Function at 0x14002b580
Capabilities:
Create thread
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1400e9180]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor esi, esi
call fcn.14002b360
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x108], xmm0
mov qword [rsp + 0x118], rax
lea rcx, [rsp + 0x108]
call fcn.14002b1e0
nop
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x98], xmm1
mov qword [rsp + 0xa8], rsi
mov byte [rsp + 0x40], sil
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 4]
lea r8, [rsp + 0xb0]
lea edx, [rsi + 0x12]
lea rcx, [rsi - 4]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14002ba9c
cmp dword [rsp + 0xb0], 2
sete dil
mov byte [rsp + 0x40], dil
jmp 0x14002b639
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xf0], xmm1
mov qword [rsp + 0x100], rsi
mov rbx, qword [rsp + 0x108]
mov r14, qword [rsp + 0x110]
cmp rbx, r14
je 0x14002b862
movabs r15, 0x7ffffffffffffffe
lea r12, [0x1400d8b58]
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rax, r15
sub rax, rcx
cmp rax, 1
jb 0x14002badb
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002b6a1
mov r9, qword [rbx]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0xd0]
call fcn.140029800
nop
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x14002b6f0
test dil, dil
jne 0x14002b80d
mov rcx, qword [rbx + 0x10]
mov rax, r15
sub rax, rcx
cmp rax, 4
jb 0x14002bad5
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002b711
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 4
lea r9, str.__
lea rcx, [rsp + 0xb0]
call fcn.140029800
nop
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.14002c030
nop
mov rdx, qword [rsp + 0xa0]
lea r8, [rsp + 0x50]
cmp rdx, qword [rsp + 0xa8]
je 0x14002b773
call fcn.14002d6b0
add qword [rsp + 0xa0], 0x10
jmp 0x14002b781
lea rcx, [rsp + 0x98]
call fcn.14002cda0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14002b7c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b7be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bac3
call fcn.14006459c
nop
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x14002b80d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b807
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bac9
call fcn.14006459c
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x14002b855
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14002b850
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bacf
call fcn.14006459c
add rbx, 0x20
cmp rbx, r14
jne 0x14002b680
test dil, dil
je 0x14002b97a
call fcn.14002a730
mov qword [rsp + 0x90], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xd0], xmm1
mov qword [rsp + 0xe0], rsi
lea rax, [rsp + 0x90]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0xc8], rax
mov ecx, 0x20
call fcn.140064560
movups xmm0, xmmword [rsp + 0xb0]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0xc0]
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14002d820]
xor edx, edx
xor ecx, ecx
call fcn.14009d9b4
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002baf6
cmp dword [rsp + 0x58], 0
je 0x14002bab8
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x58], eax
je 0x14002bae1
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xb0], xmm0
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140066b90
test eax, eax
jne 0x14002baeb
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0xd0]
call fcn.14002c1f0
nop
jmp 0x14002b97e
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
cmp rbx, rdi
je 0x14002b9d6
cmp dword [rbx + 8], 0
je 0x14002bb21
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbx + 8], eax
je 0x14002bb16
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x50], xmm0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140066b90
test eax, eax
jne 0x14002bb0b
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp rbx, rdi
jne 0x14002b993
lea rcx, [rsp + 0xf0]
call fcn.14002c1f0
nop
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14002ba61
mov rax, rcx
mov rdx, qword [rsp + 0xa0]
cmp rcx, rdx
je 0x14002ba14
cmp dword [rax + 8], 0
jne 0x14002bb2c
add rax, 0x10
cmp rax, rdx
jne 0x14002ba01
mov rdx, qword [rsp + 0xa8]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ba48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bb05
call fcn.14006459c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], rsi
lea rcx, [rsp + 0x108]
call fcn.14002c1f0
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140064540
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
lea rcx, [rsp + 0x70]
call fcn.14002a660
lea rdx, [0x1400e6e18]
lea rcx, [rsp + 0x70]
call fcn.14008bf74
nop
mov ecx, 1
call fcn.14006680c
nop
call fcn.1400987f4
nop
call fcn.1400987f4
nop
call fcn.1400987f4
nop
call fcn.1400217a0
nop
call fcn.1400217a0
nop
mov ecx, 5
call fcn.14006680c
mov ecx, 2
call fcn.14006680c
nop
mov dword [rsp + 0x58], esi
mov ecx, 6
call fcn.14006680c
nop
call fcn.1400987f4
nop
mov ecx, 2
call fcn.14006680c
int3
mov ecx, 5
call fcn.14006680c
int3
mov ecx, 1
call fcn.14006680c
nop
call fcn.14009da94
int3