Function at 0x14000aa48
Capabilities:
Get disk information
Get local ipv4 addresses

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x520
mov qword [r11 - 0x488], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140123108]
xor rax, rsp
mov qword [rsp + 0x518], rax
mov r13, rdx
mov qword [rsp + 0x70], rcx
mov qword [r11 - 0x4b0], rcx
mov qword [rsp + 0x40], rdx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
test rdx, rdx
je 0x14000aba0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
lea r15d, [r14 + 1]
test eax, eax
je 0x14000ab97
mov ebx, r14d
mov rcx, rbx
mov eax, r15d
shl eax, cl
test esi, eax
je 0x14000ab8a
movabs rax, 0x5c003a0041
mov qword [rsp + 0x510], rax
lea eax, [rbx + 0x41]
mov word [rsp + 0x510], ax
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rsp + 0x38], eax
cmp eax, 2
jb 0x14000ab8a
lea rdi, [r13 + 0xc0]
mov qword [rsp + 0x3e0], r14
mov qword [rsp + 0x3e8], r14
mov qword [rsp + 0x3e0], r14
mov qword [rsp + 0x3e8], 7
mov word [rsp + 0x3d0], r14w
mov r8, r15
lea rdx, [rsp + 0x510]
lea rcx, [rsp + 0x3d0]
call fcn.140001a78
nop
mov rdx, qword [rdi + 8]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x3d0]
cmp qword [rdi + 0x10], rdx
je 0x14000ab74
call fcn.140011954
add qword [rdi + 8], 0x28
jmp 0x14000ab7d
mov rcx, rdi
call fcn.1400119f8
nop
lea rcx, [rsp + 0x3d0]
call fcn.140001a14
add rbx, r15
cmp rbx, 0x1a
jb 0x14000aabc
mov byte [r13 + 0x108], r14b
jmp 0x14000aba6
mov r15d, 1
mov eax, r15d
xor ecx, ecx
cpuid
mov dword [rsp + 0x50], eax
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x58], ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x380], xmm0
movdqa xmm1, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x380], xmm1
mov byte [rsp + 0x370], r14b
mov rdx, r13
lea rcx, [rsp + 0x4b0]
call fcn.140008cd4
nop
mov rdx, rax
lea rcx, [rsp + 0x490]
call fcn.140065cb0
nop
lea rcx, [rsp + 0x370]
mov qword [rsp + 0xa8], rcx
lea rcx, [rsp + 0x370]
cmp rcx, rax
je 0x14000ac37
mov r8b, r14b
mov rdx, rax
lea rcx, [rsp + 0x370]
call fcn.14000fa78
nop
lea rcx, [rsp + 0x490]
call fcn.14000c7c8
nop
lea rcx, [rsp + 0x4b0]
call fcn.140001a14
lea rdx, [0x1400e5f88]
lea rcx, [rsp + 0x370]
call fcn.14006628c
nop
jmp 0x14000ac82
lea rcx, [rsp + 0xd0]
call fcn.1400270a4
nop
lea r8, str.Select__From_MSFT_NetAdapter_Where_ConnectorPresenttrue
lea rdx, str.ROOTStandardCimv2
lea rcx, [rsp + 0xd0]
call fcn.1400271f8
mov bl, al
test al, al
jne 0x14000acfd
lea r8, str.Select__From_Win32_NetworkAdapter_Where_PhysicalAdaptertrue
lea rdx, str.ROOTCIMV2
lea rcx, [rsp + 0xd0]
call fcn.1400271f8
mov bl, al
test al, al
jne 0x14000acfd
call fcn.140060914
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Failed_to_query_Win32_NetworkAdapter
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140050ed0.0]
test r13, r13
je 0x14000acfd
mov byte [r13 + 0x108], r15b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
lfence
mov ecx, 0x60
call fcn.140069690
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x60], rax
test bl, bl
je 0x14000afe9
mov qword [rsp + 0x300], r14
mov qword [rsp + 0x308], r14
mov qword [rsp + 0x300], r14
mov qword [rsp + 0x308], 7
mov word [rsp + 0x2f0], r14w
lea r9, [0x1400e5f9c]
lea r8, [rsp + 0x2f0]
lea rdx, str.PNPDeviceID
lea rcx, [rsp + 0xd0]
call fcn.140027924
mov qword [rsp + 0x320], r14
mov qword [rsp + 0x328], r14
mov qword [rsp + 0x320], r14
mov qword [rsp + 0x328], 7
mov word [rsp + 0x310], r14w
lea r9, [0x1400e5f9c]
