Function at 0x1400150a0
Capabilities:
Connect to wmi namespace via wbemlocator
Get disk information
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14011d080]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor r12d, r12d
mov r14d, r12d
mov dword [rbp + 0x78], r12d
mov r15d, r12d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [0x1400fc918]
xor edx, edx
lea r8d, [r12 + 1]
lea rcx, [0x1400fc928]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140015124
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
mov ecx, Ordinal_27
call fcn.1400e69b0
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140015178
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1400fdb98]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14001627a
jmp 0x14001517b
mov rbx, r12
mov qword [rbp - 0x18], rbx
test rbx, rbx
je 0x1400162c7
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x20]
call rdi
mov ebx, eax
lea rcx, [rbp - 0x18]
call fcn.140011d10
test ebx, ebx
jns 0x1400151d3
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14001521f
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rbp + 0x28], r12
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0xa0]
mov ecx, Ordinal_27
call fcn.1400e69b0
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14001527a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_DiskDrive
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140016285
jmp 0x14001527d
mov rbx, r12
mov qword [rbp - 8], rbx
test rbx, rbx
je 0x1400162c7
mov rdi, qword [rbx]
mov ecx, Ordinal_27
call fcn.1400e69b0
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400152d6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1400fdbf0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140016290
jmp 0x1400152d9
mov rbx, r12
mov qword [rbp - 0x18], rbx
test rbx, rbx
je 0x1400162d2
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, Ordinal_50
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x28]
call rsi
mov ebx, eax
lea rcx, [rbp - 0x18]
call fcn.140011d10
nop
lea rcx, [rbp - 8]
call fcn.140011d10
test ebx, ebx
jns 0x140015339
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rbp + 0xa0], r12d
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140015de5
nop dword [rax]
mov qword [rbp - 8], r12
mov rax, qword [rcx]
lea rdx, [rbp + 0xa0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 8]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp + 0xa0], 0
je 0x140015ddc
test eax, eax
js 0x140015ddc
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x30]
xor r8d, r8d
lea rdx, str.DeviceID
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x140015dc5
mov rbx, qword [rbp + 0x38]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r8d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], r12
mov qword [rbp + 0x188], r12
mov rdx, rbx
lea rcx, [rbp + 0x170]
call fcn.14000eb40
or r14d, 0x20
lea rcx, [rbp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r8, [rbp + 0x170]
lea rdx, str.ASSOCIATORS_OF_Win32_DiskDrive.DeviceID
lea rcx, [rsp + 0x78]
call fcn.140044610
nop
mov r8d, reloc.WLDAP32.dll_Ordinal_50
lea rdx, str._WHERE_AssocClassWin32_DiskDriveToDiskPartition
mov rcx, rax
call fcn.140040dd0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or r14d, 0x10
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1400154a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400154a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e3a
call fcn.1400e69f4
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r12w
mov qword [rbp + 8], r12
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0xa0]
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdi, qword [rbp + 0x80]
mov ecx, Ordinal_27
call fcn.1400e69b0
mov rbx, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x14001552b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14001552e
test rdi, rdi
jne 0x14001629b
jmp 0x14001552e
mov rbx, r12
mov qword [rbp + 0xa8], rbx
test rbx, rbx
je 0x14001626f
mov rdi, qword [rbx]
mov ecx, Ordinal_27
call fcn.1400e69b0
mov rbx, rax
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140015589
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1400fdbf0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400162a6
jmp 0x14001558c
mov rbx, r12
mov qword [rbp + 0x78], rbx
test rbx, rbx
je 0x1400162f9
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, Ordinal_50
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x28]
call rsi
mov ebx, eax
lea rcx, [rbp + 0x78]
call fcn.140011d10
nop
lea rcx, [rbp + 0xa8]
call fcn.140011d10
test ebx, ebx
js 0x140015d1f
mov dword [rbp + 0xa8], r12d
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140015d18
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0xa8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x18]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp + 0xa8], 0
je 0x140015d14
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x48]
xor r8d, r8d
lea rdx, str.DeviceID
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x140015d05
mov rbx, qword [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r8d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x168], r12
mov rdx, rbx
lea rcx, [rbp + 0x150]
call fcn.14000eb40
nop
lea rcx, [rbp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r8, [rbp + 0x150]
lea rdx, str.ASSOCIATORS_OF_Win32_DiskPartition.DeviceID
lea rcx, [rbp + 0x110]
call fcn.140044610
nop
mov r8d, Ordinal_50
lea rdx, str._WHERE_AssocClassWin32_LogicalDiskToPartition
mov rcx, rax
call fcn.140040dd0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or r14d, 0xc
mov rdx, qword [rbp + 0x128]
cmp rdx, 8
jb 0x14001573f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001573a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e41
call fcn.1400e69f4
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], r12w
mov qword [rbp], r12
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0xa0]
lea rdi, [rbp + 0xf0]
cmp qword [rbp + 0x108], 8
cmovae rdi, qword [rbp + 0xf0]
mov ecx, Ordinal_27
call fcn.1400e69b0
mov rbx, rax
mov qword [rbp - 0x38], rax
test rax, rax
je 0x1400157cb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400157ce
test rdi, rdi
jne 0x1400162b1
jmp 0x1400157ce
mov rbx, r12
mov qword [rsp + 0x70], rbx
test rbx, rbx
je 0x1400162ee
mov rdi, qword [rbx]
mov ecx, Ordinal_27
call fcn.1400e69b0
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140015827
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1400fdbf0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400162bc
jmp 0x14001582a
mov rbx, r12
mov qword [rbp + 0x78], rbx
test rbx, rbx
je 0x1400162e3
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, Ordinal_50
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x28]
call rsi
mov ebx, eax
lea rcx, [rbp + 0x78]
call fcn.140011d10
nop
lea rcx, [rsp + 0x70]
call fcn.140011d10
test ebx, ebx
js 0x140015c54
mov dword [rbp + 0x78], r12d
mov rcx, qword [rbp]
test rcx, rcx
je 0x140015c4e
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x78]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x10]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp + 0x78], 0
je 0x140015c4a
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x60]
xor r8d, r8d
lea rdx, str.Name
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov ebx, eax
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x20]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xd0]
xor r8d, r8d
lea rdx, str.Size
call r10
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x20]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x10]
xor r8d, r8d
lea rdx, str.VolumeSerialNumber
call r10
test eax, eax
jns 0x14001594f
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x10]
xor r8d, r8d
lea rdx, str.SerialNumber
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x148], r12
xor r8d, r8d
lea rdx, [0x1400fda58]
lea rcx, [rbp + 0x130]
call fcn.14000eb40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], r12
xor r8d, r8d
lea rdx, [0x1400fda58]
lea rcx, [rbp + 0xb0]
call fcn.14000eb40
nop
test ebx, ebx
js 0x140015bae
inc r15d
mov rbx, qword [rbp + 0x68]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r8d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14000eb40
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x140015a2d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015a28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e48
call fcn.1400e69f4
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x140], xmm1
mov rbx, qword [rbp + 0x18]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r8d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14000eb40
or r14d, 3
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140015abe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015ab9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e48
call fcn.1400e69f4
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp + 0xc0], xmm1
lea rcx, [rbp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp - 0x68]
call fcn.1400132b0
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140012520
nop
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140014450
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140015b54
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015b4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e4f
call fcn.1400e69f4
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r12w
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140015ba3
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015b9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e56
call fcn.1400e69f4
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140015bf5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015bef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e5d
call fcn.1400e69f4
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x140015c3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015c36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e64
call fcn.1400e69f4
mov rcx, qword [rbp]
test rcx, rcx
jne 0x140015890
jmp 0x140015c4e
mov rcx, qword [rbp]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 8
jb 0x140015ca5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015ca0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e6b
call fcn.1400e69f4
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], r12w
mov rdx, qword [rbp + 0x168]
cmp rdx, 8
jb 0x140015d05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015d00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e72
call fcn.1400e69f4
mov rcx, qword [rbp + 8]
test rcx, rcx
jne 0x1400155f0
jmp 0x140015d18
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x140015d65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015d60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e79
call fcn.1400e69f4
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], r12w
mov rdx, qword [rbp + 0x188]
cmp rdx, 8
jb 0x140015dc5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015dc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015e80
call fcn.1400e69f4
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x28]
test rcx, rcx
jne 0x140015350
test r15d, r15d
jne 0x14001623f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov esi, eax
test eax, eax
je 0x14001623f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r12
cmp rsi, 0x1000
jb 0x140015e87
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x1400162dd
call fcn.1400e69b0
mov rcx, rax
test rax, rax
je 0x14001620d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140015e8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400e69b0
mov qword [rbp + 0x10], rax
lea rbx, [rax + rsi]
mov qword [rbp + 0x20], rbx
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x18], rbx
mov rdx, qword [rbp + 0x10]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov rdi, qword [rbp + 0x10]
cmp byte [rdi], 0
je 0x1400161e0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r12
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x140015ee4
mov rdx, rdi
lea rcx, [rbp + 0xd0]
call fcn.14000ec80
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x110]
call fcn.140014dc0
nop
lea rcx, [rbp - 0x68]
call fcn.1400132b0
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140012520
mov rsi, rax
mov rcx, qword [rbp + 0xe0]
test rcx, rcx
jne 0x140015f61
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r12w
jmp 0x14001603d
lea r8, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae r8, qword [rbp + 0xd0]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, ecx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
mov r8, rbx
lea rcx, [rbp + 0x80]
call fcn.140045700
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
lea r8, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae r8, qword [rbp + 0xd0]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0xe0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp + 0x80]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rbp + 0x90]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], r12w
mov rdx, rsi
lea rcx, [rbp + 0xb0]
call fcn.140014450
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140016094
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001608e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016214
call fcn.1400e69f4
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400160d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400160d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001621b
call fcn.1400e69f4
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r12w
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140016126
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016120
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016222
call fcn.1400e69f4
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x140016167
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016162
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016229
call fcn.1400e69f4
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x1400161bd
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400161b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016230
call fcn.1400e69f4
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x1400161c4
inc rdi
add rdi, rax
cmp byte [rdi], 0
jne 0x140015ec5
mov rdi, qword [rbp + 0x10]
test rdi, rdi
je 0x14001623f
mov rdx, qword [rbp + 0x20]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x140016237
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140016237
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rdi
call fcn.1400e69f4
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400e6990
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
call fcn.140001f20
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
nop
mov ecx, 0x8007000e
call fcn.1400e7d00
int3