Function at 0x14008dbd0
Capabilities:
Get common file path
Get disk size
Get memory capacity
Get session user name
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor esi, esi
mov rax, qword [rcx + 8]
mov qword [rcx + 0xb50], rsi
mov rdi, rcx
mov qword [rcx + 0xb58], rsi
mov r8d, 0x208
mov qword [rcx + 0xb38], rsi
mov qword [rcx + 0xb40], rsi
mov qword [rcx + 0xb48], rsi
mov qword [rcx + 0xb30], rsi
mov dword [rcx + 0xb20], esi
mov dword [rcx + 0xad8], esi
mov dword [rcx + 0xb98], esi
mov qword [rcx + 0xca0], rsi
mov qword [rcx + 0xc28], rsi
mov qword [rcx + 0xc30], rsi
mov qword [rcx + 0xc78], rsi
mov qword [rcx + 0xc80], rsi
mov qword [rcx + 0xc88], rsi
mov qword [rcx + 0xc90], rsi
mov qword [rcx + 0xe10], rsi
mov qword [rcx + 0xe30], rsi
mov qword [rcx + 0xe50], rsi
mov qword [rcx + 0xeb0], rsi
mov qword [rcx + 0xeb8], rsi
mov qword [rcx + 0xec0], rsi
mov qword [rcx + 0xec8], rsi
mov qword [rcx + 0xed0], rsi
mov qword [rcx + 0xf18], rsi
mov qword [rcx + 0xf20], rsi
mov byte [rcx + 0xea8], sil
mov dword [rcx + 0xf28], esi
mov qword [rcx + 0xb24], 1
lea rcx, [0x14045e540]
cmp qword [0x140460018], 0x10
mov qword [0x14045df08], rax
lea rax, [0x140460000]
cmovae rax, qword [0x140460000]
mov qword [0x140460010], rsi
mov dword [0x14045e968], esi
mov dword [reloc.WS2_32.dll_accept], 1
mov byte [rax], sil
lea rax, [0x140460020]
cmp qword [0x140460038], 0x10
mov qword [0x140460030], rsi
cmovae rax, qword [0x140460020]
mov dword [0x14045e538], esi
mov dword [0x14045e32c], esi
mov dword [0x14045e118], esi
mov byte [rax], sil
lea rax, [0x14045ffe0]
cmp qword [0x14045fff8], 0x10
mov qword [0x14045fff0], rsi
cmovae rax, qword [0x14045ffe0]
xor edx, edx
mov dword [0x14045e11c], esi
mov byte [rax], sil
call fcn.14027b2c0
xor edx, edx
lea rcx, [0x14045e120]
mov r8d, 0x208
call fcn.14027b2c0
xor r9d, r9d
lea r8d, [rsi + 5]
lea rdx, [0x14045e120]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r9, [0x14045e120]
mov edx, 0x104
lea r8, str._sCleanupSys.ini
lea rcx, [0x14045e540]
call fcn.14004ebd0
xor edx, edx
lea rcx, [0x14045e330]
mov r8d, 0x208
call fcn.14027b2c0
xor edx, edx
lea rcx, [0x14045e760]
mov r8d, 0x208
call fcn.14027b2c0
xor edx, edx
mov r8d, 0x208
lea rcx, [0x14045f620]
call fcn.14027b2c0
xor edx, edx
lea rcx, [0x14045f200]
mov r8d, 0x208
call fcn.14027b2c0
xor edx, edx
lea rcx, [0x14045eff0]
mov r8d, 0x208
call fcn.14027b2c0
xor edx, edx
lea rcx, [0x14045f410]
mov r8d, 0x208
call fcn.14027b2c0
lea rbx, [0x14045e970]
xor edx, edx
mov rcx, rbx
mov r8d, 0x208
call fcn.14027b2c0
xor edx, edx
lea rcx, [0x14045ede0]
mov r8d, 0x208
call fcn.14027b2c0
xor edx, edx
lea rcx, [0x14045ebd0]
mov r8d, 0x208
call fcn.14027b2c0
xor edx, edx
lea rcx, [0x14045dd00]
mov r8d, 0x208
call fcn.14027b2c0
xor edx, edx
lea rcx, [0x14045df10]
mov r8d, 0x208
call fcn.14027b2c0
xor r9d, r9d
lea rdx, [0x14045e330]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [rsi + 0x19]
lea rdx, [0x14045e760]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [rsi + 6]
lea rdx, [0x14045f620]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [rsi + 0xe]
lea rdx, [0x14045f200]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [rsi + 0x27]
lea rdx, [0x14045eff0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [rsi + 0xd]
lea rdx, [0x14045f410]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8d, 0x104
lea rdx, [0x14045ebd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x14045ede0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [0x14045ebd0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rdx, [0x14045dd00]
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14008df60
lea rdx, [0x14045df10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edx, edx
lea rcx, str.X:UsersAdministrator
mov r8d, 0x208
call fcn.14027b2c0
cmp dword [0x14045ebc8], esi
je 0x14008dfc6
call fcn.1400844c0
mov word [0x14045e75c], ax
call fcn.140084590
test rax, rax
je 0x14008dfe7
mov r8, rax
mov edx, 0x104
mov rcx, rbx
call fcn.14028aa5c
jmp 0x14008dfe7
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
lea rdx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x104
mov rcx, rbx
mov word [0x14045e75c], ax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
movzx r9d, word [0x14045e53c]
lea r8, str._C:Users_s
mov edx, 0x104
mov qword [rsp + 0x20], rbx
lea rcx, str.X:UsersAdministrator
call fcn.14004ebd0
lea rcx, [rbp - 0x31]
call fcn.1400817e0
mov rdx, rax
call fcn.1400a0e00
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x14008e043
mov rdx, qword [rbp - 0x29]
call fcn.1400568e0
mov r8, qword [rbp - 0x21]
mov rdx, qword [rbp - 0x31]
sub r8, rdx
sar r8, 5
call fcn.140056760
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
movzx eax, byte [rbp - 0x10]
cmp al, 0x80
je 0x14008e063
mov dword [0x14045e748], 1
cmp al, 0xff
jne 0x14008e069
mov dword [0x14045e748], esi
lea rcx, [rbp + 7]
mov dword [rbp + 7], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0xf]
mov ebx, esi
movzx ecx, word [0x14045e53c]
mov qword [0x14045e750], rax
call fcn.14004f590
test eax, eax
js 0x14008e0a0
mov ecx, eax
call fcn.14004efb0
mov ebx, eax
mov rcx, qword [0x140443d80]
lea r9, [0x14045edd8]
movzx eax, word [0x14045e53c]
xor r8d, r8d
mov word [str.X:WindowsWinSxS], ax
xor edx, edx
mov dword [0x14045e758], ebx
movzx eax, word [rcx + 0x30]
mov word [str.X:WindowsSystem32cmd.exe], ax
movzx eax, byte [rcx + 0x30]
mov byte [str.X:Windowsexplorer.exe], al
movzx eax, word [rcx + 0x30]
lea rcx, [0x140332d58]
mov word [str.X:Windows_regedit.exe], ax
mov qword [0x14045edd8], rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x64
call fcn.14004f160
lea rcx, str.X:Windows_regedit.exe
mov dword [0x14045e74c], eax
call fcn.14004d940
lea r8, [rbp - 0x39]
mov dword [rbp - 0x19], esi
lea rdx, [rbp - 0x19]
mov dword [rbp - 0x39], esi
mov rcx, rax
call fcn.14004d820
mov ecx, dword [rbp - 0x39]
lea rdx, str.X:Windows_regedit.exe
mov r9d, dword [rbp - 0x19]
mov r8, rax
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], ecx
lea rcx, [rdi + 0x58]
call fcn.1400c5960
lea rcx, [rdi + 0xba0]
lea r8, str.X:Windows_regedit.exe
lea rdx, [0x140334408]
call fcn.1400c7cc0
lea rcx, [0x14045dcf8]
call fcn.14004d940
mov rcx, qword [0x14045f408]
mov edx, 3
mov qword [rdi + 0xe08], rax
call qword [sym.imp.USER32.dll_LoadIconW]
mov rcx, qword [0x14045f408]
mov edx, 2
mov qword [rdi + 0xce8], rax
call qword [sym.imp.USER32.dll_LoadIconW]
mov rcx, qword [rdi + 0xce8]
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
mov qword [rdi + 0xd78], rax
call fcn.14004d820
mov ecx, dword [rbp - 0x39]
lea rdx, [0x14045df10]
mov r9d, dword [rbp - 0x19]
mov r8, rax
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], ecx
lea rcx, [rdi + 0x58]
call fcn.1400c5960
lea rcx, [rdi + 0xcf0]
lea r8, [0x14045df10]
lea rdx, [0x1403343d0]
call fcn.1400c7cc0
mov rcx, qword [rdi + 0xd78]
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.14004d820
mov edx, dword [rbp - 0x39]
lea rcx, [rdi + 0x58]
mov r9d, dword [rbp - 0x19]
mov r8, rax
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], edx
lea rdx, [0x14045dd00]
call fcn.1400c5960
lea rcx, [rdi + 0xd80]
lea r8, [0x14045dd00]
lea rdx, [0x1403344c8]
call fcn.1400c7cc0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14012a2b0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret