Function at 0x1400080a0
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3160]
mov eax, 0x3260
call fcn.140019100
sub rsp, rax
mov rax, qword [0x140023008]
xor rax, rsp
mov qword [rbp + 0x3150], rax
mov r15, rdx
mov rbx, rcx
mov rcx, rdx
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_4285]
mov r14, rax
lea rsi, [r15 + 8]
movabs rax, 0x5c003f003f005c00
cmp qword [r15], rax
cmovne rsi, r15
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.14000cae8
xor r12d, r12d
cmp r14, rsi
jbe 0x1400081a5
mov rcx, r14
sub rcx, rsi
sar rcx, 1
dec rcx
mov r8, qword [rsp + 0x48]
cmp rcx, r8
ja 0x14000814b
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rcx
mov word [rax + rcx*2], r12w
jmp 0x1400081a5
mov rdx, rcx
sub rdx, r8
mov rax, qword [rsp + 0x50]
sub rax, r8
cmp rdx, rax
ja 0x140008192
mov qword [rsp + 0x48], rcx
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r9, qword [rsp + 0x38]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140008187
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r12w
jmp 0x1400081a5
mov word [rsp + 0x20], r12w
mov r9, rdx
lea rcx, [rsp + 0x38]
call fcn.14000e490
movzx edi, word [rsi]
mov word [rbp + 0x10b0], r12w
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r12w
jne 0x1400081b4
mov edx, 0xc
mov ecx, edx
cmp rax, rdx
cmovb rcx, rax
test ecx, ecx
jns 0x1400081de
xor edx, edx
mov ecx, 0x1f5c2188
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2055]
int3
cmp ecx, edx
je 0x1400081e7
mov al, r12b
jmp 0x140008201
mov r9d, edx
lea r8, str.SystemRoot_
mov edx, ecx
mov rcx, rsi
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_103]
test eax, eax
sete al
mov esi, 0x824
test al, al
je 0x140008237
lea r8, str._SystemRoot__
mov edx, esi
lea rcx, [rbp + 0x10b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
add r8, 0x18
jmp 0x140008265
cmp di, 0x5c
jne 0x140008275
lea r8, str._SystemDrive_
mov rdx, rsi
lea rcx, [rbp + 0x10b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
mov rdx, rsi
lea rcx, [rbp + 0x10b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov word [rbp + 0x60], r12w
cmp word [rbp + 0x10b0], r12w
je 0x140008321
mov r8d, esi
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x10b0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x14000831b
lea rdx, [rbp + 0x10b0]
mov rcx, rbx
call fcn.14000cae8
mov rax, qword [rsp + 0x50]
cmp rax, 8
jb 0x1400082ed
mov rcx, qword [rsp + 0x38]
lea rax, [rax*2 + 2]
mov rdx, rcx
cmp rax, 0x1000
jb 0x1400082e7
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14000852d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
mov rcx, qword [rbp + 0x3150]
xor rcx, rsp
call fcn.140017980
lea r11, [rsp + 0x3260]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lea rcx, [rbp + 0x60]
jmp 0x140008332
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], r12
cmp r14, rcx
je 0x14000836b
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x14000836b
lea rdx, [rbp + 0x60]
jmp 0x1400082a7
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x140008362
cmp di, 0x5c
jne 0x1400084b8
mov word [rsp + 0x60], r12w
lea rdx, [rsp + 0x60]
lea ecx, [rax + 0x7f]
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1400084b8
lea r8, [rsp + 0x60]
cmp word [rsp + 0x60], r12w
je 0x1400084b8
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], r12w
jne 0x1400083ce
lea rdi, [r8 + rax*2]
cmp rax, 2
jb 0x140008457
cmp word [r8 + rax*2 - 2], 0x5c
jne 0x1400083f1
mov word [r8 + rax*2 - 2], r12w
mov word [rbp + 0x2100], r12w
mov rdx, rsi
lea rcx, [rbp + 0x2100]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
mov rdx, rsi
lea rcx, [rbp + 0x2100]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x2100]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x140008465
lea r8, [rdi + 2]
cmp word [rdi + 2], r12w
jmp 0x1400083c4
lea rdx, [rbp + 0x60]
mov rcx, rbx
call fcn.14000cae8
mov rax, qword [rsp + 0x50]
cmp rax, 8
jb 0x1400082ed
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x1400082e7
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400082e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea r8, str._SystemRoot_System32Drivers
mov rdx, rsi
lea rcx, [rbp + 0x10b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8d, esi
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x10b0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1400084ef
mov rdx, r15
jmp 0x1400082a7
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov rcx, rbx
test eax, eax
jne 0x140008524
mov rdx, r15
jmp 0x1400082aa
lea rdx, [rbp + 0x60]
jmp 0x1400082aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3