Function at 0x140005010
Capabilities:
Get disk information
Get hostname
Get session user name

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x628
lea rcx, [0x14001a7c8]
mov rbx, rdx
lea rdi, [rsp + 0xe0]
mov dword [rsp + 0xac], 0
lea rbp, [rsp + 0x210]
call fcn.140006e10
lea r9, [rsp + 0xac]
xor r8d, r8d
xor edx, edx
mov r12, rax
mov rcx, rax
mov dword [rsp + 0x38], 0
lea r13, [rsp + 0xd0]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rcx, r12
lea r12, [rsp + 0x410]
call fcn.140006ea0
mov rcx, rdi
lea rdx, [rsp + 0xb4]
mov dword [rsp + 0xb4], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r8, [rsp + 0xb0]
mov rdx, rbp
mov ecx, 2
mov dword [rsp + 0xb0], 0x100
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rdx, [rsp + 0xb8]
mov rcx, r12
mov dword [rsp + 0xb8], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r8d, 0xffffffff
mov rcx, rbx
lea edx, [rax + rax]
call fcn.140001f50
xor eax, dword [rsp + 0xac]
mov rcx, rdi
mov r8d, 0xffffffff
mov dword [rsp + 0xc8], eax
mov eax, dword [rsp + 0xb4]
lea edx, [rax + rax]
call fcn.140001f50
mov r8d, 0xffffffff
mov rcx, r12
mov esi, eax
mov eax, dword [rsp + 0xb8]
lea edx, [rax + rax]
call fcn.140001f50
mov rcx, r13
xor esi, eax
mov dword [rsp + 0xcc], esi
call fcn.140005e70
lea rcx, [0x140019100]
call fcn.140006d90
lea rcx, [0x140019040]
mov rsi, rax
call fcn.140006e10
mov qword [rsp + 0x38], rsi
mov r9, rdi
mov r8, rbp
lea rdx, [rsp + 0xc4]
mov dword [rsp + 0x40], 1
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x58], rdx
mov rdx, r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rcx
call fcn.140002980
mov qword [rsp + 0x78], rax
mov rdi, rax
test rax, rax
je 0x14000534a
mov ebx, dword [rsp + 0xc4]
mov ecx, ebx
call fcn.140001570
movsxd rcx, eax
call fcn.140005de0
mov r12, rax
test rax, rax
je 0x140005340
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call fcn.140001590
movsxd rcx, eax
mov rbx, rcx
add rcx, rcx
call fcn.140005de0
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005868
mov r9d, 0xffffffff
mov r8, r12
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, r12
call fcn.140005e40
lea rax, [rsp + 0xbc]
mov rbp, qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x88], rax
lea rcx, [0x140019180]
call fcn.140006e10
lea rcx, [0x140019140]
mov r13, rax
call fcn.140006e10
mov dword [rsp + 0x48], 0
mov rcx, r13
movzx r8d, word [0x140019020]
mov r14, rax
mov rax, qword [rsp + 0x88]
mov dword [rsp + 0x38], 0
mov r9d, 1
mov qword [rsp + 0x30], 0
mov rdx, r14
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [0x14001a7d8]
mov qword [rsp + 0x20], rax
call fcn.140002030
mov r12, rax
test rax, rax
je 0x1400052f1
cmp dword [rsp + 0xbc], 4
ja 0x140005378
mov rcx, r14
call fcn.140006ea0
mov rcx, r13
call fcn.140006ea0
lea rcx, [0x14001a7f0]
call fcn.140006e10
mov ecx, 0x100000
xor edx, edx
mov r12, rax
mov r8, rax
call rbp
mov rcx, rax
test rax, rax
je 0x140005858
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call fcn.140006ea0
mov rcx, qword [rsp + 0x60]
call fcn.140005e40
mov rcx, qword [rsp + 0x78]
call fcn.140005e40
mov rcx, qword [rsp + 0x70]
call fcn.140006ea0
mov rcx, rsi
call fcn.140006ea0
nop
add rsp, 0x628
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
lea r15, [rsp + 0x100]
call sub.msvcrt.dll_strlen
mov rdx, rsi
mov rcx, r15
mov r8, rax
call fcn.140006220
mov r8, r12
mov rdx, r12
mov rcx, r15
mov r9d, dword [rsp + 0xbc]
call fcn.140006350
mov eax, dword [rsp + 0xbc]
xor r8d, r8d
lea rcx, [r12 + 4]
lea edx, [rax - 4]
call fcn.140001f50
cmp eax, dword [r12]
je 0x1400053e0
mov rcx, r12
call fcn.140005e40
jmp 0x1400052f1
mov eax, dword [r12 + 4]
lea rdi, [r12 + 8]
mov dword [rsp + 0x6c], eax
test eax, eax
je 0x1400053c9
mov dword [rsp + 0x68], 0
mov r15, qword [rsp + 0x80]
xor ebx, ebx
mov qword [rsp + 0x90], r12
mov r12, rdi
nop
mov edx, dword [r12]
cmp edx, 0xb
ja case.0x14000542d.0
lea rdi, [0x14001a844]
mov eax, edx
movsxd rax, dword [rdi + rax*4]
add rax, rdi
jmp rax
mov rax, qword [rsp + 0x58]
mov edx, dword [r12 + 4]
mov r9, rsi
mov rcx, r15
mov dword [rsp + 0x20], 1
lea r8, [r12 + 0x10]
mov qword [rsp + 0x28], rax
call fcn.140003f60
mov rdi, rax
test rax, rax
je 0x1400054c8
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], rdi
mov rcx, r13
movzx r8d, word [0x140019020]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xc4]
mov r9d, 2
mov rdx, r14
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [0x14001a7d8]
mov qword [rsp + 0x20], rax
call fcn.140002030
mov rcx, rax
test rax, rax
je 0x1400054c0
call fcn.140005e40
mov rcx, rdi
call fcn.140005e40
add r12, 8
add ebx, 1
cmp dword [rsp + 0x6c], ebx
jne 0x140005410
mov r12, qword [rsp + 0x90]
mov rcx, r12
call fcn.140005e40
mov rcx, r14
call fcn.140006ea0
mov rcx, r13
call fcn.140006ea0
lea rcx, [0x14001a7f0]
call fcn.140006e10
mov ecx, 0x100000
xor edx, edx
mov r12, rax
mov r8, rax
call rbp
mov rcx, rax
test rax, rax
jne 0x140005328
mov rcx, r12
call fcn.140006ea0
mov eax, dword [rsp + 0x68]
test eax, eax
jne 0x140005336
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
lea ecx, [rax + 0xbb8]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005268
mov rax, qword [rsp + 0x58]
mov r8d, dword [r12 + 4]
mov qword [rsp + 0x30], rsi
mov rcx, r15
mov dword [rsp + 0x38], 1
lea r9, [r12 + 0x18]
mov qword [rsp + 0x40], rax
mov eax, dword [r12 + 0x14]
mov dword [rsp + 0x28], eax
mov eax, dword [r12 + 0x10]
lea rax, [r12 + rax - 8]
mov qword [rsp + 0x20], rax
call fcn.1400049c0
mov rdi, rax
test rax, rax
je 0x14000560a
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], rdi
mov rcx, r13
movzx r8d, word [0x140019020]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xc4]
mov r9d, 2
mov rdx, r14
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [0x14001a7d8]
mov qword [rsp + 0x20], rax
call fcn.140002030
mov rcx, rax
test rax, rax
je 0x140005602
call fcn.140005e40
mov rcx, rdi
call fcn.140005e40
add r12, 0x10
add ebx, 1
cmp dword [rsp + 0x6c], ebx
jne 0x140005410
jmp 0x1400054d9
mov rdi, qword [rsp + 0x58]
mov eax, dword [r12 + 0x10]
lea r8, [r12 + 0x18]
mov edx, dword [r12 + 4]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rdi
lea r9, [r12 + rax - 8]
mov qword [rsp + 0x28], rsi
mov ecx, dword [r12 + 0x14]
mov dword [rsp + 0x20], ecx
mov rcx, r15
call fcn.140003ca0
mov rdi, rax
test rax, rax
jne 0x1400055a1
jmp 0x14000560a
mov rax, qword [rsp + 0x58]
mov edx, dword [r12 + 4]
mov r9, rsi
mov rcx, r15
mov dword [rsp + 0x20], 1
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x28], rax
mov r8, rdi
mov r12, rdi
call fcn.140004320
mov r11, rax
test rax, rax
je case.0x14000542d.0
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], r11
mov rcx, r13
movzx r8d, word [0x140019020]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xc4]
mov r9d, 2
mov rdx, r14
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x98], r11
mov qword [rsp + 0x28], rax
lea rax, [0x14001a7d8]
mov qword [rsp + 0x20], rax
call fcn.140002030
mov r11, qword [rsp + 0x98]
test rax, rax
mov rcx, rax
je 0x140005722
call fcn.140005e40
mov r11, qword [rsp + 0x98]
mov rcx, r11
mov r12, rdi
add ebx, 1
call fcn.140005e40
cmp dword [rsp + 0x6c], ebx
jne 0x140005410
jmp 0x1400054d9
mov rax, qword [rsp + 0x58]
mov edx, dword [r12 + 4]
mov r8, rsi
mov rcx, r15
mov r9d, 1
mov qword [rsp + 0x20], rax
call fcn.140003a30
mov rdi, rax
test rax, rax
jne 0x14000545f
jmp 0x1400054c8
mov rax, qword [rsp + 0x58]
mov edx, dword [r12 + 4]
mov r8, rsi
mov rcx, r15
mov r9d, 1
mov qword [rsp + 0x20], rax
call fcn.1400032b0
mov rdi, rax
test rax, rax
jne 0x14000545f
jmp 0x1400054c8
mov rax, qword [rsp + 0x58]
mov edx, dword [r12 + 4]
mov r8, rsi
mov rcx, r15
mov r9d, 1
mov qword [rsp + 0x20], rax
call fcn.140002e50
mov rdi, rax
test rax, rax
jne 0x14000545f
jmp 0x1400054c8
call fcn.140004ef0
add r12, 8
add ebx, 1
mov dword [rsp + 0x68], 1
cmp dword [rsp + 0x6c], ebx
jne 0x140005410
jmp 0x1400054d9
lea rcx, [0x14001a7dc]
call fcn.140006d90
mov r8d, dword [r12 + 0xc]
mov ecx, 2
mov rdi, rax
mov eax, dword [r12 + 8]
mov r9, rdi
lea rdx, [r12 + rax - 8]
lea rax, [0x14001a3d0]
mov qword [rsp + 0x20], rax
call fcn.140007030
mov rcx, rdi
call fcn.140006ea0
jmp 0x1400054c8
mov rcx, r12
call fcn.140006ea0
jmp 0x140005538
mov rcx, r12
call fcn.140005e40
jmp 0x140005340