Function at 0x140001680
Capabilities:
Create thread
Execute command
Get disk size
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor esi, esi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x38], rsi
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x40]
xor edx, edx
lea rcx, [0x1400054c0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140001732
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x30]
lea rcx, [0x1400054c8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x140001729
lea rdx, str.Disk_sector_size:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400024a0
mov rcx, rax
mov edx, dword [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes
jmp 0x140001740
lea rdx, str.Failed_to_get_disk_sector_size.
jmp 0x140001739
lea rdx, str.Failed_to_get_disk_free_space.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400024a0
lea rdx, [0x140002670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, str.Maximum_Direct_I_O_size:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400024a0
mov rcx, rax
mov edx, dword [rbp - 0x34]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes
call fcn.1400024a0
mov rcx, rax
lea rdx, [0x140002670]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], sil
mov byte [rbp - 8], 1
mov r12d, esi
lea rax, [rbp + 0x90]
mov qword [rbp], rax
lea r14, str.D:_cdkim_
lea rdi, [0x140005569]
mov edx, r12d
lea rcx, [rsp + 0x50]
call fcn.140002040
nop
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x140001872
lea rax, [r8 + 9]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x50]
cmp rdi, rbx
jbe 0x140001830
lea rax, [rbx + r8]
cmp r14, rax
ja 0x140001830
cmp rbx, r14
ja 0x140001828
mov rdi, rsi
jmp 0x140001835
mov rdi, rbx
sub rdi, r14
jmp 0x140001835
mov edi, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 9
sub r8, rdi
lea rdx, [rdi + 9]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x50]
jmp 0x14000188a
mov qword [rsp + 0x28], 9
mov edx, 9
lea rcx, [rsp + 0x50]
call fcn.140002cb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x14000190d
lea rax, [rcx + 9]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 9
lea rdx, str._test.dat
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 9], 0
lea rax, [rsp + 0x30]
jmp 0x140001925
mov qword [rsp + 0x20], 9
mov edx, 9
lea rcx, [rsp + 0x30]
call fcn.140002810
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001988
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001983
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001b4a
call fcn.140003020
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400019d8
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001b51
call fcn.140003020
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
lea r14, [rbp + 0x68]
movups xmm1, xmmword [rbp - 0x50]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
seta r13b
mov rsi, qword [rbp - 0x60]
cmova r14, rsi
movq rdi, xmm1
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140001eec
cmp rdi, 0xf
ja 0x140001a59
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x70], xmm0
jmp 0x140001aeb
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140001a78
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140001a9f
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001ac1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001ee6
mov rcx, rax
call fcn.140003028
mov rcx, rax
test rax, rax
je 0x140001b58
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001acf
test rcx, rcx
je 0x140001acd
call fcn.140003028
jmp 0x140001acf
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x70]
call fcn.1400012b0
mov rbx, qword [rbp]
mov qword [rbx], rax
test r13b, r13b
je 0x140001b32
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001b2a
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e6e
mov rcx, rsi
call fcn.140003020
inc r12d
add rbx, 8
mov qword [rbp], rbx
cmp r12d, 0xa
jge 0x140001b5f
xor esi, esi
jmp 0x1400017c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x10
call fcn.140003028
mov r14, rax
mov qword [rbp - 0x70], rax
lea rax, [rbp - 8]
mov qword [rbp], rax
lea rax, [rbp + 0x90]
mov qword [rbp + 8], rax
mov ecx, 0x10
call fcn.140003028
movups xmm0, xmmword [rbp]
movups xmmword [rax], xmm0
mov qword [rbp], rax
lea rsi, [r14 + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140002e70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r14], rax
test rax, rax
je 0x140001ed4
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
movabs r15, 0x4e94914f0000
movabs r13, 0x431bde82d7b634db
movabs rdi, 0x7ffffffffa0a1eff
lea r12, [0x14000556c]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x10]
mov rcx, rbx
call fcn.1400029a0
lea rdx, [rbp + 0x10]
mov r9, qword [rbp + 0x28]
cmp r9, 0xf
seta r11b
mov r8, qword [rbp + 0x10]
cmova rdx, r8
mov r10, qword [rbp + 0x20]
cmp r10, 4
jne 0x140001c85
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r12 + rcx - 1]
jne 0x140001c78
cmp rcx, 4
jne 0x140001c60
xor eax, eax
jmp 0x140001c7d
sbb eax, eax
or eax, 1
test eax, eax
je 0x140001e44
lea rax, [rbp + 0x10]
cmp r9, 0xf
cmova rax, r8
cmp r10, 3
jne 0x140001ca8
cmp word [rax], 0x6576
jne 0x140001ca8
cmp byte [rax + 2], 0x72
je 0x140001d2d
lea rax, [rbp + 0x10]
cmp r9, 0xf
cmova rax, r8
cmp r10, 3
jne 0x140001cd6
cmp word [rax], 0x6c63
jne 0x140001cd6
cmp byte [rax + 2], 0x73
jne 0x140001cd6
lea rcx, [0x140005574]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140001d2d
lea rax, [rbp + 0x10]
cmp r9, 0xf
cmova rax, r8
cmp r10, 2
jne 0x140001d2d
cmp word [rax], 0x6465
jne 0x140001d2d
mov byte [rbp - 8], 0
cmp dword [rsi], 0
je 0x140001ec8
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsi], eax
je 0x140001ebc
movups xmm0, xmmword [r14]
movaps xmmword [rbp - 0x60], xmm0
xor edx, edx
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x140001eb0
xorps xmm0, xmm0
movups xmmword [r14], xmm0
lea rcx, [rbp]
call fcn.1400011d0
mov rbx, qword [rbp]
cmp rbx, rdi
jge 0x140001d48
add rbx, 0x5f5e100
jmp 0x140001d52
movabs rbx, 0x7fffffffffffffff
movabs r12, 0xb2f4fc0794908cf3
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rdi, 0x989680
jne 0x140001d81
imul rax, rcx, 0x64
jmp 0x140001df2
cmp rdi, 0x16e3600
jne 0x140001dd4
mov rax, r12
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r12
imul rcx
lea rax, [rcx + rdx]
sar rax, 0x18
mov rcx, rax
shr rcx, 0x3f
add rax, rcx
imul rcx, r8, 0x3b9aca00
jmp 0x140001def
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rbx
jge 0x140001bf8
mov rcx, rbx
sub rcx, rax
cmp rcx, r15
jl 0x140001e15
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140001d60
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140001e38
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140001d60
test r11b, r11b
je 0x140001e7e
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140001e75
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e75
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.140003020
nop
xor eax, eax
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140003000
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140001110
int3
call fcn.1400011b0
int3