Function at 0x2100ee520
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rax, qword gs:[0x30]
mov qword [rcx], 0
mov rax, qword [rax + 8]
lea r12, [rsp + 0x68]
lea rbx, [rsp + 0xb0]
mov qword [rsp + 0x180], rcx
mov rcx, r12
lea r13, [rsp + 0x5c]
lea rbp, [rsp + 0x70]
mov eax, dword [rax - 0x2cc8]
mov dword [rsp + 0x68], eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov eax, dword [rax - 0x2cc4]
mov dword [rsp + 0x6c], eax
call method.tmp_pathbuf.w_get__
mov rcx, r12
mov rsi, rax
call method.tmp_pathbuf.w_get__
mov edx, 0x40
mov rcx, rbx
mov rdi, rax
call sym.FindFirstVolumeW
mov r12, rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x48], rax
cmp r12, 0xffffffffffffffff
je 0x2100ee840
nop dword [rax]
mov r9, r13
mov r8d, 0x8000
mov rdx, rdi
mov rcx, rbx
call sym.GetVolumePathNamesForVolumeNameW
test eax, eax
je 0x2100ee628
cmp word [rdi], 0
je 0x2100ee628
mov edx, 0x5c
mov rcx, rbx
call sym.msys_2.0.dll_wcsrchr
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
mov word [rax], r9w
mov r8d, 0x8000
call sym.QueryDosDeviceW
test eax, eax
jne 0x2100ee690
lea rax, [0x210273880]
test byte [rax], 1
jne 0x2100ee808
nop dword [rax]
mov r8d, 0x40
mov rdx, rbx
mov rcx, r12
call sym.FindNextVolumeW
test eax, eax
jne 0x2100ee5c8
mov rcx, r12
call sym.FindVolumeClose
mov edx, dword [rsp + 0x68]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc8], edx
mov edx, dword [rsp + 0x6c]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc4], edx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x60]
mov dword [rsp + 0x44], 0xa
lea r15, [rsp + 0x80]
mov qword [rsp + 0x38], rax
nop word [rax + rax]
mov rdx, rsi
mov rcx, rbp
call sym.RtlInitUnicodeString
mov rcx, qword [rsp + 0x38]
mov r8, r15
mov edx, 1
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
call sym.NtOpenSymbolicLinkObject
test eax, eax
js 0x2100ee75e
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x70], 0xfffe0000
call sym.NtQuerySymbolicLinkObject
mov rcx, qword [rsp + 0x60]
mov r14d, eax
call sym.NtClose
test r14d, r14d
js 0x2100ee75e
movzx eax, word [rsp + 0x70]
xor r8d, r8d
and rax, 0xfffffffffffffffe
sub dword [rsp + 0x44], 1
mov word [rsi + rax], r8w
jne 0x2100ee6b0
mov ecx, 0x28
call sym.operator_new_unsigned_long_
mov rcx, rdi
mov qword [rax], 0
mov r14, rax
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
call sym.msys_2.0.dll_wcsdup
mov rcx, rsi
mov qword [r14 + 0x18], rax
call sym.msys_2.0.dll_wcsdup
mov rcx, qword [r14 + 0x18]
mov qword [r14 + 0x20], rax
test rax, rax
je 0x2100ee871
test rcx, rcx
je 0x2100ee871
call sym.msys_2.0.dll_wcslen
mov rdx, qword [r14 + 0x18]
xor ecx, ecx
sub rax, 1
mov qword [r14 + 8], rax
mov word [rdx + rax*2], cx
mov rcx, qword [r14 + 0x20]
call sym.msys_2.0.dll_wcslen
mov qword [r14 + 0x10], rax
mov rax, qword [rsp + 0x180]
mov rax, qword [rax]
mov qword [r14], rax
mov rax, qword [rsp + 0x180]
mov qword [rax], r14
jmp 0x2100ee628
call sym.GetLastError
mov qword [rsp + 0x20], rbx
mov edx, 0x40
lea r9, str.Unable_to_determine_the_native_mapping_for__ls__error__u_
mov dword [rsp + 0x28], eax
lea r8, str.dos_drive_mappings::dos_drive_mappings__
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100ee628
test byte [0x210273880], 1
je 0x2100ee645
lea r9, str.FindFirstVolumeW___E
lea r8, str.dos_drive_mappings::dos_drive_mappings__
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100ee645
call sym.free_1
mov rcx, qword [r14 + 0x20]
call sym.free_1
mov edx, 0x28
mov rcx, r14
call sym.operator_delete_void__unsigned_long_
jmp 0x2100ee628