Function at 0x1400cc2b0
Capabilities:
Create thread
Get common file path
Get disk information
Get disk size
Get file attributes
Get file system object information
Get hostname
Get memory capacity

Disassembly:
push rbp
push rbx
push rsi
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.140057430
sub rsp, rax
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0x1150], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x12c0]
mov r9d, 2
or r8, 0xffffffffffffffff
mov edx, 0x100c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
cmp eax, 0xffffffff
je 0x1400cbe8b
mov rcx, qword [rbx + 0xa50]
mov qword [rsp + 0x12a8], rdi
mov edi, 0x104
mov r10, qword [rcx]
lea r9, [rbp + 0xb40]
mov r8d, edi
mov edx, eax
mov qword [rsp + 0x12b0], r12
call qword [r10 + 0x80]
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0xb40]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0xa50]
lea r8, [rbp + 0x530]
mov rax, qword [rcx]
mov edx, esi
call qword [rax + 0x60]
mov rcx, qword [rbx + 0xa50]
mov rax, qword [rcx]
call qword [rax + 0x120]
mov rcx, qword [rbx + 0xa50]
lea r8, [rbp + 0x530]
test eax, eax
mov rax, qword [rcx]
mov edx, esi
jne 0x1400cbea5
mov qword [rsp + 0x1278], r13
mov qword [rsp + 0x1270], r14
call qword [rax + 0x60]
mov rcx, qword [rbx + 0xa50]
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0x108]
lea rcx, [rbp + 0x530]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r12d, r12d
mov r14d, eax
and r14d, 0x10
je 0x1400cba38
cmp dword [rbx + 0xed78], r12d
je 0x1400cba38
mov ecx, 0x218
call fcn.14004af90
mov rsi, rax
test rax, rax
je 0x1400cba78
lea ecx, [r12 + 0x10]
call fcn.14004af90
test rax, rax
je 0x1400cba2e
mov qword [rax], rbx
mov ecx, dword [rbx + 0xf310]
lea rdx, [rbp + 0x530]
mov dword [rax + 8], ecx
mov qword [rsi + 0x208], rax
lea rax, [0x1400c9510]
mov rcx, rsi
sub rdx, rsi
mov qword [rsi + 0x210], rax
nop dword [rax]
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x1400cb8f3
movzx eax, word [rdx + rcx]
test ax, ax
je 0x1400cb8f3
mov word [rcx], ax
add rcx, 2
dec rdi
jne 0x1400cb8d0
jmp 0x1400cb8f8
test rdi, rdi
jne 0x1400cb8fc
sub rcx, 2
mov word [rcx], r12w
mov rcx, qword [0x1401495b0]
lea r8, [rbp + 0x2a0]
mov r9d, 0x40
mov edx, 0x1ff6
call qword [sym.imp.USER32.dll_LoadStringW]
mov rcx, qword [0x1401495b0]
lea r8, [rbp + 0x220]
mov r9d, 0x40
mov edx, 0x2018
call qword [sym.imp.USER32.dll_LoadStringW]
lea r11, [rbp + 0x220]
lea r9, [rbp + 0x2a0]
lea r8, [0x14010be20]
lea rcx, [rbp + 0x320]
mov edx, pe_nt_image_headers64
mov qword [rsp + 0x20], r11
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x320]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rbx + 0xf2f8]
mov r11d, dword [rbx + 0xf310]
mov eax, dword [rbx + 0x1b88]
mov rdx, qword [rdi + 8]
lea r8, [rsp + 0x48]
mov rcx, rdi
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], 1
call fcn.140017f40
movabs rcx, 0x1555555555555554
mov r11, rax
mov rax, qword [rbx + 0xf300]
sub rcx, rax
cmp rcx, 1
jae 0x1400cb9e5
lea rcx, str.list_T__too_long
call fcn.14002ba2c
int3
inc rax
lea r8, [0x1400eac10]
mov r9, rsi
mov qword [rbx + 0xf300], rax
mov qword [rdi + 8], r11
mov rax, qword [r11 + 8]
mov qword [rax], r11
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [rbx + 0xf310]
jmp 0x1400cba78
mov rcx, rsi
call fcn.14004b048
jmp 0x1400cba78
mov edx, dword [r13]
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0x530]
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x410
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x178]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [r13 + 0x14]
test rcx, rcx
je 0x1400cba9a
mov r9d, dword [rbx + 0xee20]
lea rdx, [rbp + 0x740]
mov r8d, pe_nt_image_headers64
call fcn.1400974f0
mov rcx, qword [0x1401495b0]
lea r8, [rbp + 0x940]
mov r9d, pe_nt_image_headers64
mov edx, 0x2015
call qword [sym.imp.USER32.dll_LoadStringW]
lea r11, [rbp + 0x740]
lea r9, [rbp + 0x940]
lea r8, [0x14010be30]
lea rcx, [rbp + 0xd50]
mov edx, 0x200
mov qword [rsp + 0x20], r11
