Function at 0x140012120
Capabilities:
Get disk information
Move file
Terminate thread

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x298
mov eax, 0x789
mov word [rsp + 0x40], ax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x90], eax
mov ecx, dword [rsp + 0x90]
mov eax, dword [rsp + 0x2a8]
sub eax, ecx
cmp eax, dword [rsp + 0x2a0]
je 0x1400121db
mov edx, dword [rsp + 0x2a0]
mov ecx, dword [rsp + 0x90]
call fcn.140012900
mov edx, 0x5b
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [rsp + 0x238], eax
mov ecx, dword [rsp + 0x2a8]
mov eax, dword [rsp + 0x2a0]
and eax, ecx
mov dword [rsp + 0x90], eax
mov edx, dword [rsp + 0x90]
mov ecx, dword [rsp + 0x90]
call fcn.140012120
mov r8d, 0x2a
lea rdx, [rsp + 0xa0]
lea rcx, str.maidsDistractinglyBestsellerFoundering
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov dword [rsp + 0x5c], eax
jmp 0x140012874
mov ecx, dword [rsp + 0x2a8]
mov eax, dword [rsp + 0x90]
add eax, ecx
cmp eax, dword [rsp + 0x2a0]
jl 0x140012874
lea rax, [rsp + 0x90]
mov qword [rsp + 0x230], rax
mov ecx, dword [rsp + 0x90]
mov rax, qword [rsp + 0x230]
mov edx, dword [rax]
sar edx, cl
mov eax, dword [rsp + 0x2a0]
movzx ecx, al
mov eax, dword [rsp + 0x2a8]
shl eax, cl
cmp edx, eax
jle 0x140012304
mov rcx, qword [rsp + 0x230]
mov eax, dword [rsp + 0x90]
mov edx, dword [rcx]
xor edx, eax
mov ecx, dword [rsp + 0x2a0]
mov eax, dword [rsp + 0x2a8]
or eax, ecx
cmp edx, eax
je 0x140012277
mov eax, dword [rsp + 0x90]
mov ecx, dword [rsp + 0x2a8]
add ecx, eax
mov rax, qword [rsp + 0x230]
mov dword [rax], ecx
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x270], eax
cmp dword [rsp + 0x270], 0x2df3ecba
je 0x1400122a1
cmp dword [rsp + 0x270], 0x759fe51f
je 0x1400122e5
jmp 0x1400122ff
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x2a8], eax
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov dword [rsp + 0x228], eax
mov eax, dword [rsp + 0x2a0]
mov ecx, dword [rsp + 0x90]
sub ecx, eax
mov rax, qword [rsp + 0x230]
mov dword [rax], ecx
jmp 0x1400122ff
mov rax, qword [rsp + 0x230]
mov ecx, dword [rsp + 0x2a8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x90], eax
jmp 0x140012401
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x274], eax
cmp dword [rsp + 0x274], 0
je 0x14001231e
jmp 0x14001239c
mov rax, qword [rsp + 0x230]
mov eax, dword [rax]
mov dword [rsp + 0x278], eax
cmp dword [rsp + 0x278], 0x681f9738
je 0x14001233e
jmp 0x14001239a
mov rax, qword [rsp + 0x230]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x2a0]
call fcn.140012900
mov r11, qword [rsp + 0x230]
mov eax, dword [rsp + 0x90]
mov ecx, dword [r11]
sub ecx, eax
mov rax, qword [rsp + 0x230]
mov dword [rax], ecx
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x2a0], eax
mov edx, 8
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x228], eax
jmp 0x140012401
mov rax, qword [rsp + 0x230]
mov ecx, dword [rax]
add ecx, dword [rsp + 0x90]
mov rax, qword [rsp + 0x230]
mov dword [rax], ecx
mov edx, dword [rsp + 0x90]
mov rax, qword [rsp + 0x230]
mov ecx, dword [rax]
call fcn.140012120
mov r11d, dword [rsp + 0x2a8]
mov eax, dword [rsp + 0x2a0]
sub eax, r11d
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x230]
mov ecx, dword [rax]
add ecx, dword [rsp + 0x90]
mov rax, qword [rsp + 0x230]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x230]
mov eax, dword [rsp + 0x90]
mov edx, dword [rcx]
or edx, eax
mov ecx, dword [rsp + 0x2a8]
mov eax, dword [rsp + 0x2a0]
xor eax, ecx
cmp edx, eax
jg 0x1400124b7
cmp dword [rsp + 0x5c], 0x74fdccb1
je 0x140012479
movzx eax, word [rsp + 0x40]
cdq
mov ecx, 0x155
idiv ecx
mov word [rsp + 0x40], ax
mov byte [rsp + 0x78], 0xab
movzx eax, word [0x14015d2c8]
mov word [rsp + 0x21c], ax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x264], eax
lea rax, [rsp + 0x21c]
mov qword [rsp + 0x268], rax
jmp 0x1400124b7
mov eax, dword [rsp + 0x5c]
shl eax, 0x9f
cmp eax, 0x46a7d78f
jbe 0x1400124b7
mov edx, dword [rsp + 0x90]
mov rax, qword [rsp + 0x230]
mov ecx, dword [rax]
call fcn.140012900
lea rdx, [rsp + 0x21c]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x90]
movzx ecx, al
mov edx, dword [rsp + 0x2a8]
sar edx, cl
mov rax, qword [rsp + 0x230]
mov ecx, dword [rsp + 0x2a0]
mov eax, dword [rax]
and eax, ecx
cmp edx, eax
jge 0x140012510
mov rax, qword [rsp + 0x230]
mov eax, dword [rax]
mov dword [rsp + 0x2a0], eax
movsx ecx, word [rsp + 0x21c]
movsx eax, word [0x14015d2c8]
add ecx, eax
mov rax, qword [rsp + 0x268]
mov word [rax], cx
jmp 0x14001257d
mov eax, dword [rsp + 0x264]
mov dword [rsp + 0x27c], eax
cmp dword [rsp + 0x27c], 0
je 0x14001252a
jmp 0x140012568
lea rax, [rsp + 0x78]
mov qword [rsp + 0x210], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
movabs rax, 0xca3d67fbb0a705a3
mov qword [rsp + 0x248], rax
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x30], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
jmp 0x14001257d
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rsp + 0x238], eax
movzx eax, word [rsp + 0x21c]
mov word [rsp + 0x218], ax
mov rax, qword [rsp + 0x230]
mov eax, dword [rax]
mov dword [rsp + 0x280], eax
cmp dword [rsp + 0x280], 0
je 0x1400125ad
jmp 0x1400127ce
movsx edx, word [rsp + 0x218]
mov rax, qword [rsp + 0x268]
movsx eax, word [rax]
and edx, eax
movsx eax, word [rsp + 0x21c]
movsx ecx, word [0x14015d2c8]
add eax, ecx
cmp edx, eax
jle 0x140012715
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x240], rax
movzx eax, word [rsp + 0x21c]
mov word [rsp + 0x60], ax
movzx eax, word [rsp + 0x40]
mov dword [rsp + 0x284], eax
cmp dword [rsp + 0x284], 0xae
je 0x14001261a
jmp 0x14001265e
mov rdx, qword [rsp + 0x248]
mov ecx, 0x1f
call fcn.140148d70
mov r11d, dword [rsp + 0x90]
mov dword [rsp + 0x2a0], r11d
mov r8d, 0xe9
xor edx, edx
lea rcx, str.swipePartnered_ramblersClass
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov qword [rsp + 0x80], rax
jmp 0x1400126f6
mov al, byte [rsp + 0x30]
mov byte [rsp + 0x288], al
cmp byte [rsp + 0x288], 0xaf
je 0x1400126d7
cmp byte [rsp + 0x288], 0xb5
je 0x14001267f
jmp 0x1400126f6
mov eax, dword [rsp + 0x2a8]
mov ecx, dword [rsp + 0x90]
add ecx, eax
mov rax, qword [rsp + 0x230]
mov dword [rax], ecx
movabs rcx, 0x1b17c1e2a28750db
mov rax, qword [rsp + 0x248]
or rax, rcx
mov qword [rsp + 0x248], rax
mov ecx, dword [rsp + 0x2a0]
mov rax, qword [rsp + 0x230]
mov eax, dword [rax]
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x230]
mov dword [rax], ecx
jmp 0x1400126f6
movsx edx, word [rsp + 0x218]
mov rax, qword [rsp + 0x268]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x60], ax
movzx ecx, word [rsp + 0x40]
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
xor ecx, eax
mov rax, qword [rsp + 0x240]
mov word [rax], cx
jmp 0x1400127cc
movsx r8d, word [rsp + 0x21c]
movsx eax, word [rsp + 0x218]
sub r8d, eax
movsx edx, word [0x14015d2c8]
mov rax, qword [rsp + 0x268]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
cmp r8d, eax
jge 0x1400127cc
lea rdx, str.babyloncesspool_verify
lea rcx, str.nitrogendepictingXrays_theoretician
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [rsp + 0x58], eax
movsx ecx, word [rsp + 0x218]
movsx eax, word [rsp + 0x60]
and ecx, eax
mov rax, qword [rsp + 0x268]
mov word [rax], cx
movsx eax, word [rsp + 0x60]
movsx ecx, word [rsp + 0x21c]
add eax, ecx
mov word [rsp + 0x218], ax
movzx ecx, byte [rsp + 0x30]
movzx eax, byte [rsp + 0x78]
sub ecx, eax
mov rax, qword [rsp + 0x70]
mov byte [rax], cl
mov r9d, 0xee
lea r8, [rsp + 0x230]
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x228], eax
jmp 0x140012818
mov rax, qword [rsp + 0x268]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x218]
add ecx, eax
mov rax, qword [rsp + 0x268]
mov word [rax], cx
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x238], eax
movsx ecx, word [rsp + 0x21c]
movsx eax, word [rsp + 0x218]
sub ecx, eax
mov rax, qword [rsp + 0x268]
mov word [rax], cx
mov edx, dword [rsp + 0x90]
mov rax, qword [rsp + 0x230]
mov ecx, dword [rax]
call fcn.140012120
mov r11, qword [rsp + 0x268]
movsx ecx, word [r11]
movsx eax, word [rsp + 0x218]
sub ecx, eax
mov rax, qword [rsp + 0x268]
mov word [rax], cx
mov edx, 0x38
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov dword [rsp + 0x260], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x2a8], eax
mov dword [rsp + 0x20], 0xbc
lea r9, [rsp + 0x258]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x258]
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
mov dword [rsp + 0x228], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x2a8], eax
lea r9, [rsp + 0x90]
mov r8d, 0x6a
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
mov dword [rsp + 0x58], eax
movsx eax, word [0x14015d2c8]
add rsp, 0x298
ret