Function at 0x140007d80
Capabilities:
Enumerate network shares
Get disk information
Get disk size
Get geographical location
Get keyboard layout
Get local ipv4 addresses
Get memory capacity
Get networking parameters
List domain servers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2f8
movapd xmmword [rsp + 0x2e0], xmm7
movapd xmmword [rsp + 0x2d0], xmm6
mov qword [rsp + 0x68], rdx
mov rbx, rcx
mov rax, qword [0x140051088]
xor rax, rsp
mov qword [rsp + 0x2c8], rax
call fcn.140020ca0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.140020b90
test rax, rax
je 0x140007dff
mov rsi, rax
lea rdx, [0x14004a3bf]
mov rcx, rdi
mov r8, rax
call fcn.140020ab0
test eax, eax
jne 0x140007dff
mov rcx, rsi
call fcn.14001f3e0
mov word [rsp + 0xc0], 0
mov word [rsp + 0x70], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0xc0]
lea r8, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process2]
test eax, eax
je 0x140007e76
cmp word [rsp + 0xc0], 0
lea rax, [0x14004a4b9]
lea rcx, [0x14004a4a3]
cmove rcx, rax
call fcn.140020c10
test rax, rax
je 0x140007e76
mov rsi, rax
lea rdx, str.architecture
mov rcx, rdi
mov r8, rax
call fcn.140020ab0
test eax, eax
jne 0x140007e76
mov rcx, rsi
call fcn.14001f3e0
mov rcx, rdi
call fcn.140008bb0
mov rcx, rdi
call fcn.140008c60
lea rsi, [rsp + 0xc0]
mov r8d, 0x104
mov rcx, rsi
xor edx, edx
call fcn.140022fe0
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140007ee6
lea rcx, [rsp + 0xc0]
call fcn.140020c10
test rax, rax
je 0x140007ee6
mov rsi, rax
lea rdx, str.filename
mov rcx, rdi
mov r8, rax
call fcn.140020ab0
test eax, eax
jne 0x140007ee6
mov rcx, rsi
call fcn.14001f3e0
mov rcx, rdi
call fcn.140008d10
lea rcx, [0x14004a561]
call fcn.140020c10
test rax, rax
je 0x140007f20
mov rsi, rax
lea rdx, str.version
mov rcx, rdi
mov r8, rax
call fcn.140020ab0
test eax, eax
jne 0x140007f20
mov rcx, rsi
call fcn.14001f3e0
mov rcx, qword [rbx + 0x50]
call fcn.140020c10
test rax, rax
je 0x140007f4f
mov rsi, rax
lea rdx, str.channel
mov rcx, rdi
mov r8, rax
call fcn.140020ab0
test eax, eax
jne 0x140007f4f
mov rcx, rsi
call fcn.14001f3e0
mov rcx, rbx
mov rdx, rdi
call fcn.140008ea0
mov rcx, rdi
call fcn.140008fa0
mov rcx, rdi
call fcn.140009110
mov rcx, rdi
call fcn.1400091f0
mov rcx, rdi
call fcn.1400092c0
mov rcx, rdi
call fcn.140009400
mov rcx, rdi
call fcn.140009770
mov word [rsp + 0xc0], 0
mov word [rsp + 0x70], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0xc0]
lea r8, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process2]
test eax, eax
je 0x140008001
cmp word [rsp + 0xc0], 0
lea rax, [0x14004a4b9]
lea rcx, [0x14004a4a3]
cmove rcx, rax
call fcn.140020c10
test rax, rax
je 0x140008001
mov rsi, rax
lea rdx, str.architecture
mov rcx, rdi
mov r8, rax
call fcn.140020ab0
test eax, eax
jne 0x140008001
mov rcx, rsi
call fcn.14001f3e0
lea rsi, [rsp + 0xc0]
mov r8d, 0x200
mov rcx, rsi
xor edx, edx
call fcn.140022fe0