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0xd50]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp + 0x530]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test rax, rax
je 0x1400cbd93
lea rsi, [rax + 2]
test rsi, rsi
je 0x1400cbd93
lea rdi, [0x140146c70]
lea r13, [0x140146cc0]
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400cbb4f
add rdi, 8
cmp rdi, r13
jl 0x1400cbb31
jmp 0x1400cbd93
mov esi, ILCombine
mov ecx, esi
call qword [sym.imp.gdiplus.dll_GdipAlloc]
mov rdi, rax
test rax, rax
je 0x1400cbb87
lea rdx, [rdi + 8]
lea rax, vtable.Gdiplus::Image.0
lea rcx, [rbp + 0x530]
mov qword [rdx], r12
mov qword [rdi], rax
call qword [sym.imp.gdiplus.dll_GdipLoadImageFromFile]
mov dword [rdi + 0x10], eax
jmp 0x1400cbb8a
mov rdi, r12
mov eax, dword [rdi + 0x10]
mov dword [rdi + 0x10], r12d
test eax, eax
jne 0x1400cbd86
mov rcx, rdi
movaps xmmword [rsp + 0x1260], xmm6
call fcn.140018070
lea r8, str.Width:__u_pixels
lea rcx, [rbp + 0x320]
mov r9d, eax
mov edx, pe_nt_image_headers64
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x320]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.140018030
lea r8, str.Height:__u_pixels
lea rcx, [rbp + 0x320]
mov r9d, eax
mov edx, pe_nt_image_headers64
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x320]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.gdiplus.dll_GdipGetImagePixelFormat]
test eax, eax
je 0x1400cbc35
mov dword [rdi + 0x10], eax
mov eax, dword [rsp + 0x40]
cmp eax, 0x61007
jg 0x1400cbdf5
je 0x1400cbe21
cmp eax, 0x30101
jg 0x1400cbdd3
je 0x1400cbdc9
cmp eax, 0x21005
jl 0x1400cbe3d
cmp eax, 0x21006
jle 0x1400cbe21
cmp eax, 0x21808
je 0x1400cbc88
cmp eax, 0x22009
jne 0x1400cbe3d
mov esi, 0x20
lea r8, str.Bit_depth:__u
lea rcx, [rbp + 0x320]
mov r9d, esi
mov edx, pe_nt_image_headers64
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x320]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
xorps xmm6, xmm6
movss dword [rsp + 0x40], xmm6
call qword [sym.imp.gdiplus.dll_GdipGetImageHorizontalResolution]
test eax, eax
je 0x1400cbcde
mov dword [rdi + 0x10], eax
movd xmm3, dword [rsp + 0x40]
lea r8, str.Horizontal_resolution:__.0f_dpi
lea rcx, [rbp + 0x320]
mov edx, pe_nt_image_headers64
cvtps2pd xmm3, xmm3
movq r9, xmm3
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x320]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
movss dword [rsp + 0x40], xmm6
call qword [sym.imp.gdiplus.dll_GdipGetImageVerticalResolution]
movaps xmm6, xmmword [rsp + 0x1260]
test eax, eax
je 0x1400cbd44
mov dword [rdi + 0x10], eax
movd xmm3, dword [rsp + 0x40]
lea r8, str.Vertical_resolution:__.0f_dpi
lea rcx, [rbp + 0x320]
mov edx, pe_nt_image_headers64
cvtps2pd xmm3, xmm3
movq r9, xmm3
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x320]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
cmp r14d, 0x10
je 0x1400cbe4f
cmp dword [rbx + 0xeda8], r12d
je 0x1400cbe4f
cmp dword [rbx + 0xed54], r12d
je 0x1400cbe4f
mov r9d, 1
lea r8, [rbp + 0x530]
jmp 0x1400cbe59
mov esi, 1
jmp 0x1400cbc88
cmp eax, 0x30402
je 0x1400cbdeb
cmp eax, 0x30803
jne 0x1400cbe3d
mov esi, 8
jmp 0x1400cbc88
mov esi, 4
jmp 0x1400cbc88
cmp eax, 0x1c400e
jg 0x1400cbe2b
je 0x1400cbe45
cmp eax, 0xe200b
je 0x1400cbc83
cmp eax, 0x101004
je 0x1400cbe21
cmp eax, 0x10300c
jne 0x1400cbe3d
mov esi, 0x30
jmp 0x1400cbc88
mov esi, reloc.SHELL32.dll_ILFindLastID
jmp 0x1400cbc88
cmp eax, 0x26200a
je 0x1400cbc83
cmp eax, 0x34400d
je 0x1400cbe45
mov esi, r12d
jmp 0x1400cbc88
mov esi, 0x40
jmp 0x1400cbc88
xor r9d, r9d
lea r8, [0x1401042bc]
mov rcx, qword [rbx + 0x80]
mov edx, 0x8066
call qword [sym.imp.USER32.dll_SendMessageW]
mov r13, qword [rsp + 0x1278]
mov r14, qword [rsp + 0x1270]
mov rdi, qword [rsp + 0x12a8]
mov r12, qword [rsp + 0x12b0]
mov rcx, qword [rbp + 0x1150]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x1280
pop rsi
pop rbx
pop rbp
ret
call qword [rax + 0x60]
lea rcx, [rbp + 0x530]
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x1400cbe7b
