Function at 0x140022650
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov qword [rsp + 0x688], rbx
mov rax, qword [0x14016b400]
xor rax, rsp
mov qword [rbp + 0x520], rax
movzx r15d, r9b
mov r14, r8
mov qword [rbp + 8], r8
mov rdi, rdx
mov qword [rsp + 0x40], rdx
mov rbx, rcx
mov qword [rbp + 0x18], rcx
lea r12, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], r12
lea r13, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], r13
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x332
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
xor esi, esi
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rsi + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14001cce0
nop
test r15b, r15b
jne 0x140022af1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x100]
call sub.msvcrt.dll_memset
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x310]
call sub.msvcrt.dll_memset
mov edx, 0x104
lea rcx, [rbp + 0x100]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstVolumeW]
mov r15, rax
lea rax, [0x1400f8528]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], r15
mov rbx, qword [rbp + 0x5b0]
mov r12, qword [rbp + 0x5a8]
mov r13, qword [rbp + 0x5a0]
cmp r15, 0xffffffffffffffff
je 0x140054574
mov al, 1
test al, al
je 0x14005458a
lea rcx, [rbp + 0x100]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 3
jne 0x140022ac5
lea rcx, [rbp + 0x100]
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400227b2
lea ecx, [rax - 1]
add rcx, rcx
cmp word [rbp + rcx + 0x100], 0x5c
jne 0x1400227e3
cmp rcx, 0x208
jae 0x140022cc3
mov word [rbp + rcx + 0x100], si
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x14002282a
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x100]
lea r8, [0x1400fd5a8]
mov edx, 0x104
lea rcx, [rbp + 0x310]
call fcn.140027130
mov esi, eax
mov dword [rbp + 0x88], eax
test eax, eax
js 0x14005460e
xor cl, cl
test cl, cl
jne 0x140054615
mov rsi, qword [rdi + 0x20]
movzx eax, byte [rdi]
mov byte [rbp + 0x20], al
mov word [rbp + 0x21], 0
lea rcx, [0x1400f83f8]
mov qword [rbp + 0x28], rcx
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x598]
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x310]
or rdi, 0xffffffffffffffff
lea rdi, [rdi + 1]
cmp word [rax + rdi*2], 0
jne 0x140022871
lea rdx, [rdi*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov qword [rbp + 0x30], rax
test rax, rax
je 0x1400547b7
lea rdx, [rdi + 1]
xor r11d, r11d
mov r10d, r11d
lea rcx, [rdx - 1]
cmp rcx, 0x7ffffffe
ja 0x1400546a5
test r10d, r10d
js 0x1400546bf
mov r10d, r11d
test rdx, rdx
je 0x1400546b0
mov r8d, 0x7ffffffe
sub r8, rdx
lea r9, [rbp + 0x310]
sub r9, rax
nop dword [rax]
lea rcx, [r8 + rdx]
test rcx, rcx
je 0x140022905
movzx ecx, word [r9 + rax]
test cx, cx
je 0x140022905
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x1400228e0
jmp 0x1400546b0
test rdx, rdx
je 0x1400546b0
mov word [rax], r11w
test r10d, r10d
js 0x140054796
or rdi, 0xffffffffffffffff
nop
lea rdi, [rdi + 1]
cmp word [rsi + rdi*2], r11w
jne 0x140022920
lea rdx, [rdi*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov rdx, rax
mov qword [rbp + 0x40], rax
test rax, rax
je 0x14005477e
lea r8, [rdi + 1]
xor eax, eax
mov r9d, eax
lea rcx, [r8 - 1]
cmp rcx, 0x7ffffffe
ja 0x1400546cd
test r9d, r9d
js 0x1400546e7
mov r9d, eax
test r8, r8
je 0x1400546d8
mov ecx, 0x7ffffffe
sub rcx, r8
sub rsi, rdx
lea rax, [r8 + rcx]
test rax, rax
je 0x1400229a9
movzx eax, word [rdx + rsi]
test ax, ax
je 0x1400229a9
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x140022985
jmp 0x1400546d8
test r8, r8
je 0x1400546d8
xor esi, esi
mov word [rdx], si
test r9d, r9d
js 0x14005475d
or rdi, 0xffffffffffffffff
inc rdi
cmp word [r14 + rdi*2], 0
jne 0x1400229c4
lea rdx, [rdi*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov rdx, rax
