Function at 0x180008ad0
Capabilities:
Create pipe
Get disk information

Disassembly:
sub rsp, 0x98
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x88], rax
cmp dword [0x18007bda4], 0x5ab6c123
jne 0x180008d17
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.tlFPbgXAiUcRVCUdMXOYxQjfmOWX
xor r8d, r8d
lea rdx, str.xRFiqGVfzmKBfGOa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindStringOrdinal]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupSeek]
lea rax, str.aCSOwQzXcctquEaWEDjxrhoIRqD
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingFromApp]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x7c], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x7c]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityUpdateMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateHardLinkTransactedW]
xor r8d, r8d
xor edx, edx
lea rcx, str.CCACMKaagbOuFcXBJDXDSQm
call qword [sym.imp.KERNEL32.dll_ResolveLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpool]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityUpdateMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolIoCallbacks]
mov eax, dword [0x18007bda0]
mov r8d, eax
mov edx, 8
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x18007bdb8], rax
mov dword [rsp + 0x44], 0xb96
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x48], 0xb86
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x50], 0x162b
mov dword [rsp + 0x40], 0x1627
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x68], 0x2164
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x48]
add eax, 0x2562
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x48]
add eax, 0x5c7
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x40]
add eax, 0x2398
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x64], 0
mov eax, dword [rsp + 0x40]
add eax, 0x8b5
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
add eax, 0x19d4
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x54]
add eax, 0x148f
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x48]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x180008e47
mov eax, dword [rsp + 0x48]
add eax, 0xa80
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], 0x9ab
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 0
mov eax, dword [rsp + 0x40]
sub eax, 0x147
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x70], 0xc18
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x58]
add eax, 0x1ad9
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x48]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
test eax, eax
je 0x180008edb
mov eax, dword [rsp + 0x48]
sub eax, 0x11e9
mov dword [rsp + 0x48], eax
jmp 0x180008ee8
mov eax, dword [rsp + 0x48]
add eax, 0x11e9
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x60]
sub eax, 0x1d61
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x40]
add eax, 0x22d
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x64]
add eax, 0x20f
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x699
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x50]
add eax, 0x1207
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
add eax, 0x466
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x61d
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x44]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x180008fc1
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
jmp 0x180008fa3
mov eax, dword [rsp + 0x50]
add eax, 0x94f
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
add eax, 0x1193
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
sub eax, 0x1504
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x68]
add eax, 0x1a73
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x4c]
add eax, 0x2194
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x68]
add eax, 0x60b
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x50]
add eax, 0x660
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x74], 0
jmp 0x1800090a0
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x24
jge 0x1800090b4
mov eax, dword [rsp + 0x44]
add eax, 9
mov dword [rsp + 0x44], eax
jmp 0x180009096
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x60]
add eax, 0xe41
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x18ba
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x68]
sub eax, 0x2f1
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x40]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x180009119
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
jmp 0x1800090fb
mov eax, dword [rsp + 0x64]
add eax, 0x16c8
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x4c]
add eax, 0x745
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x68]
add eax, 0x228
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x50]
sub eax, 0xe94
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x4c]
add eax, 0x50
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x6c]
sub eax, 0x1a0d
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x1733
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x4c]
add eax, 0x182b
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
sub eax, 0xcb1
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x48]
sub eax, 0x3f
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x50]
sub eax, 0xd2d
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x58]
add eax, 0x941
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x48]
add eax, 0x100b
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x78], 0
jmp 0x180009232
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0x13
jge 0x180009246
mov eax, dword [rsp + 0x70]
add eax, 2
mov dword [rsp + 0x70], eax
jmp 0x180009228
mov eax, dword [rsp + 0x58]
add eax, 0x1538
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x4c]
add eax, 0x1933
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x1990
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x58]
add eax, 0x20c3
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x114b
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x44]
sub eax, 0x204a
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x18000932c
cmp dword [rsp + 0x44], 0
jle 0x18000932c
mov eax, dword [rsp + 0x44]
sub eax, 0x434
mov dword [rsp + 0x44], eax
jmp 0x180009339
mov eax, dword [rsp + 0x44]
add eax, 0x434
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x54]
sub eax, 0x2580
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x44]
sub eax, 0x2278
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x64]
sub eax, 0x26c2
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x6c]
sub eax, 0x255b
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
add eax, 0x809
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
sub eax, 0x76
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x40]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x180009433
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
jmp 0x180009415
mov eax, dword [rsp + 0x44]
add eax, 0xa22
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x15b1
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
add rsp, 0x98
ret