Function at 0x1400034e0
Capabilities:
Get disk information
Get hostname

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14007b080]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x40], 0x80
lea rdx, [rsp + 0x40]
lea rcx, [r11 - 0xb8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x140003842
movdqa xmm0, xmmword [0x14006e550]
movdqu xmmword [rsp + 0x80], xmm0
mov byte [rsp + 0x70], 0
lea rax, [rsp + 0x90]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140003564
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
call fcn.140002180
nop
lea rbp, [rsp + 0x70]
mov r15, qword [rsp + 0x70]
mov r13, qword [rsp + 0x88]
cmp r13, 0x10
cmovae rbp, r15
xor r12d, r12d
mov rax, qword [rsp + 0x80]
cmp rax, 2
jb 0x140003610
lea r14, [rax + rbp]
lea r8, [r14 - 1]
sub r8, rbp
lea edx, [r12 + 0x56]
mov rcx, rbp
call fcn.140032fb0
test rax, rax
je 0x140003610
movzx edi, byte [0x14006db45]
movzx esi, byte [0x14006db44]
cmp byte [rax], sil
jne 0x1400035e7
cmp byte [rax + 1], dil
jne 0x1400035e7
mov ecx, r12d
jmp 0x1400035ec
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140003709
inc rax
lea r8, [r14 - 1]
sub r8, rax
mov edx, 0x56
mov rcx, rax
call fcn.140032fb0
test rax, rax
jne 0x1400035d7
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, 0x80
lea rdx, [rsp + 0x90]
lea rcx, [0x14006db6c]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x140003806
movdqa xmm0, xmmword [0x14006e550]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], r12b
lea rax, [rsp + 0x90]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140003665
mov r8, rbx
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.140002180
lea rbx, [rsp + 0x50]
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x68]
cmp r14, 0x10
cmovae rbx, rbp
mov rsi, qword [rsp + 0x60]
cmp rsi, 6
jb 0x140003754
lea rdi, [rsi + rbx]
lea r8, [rdi - 5]
sub r8, rbx
mov edx, 0x56
mov rcx, rbx
call fcn.140032fb0
mov r9, rax
test rax, rax
je 0x140003754
lea r12, [0x14006db84]
nop dword [rax]
nop dword [rax + rax]
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [r12 + rcx - 1]
jne 0x14000371d
cmp rcx, 6
jne 0x1400036f0
xor eax, eax
jmp 0x140003722
sub rax, rbp
cmp rax, 0xffffffffffffffff
je 0x140003610
mov bl, 1
jmp 0x140003808
sbb eax, eax
or eax, 1
test eax, eax
je 0x140003747
inc r9
lea r8, [rdi - 5]
sub r8, r9
mov edx, 0x56
mov rcx, r9
call fcn.140032fb0
mov r9, rax
test rax, rax
jne 0x1400036e0
jmp 0x140003754
sub r9, rbx
cmp r9, 0xffffffffffffffff
jne 0x140003880
lea rdi, [rsp + 0x50]
cmp r14, 0x10
cmovae rdi, rbp
cmp rsi, 7
jb 0x1400037cf
lea r8, [rsi - 6]
add r8, rdi
sub r8, rdi
mov edx, 0x56
mov rcx, rdi
call fcn.140032fb0
mov rbx, rax
test rax, rax
je 0x1400037cf
nop word [rax + rax]
mov r8d, 7
lea rdx, [0x14006db90]
mov rcx, rbx
call fcn.140033030
test eax, eax
je 0x140003873
inc rbx
lea r8, [rsi - 6]
add r8, rdi
sub r8, rbx
mov edx, 0x56
mov rcx, rbx
call fcn.140032fb0
mov rbx, rax
test rax, rax
jne 0x140003790
cmp r14, 0x10
jb 0x140003806
lea rdx, [r14 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x1400037fe
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038c0
mov rcx, rbp
call fcn.140030d20
xor bl, bl
cmp r13, 0x10
jb 0x14000383f
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140003837
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038ba
mov rcx, r15
call fcn.140030d20
movzx eax, bl
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140030cc0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
je 0x1400037cf
cmp r14, 0x10
jb 0x1400038b3
lea rdx, [r14 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x1400038ab
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038c6
mov rcx, rbp
call fcn.140030d20
mov bl, 1
jmp 0x140003808
call fcn.14003523c
nop
call fcn.14003523c
int3
call fcn.14003523c
int3