Function at 0x140149a00
Capabilities:
Get disk information
Manipulate console buffer
Terminate thread

Disassembly:
push rsi
push rdi
sub rsp, 0x618
mov byte [rsp + 0x30], 0xc6
lea rax, [rsp + 0xa8]
lea rcx, str.dumper
mov rdi, rax
mov rsi, rcx
mov ecx, ILClone
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x40], 0x967e522a
cmp dword [rsp + 0x40], 0x9aa7ecbe
je 0x140149a71
movzx eax, byte [rsp + 0x30]
add eax, 0x78
mov byte [rsp + 0x30], al
mov eax, 0x395d
mov word [rsp + 0x38], ax
mov byte [rsp + 0x31], 0x62
movabs rax, 0x412fe9ec823c2e0d
mov qword [rsp + 0x48], rax
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x34], ax
movsx eax, byte [rsp + 0x31]
cmp eax, 3
jne 0x140149ab1
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x39
lea r9, [rsp + 0x48]
mov r8d, 0xb4
lea rdx, str.Acquites_temporarily_Protactinium_fertilisers
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.USER32.dll_DrawTextExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x593a769
jl 0x140149ad2
movsx eax, byte [rsp + 0x31]
sub eax, 0x77
mov byte [rsp + 0x31], al
movzx ecx, word [rsp + 0x38]
call fcn.140149e50
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rax
movabs rax, 0x412fe9ec823c2e0d
cmp qword [rsp + 0x80], rax
je 0x140149af8
jmp 0x140149cd6
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x64], al
cmp byte [rsp + 0x64], 5
je 0x140149b0d
jmp 0x140149b96
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x68], al
cmp byte [rsp + 0x68], 0x79
je 0x140149b1f
jmp 0x140149b7d
movsx eax, word [rsp + 0x34]
sub eax, 0x21f0
movsx ecx, word [rsp + 0x38]
cmp eax, ecx
jne 0x140149b7b
movabs rax, 0x27c74eb7576d5835
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
call fcn.140149a00
mov eax, dword [rsp + 0x5c]
and eax, 0x89e0d88d
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0], rax
movsx eax, word [rsp + 0x34]
sub eax, 0x3187
mov word [rsp + 0x38], ax
jmp 0x140149b91
movzx r8d, word [rsp + 0x34]
mov dx, PathYetAnotherMakeUniqueName
mov cx, 0xed
call fcn.14014a9e0
nop
jmp 0x140149c40
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x88], rax
movabs rax, 0xd7ecdacb8be5437e
cmp qword [rsp + 0x88], rax
je 0x140149bbc
jmp 0x140149c40
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x2c3f3975
je 0x140149c2a
cmp dword [rsp + 0x54], 0x55e354d6
je 0x140149bda
jmp 0x140149c40
mov eax, dword [rsp + 0x5c]
add eax, 0xd413b562
mov dword [rsp + 0x40], eax
movzx eax, byte [rsp + 0x30]
cmp eax, 0x67
jge 0x140149c28
mov r8d, 0xfe
mov edx, 1
lea rcx, str.C:MushroomedFrailer
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov qword [rsp + 0xc8], rax
movzx eax, byte [rsp + 0x30]
sub eax, 0x10
mov byte [rsp + 0x30], al
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov word [rsp + 0x3c], ax
jmp 0x140149c40
movzx r8d, word [rsp + 0x34]
movzx edx, word [rsp + 0x3c]
movzx ecx, word [rsp + 0x3c]
call fcn.14014a9e0
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x31]
mov qword [rsp + 0x98], rax
movzx eax, word [rsp + 0x3c]
add eax, 0x379
mov rcx, qword [rsp + 0x90]
movzx ecx, word [rcx]
cmp eax, ecx
jle 0x140149c82
jmp 0x140149cc2
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x8d
lea r8, str.chilblain_Woodworking_issuable_aftershave_Spiritedly
mov edx, ILFree
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GetStringTypeExW]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0x30]
sar eax, 7
mov rcx, qword [rsp + 0xa0]
mov byte [rcx], al
movsx eax, word [rsp + 0x38]
or eax, 0x2af6
mov word [rsp + 0x34], ax
jmp 0x140149d9b
movabs rax, 0x893edc51045f924b
cmp qword [rsp + 0x48], rax
jne 0x140149d66
movsx eax, word [rsp + 0x34]
shl eax, 0xa
mov word [rsp + 0x38], ax
mov dword [rsp + 0x28], PathMakeUniqueName
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, str.devils_harebell_communicative
lea r8, [rsp + 0x30]
mov edx, 0xc5
mov ecx, 0xe9
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x50], eax
call fcn.140149a00
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x7c]
mov r8d, dword [rsp + 0x70]
lea rdx, [rsp + 0x230]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
mov dword [rsp + 0x74], eax
jmp 0x140149d9b
cmp dword [rsp + 0x50], 0x614988fd
jne 0x140149d9b
movzx eax, byte [rsp + 0x30]
or eax, 0x16
mov byte [rsp + 0x30], al
mov r8d, 0xe8
lea rdx, [rsp + 0xf0]
lea rcx, str.C:EulogisticcounterpointedMulticultural_trueEscapade
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov dword [rsp + 0x5c], eax
movzx eax, byte [rsp + 0x30]
and eax, 0xce
mov byte [rsp + 0x30], al
mov r8d, 0xeb
lea rdx, str.Indemnity_Seronegative
lea rcx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov qword [rsp + 0xd8], rax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x6c], al
cmp byte [rsp + 0x6c], 0xde
je 0x140149dde
jmp 0x140149df5
mov edx, 0x42
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x48]
shr rax, 0xb
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x230]
mov edx, ILFindChild
mov ecx, 0xe7
call qword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x40]
xor eax, 0x1c772569
mov dword [rsp + 0x40], eax
mov eax, 0x45
add rsp, 0x618
pop rdi
pop rsi
ret