Function at 0x140043af0
Capabilities:
Get disk information
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x250], rax
movzx esi, cl
xor r13d, r13d
mov dword [rsp + 0x58], r13d
lea rdx, [rbp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x140037d65
xor dil, dil
test sil, sil
jne 0x1400377a6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r13 + 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._NTFS_Scanner__Running_checks_for_important_file_modifications..._n
call fcn.140031cf0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, ds:[r13 + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Scanning_macro_traces_may_be_useless_in_1.9_servers._Do_you_want_to_scan_macro_traces___y_n_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140037e40
movzx eax, byte ds:[rsp + 0x40]
sub al, 0x59
test al, 0xdf
sete r12b
lea rbx, [rbp + 0x30]
cmp byte [rbp + 0x30], dil
je 0x1400379f4
nop word [rax + rax]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r13b
jne 0x1400377f7
cmp rax, 3
jne 0x140037875
cmp byte [rbx + 1], 0x3a
jne 0x140037875
cmp byte [rbx + 2], 0x5c
jne 0x140037875
mov dword [rsp + 0x38], 0x104
lea rax, [rbp + 0x140]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x140037875
lea rdx, str.NTFS
lea rcx, [rbp + 0x140]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
nop
test eax, eax
jne 0x140037872
movzx edx, r12b
movzx ecx, byte [rbx]
call fcn.1400371c0
jmp 0x140037875
mov dil, 1
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], r13b
jne 0x140037880
inc rbx
add rbx, rax
cmp byte [rbx], r13b
jne 0x1400377f0
nop dword [rax + rax]
test dil, dil
je 0x1400379f4
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
imul rax, rbx, 0x2710
mov rcx, qword [rbp - 0x80]
sub rcx, rax
mov qword [rsp + 0x60], rcx
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r8, [0x1400594f0]
lea rdx, [0x140059558]
lea rcx, ds:[rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x140037ab5
lea r8, [0x1400594f0]
lea rdx, [0x1400595b0]
lea rcx, [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x140037ab5
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.140036cc0
lea r8, ds:[rsp + 0x50]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x78]
call fcn.140036cc0
mov byte [rsp + 0x20], sil
mov esi, dword [rsp + 0x50]
mov r9d, esi
mov r8, qword [rsp + 0x48]
mov edi, dword [rsp + 0x54]
mov edx, edi
mov r14, qword [rsp + 0x68]
mov rcx, r14
call fcn.140036f00
test edi, edi
jle 0x1400379a6
mov rbx, r14
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rbx, ds:[rbx + 8]
sub rdi, 1
jne 0x140037990
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test esi, esi
jle 0x1400379d3
mov rbx, qword [rsp + 0x48]
mov rdi, rsi
nop dword [rax + rax]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rbx, [rbx + 8]
sub rdi, 1
jne 0x1400379c0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x18]
call fcn.140036ba0
nop
lea rsi, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rsi, qword [rbp - 0x18]
mov rdi, qword [rbp - 8]
call fcn.14004787c
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movdqa xmm1, xmmword [0x14005c330]
movdqu xmmword [rbp - 0x68], xmm1
mov byte [rbp - 0x78], 0
mov dword [rsp + 0x58], 0x10
test rdi, rdi
je 0x140037b08
nop word [rax + rax]
cmp rdi, 0x7fffffff
ja 0x140037da8
mov dword ss:[rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.1400478ec
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140037dae
movsxd rdx, ebx
cmp rdx, qword [rbp - 0x68]
ja 0x140037ac7
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rax, qword [rbp - 0x78]
mov qword [rbp - 0x68], rdx
mov byte [rax + rdx], 0
jmp 0x140037ad7
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lfence
sub rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x78]
call fcn.140006060
lea r9, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae r9, qword [rbp - 0x78]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.1400478ec
shr rax, 0x20
test eax, eax
jne 0x140037db6
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov r9, qword [rbp - 0x68]
add r9, rdx
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rax, qword [rbp - 0x78]
cmp rax, r9
je 0x140037b45
cmp byte [rax], 0x5c
jne 0x140037b38
mov byte [rax], 0x2f
inc rax
cmp rax, r9
jne 0x140037b30
lea rdx, str.File_modifications_were_exported_to:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b5c0
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x68]
mov rcx, rax
call fcn.140031840
lea rdx, [0x140010640]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.Order_the_folder_by__Date_modified__and_open_the_most_recent__.txt__files_to_check_all_important_modifications._n
call fcn.140031cf0
lea rcx, str.You_should_ban_the_user_if_you_find_a_modification_made_just_before_the_Screenshare._n
call fcn.140031cf0
nop
test r12b, r12b
je 0x140037bb1
lea rcx, str.In_the_case_of_the_logitech.txt_file__only_ban_if_this_modification_is_exactly_settings.db._n
call fcn.140031cf0
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov r8d, 0x15
lea rdx, str.new_renamed_files.txt
lea rcx, [rbp - 0x58]
call fcn.140006d20
nop
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
call fcn.140047f4c
shr rax, 0x20
test eax, eax
jne 0x140037dbe
mov rdx, qword ds:[rbp - 0x40]
cmp rdx, 8
jb 0x140037c3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037c3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037c3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
mov r8d, 0x15
lea rdx, str.old_renamed_files.txt
lea rcx, [rbp - 0x38]
call fcn.140006d20
nop
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
call fcn.140047f4c
shr rax, 0x20
test eax, eax
jne 0x140037d95
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140037ccd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037cc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037cc7
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140037d0c
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037d07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037d07
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
movdqa xmm0, xmmword [0x14005c330]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x140037d65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037d5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037d5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
nop dword [rax + rax]
call fcn.140048710
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1400486f0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
lea r8, [rbp - 0x38]
mov edx, eax
lea rcx, [0x140056d10]
call fcn.14000a180
nop
call fcn.140004560
int3
mov ecx, eax
call fcn.140004860
int3
mov ecx, eax
call fcn.140004860
nop
lea r8, [rbp - 0x58]
mov edx, eax
lea rcx, [0x140056d10]
call fcn.14000a180
int3
movzx ecx, dl
jmp 0x140037700