Function at 0x140081980
Capabilities:
Contain obfuscated stackstrings
Get disk information via ioctl

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov qword [rsp + 0x170], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0xa0], r8
mov r12, rcx
mov qword [rsp + 0xa8], rcx
xor r14d, r14d
mov qword [r11 - reloc.MFC80U.DLL_Ordinal_424], r14
mov qword [r11 - 0x1a0], r14
mov qword [r11 - 0x198], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov ecx, 0xa00000
call sub.MFC80U.DLL_Ordinal_265
mov rbp, rax
mov qword [rsp + 0x1d0], rax
xor edx, edx
mov r8d, 0xa00000
mov rcx, rax
call sub.ntdll.dll_memset
mov dword [rsp + 0x6c], r14d
mov r13d, r14d
mov rcx, qword [r12 + 8]
mov rdx, qword [rcx]
call qword [rdx + 0x80]
mov rcx, rax
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa00000
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70050
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140081b83
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x140433dd0]
mov rcx, rbx
call sub.ntdll.dll_memset
lea edx, [r14 + 0x5c]
lea rcx, str...partmgr.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
jne 0x140081aa4
mov rbx, r14
jmp 0x140081b30
mov byte [rsp + 0x1d0], r13b
xor eax, eax
mov qword [rsp + 0x1d1], rax
mov word [rsp + 0x1d9], ax
mov byte [rsp + 0x1db], al
mov r8d, Ordinal_2778
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
mov byte [rdx + rcx], al
add rdx, 1
test al, al
jne 0x140081af0
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1d0]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140081b20
mov rax, qword [rsi]
mov r8, rbx
lea rdx, str._s:_Failed_to_read_GPT_partition_table.
mov rcx, rsi
call qword [rax + 0x10]
mov rcx, rbp
call sub.MFC80U.DLL_Ordinal_266
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140081b5b
call sub.MFC80U.DLL_Ordinal_776
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140081b7c
call sub.MFC80U.DLL_Ordinal_776
xor eax, eax
jmp 0x140082718
mov dword [rsp + 0x1b0], 0xc12a7328
mov word [rsp + 0x1b4], 0xf81f
mov word [rsp + reloc.MFC80U.DLL_Ordinal_438], 0x11d2
mov byte [rsp + 0x1b8], 0xba
mov byte [rsp + 0x1b9], 0x4b
mov byte [rsp + 0x1ba], r13b
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_443], 0xa0
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_444], 0xc9
mov byte [rsp + 0x1bd], 0x3e
mov byte [rsp + 0x1be], 0xc9
mov byte [rsp + 0x1bf], 0x3b
mov dword [rsp + 0x1a0], 0xe3c9e316
mov word [rsp + 0x1a4], 0xb5c
mov word [rsp + 0x1a6], 0x4db8
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_424], 0x81
mov byte [rsp + 0x1a9], 0x7d
mov byte [rsp + 0x1aa], 0xf9
mov byte [rsp + 0x1ab], 0x2d
mov byte [rsp + 0x1ac], 0xf0
mov byte [rsp + 0x1ad], 2
mov byte [rsp + 0x1ae], 0x15
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_431], 0xae
mov dword [rsp + 0x1c0], 0xebd0a0a2
mov word [rsp + reloc.MFC80U.DLL_Ordinal_452], 0xb9e5
mov word [rsp + 0x1c6], 0x4433
mov byte [rsp + 0x1c8], 0x87
mov byte [rsp + 0x1c9], 0xc0
mov byte [rsp + 0x1ca], 0x68
mov byte [rsp + 0x1cb], 0xb6
mov byte [rsp + 0x1cc], 0xb7
mov byte [rsp + 0x1cd], 0x26
mov byte [rsp + 0x1ce], 0x99
mov byte [rsp + 0x1cf], 0xc7
cmp dword [rbp], 1
je 0x140081d12
call fcn.140049470
mov rdi, rax
mov rbx, qword [rax]
mov edx, Ordinal_2814
lea rcx, str...partmgr.cpp
call fcn.1400789a0
mov r8, rax
lea rdx, str._s:_Failed_to_write_GPT_partition_table.
mov rcx, rdi
call qword [rbx + 0x10]
mov rcx, rbp
call sub.MFC80U.DLL_Ordinal_266
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140081cea
call sub.MFC80U.DLL_Ordinal_776
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140081d0b
call sub.MFC80U.DLL_Ordinal_776
xor eax, eax
jmp 0x140082718
mov edi, r14d
cmp dword [rbp + 4], r14d
jbe 0x140081d50
lea rbx, [rbp + 0x48]
nop
mov eax, dword [rbx]
cmp r13d, eax
cmovbe r13d, eax
mov eax, edi
lea rcx, [rax + rax*8]
add rcx, rcx
lea rdx, [rbp + rcx*8 + 0x30]
lea rcx, [rsp + 0x78]
call fcn.1400810f0
add edi, 1
add rbx, 0x90
cmp edi, dword [rbp + 4]
jb 0x140081d20
add r13d, 1
mov dword [rsp + 0x70], r13d
mov rsi, qword [rsp + 0x58]
mov rdi, rsi
mov rbx, qword [rsp + 0x50]
cmp rbx, rsi
jbe 0x140081d7b
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
cmp rbx, rsi
jbe 0x140081d8b
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rsi, qword [rsp + 0x58]
movabs r13, 0xe38e38e38e38e39
cmp rbx, rdi
je 0x140081df3
mov rcx, rsi
sub rcx, rdi
mov rax, r13
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rbp, [rdx + rdx*8]
shl rbp, 4
add rbp, rbx
cmp rdi, rsi
je 0x140081dee
sub rbx, rdi
nop
nop
nop
lea rcx, [rdi + rbx]
mov rdx, rdi
mov r8d, 0x90
call sub.ntdll.dll_memcpy
add rdi, 0x90
cmp rdi, rsi
jne 0x140081dd0
mov qword [rsp + 0x58], rbp
mov rcx, qword [r12 + 8]
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov dword [rsp + 0x74], eax
mov r8d, r14d
mov dword [rsp + 0x68], r14d
mov rdx, r14
mov qword [rsp + 0x98], rdx
movzx edi, byte [rsp + 0x40]
movzx ebx, byte [rsp + 0x40]
mov rax, qword [r12 + 0x18]
test rax, rax
jne 0x140081e31
mov rcx, r14
jmp 0x140081e3d
mov rcx, qword [r12 + 0x20]
sub rcx, rax
sar rcx, 3
movsxd rax, r8d
cmp rax, rcx
jae 0x1400825e1
mov rcx, qword [r12 + 0x18]
test rcx, rcx
je 0x140081e64
mov rax, qword [r12 + 0x20]
sub rax, rcx
sar rax, 3
cmp rdx, rax
jb 0x140081e72
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rdx, qword [rsp + 0x98]
mov rax, qword [r12 + 0x18]
mov r12, qword [rax + rdx*8]
mov dword [rsp + 0xe0], 1
xor edx, edx
mov r8d, 0x88
lea rcx, [rsp + 0xe8]
call sub.ntdll.dll_memset
mov r11, qword [r12]
mov rcx, r12
call qword [r11 + 0x78]
test al, al
je 0x1400825b2
mov r15d, r14d
mov r13, r14
nop
nop
nop
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
test rsi, rsi
jne 0x140081ee3
xor edx, edx
movabs r8, 0xe38e38e38e38e39
jmp 0x140081f07
mov rcx, rbp
sub rcx, rsi
movabs r8, 0xe38e38e38e38e39
mov rax, r8
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, r15d
cmp rax, rdx
jae 0x14008204e
test rsi, rsi
je 0x140081f34
sub rbp, rsi
mov rax, r8
imul rbp
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r13, rdx
jb 0x140081f42
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rsi, qword [rsp + 0x80]
mov ebp, dword [rsp + 0x74]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x38]
imul rax, rbp
cmp rax, qword [rsi + r14 + 8]
jne 0x140081fca
mov rsi, qword [rsp + 0x80]
test rsi, rsi
je 0x140081f93
mov rcx, qword [rsp + 0x88]
sub rcx, rsi
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r13, rdx
jb 0x140081fa1
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rsi, qword [rsp + 0x80]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x88]
imul rax, rbp
cmp rax, qword [rsi + r14 + 0x10]
jne 0x140081fca
mov rax, qword [r12]
mov rcx, r12
call qword [rax + Ordinal_443]
test eax, eax
je 0x140081fde
add r15d, 1
add r13, 1
add r14, 0x90
jmp 0x140081ec0
mov rsi, qword [rsp + 0x80]
test rsi, rsi
je 0x140082019
mov rbp, qword [rsp + 0x88]
mov rcx, rbp
sub rcx, rsi
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r13, rdx
jb 0x14008202f
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
lea rdx, [r13 + r13*8]
shl rdx, 4
lea rcx, [rsp + 0xe0]
add rdx, rsi
mov r8d, 0x90
call sub.ntdll.dll_memcpy
test rsi, rsi
jne 0x140082065
xor r14d, r14d
mov rdx, r14
movabs r13, 0xe38e38e38e38e39
jmp 0x140082089
sub rbp, rsi
movabs r13, 0xe38e38e38e38e39
mov rax, r13
imul rbp
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
xor r14d, r14d
movsxd rax, r15d
cmp rax, rdx
jae 0x140082201
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x140082116
mov rcx, rbp
sub rcx, rsi
mov rax, r13
imul rcx
mov r8, rdx
sar r8, 3
mov rax, r8
shr rax, 0x3f
add r8, rax
mov rcx, qword [rsp + 0x60]
sub rcx, rsi
mov rax, r13
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r8, rdx
jae 0x140082116
xor eax, eax
mov byte [rsp + 0x28], al
mov byte [rsp + 0x20], dil
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xe0]
lea edx, [rax + 1]
mov rcx, rbp
call fcn.14007a720
lea r11, [rbp + 0x90]
mov qword [rsp + 0x58], r11
jmp 0x1400825b2
mov r12, rbp
cmp rsi, rbp
jbe 0x14008212e
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], r12
test rsi, rsi
je 0x140082193
mov rcx, rbp
sub rcx, rsi
mov rax, r13
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0xb0], rdx
je 0x140082193
cmp rsi, rbp
jbe 0x140082177
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub r12, rsi
mov rax, r13
imul r12
mov rsi, rdx
sar rsi, 3
mov rax, rsi
shr rax, 0x3f
add rsi, rax
jmp 0x140082196
mov rsi, r14
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x190], xmm0
lea r9, [rsp + 0xe0]
mov r8d, 1
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x48]
call fcn.14007b9e0
mov rbp, qword [rsp + 0x50]
cmp rbp, qword [rsp + 0x58]
jbe 0x1400821d9
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rcx, [rsi + rsi*8]
shl rcx, 4
add rcx, rbp
cmp rcx, qword [rsp + 0x58]
ja 0x1400821f6
cmp rcx, qword [rsp + 0x50]
jae 0x1400825b2
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
jmp 0x1400825b2
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0xf8], eax
add eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0xe0], 1
mov byte [rsp + 0xfc], 1
mov esi, dword [rsp + 0x74]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x38]
imul rax, rsi
mov qword [rsp + 0xe8], rax
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x88]
imul rax, rsi
mov qword [rsp + 0xf0], rax
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0xb0]
mov edx, dword [rax]
sub edx, 1
je 0x140082317
cmp edx, 1
je 0x1400822c9
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x1c0]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rcx, r14
lea r13, [0x140000000]
nop
movzx eax, word [rcx + r13 + 0x2e5758]
mov word [rsp + rcx + reloc.MFC80U.DLL_Ordinal_296], ax
add rcx, 2
test ax, ax
jne 0x1400822a0
movabs r13, 0xe38e38e38e38e39
jmp 0x140082364
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x1a0]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rcx, r14
lea r13, [0x140000000]
movzx eax, word [rcx + r13 + 0x2e5738]
mov word [rsp + rcx + reloc.MFC80U.DLL_Ordinal_296], ax
add rcx, 2
test ax, ax
jne 0x1400822f1
movabs r13, 0xe38e38e38e38e39
jmp 0x140082364
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x1b0]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rdx, r14
lea r13, [0x140000000]
nop
movzx eax, word [rdx + r13 + 0x2e5708]
mov word [rsp + rdx + reloc.MFC80U.DLL_Ordinal_296], ax
add rdx, 2
test ax, ax
jne 0x140082340
movabs r13, 0xe38e38e38e38e39
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0xd8]
test eax, eax
je 0x140082389
movabs rax, 0x4000000000000000
or qword [rsp + 0x120], rax
jmp 0x14008239b
movabs rax, 0xbfffffffffffffff
and qword [rsp + 0x120], rax
mov r14, qword [rsp + 0xa0]
test r14, r14
je 0x14008244d
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0xb0]
lea rdx, [rsp + 0x110]
mov ecx, dword [rax + 0x78]
mov dword [rdx], ecx
mov ecx, dword [rax + 0x7c]
mov dword [rdx + 4], ecx
mov ecx, dword [rax + 0x80]
mov dword [rdx + 8], ecx
mov eax, dword [rax + 0x84]
mov dword [rdx + 0xc], eax
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0xb0]
lea rcx, [rsp + 0x100]
mov edx, dword [rax + 0x68]
mov dword [rcx], edx
mov edx, dword [rax + 0x6c]
mov dword [rcx + 4], edx
mov edx, dword [rax + 0x70]
mov dword [rcx + 8], edx
mov eax, dword [rax + 0x74]
mov dword [rcx + 0xc], eax
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0xb0]
lea rcx, [rax + 0x20]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_296]
sub rdx, rcx
nop
nop
nop
nop
movzx eax, word [rcx]
mov word [rcx + rdx], ax
add rcx, 2
test ax, ax
jne 0x140082430
xor r14d, r14d
mov qword [rsp + 0xa0], r14
jmp 0x140082450
xor r14d, r14d
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x1400824d0
mov rcx, rbp
sub rcx, rsi
mov rax, r13
imul rcx
mov r8, rdx
sar r8, 3
mov rax, r8
shr rax, 0x3f
add r8, rax
mov rcx, qword [rsp + 0x60]
sub rcx, rsi
mov rax, r13
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r8, rdx
jae 0x1400824d0
xor eax, eax
mov byte [rsp + 0x28], al
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xe0]
lea edx, [rax + 1]
mov rcx, rbp
call fcn.14007a720
lea r11, [rbp + 0x90]
mov qword [rsp + 0x58], r11
jmp 0x1400825b2
mov r12, rbp
cmp rsi, rbp
jbe 0x1400824e8
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], r12
test rsi, rsi
je 0x14008254d
mov rcx, rbp
sub rcx, rsi
mov rax, r13
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0xb0], rdx
je 0x14008254d
cmp rsi, rbp
jbe 0x140082531
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub r12, rsi
mov rax, r13
imul r12
mov rsi, rdx
sar rsi, 3
mov rax, rsi
shr rax, 0x3f
add rsi, rax
jmp 0x140082550
mov rsi, r14
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0x180], xmm0
lea r9, [rsp + 0xe0]
mov r8d, 1
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x48]
call fcn.14007b9e0
mov rbp, qword [rsp + 0x50]
cmp rbp, qword [rsp + 0x58]
jbe 0x140082593
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rcx, [rsi + rsi*8]
shl rcx, 4
add rcx, rbp
cmp rcx, qword [rsp + 0x58]
ja 0x1400825ac
cmp rcx, qword [rsp + 0x50]
jae 0x1400825b2
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r8d, dword [rsp + 0x68]
add r8d, 1
mov dword [rsp + 0x68], r8d
mov rdx, qword [rsp + 0x98]
add rdx, 1
mov qword [rsp + 0x98], rdx
mov r12, qword [rsp + 0xa8]
jmp 0x140081e22
cmp qword [rsp + 0x50], 0
jne 0x1400825ee
mov rdx, r14
jmp 0x14008260c
mov rcx, qword [rsp + 0x58]
sub rcx, qword [rsp + 0x50]
mov rax, r13
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rbp, qword [rsp + 0x1d0]
mov dword [rbp + 4], edx
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14008269d
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, r13
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x14008269d
mov r8d, edx
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.14007a070
mov r11, qword [rsp + 0x50]
test r11, r11
jne 0x14008265d
mov rdi, r14
jmp 0x14008267e
mov rcx, qword [rsp + 0x58]
sub rcx, r11
mov rax, r13
imul rcx
mov rdi, rdx
sar rdi, 3
mov rax, rdi
shr rax, 0x3f
add rdi, rax
jne 0x140082689
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r11, qword [rsp + 0x50]
lea r8, [rdi + rdi*8]
shl r8, 4
lea rcx, [rbp + 0x30]
mov rdx, r11
call sub.ntdll.dll_memcpy
mov rcx, qword [r12 + 8]
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rcx, rax
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, 0xa00000
mov r8, rbp
mov edx, 0x7c054
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
mov rcx, rbp
call sub.MFC80U.DLL_Ordinal_266
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400826f5
call sub.MFC80U.DLL_Ordinal_776
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140082716
call sub.MFC80U.DLL_Ordinal_776
mov eax, edi
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + reloc.MFC80U.DLL_Ordinal_568]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret