Function at 0x14000a870
Capabilities:
Get disk information
Get local ipv4 addresses

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x520
mov qword [r11 - 0x488], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x518], rax
mov r13, rdx
mov qword [rsp + 0x70], rcx
mov qword [r11 - 0x4b0], rcx
mov qword [rsp + 0x40], rdx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
test rdx, rdx
je 0x14000a9c8
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
lea r15d, [r14 + 1]
test eax, eax
je 0x14000a9bf
mov ebx, r14d
mov rcx, rbx
mov eax, r15d
shl eax, cl
test esi, eax
je 0x14000a9b2
movabs rax, 0x5c003a0041
mov qword [rsp + 0x510], rax
lea eax, [rbx + 0x41]
mov word [rsp + 0x510], ax
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rsp + 0x38], eax
cmp eax, 2
jb 0x14000a9b2
lea rdi, [r13 + 0xc0]
mov qword [rsp + 0x3e0], r14
mov qword [rsp + 0x3e8], r14
mov qword [rsp + 0x3e0], r14
mov qword [rsp + 0x3e8], 7
mov word [rsp + 0x3d0], r14w
mov r8, r15
lea rdx, [rsp + 0x510]
lea rcx, [rsp + 0x3d0]
call fcn.140001a78
nop
mov rdx, qword [rdi + 8]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x3d0]
cmp qword [rdi + 0x10], rdx
je 0x14000a99c
call fcn.140011934
add qword [rdi + 8], 0x28
jmp 0x14000a9a5
mov rcx, rdi
call fcn.1400119d8
nop
lea rcx, [rsp + 0x3d0]
call fcn.140001a14
add rbx, r15
cmp rbx, 0x1a
jb 0x14000a8e4
mov byte [r13 + 0x108], r14b
jmp 0x14000a9ce
mov r15d, 1
mov eax, r15d
xor ecx, ecx
cpuid
mov dword [rsp + 0x50], eax
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x58], ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x380], xmm0
movdqa xmm1, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x380], xmm1
mov byte [rsp + 0x370], r14b
mov rdx, r13
lea rcx, [rsp + 0x4b0]
call fcn.140008afc
nop
mov rdx, rax
lea rcx, [rsp + 0x490]
call fcn.140067cc0
nop
lea rcx, [rsp + 0x370]
mov qword [rsp + 0xa8], rcx
lea rcx, [rsp + 0x370]
cmp rcx, rax
je 0x14000aa5f
mov r8b, r14b
mov rdx, rax
lea rcx, [rsp + 0x370]
call fcn.14000fa58
nop
lea rcx, [rsp + 0x490]
call fcn.14000c7a8
nop
lea rcx, [rsp + 0x4b0]
call fcn.140001a14
lea rdx, [0x1400e7f48]
lea rcx, [rsp + 0x370]
call fcn.14006829c
nop
jmp 0x14000aaaa
lea rcx, [rsp + 0xd0]
call fcn.140027084
nop
lea r8, str.Select__From_MSFT_NetAdapter_Where_ConnectorPresenttrue
lea rdx, str.ROOTStandardCimv2
lea rcx, [rsp + 0xd0]
call fcn.1400271d8
mov bl, al
test al, al
jne 0x14000ab25
lea r8, str.Select__From_Win32_NetworkAdapter_Where_PhysicalAdaptertrue
lea rdx, str.ROOTCIMV2
lea rcx, [rsp + 0xd0]
call fcn.1400271d8
mov bl, al
test al, al
jne 0x14000ab25
call fcn.140062924
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Failed_to_query_Win32_NetworkAdapter
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140051314.0]
test r13, r13
je 0x14000ab25
mov byte [r13 + 0x108], r15b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
lfence
mov ecx, 0x60
call fcn.14006b6a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x60], rax
test bl, bl
je 0x14000ae11
mov qword [rsp + 0x300], r14
mov qword [rsp + 0x308], r14
mov qword [rsp + 0x300], r14
mov qword [rsp + 0x308], 7
mov word [rsp + 0x2f0], r14w
lea r9, [0x1400e7f5c]
lea r8, [rsp + 0x2f0]
lea rdx, str.PNPDeviceID
lea rcx, [rsp + 0xd0]
call fcn.140027904
mov qword [rsp + 0x320], r14
mov qword [rsp + 0x328], r14
mov qword [rsp + 0x320], r14
mov qword [rsp + 0x328], 7
mov word [rsp + 0x310], r14w
lea r9, [0x1400e7f5c]
lea r8, [rsp + 0x310]
lea rdx, str.GUID
lea rcx, [rsp + 0xd0]
call fcn.140027904
test al, al
jne 0x14000ac20
lea r9, [0x1400e7f5c]
lea r8, [rsp + 0x310]
lea rdx, str.DeviceID
lea rcx, [rsp + 0xd0]
call fcn.140027904
mov rsi, qword [rsp + 0x320]
test rsi, rsi
je 0x14000ade1
mov r12, qword [rsp + 0x60]
mov rbx, r12
mov rdi, qword [r12 + 8]
cmp byte [rdi + 0x19], r14b
jne 0x14000acdd
lea rcx, [rdi + 0x20]
lea r8, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 8
cmovae r8, qword [rsp + 0x2f0]
mov rdx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x14000ac74
mov rcx, qword [rcx]
mov r9, qword [rsp + 0x300]
call fcn.140018218
test eax, eax
jns 0x14000ac8b
mov rdi, qword [rdi + 0x10]
jmp 0x14000ac91
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], r14b
je 0x14000ac48
cmp rbx, r12
je 0x14000acdd
lea r8, [rbx + 0x20]
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14000acae
mov r8, qword [r8]
lea rcx, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 8
cmovae rcx, qword [rsp + 0x2f0]
mov rdx, qword [rsp + 0x300]
call fcn.140018218
test eax, eax
jns 0x14000adad
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x90], r14
lfence
mov ecx, 0x60
call fcn.14006b6a0
mov rsi, rax
mov qword [rsp + 0x90], rax
lea rdi, [rax + 0x20]
mov qword [rsp + 0xb0], rdi
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0xb8], rax
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea rdx, [rsp + 0x2f0]
mov rcx, rdi
call fcn.140001ae4
nop
mov qword [rdi + 0x30], r14
mov qword [rdi + 0x38], 7
mov word [rdi + 0x20], r14w
mov qword [rsi], r12
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r12
and word [rsi + 0x18], 0
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.140017dec
mov rbx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x320]
lea rcx, [rbx + 0x40]
lea rax, [rsp + 0x310]
cmp rcx, rax
je 0x14000ade1
lea rdx, [rsp + 0x310]
cmp qword [rsp + 0x328], 8
cmovae rdx, qword [rsp + 0x310]
mov r8, rsi
call fcn.140001a78
nop
lea rcx, [rsp + 0x310]
call fcn.140001a14
nop
lea rcx, [rsp + 0x2f0]
call fcn.140001a14
lea rcx, [rsp + 0xd0]
call fcn.140027d6c
test al, al
jne 0x14000ab59
mov dword [rsp + 0x3c], 0x3c00
mov edi, 2
mov qword [rsp + 0x40], r14
mov ecx, dword [rsp + 0x3c]
call fcn.14006c210
mov r12, rax
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
mov edx, 0x100
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov esi, eax
cmp eax, 0x6f
jne 0x14000ae78
mov rbx, r14
mov qword [rsp + 0x40], rbx
test r12, r12
je 0x14000ae70
mov rcx, r12
call fcn.14006b6e0
mov r12, r14
sub rdi, r15
jne 0x14000ae23
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x360], xmm0
movdqa xmm1, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x360], xmm1
mov byte [rsp + 0x350], r14b
lea rdx, str.000000000000
lea rcx, [rsp + 0x350]
call fcn.14000f81c
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x340], xmm0
movdqa xmm1, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x340], xmm1
mov byte [rsp + 0x330], r14b
lea rdx, str.000000000000
lea rcx, [rsp + 0x330]
call fcn.14000f81c
nop
test esi, esi
sete byte [rsp + 0x35]
test esi, esi
jne 0x14000af26
lea rax, [rsp + 0x330]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x350]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r12
lea rdx, [rsp + 0x60]
mov ecx, r15d
call fcn.140009de0
jmp 0x14000af32
test r13, r13
je 0x14000af32
mov byte [r13 + 0x108], r15b
