Function at 0x26f492610
Capabilities:
Get common file path
Get disk information
Get system information on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rcx, str.ntdll.dll
call fcn.26f497474
mov rbx, rax
test rax, rax
je 0x26f492b42
lea rdx, str.RtlGetVersion
mov rcx, rax
call fcn.26f4973f3
mov rdx, rax
test rax, rax
je 0x26f49269b
lea r8, [0x26f4a81c0]
mov ecx, 0x23
mov eax, 0
mov rdi, r8
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov dword [0x26f4a81c0], 0x11c
mov rcx, r8
call rdx
test eax, eax
jne 0x26f49267e
mov esi, 0
jmp 0x26f4926a0
mov r8d, eax
lea rdx, str.sys_init
lea rcx, str._E____s_____RtlGetVersion_failed_res_08lx__n
call fcn.26f49a202
mov esi, 0x40000001
jmp 0x26f4926a0
mov esi, 0x40000001
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x26f4926d7
and esi, 0x3fffffff
mov r8d, esi
lea rdx, str.sys_init
lea rcx, [0x26f4a0d68]
call fcn.26f49a202
mov eax, 0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [0x26f4a81c0]
mov qword [0x26f4a8038], rax
lea rbx, [0x26f4a82e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov qword [0x26f4a8040], rbx
mov edx, 0x104
lea rcx, [0x26f4a80a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x26f4927ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r8d, eax
lea rdx, str.sys_init
lea rcx, str._E____s_____GetWindowsDirectoryA_failed_gle_lu__n
call fcn.26f49a202
cmp esi, 0x20
ja 0x26f492757
ja case.0x26f49274b.1
mov eax, esi
lea rdx, [0x26f4a0d88]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov esi, 0x40000001
jmp 0x26f4926ad
cmp esi, 0x94
je 0x26f492b56
cmp esi, 0x94
ja 0x26f4927a2
cmp esi, 0x7f
ja 0x26f49278c
cmp esi, 0x7e
jae 0x26f492b60
cmp esi, 0x50
jne 0x26f492b6a
mov esi, 0x40000007
jmp 0x26f4926ad
cmp esi, 0x91
jne 0x26f492b74
mov esi, 0x4000000d
jmp 0x26f4926ad
cmp esi, 0xb7
je 0x26f492b7e
cmp esi, 0x80070005
je 0x26f492b88
cmp esi, 0xaa
jne 0x26f492b92
mov esi, 0x4000000d
jmp 0x26f4926ad
mov esi, 0x40000003
jmp 0x26f4926ad
mov esi, 0x40000009
jmp 0x26f4926ad
mov esi, 0x4000000d
jmp 0x26f4926ad
lea r8, [0x26f4a80a0]
mov qword [0x26f4a8028], r8
lea rdx, str.sys_init
lea rcx, str._I____s_____GetWindowsDirectoryA_done_sys_win_dir_s__n
call fcn.26f49a202
test esi, esi
jne 0x26f4926ad
mov qword [rsp + 0x48], 0x25
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x26f4a8060]
lea r8, str.MachineGuid
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call fcn.26f497e42
test eax, eax
je 0x26f4928fe
test esi, esi
jne 0x26f4926ad
mov rax, qword [0x26f4a8028]
movzx eax, byte [rax]
mov byte [rsp + 0x48], al
mov byte [rsp + 0x49], 0x3a
mov byte [rsp + 0x4a], 0x5c
mov byte [rsp + 0x4b], 0
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, 0
mov edx, 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x26f4929bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r9d, eax
lea r8, [rsp + 0x48]
lea rdx, str.sys_init
lea rcx, str._E____s_____GetVolumeInformationA_failed_vol_s_gle_lu__n
call fcn.26f49a202
cmp ebx, 0x20
ja 0x26f492924
ja case.0x26f4928fc.1
mov ebx, ebx
lea rdx, [0x26f4a0e0c]
movsxd rax, dword [rdx + rbx*4]
add rax, rdx
jmp rax
lea r8, [0x26f4a8060]
mov qword [0x26f4a8020], r8
lea rdx, str.sys_init
lea rcx, str._I____s_____GetWindowsDirectoryA_done_sys_mach_guid_s__n
add al, ch
jrcxz 0x26f492995
add byte [rax], al
add al, ch
jrcxz 0x26f492995
add byte [rax], al
jmp 0x26f492853
inc dword [rcx + 0x94fb]
add byte [rdi], cl
test byte [rdi + 1], dl
add dword [rax], eax
invalid
cmp ebx, 0x94
je 0x26f492a87
add dword [rax], eax
invalid
add dword [rax], eax
add byte [rdi + 0x37], dh
ja 0x26f492969
cmp ebx, 0x7f
ja 0x26f492953
cmp ebx, 0x7e
jae 0x26f492a91
cmp ebx, 0x50
jne 0x26f492a9b
mov esi, 0x40000007
jmp 0x26f4926ad
cmp ebx, 0x91
jne 0x26f492aa5
sti
xchg ecx, eax
add byte [rax], al
add byte [rdi], cl
test dword [rsi + 1], eax
add byte [rax], al
mov esi, 0x4000000d
jmp 0x26f4926ad
cmp ebx, 0xb7
je 0x26f492aaf
cmp ebx, 0x80070005
je 0x26f492ab9
cmp ebx, 0xaa
je 0x26f492993
mov esi, 0x40000001
jmp 0x26f4926ad
mov esi, 0x4000000d
jmp 0x26f4926ad
add byte [rax], al
jmp 0x26f4926ad
mov esi, 0x40000003
jmp 0x26f4926ad
mov esi, 0x40000009
jmp 0x26f4926ad
mov esi, 0x4000000d
jmp 0x26f4926ad
mov r9d, dword [rsp + 0x44]
lea r8, [rsp + 0x48]
lea rdx, str.sys_init
lea rcx, str._I____s_____GetVolumeInformationA_done_vol_s_vol_sn_08lx__n
call fcn.26f49a202
mov rax, qword [0x26f4a8040]
movzx ebx, word [rax + 0x2e]
mov rsi, qword [0x26f4a8020]
test rsi, rsi
je 0x26f492a01
mov rcx, rsi
call sub.msvcrt.dll_strlen
cmp rax, 0x24
clc
and al, 0xf
test dl, al
add byte [rax], al
invalid
clc
and al, 0xf
test dl, al
add byte [rax], al
add byte [rax - 0x75], cl
add eax, 0x15638
mov rax, qword [0x26f4a8040]
movzx esi, word [rax + 0x2c]
mov r8d, dword [rsp + 0x44]
movzx ebx, bx
shl rbx, 0x20
or r8, rbx
shl rsi, 0x30
or r8, rsi
mov qword [0x26f4a8030], r8
mov rax, qword [0x26f4a8038]
movzx edx, word [rax + 0x114]
mov r9d, dword [rax + 4]
movzx ecx, word [rax + 0x116]
mov dword [rsp + 0x38], ecx
movzx edx, dx
mov dword [rsp + 0x30], edx
mov edx, dword [rax + 0xc]
mov dword [rsp + 0x28], edx
mov eax, dword [rax + 8]
mov dword [rsp + 0x20], eax
lea rdx, str.sys_init
lea rcx, str._I____s_____Done_sys_uid_016llx_sys_os_ver_lu._lu._lu._d._d__n
call fcn.26f49a202
jmp 0x26f4926c9
mov esi, 0x40000001
jmp 0x26f4926ad
mov esi, 0x40000008
jmp 0x26f4926ad
mov esi, 0x4000000d
jmp 0x26f4926ad
mov esi, 0x40000003
jmp 0x26f4926ad
mov esi, 0x40000001
jmp 0x26f4926ad
mov esi, 0x40000001
jmp 0x26f4926ad
mov esi, 0x40000007
jmp 0x26f4926ad
mov esi, 0x40000009
jmp 0x26f4926ad
cmp byte [rsi + 8], 0x2d
jne 0x26f492a01
cmp byte [rsi + 0xd], 0x2d
jne 0x26f492a01
mov rbp, qword [sym.imp.msvcrt.dll__errno]
call rbp
mov dword [rax], 0
mov rax, qword [0x26f4a8020]
lea rcx, [rax + 9]
mov r8d, 0x10
mov edx, 0
call sub.msvcrt.dll_strtol
mov edi, eax
mov esi, eax
call rbp
cmp dword [rax], 0
jne 0x26f492b1a
test di, di
jne 0x26f492a0c
jmp 0x26f492a01
call qword [sym.imp.msvcrt.dll__errno]
mov r9d, dword [rax]
mov r8, qword [0x26f4a8020]
lea rdx, str.sys_init
lea rcx, str._E____s_____strtol_failed_sys_mach_guid_s_errno_d__n
call fcn.26f49a202
jmp 0x26f492a01
mov esi, 0x40000001
jmp 0x26f4926ad
mov esi, 0x40000008
jmp 0x26f4926ad
mov esi, 0x4000000d
jmp 0x26f4926ad
mov esi, 0x40000003
jmp 0x26f4926ad
mov esi, 0x40000001
jmp 0x26f4926ad
mov esi, 0x40000001
jmp 0x26f4926ad
mov esi, 0x40000007
jmp 0x26f4926ad
mov esi, 0x40000009
jmp 0x26f4926ad
mov esi, 0x40000001
jmp 0x26f4926ad