Function at 0x140004670
Capabilities:
Create thread
Get disk information
Get system information on windows
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x40], xmm6
mov qword [rbp + 0x38], 0xfffffffffffffffe
stmxcsr dword [rbp + 8]
or dword [rbp + 8], 0x8040
ldmxcsr dword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov dword [rbp + 8], 0x5c3a63
xor ebx, ebx
lea r14, [rbp + 8]
mov r15, qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor edi, edi
jmp 0x1400046d7
inc ebx
cmp ebx, 0x1a
je 0x1400046f7
bt esi, ebx
jae 0x1400046d0
lea eax, [rbx + 0x41]
mov byte [rbp + 8], al
mov rcx, r14
call r15
and eax, 0xfffffffe
xor ecx, ecx
cmp eax, 2
sete cl
add edi, ecx
jmp 0x1400046d0
cmp edi, 1
jne 0x140004707
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x28], 1
jne 0x140004722
mov ecx, 0x3d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140004570]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
mov edi, 0xa
mov rbx, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop word cs:[rax + rax]
mov rcx, rsi
mov edx, 0x64
call rbx
dec edi
test eax, eax
jne 0x140004760
test edi, edi
jne 0x140004c11
xor ebx, ebx
xorps xmm6, xmm6
jmp 0x140004798
mov rcx, r13
call fcn.14000aa54
inc rbx
cmp rbx, 0xf7
je 0x140004c1c
lea rax, [0x14000d160]
mov qword [rbp - 0x40], rbx
mov r15, qword [rax + rbx*8]
mov qword [rbp + 8], 0
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rsi, rax
cmp rax, 0xf
jbe 0x140004810
test rsi, rsi
js 0x140005014
mov rdi, rsi
or rdi, 0xf
cmp rdi, 0x17
mov eax, 0x16
cmovb rdi, rax
cmp rdi, 0xfff
jb 0x140004830
lea rcx, [rdi + 0x28]
call fcn.14000aa10
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14000483c
mov qword [rbp + 0x18], rsi
lea rcx, [rbp + 8]
mov rdx, r15
mov r8, rsi
call fcn.1400051d0
mov byte [rbp + rsi + 8], 0
jmp 0x14000485a
lea rcx, [rdi + 1]
call fcn.14000aa10
mov rbx, rax
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov rcx, rbx
mov rdx, r15
mov r8, rsi
call fcn.1400051d0
mov byte [rbx + rsi], 0
mov qword [rbp + 8], rbx
mov r14, qword [0x140011a48]
mov rax, qword [r14 + 8]
xor r12d, r12d
cmp byte [rax + 0x19], 0
je 0x1400048a0
mov rdi, rax
mov r13, r14
cmp byte [r13 + 0x19], 0
jne 0x140004977
mov rbx, r13
cmp qword [r13 + 0x38], 0x10
jb 0x14000492a
mov rdx, qword [rbx + 0x20]
jmp 0x14000492e
cmp qword [rbp + 0x20], 0x10
lea r15, [rbp + 8]
jb 0x1400048af
mov r15, qword [rbp + 8]
mov rsi, qword [rbp + 0x18]
mov r13, r14
jmp 0x1400048d5
mov r12d, 1
mov r13, rdi
mov rax, rdi
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x140004874
mov rdi, rax
cmp qword [rax + 0x38], 0x10
jb 0x1400048f0
mov rcx, qword [rdi + 0x20]
jmp 0x1400048f4
lea rcx, [rdi + 0x20]
mov rbx, qword [rdi + 0x30]
cmp rsi, rbx
mov r8, rbx
cmovb r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcmp
xor ecx, ecx
cmp rbx, rsi
setb cl
xor edx, edx
test eax, eax
sets dl
cmovne ecx, edx
cmp cl, 1
jne 0x1400048c0
lea rax, [rdi + 0x10]
xor r12d, r12d
jmp 0x1400048cc
lea rdx, [rbx + 0x20]
mov r15, qword [rbx + 0x30]
mov r13, qword [rbp + 8]
mov rsi, qword [rbp + 0x18]
mov rax, qword [rbp + 0x20]
mov qword [rbp - 8], rax
cmp rax, 0x10
lea rcx, [rbp + 8]
cmovae rcx, r13
cmp r15, rsi
mov r8, rsi
cmovb r8, r15
call sub.VCRUNTIME140.dll_memcmp
xor ecx, ecx
cmp rsi, r15
setae cl
xor edx, edx
test eax, eax
setns dl
cmovne ecx, edx
test cl, cl
jne 0x140004ab8
movabs rax, 0x2aaaaaaaaaaaaaa
cmp qword [0x140011a50], rax
je 0x14000500f
lea rax, [0x140011a48]
mov qword [rbp - 0x50], rax
mov ecx, 0x60
call fcn.14000aa10
mov qword [rax + 0x20], 0
movups xmmword [rax + 0x30], xmm6
mov rdx, qword [rbp + 8]
mov rbx, rax
mov r15, qword [rbp + 0x18]
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
lea r13, [rbp + 8]
mov qword [rbp - 0x38], rdx
cmovae r13, rdx
cmp r15, 0xf
mov qword [rbp - 8], rax
ja 0x140004a00
mov rax, rbx
add rax, 0x20
movups xmm0, xmmword [r13]
movups xmmword [rax], xmm0
mov qword [rbx + 0x30], r15
mov qword [rbx + 0x38], 0xf
jmp 0x140004a68
mov qword [rbp], rbx
mov rsi, r15
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
cmovae rsi, rax
cmp rsi, 0xfff
jb 0x140004a40
lea rcx, [rsi + 0x28]
call fcn.14000aa10
mov rcx, rax
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004a49
lea rcx, [rsi + 1]
call fcn.14000aa10
mov rbx, qword [rbp]
mov qword [rbx + 0x20], rax
lea r8, [r15 + 1]
mov rcx, rax
mov rdx, r13
call fcn.1400051d0
mov qword [rbx + 0x30], r15
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x50], 0
mov qword [rbx + 0x58], 0xf
mov byte [rbx + 0x40], 0
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov word [rbx + 0x18], 0
mov qword [rbp - 0x48], 0
lea rcx, [rbp - 0x50]
call fcn.1400040f0
mov rcx, rdi
mov edx, r12d
mov r8, rbx
call fcn.1400041d0
mov r13, qword [rbp - 0x38]
lea rax, [rbp - 0x20]
movups xmmword [rax], xmm6
mov r15, qword [rbx + 0x50]
cmp qword [rbx + 0x58], 0x10
jb 0x140004b10
mov rbx, qword [rbx + 0x40]
cmp r15, 0xf
jbe 0x140004b1a
mov rsi, r15
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
cmovae rsi, rax
cmp rsi, 0xfff
jb 0x140004b40
lea rcx, [rsi + 0x28]
call fcn.14000aa10
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004b4c
add rbx, 0x40
cmp r15, 0xf
ja 0x140004ad4
movups xmm0, xmmword [rbx]
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov esi, 0xf
mov rdi, qword [rbp - 0x30]
jmp 0x140004b67
lea rcx, [rsi + 1]
call fcn.14000aa10
mov rdi, rax
mov qword [rbp - 0x30], rdi
lea r8, [r15 + 1]
mov rcx, rdi
mov rdx, rbx
call fcn.1400051d0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], rsi
cmp rsi, 0x10
lea rcx, [rbp - 0x30]
cmovae rcx, rdi
xor edx, edx
mov r8d, 0x10
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
lea rcx, [0x140011a60]
mov rbx, qword [rbp - 0x40]
mov byte [rbx + rcx], al
cmp rsi, 0x10
jb 0x140004bce
cmp rsi, 0xfff
jb 0x140004bc0
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x140005019
add rsi, 0x28
mov rdi, rax
jmp 0x140004bc3
inc rsi
mov rcx, rdi
mov rdx, rsi
call fcn.14000aa54
mov rcx, qword [rbp - 8]
cmp rcx, 0x10
jb 0x140004788
lea rdx, [rcx + 1]
cmp rdx, 0x1000
jb 0x140004780
mov rax, qword [r13 - 8]
add r13, 0xfffffffffffffff8
sub r13, rax
cmp r13, 0x20
jae 0x140005019
add rcx, 0x28
mov rdx, rcx
mov r13, rax
jmp 0x140004780
mov ecx, 0x1f
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x140011050]
mov ecx, dword [0x140011054]
cmp eax, ecx
jle 0x140004c38
mov dword [0x140011050], ecx
mov dword [0x140011054], eax
mov eax, dword [0x140011054]
mov ecx, dword [0x140011058]
cmp eax, ecx
lea rdi, [0x140011a60]
jle 0x140004c5b
mov dword [0x140011054], ecx
mov dword [0x140011058], eax
mov eax, dword [0x140011058]
mov ecx, dword [0x14001105c]
cmp eax, ecx
jle 0x140004c77
mov dword [0x140011058], ecx
mov dword [0x14001105c], eax
mov eax, dword [0x14001105c]
mov ecx, dword [0x140011060]
cmp eax, ecx
jle 0x140004c93
mov dword [0x14001105c], ecx
mov dword [0x140011060], eax
mov eax, dword [0x140011050]
mov ecx, dword [0x140011054]
cmp eax, ecx
jle 0x140004caf
mov dword [0x140011050], ecx
mov dword [0x140011054], eax
mov eax, dword [0x140011054]
mov ecx, dword [0x140011058]
cmp eax, ecx
jle 0x140004ccb
mov dword [0x140011054], ecx
mov dword [0x140011058], eax
mov eax, dword [0x140011058]
mov ecx, dword [0x14001105c]
cmp eax, ecx
jle 0x140004ce7
mov dword [0x140011058], ecx
mov dword [0x14001105c], eax
mov eax, dword [0x140011050]
mov ecx, dword [0x140011054]
cmp eax, ecx
jle 0x140004d03
mov dword [0x140011050], ecx
mov dword [0x140011054], eax
mov eax, dword [0x140011054]
mov ecx, dword [0x140011058]
cmp eax, ecx
jle 0x140004d1f
mov dword [0x140011054], ecx
mov dword [0x140011058], eax
mov eax, dword [0x140011050]
mov ecx, dword [0x140011054]
cmp eax, ecx
jle 0x140004d3b
mov dword [0x140011050], ecx
mov dword [0x140011054], eax
mov rcx, qword [0x140011a58]
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov edx, 0xf7
mov r8d, 0x1000
mov r9d, 4
call rax
mov rsi, rax
mov eax, dword [0x140011050]
mov ecx, dword [0x140011054]
cmp eax, ecx
jle 0x140004d83
mov dword [0x140011050], ecx
mov dword [0x140011054], eax
mov eax, dword [0x140011054]
mov ecx, dword [0x140011058]
cmp eax, ecx
jle 0x140004d9f
mov dword [0x140011054], ecx
mov dword [0x140011058], eax
mov eax, dword [0x140011058]
mov ecx, dword [0x14001105c]
cmp eax, ecx
jle 0x140004dbb
mov dword [0x140011058], ecx
mov dword [0x14001105c], eax
mov eax, dword [0x14001105c]
mov ecx, dword [0x140011060]
cmp eax, ecx
jle 0x140004dd7
mov dword [0x14001105c], ecx
mov dword [0x140011060], eax
mov eax, dword [0x140011050]
mov ecx, dword [0x140011054]
cmp eax, ecx
jle 0x140004df3
mov dword [0x140011050], ecx
mov dword [0x140011054], eax
mov eax, dword [0x140011054]
mov ecx, dword [0x140011058]
cmp eax, ecx
jle 0x140004e0f
mov dword [0x140011054], ecx
mov dword [0x140011058], eax
mov eax, dword [0x140011058]
mov ecx, dword [0x14001105c]
cmp eax, ecx
jle 0x140004e2b
mov dword [0x140011058], ecx
mov dword [0x14001105c], eax
mov eax, dword [0x140011050]
mov ecx, dword [0x140011054]
cmp eax, ecx
jle 0x140004e47
mov dword [0x140011050], ecx
mov dword [0x140011054], eax
mov eax, dword [0x140011054]
mov ecx, dword [0x140011058]
cmp eax, ecx
jle 0x140004e63
mov dword [0x140011054], ecx
mov dword [0x140011058], eax
mov eax, dword [0x140011050]
mov ecx, dword [0x140011054]
cmp eax, ecx
jle 0x140004e7f
mov dword [0x140011050], ecx
mov dword [0x140011054], eax
movaps xmm0, xmmword [0x140011a60]
movaps xmm1, xmmword [0x140011a70]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
xorps xmm0, xmm0
movaps xmmword [0x140011a60], xmm0
movaps xmmword [0x140011a70], xmm0
movaps xmm1, xmmword [0x140011a80]
movaps xmm2, xmmword [0x140011a90]
movups xmmword [rsi + 0x20], xmm1
movups xmmword [rsi + 0x30], xmm2
movaps xmmword [0x140011a80], xmm0
movaps xmmword [0x140011a90], xmm0
movaps xmm1, xmmword [0x140011aa0]
movaps xmm2, xmmword [0x140011ab0]
movups xmmword [rsi + 0x40], xmm1
movups xmmword [rsi + 0x50], xmm2
movaps xmmword [0x140011aa0], xmm0
movaps xmmword [0x140011ab0], xmm0
movaps xmm1, xmmword [0x140011ac0]
movaps xmm2, xmmword [0x140011ad0]
movups xmmword [rsi + 0x60], xmm1
movups xmmword [rsi + 0x70], xmm2
movaps xmmword [0x140011ac0], xmm0
movaps xmmword [0x140011ad0], xmm0
movaps xmm1, xmmword [0x140011ae0]
movaps xmm2, xmmword [0x140011af0]
movups xmmword [rsi + 0x80], xmm1
movups xmmword [rsi + 0x90], xmm2
movaps xmmword [0x140011ae0], xmm0
movaps xmmword [0x140011af0], xmm0
movaps xmm1, xmmword [0x140011b00]
movaps xmm2, xmmword [0x140011b10]
movups xmmword [rsi + 0xa0], xmm1
movups xmmword [rsi + 0xb0], xmm2
movaps xmmword [0x140011b00], xmm0
movaps xmmword [0x140011b10], xmm0
movaps xmm1, xmmword [0x140011b20]
movaps xmm2, xmmword [0x140011b30]
movups xmmword [rsi + 0xc0], xmm1
movups xmmword [rsi + 0xd0], xmm2
movaps xmmword [0x140011b20], xmm0
movaps xmmword [0x140011b30], xmm0
movdqa xmm0, xmmword [0x140011b40]
pshufd xmm1, xmm0, 0xee
movq qword [rsi + 0xe0], xmm0
mov qword [0x140011b40], 0
movq qword [rsi + 0xe8], xmm1
mov qword [0x140011b48], 0
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, byte [rax + rdi + 0xf0]
mov byte [rsi + rax + 0xf0], cl
mov byte [rax + rdi + 0xf0], 0
inc rax
cmp rax, 7
jne 0x140004fd0
lea rdx, [0x140004590]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
call rsi
mov ecx, 0x1f
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400040d0
call fcn.1400044e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3