Function at 0x18001a510
Capabilities:
Get disk information
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180040030]
xor rax, rsp
mov qword [rbp + 0x20], rax
movzx edx, word [0x180035b9a]
lea rsi, [0x180041458]
movzx r10d, word [0x180035b98]
mov edi, 0x2d
movzx eax, word [str.OTCIMV2]
xor r14d, r14d
xor dx, di
mov dword [rsp + 0x38], r14d
xor dx, di
mov qword [rsp + 0x30], r14
movzx ecx, di
mov word [rsp + 0x5c], dx
lea r8d, [r14 + 0x17]
mov qword [rsp + 0x28], r14
xor r8w, di
mov word [rsp + 0x50], di
xor cx, di
mov word [rsp + 0x54], r8w
lea r9d, [r14 + 0x71]
mov word [rsp + 0x58], cx
xor r9w, di
mov word [rsp + 0x60], r14w
xor r10w, di
mov word [rsp + 0x56], r9w
xor ax, di
mov qword [rsp + 0x20], r14
xor r10w, di
lea ebx, [rdi + 0x41]
xor ax, di
mov word [rsp + 0x5a], r10w
xor bx, di
mov word [rsp + 0x5e], ax
lea r9, [rbp - 0x80]
mov word [rsp + 0x52], bx
xor r8d, r8d
lea rcx, [rsp + 0x52]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x18001a676
mov cl, 0x6c
mov byte [rsp + 0x50], 0x1e
movzx r8d, cl
mov qword [0x180041468], r14
xor r8b, 0x1e
mov qword [0x180041470], r14
movzx edx, cl
mov byte [rsp + 0x55], r8b
mov al, 0x5b
xor dl, 0x1e
xor al, 0x1e
mov byte [rsp + 0x53], dl
xor r10d, r10d
mov byte [rsp + 0x51], al
xor cl, 0x1e
mov byte [rsp + 0x57], r10b
mov bl, 0x71
mov byte [rsp + 0x52], cl
xor bl, 0x1e
lea rax, [rsp + 0x51]
mov r9b, 0x2f
mov byte [rsp + 0x54], bl
xor r9b, 0x1e
xorps xmm0, xmm0
mov byte [rsp + 0x56], r9b
mov r8, 0xffffffffffffffff
movups xmmword [0x180041458], xmm0
inc r8
cmp byte [rax + r8], r10b
jne 0x18001a663
lea rdx, [rsp + 0x51]
jmp 0x18001a84d
lea rdx, [rsp + 0x7c]
mov dword [rsp + 0x7c], 0x10
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x18001a720
mov cl, 0x29
mov byte [rsp + 0x50], 0x5b
movzx r8d, cl
mov qword [0x180041468], r14
xor r8b, 0x5b
mov qword [0x180041470], r14
movzx edx, cl
mov byte [rsp + 0x55], r8b
mov al, 0x1e
xor dl, 0x5b
xor al, 0x5b
mov byte [rsp + 0x53], dl
xor r10d, r10d
mov byte [rsp + 0x51], al
xor cl, 0x5b
mov byte [rsp + 0x57], r10b
mov bl, 0x34
mov byte [rsp + 0x52], cl
xor bl, 0x5b
lea rax, [rsp + 0x51]
mov r9b, 0x69
mov byte [rsp + 0x54], bl
xor r9b, 0x5b
xorps xmm0, xmm0
mov byte [rsp + 0x56], r9b
mov r8, 0xffffffffffffffff
movups xmmword [0x180041458], xmm0
inc r8
cmp byte [rax + r8], r10b
jne 0x18001a703
lea rdx, [rsp + 0x51]
jmp 0x18001a84d
movdqa xmm1, xmmword [str.M6hu]
lea r8, [rsp + 0x51]
movdqa xmm2, xmmword [0x1800373d0]
xor ecx, ecx
mov r9d, dword [rbp - 0x80]
mov eax, 1
movdqu xmmword [rsp + 0x60], xmm2
cpuid
mov dword [rsp + 0x50], eax
movdqa xmm0, xmm1
mov dword [rsp + 0x58], ecx
movd ecx, xmm1
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], r9d
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
mov dword [rsp + 0x5c], edx
mov edx, 0x64
psrldq xmm0, 1
movd eax, xmm0
mov dword [rsp + 0x54], r14d
movdqu xmmword [rsp + 0x50], xmm1
xor byte [rsp + 0x52], cl
xor al, cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
mov byte [rsp + 0x51], al
movd eax, xmm2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
xor al, cl
mov byte [rsp + 0x70], r14b
lea rcx, [rbp - 0x50]
mov byte [rsp + 0x60], al
mov dword [rsp + 0x20], ebx
call fcn.180016420
xorps xmm0, xmm0
mov qword [0x180041468], r14
movups xmmword [0x180041458], xmm0
mov qword [0x180041470], r14
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r14b
jne 0x18001a840
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1800053f0
mov rax, rsi
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180030770
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret