Function at 0x427050
Capabilities:
Get disk information
Terminate thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3b8
mov rbp, rsp
mov dword [rbp + 0x74], ecx
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x188], 0
nop
call fcn.00426d40
mov byte [0x0043ab0a], 1
lea rcx, [rbp + 0x1a6]
mov edx, 0x105
xor r8, r8
call fcn.00405ca0
mov rcx, qword [0x00439190]
lea rdx, [rbp + 0x1a6]
mov r8d, 0x104
call sub.kernel32.dll_GetModuleFileNameW
lea rcx, [rbp + 0x188]
movzx rdx, word [rbp + 0x1a6]
call fcn.0040ae40
lea rcx, [rbp + 0x188]
lea rdx, [0x00427444]
call fcn.0040b150
mov rcx, qword [rbp + 0x188]
call fcn.0040ae00
mov rcx, rax
xor edx, edx
xor r8, r8
lea r9, [rbp + 0x1a0]
lea rax, [rbp + 0x19c]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x198]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
call sub.kernel32.dll_GetVolumeInformationW
lea rcx, [rbp + 0x180]
movzx rdx, word [rbp + 0x1a6]
xor r8, r8
call fcn.0040a420
mov rcx, qword [0x00432f00]
mov rdx, qword [rbp + 0x180]
lea r8, [0x00427458]
call fcn.0040a6a0
lea rcx, [rbp + 0xa0]
call fcn.0041bab0
mov rdi, qword [0x00432e58]
lea rsi, [rbp + 0xa0]
mov ecx, 0x1b
rep movsq qword [rdi], qword [rsi]
movsd dword [rdi], dword [rsi]
mov rax, qword [0x00432e58]
imul ebx, dword [rax + 0xac], 0x64
mov rcx, qword [0x00432ed0]
lea rdx, [0x00427468]
call fcn.00409f40
xor ecx, ecx
call sub.user32.dll_GetSystemMetrics
mov ecx, eax
test ecx, ecx
jbe 0x427204
lea r8, [rbp + 0x98]
mov eax, ebx
xor edx, edx
div ecx
mov rdx, rax
mov edx, edx
mov rcx, r8
call fcn.00410b70
mov rcx, qword [0x00432ed0]
mov rdx, qword [rbp + 0x98]
call fcn.00409f40
lea rcx, [rbp + 0x90]
movzx rdx, word [rbp + 0x1a6]
call fcn.0040ae40
lea rcx, [rbp + 0x88]
call fcn.0041a3e0
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x88]
call fcn.0040af30
call fcn.00413e80
lea rcx, [rbp + 0x78]
mov edx, eax
call fcn.00410b70
mov rcx, qword [0x00432e70]
mov edx, 0xb
mov r8, qword [rbp + 0x90]
lea r9, [0x0042747c]
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea rax, [0x0042748c]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [0x0042749c]
mov qword [rsp + 0x38], rax
lea rax, [0x004274ac]
mov qword [rsp + 0x40], rax
lea rax, [0x0042749c]
mov qword [rsp + 0x48], rax
lea rax, [0x004274bc]
mov qword [rsp + 0x50], rax
lea rax, [0x004274d0]
mov qword [rsp + 0x58], rax
mov rax, qword [0x00432ed0]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
call fcn.0040b350
mov eax, dword [rbp + 0x74]
cmp eax, 0x3e8
je 0x4272f8
mov byte [0x0043ab08], 0
mov rax, qword [0x00432f48]
mov byte [rax], 1
call fcn.004249a0
jmp 0x427386
call fcn.004249a0
mov ecx, 0x7d0
call sub.kernel32.dll_Sleep
mov rax, qword [0x00432d88]
mov rcx, qword [rax]
mov edx, 0xea60
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x427328
call fcn.00426f80
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
call fcn.0041a300
mov rax, qword [0x00432df8]
mov rcx, qword [rax]
xor edx, edx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x427386
mov rax, qword [0x00432df8]
mov rcx, qword [rax]
lea rdx, [rbp + 0x194]
call sub.kernel32.dll_GetExitCodeThread
mov rax, qword [0x00432df8]
mov rcx, qword [rax]
mov edx, dword [rbp + 0x194]
call sub.kernel32.dll_TerminateThread
mov rax, qword [0x00432df8]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x78]
mov edx, 2
call fcn.00409ad0
lea rcx, [rbp + 0x88]
call fcn.00409a40
lea rcx, [rbp + 0x90]
mov edx, 2
call fcn.00409ad0
lea rcx, [rbp + 0x180]
call fcn.00409a40
lea rcx, [rbp + 0x188]
call fcn.004099f0
lea rsp, [rbp + 0x3b8]
pop rbx
pop rsi
pop rdi
pop rbp
ret