Function at 0x140083080
Capabilities:
Create process on windows
Enumerate files on windows
Get disk information

Disassembly:
jmp 0x140083080
push rbp
push rsi
push rdi
sub rsp, 0xa80
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1d4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140289140]
xor rax, rbp
mov qword [rbp + 0xa48], rax
lea rcx, [0x1402ac2b2]
call fcn.140007f72
nop
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.140007973
lea rcx, [rbp + 0x8a4]
call fcn.140005669
mov qword [rbp + 0xa38], rax
lea rdx, str.AyuGram_Desktop
lea rcx, [rbp + 0x9e0]
call fcn.1400034d6
nop
lea rdx, str.Telegram_Desktop
lea rcx, [rbp + 0xa08]
call fcn.1400034d6
nop
lea rax, [rbp + 0xa30]
mov r8, rax
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x8c8]
call fcn.140004327
lea rcx, [rbp + 0x8f8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x9b0]
lea rcx, [rbp + 0x8f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp + 0xa38]
lea rdx, [rbp + 0x9b0]
lea rcx, [rbp + 8]
call fcn.1400055e2
nop
lea r9, [fcn.140006e79]
mov r8d, 2
mov edx, 0x28
lea rcx, [rbp + 0x9e0]
call fcn.140002b7b
nop
lea rax, [rbp + 0x48]
lea rcx, [0x14022c768]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x36
rep movsb byte [rdi], byte [rsi]
lea rdx, [0x14022c7a8]
lea rcx, [rbp + 0x98]
call fcn.1400034d6
nop
lea rax, [rbp + 0x48]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0xd8]
add rax, 0x36
mov qword [rbp + 0x118], rax
jmp 0x1400831f6
mov rax, qword [rbp + 0xf8]
add rax, 2
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0x118]
cmp qword [rbp + 0xf8], rax
je 0x14008362b
mov rax, qword [rbp + 0xf8]
movzx eax, word [rax]
mov word [rbp + 0x134], ax
lea r8, [rbp + 0x98]
movzx edx, word [rbp + 0x134]
lea rcx, [rbp + 0x158]
call fcn.140004345
nop
lea rcx, [rbp + 0x158]
call fcn.14000355d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x14008325f
lea rcx, [rbp + 0x158]
call fcn.140006e79
nop
jmp 0x1400831e4
lea rdx, [0x14022c828]
lea rcx, [0x14028c730]
call fcn.14000485e
lea rdx, [rbp + 0x158]
mov rcx, rax
call fcn.140004e71
mov qword [rbp + 0xa38], rax
lea rdx, [0x14000452a]
mov rcx, qword [rbp + 0xa38]
call fcn.1400066fe
nop
mov edx, 0x28
lea rcx, [rbp + 0x198]
call fcn.140006730
lea rcx, [rbp + 0x198]
call fcn.14000366b
nop
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x198]
call fcn.1400064bf
nop
lea rcx, [rbp + 0x198]
call fcn.140001e0b
movzx eax, al
test eax, eax
jne 0x14008360c
lea rcx, [rbp + 0x198]
call fcn.14000501f
mov rdx, rax
lea rcx, [rbp + 0x1d8]
call fcn.1400011b8
nop
lea rcx, [rbp + 0x198]
call fcn.140002b94
nop
lea r8, [0x14022c074]
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x928]
call fcn.140007063
mov qword [rbp + 0xa38], rax
mov rcx, qword [rbp + 0xa38]
call fcn.14000355d
lea rdx, [rbp + 0x220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x488], rax
lea rcx, [rbp + 0x928]
call fcn.140006e79
nop
cmp qword [rbp + 0x488], 0xffffffffffffffff
jne 0x14008337b
lea rcx, [rbp + 0x1d8]
call fcn.140006e79
nop
jmp 0x1400832ce
lea rdx, [rbp + 0x24c]
lea rcx, [rbp + 0x4a8]
call fcn.1400034d6
nop
lea rdx, [0x14022c020]
lea rcx, [rbp + 0x4a8]
call fcn.14000358f
movzx eax, al
test eax, eax
jne 0x1400833c3
lea rdx, [0x14022c024]
lea rcx, [rbp + 0x4a8]
call fcn.14000358f
movzx eax, al
test eax, eax
je 0x1400833d5
lea rcx, [rbp + 0x4a8]
call fcn.140006e79
nop
jmp 0x1400835d0
lea r8, [rbp + 0x4a8]
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x4e8]
call fcn.140005781
nop
mov eax, dword [rbp + 0x220]
and eax, 0x10
test eax, eax
je 0x1400835b6
lea rax, [rbp + 8]
mov qword [rbp + 0x528], rax
mov rcx, qword [rbp + 0x528]
call fcn.140005f33
mov qword [rbp + 0x548], rax
mov rcx, qword [rbp + 0x528]
call fcn.140005e89
mov qword [rbp + 0x568], rax
jmp 0x140083446
mov rax, qword [rbp + 0x548]
add rax, 0x28
mov qword [rbp + 0x548], rax
mov rax, qword [rbp + 0x568]
cmp qword [rbp + 0x548], rax
je 0x140083566
mov rax, qword [rbp + 0x548]
mov qword [rbp + 0x588], rax
mov rdx, qword [rbp + 0x588]
lea rcx, [rbp + 0x4a8]
call fcn.140002bad
movzx eax, al
test eax, eax
je 0x140083561
lea rdx, [0x14022c860]
lea rcx, [0x14028c730]
call fcn.14000485e
lea rdx, [rbp + 0x4e8]
mov rcx, rax
call fcn.140004e71
mov qword [rbp + 0xa38], rax
lea rdx, [0x14000452a]
mov rcx, qword [rbp + 0xa38]
call fcn.1400066fe
nop
lea rcx, [rbp + 0x4e8]
call fcn.14000355d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rcx, qword [rbp + 0x488]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp + 0x4e8]
call fcn.140006e79
nop
lea rcx, [rbp + 0x4a8]
call fcn.140006e79
nop
lea rcx, [rbp + 0x1d8]
call fcn.140006e79
nop
lea rcx, [rbp + 0x198]
call fcn.1400022ca
nop
lea rcx, [rbp + 0x158]
call fcn.140006e79
nop
lea rcx, [rbp + 0x98]
call fcn.140006e79
nop
lea rcx, [rbp + 8]
call fcn.140005bfa
nop
jmp 0x140083670
jmp 0x140083434
lea r8, [0x14022c6d4]
lea rdx, [rbp + 0x4e8]
lea rcx, [rbp + 0x968]
call fcn.140007063
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov qword [rbp + 0xa40], rax
mov rdx, qword [rbp + 0xa40]
lea rcx, [rbp + 0x198]
call fcn.140005c4f
nop
lea rcx, [rbp + 0x968]
call fcn.140006e79
nop
lea rcx, [rbp + 0x4e8]
call fcn.140006e79
nop
lea rcx, [rbp + 0x4a8]
call fcn.140006e79
nop
lea rdx, [rbp + 0x220]
mov rcx, qword [rbp + 0x488]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14008337b
mov rcx, qword [rbp + 0x488]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp + 0x1d8]
call fcn.140006e79
nop
jmp 0x1400832ce
lea rcx, [rbp + 0x198]
call fcn.1400022ca
nop
lea rcx, [rbp + 0x158]
call fcn.140006e79
nop
jmp 0x1400831e4
lea rdx, [0x14022c888]
lea rcx, [0x14028c730]
call fcn.14000485e
mov qword [rbp + 0xa38], rax
lea rdx, [0x14000452a]
mov rcx, qword [rbp + 0xa38]
call fcn.1400066fe
nop
lea rcx, [rbp + 0x98]
call fcn.140006e79
nop
lea rcx, [rbp + 8]
call fcn.140005bfa
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140224470]
call fcn.140006b90
mov rcx, qword [rbp + 0xa48]
xor rcx, rbp
call fcn.1400044d0
lea rsp, [rbp + 0xa50]
pop rdi
pop rsi
pop rbp
ret