Function at 0x140006940
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140160080]
xor rax, rsp
mov qword [rbp + 0xc0], rax
movzx r15d, dl
mov r13, rcx
mov qword [rsp + 0x58], rcx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov dword [rsp + 0x54], ecx
mov byte [rsp + 0x40], Ordinal_50
mov al, 0x7c
mov cl, 0x56
mov dl, 0x5c
mov r8b, 0x5b
mov r9b, 0x4a
mov r10b, 0x42
mov r11b, 0x6b
mov bl, 0x5d
mov dil, 0x46
mov sil, 0x59
movzx r14d, r9b
xor r12d, r12d
xor al, 0x2f
mov byte [rsp + 0x41], al
xor cl, 0x2f
mov byte [rsp + 0x42], cl
xor dl, 0x2f
mov byte [rsp + 0x43], dl
xor r8b, 0x2f
mov byte [rsp + 0x44], r8b
xor r9b, 0x2f
mov byte [rsp + 0x45], r9b
xor r10b, 0x2f
mov byte [rsp + 0x46], r10b
xor r11b, 0x2f
mov byte [rsp + 0x47], r11b
xor bl, 0x2f
mov byte [rsp + 0x48], bl
xor dil, 0x2f
mov byte [rsp + 0x49], dil
xor sil, 0x2f
mov byte [rsp + 0x4a], sil
xor r14b, 0x2f
mov byte [rsp + 0x4b], r14b
mov byte [rsp + 0x4c], r12b
lea rcx, [rsp + 0x41]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
mov r12, 0xffffffffffffffff
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006a40
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140032c10
nop
mov byte [rsp + 0x50], 3
mov al, 0x5f
xor ecx, ecx
xor al, 3
mov byte [rsp + 0x51], al
mov byte [rsp + 0x52], cl
lea rax, [rsp + 0x51]
mov r8, r12
inc r8
cmp byte [rax + r8], cl
jne 0x140006a72
lea rdx, [rsp + 0x51]
lea rcx, [rbp - 0x58]
call fcn.14002e4a0
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140148df0]
mov qword [rbp - 0x30], rax
lea rcx, [rbp + 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x54], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x30], rdi
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x34], edx
lea rcx, [rbp - 0x28]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rbx, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp - 0x28], rbx
xor eax, eax
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x48], 4
mov dword [rbp - 0x60], eax
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rcx, qword [rbp - 0x58]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rdx, [0x140005760]
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp - 0x60]
shr edx, 0x10
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
movzx edx, word [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
test r15b, r15b
jne 0x140006cc9
mov byte [rsp + 0x40], 0x77
mov al, 0x45
mov cl, 0x40
mov dl, reloc.WS2_32.dll_select
mov r8b, Ordinal_79
mov r9b, 0x47
mov r10b, reloc.WS2_32.dll_setsockopt
movzx r11d, r9b
mov bl, reloc.WLDAP32.dll_Ordinal_79
mov dil, 0x42
movzx esi, dil
movzx r14d, r8b
movzx r15d, al
xor r13d, r13d
xor al, 0x77
mov byte [rsp + 0x41], al
xor cl, 0x77
mov byte [rsp + 0x42], cl
xor dl, 0x77
mov byte [rsp + 0x43], dl
xor r8b, 0x77
mov byte [rsp + 0x44], r8b
xor r9b, 0x77
mov byte [rsp + 0x45], r9b
xor r10b, 0x77
mov byte [rsp + 0x46], r10b
xor r11b, 0x77
mov byte [rsp + 0x47], r11b
xor bl, 0x77
mov byte [rsp + 0x48], bl
xor dil, 0x77
mov byte [rsp + 0x49], dil
xor sil, 0x77
mov byte [rsp + 0x4a], sil
xor r14b, 0x77
mov byte [rsp + 0x4b], r14b
xor r15b, 0x77
mov byte [rsp + 0x4c], r15b
mov byte [rsp + 0x4d], r13b
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x28]
call fcn.140030560
nop
lea rax, [rsp + 0x41]
mov r13, qword [rsp + 0x58]
nop word [rax + rax]
inc r12
cmp byte [rax + r12], 0
jne 0x140006c30
mov r8, r12
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x80]
call fcn.14002e4a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor ecx, ecx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rcx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], cl
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.140040320
nop
lea rcx, [rbp - 0x80]
call fcn.140030630
nop
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x30], rax
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x34], edx
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp - 0x28], rax
jmp 0x140006cf9
mov rdx, r13
lea rcx, [rbp - 0x28]
call fcn.140030560
nop
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x30], rdi
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x34], edx
mov qword [rbp - 0x28], rbx
lea rcx, [rbp - 0x28]
call fcn.1400304b0
lea rcx, [rbp - 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x58]
call fcn.140030630
mov rax, r13
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400f24a0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret