Function at 0x1400263a8
Capabilities:
Get disk information
Get thread local storage value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf8
lea rax, [rdx - 8]
mov r14, rcx
lea rcx, [r11 + 0x10]
mov qword [rsp + 0xb8], rax
call fcn.1400170fc
mov rax, qword [rsp + 0x148]
mov ecx, 0x2d
cmp cx, word [rax]
lea edx, [rcx - 3]
cmove edx, ecx
lea rcx, [0x14013e190]
movsx r15d, dl
mov word [rsp + 0x80], r15w
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, byte [r14 + 0x11]
shr rax, 1
xor edi, edi
and rax, 1
or rax, qword [0x14013d080]
je 0x140026451
mov rax, qword [rsp + 0x148]
cmp r15w, word [rax]
jne 0x14002643d
cmp word [rax + 2], di
je 0x140026451
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x14002708f
mov ecx, dword [0x14013c934]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x148]
lea r13, [0x14013cb18]
mov r12, rax
mov byte [rsp + 0x4c], dil
mov byte [rsp + 0x41], dil
mov byte [rsp + 0x44], dil
mov byte [rsp + 0x40], dil
mov byte [rsp + 0x158], dil
mov byte [rsp + 0x4b], dil
mov byte [rsp + 0x48], dil
mov r8d, edi
mov dword [rsp + 0x60], edi
mov byte [rsp + 0x58], dil
mov bpl, dil
mov sil, dil
mov qword [rsp + 0xa0], rbx
cmp word [rbx], r15w
jne 0x14002657a
mov r14d, 1
cmp word [rbx + 2], r15w
jne 0x140026572
add rbx, 4
lea rcx, str.thread
mov r8d, 6
mov rdx, rbx
mov qword [rsp + 0xa0], rbx
call fcn.14005c4dc
cmp al, dil
je 0x140026517
mov rax, qword [rsp + 0x148]
mov r8d, dword [rsp + 0x60]
cmp word [rax + 0xc], 0x2b
jne 0x140026509
mov sil, 3
jmp 0x14002651f
cmp word [rax + 0xc], 0x40
sete sil
add sil, r14b
jmp 0x14002651f
mov r8d, r14d
mov dword [rsp + 0x60], r14d
movzx eax, word [rbx]
cmp ax, di
je 0x140026553
mov ecx, 0x20
lea edx, [rcx - 0x17]
cmp dx, ax
ja 0x14002653a
cmp ax, 0xd
jbe 0x140026553
cmp cx, ax
je 0x140026553
add rbx, 2
mov qword [rsp + 0xa0], rbx
mov ax, word [rbx]
cmp ax, di
jne 0x14002652f
lea rcx, [rsp + 0xa0]
call fcn.1400170fc
mov rbx, qword [rsp + 0xa0]
cmp word [rbx], r15w
je 0x1400264bf
mov r14, qword [rsp + 0x140]
cmp r8d, edi
je 0x140026591
cmp word [rbx], di
jne 0x140026591
mov r15d, 1
mov byte [rsp + 0x4e], r15b
jmp 0x14002659c
mov byte [rsp + 0x4e], dil
mov r15d, 1
mov eax, 0x2a
cmp ax, word [rbx]
jne 0x1400265e1
add rbx, 2
mov byte [rsp + 0x58], r15b
cmp word [rbx], 0x3f
mov qword [rsp + 0x98], rbx
jne 0x1400265cc
add rbx, 2
mov bpl, r15b
mov qword [rsp + 0x98], rbx
lea rcx, [rsp + 0x98]
call fcn.1400170fc
mov rbx, qword [rsp + 0x98]
mov rcx, rbx
call fcn.14001be60
mov rbx, rax
mov qword [rsp + 0x98], rax
cmp byte [rsp + 0x58], dil
je 0x14002660f
cmp bpl, dil
jne 0x14002660f
cmp word [rax], di
