Function at 0x140002a90
Capabilities:
Encode data using xor
Get common file path
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rsi, rcx
mov edi, 0x104
mov ecx, edi
call fcn.140001050
mov edx, edi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, edi
call fcn.140001050
movsx r8d, byte [rbx]
lea rdx, str._c:_
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_wsprintfA]
xor ebx, ebx
lea r9, [rbp + 0x6f]
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x28], rbx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
or edi, 0xffffffff
test eax, eax
jne 0x140002b24
lea rcx, str.Failed_to_get_volume_information._n
call sym.RedNodeC2.exe_OutputDebugStringA
mov edx, edi
jmp 0x140002b27
mov edx, dword [rbp + 0x6f]
cmp edx, edi
jne 0x140002bf3
mov dword [rbp + 7], 0x11
mov dword [rbp + 0xb], 5
mov dword [rbp + 0xf], 0xf4241
mov dword [rbp + 0x13], 0xf4242
mov dword [rbp + 0x17], 0xf4243
mov dword [rbp + 0x1b], 0xf4244
mov dword [rbp + 0x1f], 0xf4245
mov dword [rbp + 0x23], 0xf4246
mov dword [rbp + 0x27], 0xf4247
mov dword [rbp + 0x2b], 0xf4248
mov dword [rbp + 0x2f], 0xf4249
mov dword [rbp + 0x33], 0xf424a
mov dword [rbp + 0x37], 0xf424b
mov dword [rbp + 0x3b], 0xf424c
mov dword [rbp + 0x3f], 0xf424d
mov dword [rbp + 0x43], 0xf424e
mov dword [rbp + 0x47], 0xf424f
mov dword [rbp + 0x4b], 0xf4250
mov qword [rbp + 0x4f], 0xf4251
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, ebx
mov ecx, edx
inc edx
xor dword [rbp + rcx*4 + 0xf], eax
mov r9d, dword [rbp + 7]
cmp edx, r9d
jb 0x140002bbd
mov ecx, dword [rbp + 0x53]
xor edx, edx
mov eax, ecx
sub ecx, r9d
sub eax, dword [rbp + 0xb]
div r9d
mov eax, ecx
mov r8d, edx
xor edx, edx
div r9d
mov ecx, edx
mov edx, dword [rbp + r8*4 + 0xf]
add edx, dword [rbp + rcx*4 + 0xf]
mov dword [rbp + 7], 0x11
mov ecx, ebx
mov dword [rbp + 0xb], 5
mov dword [rbp + 0xf], 0xf4241
mov dword [rbp + 0x13], 0xf4242
mov dword [rbp + 0x17], 0xf4243
mov dword [rbp + 0x1b], 0xf4244
mov dword [rbp + 0x1f], 0xf4245
mov dword [rbp + 0x23], 0xf4246
mov dword [rbp + 0x27], 0xf4247
mov dword [rbp + 0x2b], 0xf4248
mov dword [rbp + 0x2f], 0xf4249
mov dword [rbp + 0x33], 0xf424a
mov dword [rbp + 0x37], 0xf424b
mov dword [rbp + 0x3b], 0xf424c
mov dword [rbp + 0x3f], 0xf424d
mov dword [rbp + 0x43], 0xf424e
mov dword [rbp + 0x47], 0xf424f
mov dword [rbp + 0x4b], 0xf4250
mov qword [rbp + 0x4f], 0xf4251
mov eax, ecx
inc ecx
xor dword [rbp + rax*4 + 0xf], edx
mov r11d, dword [rbp + 7]
cmp ecx, r11d
jb 0x140002c7b
mov r10d, dword [rbp + 0x53]
xor edx, edx
mov eax, r10d
sub eax, dword [rbp + 0xb]
div r11d
mov eax, r10d
sub eax, r11d
mov r8d, edx
xor edx, edx
div r11d
mov r9d, dword [rbp + r8*4 + 0xf]
mov eax, r10d
add r9d, dword [rbp + rdx*4 + 0xf]
xor edx, edx
div r11d
mov dword [rbp - 9], r9d
mov dword [rbp + rdx*4 + 0xf], r9d
xor edx, edx
mov r9d, dword [rbp + 7]
mov r10d, dword [rbp + 0x53]
inc r10d
mov dword [rbp + 0x53], r10d
mov eax, r10d
sub eax, dword [rbp + 0xb]
div r9d
mov eax, r10d
sub eax, r9d
mov r8d, edx
xor edx, edx
div r9d
mov r8d, dword [rbp + r8*4 + 0xf]
mov eax, r10d
add r8d, dword [rbp + rdx*4 + 0xf]
xor edx, edx
div r9d
mov dword [rbp + rdx*4 + 0xf], r8d
xor edx, edx
mov r10d, dword [rbp + 7]
mov r11d, dword [rbp + 0x53]
inc r11d
mov eax, r11d
mov dword [rbp + 0x53], r11d
sub eax, dword [rbp + 0xb]
div r10d
mov eax, r11d
mov r8d, edx
sub eax, r10d
xor edx, edx
div r10d
mov r9d, dword [rbp + r8*4 + 0xf]
mov eax, r11d
add r9d, dword [rbp + rdx*4 + 0xf]
xor edx, edx
div r10d
mov word [rbp - 3], r9w
mov dword [rbp + rdx*4 + 0xf], r9d
mov r11d, dword [rbp + 0x53]
inc r11d
mov dword [rbp + 0x53], r11d
mov r10d, dword [rbp + 7]
xor edx, edx
mov eax, r11d
sub eax, dword [rbp + 0xb]
div r10d
mov eax, r11d
mov r8d, edx
sub eax, r10d
xor edx, edx
div r10d
mov r9d, dword [rbp + r8*4 + 0xf]
mov eax, r11d
add r9d, dword [rbp + rdx*4 + 0xf]
xor edx, edx
div r10d
mov byte [rbp + rbx - 1], r9b
inc rbx
mov dword [rbp + rdx*4 + 0xf], r9d
mov r11d, dword [rbp + 0x53]
inc r11d
mov dword [rbp + 0x53], r11d
cmp rbx, 8
jl 0x140002d52
mov eax, dword [rbp + 1]
lea rdx, str._08lX_04lX_lu
movzx r9d, word [rbp - 3]
mov rcx, rsi
mov r8d, dword [rbp - 9]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfA]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret