 0x18]
call sub.msvcrt.dll__CxxThrowException
int3
lea rcx, [rbp + 0x28]
call fcn.14001e0e8
mov dword [rbp - 8], 0x8000ffff
lea rdx, [0x140156368]
lea rcx, [rbp - 8]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rbp + 8], 0x8007000e
lea rdx, [0x140156368]
lea rcx, [rbp + 8]
call sub.msvcrt.dll__CxxThrowException
nop
mov eax, 1
jmp 0x14000a120
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3a8
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.StringCchCopy_fails_with_0x_08lx__winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140010920
nop
jmp 0x14000a1ff
lea r8, [0x1400f2048]
mov edx, 0x104
lea rcx, [rbp + 0x100]
call fcn.140006000
mov ebx, eax
mov dword [rbp + 0x78], eax
test eax, eax
jns 0x14004c8eb
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3bd
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.StringCchCat_fails_with_0x_08lx__winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140010920
nop
jmp 0x14000a1ff
mov rdx, qword [rsp + 0x40]
jmp 0x14000a15e
mov eax, 1
jmp 0x14000a184
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3cd
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.StringCchCat_failed_with_0x_08lx__winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140010920
nop
jmp 0x14000a1ff
lea ecx, [rax - 1]
add rcx, rcx
cmp word [rbp + rcx + 0x100], 0x5c
jne 0x14000a191
cmp rcx, 0x208
jae 0x14004c9a6
mov word [rbp + rcx + 0x100], r8w
jmp 0x14000a191
call fcn.140030a08
int3
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x398
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, str.GetCurrentVolumeArray_returns_0
jmp 0x14004ca46
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x391
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, str.GetCurrentVolumeArray_returns_NULL
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140010920
nop
jmp 0x14000a036