Function at 0x140064690
Capabilities:
Allocate thread local storage
Get disk information
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0xe8
mov byte [rsp + 0x22], 0xb
mov dword [rsp + 0x54], 0x2a1
mov dword [rsp + 0x3c], 0x3b8
mov dword [rsp + 0x28], 0x19a
mov byte [rsp + 0x24], 0x56
mov dword [rsp + 0x38], 0x38c
mov dword [rsp + 0x58], 0x1c7
mov byte [rsp + 0x23], 0xe1
mov dword [rsp + 0x34], 0x1f7
mov byte [rsp + 0x21], 0x81
mov dword [rsp + 0x30], 0x4a
mov dword [rsp + 0x2c], 0x6c
mov byte [rsp + 0x20], 0xcc
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x40], 0xd0
mov dword [rsp + 0x40], 0x23d
jmp 0x14006471f
mov eax, dword [rsp + 0x40]
dec eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0xe
jle 0x140064744
mov eax, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov ecx, dword [0x140074c80]
or ecx, eax
mov eax, ecx
mov dword [0x140074a68], eax
jmp 0x140064715
cmp dword [rsp + 0x2c], 0
jne 0x140064766
mov eax, dword [rsp + 0x30]
movzx ecx, al
mov eax, dword [rsp + 0x38]
shl eax, cl
test eax, eax
jne 0x140064766
mov dword [rsp + 0x5c], 0
jmp 0x14006476e
mov dword [rsp + 0x5c], 1
movsx eax, byte [0x140074c90]
xor eax, dword [rsp + 0x5c]
mov ecx, dword [0x140074c4c]
sub ecx, eax
mov eax, ecx
mov dword [0x140074c4c], eax
mov dword [rsp + 0x50], 0x71
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0x50]
dec eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0xb8], 0
je 0x1400647dc
movzx eax, byte [0x140074c89]
mov dword [rsp + 0xbc], eax
xor edx, edx
mov eax, dword [rsp + 0x3c]
mov ecx, 3
div ecx
mov ecx, dword [rsp + 0xbc]
add ecx, eax
mov eax, ecx
mov byte [rsp + 0x20], al
jmp 0x140064791
movsx eax, byte [rsp + 0x23]
mov ecx, dword [0x140074a68]
add ecx, eax
mov eax, ecx
movsx ecx, byte [rsp + 0x22]
movsx edx, byte [rsp + 0x22]
sub ecx, edx
or eax, ecx
test eax, eax
je 0x140064810
cmp dword [0x140074c84], 0
je 0x140064810
mov dword [rsp + 0x60], 1
jmp 0x140064818
mov dword [rsp + 0x60], 0
mov eax, dword [rsp + 0x60]
mov dword [0x140074a64], eax
movzx eax, byte [0x140074c88]
or eax, dword [rsp + 0x38]
movsx ecx, byte [0x140074c6e]
and ecx, eax
mov eax, ecx
mov byte [0x140074c6e], al
movzx eax, byte [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
sub ecx, eax
mov eax, ecx
mov ecx, dword [0x140074c60]
or ecx, eax
mov eax, ecx
movsx ecx, byte [0x140074c90]
or ecx, eax
mov eax, ecx
mov byte [0x140074c90], al
movsx eax, byte [rsp + 0x23]
movzx ecx, al
mov eax, dword [0x140074c28]
shr eax, cl
mov dword [0x140074c74], eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
movzx eax, byte [0x140074b8f]
test eax, eax
jne 0x14006489e
cmp dword [rsp + 0x30], 0
jne 0x14006489e
mov dword [rsp + 0x64], 0
jmp 0x1400648a6
mov dword [rsp + 0x64], 1
mov eax, dword [rsp + 0x64]
mov ecx, dword [0x140074c48]
add ecx, eax
mov eax, ecx
mov dword [0x140074c48], eax
movzx eax, byte [rsp + 0x21]
movsx ecx, byte [rsp + 0x23]
cmp eax, ecx
jne 0x1400648d2
mov dword [rsp + 0x68], 1
jmp 0x1400648da
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x3c]
or ecx, eax
mov eax, ecx
movzx ecx, al
mov eax, dword [0x140074c3c]
shl eax, cl
mov byte [0x140074b8f], al
movsx eax, byte [0x140074a62]
add eax, dword [rsp + 0x30]
movzx ecx, byte [0x140074c5c]
and ecx, eax
mov eax, ecx
mov byte [0x140074c5c], al
movzx eax, byte [0x140074c89]
movzx ecx, byte [rsp + 0x20]
shl eax, cl
mov ecx, dword [rsp + 0x38]
shl eax, cl
mov ecx, dword [0x140074c30]
and ecx, eax
mov eax, ecx
mov dword [0x140074c30], eax
mov eax, dword [rsp + 0x30]
movzx ecx, al
mov eax, dword [rsp + 0x58]
shr eax, cl
movzx ecx, byte [rsp + 0x21]
cmp eax, ecx
jne 0x140064957
mov dword [rsp + 0x6c], 1
jmp 0x14006495f
mov dword [rsp + 0x6c], 0
mov eax, dword [rsp + 0x6c]
mov ecx, dword [0x140074c38]
xor ecx, eax
mov eax, ecx
test eax, eax
je 0x140064984
cmp dword [0x140074c4c], 0
je 0x140064984
mov dword [rsp + 0x70], 1
jmp 0x14006498c
mov dword [rsp + 0x70], 0
movsx eax, byte [0x140074a62]
sub eax, dword [rsp + 0x70]
mov byte [0x140074a62], al
movzx eax, byte [0x140074c6d]
mov dword [rsp + 0xc0], eax
movzx ecx, byte [rsp + 0x20]
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [rsp + 0xc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
cmp dword [0x140074c3c], 0
je 0x1400649ec
movzx eax, byte [rsp + 0x24]
test eax, eax
je 0x1400649ec
mov dword [rsp + 0x74], 1
jmp 0x1400649f4
mov dword [rsp + 0x74], 0
movsx eax, byte [0x140074a62]
or eax, dword [rsp + 0x74]
mov byte [0x140074a62], al
movzx eax, byte [0x140074c89]
movzx ecx, byte [rsp + 0x24]
mov dword [rsp + 0xc4], ecx
movzx edx, byte [rsp + 0x20]
movzx ecx, dl
mov edx, dword [rsp + 0xc4]
sar edx, cl
mov ecx, edx
mov dword [rsp + 0xc8], ecx
movzx edx, byte [0x140074c5f]
mov r8d, dword [rsp + 0x30]
sub r8d, edx
mov edx, r8d
movzx ecx, dl
mov edx, dword [rsp + 0xc8]
shl edx, cl
mov ecx, edx
and eax, ecx
movzx ecx, byte [0x140074c5f]
xor ecx, eax
mov eax, ecx
mov byte [0x140074c5f], al
movzx eax, byte [0x140074c5c]
test eax, eax
je 0x140064a8c
movzx eax, byte [rsp + 0x21]
movzx ecx, al
mov eax, dword [rsp + 0x34]
shr eax, cl
test eax, eax
je 0x140064a8c
mov dword [rsp + 0x78], 1
jmp 0x140064a94
mov dword [rsp + 0x78], 0
mov eax, dword [rsp + 0x78]
mov ecx, dword [0x140074c70]
sub ecx, eax
mov eax, ecx
mov dword [0x140074c70], eax
movzx eax, byte [0x140074c6d]
movsx ecx, byte [rsp + 0x22]
and eax, ecx
xor eax, dword [rsp + 0x38]
test eax, eax
je 0x140064ada
cmp dword [rsp + 0x38], 0
je 0x140064ada
movzx eax, byte [0x140074c88]
test eax, eax
je 0x140064ada
mov dword [rsp + 0x7c], 1
jmp 0x140064ae2
mov dword [rsp + 0x7c], 0
movzx eax, byte [0x140074c89]
sub eax, dword [rsp + 0x7c]
mov byte [0x140074c89], al
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x28]
shr eax, cl
mov ecx, dword [0x140074c3c]
sub ecx, eax
mov eax, ecx
mov byte [0x140074c5d], al
cmp dword [rsp + 0x54], 0
je 0x140064b39
