Function at 0x14000a340
Capabilities:
Enumerate files on windows
Enumerate gui resources
Enumerate processes
Get common file path
Get disk information
Get hostname
Get installed programs
Get session user name
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r14
sub rsp, 0xda0
mov rax, qword [0x14008d040]
xor rax, rsp
mov qword [rsp + 0xd90], rax
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [r11 - 0xc78], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x138], xmm0
mov qword [r11 - 0xc60], rdi
mov qword [r11 - 0xc58], rdi
lea r8d, [rdi + 0xe]
lea rdx, str.__SB_Checks___n
lea rcx, [r11 - 0xc78]
call fcn.140005310
nop
lea rcx, [rsp + 0x60]
call fcn.140006df0
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
lea edx, [rdi + 0x10]
call fcn.140005ea0
nop
jmp 0x14000a3e5
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0xd
lea rdx, str.Process_list:
lea rcx, [rsp + 0x38]
call fcn.140005310
mov esi, 1
mov dword [rsp + 0x30], esi
mov ebx, edi
xor edx, edx
mov r8d, 0x12c
lea rcx, [rsp + 0x594]
call fcn.1400692a0
mov dword [rsp + 0x590], 0x130
xor edx, edx
lea ecx, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
lea rdx, [rsp + 0x590]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000a4a1
mov r8d, 3
lea rdx, [0x140086010]
lea rcx, [rsp + 0x38]
call fcn.1400041a0
lea rdx, [rsp + 0x5bc]
lea rcx, [rsp + 0x38]
call fcn.140002ec0
inc ebx
lea rdx, [rsp + 0x590]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000a461
mov r8d, 0x10
lea rdx, str._nProcess_count:
lea rcx, [rsp + 0x38]
call fcn.1400041a0
lea r9, [rsp + 0x17d]
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x14000a4c0
lea r8, [rsp + 0x17d]
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.14000b740
or esi, 6
mov dword [rsp + 0x30], esi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
lea edx, [rbx + 0x10]
call fcn.140005ea0
lea r8d, [rbx + 1]
lea rdx, [0x14008574c]
lea rcx, [rsp + 0x38]
call fcn.1400041a0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x130]
call fcn.140002f60
and esi, 0xfffffffe
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x38]
call fcn.140004080
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], rdi
lea edx, [rbx + 0x10]
call fcn.140005ea0
nop
jmp 0x14000a581
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 9
lea rdx, str.Windows:_n
lea rcx, [rsp + 0x38]
call fcn.140005310
or esi, 0x10
mov dword [rsp + 0x30], esi
lea rdx, [rsp + 0x38]
lea rcx, [0x140009250]
call qword [sym.imp.USER32.dll_EnumWindows]
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x38]
call fcn.140004080
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000a603
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0xa
lea rdx, str.Desktops:_n
lea rcx, [rsp + 0x38]
call fcn.140005310
bts esi, 7
mov dword [rsp + 0x30], esi
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov rcx, rax
lea r8, [rsp + 0x38]
lea rdx, [0x140009350]
call qword [sym.imp.USER32.dll_EnumDesktopsA]
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x38]
call fcn.140004080
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000a68f
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0xf
lea rdx, str.Monitor_count:
lea rcx, [rsp + 0x38]
call fcn.140005310
bts esi, 8
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x158], edi
lea r9, [rsp + 0x158]
lea r8, [0x1400093b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea r9, [rsp + 0x17d]
mov r8d, dword [rsp + 0x158]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x14000a700
lea r8, [rsp + 0x17d]
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.14000b740
or esi, 0x600
mov dword [rsp + 0x30], esi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
mov r8d, 1
lea rdx, [0x14008574c]
lea rcx, [rsp + 0x38]
call fcn.1400041a0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x130]
call fcn.140002f60
btr esi, 8
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x38]
call fcn.140004080
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000a7cf
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x14
lea rdx, str.Installed_programs:_n
lea rcx, [rsp + 0x38]
call fcn.140005310
nop
or esi, 0x20
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000a84f
mov r8d, 0x1d
lea rdx, str.Failed_to_open_uninstall_key_n
lea rcx, [rsp + 0x38]
call fcn.1400041a0
jmp 0x14000a953
mov ebx, edi
nop dword [rax]
nop word [rax + rax]
mov r9d, 0x400
lea r8, [rsp + 0x190]
mov edx, ebx
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
inc ebx
mov rcx, qword [rsp + 0x160]
test eax, eax
jne 0x14000a94d
lea rax, [rsp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x190]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000a860
mov dword [rsp + 0x158], 0x400
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x590]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000a93a
lea r8d, [rax + 2]
lea rdx, [0x140085e2c]
lea rcx, [rsp + 0x38]
call fcn.1400041a0
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x38]
call fcn.140002ec0
mov r8d, 1
lea rdx, [0x14008574c]
lea rcx, [rsp + 0x38]
call fcn.1400041a0
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000a860
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x38]
call fcn.140004080
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000a98d
lea rcx, [rsp + 0x60]
call fcn.140008f80
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000a9cc
lea rcx, [rsp + 0x60]
call fcn.1400098c0
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000aa0b
lea rcx, [rsp + 0x60]
call fcn.140009af0
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000aa4a
lea rcx, [rsp + 0x60]
call fcn.140009670
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000aa89
mov qword [rsp + 0x168], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], rdi
mov r8d, 0x14
lea rdx, str.Current_directory:__n
lea rcx, [rsp + 0x168]
call fcn.140005310
nop
or dword [rsp + 0x30], 8
lea rdx, [rsp + 0x590]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x168]
call fcn.140002ec0
mov r8d, 1
lea rdx, [0x14008574c]
lea rcx, [rsp + 0x168]
call fcn.1400041a0
lea rdx, [rsp + 0x190]
lea rcx, [0x140085730]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000ab50
lea r8d, [rax + 0x1b]
lea rdx, str.Failed_to_find_first_file_n
lea rcx, [rsp + 0x168]
call fcn.1400041a0
jmp 0x14000ac3b
test byte [rsp + 0x190], 0x10
jne 0x14000aba5
mov r8d, 2
lea rdx, [0x140085e2c]
lea rcx, [rsp + 0x168]
call fcn.1400041a0
lea rdx, [rsp + 0x1bc]
lea rcx, [rsp + 0x168]
call fcn.140002ec0
mov r8d, 1
lea rdx, [0x14008574c]
lea rcx, [rsp + 0x168]
call fcn.1400041a0
jmp 0x14000ac19
movzx ecx, byte [rsp + 0x1bc]
movzx eax, byte [rsp + 0x1bd]
cmp cl, 0x2e
jne 0x14000abd0
test al, al
je 0x14000ac19
cmp cl, cl
jne 0x14000abd0
cmp al, cl
jne 0x14000abd0
cmp byte [rsp + 0x1be], 0
je 0x14000ac19
mov r8d, 8
lea rdx, str.___DIR_
lea rcx, [rsp + 0x168]
call fcn.1400041a0
lea rdx, [rsp + 0x1bc]
lea rcx, [rsp + 0x168]
call fcn.140002ec0
mov r8d, 1
lea rdx, [0x14008574c]
lea rcx, [rsp + 0x168]
call fcn.1400041a0
lea rdx, [rsp + 0x190]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000ab50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x168]
call fcn.140004080
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x168], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000ac81
mov qword [rsp + 0x168], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], rdi
mov r8d, 0xa
lea rdx, str.Username:
lea rcx, [rsp + 0x168]
call fcn.140005310
or dword [rsp + 0x30], 0x40
mov dword [rsp + 0x158], 0x400
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x190]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x168]
call fcn.140002ec0
mov r8d, 0x10
lea rdx, str._nComputer_name:
lea rcx, [rsp + 0x168]
call fcn.1400041a0
mov dword [rsp + 0x128], 0x400
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x590]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x168]
call fcn.140002ec0
mov r8d, 0xe
lea rdx, str._nDomain_name:
lea rcx, [rsp + 0x168]
call fcn.1400041a0
mov dword [rsp + 0x160], 0x400
lea r8, [rsp + 0x160]
lea rdx, [rsp + 0x990]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
lea rdx, [rsp + 0x990]
lea rcx, [rsp + 0x168]
call fcn.140002ec0
mov r8d, 1
lea rdx, [0x14008574c]
lea rcx, [rsp + 0x168]
call fcn.1400041a0
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x130]
call fcn.140002f60
and dword [rsp + 0x30], 0xffffffbf
lea rcx, [rsp + 0x168]
call fcn.140004080
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x168], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000adfe
lea rcx, [rsp + 0x60]
call fcn.14000a040
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000ae3d
lea rcx, [rsp + 0x60]
call fcn.140008880
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000ae7c
lea rcx, [rsp + 0x60]
call fcn.140009de0
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000aebb
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, str.Resolution:
lea rcx, [rsp + 0x38]
call fcn.140005310
or dword [rsp + 0x30], 0x800
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140006d30
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
mov r8d, 1
lea rdx, [0x140085748]
lea rcx, [rsp + 0x38]
call fcn.1400041a0
mov edx, esi
lea rcx, [rsp + 0x168]
call fcn.140006d30
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140002f60
nop
lea rcx, [rsp + 0x168]
call fcn.140004080
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x168], rdi
mov edx, 0x10
call fcn.140005ea0
mov r8d, 1
lea rdx, [0x14008574c]
lea rcx, [rsp + 0x38]
call fcn.1400041a0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x130]
call fcn.140002f60
and dword [rsp + 0x30], 0xfffff7ff
lea rcx, [rsp + 0x38]
call fcn.140004080
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000aff1
lea rcx, [rsp + 0x60]
call fcn.1400093c0
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000b030
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, inet_ntoa
lea rdx, str.TickCount:
lea rcx, [rsp + 0x38]
call fcn.140005310
nop
or dword [rsp + 0x30], 0x1000
mov qword [rsp + 0x160], 0xfffffffffa0a1f00
lea rcx, str.NTDLL.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtDelayExecution
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
lea rdx, [rsp + 0x160]
xor ecx, ecx
call rbx
test eax, eax
je 0x14000b0cf
cmp eax, 0x102
je 0x14000b0cf
mov r8d, 7
lea rdx, str.Failed_n
lea rcx, [rsp + 0x38]
call fcn.1400041a0
jmp 0x14000b17c
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r8, rax
lea r9, [rsp + 0x17d]
sub r8d, esi
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x14000b0f0
lea r8, [rsp + 0x17d]
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.14000b740
or dword [rsp + 0x30], 0x6000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
mov r8d, 3
lea rdx, [0x1400863d8]
lea rcx, [rsp + 0x38]
call fcn.1400041a0
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x38]
call fcn.140004080
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000b1b6
lea rcx, [rsp + 0x60]
call fcn.140008250
nop
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000b1f5
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, inet_ntoa
lea rdx, str.Bitlocker:_n
lea rcx, [rsp + 0x38]
call fcn.140005310
or dword [rsp + 0x30], 0x8000
lea rdx, [rsp + 0x190]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea rbx, [rsp + 0x190]
cmp word [rbx], 0
je 0x14000b2a5
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140008510
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, 0x10
call fcn.140005ea0
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x14000b290
lea rbx, [rbx + rax*2]
add rbx, 2
jmp 0x14000b246
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x130]
call fcn.140002f60
nop
lea rcx, [rsp + 0x38]
call fcn.140004080
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov edx, 0x10
call fcn.140005ea0
nop
jmp 0x14000b2db
mov rcx, qword [rsp + 0x148]
inc rcx
call fcn.140010f90
mov rbx, rax
lea rdx, [rsp + 0x138]
cmp qword [rsp + 0x150], 0xf
cmova rdx, qword [rsp + 0x138]
mov r8, rax
sub r8, rdx
nop
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000b310
lea rcx, [rsp + 0x130]
call fcn.140004080
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x130], rdi
mov edx, 0x10
call fcn.140005ea0
mov rax, rbx
mov rcx, qword [rsp + 0xd90]
xor rcx, rsp
call fcn.140010e80
lea r11, [rsp + 0xda0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret