Function at 0x2eda343b0
Capabilities:
Get disk information
Get hostname
Get session user name

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x628
lea rcx, [0x2eda3e669]
mov r12, rdx
lea rsi, [rsp + 0xe0]
mov dword [rsp + 0xac], 0
lea rdi, [rsp + 0x410]
call fcn.2eda35e40
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0xac]
mov r13, rax
mov rcx, rax
lea rbp, [rsp + 0x210]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea r15, [rsp + 0xc8]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rcx, r13
call fcn.2eda35ed0
lea r8, [rsp + 0xb0]
mov rdx, rbp
mov ecx, 2
mov dword [rsp + 0xb0], 0x100
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov rcx, rsi
lea rdx, [rsp + 0xb4]
mov dword [rsp + 0xb4], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rdx, [rsp + 0xb8]
mov rcx, rdi
mov dword [rsp + 0xb8], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov rcx, r12
mov r8d, 0xffffffff
lea r12, [rsp + 0xd0]
lea edx, [rax + rax]
call fcn.2eda32100
xor eax, dword [rsp + 0xac]
mov rcx, rsi
mov r8d, 0xffffffff
mov dword [rsp + 0xc8], eax
mov eax, dword [rsp + 0xb4]
lea edx, [rax + rax]
call fcn.2eda32100
mov r8d, 0xffffffff
mov rcx, rdi
mov ebx, eax
mov eax, dword [rsp + 0xb8]
lea edx, [rax + rax]
call fcn.2eda32100
mov rcx, r12
xor ebx, eax
mov dword [rsp + 0xcc], ebx
call fcn.2eda34f60
lea rcx, [0x2eda3d080]
call fcn.2eda35dc0
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbp
mov rbx, rax
lea rax, [rsp + 0xc4]
mov rdx, r12
mov rcx, r15
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x70], rax
call fcn.2eda32ab0
mov rsi, rax
test rax, rax
je 0x2eda347b9
mov edx, dword [rsp + 0xc4]
mov rcx, rax
call fcn.2eda32a20
mov rdi, rax
test rax, rax
je 0x2eda347b1
lea rax, [rsp + 0xbc]
lea rbp, [0x2eda3e678]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x78], rax
jmp 0x2eda345d7
mov rcx, r14
call fcn.2eda35ed0
mov rcx, r13
call fcn.2eda35ed0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
lea ecx, [rax + 0xbb8]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x2eda3d100]
call fcn.2eda35e40
lea rcx, [0x2eda3d0c0]
mov r13, rax
call fcn.2eda35e40
mov dword [rsp + 0x48], 0
mov r9d, 1
mov rcx, r13
mov r14, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbp
movzx r8d, word [section..data]
mov rdx, r14
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
call fcn.2eda32160
mov r12, rax
test rax, rax
je 0x2eda345b0
cmp dword [rsp + 0xbc], 4
jbe 0x2eda345b0
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
mov r8, rax
call fcn.2eda35310
mov rcx, qword [rsp + 0x68]
mov r8, r12
mov rdx, r12
mov r9d, dword [rsp + 0xbc]
call fcn.2eda35380
mov eax, dword [rsp + 0xbc]
xor r8d, r8d
lea rcx, [r12 + 4]
lea edx, [rax - 4]
call fcn.2eda32100
cmp eax, dword [r12]
je 0x2eda347e0
mov rcx, r12
call fcn.2eda34f30
jmp 0x2eda345b0
mov rax, qword [rsp + 0x70]
mov edx, dword [r12 + 4]
mov r9, rbx
mov rcx, r15
mov dword [rsp + 0x20], 1
lea r8, [r12 + 0x10]
mov qword [rsp + 0x28], rax
call fcn.2eda33ac0
mov rsi, rax
test rax, rax
je 0x2eda34741
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rsi
mov rcx, r13
mov rdx, r14
mov dword [rsp + 0x48], 0
movzx r8d, word [section..data]
mov r9d, 2
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xc4]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x20], rbp
call fcn.2eda32160
mov rcx, rax
test rax, rax
je 0x2eda34739
call fcn.2eda34f30
mov rcx, rsi
call fcn.2eda34f30
add r12, 8
add dword [rsp + 0x64], 1
mov eax, dword [rsp + 0x64]
cmp dword [rsp + 0x80], eax
jne 0x2eda34820
mov r12, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rcx, r12
call fcn.2eda34f30
mov rcx, r14
call fcn.2eda35ed0
mov rcx, r13
call fcn.2eda35ed0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
lea ecx, [rax + 0xbb8]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x84]
test eax, eax
je 0x2eda345d7
mov rcx, rdi
call fcn.2eda34f30
mov rcx, rsi
call fcn.2eda34f30
mov rcx, rbx
call fcn.2eda35ed0
nop
add rsp, 0x628
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [r12 + 4]
lea r10, [r12 + 8]
mov dword [rsp + 0x80], eax
test eax, eax
je 0x2eda346a6
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x84], 0
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], r12
mov r12, r10
nop
cmp dword [r12], 0xa
ja case.0x2eda3483d.0
mov eax, dword [r12]
lea rsi, [0x2eda3e694]
movsxd rax, dword [rsi + rax*4]
add rax, rsi
jmp rax
lea rcx, [0x2eda3e67c]
add r12, 8
call fcn.2eda35e40
mov rsi, rax
mov rcx, rax
call fcn.2eda36470
mov rcx, rsi
call fcn.2eda35ed0
add dword [rsp + 0x64], 1
mov eax, dword [rsp + 0x64]
cmp dword [rsp + 0x80], eax
je 0x2eda34a99
mov dword [rsp + 0x84], 1
jmp 0x2eda34820
mov rsi, qword [rsp + 0x70]
mov eax, dword [r12 + 0x10]
lea r8, [r12 + 0x18]
mov edx, dword [r12 + 4]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rsi
lea r9, [r12 + rax - 8]
mov qword [rsp + 0x28], rbx
mov ecx, dword [r12 + 0x14]
mov dword [rsp + 0x20], ecx
mov rcx, r15
call fcn.2eda33850
mov rsi, rax
test rax, rax
je 0x2eda3492e
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rsi
mov rcx, r13
mov rdx, r14
mov dword [rsp + 0x48], 0
movzx r8d, word [section..data]
mov r9d, 2
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xc4]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x20], rbp
call fcn.2eda32160
mov rcx, rax
test rax, rax
je 0x2eda34926
call fcn.2eda34f30
mov rcx, rsi
call fcn.2eda34f30
add r12, 0x10
jmp case.0x2eda3483d.0
mov rax, qword [rsp + 0x70]
mov edx, dword [r12 + 4]
mov r9, rbx
mov rcx, r15
mov dword [rsp + 0x20], 1
lea rsi, [r12 + 0x10]
mov qword [rsp + 0x28], rax
mov r8, rsi
mov r12, rsi
call fcn.2eda33e80
mov r11, rax
test rax, rax
je case.0x2eda3483d.0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], r11
mov rcx, r13
mov rdx, r14
mov dword [rsp + 0x48], 0
movzx r8d, word [section..data]
mov r9d, 2
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xc4]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x98], r11
call fcn.2eda32160
mov r11, qword [rsp + 0x98]
test rax, rax
mov rcx, rax
je 0x2eda349e3
call fcn.2eda34f30
mov r11, qword [rsp + 0x98]
mov rcx, r11
mov r12, rsi
call fcn.2eda34f30
jmp case.0x2eda3483d.0
mov rax, qword [rsp + 0x70]
mov edx, dword [r12 + 4]
mov r8, rbx
mov rcx, r15
mov r9d, 1
mov qword [rsp + 0x20], rax
call fcn.2eda33650
mov rsi, rax
test rax, rax
jne 0x2eda346e7
jmp 0x2eda34741
mov rax, qword [rsp + 0x70]
mov edx, dword [r12 + 4]
mov r8, rbx
mov rcx, r15
mov r9d, 1
mov qword [rsp + 0x20], rax
call fcn.2eda33040
mov rsi, rax
test rax, rax
jne 0x2eda346e7
jmp 0x2eda34741
mov rax, qword [rsp + 0x70]
mov edx, dword [r12 + 4]
mov r8, rbx
mov rcx, r15
mov r9d, 1
mov qword [rsp + 0x20], rax
call fcn.2eda32c70
mov rsi, rax
test rax, rax
jne 0x2eda346e7
jmp 0x2eda34741
mov r12, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rcx, r12
call fcn.2eda34f30
mov rcx, r14
call fcn.2eda35ed0
mov rcx, r13
call fcn.2eda35ed0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
mov ecx, eax
add ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x2eda347a9