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rcx, [rbp + 0x530]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor r12d, r12d
test eax, eax
je 0x1400cbf8f
mov rcx, qword [rsp + 0x40]
lea r8d, [r12 + 0x20]
lea rdx, [rbp + 0x2a0]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
call fcn.140097d30
lea r9, [rbp + 0x2a0]
lea r8, str.Free_Space:__s
lea edx, [r12 + 0x40]
lea rcx, [rbp + 0x220]
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x220]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x48]
lea r8d, [r12 + 0x20]
lea rdx, [rbp + 0x2a0]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
call fcn.140097d30
lea r9, [rbp + 0x2a0]
lea r8, str.Total_Size:__s
lea edx, [r12 + 0x40]
lea rcx, [rbp + 0x220]
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x220]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x38], 0x105
lea rax, [rbp + 0x320]
lea rcx, [rbp + 0x530]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1400cbe7b
lea r9, [rbp + 0x320]
lea r8, str.File_System:__s
lea rcx, [rbp + 0x220]
mov edx, 0x40
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x220]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400cbe7b
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xf30]
mov eax, 0x1030
call fcn.140057430
sub rsp, rax
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0xf20], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x80]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8074
mov qword [rsp + 0x38], 0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x80]
lea r8, [0x14010426c]
xor r9d, r9d
mov edx, 0x8066
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0xa50]
lea r8, [rbp + 0x700]
mov rax, qword [rcx]
mov edx, 0x104
call qword [rax + 0x68]
mov rcx, qword [rbx + 0xa50]
mov rax, qword [rcx]
call qword [rax + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdi, rax
lea rax, [rsp + 0x38]
lea edx, [r9 + 0x11]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rdx, qword [rsp + 0x38]
mov rcx, rdi
call fcn.140092a30
test eax, eax
je 0x1400cc1e1
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x300]
mov dword [rsp + 0x30], 0x200
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x300]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp + 0x240]
call fcn.140095f20
lea rax, [rbp + 0x280]
lea r8, [rbp + 0x240]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], Shell_GetImageLists
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r9, [rbp + 0x280]
lea r8, str.Processor:__s
lea rcx, [rbp + 0x300]
mov edx, 0x200
call section..text
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x300]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x40]
mov dword [rsp + Shell_GetImageLists], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0xb20]
xor r9d, r9d
mov r8d, 0x200
mov dword [rsp + 0x20], 0
call fcn.140097d30
lea r9, [rbp + 0xb20]
lea r8, str.Memory:__s
lea rcx, [rbp + 0x300]
mov edx, 0x200
call section..text
lea r9, [rbp + 0x300]
jmp 0x1400cc261
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x700]
mov qword [rsp + 0x30], 0
call fcn.140094590
test eax, eax
js 0x1400cc216
mov rcx, qword [rsp + 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbx + 0x80]
lea r9, [rbp + 0x910]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, [rbp - 0x80]
mov r9d, 0x2b8
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], 0x408
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea r9, [rbp + 0x198]
mov rcx, qword [rbx + 0x80]
xor r8d, r8d
mov edx, 0x8073
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0xf20]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x80]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8074
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0xa50]
mov rax, qword [rcx]
call qword [rax + 0x248]
test eax, eax
jne 0x1400cc2f2
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400cc010
cmp eax, 1
jne 0x1400cc304
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400cb740
jle 0x1400cc30e
mov rcx, rbx
call fcn.1400cb550
add rsp, 0x20
pop rbx
ret