Function at 0x424ac0
Capabilities:
Create process on windows
Get disk information

Disassembly:
push rbp
push rbx
sub rsp, 0x328
mov rbp, rsp
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd8], 0
nop
mov rcx, qword [0x0042d930]
xor edx, edx
call fcn.004052f0
lea rcx, [rbp + 0xc8]
lea rdx, [0x00425078]
mov rax, qword [0x0042d948]
mov r8, qword [rax]
call fcn.0040a8f0
mov rcx, qword [rbp + 0xc8]
call fcn.0040a4d0
mov rcx, rax
xor edx, edx
call sub.user32.dll_FindWindowW
test rax, rax
jbe 0x424bf3
lea rcx, [rbp + 0xc0]
mov rdx, qword [rbp + 0x40]
call fcn.0040a540
mov rcx, qword [rbp + 0xc0]
lea rdx, [0x00425094]
call fcn.0040ab00
test eax, eax
jne 0x424f59
mov rcx, qword [0x00434190]
lea rdx, [rbp + 0xe4]
mov r8d, 0x104
call sub.kernel32.dll_GetModuleFileNameW
mov rcx, qword [0x0042d8a8]
lea rdx, [rbp + 0xe4]
mov r8d, pe_nt_image_headers64
call fcn.0040a5d0
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x40]
call fcn.0040a540
mov rcx, qword [rbp + 0xb8]
lea rdx, [0x004250ac]
call fcn.0040ab00
test eax, eax
jne 0x424ce3
lea rcx, [rbp + 0xd8]
mov edx, 3
lea r8, [0x004250c0]
mov rax, qword [0x0042d8a8]
mov r9, qword [rax]
lea rax, [0x00425160]
mov qword [rsp + 0x20], rax
call fcn.0040aa20
lea rcx, [rbp + 0xa8]
lea rdx, [0x004251b4]
mov r8, qword [rbp + 0xd8]
call fcn.0040a8f0
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0xa8]
xor r8, r8
call fcn.0040a350
lea rcx, [rbp + 0xb0]
lea rdx, [0x0042519c]
mov r8, qword [rbp + 0xa0]
call fcn.00409d60
mov rcx, qword [rbp + 0xb0]
call fcn.0040a160
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_WinExec
jmp 0x424f59
mov rax, qword [0x0042d908]
mov byte [rax], 0
mov rax, qword [0x0042d8a8]
mov rcx, qword [rax]
call fcn.00423a30
mov ebx, eax
lea rcx, [rbp + 0x98]
mov rax, qword [0x0042d8a8]
mov rax, qword [rax]
movzx rdx, word [rax]
call fcn.0040a520
lea rcx, [rbp + 0x98]
lea rdx, [0x004251c8]
call fcn.0040a820
mov rcx, qword [rbp + 0x98]
call fcn.0040a4d0
mov rcx, rax
xor edx, edx
xor r8, r8
lea r9, [rbp + 0x2ec]
lea rax, [rbp + 0x2e8]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x2e4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
call sub.kernel32.dll_GetVolumeInformationW
lea rcx, [rbp + 0x90]
mov edx, dword [rbp + 0x2ec]
add edx, ebx
mov edx, edx
call fcn.0040f100
mov rcx, qword [0x0042d8e0]
mov rdx, qword [rbp + 0x90]
call fcn.00409690
mov rax, qword [0x0042d8e0]
cmp qword [rax], 0
jne 0x424dbd
mov rcx, qword [0x0042d8e0]
lea rdx, [0x004251dc]
call fcn.00409690
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x40]
call fcn.0040a540
mov rcx, qword [rbp + 0x88]
lea rdx, [0x00425094]
call fcn.0040ab00
test eax, eax
jne 0x424df7
mov rcx, qword [0x0042d8e0]
lea rdx, [0x004251f8]
call fcn.0040a820
lea rcx, [0x00425210]
call fcn.00417e00
lea rcx, [rbp + 0x80]
call fcn.00411f40
mov rcx, qword [0x0042d8b8]
mov rdx, qword [rbp + 0x80]
call fcn.00409690
mov dword [0x0043580c], 0
mov rax, qword [0x0042d8f8]
mov word [rax], 0x50
call fcn.00424a80
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x40]
call fcn.0040a540
mov rcx, qword [rbp + 0x78]
lea rdx, [0x00425094]
call fcn.0040ab00
test eax, eax
je 0x424ebe
lea rcx, [rbp + 0x70]
lea rdx, [0x00425078]
mov rax, qword [0x0042d948]
mov r8, qword [rax]
call fcn.0040a8f0
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x70]
xor r8, r8
call fcn.0040a350
mov rcx, qword [rbp + 0x68]
call fcn.00423190
test al, al
je 0x424f59
lea rcx, [rbp + 0x60]
lea rdx, [0x00425078]
mov rax, qword [0x0042d948]
mov r8, qword [rax]
call fcn.0040a8f0
mov rcx, qword [rbp + 0x60]
call fcn.004232a0
jmp 0x424f14
lea rcx, [rbp + 0x58]
lea rdx, [0x00425220]
mov rax, qword [0x0042d948]
mov r8, qword [rax]
call fcn.0040a8f0
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
xor r8, r8
call fcn.0040a350
mov rcx, qword [rbp + 0x50]
call fcn.00423190
lea rcx, [rbp + 0x48]
lea rdx, [0x00425220]
mov rax, qword [0x0042d948]
mov r8, qword [rax]
call fcn.0040a8f0
mov rcx, qword [rbp + 0x48]
call fcn.004232a0
call fcn.00414350
jmp 0x424f3f
lea rcx, [rbp + 0x2f0]
call sub.user32.dll_TranslateMessage
lea rcx, [rbp + 0x2f0]
call sub.user32.dll_DispatchMessageW
mov rax, qword [0x0042d8b0]
cmp byte [rax], 0
jne 0x424f57
lea rcx, [rbp + 0x2f0]
xor edx, edx
xor r8, r8
xor r9, r9
call sub.user32.dll_GetMessageW
test eax, eax
jne 0x424f1b
nop
nop
lea rcx, [rbp + 0x48]
call fcn.00409180
lea rcx, [rbp + 0x50]
call fcn.004091d0
lea rcx, [rbp + 0x58]
mov edx, 2
call fcn.00409260
lea rcx, [rbp + 0x68]
call fcn.004091d0
lea rcx, [rbp + 0x70]
mov edx, 6
call fcn.00409260
lea rcx, [rbp + 0xa0]
call fcn.004091d0
lea rcx, [rbp + 0xa8]
call fcn.00409180
lea rcx, [rbp + 0xb0]
call fcn.004091d0
lea rcx, [rbp + 0xb8]
mov edx, 3
call fcn.00409260
lea rcx, [rbp + 0xd8]
call fcn.00409180
lea rsp, [rbp + 0x328]
pop rbx
pop rbp
ret