Function at 0x140006920
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x14015d080]
xor rax, rsp
mov qword [rbp + 0xc0], rax
movzx r15d, dl
mov r13, rcx
mov qword [rsp + 0x58], rcx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov dword [rsp + 0x54], ecx
mov byte [rsp + 0x40], 0x60
mov al, 0x33
mov cl, Ordinal_26
mov dl, reloc.WS2_32.dll_send
mov r8b, reloc.WS2_32.dll_sendto
mov r9b, 5
mov r10b, reloc.WS2_32.dll_listen
mov r11b, 0x24
mov bl, reloc.WS2_32.dll_select
mov dil, 9
mov sil, reloc.WLDAP32.dll_Ordinal_22
movzx r14d, r9b
xor r12d, r12d
xor al, 0x60
mov byte [rsp + 0x41], al
xor cl, 0x60
mov byte [rsp + 0x42], cl
xor dl, 0x60
mov byte [rsp + 0x43], dl
xor r8b, 0x60
mov byte [rsp + 0x44], r8b
xor r9b, 0x60
mov byte [rsp + 0x45], r9b
xor r10b, 0x60
mov byte [rsp + 0x46], r10b
xor r11b, 0x60
mov byte [rsp + 0x47], r11b
xor bl, 0x60
mov byte [rsp + 0x48], bl
xor dil, 0x60
mov byte [rsp + 0x49], dil
xor sil, 0x60
mov byte [rsp + 0x4a], sil
xor r14b, 0x60
mov byte [rsp + 0x4b], r14b
mov byte [rsp + 0x4c], r12b
lea rcx, [rsp + 0x41]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
mov r12, 0xffffffffffffffff
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006a20
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140030ee0
nop
mov byte [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_60
mov al, 0x60
xor ecx, ecx
xor al, 0x3c
mov byte [rsp + 0x51], al
mov byte [rsp + 0x52], cl
lea rax, [rsp + 0x51]
mov r8, r12
inc r8
cmp byte [rax + r8], cl
jne 0x140006a52
lea rdx, [rsp + 0x51]
lea rcx, [rbp - 0x58]
call fcn.14002ca60
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x1401469b0]
mov qword [rbp - 0x30], rax
lea rcx, [rbp + 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x54], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x30], rdi
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x34], edx
lea rcx, [rbp - 0x28]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rbx, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp - 0x28], rbx
xor eax, eax
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x48], 4
mov dword [rbp - 0x60], eax
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rcx, qword [rbp - 0x58]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rdx, [0x140005740]
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp - 0x60]
shr edx, 0x10
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
movzx edx, word [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
test r15b, r15b
jne 0x140006ca9
mov byte [rsp + 0x40], 0x56
mov al, 0x64
mov cl, 0x61
mov dl, 0x33
mov r8b, reloc.WS2_32.dll_WSAGetLastError
mov r9b, 0x66
mov r10b, 0x34
movzx r11d, r9b
mov bl, WSAGetLastError
mov dil, 0x63
movzx esi, dil
movzx r14d, r8b
movzx r15d, al
xor r13d, r13d
xor al, 0x56
mov byte [rsp + 0x41], al
xor cl, 0x56
mov byte [rsp + 0x42], cl
xor dl, 0x56
mov byte [rsp + 0x43], dl
xor r8b, 0x56
mov byte [rsp + 0x44], r8b
xor r9b, 0x56
mov byte [rsp + 0x45], r9b
xor r10b, 0x56
mov byte [rsp + 0x46], r10b
xor r11b, 0x56
mov byte [rsp + 0x47], r11b
xor bl, 0x56
mov byte [rsp + 0x48], bl
xor dil, 0x56
mov byte [rsp + 0x49], dil
xor sil, 0x56
mov byte [rsp + 0x4a], sil
xor r14b, 0x56
mov byte [rsp + 0x4b], r14b
xor r15b, 0x56
mov byte [rsp + 0x4c], r15b
mov byte [rsp + 0x4d], r13b
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x28]
call fcn.14002eb20
nop
lea rax, [rsp + 0x41]
mov r13, qword [rsp + 0x58]
nop word [rax + rax]
inc r12
cmp byte [rax + r12], 0
jne 0x140006c10
mov r8, r12
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x80]
call fcn.14002ca60
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor ecx, ecx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rcx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], cl
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.14003e410
nop
lea rcx, [rbp - 0x80]
call fcn.14002ebf0
nop
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x30], rax
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x34], edx
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp - 0x28], rax
jmp 0x140006cd9
mov rdx, r13
lea rcx, [rbp - 0x28]
call fcn.14002eb20
nop
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x30], rdi
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x34], edx
mov qword [rbp - 0x28], rbx
lea rcx, [rbp - 0x28]
call fcn.14002ea70
lea rcx, [rbp - 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x58]
call fcn.14002ebf0
mov rax, r13
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400f0120
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret