Function at 0x140003110
Capabilities:
Delete file
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r15d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, eax
test eax, eax
jne 0x14000316a
lea rdx, str.Failed_to_get_logical_drive_strings_buffer_size._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400039e0
jmp 0x1400031a3
mov rcx, rbx
call fcn.14000557c
mov rsi, rax
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x140003267
lea rdx, str.Failed_to_get_logical_drive_strings._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400039e0
mov rcx, rsi
call fcn.140005530
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
xor r8d, r8d
lea rdx, [0x1400075a7]
lea rcx, [rbp - 0x39]
call fcn.140004200
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r14, qword [rbp - 0x29]
sub rax, r14
cmp rax, 8
jb 0x14000361c
lea r12, [rbp - 0x39]
mov r13, qword [rbp - 0x21]
cmp r13, 0xf
seta byte [rbp - 0x79]
mov rsi, qword [rbp - 0x39]
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x27], r15
lea r15, [r14 + 8]
mov ebx, 0xf
lea rdi, [rbp + 0xf]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp r15, rbx
jbe 0x140003310
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400032d5
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140005538
test rax, rax
je 0x140003579
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000330c
mov rbx, rsi
cmp byte [rsi], r15b
je 0x14000319b
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x1400032aa
mov rax, rdi
inc rax
cmp byte [rbx + rax], r15b
jne 0x140003291
inc rbx
add rbx, rax
cmp byte [rbx], r15b
jne 0x140003280
jmp 0x14000319b
mov rcx, rsi
call fcn.140005530
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
inc rdi
cmp byte [rbx + rdi], r15b
jne 0x1400032c1
mov r8, rdi
mov rdx, rbx
jmp 0x1400031bc
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400032fb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003610
jmp 0x140003245
test rcx, rcx
je 0x14000330a
call fcn.140005538
mov rdi, rax
jmp 0x14000330c
xor edi, edi
mov qword [rbp + 0xf], rdi
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x27], rbx
mov r8, r14
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [str._avm.efi]
mov qword [r14 + rdi], rax
mov byte [rdi + r15], 0
lea r12, [rbp - 0x39]
cmp byte [rbp - 0x79], 0
cmovne r12, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xor eax, eax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
lea r15, [r14 + 4]
mov ebx, 0xf
lea rdi, [rbp - 0x11]
cmp r15, rbx
jbe 0x1400033e9
mov rbx, r15
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x1400033af
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005538
test rax, rax
je 0x140003527
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400033e5
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400033d8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003616
jmp 0x140003390
test rcx, rcx
je 0x1400033e2
call fcn.140005538
mov rdi, rax
mov qword [rbp - 0x11], rdi
mov qword [rbp - 1], r15
mov qword [rbp + 7], rbx
mov r8, r14
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [str.efi]
mov dword [r14 + rdi], eax
mov byte [rdi + r15], 0
lea rcx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0xf
cmova rcx, qword [rbp + 0xf]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 0xf
cmova rax, qword [rbp - 0x11]
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 1]
mov qword [rbp - 0x41], rax
call fcn.140004d64
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x49], xmm0
lea r8, [rbp - 0x49]
mov edx, eax
lea rcx, [rbp - 0x71]
call fcn.140001850
nop
lea rcx, [rbp - 0x71]
cmp qword [rbp - 0x59], 7
cmova rcx, qword [rbp - 0x71]
call fcn.1400052d4
movzx ecx, al
mov qword [rbp - 0x19], rcx
shr rax, 0x20
mov dword [rbp - 0x49], eax
lea rcx, [0x14000a080]
mov qword [rbp - 0x41], rcx
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x49], xmm0
cmp eax, 0x91
jne 0x1400034a7
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x71]
call fcn.140002d40
cmp dword [rbp - 0x49], 0
jne 0x140003602
mov rdx, qword [rbp - 0x59]
cmp rdx, 7
jbe 0x1400034f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005530
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x140003533
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000352e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000352e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005530
mov qword [rbp - 1], 0
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x140003585
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003580
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003580
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005530
mov qword [rbp + 0x1f], 0
mov qword [rbp + 0x27], 0xf
mov byte [rbp + 0xf], 0
cmp r13, 0xf
jbe 0x1400035d3
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400035cb
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140005530
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140005510
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rbp - 0x71]
lea rdx, [rbp - 0x49]
call fcn.1400026e0
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.1400011a0
int3