movzx eax, byte [rsp + 0x20]
movsx ecx, byte [rsp + 0x23]
sar eax, cl
test eax, eax
je 0x140064b39
mov dword [rsp + 0x80], 1
jmp 0x140064b44
mov dword [rsp + 0x80], 0
movsx eax, byte [0x140074c5d]
mov ecx, dword [rsp + 0x80]
sar eax, cl
movsx ecx, byte [0x140074a63]
sub ecx, eax
mov eax, ecx
mov byte [0x140074a63], al
movsx eax, byte [0x140074c5d]
movzx ecx, byte [rsp + 0x24]
sar eax, cl
mov dword [0x140074c34], eax
movzx eax, byte [0x140074c88]
movzx ecx, byte [rsp + 0x20]
imul eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [0x140074a64]
sub ecx, eax
mov eax, ecx
mov dword [0x140074c80], eax
movsx eax, byte [0x140074c5e]
movsx ecx, byte [rsp + 0x22]
and ecx, dword [rsp + 0x2c]
mov edx, dword [rsp + 0x2c]
or edx, ecx
mov ecx, edx
add eax, ecx
movzx ecx, byte [0x140074c89]
add ecx, eax
mov eax, ecx
mov byte [0x140074c89], al
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x28], eax
jbe 0x140064c38
movzx eax, byte [0x140074c5f]
movsx ecx, byte [rsp + 0x22]
sub eax, ecx
mov ecx, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x28]
add edx, ecx
mov ecx, edx
or eax, ecx
test eax, eax
jne 0x140064c16
movsx eax, byte [0x140074c90]
test eax, eax
jne 0x140064c16
mov dword [rsp + 0x84], 0
jmp 0x140064c21
mov dword [rsp + 0x84], 1
mov eax, dword [rsp + 0x84]
mov ecx, dword [0x140074c34]
and ecx, eax
mov eax, ecx
mov dword [0x140074c34], eax
cmp dword [0x140074c4c], 0
jne 0x140064c64
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x28]
add ecx, eax
mov eax, ecx
sub eax, dword [rsp + 0x28]
mov ecx, dword [0x140074c8c]
shl eax, cl
test eax, eax
jne 0x140064c64
mov byte [rsp + 0x25], 0
jmp 0x140064c69
mov byte [rsp + 0x25], 1
movzx eax, byte [rsp + 0x25]
mov byte [0x140074c8b], al
movzx eax, byte [rsp + 0x21]
movzx ecx, al
mov eax, dword [rsp + 0x2c]
sar eax, cl
test eax, eax
je 0x140064c9a
cmp dword [rsp + 0x2c], 0
je 0x140064c9a
mov dword [rsp + 0x88], 1
jmp 0x140064ca5
mov dword [rsp + 0x88], 0
movzx eax, byte [0x140074b8f]
or eax, dword [rsp + 0x88]
movsx ecx, byte [0x140074c6c]
xor ecx, eax
mov eax, ecx
mov byte [0x140074c6c], al
movzx eax, byte [0x140074c8a]
movzx ecx, byte [rsp + 0x21]
sub eax, ecx
mov dword [0x140074a64], eax
movzx eax, byte [0x140074c5f]
test eax, eax
jne 0x140064cf9
movzx eax, byte [rsp + 0x21]
test eax, eax
jne 0x140064cf9
mov dword [rsp + 0x8c], 0
jmp 0x140064d04
mov dword [rsp + 0x8c], 1
movsx eax, byte [0x140074c6e]
and eax, dword [rsp + 0x8c]
mov byte [0x140074c6e], al
mov dword [rsp + 0x44], 0x28
mov dword [rsp + 0x44], 0x21e
jmp 0x140064d34
mov eax, dword [rsp + 0x44]
dec eax
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0xd
jle 0x140064d5b
movzx eax, byte [rsp + 0x20]
movzx ecx, al
mov eax, dword [rsp + 0x3c]
shr eax, cl
mov ecx, dword [0x140074c70]
and ecx, eax
mov eax, ecx
mov dword [0x140074a68], eax
jmp 0x140064d2a
movzx eax, byte [0x140074b8f]
movzx ecx, byte [rsp + 0x24]
mov dword [rsp + 0xcc], ecx
movsx edx, byte [rsp + 0x22]
movzx ecx, dl
mov edx, dword [rsp + 0xcc]
shl edx, cl
mov ecx, edx
mov dword [rsp + 0xd0], ecx
mov edx, dword [rsp + 0x34]
movzx ecx, dl
mov edx, dword [rsp + 0xd0]
sar edx, cl
mov ecx, edx
or eax, ecx
movsx ecx, byte [0x140074c6f]
xor ecx, eax
mov eax, ecx
mov byte [0x140074c6f], al
movzx eax, byte [rsp + 0x21]
movsx ecx, byte [rsp + 0x23]
movzx edx, byte [rsp + 0x20]
sub ecx, edx
shl eax, cl
mov ecx, dword [0x140074c68]
add ecx, eax
mov eax, ecx
movzx ecx, byte [0x140074c88]
add ecx, eax
mov eax, ecx
mov byte [0x140074c88], al
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp dword [0x140074c30], 0
jne 0x140064dfe
cmp dword [rsp + 0x34], 0
jne 0x140064dfe
mov dword [rsp + 0x90], 0
jmp 0x140064e09
mov dword [rsp + 0x90], 1
movsx eax, byte [0x140074c5e]
sub eax, dword [rsp + 0x90]
mov byte [0x140074c5e], al
mov eax, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x3c]
sub ecx, eax
mov eax, ecx
cmp dword [0x140074c3c], eax
jne 0x140064e3e
mov dword [rsp + 0x94], 1
jmp 0x140064e49
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
mov ecx, dword [0x140074c30]
sub ecx, eax
mov eax, ecx
mov dword [0x140074c30], eax
mov eax, dword [rsp + 0x28]
movzx ecx, al
mov eax, dword [0x140074c70]
shl eax, cl
mov ecx, dword [0x140074c50]
sub ecx, eax
mov eax, ecx
mov dword [0x140074c50], eax
mov eax, dword [rsp + 0x2c]
cmp dword [0x140074c28], eax
jne 0x140064e98
mov dword [rsp + 0x98], 1
jmp 0x140064ea3
mov dword [rsp + 0x98], 0
mov eax, dword [rsp + 0x98]
mov dword [0x140074c70], eax
movsx eax, byte [0x140074a62]
sub eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x34]
add edx, ecx
mov ecx, edx
movzx edx, byte [0x140074c89]
add ecx, edx
or eax, ecx
mov ecx, dword [0x140074c4c]
sub ecx, eax
mov eax, ecx
mov dword [0x140074c4c], eax
imul eax, dword [0x140074c84], 3
mov ecx, dword [rsp + 0x28]
add ecx, eax
mov eax, ecx
xor edx, edx
mov ecx, 2
div ecx
mov eax, edx
mov word [rsp + 0x4c], ax
movsx eax, word [rsp + 0x4c]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x140064f37
cmp dword [rsp + 0x48], 1
je 0x140064fab
cmp dword [rsp + 0x48], 2
je 0x140064ff1
cmp dword [rsp + 0x48], 3
je 0x14006508b
jmp 0x1400650c6
movzx eax, byte [rsp + 0x21]
mov ecx, dword [rsp + 0x34]
shl eax, cl
cmp dword [0x140074c3c], eax
jne 0x140064f57
mov dword [rsp + 0x9c], 1
jmp 0x140064f62
mov dword [rsp + 0x9c], 0
movsx eax, byte [0x140074c6c]
xor eax, dword [rsp + 0x9c]
mov byte [0x140074c6c], al
movsx eax, byte [rsp + 0x23]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
movsx ecx, byte [rsp + 0x23]
xor eax, ecx
movzx ecx, al
mov eax, dword [0x140074c74]
shr eax, cl
movzx ecx, byte [0x140074c8b]
xor ecx, eax
mov eax, ecx
mov byte [0x140074c8b], al
jmp 0x1400650fb
mov eax, dword [rsp + 0x2c]
cdq
mov ecx, 5
idiv ecx
mov eax, edx
mov ecx, dword [0x140074c50]
add ecx, eax
mov eax, ecx
mov byte [rsp + 0x23], al
movsx eax, byte [rsp + 0x22]
movzx ecx, al
mov eax, dword [0x140074c30]
shr eax, cl
or eax, dword [rsp + 0x34]
movsx ecx, byte [0x140074c6c]
and ecx, eax
mov eax, ecx
mov byte [0x140074c6c], al
jmp 0x1400650fb
cmp dword [rsp + 0x58], 0
je 0x140065001
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140065015
cmp dword [rsp + 0x30], 0
jne 0x140065015
mov dword [rsp + 0xa0], 0
jmp 0x140065020
mov dword [rsp + 0xa0], 1
mov eax, dword [rsp + 0xa0]
mov ecx, dword [0x140074c28]
xor ecx, eax
mov eax, ecx
mov byte [0x140074c6e], al
movsx eax, byte [0x140074a63]
add eax, dword [rsp + 0x30]
movsx ecx, byte [rsp + 0x22]
cmp eax, ecx
jne 0x14006506a
mov eax, dword [0x140074c84]
mov ecx, dword [rsp + 0x38]
and ecx, eax
mov eax, ecx
test eax, eax
je 0x14006506a
mov dword [rsp + 0xa4], 1
jmp 0x140065075
mov dword [rsp + 0xa4], 0
movzx eax, byte [0x140074c8b]
or eax, dword [rsp + 0xa4]
mov byte [0x140074c8b], al
jmp 0x1400650fb
movzx eax, byte [0x140074c8b]
movzx ecx, byte [rsp + 0x21]
and eax, ecx
movsx ecx, byte [rsp + 0x22]
xor eax, ecx
mov dword [0x140074c64], eax
movzx eax, byte [0x140074b8e]
movzx ecx, byte [rsp + 0x20]
imul eax, ecx
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
mov dword [rsp + 0x28], eax
jmp 0x1400650fb
movsx eax, byte [0x140074c6e]
movsx ecx, byte [rsp + 0x22]
shl eax, cl
movzx ecx, byte [rsp + 0x20]
shl eax, cl
movzx ecx, byte [rsp + 0x20]
sar eax, cl
movzx ecx, byte [0x140074c8b]
sar eax, cl
mov ecx, dword [0x140074c84]
or ecx, eax
mov eax, ecx
mov dword [0x140074c84], eax
movzx eax, byte [rsp + 0x21]
cmp dword [0x140074c8c], eax
jae 0x140065115
mov dword [rsp + 0xac], 1
jmp 0x140065120
mov dword [rsp + 0xac], 0
mov eax, dword [0x140074c70]
cmp dword [rsp + 0x30], eax
jbe 0x140065139
mov dword [rsp + 0xa8], 1
jmp 0x140065144
mov dword [rsp + 0xa8], 0
mov eax, dword [rsp + 0xa8]
cmp dword [rsp + 0xac], eax
je 0x140065161
mov dword [rsp + 0xb0], 1
jmp 0x14006516c
mov dword [rsp + 0xb0], 0
movzx eax, byte [rsp + 0x21]
cmp dword [rsp + 0xb0], eax
je 0x1400651da
movsx eax, byte [0x140074a63]
mov dword [rsp + 0xd4], eax
mov eax, dword [rsp + 0x28]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
mov ecx, dword [rsp + 0xd4]
add ecx, eax
mov eax, ecx
mov byte [rsp + 0x23], al
movzx eax, byte [0x140074b8f]
test eax, eax
je 0x1400651ca
movzx eax, byte [rsp + 0x24]
test eax, eax
je 0x1400651ca
movsx eax, byte [rsp + 0x22]
test eax, eax
je 0x1400651ca
mov byte [rsp + 0x26], 1
jmp 0x1400651cf
mov byte [rsp + 0x26], 0
movzx eax, byte [rsp + 0x26]
mov byte [0x140074c6c], al
mov eax, dword [rsp + 0x38]
movzx ecx, al
mov eax, dword [0x140074c60]
shr eax, cl
movzx ecx, byte [rsp + 0x20]
cmp eax, ecx
jne 0x1400651ff
mov dword [rsp + 0xb4], 1
jmp 0x14006520a
mov dword [rsp + 0xb4], 0
movzx eax, byte [rsp + 0x24]
mov ecx, dword [rsp + 0xb4]
xor ecx, eax
mov eax, ecx
or eax, dword [0x140074c80]
mov byte [0x140074c6d], al
movzx ecx, byte [0x140074c30]
call fcn.140062ef0
movzx eax, word [rsp + 0x34]
add rsp, 0xe8
ret