xor ecx, ecx
call fcn.14002c300
mov qword [rsp + 0xb8], rax
xorpd xmm6, xmm6
movapd xmmword [rsp + 0x80], xmm6
movapd xmmword [rsp + 0x70], xmm6
mov dword [rsp + 0x90], 0
lea rbp, [rsp + 0x70]
lea rdx, [rsp + 0xb8]
mov rcx, rbp
call fcn.14002b7fc
lea r8, str._Y__m__e__H:_M:_S
mov edx, 0x200
mov rcx, rsi
mov r9, rbp
call fcn.14002d488
mov rcx, rsi
call fcn.140020c10
test rax, rax
je 0x1400080a0
mov rsi, rax
lea rdx, str.date
mov rcx, rdi
mov r8, rax
call fcn.140020ab0
test eax, eax
jne 0x1400080a0
mov rcx, rsi
call fcn.14001f3e0
mov qword [rsp + 0x58], rbx
movapd xmmword [rsp + 0x1b0], xmm6
movapd xmmword [rsp + 0x1a0], xmm6
movapd xmmword [rsp + 0x190], xmm6
movapd xmmword [rsp + 0x180], xmm6
movapd xmmword [rsp + 0x170], xmm6
movapd xmmword [rsp + 0x160], xmm6
movapd xmmword [rsp + 0x150], xmm6
movapd xmmword [rsp + 0x140], xmm6
movapd xmmword [rsp + 0x130], xmm6
movapd xmmword [rsp + 0x120], xmm6
movapd xmmword [rsp + 0x110], xmm6
movapd xmmword [rsp + 0x100], xmm6
movapd xmmword [rsp + 0xf0], xmm6
movapd xmmword [rsp + 0xe0], xmm6
movapd xmmword [rsp + 0xd0], xmm6
movapd xmmword [rsp + 0xc0], xmm6
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
and eax, 0x3ff
lea rsi, [rsp + 0xc0]
mov ecx, eax
mov edx, 2
mov r8, rsi
mov r9d, 0x100
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov rcx, rsi
call fcn.140020c10
test rax, rax
je 0x14000818e
mov rsi, rax
lea rdx, str.locale
mov rcx, rdi
mov r8, rax
call fcn.140020ab0
test eax, eax
jne 0x14000818e
mov rcx, rsi
call fcn.14001f3e0
mov qword [rsp + 0x50], rdi
mov ebp, 0x80000000
mov eax, 0x80000000
xor ecx, ecx
cpuid
test eax, eax
js 0x1400084f7
lea rcx, [rsp + 0xc0]
call fcn.140020c10
test rax, rax
mov r14, qword [rsp + 0x50]
je 0x140008272
mov rsi, rax
lea rdx, [0x14004a41c]
mov rcx, r14
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x14000826a
xorpd xmm0, xmm0
movapd xmmword [rsp + 0x70], xmm0
movapd xmmword [rsp + 0xa0], xmm0
movapd xmmword [rsp + 0x90], xmm0
movapd xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x70], 0x40
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
movsd xmm1, qword [rsp + 0x78]
unpcklps xmm1, xmmword [0x140041200]
subpd xmm1, xmmword [0x140041210]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
call fcn.140020b90
test rax, rax
je 0x14000826a
mov rdi, rax
lea rdx, [0x14004a432]
mov rcx, r14
mov r8, rax
call fcn.140020ab0
test eax, eax
jne 0x140008272
mov rcx, rsi
call fcn.14001f3e0
mov rcx, rdi
jmp 0x14000826d
mov rcx, rsi
call fcn.14001f3e0
call fcn.140020ce0
test rax, rax
je 0x1400083e8
mov rdi, rax
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
lea r13, [rsp + 0xb8]
lea r14, [0x14004a34c]
lea r15, [rsp + 0x70]
mov r12, qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
movapd xmm6, xmmword [0x140041200]
movapd xmm7, xmmword [0x140041210]
jmp 0x1400082ce
add rbp, 1
cmp rbp, 0x19
je 0x1400089a7
bt ebx, ebp
jae 0x1400082c0
lea eax, [rbp + 0x41]
mov byte [rsp + 0xb8], al
mov word [rsp + 0xb9], 0x3a
call fcn.140020ca0
test rax, rax
je 0x1400083db
mov rsi, rax
mov rcx, rdi
mov rdx, rax
call fcn.140020a60
test eax, eax
je 0x1400083db
mov rcx, r13
call fcn.140020c10
test rax, rax
je 0x1400083db
mov rcx, rsi
mov rdx, r14
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x1400083db
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0x70], 0
mov rcx, r13
xor edx, edx
lea r8, [rsp + 0xc0]
mov r9, r15
call r12
test eax, eax
je 0x1400082c0
movsd xmm1, qword [rsp + 0xc0]
unpcklps xmm1, xmm6
subpd xmm1, xmm7
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
call fcn.140020b90
test rax, rax
je 0x1400083db
mov rcx, rsi
lea rdx, str.size
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x1400083db
movsd xmm1, qword [rsp + 0x70]
unpcklps xmm1, xmm6
subpd xmm1, xmm7
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
call fcn.140020b90
test rax, rax
je 0x1400083db
mov rcx, rsi
lea rdx, str.free
mov r8, rax
call fcn.140020ab0
test eax, eax
jne 0x1400082c0
mov r14, qword [rsp + 0x50]
mov rcx, rdi
call fcn.14001f3e0
call fcn.140020ca0
mov rbx, rax
lea rdx, str.interfaces
mov rcx, r14
mov r8, rax
call fcn.140020ab0
mov qword [rsp + 0xc0], 0
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
cmp eax, 0x6f
jne 0x140008463
mov rcx, qword [rsp + 0xc0]
mov edx, 1
call fcn.14002c370
test rax, rax
je 0x140008463
mov r13, rax
lea rdx, [rsp + 0xc0]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
test eax, eax
je 0x1400089cb
mov rcx, r13
call fcn.14002c850
test rbx, rbx
je 0x14000846b
mov rcx, rbx
call fcn.14001f3e0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0xb8], 0
xorpd xmm0, xmm0
movupd xmmword [rsp + 0x38], xmm0
lea rbx, [rsp + 0xb8]
mov qword [rsp + 0x28], rbx
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x30], 1
lea r8, [rsp + 0xc0]
xor ecx, ecx
mov edx, 0x65
mov r9d, 0xffffffff
call sub.NETAPI32.dll_NetServerEnum
test eax, eax
je 0x1400085b2
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
mov rbp, qword [rsp + 0x58]
je 0x1400086be
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x1400086be
mov edi, eax
lea r8, [rsp + 0xec]
lea r11, [rsp + 0xd4]
lea r14, [rsp + 0xd8]
lea r15, [rsp + 0xdc]
lea r12, [rsp + 0xc4]
lea r13, [rsp + 0xc8]
lea rsi, [rsp + 0xcc]
jmp 0x14000856d
mov dword [rsp + 0xe0], eax
lea rax, [rsp + 0xe4]
lea r9, [rsp + 0xe8]
mov r10, r8
mov dword [rax], ebx
mov dword [r9], ecx
mov dword [r10], edx
add ebp, 1
cmp ebp, edi
ja 0x1400081a9
mov eax, ebp
xor ecx, ecx
cpuid
cmp ebp, 0x80000004
je 0x140008540
cmp ebp, 0x80000003
je 0x1400085a0
cmp ebp, 0x80000002
jne 0x140008562
mov dword [rsp + 0xc0], eax
mov rax, r12
mov r9, r13
mov r10, rsi
jmp 0x14000855a
mov dword [rsp + 0xd0], eax
mov rax, r11
mov r9, r14
mov r10, r15
jmp 0x14000855a
call fcn.140020ce0
mov r12, rax
lea rdx, str.network
mov rcx, r14
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x14000897b
mov rdi, qword [rsp + 0xc0]
cmp qword [rsp + 0xb8], 0
je 0x1400086b1
add rdi, 0x20
xor ebx, ebx
lea r14, str.comment
lea r15, [0x14004a34c]
jmp 0x140008622
add rbx, 1
add rdi, 0x28
cmp rbx, qword [rsp + 0xb8]
jae 0x140008697
call fcn.140020ca0
mov rbp, rax
mov rcx, r12
mov rdx, rax
call fcn.140020a60
mov rcx, qword [rdi]
call fcn.140007020
mov r13, rax
mov rcx, rax
call fcn.140020c10
mov rcx, rbp
mov rdx, r14
mov r8, rax
call fcn.140020ab0
mov rcx, qword [rdi - 0x18]
call fcn.140007020
mov rsi, rax
mov rcx, rax
call fcn.140020c10
mov rcx, rbp
mov rdx, r15
mov r8, rax
call fcn.140020ab0
test r13, r13
je 0x140008685
mov rcx, r13
call fcn.14002c850
test rsi, rsi
je 0x140008610
mov rcx, rsi
call fcn.14002c850
jmp 0x140008610
mov rdi, qword [rsp + 0xc0]
mov r14, qword [rsp + 0x50]
lea rsi, [rsp + 0x70]
lea rbx, [rsp + 0xb8]
mov rcx, rdi
call sub.NETAPI32.dll_NetApiBufferFree
mov rbp, qword [rsp + 0x58]
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0xc0]
xor ecx, ecx
mov edx, 0x1f6
mov r9d, 0xffffffff
call sub.NETAPI32.dll_NetShareEnum
test eax, eax
je 0x140008726
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
jne 0x140008887
jmp 0x14000888c
call fcn.140020ce0
mov rdi, rax
lea rdx, str.shares
mov rcx, r14
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x140008991
mov rbx, qword [rsp + 0xc0]
cmp qword [rsp + 0xb8], 0
je 0x140008884
xor r12d, r12d
jmp 0x140008786
add r12, 1
add rbx, 0x48
cmp r12, qword [rsp + 0xb8]
jae 0x140008872
call fcn.140020ca0
mov rsi, rax
mov rcx, rdi
mov rdx, rax
call fcn.140020a60
mov rcx, qword [rbx]
call fcn.140007020
mov r15, rax
mov rcx, rax
call fcn.140020c10
mov rcx, rsi
lea rdx, str.netname
mov r8, rax
call fcn.140020ab0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400087f6
call fcn.140007020
mov rbp, rax
mov rcx, rax
call fcn.140020c10
mov rcx, rsi
lea rdx, str.passwd
mov r8, rax
call fcn.140020ab0
test rbp, rbp
je 0x1400087f6
mov rcx, rbp
call fcn.14002c850
mov rcx, qword [rbx + 0x10]
call fcn.140007020
mov r13, rax
mov rcx, rax
call fcn.140020c10
mov rcx, rsi
lea rdx, str.remark
mov r8, rax
call fcn.140020ab0
mov rcx, qword [rbx + 0x28]
call fcn.140007020
mov r14, rax
mov rcx, rax
call fcn.140020c10
mov rcx, rsi
lea rdx, str.path
mov r8, rax
call fcn.140020ab0
test r15, r15
je 0x14000884f
mov rcx, r15
call fcn.14002c850
test r13, r13
je 0x14000885c
mov rcx, r13
call fcn.14002c850
test r14, r14
je 0x140008770
mov rcx, r14
call fcn.14002c850
jmp 0x140008770
mov rbx, qword [rsp + 0xc0]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rcx, rbx
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, r14
call fcn.14001ffc0
mov rsi, rax
test rax, rax
je 0x14000891a
mov rcx, rbp
call fcn.140004b80
test rax, rax
je 0x14000891a
mov rdi, rax
mov rax, qword [rsp + 0x68]
mov ebx, dword [rax]
mov rcx, rsi
call fcn.14002d8b0
lea rdx, [rax + 1]
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
mov rcx, rdi
mov r8, rsi
mov r9d, ebx
call fcn.140004ab0
test al, al
je 0x14000891c
mov rcx, rbp
mov rdx, rdi
call fcn.1400043a0
test al, al
je 0x14000891c
mov rcx, rdi
call fcn.140004bf0
mov rcx, rsi
call fcn.14002c850
mov rcx, r14
call fcn.14001f3e0
mov sil, 1
jmp 0x140008945
xor edi, edi
test r14, r14
je 0x140008929
mov rcx, r14
call fcn.14001f3e0
test rdi, rdi
je 0x140008936
mov rcx, rdi
call fcn.140004bf0
test rsi, rsi
je 0x140008943
mov rcx, rsi
call fcn.14002c850
xor esi, esi
mov rcx, qword [rsp + 0x2c8]
xor rcx, rsp
call fcn.140021820
mov eax, esi
movaps xmm6, xmmword [rsp + 0x2d0]
movaps xmm7, xmmword [rsp + 0x2e0]
add rsp, 0x2f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r12, r12
je 0x1400084d7
mov rcx, r12
call fcn.14001f3e0
jmp 0x1400084d7
test rdi, rdi
je 0x140008710
mov rcx, rdi
call fcn.14001f3e0
jmp 0x140008710
lea rdx, str.disk
mov r14, qword [rsp + 0x50]
mov rcx, r14
mov r8, rdi
call fcn.140020ab0
test eax, eax
jne 0x1400083e8
jmp 0x1400083e0
call fcn.140020ce0
mov rsi, rax
lea rdx, [0x14004a197]
mov rcx, rbx
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x140008456
mov rdi, r13
add rdi, 0x110
nop word [rax + rax]
lea rcx, [rdi + 8]
call fcn.140020c10
mov rcx, rsi
mov rdx, rax
call fcn.140020a60
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140008a00
mov qword [rsp + 0xc0], 0
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140008456
mov rcx, qword [rsp + 0xc0]
mov edx, 1
call fcn.14002c370
test rax, rax
je 0x140008456
mov rbp, rax
lea rdx, [rsp + 0xc0]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x140008a8d
mov rcx, r13
call fcn.14002c850
test rbp, rbp
je 0x14000845e
mov r13, rbp
jmp 0x140008456
call fcn.140020ca0
lea rdx, str.adapters
mov rcx, rbx
mov qword [rsp + 0x60], rax
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x140008a74
lea rsi, [0x14004a23f]
lea r15, str.netmask
call fcn.140020ca0
mov rdi, rax
lea rdx, [rbp + 0xc]
mov rcx, qword [rsp + 0x60]
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x140008a74
lea rcx, [rbp + 0x110]
call fcn.140020c10
mov rcx, rdi
lea rdx, str.description
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x140008a74
call fcn.140020ce0
mov r14, rax
mov rcx, rdi
lea rdx, str.addresses
mov r8, rax
call fcn.140020ab0
test eax, eax
je 0x140008b9d
mov rdi, rbp
lea r12, [rbp + 0x1b8]
nop word [rax + rax]
call fcn.140020ca0
mov rbp, rax
lea rcx, [r12 + 8]
call fcn.140020c10
mov rcx, rbp
mov rdx, rsi
mov r8, rax
call fcn.140020ab0
lea rcx, [r12 + 0x18]
call fcn.140020c10
mov rcx, rbp
mov rdx, r15
mov r8, rax
call fcn.140020ab0
mov rcx, r14
mov rdx, rbp
call fcn.140020a60
mov r12, qword [r12]
test r12, r12
jne 0x140008b30
mov rbp, rdi
mov rbp, qword [rdi]
test rbp, rbp
mov r14, qword [rsp + 0x50]
jne 0x140008abb
mov rcx, r13
call fcn.14002c850
jmp 0x14000846b
mov r14, qword [rsp + 0x50]
jmp 0x140008a74