mov qword [rbp + 0x58], rax
test rax, rax
je 0x140054745
inc rdi
mov r9d, esi
lea rcx, [rdi - 1]
cmp rcx, 0x7ffffffe
ja 0x1400546f7
test r9d, r9d
js 0x140054711
mov r9d, esi
test rdi, rdi
je 0x140054702
mov ecx, 0x7ffffffe
sub rcx, rdi
mov r8, r14
sub r8, rax
nop dword [rax]
lea rax, [rdi + rcx]
test rax, rax
je 0x140022a55
movzx eax, word [rdx + r8]
test ax, ax
je 0x140022a55
mov word [rdx], ax
add rdx, 2
sub rdi, 1
jne 0x140022a30
jmp 0x140054702
test rdi, rdi
je 0x140054702
mov word [rdx], si
test r9d, r9d
js 0x140054722
movzx eax, byte [rbp + 0x590]
mov byte [rsp + 0x30], al
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 0x20]
mov rcx, qword [rbp + 0x18]
call fcn.140021a60
nop
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140022aa2
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140022ab1
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140022ac0
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rdi, qword [rsp + 0x40]
mov r8d, 0x104
lea rdx, [rbp + 0x100]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextVolumeW]
test eax, eax
jne 0x14002277d
lea rcx, [rbp + 0x70]
call fcn.140030b28
jmp 0x140022c8d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140054a8f
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400f9ec0]
mov rsi, rax
test rax, rax
je 0x140054a8f
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140054a41
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x40]
call qword [0x1400f9ec0]
mov edi, eax
test eax, eax
je 0x140054a41
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x100]
call sub.msvcrt.dll_memset
xor eax, eax
mov r14d, eax
test edi, edi
je 0x140022c8d
mov r12, qword [rbp + 0x5a8]
mov r13, qword [rbp + 0x5a0]
mov r8, qword [rsi]
mov edx, 0x104
lea rcx, [rbp + 0x100]
call fcn.1400109f0
mov ebx, eax
mov dword [rbp + 0x88], eax
test eax, eax
js 0x1400547cf
xor al, al
test al, al
jne 0x1400547d6
lea rcx, [rbp + 0x100]
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140022ba3
mov rcx, qword [rsp + 0x40]
mov r8, qword [rcx + 0x10]
test r8, r8
je 0x140054854
mov dl, 1
lea ecx, [rax - 1]
add rcx, rcx
test dl, dl
je 0x140054a14
cmp word [rbp + rcx + 0x100], 0x5c
jne 0x14005485b
mov edx, 0x104
lea rcx, [rbp + 0x100]
call fcn.140029908
mov ebx, eax
mov dword [rbp + 0x88], eax
test eax, eax
js 0x14005498f
xor al, al
test al, al
jne 0x140054996
mov rdx, qword [rsp + 0x40]
mov rax, qword [rdx + 0x20]
mov rcx, qword [rbp + 8]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x598]
mov qword [rsp + 0x20], rax
movzx edx, byte [rdx]
lea rcx, [rbp + 0x20]
call fcn.1400173b0
nop
movzx eax, byte [rbp + 0x590]
mov byte [rsp + 0x30], al
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r9, qword [rbp + 0x5b0]
movzx r8d, r15b
lea rdx, [rbp + 0x20]
mov rcx, qword [rbp + 0x18]
call fcn.140021a60
nop
lea rcx, [rbp + 0x20]
call fcn.14001706c
inc r14d
add rsi, 8
cmp r14d, edi
jb 0x140022b6a
lea rcx, [rbp + 0x80]
call fcn.14001ce00
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.1400321c0
mov rbx, qword [rsp + 0x688]
add rsp, 0x630
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400324a4
nop
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x12
je 0x140022ae3
xor al, al
jmp 0x140022789
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x347
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
mov edi, dword [rbp + 0x88]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, edi
lea r8, str.FindFirstVolumeW_FindNextVolumeW_fails_with_0x_08lx_winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14001cc70
nop
jmp 0x140022ac0
mov cl, 1
jmp 0x140022822
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x367
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
mov rdi, qword [rdi + 0x10]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x100]