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x370]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x330]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x470]
call fcn.14000987c
nop
test r13, r13
je 0x14000b4cd
mov r8d, r15d
mov edx, 2
lea rcx, [rsp + 0x120]
call fcn.14000fda0
nop
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x120]
call fcn.14000db9c
mov edx, dword [rsp + 0x54]
lea rcx, [rsp + 0x120]
call fcn.14000db9c
mov edx, dword [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.14000db9c
nop
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x128]
call fcn.14000ff58
mov edi, dword [rsp + 0x30]
or edi, 0x10
mov dword [rsp + 0x30], edi
and edi, 0xffffffef
mov dword [rsp + 0x30], edi
or edi, 8
mov dword [rsp + 0x30], edi
mov r8, r13
mov edx, r15d
lea rcx, [rsp + 0x3f0]
call fcn.1400c2024
test al, al
sete byte [rsp + 0x34]
and edi, 0xfffffff7
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x408]
mov esi, 0x1000
cmp rdx, 0x10
jb 0x14000b04d
inc rdx
mov rcx, qword [rsp + 0x3f0]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b048
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b616
call fcn.14006b6e0
movdqa xmm0, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x400], xmm0
mov byte [rsp + 0x3f0], r14b
lea rcx, [rsp + 0x1a8]
call fcn.14000d50c
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0xb8], rax
lea rax, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x1a8], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x1a8], rax
lea rcx, [rsp + 0x1a8]
call fcn.140069b78
cmp byte [rsp + 0x34], r14b
je 0x14000b0d4
call fcn.140062924
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140051314.0]
lea r8, [r13 + 0x20]
mov edx, r15d
lea rcx, [rsp + 0x370]
call fcn.1400c2024
test al, al
jne 0x14000b10b
call fcn.140062924
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140051314.0]
lea r8, [r13 + 0x40]
mov edx, r15d
lea rcx, [rsp + 0x350]
call fcn.1400c2024
test al, al
jne 0x14000b142
call fcn.140062924
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140051314.0]
lea r8, [r13 + 0x60]
mov edx, r15d
lea rcx, [rsp + 0x330]
call fcn.1400c2024
test al, al
jne 0x14000b179
call fcn.140062924
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140051314.0]
lea rdi, [r13 + 0xa0]
mov rdx, rdi
lea rcx, [rsp + 0x430]
call fcn.140067cc0
nop
mov r8, rdi
mov edx, r15d
mov rcx, rax
call fcn.1400c2024
test al, al
sete dil
mov rdx, qword [rsp + 0x448]
cmp rdx, 0x10
jb 0x14000b1e4
inc rdx
mov rcx, qword [rsp + 0x430]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b1df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b61c
call fcn.14006b6e0
movdqa xmm0, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x440], xmm0
mov byte [rsp + 0x430], r14b
test dil, dil
je 0x14000b221
call fcn.140062924
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140051314.0]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x3c0], xmm0
movdqa xmm1, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x3c0], xmm1
mov byte [rsp + 0x3b0], r14b
lea rdx, str.000000000000
lea rcx, [rsp + 0x3b0]
call fcn.14000f81c
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x3a0], xmm0
movdqa xmm1, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x3a0], xmm1
mov byte [rsp + 0x390], r14b
lea rdx, str.000000000000
lea rcx, [rsp + 0x390]
call fcn.14000f81c
nop
cmp byte [rsp + 0x35], r14b
je 0x14000b2c8
lea rax, [rsp + 0x390]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r12
lea rdx, [rsp + 0x60]
xor ecx, ecx
call fcn.140009de0
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x370]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x390]
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0x4f0]
call fcn.14000987c
mov rdi, rax
lea r12, [r13 + 0x110]
cmp r12, rax
je 0x14000b334
mov rcx, r12
call fcn.140001a14
mov r8d, 0x20
mov rdx, rdi
mov rcx, r12
call fcn.140089be0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
lea rcx, [rsp + 0x4f0]
call fcn.140001a14
nop
mov rdx, qword [rsp + 0x3a8]
cmp rdx, 0x10
jb 0x14000b381
inc rdx
mov rcx, qword [rsp + 0x390]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b37c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b622
call fcn.14006b6e0
movdqa xmm0, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x3a0], xmm0
mov byte [rsp + 0x390], r14b
mov rdx, qword [rsp + 0x3c8]
cmp rdx, 0x10
jb 0x14000b3d9
inc rdx
mov rcx, qword [rsp + 0x3b0]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b3d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b628
call fcn.14006b6e0
movdqa xmm0, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x3c0], xmm0
mov byte [rsp + 0x3b0], r14b
mov rdi, qword [r13 + 0xf0]
mov r12, qword [r13 + 0xf8]
jmp 0x14000b4c2
mov rdx, rdi
lea rcx, [rsp + 0x410]
call fcn.140067cc0
nop
mov r8, rdi
mov edx, r15d
mov rcx, rax
call fcn.1400c2024
test al, al
sete r13b
mov rdx, qword [rsp + 0x428]
cmp rdx, 0x10
jb 0x14000b469
inc rdx
mov rcx, qword [rsp + 0x410]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b464
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b62e
call fcn.14006b6e0
mov qword [rsp + 0x420], r14
mov qword [rsp + 0x428], 0xf
mov byte [rsp + 0x410], r14b
test r13b, r13b
je 0x14000b4be
call fcn.140062924
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140051314.0]
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x14000b4b6
mov rax, qword [rdi]
mov qword [rdi + 0x10], r14
mov word [rax], r14w
add rdi, 0x48
cmp rdi, r12
jne 0x14000b405
jmp 0x14000b4d2
mov esi, 0x1000
mov rdi, qword [rsp + 0x70]
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea rdx, [rsp + 0x470]
mov rcx, rdi
call fcn.140001ae4
or dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x470]
call fcn.140001a14
nop
mov rdx, qword [rsp + 0x348]
cmp rdx, 0x10
jb 0x14000b541
inc rdx
mov rcx, qword [rsp + 0x330]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b53c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b634
call fcn.14006b6e0
movdqa xmm0, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x340], xmm0
mov byte [rsp + 0x330], r14b
mov rdx, qword [rsp + 0x368]
cmp rdx, 0x10
jb 0x14000b599
inc rdx
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b594
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b63a
call fcn.14006b6e0
movdqa xmm0, xmmword [0x1400fe9f0]
movdqu xmmword [rsp + 0x360], xmm0
mov byte [rsp + 0x350], r14b
test rbx, rbx
je 0x14000b5c0
mov rcx, rbx
call fcn.14006b6e0
nop
lea rcx, [rsp + 0x60]
call fcn.14000c108
nop
lea rcx, [rsp + 0xd0]
call fcn.140027114
nop
lea rcx, [rsp + 0x370]
call fcn.14000c7a8
mov rax, rdi
mov rcx, qword [rsp + 0x518]
xor rcx, rsp
call fcn.14006b800
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14008d8cc
nop
call fcn.14008d8cc
nop
call fcn.14008d8cc
nop
call fcn.14008d8cc
int3
call fcn.14008d8cc
nop
call fcn.14008d8cc
nop
call fcn.14008d8cc
int3