Function at 0x3bc1c9770
Capabilities:
Get common file path
Get disk information
Get system information on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rcx, str.ntdll.dll
call fcn.3bc1ccf94
mov rbx, rax
test rax, rax
je 0x3bc1c9ca2
lea rdx, str.RtlGetVersion
mov rcx, rax
call fcn.3bc1ccf13
mov rdx, rax
test rax, rax
je 0x3bc1c97fb
lea r8, [0x3bc1dd420]
mov ecx, 0x23
mov eax, 0
mov rdi, r8
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov dword [0x3bc1dd420], 0x11c
mov rcx, r8
call rdx
test eax, eax
jne 0x3bc1c97de
mov esi, 0
jmp 0x3bc1c9800
mov r8d, eax
lea rdx, str.sys_init
lea rcx, str._E____s_____RtlGetVersion_failed_res_08lx__n
call fcn.3bc1c1292
mov esi, 0x40000001
jmp 0x3bc1c9800
mov esi, 0x40000001
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x3bc1c9837
and esi, 0x3fffffff
mov r8d, esi
lea rdx, str.sys_init
lea rcx, str._E____s_____Failed_err_08x__n
call fcn.3bc1c1292
mov eax, 0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [0x3bc1dd420]
mov qword [0x3bc1dd298], rax
lea rbx, [0x3bc1dd540]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov qword [0x3bc1dd2a0], rbx
mov edx, 0x104
lea rcx, [0x3bc1dd300]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x3bc1c994e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r8d, eax
lea rdx, str.sys_init
lea rcx, str._E____s_____GetWindowsDirectoryA_failed_gle_lu__n
call fcn.3bc1c1292
cmp esi, 0x20
ja 0x3bc1c98b7
ja case.0x3bc1c98ab.1
mov eax, esi
lea rdx, [0x3bc1d7f88]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov esi, 0x40000001
jmp 0x3bc1c980d
cmp esi, 0x94
je 0x3bc1c9cb6
cmp esi, 0x94
ja 0x3bc1c9902
cmp esi, 0x7f
ja 0x3bc1c98ec
cmp esi, 0x7e
jae 0x3bc1c9cc0
cmp esi, 0x50
jne 0x3bc1c9cca
mov esi, 0x40000007
jmp 0x3bc1c980d
cmp esi, 0x91
jne 0x3bc1c9cd4
mov esi, 0x4000000d
jmp 0x3bc1c980d
cmp esi, 0xb7
je 0x3bc1c9cde
cmp esi, 0x80070005
je 0x3bc1c9ce8
cmp esi, 0xaa
jne 0x3bc1c9cf2
mov esi, 0x4000000d
jmp 0x3bc1c980d
mov esi, 0x40000003
jmp 0x3bc1c980d
mov esi, 0x40000009
jmp 0x3bc1c980d
mov esi, 0x4000000d
jmp 0x3bc1c980d
lea r8, [0x3bc1dd300]
mov qword [0x3bc1dd288], r8
lea rdx, str.sys_init
lea rcx, str._I____s_____GetWindowsDirectoryA_done_sys_win_dir_s__n
call fcn.3bc1c1292
test esi, esi
jne 0x3bc1c980d
mov qword [rsp + 0x48], 0x25
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x3bc1dd2c0]
lea r8, str.MachineGuid
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call fcn.3bc1cb0e2
test eax, eax
je 0x3bc1c9a5e
test esi, esi
jne 0x3bc1c980d
mov rax, qword [0x3bc1dd288]
movzx eax, byte [rax]
mov byte [rsp + 0x48], al
mov byte [rsp + 0x49], 0x3a
mov byte [rsp + 0x4a], 0x5c
mov byte [rsp + 0x4b], 0
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, 0
mov edx, 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x3bc1c9b1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r9d, eax
lea r8, [rsp + 0x48]
lea rdx, str.sys_init
lea rcx, str._E____s_____GetVolumeInformationA_failed_vol_s_gle_lu__n
call fcn.3bc1c1292
cmp ebx, 0x20
ja 0x3bc1c9a84
ja case.0x3bc1c9a5c.1
mov ebx, ebx
lea rdx, [0x3bc1d800c]
movsxd rax, dword [rdx + rbx*4]
add rax, rdx
jmp rax
lea r8, [0x3bc1dd2c0]
mov qword [0x3bc1dd280], r8
lea rdx, str.sys_init
lea rcx, str._I____s_____GetWindowsDirectoryA_done_sys_mach_guid_s__n
add al, ch
adc edi, dword [rax - 1]
invalid
jmp 0x3bc1c99b3
invalid
add al, ch
adc edi, dword [rax - 1]
invalid
inc dword [rcx + 0x94fb]
add byte [rdi], cl
test byte [rdi + 1], dl
add dword [rax], eax
invalid
cmp ebx, 0x94
je 0x3bc1c9be7
add dword [rax], eax
invalid
add dword [rax], eax
add byte [rdi + 0x37], dh
ja 0x3bc1c9ac9
cmp ebx, 0x7f
ja 0x3bc1c9ab3
cmp ebx, 0x7e
jae 0x3bc1c9bf1
cmp ebx, 0x50
jne 0x3bc1c9bfb
mov esi, 0x40000007
jmp 0x3bc1c980d
cmp ebx, 0x91
jne 0x3bc1c9c05
sti
xchg ecx, eax
add byte [rax], al
add byte [rdi], cl
test dword [rsi + 1], eax
add byte [rax], al
mov esi, 0x4000000d
jmp 0x3bc1c980d
cmp ebx, 0xb7
je 0x3bc1c9c0f
cmp ebx, 0x80070005
je 0x3bc1c9c19
cmp ebx, 0xaa
je 0x3bc1c9af3
mov esi, 0x40000001
jmp 0x3bc1c980d
mov esi, 0x4000000d
jmp 0x3bc1c980d
mov esi, 0x40000003
jmp 0x3bc1c980d
mov esi, 0x40000009
jmp 0x3bc1c980d
mov esi, 0x4000000d
jmp 0x3bc1c980d
mov r9d, dword [rsp + 0x44]
lea r8, [rsp + 0x48]
lea rdx, str.sys_init
lea rcx, str._I____s_____GetVolumeInformationA_done_vol_s_vol_sn_08lx__n
call fcn.3bc1c1292
mov rax, qword [0x3bc1dd2a0]
movzx ebx, word [rax + 0x2e]
mov rsi, qword [0x3bc1dd280]
test rsi, rsi
je 0x3bc1c9b61
mov rcx, rsi
call sub.msvcrt.dll_strlen
cmp rax, 0x24
clc
and al, 0xf
test dl, al
add byte [rax], al
invalid
clc
and al, 0xf
test dl, al
add byte [rax], al
add byte [rax - 0x75], cl
add eax, 0x13738
mov rax, qword [0x3bc1dd2a0]
movzx esi, word [rax + 0x2c]
mov r8d, dword [rsp + 0x44]
movzx ebx, bx
shl rbx, 0x20
or r8, rbx
shl rsi, 0x30
or r8, rsi
mov qword [0x3bc1dd290], r8
mov rax, qword [0x3bc1dd298]
movzx edx, word [rax + 0x114]
mov r9d, dword [rax + 4]
movzx ecx, word [rax + 0x116]
mov dword [rsp + 0x38], ecx
movzx edx, dx
mov dword [rsp + 0x30], edx
mov edx, dword [rax + 0xc]
mov dword [rsp + 0x28], edx
mov eax, dword [rax + 8]
mov dword [rsp + 0x20], eax
lea rdx, str.sys_init
lea rcx, str._I____s_____Done_sys_uid_016llx_sys_os_ver_lu._lu._lu._d._d__n
call fcn.3bc1c1292
jmp 0x3bc1c9829
mov esi, 0x40000001
jmp 0x3bc1c980d
mov esi, 0x40000008
jmp 0x3bc1c980d
mov esi, 0x4000000d
jmp 0x3bc1c980d
mov esi, 0x40000003
jmp 0x3bc1c980d
mov esi, 0x40000001
jmp 0x3bc1c980d
mov esi, 0x40000001
jmp 0x3bc1c980d
mov esi, 0x40000007
jmp 0x3bc1c980d
mov esi, 0x40000009
jmp 0x3bc1c980d
cmp byte [rsi + 8], 0x2d
jne 0x3bc1c9b61
cmp byte [rsi + 0xd], 0x2d
jne 0x3bc1c9b61
mov rbp, qword [sym.imp.msvcrt.dll__errno]
call rbp
mov dword [rax], 0
mov rax, qword [0x3bc1dd280]
lea rcx, [rax + 9]
mov r8d, 0x10
mov edx, 0
call sub.msvcrt.dll_strtol
mov edi, eax
mov esi, eax
call rbp
cmp dword [rax], 0
jne 0x3bc1c9c7a
test di, di
jne 0x3bc1c9b6c
jmp 0x3bc1c9b61
call qword [sym.imp.msvcrt.dll__errno]
mov r9d, dword [rax]
mov r8, qword [0x3bc1dd280]
lea rdx, str.sys_init
lea rcx, str._E____s_____strtol_failed_sys_mach_guid_s_errno_d__n
call fcn.3bc1c1292
jmp 0x3bc1c9b61
mov esi, 0x40000001
jmp 0x3bc1c980d
mov esi, 0x40000008
jmp 0x3bc1c980d
mov esi, 0x4000000d
jmp 0x3bc1c980d
mov esi, 0x40000003
jmp 0x3bc1c980d
mov esi, 0x40000001
jmp 0x3bc1c980d
mov esi, 0x40000001
jmp 0x3bc1c980d
mov esi, 0x40000007
jmp 0x3bc1c980d
mov esi, 0x40000009
jmp 0x3bc1c980d
mov esi, 0x40000001
jmp 0x3bc1c980d