lea r8, str.StringCchPrintf_fails_for__s_s_with_0x_08lx_winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14001cc70
xor esi, esi
jmp 0x140022ac0
mov r10d, 0x80070057
jmp 0x1400228b4
sub rax, 2
mov r10d, 0x8007007a
jmp 0x14002290e
test rdx, rdx
je 0x140022912
jmp 0x14002290e
mov r9d, 0x80070057
jmp 0x140022965
sub rdx, 2
mov r9d, 0x8007007a
jmp 0x1400229b2
xor esi, esi
test r8, r8
je 0x1400229b7
jmp 0x1400229b4
mov r9d, 0x80070057
jmp 0x140022a06
sub rdx, 2
mov r9d, 0x8007007a
jmp 0x140022a5e
test rdi, rdi
je 0x140022a61
mov word [rax], si
jmp 0x140022a61
lea rcx, [rbp + 0x50]
call fcn.1400275bc
mov dword [rsp + 0x40], 0x8000ffff
lea rdx, [0x140167770]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rbp - 8], 0x8007000e
lea rdx, [0x140167770]
lea rcx, [rbp - 8]
call sub.msvcrt.dll__CxxThrowException
int3
lea rcx, [rbp + 0x38]
call fcn.1400275bc
mov dword [rbp - 4], 0x8000ffff
lea rdx, [0x140167770]
lea rcx, [rbp - 4]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rbp], 0x8007000e
lea rdx, [0x140167770]
lea rcx, [rbp]
call sub.msvcrt.dll__CxxThrowException
int3
lea rcx, [rbp + 0x28]
call fcn.1400275bc
mov dword [rbp + 0x10], 0x8000ffff
lea rdx, [0x140167770]
lea rcx, [rbp + 0x10]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rbp + 8], 0x8007000e
lea rdx, [0x140167770]
lea rcx, [rbp + 8]
call sub.msvcrt.dll__CxxThrowException
nop
mov al, 1
jmp 0x140022b90
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3a8
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.StringCchCopy_fails_with_0x_08lx__winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14001cc70
nop
jmp 0x140022c7d
xor dl, dl
jmp 0x140022bc2
mov eax, 0x104
lea rcx, [rbp + 0x100]
cmp word [rcx], 0
je 0x140054877
add rcx, 2
sub rax, 1
jne 0x140054867
mov ebx, 0x80070057
test rax, rax
mov r11d, 0
cmovne ebx, r11d
je 0x140054895
mov ecx, 0x104
sub rcx, rax
jmp 0x140054898
mov rcx, r11
test rax, rax
je 0x1400548fe
mov edx, 0x104
sub rdx, rcx
lea r9, [rbp + 0x100]
lea r9, [r9 + rcx*2]
je 0x1400548e6
lea rax, [rcx + 0x7ffffefa]
add rax, rdx
lea r10, [0x1400fd76c]
sub r10, r9
test rax, rax
je 0x1400548e6
movzx ecx, word [r9 + r10]
test cx, cx
je 0x1400548e6
mov word [r9], cx
add r9, 2
dec rax
sub rdx, 1
jne 0x1400548c6
lea rax, [r9 - 2]
test rdx, rdx
cmovne rax, r9
mov word [rax], r11w
mov ebx, 0x8007007a
cmovne ebx, r11d
mov dword [rbp + 0x88], ebx
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x140022bdf
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3bd
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.StringCchCat_fails_with_0x_08lx__winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14001cc70
nop
jmp 0x140022c7d
mov al, 1
jmp 0x140022c02
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x50], rax
lea rax, str.CVssDeletingWriter::ExpandFilesAllVolumes
mov qword [rsp + 0x58], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3cd
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.StringCchCat_failed_with_0x_08lx__winerror__d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14001cc70
nop
jmp 0x140022c7d
cmp word [rbp + rcx + 0x100], 0x5c
jne 0x140022c0a
cmp rcx, 0x208
jae 0x140054a3b
xor eax, eax
mov word [rbp + rcx + 0x100], ax
jmp 0x140022c0a
call fcn.1400324a4
int3
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x398
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, str.GetCurrentVolumeArray_returns_0
jmp 0x140054adb
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
lea rax, str.WRTDELET
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x391
mov dword [rsp + 0x6c], 4
mov dword [rsp + 0x70], 0xff
mov dword [rbp - 0x10], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
lea r8, str.GetCurrentVolumeArray_returns_NULL
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14001cc70
nop
jmp 0x140022c8d