lea r8, [rsp + 0x310]
lea rdx, str.GUID
lea rcx, [rsp + 0xd0]
call fcn.140027924
test al, al
jne 0x14000adf8
lea r9, [0x1400e5f9c]
lea r8, [rsp + 0x310]
lea rdx, str.DeviceID
lea rcx, [rsp + 0xd0]
call fcn.140027924
mov rsi, qword [rsp + 0x320]
test rsi, rsi
je 0x14000afb9
mov r12, qword [rsp + 0x60]
mov rbx, r12
mov rdi, qword [r12 + 8]
cmp byte [rdi + 0x19], r14b
jne 0x14000aeb5
lea rcx, [rdi + 0x20]
lea r8, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 8
cmovae r8, qword [rsp + 0x2f0]
mov rdx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x14000ae4c
mov rcx, qword [rcx]
mov r9, qword [rsp + 0x300]
call fcn.140018238
test eax, eax
jns 0x14000ae63
mov rdi, qword [rdi + 0x10]
jmp 0x14000ae69
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], r14b
je 0x14000ae20
cmp rbx, r12
je 0x14000aeb5
lea r8, [rbx + 0x20]
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14000ae86
mov r8, qword [r8]
lea rcx, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 8
cmovae rcx, qword [rsp + 0x2f0]
mov rdx, qword [rsp + 0x300]
call fcn.140018238
test eax, eax
jns 0x14000af85
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x90], r14
lfence
mov ecx, 0x60
call fcn.140069690
mov rsi, rax
mov qword [rsp + 0x90], rax
lea rdi, [rax + 0x20]
mov qword [rsp + 0xb0], rdi
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0xb8], rax
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea rdx, [rsp + 0x2f0]
mov rcx, rdi
call fcn.140001ae4
nop
mov qword [rdi + 0x30], r14
mov qword [rdi + 0x38], 7
mov word [rdi + 0x20], r14w
mov qword [rsi], r12
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r12
and word [rsi + 0x18], 0
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.140017e0c
mov rbx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x320]
lea rcx, [rbx + 0x40]
lea rax, [rsp + 0x310]
cmp rcx, rax
je 0x14000afb9
lea rdx, [rsp + 0x310]
cmp qword [rsp + 0x328], 8
cmovae rdx, qword [rsp + 0x310]
mov r8, rsi
call fcn.140001a78
nop
lea rcx, [rsp + 0x310]
call fcn.140001a14
nop
lea rcx, [rsp + 0x2f0]
call fcn.140001a14
lea rcx, [rsp + 0xd0]
call fcn.140027d8c
test al, al
jne 0x14000ad31
mov dword [rsp + 0x3c], 0x3c00
mov edi, 2
mov qword [rsp + 0x40], r14
mov ecx, dword [rsp + 0x3c]
call fcn.14006a200
mov r12, rax
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
mov edx, 0x100
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov esi, eax
cmp eax, 0x6f
jne 0x14000b050
mov rbx, r14
mov qword [rsp + 0x40], rbx
test r12, r12
je 0x14000b048
mov rcx, r12
call fcn.1400696d0
mov r12, r14
sub rdi, r15
jne 0x14000affb
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x360], xmm0
movdqa xmm1, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x360], xmm1
mov byte [rsp + 0x350], r14b
lea rdx, str.000000000000
lea rcx, [rsp + 0x350]
call fcn.14000f83c
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x340], xmm0
movdqa xmm1, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x340], xmm1
mov byte [rsp + 0x330], r14b
lea rdx, str.000000000000
lea rcx, [rsp + 0x330]
call fcn.14000f83c
nop
test esi, esi
sete byte [rsp + 0x35]
test esi, esi
jne 0x14000b0fe
lea rax, [rsp + 0x330]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x350]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r12
lea rdx, [rsp + 0x60]
mov ecx, r15d
call fcn.140009fb8
jmp 0x14000b10a
test r13, r13
je 0x14000b10a
mov byte [r13 + 0x108], r15b
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x370]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x330]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x470]
call fcn.140009a54
nop
test r13, r13
je 0x14000b6a5
mov r8d, r15d
mov edx, 2
lea rcx, [rsp + 0x120]
call fcn.14000fdc0
nop
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x120]
call fcn.14000dbbc
mov edx, dword [rsp + 0x54]
lea rcx, [rsp + 0x120]
call fcn.14000dbbc
mov edx, dword [rsp + 0x58]
lea rcx, [rsp + 0x120]
call fcn.14000dbbc
nop
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x128]
call fcn.14000ff78
mov edi, dword [rsp + 0x30]
or edi, 0x10
mov dword [rsp + 0x30], edi
and edi, 0xffffffef
mov dword [rsp + 0x30], edi
or edi, 8
mov dword [rsp + 0x30], edi
mov r8, r13
mov edx, r15d
lea rcx, [rsp + 0x3f0]
call fcn.1400c0394
test al, al
sete byte [rsp + 0x34]
and edi, 0xfffffff7
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x408]
mov esi, 0x1000
cmp rdx, 0x10
jb 0x14000b225
inc rdx
mov rcx, qword [rsp + 0x3f0]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b220
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b7ee
call fcn.1400696d0
movdqa xmm0, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x400], xmm0
mov byte [rsp + 0x3f0], r14b
lea rcx, [rsp + 0x1a8]
call fcn.14000d52c
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0xb8], rax
lea rax, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x1a8], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x1a8], rax
lea rcx, [rsp + 0x1a8]
call fcn.140067b68
cmp byte [rsp + 0x34], r14b
je 0x14000b2ac
call fcn.140060914
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140050ed0.0]
lea r8, [r13 + 0x20]
mov edx, r15d
lea rcx, [rsp + 0x370]
call fcn.1400c0394
test al, al
jne 0x14000b2e3
call fcn.140060914
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140050ed0.0]
lea r8, [r13 + 0x40]
mov edx, r15d
lea rcx, [rsp + 0x350]
call fcn.1400c0394
test al, al
jne 0x14000b31a
call fcn.140060914
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140050ed0.0]
lea r8, [r13 + 0x60]
mov edx, r15d
lea rcx, [rsp + 0x330]
call fcn.1400c0394
test al, al
jne 0x14000b351
call fcn.140060914
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140050ed0.0]
lea rdi, [r13 + 0xa0]
mov rdx, rdi
lea rcx, [rsp + 0x430]
call fcn.140065cb0
nop
mov r8, rdi
mov edx, r15d
mov rcx, rax
call fcn.1400c0394
test al, al
sete dil
mov rdx, qword [rsp + 0x448]
cmp rdx, 0x10
jb 0x14000b3bc
inc rdx
mov rcx, qword [rsp + 0x430]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b3b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b7f4
call fcn.1400696d0
movdqa xmm0, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x440], xmm0
mov byte [rsp + 0x430], r14b
test dil, dil
je 0x14000b3f9
call fcn.140060914
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140050ed0.0]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x3c0], xmm0
movdqa xmm1, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x3c0], xmm1
mov byte [rsp + 0x3b0], r14b
lea rdx, str.000000000000
lea rcx, [rsp + 0x3b0]
call fcn.14000f83c
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x3a0], xmm0
movdqa xmm1, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x3a0], xmm1
mov byte [rsp + 0x390], r14b
lea rdx, str.000000000000
lea rcx, [rsp + 0x390]
call fcn.14000f83c
nop
cmp byte [rsp + 0x35], r14b
je 0x14000b4a0
lea rax, [rsp + 0x390]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r12
lea rdx, [rsp + 0x60]
xor ecx, ecx
call fcn.140009fb8
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x370]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x390]
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0x4f0]
call fcn.140009a54
mov rdi, rax
lea r12, [r13 + 0x110]
cmp r12, rax
je 0x14000b50c
mov rcx, r12
call fcn.140001a14
mov r8d, 0x20
mov rdx, rdi
mov rcx, r12
call fcn.140087bd0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
lea rcx, [rsp + 0x4f0]
call fcn.140001a14
nop
mov rdx, qword [rsp + 0x3a8]
cmp rdx, 0x10
jb 0x14000b559
inc rdx
mov rcx, qword [rsp + 0x390]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b554
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b7fa
call fcn.1400696d0
movdqa xmm0, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x3a0], xmm0
mov byte [rsp + 0x390], r14b
mov rdx, qword [rsp + 0x3c8]
cmp rdx, 0x10
jb 0x14000b5b1
inc rdx
mov rcx, qword [rsp + 0x3b0]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b5ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b800
call fcn.1400696d0
movdqa xmm0, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x3c0], xmm0
mov byte [rsp + 0x3b0], r14b
mov rdi, qword [r13 + 0xf0]
mov r12, qword [r13 + 0xf8]
jmp 0x14000b69a
mov rdx, rdi
lea rcx, [rsp + 0x410]
call fcn.140065cb0
nop
mov r8, rdi
mov edx, r15d
mov rcx, rax
call fcn.1400c0394
test al, al
sete r13b
mov rdx, qword [rsp + 0x428]
cmp rdx, 0x10
jb 0x14000b641
inc rdx
mov rcx, qword [rsp + 0x410]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b63c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b806
call fcn.1400696d0
mov qword [rsp + 0x420], r14
mov qword [rsp + 0x428], 0xf
mov byte [rsp + 0x410], r14b
test r13b, r13b
je 0x14000b696
call fcn.140060914
mov rcx, qword [rax]
mov rax, qword [rcx]
lea r8, str.Unable_to_get_telemetry_device_data:_hashing_failed
mov edx, r15d
mov rax, qword [rax + 0x38]
call qword [case.0x140050ed0.0]
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x14000b68e
mov rax, qword [rdi]
mov qword [rdi + 0x10], r14
mov word [rax], r14w
add rdi, 0x48
cmp rdi, r12
jne 0x14000b5dd
jmp 0x14000b6aa
mov esi, 0x1000
mov rdi, qword [rsp + 0x70]
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea rdx, [rsp + 0x470]
mov rcx, rdi
call fcn.140001ae4
or dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x470]
call fcn.140001a14
nop
mov rdx, qword [rsp + 0x348]
cmp rdx, 0x10
jb 0x14000b719
inc rdx
mov rcx, qword [rsp + 0x330]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b714
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b80c
call fcn.1400696d0
movdqa xmm0, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x340], xmm0
mov byte [rsp + 0x330], r14b
mov rdx, qword [rsp + 0x368]
cmp rdx, 0x10
jb 0x14000b771
inc rdx
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, rsi
jb 0x14000b76c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b812
call fcn.1400696d0
movdqa xmm0, xmmword [0x1400fc260]
movdqu xmmword [rsp + 0x360], xmm0
mov byte [rsp + 0x350], r14b
test rbx, rbx
je 0x14000b798
mov rcx, rbx
call fcn.1400696d0
nop
lea rcx, [rsp + 0x60]
call fcn.14000c12c
nop
lea rcx, [rsp + 0xd0]
call fcn.140027134
nop
lea rcx, [rsp + 0x370]
call fcn.14000c7c8
mov rax, rdi
mov rcx, qword [rsp + 0x518]
xor rcx, rsp
call fcn.1400697f0
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14008b8bc
nop
call fcn.14008b8bc
nop
call fcn.14008b8bc
nop
call fcn.14008b8bc
int3
call fcn.14008b8bc
nop
call fcn.14008b8bc
nop
call fcn.14008b8bc
int3