Function at 0x1400a5444
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x7f0
mov qword [r11 - 0x670], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x14016b400]
xor rax, rsp
mov qword [rsp + 0x7e0], rax
mov r13, r9
mov rbx, rdx
mov qword [rsp + 0x108], r8
mov qword [rsp + 0x50], r9
lea rsi, str.base_stor_vssmodulescoord_srchwdelete.cxx
mov qword [rsp + 0x58], rsi
lea r14, str.CVssHardwareProviderWrapper::RestoreSharesAndMountPointsOnVolume
mov qword [rsp + 0x60], r14
lea r15, str.CORHDELC
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x59c
mov dword [rsp + 0x74], 1
mov dword [rsp + 0x78], 0xff
xor edi, edi
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rdi + 0x78]
lea rcx, [r11 - 0x798]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.14001cce0
nop
mov dword [rsp + 0x48], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x3c0]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x1a0], rdi
lea rax, [0x1400f83f8]
mov qword [rsp + 0x198], rax
mov r8, rbx
mov edx, 0x104
lea rcx, [rsp + 0x3c0]
call fcn.1400109f0
mov ebx, eax
mov dword [rsp + 0x128], eax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x5a9
mov dword [rsp + 0x74], 1
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rdi + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x1400a55f7
cmp ebx, 0x8000ffff
jne 0x1400a55ca
mov dword [rsp + 0x110], ebx
lea rdx, [0x140167770]
lea rcx, [rsp + 0x110]
call sub.msvcrt.dll__CxxThrowException
int3
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x1c0]
call fcn.14000aeb0
lea r9, str.StringCchCopy_copy_input_volume_name
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.1400dc9fc
nop
mov r12d, 0xf
cmp byte [rsp + 0xfb], 0
je 0x1400a5645
lea rbx, [rsp + 0x80]
mov eax, r12d
mov qword [rsp + 0x100], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400a5633
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], rdi
mov rax, qword [rsp + 0x100]
add rbx, 8
sub rax, 1
mov qword [rsp + 0x100], rax
jne 0x1400a561a
lea rcx, [rsp + 0x3c0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400a5651
movzx eax, ax
cmp word [rsp + rax*2 + 0x3be], 0x5c
je 0x1400a57c4
mov eax, 0x104
lea rcx, [rsp + 0x3c0]
cmp word [rcx], 0
je 0x1400a568a
add rcx, 2
sub rax, 1
jne 0x1400a567a
mov ebx, 0x80070057
test rax, rax
cmovne ebx, edi
je 0x1400a56a2
mov r8d, 0x104
sub r8, rax
jmp 0x1400a56a5
mov r8, rdi
test rax, rax
je 0x1400a570b
mov ecx, 0x104
sub rcx, r8
lea rdx, [rsp + 0x3c0]
lea rdx, [rdx + r8*2]
je 0x1400a56f5
lea rax, [r8 + 0x7ffffefa]
add rax, rcx
lea r8, [0x1400fd76c]
sub r8, rdx
test rax, rax
je 0x1400a56f5
movzx r9d, word [rdx + r8]
test r9w, r9w
je 0x1400a56f5
mov word [rdx], r9w
add rdx, 2
dec rax
sub rcx, 1
jne 0x1400a56d4
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov ebx, 0x8007007a
cmovne ebx, edi
mov dword [rsp + 0x128], ebx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x5b2
mov dword [rsp + 0x74], 1
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x1400a5797
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x1c0]
call fcn.14000aeb0
lea r9, str.StringCchCat_fails_to_concat_backslash
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.1400dc9fc
nop
cmp byte [rsp + 0xfb], 0
je 0x1400a57c4
lea rbx, [rsp + 0x80]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400a57ba
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], rdi
add rbx, 8
sub r12, 1
jne 0x1400a57a9
mov eax, edi
test r13, r13
sete al
mov dword [rsp + 0x4c], eax
test r13, r13
je 0x1400a5bfe
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xea
je 0x1400a589b
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x5c7
mov dword [rsp + 0x74], 1
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400a585c
movzx ebx, ax
or ebx, 0x80070000
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1400a586e
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x28], ebx
lea rcx, [rsp + 0x3c0]
mov qword [rsp + 0x20], rcx
lea r9, str.GetVolumePathNamesForVolumeName__s__fails_with_0x_08lx
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.1400dc25c
mov edx, dword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov rbx, rax
mov qword [rsp + 0x1a0], rax
test rax, rax
jne 0x1400a58de
mov dword [rsp + 0x114], 0x8007000e
lea rdx, [0x140167770]
lea rcx, [rsp + 0x114]
call sub.msvcrt.dll__CxxThrowException
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x1400a599a
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x5cf
mov dword [rsp + 0x74], 1
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rax + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400a595b
movzx ebx, ax
or ebx, 0x80070000
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1400a596d
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x28], ebx
lea rcx, [rsp + 0x3c0]
mov qword [rsp + 0x20], rcx
lea r9, str.GetVolumePathNamesForVolumeName__s__fails_with_0x_08lx
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.1400dc25c
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400a599e
test rax, rax
je 0x1400a5a53
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteVolumeMountPointW]
test eax, eax
jne 0x1400a5a36
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x5db
mov dword [rsp + 0x74], 1
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rax + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, str.Fail_to_delete_mount_point__s_for_volume__s__winerror__d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.14001cc70
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x1400a5a3a
lea rbx, [rbx + rax*2]
add rbx, 2
jne 0x1400a599a
mov r12, r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], 0
jne 0x1400a5a5a
test rax, rax
je 0x1400a5bfe
lea rdx, [rsp + 0x3c0]
mov rcx, r12
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_1.dll_SetVolumeMountPointW]
test eax, eax
jne 0x1400a5be0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x5eb
mov dword [rsp + 0x74], 6
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rax + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
mov r8, r12
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x58]
call fcn.14000ad60
lea r8, [rsp + 0x3c0]
lea rdx, [rsp + 0x268]
mov rcx, rax
call fcn.14000ad60
mov rbx, rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.14000af8c
mov r9d, 1
mov r8, rax
mov edx, 0x3041
lea rcx, [rsp + 0x120]
call fcn.1400db328
lea rcx, [rsp + 0x268]
call fcn.14000ae60
lea rcx, [rsp + 0x310]
call fcn.14000ae60
lea rcx, [rsp + 0x58]
call fcn.14000ae60
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x5ed
mov dword [rsp + 0x74], 6
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1400a5bab
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, str.SetVolumeMountPoint__s___s__fails_with_0x_08lx
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.14001cc70
mov dword [rsp + 0x4c], 1
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [r12 + rax*2], 0
jne 0x1400a5be4
lea r12, [r12 + rax*2]
add r12, 2
jne 0x1400a5a56
jmp 0x1400a5c22
mov ebx, dword [rsp + 0x128]
test ebx, ebx
jns 0x1400a5c9e
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x5fb
mov dword [rsp + 0x74], 1
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x3c0]
lea r8, str.Fail_to_restore_all_mount_points_for__s.__0_08lx_._Continuing.
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.14001cc70
mov dword [rsp + 0x128], edi
mov ecx, edi
mov dword [rsp + 0x50], ecx
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 8]
test eax, eax
jle 0x1400a5f5e
mov rdx, rdi
mov qword [rsp + 0x40], rdx
movsxd r12, dword [rsp + 0x4c]
test rdx, rdx
js 0x1400a6008
cmp ecx, eax
jge 0x1400a6008
mov rax, qword [rsp + 0x108]
mov rbx, qword [rax]
add rbx, rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x5d0]
call sub.msvcrt.dll_memset
or rcx, 0xffffffffffffffff
lea rcx, [rcx + 1]
cmp word [rbx + rcx*2 + 8], 0
jne 0x1400a5cfc
mov rax, qword [rbx]
mov rdx, qword [rax + 0x28]
lea rax, [rdx + rcx*2]
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x5d0]
test r12, r12
lea r9, [rsp + 0x3c0]
jne 0x1400a5d3c
mov r9, r13
call fcn.140027130
mov dword [rsp + 0x128], eax
mov r12d, eax
shr eax, 0x1f
test al, al
jne 0x1400a5fa6
mov rdx, qword [rbx]
xor r8d, r8d
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.srvcli.dll_NetShareDel]
mov r12d, eax
test eax, eax
je 0x1400a5dd7
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x617
mov dword [rsp + 0x74], 6
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
mov r9, qword [rbx]
mov dword [rsp + 0x20], r12d
mov r9, qword [r9]
lea r8, str.NetShareDel__s__failed_with__d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.14001cc70
mov rax, qword [rbx]
mov r12, qword [rax + 0x28]
lea rcx, [rsp + 0x5d0]
mov qword [rax + 0x28], rcx
xor r9d, r9d
mov r8, qword [rbx]
mov edx, 0x1f6
xor ecx, ecx
call qword [sym.imp.srvcli.dll_NetShareAdd]
mov dword [rsp + 0x100], eax
test eax, eax
je 0x1400a5f29
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x61f
mov dword [rsp + 0x74], 6
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x5d0]
lea rdx, [rsp + 0x268]
lea rcx, [rsp + 0x58]
call fcn.14000ad60
mov r8d, dword [rsp + 0x100]
lea rdx, [rsp + 0x310]
mov rcx, rax
call fcn.14000af8c
mov r9d, 1
mov r8, rax
mov edx, 0x3042
lea rcx, [rsp + 0x120]
call fcn.1400db328
lea rcx, [rsp + 0x268]
call fcn.14000ae60
lea rcx, [rsp + 0x58]
call fcn.14000ae60
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x620
mov dword [rsp + 0x74], 6
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
mov r9, qword [rbx]
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9, qword [r9]
lea r8, str.NetShareAdd__s___s__failed_with__d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.14001cc70
mov rax, qword [rbx]
mov qword [rax + 0x28], r12
mov ecx, dword [rsp + 0x50]
inc ecx
mov dword [rsp + 0x50], ecx
mov rdx, qword [rsp + 0x40]
add rdx, 0x210
mov qword [rsp + 0x40], rdx
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 8]
cmp ecx, eax
jl 0x1400a5cbf
lea rcx, [rsp + 0x198]
call fcn.140027ab0
nop
lea rcx, [rsp + 0x120]
call fcn.14001ce00
mov rcx, qword [rsp + 0x7e0]
xor rcx, rsp
call fcn.1400321c0
lea r11, [rsp + 0x7f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x613
mov dword [rsp + 0x74], 1
mov dword [rsp + 0x78], 0xff
mov dword [rsp + 0xf8], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
lea r9, str.StringCchPrintfW__
mov r8d, r12d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.1400dcb7c
int3
call fcn.140071100
int3