Function at 0x69904d0d
Capabilities:
Get disk information
Get hostname
Get session user name

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5f8
lea rcx, [0x6990a79c]
mov rbx, rdx
lea rdi, [rsp + 0xcc]
mov dword [rsp + 0x94], 0
lea rbp, [rsp + 0x3ee]
call fcn.69905ab0
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0x94]
mov r12, rax
mov rcx, rax
lea r13, [rsp + 0x1ee]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea r14, [rsp + 0xbc]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rcx, r12
call fcn.69905b32
lea rdx, [rsp + 0x9c]
mov rcx, rdi
mov dword [rsp + 0x9c], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r8, [rsp + 0x98]
mov rdx, r13
mov ecx, 2
mov dword [rsp + 0x98], 0x100
mov word [rsp + 0x1ee], 0
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rdx, [rsp + 0xa0]
mov rcx, rbp
mov dword [rsp + 0xa0], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
or r8d, 0xffffffff
mov rcx, rbx
lea edx, [rax + rax]
call fcn.69901c90
xor eax, dword [rsp + 0x94]
or r8d, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0x9c]
lea edx, [rax + rax]
call fcn.69901c90
or r8d, 0xffffffff
mov rcx, rbp
mov esi, eax
mov eax, dword [rsp + 0xa0]
lea edx, [rax + rax]
call fcn.69901c90
mov rcx, r14
xor esi, eax
mov dword [rsp + 0xb4], esi
call fcn.69904e80
lea rcx, [0x699090e0]
call fcn.69905a30
lea rcx, [0x69909020]
mov r12, rax
call fcn.69905ab0
mov qword [rsp + 0x38], r12
mov r9, rdi
mov r8, r13
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xac]
lea rcx, [rsp + 0xb0]
mov rdx, r14
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
call fcn.699024c4
mov qword [rsp + 0x68], rax
test rax, rax
je 0x699048cd
mov edx, dword [rsp + 0xac]
mov rcx, rax
call fcn.69902443
mov r13, rax
test rax, rax
je 0x699048c3
xor esi, esi
lea rbp, [0x6990a7ac]
lea rcx, [0x69909160]
call fcn.69905ab0
lea rcx, [0x69909120]
mov r14, rax
call fcn.69905ab0
cmp dword [section..data], 0
mov qword [rsp + 0x28], r13
mov rcx, r14
mov r15, rax
mov eax, 1
mov dword [rsp + 0x38], 0
movzx r8d, word [0x69909004]
cmovne esi, eax
mov qword [rsp + 0x20], rbp
mov r9d, 1
mov rdx, r15
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x40], rax
call fcn.69901cd0
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x60], rax
test rax, rax
je 0x69904845
cmp dword [rsp + 0xa4], 4
jbe 0x69904845
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
mov rdx, r12
repne scasb al, byte [rdi]
lea r10, [rsp + 0xec]
mov qword [rsp + 0x70], r10
not rcx
lea r8, [rcx - 1]
mov rcx, r10
call fcn.69905170
mov r8, qword [rsp + 0x60]
mov r10, qword [rsp + 0x70]
mov r9d, dword [rsp + 0xa4]
mov rdx, r8
mov rcx, r10
call fcn.699051c5
mov eax, dword [rsp + 0xa4]
xor r8d, r8d
lea edx, [rax - 4]
mov rax, qword [rsp + 0x60]
lea rcx, [rax + 4]
call fcn.69901c90
mov rbx, qword [rsp + 0x60]
cmp eax, dword [rbx]
jne 0x6990483b
mov eax, dword [rbx + 4]
mov dword [rsp + 0x70], 0
lea rbx, [rbx + 8]
mov dword [rsp + 0x84], eax
mov edi, dword [rsp + 0x84]
cmp dword [rsp + 0x70], edi
je 0x6990483b
mov edx, dword [rbx]
lea eax, [rdx - 1]
cmp eax, 0xa
ja case.0x699044e5.9
lea rdi, [0x6990a820]
movsxd rax, dword [rdi + rax*4]
add rax, rdi
jmp rax
lea rax, [rsp + 0xac]
mov edx, dword [rbx + 4]
mov r9d, 1
mov r8, r12
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
call fcn.6990274f
jmp 0x69904671
lea rax, [rsp + 0xac]
mov edx, dword [rbx + 4]
mov r9d, 1
mov r8, r12
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
call fcn.69902ad1
jmp 0x69904671
lea rax, [rsp + 0xac]
mov edx, dword [rbx + 4]
mov r9d, 1
mov r8, r12
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
call fcn.69903053
jmp 0x69904671
lea rax, [rsp + 0xac]
mov edx, dword [rbx + 4]
lea rdi, [rbx + 0x10]
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xb0]
mov r9, r12
mov r8, rdi
call fcn.69903721
mov rbx, rax
test rax, rax
je 0x6990482f
mov dword [rsp + 0x48], esi
mov rcx, r14
mov r9d, 2
mov rdx, r15
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rbx
movzx r8d, word [0x69909004]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xac]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x20], rbp
call fcn.69901cd0
mov rcx, rax
test rax, rax
je 0x699045f4
call fcn.69904e58
mov rcx, rbx
call fcn.69904e58
jmp 0x6990482f
lea r8, [rsp + 0xac]
mov eax, dword [rbx + 0x10]
mov edx, dword [rbx + 4]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], r8
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x28], r12
mov r8d, dword [rbx + 0x14]
lea r9, [rbx + rax - 8]
mov dword [rsp + 0x20], r8d
lea r8, [rbx + 0x18]
call fcn.6990323b
jmp 0x69904741
lea rax, [rsp + 0xac]
mov edx, dword [rbx + 4]
mov r9, r12
lea r8, [rbx + 0x10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0x20], 1
call fcn.6990349c
mov rdi, rax
test rax, rax
je 0x69904810
mov dword [rsp + 0x48], esi
mov rcx, r14
mov r9d, 2
mov rdx, r15
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rdi
movzx r8d, word [0x69909004]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xac]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x20], rbp
call fcn.69901cd0
mov rcx, rax
test rax, rax
je 0x699046ce
call fcn.69904e58
mov rcx, rdi
call fcn.69904e58
jmp 0x69904810
lea r9, [rsp + 0xac]
mov eax, dword [rbx + 8]
mov r8d, dword [rbx + 4]
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x50], r9
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x40], r12
mov r9d, dword [rbx + 0x24]
mov dword [rsp + 0x38], r9d
mov r9d, dword [rbx + 0x20]
lea r9, [rbx + r9 - 8]
mov qword [rsp + 0x30], r9
mov r9d, dword [rbx + 0x18]
lea r9, [rbx + r9 - 8]
mov qword [rsp + 0x28], r9
mov r9d, dword [rbx + 0x10]
lea r9, [rbx + r9 - 8]
mov qword [rsp + 0x20], r9
lea r9, [rbx + rax - 8]
call fcn.69903bea
mov rdi, rax
test rax, rax
je 0x699047a2
mov dword [rsp + 0x48], esi
mov rcx, r14
mov r9d, 2
mov rdx, r15
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rdi
movzx r8d, word [0x69909004]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xac]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x20], rbp
call fcn.69901cd0
mov rcx, rax
test rax, rax
je 0x6990479a
call fcn.69904e58
mov rcx, rdi
call fcn.69904e58
lea rdi, [rbx + 0x10]
jmp 0x6990482f
lea rcx, [0x6990a7b0]
call fcn.69905a30
lea rcx, [0x6990a7be]
mov rdi, rax
call fcn.69905a30
mov r8d, dword [rbx + 0xc]
mov ecx, 2
lea r9, [0x6990a3d0]
mov r10, rax
mov eax, dword [rbx + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], r10
lea rdx, [rbx + rax - 8]
mov qword [rsp + 0x88], r10
call fcn.69905c9d
mov rcx, rdi
call fcn.69905b32
mov r10, qword [rsp + 0x88]
mov rcx, r10
call fcn.69905b32
lea rdi, [rbx + 8]
jmp 0x6990482f
call fcn.69904091
lea rdi, [rbx + 8]
mov dword [rsp + 0x80], 1
jmp 0x6990482f
mov rdi, rbx
inc dword [rsp + 0x70]
mov rbx, rdi
jmp 0x699044b8
mov rcx, qword [rsp + 0x60]
call fcn.69904e58
mov rcx, r15
call fcn.69905b32
mov rcx, r14
call fcn.69905b32
lea rcx, [0x6990a7ce]
call fcn.69905ab0
mov ecx, 0x100000
xor edx, edx
mov r14, rax
mov r8, rax
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rcx, rax
test rax, rax
je 0x6990488d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x80], 1
mov rcx, r14
call fcn.69905b32
cmp dword [rsp + 0x80], 0
jne 0x699048bb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
lea ecx, [rax + 0xbb8]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x6990439a
mov rcx, r13
call fcn.69904e58
mov rcx, qword [rsp + 0x68]
call fcn.69904e58
mov rcx, qword [rsp + 0x78]
call fcn.69905b32
mov rcx, r12
call fcn.69905b32
nop
add rsp, 0x5f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov r13, rdx
call fcn.69906b5e
test eax, eax
je 0x69904d37
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp 0x699041ac
mov rcx, r12
call fcn.69904b91
test eax, eax
je 0x69904d24
add rsp, 0x28
pop r12
pop r13
ret