Function at 0x1401a9a2c
Capabilities:
Create thread
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rbp - 8], rax
mov qword [rbp - 0x18], rcx
xor ebx, ebx
mov dword [rbp - 0x40], ebx
lea rax, [rbp - 0x18]
mov qword [rbp - 0x20], rax
and dword [rbp - 0x10], ebx
cmp dword [rcx - 0x10], 2
jl 0x1401a9b8d
cmp word [rcx + 2], 0x5c
jne 0x1401a9b8d
lea edi, [rbx + 1]
cmp dword [rcx - 0x10], 4
jle 0x1401a9ab2
lea r8d, [rbx + 4]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x18]
call fcn.140027f24
nop
mov ebx, edi
mov dword [rbp - 0x40], ebx
lea rdx, [0x1403a05e0]
mov rcx, qword [rax]
call fcn.14028f2a0
test eax, eax
jne 0x1401a9ab2
mov r14b, dil
jmp 0x1401a9ab5
xor r14b, r14b
test dil, bl
je 0x1401a9ae8
and ebx, 0xfffffffe
mov dword [rbp - 0x40], ebx
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401a9ae5
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001d845.0]
mov ebx, dword [rbp - 0x40]
test r14b, r14b
je 0x1401a9b57
mov rax, qword [rbp - 0x18]
mov r8d, 8
cmp dword [rax - 0x10], r8d
jle 0x1401a9b24
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x18]
call fcn.140027f24
nop
or ebx, 2
mov dword [rbp - 0x40], ebx
lea rdx, [0x1403a05f8]
mov rcx, qword [rax]
call fcn.14028f2a0
test eax, eax
je 0x1401a9b27
xor dil, dil
test bl, 2
je 0x1401a9b57
and ebx, 0xfffffffd
mov dword [rbp - 0x40], ebx
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401a9b57
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001d845.0]
test dil, dil
jne 0x1401a9bd8
mov rcx, qword [rbp - 0x18]
call fcn.1401a9970
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402194b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov r8d, 3
cmp dword [rcx - 0x10], r8d
jl 0x1401a9bc1
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x18]
call fcn.140027f24
nop
mov ebx, 4
mov dword [rbp - 0x40], ebx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, ebx
jne 0x1401a9bc1
lea edi, [rbx - 3]
jmp 0x1401a9bc4
xor dil, dil
test bl, 4
je 0x1401a9b57
and ebx, 0xfffffffb
mov dword [rbp - 0x40], ebx
mov rdx, qword [rbp - 0x28]
jmp 0x1401a9b36
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9, qword [rbp - 0x18]
lea r8, [fcn.1401a9970]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x1401a9c2d
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1401a9c1f
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401a9b68
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401a9b68
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001d845.0]
jmp 0x1401a9b68