Function at 0x140026430
Capabilities:
Get disk information
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x908]
sub rsp, 0xa08
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rbp + 0x8f0], rax
mov r12, r9
mov r13, r8
mov rbx, rdx
mov r15, rcx
mov rax, qword [rbp + 0x970]
mov qword [rsp + 0x58], rax
xor r8d, r8d
test rdx, rdx
je 0x140026fbe
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], r8w
jne 0x140026490
cmp rax, 5
jb 0x140026fbe
mov rax, qword [rcx + 0x30c8]
sub rdx, rax
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x1400264c7
add rax, 2
test cx, cx
jne 0x1400264b0
mov eax, r8d
jmp 0x1400264cc
sbb eax, eax
or eax, 1
test eax, eax
je 0x14002654e
movzx edi, word [rbx]
cmp di, 0x5c
jne 0x1400264dd
mov al, 1
jmp 0x14002652a
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xf0]
call fcn.14005af20
mov word [rbp + 0xe0], di
mov dword [rbp + 0xe2], 0x5c003a
xor eax, eax
mov word [rbp + 0xe6], ax
mov r8d, 0x400
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
sete al
mov byte [r15 + 0x3156], al
mov r8, rsi
inc r8
cmp word [rbx + r8*2], 0
jne 0x140026534
mov rdx, rbx
lea rcx, [r15 + 0x30c8]
call fcn.140002210
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140026fff
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xb8], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x14002700a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xb0], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140027015
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xd8], rax
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r15 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14002675e
cmp r15w, word [rbx]
je 0x14002669c
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140027020
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xc8], rax
cmp rbx, 0x10000
jae 0x140026634
movzx edx, bx
lea rcx, [rbp + 0xc8]
call fcn.140001fa0
jmp 0x14002665b
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140026640
mov rdx, rbx
lea rcx, [rbp + 0xc8]
call fcn.140002210
nop
lea rcx, [rbp + 0xc8]
call fcn.1400098f0
mov rax, qword [rbp + 0xc8]
cmp dword [rax - 0x10], 2
jl 0x140026683
movzx ecx, word [rax]
cmp cx, 0x5c
jne 0x1400266e9
cmp word [rax + 2], cx
je 0x1400266f5
lea rdx, [rax - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002669c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r14d, 0x14
mov edi, r15d
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140026716
inc edi
cmp edi, r14d
jb 0x1400266a5
jmp 0x14002671f
cmp cx, 0x2f
jne 0x140026683
cmp word [rax + 2], cx
jne 0x140026683
lea rdx, [rax - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002670e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r14d, 0x190
jmp 0x1400266a2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, rbx
call fcn.1400283d0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140026f56
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
je 0x140026f48
lea rcx, [r14 + 2]
call fcn.140039d3c
mov r15, rax
lea r8, [r14 + 2]
xor edx, edx
mov rcx, rax
call fcn.14005af20
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xc0]
mov r8d, r14d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140026f3b
cmp dword [rbp + 0xc0], r14d
jne 0x140026f3b
test rdi, rdi
je 0x1400267d4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
cmp r14d, 2
jbe 0x1400267fc
movzx eax, word [r15]
mov ecx, 0xfeff
cmp ax, cx
jne 0x1400267ee
mov bl, 1
jmp 0x1400267fc
mov ecx, 0xfffe
cmp ax, cx
je 0x140026f56
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140027020
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa8], rax
test bl, bl
jne 0x14002689e
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x70]
call fcn.14005af20
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov r8d, 3
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.1400135d0
nop
mov rdx, qword [rsp + 0x70]
test rdx, rdx
jne 0x140026863
xor eax, eax
mov r8d, eax
jmp 0x14002687b
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140026870
lea rcx, [rbp + 0xa8]
call fcn.140002210
nop
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x1400268c8
call fcn.140045dd0
jmp 0x1400268c8
lea rdx, [r15 + 2]
test rdx, rdx
jne 0x1400268ae
xor eax, eax
mov r8d, eax
jmp 0x1400268bc
mov r8, rsi
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400268b1
lea rcx, [rbp + 0xa8]
call fcn.140002210
mov edx, 1
mov rcx, r15
call fcn.140039910
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x98], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x14002702b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x88], rax
xor r15d, r15d
mov dword [rbp + 0x98], r15d
mov dword [rbp + 0x90], r15d
lea rcx, [rbp + 0x88]
call fcn.140002ba0
nop
mov rdx, qword [rbp + 0xa8]
cmp dword [rdx - 8], 1
jle 0x14002694b
mov edx, dword [rdx - 0x10]
lea rcx, [rbp + 0xa8]
call fcn.140002a20
mov rdx, qword [rbp + 0xa8]
mov dword [rbp + 0x90], r15d
test rdx, rdx
je 0x14002699b
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140026960
test rax, rax
je 0x14002699b
mov r8, rsi
inc r8
cmp word [rdx + r8*2], 0
jne 0x140026972
lea rcx, [rbp + 0x88]
call fcn.140002210
mov rax, qword [rbp + 0x88]
mov ecx, dword [rax - 0x10]
mov dword [rbp + 0x98], ecx
jmp 0x1400269a7
lea rcx, [rbp + 0x88]
call fcn.140002ba0
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140027036
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x80], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140027041
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0x90], r15
lea r9, [rbp + 0x90]
lea r8, [0x1400694bc]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x88]
call fcn.14000d550
nop
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.140001e50
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026a40
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rbp + 0x80]
mov ecx, dword [rax - 0x10]
test ecx, ecx
je 0x140026e76
mov edx, 0xa0d
cmp ecx, 1
jne 0x140026a80
cmp word [rax], dx
je 0x140026e76
cmp word [rax], 0x23
je 0x140026e76
cmp word [rax], 0x3b
je 0x140026e76
nop dword [rax]
lea rcx, [rbp + 0x80]
call fcn.1400098f0
mov rbx, qword [rbp + 0x80]
mov edi, dword [rbx - 0x10]
test edi, edi
js 0x140026ff4
cmp word [rbx], 0x5b
jne 0x140026bc7
cmp edi, 1
jl 0x140026b11
dec edi
lea r14d, [rdi + 1]
cmp dword [rbx - 8], 1
jle 0x140026acf
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0x80]
call fcn.140002a20
mov rbx, qword [rbp + 0x80]
movsxd r8, r14d
add r8, r8
lea rdx, [rbx + 2]
je 0x140026af5
test rbx, rbx
je 0x140026fe3
test rdx, rdx
je 0x140026fe3
mov rcx, rbx
call fcn.14005a880
test edi, edi
js 0x140026ff4
cmp edi, dword [rbx - 0xc]
jg 0x140026ff4
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], r15w
cmp dword [rbx - 0x10], 0
jle 0x140026de3
mov edx, 0x5d
mov rcx, rbx
call fcn.14003baf8
test rax, rax
je 0x140026de3
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140026de3
mov r8d, 1
mov edx, eax
lea rcx, [rbp + 0x80]
call fcn.14000f940
mov rdx, qword [rbp + 0x80]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp + 0xa0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140026de3
cmp dword [rbx + 0x10], 0
jl 0x140026bb2
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140026bb2
call fcn.140002120
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140026ba2
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rVariantCopy + 8]
lea rax, [rdi + 0x18]
mov qword [rbp + 0xa0], rax
jmp 0x140026de3
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xa0]
call fcn.140002210
jmp 0x140026de3
test edi, edi
jg 0x140026bcf
mov edi, esi
jmp 0x140026bee
mov edx, 0x3d
mov rcx, rbx
call fcn.14003baf8
mov rdi, rax
test rax, rax
jne 0x140026be8
mov edi, esi
jmp 0x140026bee
sub rdi, rbx
sar rdi, 1
mov r9d, edi
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x80]
call fcn.14000d710
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp + 0xb8]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140026c6a
cmp dword [rbx + 0x10], 0
jl 0x140026c59
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140026c59
call fcn.140002120
mov r14, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140026c4c
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rVariantCopy + 8]
lea rax, [r14 + 0x18]
mov qword [rbp + 0xb8], rax
jmp 0x140026c6a
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xb8]
call fcn.140002210
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026c88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea r8d, [rdi + 1]
mov rax, qword [rbp + 0x80]
mov r9d, dword [rax - 0x10]
sub r9d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.14000d710
nop
mov rdx, qword [rsp + 0x50]
lea rbx, [rdx - 0x18]
mov rdi, qword [rbp + 0xb0]
add rdi, 0xffffffffffffffe8
cmp rbx, rdi
je 0x140026d15
cmp dword [rdi + 0x10], 0
jl 0x140026d04
mov rax, qword [rdi]
cmp qword [rbx], rax
jne 0x140026d04
mov rcx, rbx
call fcn.140002120
mov r14, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140026cf7
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rVariantCopy + 8]
lea rax, [r14 + 0x18]
mov qword [rbp + 0xb0], rax
jmp 0x140026d15
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xb0]
call fcn.140002210
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140026d2d
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + VariantCopy]
mov rbx, qword [r13 + 8]
cmp rbx, qword [r13 + 0x10]
je 0x140026d55
mov rcx, qword [rbp + 0xa0]
add rcx, 0xffffffffffffffe8
call fcn.140002120
add rax, 0x18
mov qword [rbx], rax
add qword [r13 + 8], 8
jmp 0x140026d67
lea r8, [rbp + 0xa0]
mov rdx, rbx
mov rcx, r13
call fcn.140004cb0
mov rbx, qword [r12 + 8]
cmp rbx, qword [r12 + 0x10]
je 0x140026d92
mov rcx, qword [rbp + 0xb8]
add rcx, 0xffffffffffffffe8
call fcn.140002120
add rax, 0x18
mov qword [rbx], rax
add qword [r12 + 8], 8
jmp 0x140026da4
lea r8, [rbp + 0xb8]
mov rdx, rbx
mov rcx, r12
call fcn.140004cb0
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x140026dd1
mov rcx, qword [rbp + 0xb0]
add rcx, 0xffffffffffffffe8
call fcn.140002120
add rax, 0x18
mov qword [rbx], rax
add qword [rdi + 8], 8
jmp 0x140026de3
lea r8, [rbp + 0xb0]
mov rdx, rbx
mov rcx, rdi
call fcn.140004cb0
mov eax, dword [rbp + 0x90]
mov dword [rbp + 0x94], eax
test eax, eax
js 0x140026f2a
lea r9, [rbp + 0x90]
lea r8, [0x1400694bc]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x88]
call fcn.14000d550
nop
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.140001e50
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026e45
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rbp + 0x80]
mov ecx, dword [rax - 0x10]
test ecx, ecx
je 0x140026e76
cmp ecx, 1
jne 0x140026a80
mov ecx, 0xa0d
cmp word [rax], cx
je 0x140026e76
cmp word [rax], 0x23
je 0x140026e76
cmp word [rax], 0x3b
jne 0x140026a80
mov dword [rbp + 0x94], r15d
lea rcx, [rbp + 0x88]
call fcn.140002ba0
mov dword [rbp + 0x98], r15d
mov bl, 1
mov rdx, qword [rbp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026eb3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026ed4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov dword [rbp + 0x94], r15d
lea rcx, [rbp + 0x88]
call fcn.140002ba0
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026f08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026f58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140026f58
lea rcx, [rbp + 0x80]
call fcn.140002ba0
jmp 0x140026e76
mov edx, 1
mov rcx, r15
call fcn.140039910
test rdi, rdi
je 0x140026f56
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026f79
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026f9a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140026fb9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
movzx eax, bl
jmp 0x140026fc0
xor al, al
mov rcx, qword [rbp + 0x8f0]
xor rcx, rsp
call fcn.1400398f0
add rsp, 0xa08
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140040b74
nop
mov dword [rax], 0x16
call fcn.140040a50
mov ecx, 0x80070057
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
int3