Function at 0x18004d790
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push rdi
mov eax, 0x2fb0
call fcn.1800eab00
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2fc8], rbx
mov qword [rsp + 0x2fd0], rsi
mov rax, qword [0x180175020]
xor rax, rsp
mov qword [rsp + 0x2fa0], rax
mov rsi, rcx
mov qword [rsp + 0x60], rcx
xor edi, edi
mov dword [rsp + 0x50], edi
lea edx, [rdi + 2]
lea r8d, [rdi + 1]
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_int____ptr64]
nop
call qword [sym.imp.MSVCP90.dll_public:_static_class_std::locale_const____ptr64___cdecl_std::locale::classic_void_]
mov r8, rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x70]
lea rdx, [rsp + 0x2d60]
call qword [sym.imp.MSVCP90.dll_public:_class_std::locale___cdecl_std::basic_ios_char__struct_std::char_traits_char__::imbue_class_std::locale_const____ptr64____ptr64]
lea rcx, [rsp + 0x2d60]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::locale::destructor_void____ptr64]
mov byte [rsp + 0x2d68], 0x5a
mov byte [rsp + 0x2d69], 0x50
mov byte [rsp + 0x2d6a], 0x45
mov byte [rsp + 0x2d6b], 0x4a
mov byte [rsp + 0x2d6c], 0x6c
mov byte [rsp + 0x2d6d], 0x2d
mov byte [rsp + 0x2d6e], 0x2a
mov byte [rsp + 0x2d6f], 0x5b
mov byte [rsp + 0x2d70], 0x41
mov byte [rsp + 0x2d71], 0x78
mov byte [rsp + 0x2d72], 0x57
mov byte [rsp + 0x2d73], 0x37
mov byte [rsp + 0x2d74], 0x34
mov byte [rsp + 0x2d75], 0x23
mov byte [rsp + 0x2d76], 0x32
mov byte [rsp + 0x2d77], 0x55
mov dword [rsp + 0x44], 0x5c3a43
mov ebx, 0x9a758634
mov byte [rsp + 0x2d60], 0xcb
mov byte [rsp + 0x2d61], 0x80
mov byte [rsp + 0x2d62], 0xf4
mov byte [rsp + 0x2d63], 0x6e
mov byte [rsp + 0x2d64], 0xdc
mov byte [rsp + 0x2d65], 0x48
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x4c], edi
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x2d80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
mov r8d, 0x104
lea rdx, [rsp + 0x2e90]
lea rcx, [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x18004d92f
mov eax, dword [rsp + 0x40]
xor ebx, eax
lea rcx, str.IPHLPAPI.DLL
call fcn.18004f110
test rax, rax
je 0x18004d9c6
lea rdx, str.GetAdaptersInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18004d9c6
mov dword [rsp + 0x48], 0x2c00
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x160]
call rax
movzx r11d, byte [rsp + 0x2f8]
movzx eax, r11b
xor al, 0xcb
mov byte [rsp + 0x2d60], al
movzx eax, r11b
xor al, 0x80
mov byte [rsp + 0x2d61], al
movzx eax, r11b
xor al, 0xf4
mov byte [rsp + 0x2d62], al
movzx eax, r11b
xor al, 0x6e
mov byte [rsp + 0x2d63], al
movzx eax, r11b
xor al, 0xdc
mov byte [rsp + 0x2d64], al
xor r11b, 0x48
mov byte [rsp + 0x2d65], r11b
mov edx, ebx
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x180131480]
call fcn.18000ffd0
nop word [rax + rax]
movzx ebx, byte [rsp + rdi + 0x2d60]
mov rax, rbx
shr rax, 4
movzx edx, byte [rsp + rax + 0x2d68]
lea rcx, [rsp + 0x70]
call fcn.18004de00
and ebx, 0xf
movzx edx, byte [rsp + rbx + 0x2d68]
lea rcx, [rsp + 0x70]
call fcn.18004de00
inc rdi
cmp rdi, 6
jl 0x18004d9f0
mov rdx, rsi
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::str_void____ptr64]
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::vbase_dtor_void____ptr64]
mov rax, rsi
mov rcx, qword [rsp + 0x2fa0]
xor rcx, rsp
call fcn.1800e9aa0
lea r11, [rsp + 0x2fb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret