Function at 0x14002b650
Capabilities:
Create thread
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x370
mov rax, qword [0x1400ea180]
xor rax, rsp
mov qword [rsp + 0x360], rax
xor esi, esi
mov r14d, esi
mov dword [rsp + 0xa0], esi
call fcn.14002b250
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x130]
call fcn.14002b0d0
nop
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xb0], xmm1
mov qword [rsp + 0xc0], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xa8]
lea edx, [rsi + 0x1a]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14002b6ee
mov r15d, esi
jmp 0x14002b717
lea r8, [rsp + 0xa0]
mov edx, 2
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov r15, qword [rsp + 0xa0]
test eax, eax
cmove r15, rsi
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0x148], r15
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xe8], xmm1
mov qword [rsp + 0xf8], rsi
mov rdi, qword [rsp + 0x130]
mov r12, qword [rsp + 0x138]
cmp rdi, r12
je 0x14002bc90
movabs r13, 0x7ffffffffffffffe
lea rdx, [0x1400d9b18]
mov rcx, qword [rdi + 0x10]
mov rax, r13
sub rax, rcx
cmp rax, 1
jb 0x14002bf67
mov r9, rdi
cmp qword [rdi + 0x18], 8
jb 0x14002b786
mov r9, qword [rdi]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0xc8]
call fcn.1400296f0
or r14d, 2
lea rcx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 8
cmovae rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
lea ecx, [rax - 2]
cmp ecx, 2
jbe 0x14002b7dd
cmp eax, 6
jne 0x14002bc3b
mov rcx, qword [rdi + 0x10]
mov rax, r13
sub rax, rcx
cmp rax, 4
jb 0x14002bf61
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x14002b7fe
mov rax, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 4
lea r9, str.__
lea rcx, [rsp + 0x100]
call fcn.1400296f0
or r14d, 4
cmp ebx, 4
jne 0x14002bb67
mov dword [rsp + 0x120], 0x104
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14002b84a
mov rcx, qword [rdi]
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x150]
call qword [sym.imp.MPR.dll_WNetGetConnectionW]
test eax, eax
jne 0x14002bb67
test r15, r15
je 0x14002b8cf
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x150]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14002b890
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.140028760
nop
or r14d, 1
mov dword [rsp + 0xa0], r14d
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.14002b4f0
test al, al
jne 0x14002b8cf
mov bl, 1
jmp 0x14002b8d1
xor bl, bl
test r14b, 1
je 0x14002b91d
and r14d, 0xfffffffe
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14002b91d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b918
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf37
call fcn.1400652cc
test bl, bl
je 0x14002b9be
mov rdx, qword [rsp + 0x118]
cmp rdx, 8
jb 0x14002b96e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b968
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf3d
call fcn.1400652cc
nop
mov rdx, qword [rsp + 0xe0]
cmp rdx, 8
jb 0x14002bc83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bc7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf0f
jmp 0x14002bc7e
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x150]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14002b9e0
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.140028760
nop
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14002c980
mov rbx, rax
lea rax, [rsp + 0x100]
cmp rax, rbx
je 0x14002ba8b
mov rdx, qword [rsp + 0x118]
cmp rdx, 8
jb 0x14002ba65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ba60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf43
call fcn.1400652cc
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x100], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x110], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14002bacd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bac8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf43
call fcn.1400652cc
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], si
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14002bb22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bb1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf49
call fcn.1400652cc
mov rax, qword [rsp + 0xf0]
cmp rax, qword [rsp + 0xf8]
je 0x14002bb4f
lea rdx, [rsp + 0x100]
mov rcx, rax
call fcn.14002c560
add qword [rsp + 0xf0], 0x20
jmp 0x14002bb67
lea r8, [rsp + 0x100]
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.14002d790
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x60]
call fcn.14002c560
nop
mov rdx, qword [rsp + 0xb8]
lea r8, [rsp + 0x60]
cmp rdx, qword [rsp + 0xc0]
je 0x14002bba1
call fcn.14002dec0
add qword [rsp + 0xb8], 0x10
jmp 0x14002bbaf
lea rcx, [rsp + 0xb0]
call fcn.14002d410
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14002bbf2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bbec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf4f
call fcn.1400652cc
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 8
jb 0x14002bc3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bc35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf55
call fcn.1400652cc
nop
mov rdx, qword [rsp + 0xe0]
cmp rdx, 8
jb 0x14002bc83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc8]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14002bc7e
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf5b
call fcn.1400652cc
add rdi, 0x20
cmp rdi, r12
jne 0x14002b75e
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0xa0]
lea edx, [r9 + 0xe]
mov rcx, 0xfffffffffffffffc
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14002bf15
cmp dword [rsp + 0xa0], 2
jne 0x14002bdcf
call fcn.14002a620
mov qword [rsp + 0xa0], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xc8], xmm1
mov qword [rsp + 0xd8], rsi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x78], rax
mov ecx, 0x20
call fcn.140065290
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14002e030]
xor edx, edx
xor ecx, ecx
call fcn.14009e6e4
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002bf8c
cmp dword [rsp + 0x48], 0
je 0x14002bf6d
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x48], eax
je 0x14002bf77
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x120], xmm0
xor edx, edx
lea rcx, [rsp + 0x120]
call fcn.1400678c0
test eax, eax
jne 0x14002bf81
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0xc8]
call fcn.14002c720
nop
jmp 0x14002bddb
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
cmp rbx, rdi
je 0x14002be33
cmp dword [rbx + 8], 0
je 0x14002bfb7
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbx + 8], eax
je 0x14002bfac
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1400678c0
test eax, eax
jne 0x14002bfa1
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp rbx, rdi
jne 0x14002bdf0
lea rcx, [rsp + 0xe8]
call fcn.14002c720
nop
test r15, r15
je 0x14002be50
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14002bed0
mov rax, rcx
mov rdx, qword [rsp + 0xb8]
cmp rcx, rdx
je 0x14002be83
nop dword [rax]
cmp dword [rax + 8], 0
jne 0x14002bfc2
add rax, 0x10
cmp rax, rdx
jne 0x14002be70
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002beb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf9b
call fcn.1400652cc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rsi
lea rcx, [rsp + 0x130]
call fcn.14002c720
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140065270
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140099524
nop
lea rcx, [rsp + 0x80]
call fcn.14002a550
lea rdx, [0x1400e7f08]
lea rcx, [rsp + 0x80]
call fcn.14008cca4
nop
call fcn.140099524
nop
call fcn.140099524
nop
call fcn.140099524
nop
call fcn.140099524
int3
call fcn.140099524
nop
call fcn.140099524
nop
call fcn.140099524
nop
call fcn.1400217a0
nop
call fcn.1400217a0
nop
mov ecx, 1
call fcn.14006753c
mov ecx, 5
call fcn.14006753c
mov ecx, 2
call fcn.14006753c
nop
mov dword [rsp + 0x48], esi
mov ecx, 6
call fcn.14006753c
nop
call fcn.140099524
nop
mov ecx, 2
call fcn.14006753c
int3
mov ecx, 5
call fcn.14006753c
int3
mov ecx, 1
call fcn.14006753c
nop
call fcn.14009e7c4
int3