Function at 0x4235b0
Capabilities:
Get disk information
Terminate thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3c8
mov rbp, rsp
mov dword [rbp + 0x7c], ecx
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x198], 0
nop
call fcn.00423370
mov byte [0x004357f9], 1
lea rcx, [rbp + 0x1b6]
mov edx, 0x105
xor r8, r8
call fcn.00405c10
mov rcx, qword [0x00434190]
lea rdx, [rbp + 0x1b6]
mov r8d, 0x104
call sub.kernel32.dll_GetModuleFileNameW
lea rcx, [rbp + 0x198]
movzx rdx, word [rbp + 0x1b6]
call fcn.0040a520
lea rcx, [rbp + 0x198]
lea rdx, [0x004239a8]
call fcn.0040a820
mov rcx, qword [rbp + 0x198]
call fcn.0040a4d0
mov rcx, rax
xor edx, edx
xor r8, r8
lea r9, [rbp + 0x1b0]
lea rax, [rbp + 0x1ac]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
call sub.kernel32.dll_GetVolumeInformationW
lea rcx, [rbp + 0x190]
movzx rdx, word [rbp + 0x1b6]
xor r8, r8
call fcn.00409ae0
mov rcx, qword [0x0042d928]
mov rdx, qword [rbp + 0x190]
lea r8, [0x004239bc]
call fcn.00409d60
lea rcx, [rbp + 0xb0]
call fcn.00419500
mov rdi, qword [0x0042d8d8]
lea rsi, [rbp + 0xb0]
mov ecx, 0x1b
rep movsq qword [rdi], qword [rsi]
movsd dword [rdi], dword [rsi]
mov rax, qword [0x0042d8d8]
imul ebx, dword [rax + 0xac], 0x64
mov rcx, qword [0x0042d910]
lea rdx, [0x004239cc]
call fcn.00409690
xor ecx, ecx
call sub.user32.dll_GetSystemMetrics
mov ecx, eax
test ecx, ecx
jbe 0x423772
lea r8, [rbp + 0xa8]
mov eax, ebx
xor edx, edx
div ecx
mov rdx, rax
mov edx, edx
mov rcx, r8
call fcn.0040f100
mov rcx, qword [0x0042d910]
mov rdx, qword [rbp + 0xa8]
call fcn.00409690
lea rcx, [rbp + 0xa0]
movzx rdx, word [rbp + 0x1b6]
call fcn.0040a520
lea rcx, [rbp + 0x98]
call fcn.00417f30
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x98]
call fcn.0040a620
call fcn.00411de0
lea rcx, [rbp + 0x88]
mov edx, eax
call fcn.0040f100
lea rcx, [rbp + 0x80]
call fcn.00411a30
mov rcx, qword [0x0042d8f0]
mov edx, 0xb
mov r8, qword [rbp + 0xa0]
lea r9, [0x004239e0]
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea rax, [0x004239f0]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [0x00423a00]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [0x00423a00]
mov qword [rsp + 0x48], rax
lea rax, [0x00423a10]
mov qword [rsp + 0x50], rax
lea rax, [0x00423a24]
mov qword [rsp + 0x58], rax
mov rax, qword [0x0042d910]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
call fcn.0040aa20
mov eax, dword [rbp + 0x7c]
cmp eax, 0x3e8
je 0x423875
mov byte [0x004357f8], 0
mov rax, qword [0x0042d950]
mov byte [rax], 1
call fcn.00421c90
jmp 0x4238df
call fcn.00421c90
mov rax, qword [0x0042d888]
mov rcx, qword [rax]
mov edx, 0x6ddd00
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x4238d5
mov rax, qword [0x0042d888]
mov rcx, qword [rax]
lea rdx, [rbp + 0x1a4]
call sub.kernel32.dll_GetExitCodeThread
mov rax, qword [0x0042d888]
mov rcx, qword [rax]
mov edx, dword [rbp + 0x1a4]
call sub.kernel32.dll_TerminateThread
mov rax, qword [0x0042d888]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
call fcn.00417e70
mov rax, qword [0x0042d8e8]
cmp byte [rax], 0
nop
lea rcx, [rbp + 0x80]
mov edx, 3
call fcn.00409260
lea rcx, [rbp + 0x98]
call fcn.004091d0
lea rcx, [rbp + 0xa0]
mov edx, 2
call fcn.00409260
lea rcx, [rbp + 0x190]
call fcn.004091d0
lea rcx, [rbp + 0x198]
call fcn.00409180
lea rsp, [rbp + 0x3c8]
pop rbx
pop rsi
pop rdi
pop rbp
ret