Function at 0x14015f140
Capabilities:
Get disk information
Get file size
Move file

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x138
movabs rax, 0x77a162d0119b87
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
movabs rax, 0x77a162d0119b87
cmp qword [rsp + 0x78], rax
je 0x14015f19e
movabs rax, 0x7bba9922976225
cmp qword [rsp + 0x78], rax
je 0x14015f242
jmp 0x14015f27c
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x80], rax
movabs rax, 0x746cffd1129181
cmp qword [rsp + 0x80], rax
je 0x14015f1fe
movabs rax, 0x7c7d942327b2b3
cmp qword [rsp + 0x80], rax
je 0x14015f1d5
jmp 0x14015f21d
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x158], rax
lea rdx, [rsp + 0xf0]
mov ecx, 0x1f
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [rsp + 0x2c], eax
jmp 0x14015f21d
mov r8, qword [rsp + 0x158]
mov edx, dword [rsp + 0x2c]
mov cx, 0x4d
call fcn.14015ec30
mov eax, dword [section..data]
mov dword [rsp + 0x2c], eax
mov byte [rsp + 0x20], 0x46
mov eax, 0x7e8
mov word [rsp + 0x24], ax
mov eax, 0x899
mov word [rsp + 0x28], ax
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x30], rax
jmp 0x14015f27c
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x58], al
cmp byte [rsp + 0x58], 0x6d
je 0x14015f254
jmp 0x14015f26d
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x38], eax
jmp 0x14015f27c
movsx eax, word [rsp + 0x24]
sub eax, 0x5f8
mov word [rsp + 0x24], ax
mov eax, dword [rsp + 0x148]
add eax, 0xe5c
cmp eax, dword [rsp + 0x150]
jle 0x14015f4e2
lea rax, [rsp + 0x24]
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x21], 0x7b
movzx eax, word [rsp + 0x28]
mov word [rsp + 0x54], ax
movsx eax, byte [rsp + 0x20]
cmp eax, 0x56
jge 0x14015f371
movabs rax, 0x765691f7bce2ca
mov rcx, qword [rsp + 0x158]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x140]
jle 0x14015f34b
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x48], al
cmp byte [rsp + 0x48], 0x49
je 0x14015f33b
cmp byte [rsp + 0x48], 0xe9
je 0x14015f2f7
jmp 0x14015f349
mov rax, qword [rsp + 0x70]
movsx eax, word [rax]
and eax, 0x332
mov word [rsp + 0x24], ax
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x5c], al
cmp byte [rsp + 0x5c], 0xbb
je 0x14015f31b
jmp 0x14015f32f
movsx eax, word [rsp + 0x24]
sub eax, 0x31c
mov rcx, qword [rsp + 0x70]
mov word [rcx], ax
jmp 0x14015f339
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [rsp + 0x60], eax
jmp 0x14015f349
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x148], eax
jmp 0x14015f371
movsx eax, byte [rsp + 0x20]
cmp eax, 0x15
jg 0x14015f371
mov edx, dword [rsp + 0x90]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov dword [rsp + 0x94], eax
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x4c], al
cmp byte [rsp + 0x4c], 0x58
je 0x14015f453
cmp byte [rsp + 0x4c], 0xce
je 0x14015f391
jmp 0x14015f48b
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
add eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x88], rax
movabs rax, 0x7535db9e83842d
cmp qword [rsp + 0x88], rax
je 0x14015f435
movabs rax, 0x7cf92a8a3619a9
cmp qword [rsp + 0x88], rax
je 0x14015f3dd
jmp 0x14015f451
movabs rax, 0x7ebe18cfe555b8
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
movzx eax, byte [rsp + 0x21]
cmp eax, 0xbe
jle 0x14015f421
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x148], eax
jmp 0x14015f433
movsx eax, word [rsp + 0x24]
or eax, 0x2e6
mov rcx, qword [rsp + 0x70]
mov word [rcx], ax
jmp 0x14015f451
mov r8d, 0xb9
mov rdx, qword [rsp + 0xd0]
mov ecx, 0xdd
call sub.KERNEL32.dll_VerLanguageNameA
mov dword [rsp + 0x2c], eax
jmp 0x14015f48b
movsx eax, byte [rsp + 0x20]
shl eax, 6
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x50]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x30]
mov dword [rcx], eax
lea rdx, str.C:PaginalContinence_nastiness
lea rcx, str.C:DecoysconfiguringComitygerbilsMilieu
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xe8], rax
jmp 0x14015f55b
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x4a58
je 0x14015f4fb
jmp 0x14015f50d
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
add eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov dword [rcx], eax
movabs rax, 0x7d387ae1768911
mov rcx, qword [rsp + 0x40]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x140]
mov rax, qword [rsp + 0x30]
mov edx, dword [rax]
movzx ecx, word [rsp + 0x28]
call fcn.14015ec30
mov ecx, 0xd9
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov dword [rsp + 0x50], eax
movsx eax, byte [rsp + 0x20]
sar eax, 3
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0x802
je 0x14015f574
jmp 0x14015f5b8
movzx r9d, word [rsp + 0x24]
movzx r8d, word [rsp + 0x28]
movzx edx, word [rsp + 0x24]
mov ecx, dword [rsp + 0x150]
call fcn.14015ebc0
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0xb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x30]
mov dword [rcx], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x30]
mov dword [rcx], eax
mov r9, qword [rsp + 0x158]
mov r8d, dword [rsp + 0x148]
mov edx, dword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
call fcn.14015f140
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov dword [rsp + 0x2c], eax
mov eax, 0x44
add rsp, 0x138
ret