Function at 0x140004540
Capabilities:
Enumerate disk volumes
Get disk information
Get disk information via ioctl
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ac0]
mov eax, 0x1bc0
call fcn.14000c390
sub rsp, rax
movaps xmmword [rsp + 0x1bb0], xmm6
movaps xmmword [rsp + 0x1ba0], xmm7
movaps xmmword [rsp + 0x1b90], xmm8
movaps xmmword [rsp + 0x1b80], xmm9
movaps xmmword [rsp + 0x1b70], xmm10
movaps xmmword [rsp + 0x1b60], xmm11
mov rax, qword [0x140046058]
xor rax, rsp
mov qword [rbp + 0x1a50], rax
xor r13d, r13d
mov esi, r13d
mov dword [rbp + 0x14d8], r13d
mov dil, 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1630]
call fcn.14000e050
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1840]
call fcn.14000e050
mov dword [rbp + 0x14e0], r13d
mov edx, 0x104
lea rcx, [rbp + 0x1630]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1400046e7
movabs rax, 0x285b3acb677c563
mov qword [rbp + 0x1490], rax
movabs rax, 0x7a0fbd4ad2192cde
mov qword [rbp + 0x1498], rax
xorps xmm2, xmm2
movabs rax, 0x66ebdaea962ae838
mov qword [rbp + 0x14b0], rax
movabs rax, 0x7a05d826b6774d96
mov qword [rbp + 0x14b8], rax
xorps xmm1, xmm1
movdqa xmm0, xmmword [rbp + 0x1490]
pxor xmm0, xmmword [rbp + 0x14b0]
movdqa xmmword [rbp + 0x1510], xmm0
pxor xmm2, xmm1
movdqa xmmword [rbp + 0x1520], xmm2
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x1510]
lea edx, [r13 + 2]
nop
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140004690
jmp 0x140005bc2
mov r14, 0xffffffffffffffff
lea r15d, [r14 + 0x5d]
lea rcx, [rbp + 0x1630]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004700
dec rax
cmp word [rbp + 0x1630], 0x5c
jne 0x140005aee
cmp word [rbp + 0x1632], 0x5c
jne 0x140005aee
cmp word [rbp + 0x1634], 0x3f
jne 0x140005aee
cmp word [rbp + 0x1636], 0x5c
jne 0x140005aee
lea rbx, [rax + rax]
cmp word [rbp + rbx + 0x1630], 0x5c
jne 0x140005aee
cmp rbx, 0x208
jae 0x140005c1c
mov word [rbp + rbx + 0x1630], r13w
mov r8d, 0x104
lea rdx, [rbp + 0x1840]
lea rcx, [rbp + 0x1638]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov word [rbp + rbx + 0x1630], r15w
test eax, eax
je 0x140005a02
lea rdx, [rbp + 0x1840]
lea rcx, [rbp + 0x14f8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rbp + 0x1490], 0x30
mov qword [rbp + 0x1498], r13
mov dword [rbp + 0x14a8], 0x40
lea rax, [rbp + 0x14f8]
mov qword [rbp + 0x14a0], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x14b0], xmm0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 3
lea r9, [rbp + 0x1620]
lea r8, [rbp + 0x1490]
mov edx, 0x12019f
lea rcx, [rbp + 0x14d0]
call qword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
js 0x1400053aa
mov r15, qword [rbp + 0x14d0]
cmp r15, 0xffffffffffffffff
je 0x1400053a4
mov dword [rbp + 0x14d8], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x1510], xmm0
movups xmmword [rbp + 0x1520], xmm0
movups xmmword [rbp + 0x1530], xmm0
movups xmmword [rbp + 0x1540], xmm0
movups xmmword [rbp + 0x1550], xmm0
movups xmmword [rbp + 0x1560], xmm0
movups xmmword [rbp + 0x1570], xmm0
