Function at 0x140002960
Capabilities:
Get disk information
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
mov rax, qword [0x1400bd040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov dword [rsp + 0x40], 0x80
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor r13d, r13d
test eax, eax
je 0x140002c64
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x58], r13
mov r12d, 0xf
mov qword [rsp + 0x60], r12
mov byte [rsp + 0x48], r13b
lea rax, [rbp - 0x70]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r13b
jne 0x1400029d5
lea rcx, [rsp + 0x48]
cmp rbx, r12
ja 0x140002a00
mov qword [rsp + 0x58], rbx
mov r8, rbx
lea rdx, [rbp - 0x70]
call fcn.14003b680
mov byte [rsp + rbx + 0x48], r13b
jmp 0x140002a0d
lea r9, [rbp - 0x70]
mov rdx, rbx
call fcn.140004c70
nop
lea rsi, [rsp + 0x48]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
cmp rdi, 0x10
cmovae rsi, rbx
mov r15d, 1
mov rax, qword [rsp + 0x58]
cmp rax, 2
jb 0x140002a89
lea r14, [rax + rsi]
lea r8, [r14 - 1]
sub r8, rsi
mov rcx, rsi
jmp 0x140002a6b
cmp byte [rax], 0x56
jne 0x140002a55
cmp byte [rax + 1], 0x4d
jne 0x140002a55
mov ecx, r13d
jmp 0x140002a5a
sbb ecx, ecx
or ecx, r15d
test ecx, ecx
je 0x140002a7c
add rax, r15
lea r8, [r14 - 1]
sub r8, rax
mov rcx, rax
mov edx, 0x56
call fcn.14003bef0
test rax, rax
jne 0x140002a45
jmp 0x140002a89
sub rax, rsi
cmp rax, 0xffffffffffffffff
jne 0x140002c2e
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, 0x80
lea rdx, [rbp - 0x70]
lea rcx, [0x1400ac22c]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x140002c21
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r12
lea rax, [rbp - 0x70]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r13b
jne 0x140002ad5
lea rcx, [rsp + 0x68]
cmp rbx, r12
ja 0x140002b00
mov qword [rsp + 0x78], rbx
mov r8, rbx
lea rdx, [rbp - 0x70]
call fcn.14003b680
mov byte [rsp + rbx + 0x68], r13b
jmp 0x140002b0c
lea r9, [rbp - 0x70]
mov rdx, rbx
call fcn.140004c70
lea r14, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rbp - 0x80]
cmp rsi, 0x10
cmovae r14, rbx
mov r12, qword [rsp + 0x78]
cmp r12, 6
jb 0x140002b87
lea r13, [r12 + r14]
lea r8, [r13 - 5]
sub r8, r14
mov rcx, r14
jmp 0x140002b63
mov r8d, 6
lea rdx, [0x1400ac230]
mov rcx, rdi
call fcn.14003bf70
test eax, eax
je 0x140002b77
add rdi, r15
lea r8, [r13 - 5]
sub r8, rdi
mov rcx, rdi
mov edx, 0x56
call fcn.14003bef0
test rax, rax
mov rdi, rax
jne 0x140002b3d
jmp 0x140002b84
sub rdi, r14
cmp rdi, 0xffffffffffffffff
jne 0x140002c9e
xor r13d, r13d
lea r14, [rsp + 0x68]
cmp rsi, 0x10
cmovae r14, rbx
cmp r12, 7
jb 0x140002bea
lea r8, [r12 - 6]
add r8, r14
sub r8, r14
mov rcx, r14
jmp 0x140002bd8
mov r8d, 7
lea rdx, [0x1400ac238]
mov rcx, rdi
call fcn.14003bf70
test eax, eax
je 0x140002c91
add rdi, r15
lea r8, [r12 - 6]
add r8, r14
sub r8, rdi
mov rcx, rdi
mov edx, 0x56
call fcn.14003bef0
test rax, rax
mov rdi, rax
jne 0x140002baa
cmp rsi, 0x10
jb 0x140002c21
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140002c19
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002cdc
mov rcx, rbx
call fcn.140038ed0
mov r15b, r13b
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
cmp rdi, 0x10
jb 0x140002c61
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140002c59
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002cd6
mov rcx, rbx
call fcn.140038ed0
mov al, r15b
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140038910
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
sub rdi, r14
cmp rdi, 0xffffffffffffffff
je 0x140002bea
cmp rsi, 0x10
jb 0x140002c24
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140002cc9
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002cdc
mov rcx, rbx
call fcn.140038ed0
jmp 0x140002c24
call fcn.140061908
nop
call fcn.140061908
int3