jne 0x14002660f
mov byte [rsp + 0x140], r15b
jmp 0x140026634
mov byte [rsp + 0x140], dil
cmp dword [rsp + 0x60], edi
jne 0x140026634
cmp word [rax], di
jne 0x140026634
movzx eax, sil
cmp sil, dil
mov ecx, 3
cmove eax, ecx
mov sil, al
mov rax, r12
neg rax
sbb al, al
and al, sil
mov esi, 1
lea rcx, [rsi - 2]
mov byte [rsp + 0x5c], al
and al, sil
cmovne rcx, r12
cmp al, dil
mov byte [rsp + 0x4f], sil
cmovne r13, r12
mov qword [rsp + 0x68], rcx
lea r15, [r13 + 8]
test byte [r14 + 0x10], sil
je 0x140026679
mov byte [rsp + 0x42], sil
cmp qword [r13], rdi
jne 0x14002667e
mov byte [rsp + 0x42], dil
mov rcx, qword [rsp + 0x150]
test sil, cl
je 0x1400266a1
and rcx, 0xfffffffffffffffe
mov byte [rsp + 0x42], dil
mov byte [rsp + 0x4f], dil
mov qword [rsp + 0x150], rcx
lea rax, [0x14011c618]
mov qword [rsp + 0x90], 0xfffffffffff80000
mov qword [rsp + 0xd8], rax
cmp rcx, 0xffffffffffffffff
jne 0x1400266db
mov rcx, qword [r13 + 0x20]
mov byte [rsp + 0x41], 2
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x90], rcx
mov rax, qword [rsp + 0x148]
lea rcx, [rsp + 0x88]
mov dword [rsp + 0x50], edi
cmp word [rax], di
setne byte [rsp + 0x70]
call fcn.1400632a0
mov cl, byte [r14 + 0x10]
mov r12b, byte [r14 + 0x10]
mov al, cl
mov qword [rsp + 0xc8], rdi
and al, sil
shr r12b, 6
mov byte [rsp + 0x46], 0xff
mov byte [rsp + 0x54], al
mov al, cl
shr cl, 2
shr al, 1
and cl, sil
and r12b, sil
and al, sil
mov byte [rsp + 0x4a], cl
lea rcx, [0x14013e190]
mov byte [rsp + 0x47], al
mov al, byte [r14 + 0x10]
mov byte [rsp + 0x4d], 0xff
shr al, 3
mov dword [rsp + 0x78], edi
mov ebp, edi
and al, sil
mov byte [rsp + 0x49], al
mov al, byte [r14 + 0x10]
shr al, 4
and al, sil
mov byte [rsp + 0x45], al
mov al, byte [r14 + 0x10]
shr al, 5
and al, sil
mov byte [rsp + 0x43], al
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x148]
mov si, word [rsp + 0x80]
cmp word [rax], si
jne 0x140026db7
mov bl, byte [rsp + 0x41]
mov r15d, edi
cmp word [rax + 2], si
jne 0x140026da2
add rax, 4
lea rcx, str.thread
mov r8d, 6
mov rdx, rax
mov qword [rsp + 0x148], rax
inc r15d
call fcn.14005c4dc
cmp al, dil
jne 0x140026d46
mov rdx, qword [rsp + 0x148]
lea rcx, [0x140120874]
mov r8d, 1
call fcn.14005c4dc
cmp al, dil
je 0x140026835
mov rcx, qword [rsp + 0x148]
mov eax, 0x2d
cmp word [rcx + 2], ax
jne 0x14002680d
mov al, dil
mov byte [rsp + 0x45], al
jmp 0x140026d4e
movzx eax, byte [r14 + 0x11]
mov edx, 1
shr rax, 1
and rax, rdx
or rax, qword [0x14013d080]
jne 0x140026d4e
mov al, dl
mov byte [rsp + 0x45], dl
jmp 0x140026d4e
mov rdx, qword [rsp + 0x148]
lea rcx, str.lock:
mov r8d, 5
call fcn.14005c4dc
cmp al, dil
je 0x140026933
add qword [rsp + 0x148], 0xa
mov eax, 1
lea rdx, [rsp + 0xa8]
add byte [rsp + 0x44], al
lea rcx, [rsp + 0x148]
mov qword [rsp + 0xa8], rdi
call fcn.1400c13f0
mov r11, qword [r13 + 0x20]
mov ecx, 1
cmp r11, rdi
jle 0x14002690c
cmp bl, cl
je 0x14002690c
mov al, byte [rsp + 0x44]
cmp al, cl
jne 0x1400268bd
cmp r11, qword [rsp + 0xa8]
jne 0x1400268bd
mov rdx, qword [rsp + 0xa8]
mov bl, cl
mov qword [rsp + 0x90], rdx
mov rcx, qword [rsp + 0x148]
movzx eax, word [rcx]
cmp ax, di
je 0x140026d84
mov edx, 0x20
lea r8d, [rdx - 0x17]
cmp r8w, ax
ja 0x1400268ea
cmp ax, 0xd
jbe 0x140026d84
cmp dx, ax
je 0x140026d84
add rcx, 2
mov qword [rsp + 0x148], rcx
mov ax, word [rcx]
cmp ax, di
jne 0x1400268da
jmp 0x140026d84
mov rdx, qword [rsp + 0xa8]
cmp rdx, rdi
mov qword [rsp + 0x90], rdx
jg 0x1400268bd
mov byte [rsp + 0x4c], cl
mov qword [rsp + 0x90], 0xfffffffffff80000
jmp 0x1400268bd
mov rdx, qword [rsp + 0x148]
lea rcx, [0x140120868]
mov r8d, 3
call fcn.14005c4dc
cmp al, dil
je 0x140026995
mov rcx, qword [rsp + 0x148]
cmp word [rcx + 6], 0x31
jb 0x14002698d
cmp word [rcx + 6], 0x39
ja 0x14002698d
movzx eax, byte [r14 + 0x11]
mov edx, 1
shr rax, 1
and rax, rdx
or rax, qword [0x14013d080]
jne 0x140026d4e
mov r12b, dl
jmp 0x140026d4e
mov r12b, dil
jmp 0x140026d4e
mov rdx, qword [rsp + 0x148]
lea rcx, [0x140120864]
mov r8d, 1
call fcn.14005c4dc
cmp al, dil
je 0x1400269cf
mov rcx, qword [rsp + 0x148]
mov eax, 0x2d
cmp word [rcx + 2], ax
setne byte [rsp + 0x4a]
jmp 0x140026d4e
mov rdx, qword [rsp + 0x148]
lea rcx, [0x140120860]
mov r8d, 2
call fcn.14005c4dc
cmp al, dil
je 0x140026a09
mov rcx, qword [rsp + 0x148]
mov eax, 0x2d
cmp word [rcx + 4], ax
setne byte [rsp + 0x49]
jmp 0x140026d4e
mov rdx, qword [rsp + 0x148]
lea rcx, [0x14012085c]
mov r8d, 2
call fcn.14005c4dc
cmp al, dil
je 0x140026a72
mov rcx, qword [rsp + 0x148]
cmp word [rcx + 4], 0x31
jb 0x140026a66
cmp word [rcx + 4], 0x39
ja 0x140026a66
movzx eax, byte [r14 + 0x11]
mov edx, 1
shr rax, 1
and rax, rdx
or rax, qword [0x14013d080]
jne 0x140026d4e
mov al, dl
mov byte [rsp + 0x43], dl
jmp 0x140026d4e
mov al, dil
mov byte [rsp + 0x43], al
jmp 0x140026d4e
mov rdx, qword [rsp + 0x148]
lea rcx, str.dbg
mov r8d, 4
call fcn.14005c4dc
cmp al, dil
je 0x140026adb
mov rcx, qword [rsp + 0x148]
cmp word [rcx + 8], 0x31
jb 0x140026acf
cmp word [rcx + 8], 0x39
ja 0x140026acf
movzx eax, byte [r14 + 0x11]
mov edx, 1
shr rax, 1
and rax, rdx
or rax, qword [0x14013d080]
jne 0x140026d4e
mov byte [0x14013ccb1], dl
jmp 0x140026d4e
mov byte [0x14013ccb1], dil
jmp 0x140026d4e
mov rdx, qword [rsp + 0x148]
lea rcx, str.RAW
mov r8d, 4
call fcn.14005c4dc
cmp al, dil
je 0x140026b44
mov rcx, qword [rsp + 0x148]
cmp word [rcx + 8], 0x31
jb 0x140026b38
cmp word [rcx + 8], 0x39
ja 0x140026b38
movzx eax, byte [r14 + 0x11]
mov edx, 1
shr rax, 1
and rax, rdx
or rax, qword [0x14013d080]
jne 0x140026d4e
mov al, dl
mov byte [rsp + 0x47], dl
jmp 0x140026d4e
mov al, dil
mov byte [rsp + 0x47], al
jmp 0x140026d4e
mov rdx, qword [rsp + 0x148]
lea rcx, [0x140120848]
mov r8d, 3
call fcn.14005c4dc
cmp al, dil
je 0x140026b8d
mov rcx, qword [rsp + 0x148]
cmp word [rcx + 6], 0x31
jb 0x140026b7e
cmp word [rcx + 6], 0x39
mov eax, 3
jbe 0x140026b80
mov eax, edi
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x4d], al
jmp 0x140026d4e
lea rdx, [rsp + 0x148]
lea rcx, [0x140120844]
mov r8d, 2
call fcn.140065d7c
cmp al, dil
jne 0x140026bcb
lea rdx, [rsp + 0x148]
lea rcx, [0x140120840]
mov r8d, 3
call fcn.140065d7c
cmp al, dil
je 0x140026bd9
mov eax, 1
mov byte [rsp + 0x58], al
jmp 0x140026d91
mov rdx, qword [rsp + 0x148]
lea rcx, [0x14012083c]
mov r8d, 3
call fcn.14005c4dc
cmp al, dil
je 0x140026c49
mov rcx, qword [rsp + 0x148]
mov edx, 1
add ebp, edx
cmp word [rcx + 6], 0x31
jb 0x140026c38
cmp word [rcx + 6], 0x39
ja 0x140026c38
movzx eax, byte [r14 + 0x11]
shr rax, 1
and rax, rdx
or rax, qword [0x14013d080]
jne 0x140026d4e
mov al, dl
mov byte [rsp + 0x46], dl
jmp 0x140026d4e
and byte [r14 + 0x10], 0xfe
mov al, dil
mov byte [rsp + 0x46], al
jmp 0x140026d4e
lea rdx, [rsp + 0x148]
lea rcx, [0x140120838]
mov r8d, 1
call fcn.140065d7c
cmp al, dil
je 0x140026c72
mov byte [rsp + 0x40], 1
jmp 0x140026d91
lea rdx, [rsp + 0x148]
lea rcx, [0x140120834]
mov r8d, 3
call fcn.140065d7c
cmp al, dil
je 0x140026c9e
mov byte [rsp + 0x158], 1
jmp 0x140026d91
lea rdx, [rsp + 0x148]
lea rcx, str.vol
mov r8d, 4
call fcn.140065d7c
cmp al, dil
je 0x140026cca
mov byte [rsp + 0x158], 3
jmp 0x140026d91
lea rdx, [rsp + 0x148]
lea rcx, str.part
mov r8d, 4
call fcn.140065d7c
cmp al, dil
je 0x140026cf6
mov byte [rsp + 0x158], 2
jmp 0x140026d91
lea rdx, [rsp + 0x148]
lea rcx, [0x140120820]
mov r8d, 3
call fcn.140065d7c
cmp al, dil
je 0x140026d1c
mov byte [rsp + 0x4b], 1
jmp 0x140026d91
lea rdx, [rsp + 0x148]
lea rcx, str.abak
mov r8d, 4
call fcn.140065d7c
cmp al, dil
je 0x1400268bd
mov byte [rsp + 0x48], 1
jmp 0x140026d91
mov rcx, qword [rsp + 0x148]
movzx eax, word [rcx]
cmp ax, di
je 0x140026d84
mov edx, 0x20
lea r8d, [rdx - 0x17]
cmp r8w, ax
ja 0x140026d6b
cmp ax, 0xd
jbe 0x140026d84
cmp dx, ax
je 0x140026d84
add rcx, 2
mov qword [rsp + 0x148], rcx
mov ax, word [rcx]
cmp ax, di
jne 0x140026d5f
