Function at 0x1401539e0
Capabilities:
Get disk information
Move file
Suspend thread

Disassembly:
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov word [rsp + 8], cx
sub rsp, 0x478
movabs rax, 0x2bf3059e3748a3bb
mov qword [rsp + 0x60], rax
movsx eax, word [rsp + 0x490]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
je 0x140153a1b
jmp 0x140153a90
movsx eax, word [rsp + 0x480]
sub eax, 0x7bab
movsx ecx, word [rsp + 0x490]
cmp eax, ecx
jge 0x140153a8b
mov dword [rsp + 0x38], 0x23f71e7
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0x23f71e7
je 0x140153a50
jmp 0x140153a7e
movabs rax, 0x29b74de59ff354f9
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x34], 0x72e40909
mov eax, 0x241
mov word [rsp + 0x30], ax
jmp 0x140153a8b
mov eax, dword [rsp + 0x34]
and eax, 0x23a676e3
mov dword [rsp + 0x34], eax
jmp 0x140153b19
movzx eax, word [rsp + 0x30]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0x1f9
je 0x140153aab
jmp 0x140153b0c
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov dword [rsp + 0xa0], eax
movabs rax, 0x5b91b9599cb1fb9f
mov qword [rsp + 0x488], rax
mov ecx, dword [rsp + 0x38]
call fcn.140153e90
movzx eax, word [rsp + 0x30]
shl eax, 1
mov word [rsp + 0x30], ax
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0xa4], eax
jmp 0x140153b19
mov eax, dword [rsp + 0x34]
xor eax, 0x1e86f5a4
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
movzx eax, word [rsp + 0x30]
cmp eax, 0x51
jne 0x140153b5f
mov rax, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x48]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0x35e2119b
je 0x140153b79
jmp 0x140153bc6
movzx edx, word [rsp + 0x30]
movzx ecx, word [rsp + 0x30]
call fcn.140154660
mov dword [rsp + 0x20], 0x44
lea r9, [rsp + 0x1b0]
mov r8d, 0xe7
lea rdx, str.misjudgment_Hired_Desist_discourses
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_FoldStringW]
mov dword [rsp + 0x50], eax
movzx eax, word [rsp + 0x30]
sar eax, 0xd
mov word [rsp + 0x30], ax
jmp 0x140153c8a
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x140153be3
jmp 0x140153c7d
movzx eax, word [rsp + 0x30]
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0x84e
je 0x140153bfe
jmp 0x140153c7b
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
add rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
mov dword [rsp + 0x28], 0x38
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
lea r9, str.prefixing_Sable_Consumption_Grumbled_bedsores
lea r8, [rsp + 0x40]
mov edx, 0x25
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
lea rdx, str.barterGraffitoFlourishescommuters
lea rcx, str.staunchnessordureequations
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [rsp + 0xa8], eax
jmp 0x140153c8a
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x488], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
and eax, 0x332f54fd
cmp eax, dword [rsp + 0x38]
jne 0x140153d1c
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rsp + 0x54], eax
movabs rax, 0x70383a625cd1acd4
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov r9d, dword [rsp + 0x50]
movzx r8d, word [rsp + 0x480]
mov dl, 0xcc
movzx ecx, word [rsp + 0x490]
call fcn.140154120
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x50], eax
mov r8d, 0x33
lea rdx, [rsp + 0xf0]
lea rcx, str.Coalfieldsintestine
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
mov dword [rsp + 0x94], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x34]
jne 0x140153e67
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x98], rax
movabs rax, 0x475f37c46e084f66
cmp qword [rsp + 0x98], rax
je 0x140153e41
movabs rax, 0x4a175cc984682c56
cmp qword [rsp + 0x98], rax
je 0x140153d88
jmp 0x140153e67
movzx eax, word [rsp + 0x30]
add eax, 0xc5
mov word [rsp + 0x30], ax
mov dl, 0x9f
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140154b70
nop
movsx eax, word [rsp + 0x490]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0x5196
je 0x140153dc5
jmp 0x140153e2c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0xb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x20], 5
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
mov dword [rsp + 0x94], eax
jmp 0x140153e3f
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x38]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
jmp 0x140153e67
mov rax, qword [rsp + 0x40]
mov r9, qword [rax]
movzx r8d, word [rsp + 0x30]
mov edx, dword [rsp + 0x54]
mov cl, 0x10
call fcn.140153480
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x488], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0xe0], rax
mov eax, 0x22
add rsp, 0x478
ret