movups xmmword [rbp + 0x1580], xmm0
movups xmmword [rbp + 0x1590], xmm0
mov qword [rsp + 0x38], r13
lea rax, [rbp + 0x14d8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x90
lea rax, [rbp + 0x1510]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70048
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14000537f
mov ecx, dword [rbp + 0x1510]
test ecx, ecx
je 0x14000537f
cmp ecx, 1
jne 0x14000537f
mov rax, qword [rbp + 0x1530]
cmp rax, qword [0x140040360]
jne 0x14000537f
mov rax, qword [rbp + 0x1538]
cmp rax, qword [0x140040368]
jne 0x14000537f
xor eax, eax
mov qword [rbp + 0x14e8], rax
mov dword [rbp + 0x14f0], eax
mov qword [rsp + 0x38], r13
lea rax, [rbp + 0x14e0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xc
lea rax, [rbp + 0x14e8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400053a4
movabs rax, 0x13aedbdd1f388
mov qword [rbp + 0xa0], rax
movabs rax, 0x4fd0dbe33796c00
mov qword [rbp + 0xa8], rax
xorps xmm2, xmm2
movabs rcx, 0x13ad7bd89f3d4
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rax
xorps xmm0, xmm0
movdqa xmm1, xmmword [rbp + 0xa0]
pxor xmm1, xmmword [rbp + 0xc0]
pxor xmm2, xmm0
movaps xmmword [rbp + 0x150], xmm1
movaps xmmword [rbp + 0x160], xmm2
movaps xmm0, xmmword [rbp - 0x80]
movaps xmmword [rbp + 0x170], xmm0
movaps xmm1, xmmword [rbp - 0x70]
movaps xmmword [rbp + 0x180], xmm1
movaps xmm0, xmmword [rbp - 0x60]
movaps xmmword [rbp + 0x190], xmm0
movaps xmm1, xmmword [rbp - 0x50]
movaps xmmword [rbp + 0x1a0], xmm1
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp + 0x1b0], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movaps xmmword [rbp + 0x1c0], xmm1
lea r8, [rbp + 0x1840]
lea rdx, [rbp + 0x150]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
xorps xmm5, xmm5
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
test eax, eax
je 0x1400058c7
movabs rax, 0xac77a9925f253a
mov qword [rsp + 0x60], rax
movabs rax, 0x3e10ff0dd613309a
mov qword [rsp + 0x68], rax
movabs rax, 0x13a24bfbf66de7f1
mov qword [rsp + 0x70], rax
movabs rax, 0x14ca896c82ac8742
mov qword [rsp + 0x78], rax
movabs rax, 0x1fffffffe221d3fa
mov qword [rbp - 0x80], rax
movabs rax, 0x1fffffffe4e78428
mov qword [rbp - 0x78], rax
xorps xmm6, xmm6
xorps xmm7, xmm7
movabs rcx, 0x4df03eefd7031f62
mov qword [rbp - 0x40], rcx
movabs rcx, 0x4a76907eb96153f3
mov qword [rbp - 0x38], rcx
movabs rcx, 0x7cc0178f9902a5ad
mov qword [rbp - 0x30], rcx
movabs rcx, 0x71e4fe0ae5c1f32d
mov qword [rbp - 0x28], rcx
movabs rcx, 0x1fffffffe221ba9c
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x1f0], xmm0
pxor xmm5, xmm2
movdqa xmmword [rbp + 0x200], xmm5
pxor xmm6, xmm3
movdqa xmmword [rbp + 0x210], xmm6
pxor xmm7, xmm4
movdqa xmmword [rbp + 0x220], xmm7
lea rax, [rbp + 0x930]
lea rcx, [rbp + 0x1d0]
mov edx, 4
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140004b30
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
call fcn.14000a678
lea rcx, [rbp + 0x930]
mov qword [rbp + 0x120], rcx
lea rdx, [rbp + 0x930]
mov rcx, r14
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140004bb5
mov qword [rbp + 0x128], rcx
lea r8, [rbp + 0x120]
mov edx, eax
lea rcx, [rbp + 0xa0]
call fcn.140001fe0
or esi, 0xc
or esi, 1
mov dword [rbp + 0x14d8], esi
lea rcx, [rbp + 0xa0]
call fcn.1400029a0
test al, al
je 0x140004df1
movabs rax, 0x1112a276d3c69a5f
mov qword [rsp + 0x60], rax
movabs rax, 0x350ff5b1fa68a5c8
mov qword [rsp + 0x68], rax
movabs rax, 0x13420e6bd4f04bbd
mov qword [rsp + 0x70], rax
movabs rax, 0x163c7af261eb20fd
mov qword [rsp + 0x78], rax
movabs rax, 0xef9f2c777977809
mov qword [rbp - 0x80], rax
movabs rax, 0x79294200d8c2c5f6
mov qword [rbp - 0x78], rax
xorps xmm5, xmm5
xorps xmm6, xmm6
xorps xmm7, xmm7
movabs rax, 0x5c4eeb30969aa007
mov qword [rbp - 0x40], rax
movabs rax, 0x41699ac2951ac6a1
mov qword [rbp - 0x38], rax
movabs rax, 0x7c20521fbb9f09e1
mov qword [rbp - 0x30], rax
movabs rax, 0x73120d9406865492
mov qword [rbp - 0x28], rax
movabs rax, 0x7b9291a615b9116f
mov qword [rbp - 0x20], rax
movabs rax, 0x79294200d8c2c586
mov qword [rbp - 0x18], rax
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x1f0], xmm0
pxor xmm5, xmm2
movdqa xmmword [rbp + 0x200], xmm5
pxor xmm6, xmm3
movdqa xmmword [rbp + 0x210], xmm6
pxor xmm7, xmm4
movdqa xmmword [rbp + 0x220], xmm7
lea rax, [rbp + 0xb60]
lea rcx, [rbp + 0x1d0]
mov edx, 5
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140004d30
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
call fcn.14000a678
lea rcx, [rbp + 0xb60]
mov qword [rbp + 0x130], rcx
lea rdx, [rbp + 0xb60]
mov rcx, r14
nop dword [rax]
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140004db0
mov qword [rbp + 0x138], rcx
lea r8, [rbp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140001fe0
or esi, 0x30
or esi, 2
mov dword [rbp + 0x14d8], esi
lea rcx, [rsp + 0x40]
call fcn.1400029a0
test al, al
je 0x140004df1
mov bl, 1
jmp 0x140004df3
xor bl, bl
test sil, 2
je 0x140004e52
and esi, 0xfffffffd
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140004e3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c22
call fcn.14000baa0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
test sil, 1
je 0x140004ea1
and esi, 0xfffffffe
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x140004ea1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c28
call fcn.14000baa0
xorps xmm2, xmm2
test bl, bl
jne 0x1400057e8
movabs rax, 0x46aa51f0f7333de
mov qword [rsp + 0x60], rax
movabs rax, 0x7cf24ef0c14e2dff
mov qword [rsp + 0x68], rax
movabs rax, 0x1f764b71e4f8da22
mov qword [rsp + 0x70], rax
movabs rax, 0x1dba720193f7a03f
mov qword [rsp + 0x78], rax
movabs rax, 0x14b2b7c20fc08fdc
mov qword [rbp - 0x80], rax
movabs rax, 0x61bda5ebf60f0592
mov qword [rbp - 0x78], rax
xorps xmm5, xmm5
xorps xmm6, xmm6
xorps xmm7, xmm7
movabs rax, 0x294ac7767d0747bf
mov qword [rbp - 0x40], rax
movabs rax, 0x20c816d0a9630d8c
mov qword [rbp - 0x38], rax
movabs rax, 0x6d15223cb8b19c67
mov qword [rbp - 0x30], rax
movabs rax, 0x72f82e75f598d350
mov qword [rbp - 0x28], rax
movabs rax, 0x79c6d8ad6d9cfbb3
mov qword [rbp - 0x20], rax
movabs rax, 0x61d4c38ed87863f5
mov qword [rbp - 0x18], rax
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x1f0], xmm0
pxor xmm5, xmm2
movdqa xmmword [rbp + 0x200], xmm5
pxor xmm6, xmm3
movdqa xmmword [rbp + 0x210], xmm6
pxor xmm7, xmm4
movdqa xmmword [rbp + 0x220], xmm7
lea rax, [rbp + 0x4d0]
lea rcx, [rbp + 0x1d0]
mov edx, 6
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140004fe0
lea rcx, [rbp + 0x4d0]
call fcn.140014e40
movabs rax, 0x9e59de747875a16
mov qword [rsp + 0x60], rax
movabs rax, 0x22f18acc5eff3a4d
mov qword [rsp + 0x68], rax
movabs rax, 0x18c0361c6a2eb557
mov qword [rsp + 0x70], rax
movabs rax, 0xad404793fb7f9a6
mov qword [rsp + 0x78], rax
movabs rax, 0x133e2f93fd84ee39
mov qword [rbp - 0x80], rax
movabs rax, 0x6b2b30702695284f
mov qword [rbp - 0x78], rax
xorps xmm5, xmm5
xorps xmm6, xmm6
xorps xmm7, xmm7
movabs rax, 0x44b9d4a102db604e
mov qword [rbp - 0x40], rax
movabs rax, 0x5697e5bf318d5924
mov qword [rbp - 0x38], rax
movabs rax, 0x77a26a680541f70b
mov qword [rbp - 0x30], rax
movabs rax, 0x6ffa731f58da8dc9
mov qword [rbp - 0x28], rax
movabs rax, 0x66554cf29faa875f
mov qword [rbp - 0x20], rax
movabs rax, 0x6b2b30702695283f
mov qword [rbp - 0x18], rax
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x1f0], xmm0
pxor xmm5, xmm2
movdqa xmmword [rbp + 0x200], xmm5
pxor xmm6, xmm3
movdqa xmmword [rbp + 0x210], xmm6
pxor xmm7, xmm4
movdqa xmmword [rbp + 0x220], xmm7
lea rax, [rbp + 0xe00]
lea rcx, [rbp + 0x1d0]
mov edx, 5
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140005170
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movabs rax, 0x37e6b8e0f1e285c
mov qword [rsp + 0x60], rax
movabs rax, 0x3bbc68a8c7a32d47
mov qword [rsp + 0x68], rax
movabs rax, 0x1fa914b052d15626
mov qword [rsp + 0x70], rax
movabs rax, 0x1b5c74276f2af80d
mov qword [rsp + 0x78], rax
movabs rax, 0x1fffffffe2a7881f
mov qword [rbp - 0x80], rax
movabs rax, 0x1fffffffe4661cf9
mov qword [rbp - 0x78], rax
xorps xmm5, xmm5
xorps xmm6, xmm6
xorps xmm7, xmm7
movabs rcx, 0x4e2222c84a421204
mov qword [rbp - 0x40], rcx
movabs rcx, 0x4fda07dba8d14e2e
mov qword [rbp - 0x38], rcx
movabs rcx, 0x70cb48c43dbe147a
mov qword [rbp - 0x30], rcx
movabs rcx, 0x7e72034108478c62
mov qword [rbp - 0x28], rcx
movabs rcx, 0x1fffffffe2a7e179
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x1f0], xmm0
pxor xmm5, xmm2
movdqa xmmword [rbp + 0x200], xmm5
pxor xmm6, xmm3
movdqa xmmword [rbp + 0x210], xmm6
pxor xmm7, xmm4
movdqa xmmword [rbp + 0x220], xmm7
lea rax, [rbp + 0x1260]
lea rdx, [rbp + 0x1d0]
mov ecx, 4
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rcx, 1
jne 0x140005300
movups xmm0, xmmword [rdx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rax + 0x20], xmm0
lea rdx, [rbp + 0xe00]
lea rcx, [rbp + 0x1260]
call fcn.1400150f4
test eax, eax
je 0x1400053c3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x1630]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
setne dil
mov r15d, 0x5c
test dil, dil
jne 0x1400046f2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov al, 1
jmp 0x140005bce
movabs rax, 0x9de37d145fa1f20
mov qword [rsp + 0x60], rax
movabs rax, 0x33f344ea7e9853b
mov qword [rsp + 0x68], rax
movabs rax, 0xd16bf9a4306880c
mov qword [rsp + 0x70], rax
movabs rax, 0x112f226fc8162775
mov qword [rsp + 0x78], rax
movabs rax, 0xd16ad15775a37d0
mov qword [rbp - 0x80], rax
movabs rax, 0xf120a04866d621e
mov qword [rbp - 0x78], rax
movabs rax, 0x1bb6a0beabf2ad14
mov qword [rbp - 0x70], rax
movabs rax, 0x13d27d51cd6434de
mov qword [rbp - 0x68], rax
movabs rax, 0x2680e7588
mov qword [rbp - 0x60], rax
movabs rcx, 0x565363a1f0a
mov qword [rbp - 0x58], rcx
xorps xmm7, xmm7
xorps xmm8, xmm8
xorps xmm9, xmm9
xorps xmm10, xmm10
xorps xmm11, xmm11
movabs rax, 0x99b378d45c01f78
mov qword [rbp], rax
movabs rax, 0x3723412a7a0857d
mov qword [rbp + 8], rax
movabs rax, 0xd79bfe843658865
mov qword [rbp + 0x10], rax
movabs rax, 0x115b2209c8792706
mov qword [rbp + 0x18], rax
movabs rax, 0xd79ad7a7718378c
mov qword [rbp + 0x20], rax
movabs rax, 0xf7d0a668631626a
mov qword [rbp + 0x28], rax
movabs rax, 0x1bd1a0d3ab86ad7b
mov qword [rbp + 0x30], rax
movabs rax, 0x13b77d7fcd1334b8
mov qword [rbp + 0x38], rax
movabs rax, 0x2686775ee
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
xorps xmm5, xmm5
xorps xmm6, xmm6
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x4d0], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x4e0], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x4f0], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
pxor xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x500], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
pxor xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x510], xmm0
pxor xmm7, xmm2
movdqa xmmword [rbp + 0x520], xmm7
pxor xmm8, xmm3
movdqa xmmword [rbp + 0x530], xmm8
pxor xmm9, xmm4
movdqa xmmword [rbp + 0x540], xmm9
pxor xmm10, xmm5
movdqa xmmword [rbp + 0x550], xmm10
pxor xmm11, xmm6
movdqa xmmword [rbp + 0x560], xmm11
lea rax, [rbp + 0xe00]
lea rcx, [rbp + 0x4d0]
mov edx, 8
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x1400055b0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
lea rax, [rbp + 0xe00]
inc r14
cmp word [rax + r14*2], 0
jne 0x140005650
mov r8, r14
lea rdx, [rbp + 0xe00]
lea rcx, [rsp + 0x40]
call fcn.140009210
nop
lea rcx, [rsp + 0x40]
call fcn.140004280
test al, al
sete bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400056c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c2e
call fcn.14000baa0
test bl, bl
jne 0x140005bcc
movabs rax, 0x6e71e145f21e3cb
mov qword [rbp + 0xa0], rax
movabs rax, 0x2f38917f32d22601
mov qword [rbp + 0xa8], rax
xorps xmm2, xmm2
movabs rax, 0x26ae58517f7cc990
mov qword [rbp + 0xc0], rax
movabs rax, 0x2f389b5e56bd4946
mov qword [rbp + 0xc8], rax
xorps xmm1, xmm1
movdqa xmm0, xmmword [rbp + 0xa0]
pxor xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0x1510], xmm0
pxor xmm2, xmm1
movdqa xmmword [rbp + 0x1520], xmm2
lea rcx, [rsp + 0x60]
lea rax, [rbp + 0x1510]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.1400010e0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov al, 1
jmp 0x140005bce
movabs rax, 0x3ac32c838c84e1f
mov qword [rbp + 0xa0], rax
movabs rax, 0x424ce492b9334268
mov qword [rbp + 0xa8], rax
movabs rax, 0x46e07b8e18956344
mov qword [rbp + 0xc0], rax
movabs rax, 0x4246b0c1f06b0737
mov qword [rbp + 0xc8], rax
xorps xmm1, xmm1
movdqa xmm0, xmmword [rbp + 0xc0]
pxor xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x1510], xmm0
pxor xmm1, xmm2
movdqa xmmword [rbp + 0x1520], xmm1
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x1510]
mov edx, 2
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140005870
jmp 0x140005bc2
movabs rax, 0x15b0ab67bc3b6c83
mov qword [rbp + 0xa0], rax
movabs rax, 0x5ccdf18c660e4013
mov qword [rbp + 0xa8], rax
movabs rdx, 0x1fffffffe0000000
mov qword [rbp + 0xb0], rdx
movabs rcx, 0xe000000020000cd5
mov qword [rbp + 0xb8], rcx
movabs rax, 0x52e2ea339c6641d8
mov qword [rbp + 0xe0], rax
movabs rax, 0x5685a5cd36511456
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rdx
mov qword [rbp + 0xf8], rcx
movdqa xmm0, xmmword [rbp + 0xa0]
pxor xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x1510], xmm0
movdqa xmm1, xmmword [rbp + 0xb0]
pxor xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rbp + 0x1520], xmm1
pxor xmm4, xmm2
movdqa xmmword [rbp + 0x1530], xmm4
pxor xmm5, xmm3
movdqa xmmword [rbp + 0x1540], xmm5
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x1510]
mov edx, 2
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x1400059a0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x60]
jmp 0x140005bc7
movabs rax, 0xbf936836a9fb7b1
mov qword [rbp + 0x1490], rax
movabs rax, 0x6af97aaeb0392994
mov qword [rbp + 0x1498], rax
xorps xmm2, xmm2
movabs rax, 0x658c59c04ac29aea
mov qword [rbp + 0x14b0], rax
movabs rax, 0x6af97aaeb03923e0
mov qword [rbp + 0x14b8], rax
xorps xmm1, xmm1
movdqa xmm0, xmmword [rbp + 0x1490]
pxor xmm0, xmmword [rbp + 0x14b0]
movdqa xmmword [rbp + 0x1510], xmm0
pxor xmm2, xmm1
movdqa xmmword [rbp + 0x1520], xmm2
lea rcx, [rsp + 0x60]
lea rax, [rbp + 0x1510]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0xa0], xmm0
lea rcx, [rsp + 0x60]
jmp 0x140005bc7
movabs rax, 0x1ae3a9eafaae3618
mov qword [rbp + 0x1490], rax
movabs rax, 0x76d0ac41cdc83b74
mov qword [rbp + 0x1498], rax
xorps xmm2, xmm2
movabs rax, 0x6f8fc6bcdaf31b43
mov qword [rbp + 0x14b0], rax
movabs rax, 0x76dac92cac865e19
mov qword [rbp + 0x14b8], rax
xorps xmm1, xmm1
movdqa xmm0, xmmword [rbp + 0x1490]
pxor xmm0, xmmword [rbp + 0x14b0]
movdqa xmmword [rbp + 0x1510], xmm0
pxor xmm2, xmm1
movdqa xmmword [rbp + 0x1520], xmm2
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x1510]
mov edx, 2
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140005b70
lea rcx, [rsp + 0x60]
call fcn.1400010e0
xor al, al
mov rcx, qword [rbp + 0x1a50]
xor rcx, rsp
call fcn.14000ba80
lea r11, [rsp + 0x1bc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000bbb0
nop
call fcn.1400163a0
nop
call fcn.1400163a0
int3
call fcn.1400163a0
int3