lea rcx, [rsp + 0x148]
call fcn.1400170fc
mov rax, qword [rsp + 0x148]
cmp word [rax], si
je 0x140026798
mov byte [rsp + 0x41], bl
mov rbx, qword [rsp + 0x98]
mov dword [rsp + 0x78], r15d
lea r15, [r13 + 8]
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [rsp + 0x4e]
mov qword [rsp + 0x148], rbx
cmp al, dil
je 0x140026de5
cmp byte [rsp + 0x40], dil
je 0x140026de5
mov edx, 1
mov ecx, edx
jmp 0x140026dec
mov ecx, edi
mov edx, 1
mov sil, byte [rsp + 0x140]
cmp word [rbx], di
jne 0x140026e04
cmp dword [rsp + 0x60], edi
jne 0x140026e04
cmp sil, dil
jne 0x140026e83
cmp qword [r13 + 0x20], rdi
jle 0x140026e83
cmp byte [rsp + 0x41], dil
jg 0x140026e83
cmp word [rbx], di
jne 0x140026e31
mov al, byte [r14 + 0x10]
and al, dl
cmp byte [rsp + 0x54], al
jne 0x140026e31
cmp dword [rsp + 0x78], ebp
jne 0x140026e31
cmp ecx, edi
jne 0x140026e90
jmp 0x140027065
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xb8]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea edi, [r9 + 5]
mov r8, rdi
mov rcx, r14
call fcn.140025f80
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, rbx
mov cl, 1
call fcn.140018614
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140027065
cmp al, dil
je 0x140026e90
cmp ecx, edi
je 0x140027612
cmp byte [r14 + 0xd8], dil
je 0x140026ea0
cmp word [rbx], di
mov bl, dl
jne 0x140026ea3
mov bl, dil
mov rbp, qword [rsp + 0x68]
cmp byte [rsp + 0x70], dil
je 0x140026edc
test byte [r14 + 0x10], dl
je 0x140026edc
cmp byte [rsp + 0x4f], dil
je 0x140026edc
mov rdx, qword [rsp + 0xb8]
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
call fcn.140025f80
cmp bl, dil
je 0x140027001
lea rcx, [rsp + 0xb0]
mov byte [r14 + 0xd8], dil
call fcn.1400632a0
lea rdx, str._CurFile_
lea rcx, [rsp + 0xd0]
call fcn.14006ff14
mov rdx, qword [rsp + 0xd0]
mov eax, 1
lea r8, [rsp + 0xb0]
xor r9d, r9d
mov rcx, r14
mov byte [rsp + 0x20], al
call fcn.140079e84
lea rcx, [rsp + 0xd0]
call fcn.14005aef8
lea rdx, str.ENTER:
lea rcx, [rsp + 0xc0]
call fcn.14006ff14
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0xc0]
call fcn.1400633dc
movsxd rbx, dword [r15 + 8]
mov eax, 1
test byte [r14 + 0x10], al
je 0x140026fa3
mov rax, qword [rsp + 0x150]
mov rdx, qword [rsp + 0xc0]
mov r9d, 0x11
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.140025f80
jmp 0x140026fb5
cmp qword [r15], rdi
jne 0x140026fb5
mov edx, 0x10000
mov rcx, r15
call fcn.1400633a0
mov rax, qword [r15]
lea rcx, [rsp + 0x88]
lea rdx, [rax + rbx*2]
call fcn.14006ffb0
mov rax, qword [r15]
cmp byte [rsp + 0x42], dil
mov qword [r15 + 8], rbx
mov word [rax + rbx*2], di
mov eax, dword [rsp + 0x70]
movzx eax, al
lea rcx, [rsp + 0xc0]
cmovne eax, edi
mov dword [rsp + 0x70], eax
call fcn.14005aef8
lea rcx, [rsp + 0xb0]
call fcn.14005aef8
mov ebx, 1
mov rdx, rbp
mov cl, bl
call fcn.140018614
cmp sil, dil
je 0x140027023
mov eax, edi
cmp dword [rsp + 0x60], edi
jne 0x140027619
jmp 0x140027062
cmp byte [rsp + 0x40], dil
je 0x1400270a3
mov rax, qword [rsp + 0x148]
cmp word [rax], di
jne 0x1400270a3
mov qword [rsp + 0xe8], rdi
cmp qword [r13], rdi
je 0x140027060
mov rcx, qword [r13]
lea r8, [rsp + 0xe8]
mov r9d, 2
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, edi
movsxd rdi, eax
lea rcx, [rsp + 0xc8]
call fcn.14005aef8
lea rcx, [rsp + 0x88]
call fcn.14005aef8
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rdi
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov al, byte [r13 + 0x28]
or al, byte [rsp + 0x4b]
je 0x14002715c
lea r8, [0x14011c618]
lea rdx, [0x14011dc90]
mov r9d, ebx
mov rcx, r14
mov qword [rsp + 0x20], rdi
call fcn.14001e620
cmp rax, rdi
je 0x14002715c
cmp qword [rax], rdi
je 0x14002715c
lea rcx, [rax + 0x10]
mov edx, 0x38
call fcn.1400187c8
mov r11, rax
cmp rax, rdi
je 0x14002715c
mov rcx, rax
call fcn.140018900
mov qword [rcx + 0x28], r13
lea rbx, [rcx + 0x18]
mov qword [rbx], rdi
mov cl, byte [r13 + 0x29]
mov qword [rbx], rdi
mov byte [r11 + 0x21], cl
mov cl, byte [r13 + 0x28]
lea r8, [0x14013d130]
mov byte [r11 + 0x20], cl
mov rdx, qword [r13 + 0x20]
or r9d, 0xffffffff
mov qword [r11 + 8], rdx
mov rax, qword [r13]
lea rdx, str.__LOGS
mov qword [r11 + 0x10], rax
mov rcx, r14
mov qword [r13], rdi
call fcn.14001e70c
cmp rax, rdi
je 0x140027157
mov rdx, qword [rax]
mov rcx, rbx
call fcn.140070048
mov ebx, 1
cmp qword [r13], rdi
je 0x140027173
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec qword [0x14013ccb8]
mov eax, 3
mov qword [r13], rdi
mov qword [r15 + 8], rdi
mov qword [r13 + 0x20], 0xfffffffffff80000
mov byte [r13 + 0x28], dil
cmp byte [rsp + 0x5c], al
jne 0x1400271ce
mov rax, qword [rsp + 0x148]
cmp word [rax], di
jne 0x1400271df
cmp qword [0x14013cb18], rdi
je 0x1400271ce
or rdx, 0xffffffffffffffff
mov cl, bl
call fcn.140018614
mov rcx, qword [0x14013cb18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14013cb18], rdi
dec qword [0x14013ccb8]
mov rax, qword [rsp + 0x148]
cmp word [rax], di
je 0x1400275e7
and byte [r13 + 0x29], 0xfe
cmp byte [rsp + 0x58], dil
setne al
or byte [r13 + 0x29], al
cmp byte [rsp + 0x158], dil
je 0x14002738f
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0xc8]
lea ebp, [rax + 0x108]
lea eax, [rbp + rbp]
movsxd rdx, eax
call fcn.1400633a0
mov rbx, qword [rsp + 0xc8]
movsxd r11, ebp
lea rsi, [rbx + r11*2]
xor r9d, r9d
mov edx, 0x105
mov word [rsi], di
mov word [rbx], di
mov rcx, qword [rsp + 0x148]
mov r8, rsi
call fcn.14006426c
movzx r11d, word [rsi]
cmp r11w, di
je 0x14002738a
mov eax, 0x3a
cmp ax, word [rsi + 2]
jne 0x14002738a
mov word [rsp + 0x7a], ax
mov eax, 0x5c
mov word [rsp + 0x78], r11w
mov word [rsp + 0x7c], ax
mov eax, 1
mov word [rsp + 0x7e], di
mov qword [rsp + 0x148], rsi
test byte [rsp + 0x158], al
je 0x1400272be
lea rcx, [rsp + 0x78]
mov r8d, ebp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, edi
je 0x1400272be
cmp word [rbx], di
jne 0x14002735a
test byte [rsp + 0x158], 2
je 0x14002738a
lea rcx, [rsp + 0x140]
mov edx, 0x1e0
call fcn.140063314
mov rax, qword [rsp + 0x140]
movzx r11d, word [rsi]
mov word [rax], r11w
mov rax, qword [rsp + 0x140]
or rdx, 0xffffffffffffffff
mov byte [rsp + 0x30], dil
lea rcx, [rsp + 0x140]
mov r9d, 0xac
mov r8, rdx
mov qword [rsp + 0x28], rdi
mov word [rax + 2], di
mov qword [rsp + 0x20], rdi
call fcn.14008bedc
mov r11, qword [rsp + 0x140]
cmp qword [r11], rdi
jl 0x14002737d
cmp qword [r11 + 8], rdi
jle 0x14002737d
mov r9d, dword [r11 + 8]
mov r8d, dword [r11]
lea rdx, str._Harddisk_uPartition_u_
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x140]
call fcn.14005aef8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsi + 6]
cdqe
lea rcx, [rbx + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x148], rbx
jmp 0x14002738a
lea rcx, [rsp + 0x140]
call fcn.14005aef8
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
lea ecx, [rbx + 0x9e]
movsxd rdx, ecx
cmp qword [r15 + 0x10], rdx
jge 0x1400273c4
lea ecx, [rbx + 0x10008]
movsxd rdx, ecx
mov rcx, r15
mov qword [r15 + 0x10], rdx
call fcn.1400633a0
mov rax, qword [r15]
lea rcx, str.CONOUT_
mov word [rax], di
mov rdx, qword [rsp + 0x148]
call fcn.14005c518
mov sil, al
cmp al, dil
je 0x1400273f0
mov ecx, 0x102
call fcn.14006061c
mov cl, byte [rsp + 0x40]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
neg cl
mov r9d, 7
mov r8d, 0x40000000
sbb edx, edx
mov rcx, r13
mov qword [rsp + 0xe0], rdi
and edx, 2
add edx, 2
mov dword [rsp + 0x28], edx
mov rdx, qword [rsp + 0x148]
mov qword [rsp + 0x20], rdi
call fcn.140003888
mov ecx, edi
cmp rax, rdi
mov al, byte [rsp + 0x48]
mov byte [r13 + 0x28], al
mov eax, 1
setne cl
cmp ecx, eax
jne 0x140027453
mov dword [rsp + 0x50], edi
jmp 0x14002746a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
cmp eax, edi
cmove eax, ecx
mov dword [rsp + 0x50], eax
mov rax, rcx
cmp qword [r13], rdi
je 0x1400274a9
add qword [0x14013ccb8], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0xd8], rax
cmp byte [rsp + 0x40], dil
je 0x1400274a9
mov rcx, qword [r13]
lea r8, [rsp + 0xe0]
mov r9d, 2
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp sil, dil
mov esi, 1
jne 0x1400274d3
cmp qword [rsp + 0xe0], rdi
jg 0x1400274d3
mov rax, qword [r15]
mov ecx, 0xfeff
mov word [rax], cx
mov rax, qword [r15]
mov word [rax + 2], di
mov qword [r15 + 8], rsi
mov rcx, qword [r15 + 8]
mov rdx, qword [rsp + 0x88]
lea eax, [rbx + 1]
movsxd r8, eax
mov rax, qword [r15]
lea rcx, [rax + rcx*2]
add r8, r8
call fcn.14001d7d8
add qword [r15 + 8], rbx
cmp byte [rsp + 0x70], dil
je 0x14002752d
test byte [r14 + 0x10], sil
je 0x14002752d
mov rax, qword [rsp + 0x150]
mov rdx, qword [rsp + 0xb8]
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.140025f80
cmp qword [r13], rdi
je 0x14002759c
test byte [0x14013d6f6], 2
je 0x14002759c
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [rsp + 0x140], eax
movzx ecx, word [rsp + 0x140]
cmp cx, 0x55
jl 0x14002755f
add cx, 0xfffb
movzx eax, word [rsp + 0x142]
cmp ax, 0x1e
jl 0x140027571
add ax, 0xfffb
sub cx, si
sub ax, si
lea r8, [rsp + 0x60]
mov word [rsp + 0x64], cx
mov rcx, qword [r13]
mov edx, esi
mov word [rsp + 0x60], di
mov word [rsp + 0x62], di
mov word [rsp + 0x66], ax
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
mov rbx, qword [rsp + 0xd8]
cmp word [rbx], di
je 0x1400275ee
cmp byte [rsp + 0x158], dil
jne 0x1400275ee
lea rcx, [rsp + 0x88]
mov edx, 0x10e
call fcn.1400633a0
mov r8, qword [rsp + 0x88]
xor r9d, r9d
mov edx, 0x105
mov rcx, rbx
call fcn.14006426c
mov rbx, qword [rsp + 0x88]
jmp 0x1400275ee
lea rbx, [0x14011c618]
lea rdx, str.__LOGS
lea rcx, [0x14013d130]
mov r8, rbx
call fcn.140062600
mov eax, dword [rsp + 0x50]
cmp eax, edi
jne 0x140027062
jmp 0x140027614
mov eax, edi
mov ebx, 1
mov cl, byte [rsp + 0x46]
cmp cl, dil
jl 0x14002762d
and byte [r14 + 0x10], 0xfe
and cl, bl
or byte [r14 + 0x10], cl
mov cl, byte [rsp + 0x4d]
cmp cl, dil
jl 0x14002763a
mov byte [r13 + 0x29], cl
mov cl, byte [rsp + 0x43]
and byte [r14 + 0x10], 0x81
and r12b, bl
and cl, bl
add r12b, r12b
or r12b, cl
mov cl, byte [rsp + 0x45]
and cl, bl
add r12b, r12b
or r12b, cl
mov cl, byte [rsp + 0x49]
and cl, bl
add r12b, r12b
or r12b, cl
mov cl, byte [rsp + 0x4a]
and cl, bl
add r12b, r12b
or r12b, cl
mov cl, byte [rsp + 0x47]
and cl, bl
add r12b, r12b
or r12b, cl
mov rcx, qword [rsp + 0x90]
add r12b, r12b
or byte [r14 + 0x10], r12b
cmp rcx, rdi
jle 0x14002769b
mov qword [r13 + 0x20], rcx
jmp 0x140027062
cmp byte [rsp + 0x4c], dil
je 0x140027062
mov qword [r13 + 0x20], 0xfffffffffff80000
jmp 0x140027062