Function at 0x140001a60
Capabilities:
Get disk information
Terminate process

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x14001d040]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
lea r9, [rsp + 0x48]
mov dword [rsp + 0x38], edi
lea rcx, [0x1400139e0]
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x48], edi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140001c74
xorps xmm0, xmm0
mov qword [rsp + 0x80], rbx
movdqu xmmword [rsp + 0x50], xmm0
xor eax, eax
mov dword [rsp + 0x40], 0x2b394834
xor ecx, ecx
mov dword [rsp + 0x44], 0x16362516
cpuid
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x5c], edx
movdqu xmm0, xmmword [rsp + 0x50]
mov dword [rsp + 0x50], 0xbeebaca9
mov dword [rsp + 0x54], 0xee4e9245
movups xmm1, xmm0
psrldq xmm0, 8
paddd xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ebx, xmm1
nop dword [rax + rax]
cmp ebx, dword [rsp + rdi + 0x40]
jne 0x140001b30
cmp eax, dword [rsp + rdi + 0x50]
je 0x140001bce
add rdi, 4
cmp rdi, 8
jb 0x140001b20
mov ecx, 4
call fcn.140001a30
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140013a34]
call fcn.14000d100
mov ecx, 7
call fcn.140001a30
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Your_HASH:
call fcn.14000d100
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._and_your_SN:
call fcn.14000d100
mov edx, dword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._are_NOT_approved._Exiting_injector
call fcn.14000d100
lea rdx, [0x14000d4b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n___
call fcn.14000d100
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Your_HASH:
call fcn.14000d100
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._and_your_SN:
call fcn.14000d100
mov edx, dword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._ARE_approved._Starting_injector
call fcn.14000d100
lea rdx, [0x14000d4b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140010290
add rsp, 0x70
pop rdi
ret