Function at 0x1400d280c
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6e8]
sub rsp, 0x7b0
mov qword [rbp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14015d3e0]
xor rax, rsp
mov qword [rbp + 0x6a0], rax
mov r15, rdx
mov r13, rcx
lea r14, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], r14
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4aa
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
xor ebx, ebx
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rbx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.1400bec34
nop
mov rdx, qword [r15 + 0x10]
or rsi, 0xffffffffffffffff
mov rdi, rsi
inc rdi
cmp word [rdx + rdi*2], bx
jne 0x1400d28bd
mov r12d, 0x104
cmp rdi, r12
jae 0x1400d2f2a
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x1400d2eaf
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
call qword [0x1400f7e80]
test al, al
je 0x1400d2eaf
lea r8d, [rdi + 1]
lea rdx, [rbp + 0x70]
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
nop dword [rax + rax]
test eax, eax
jne 0x1400d299d
mov qword [rsp + 0x38], r14
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4c4
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov rbx, qword [r15 + 0x20]
mov rdi, qword [r15 + 0x10]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9, rdi
lea r8, str.GetVolumePathName__s_s__failed_with__d
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.140009fb0
jmp 0x1400d2f1d
lea rax, [rbp + 0x70]
mov r14, rsi
inc r14
cmp word [rax + r14*2], bx
jne 0x1400d29a4
test r14, r14
je 0x1400d2f1d
mov rcx, qword [r15 + 0x10]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400d29be
cmp r14, rax
ja 0x1400d2e50
mov r8, r14
lea rdx, [rbp + 0x70]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400d2e50
mov rdx, qword [r15 + 0x10]
call fcn.1400d3f18
test al, al
je 0x1400d2a65
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rax
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4e5
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
lea r8, str.reparse_point_found_on_path__so_skipping
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.140009fb0
jmp 0x1400d2f1d
lea r8, [rbp + 0x70]
mov rdx, r12
lea rcx, [rbp + 0x70]
call fcn.14002d18c
mov edi, eax
mov dword [rbp - 8], eax
shr eax, 0x1f
test al, al
je 0x1400d2b05
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rax
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4ed
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.StringCchCopy_failed_with_0x_08lx__winerror__d
mov r9d, edi
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.140009fb0
jmp 0x1400d2f1d
cmp word [rbp + r14*2 + 0x6e], 0x5c
je 0x1400d2c22
mov rcx, r12
lea rax, [rbp + 0x70]
cmp word [rax], bx
je 0x1400d2b28
add rax, 2
sub rcx, 1
jne 0x1400d2b19
mov rax, rcx
neg rax
sbb edi, edi
not edi
and edi, 0x80070057
test rcx, rcx
je 0x1400d2b45
mov rax, r12
sub rax, rcx
jmp 0x1400d2b48
mov rax, rbx
test rcx, rcx
je 0x1400d2bab
mov rcx, r12
sub rcx, rax
lea rdx, [rbp + 0x70]
lea rdx, [rdx + rax*2]
je 0x1400d2b90
lea r8, [rax + 0x7ffffefa]
add r8, rcx
lea r9, [0x1401035b0]
sub r9, rdx
test r8, r8
je 0x1400d2b90
movzx eax, word [r9 + rdx]
test ax, ax
je 0x1400d2b90
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x1400d2b71
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], bx
neg rcx
sbb edi, edi
not edi
and edi, 0x8007007a
mov dword [rbp - 8], edi
mov eax, edi
shr eax, 0x1f
test al, al
je 0x1400d2c22
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rax
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4fb
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.StringCchCat_failed_with_0x_08lx__winerror__d
jmp 0x1400d2aeb
mov r8d, r12d
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
je 0x1400d2de1
mov dword [rbp - 8], ebx
mov r9, rbx
mov qword [rbp - 0x20], rbx
mov rcx, qword [r13 + 8]
test rcx, rcx
jne 0x1400d2c5e
mov edi, 0x80004005
jmp 0x1400d2c7c
mov rax, qword [rcx]
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x490]
mov rax, qword [rax + 0x48]
call qword [0x1400f7e80]
mov edi, eax
mov r9, qword [rbp - 0x20]
mov dword [rbp - 8], edi
mov eax, edi
shr eax, 0x1f
test al, al
je 0x1400d2cf2
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rax
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x517
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], edi
lea r9, [rbp + 0x490]
lea r8, str.GetSnapshotDeviceName__s__failed_with_0x_08lx
jmp 0x1400d2f0f
mov rax, qword [r15 + 0x10]
lea rcx, [rax + r14*2]
mov qword [rsp + 0x20], rcx
lea r8, [0x1400f9fa8]
mov rdx, r12
lea rcx, [rbp + 0x280]
call fcn.1400053e0
mov edi, eax
mov dword [rbp - 8], eax
shr eax, 0x1f
test al, al
je 0x1400d2d91
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rax
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x529
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov r9d, edi
lea r8, str.StringCchPrintf_failed_with_0x_08lx
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.140009fb0
jmp 0x1400d2f1d
lea rax, [rbp + 0x280]
inc rsi
cmp word [rax + rsi*2], bx
jne 0x1400d2d98
cmp word [rbp + rsi*2 + 0x27e], 0x5c
jne 0x1400d2dc4
lea rax, [rsi*2 - 2]
cmp rax, 0x208
jae 0x1400d2ddb
mov word [rbp + rax + 0x280], bx
lea rcx, [r15 + 8]
lea rdx, [rbp + 0x280]
call fcn.14003152c
mov dl, 1
jmp 0x1400d2f1f
call fcn.1400167c8
int3
mov edi, 0x80004005
mov dword [rbp - 8], edi
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rax
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x50a
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], edi
lea r9, [rbp + 0x70]
lea r8, str.GetVolumeNameForVolumeMountPoint__s__failed_with_0x_08lx
jmp 0x1400d2f0f
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rax
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4df
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
lea r8, str.not_a_prefix__so_skipping
jmp 0x1400d2a52
mov qword [rsp + 0x38], r14
lea rax, str.CVssDeletingWriter::FixupSnapshotVolumeSpecification
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x4b7
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov rax, qword [r15 + 0x20]
mov qword [rsp + 0x20], rax
mov r9, qword [r15 + 0x10]
lea r8, str.skipping_deletion_of__s_s_since_its_not_included_on_a_snapshot
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.140009fb0
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.140031dac
mov bl, al
lea rcx, [rbp - 0x10]
call fcn.140009990
mov al, bl
mov rcx, qword [rbp + 0x6a0]
xor rcx, rsp
call fcn.1400164a0
mov rbx, qword [rsp + 0x800]
add rsp, 0x7b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret