Function at 0x18001d0e0
Capabilities:
Get common file path
Get disk information
Get hostname
Hash data using sha256

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x12d0]
mov eax, 0x13d0
call fcn.18005c7d0
sub rsp, rax
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1410], rbx
mov rsi, rcx
xor r15d, r15d
mov dword [rbp + 0x20], r15d
cmp qword [0x180119ff0], r15
jbe 0x18001d14b
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rcx + 0x10], r15
mov byte [rcx], r15b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x180119fe0]
call fcn.180003480
jmp 0x18001d6a9
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x58], r15
mov byte [rbp + 0x48], r15b
mov r14d, 0x1050
mov r8d, r14d
xor edx, edx
lea rcx, [rbp + 0x280]
call fcn.180061460
mov word [rbp + 0x28], r15w
xor eax, eax
mov qword [rbp + 0x2a], rax
mov qword [rbp + 0x32], rax
mov qword [rbp + 0x3a], rax
mov dword [rbp + 0x42], eax
mov word [rbp + 0x46], ax
mov dword [rbp + 0x1320], reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x1320]
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x18001d1e6
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x28]
call fcn.18001c8c0
test al, al
je 0x18001d1e6
lea rdx, [rbp + 0x280]
lea rcx, [rsp + 0x40]
call fcn.18001ca00
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.180002050
lea rcx, [rsp + 0x40]
call fcn.180003310
mov dword [rbp + 0x2c4], r15d
mov edx, 0x104
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18001d25d
lea rdx, [0x1800a83dc]
lea rcx, [rbp + 0x70]
call fcn.18006f4b0
test rax, rax
je 0x18001d21a
mov word [rax + 2], r15w
mov dword [rbp + 0x1318], r15d
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x1318]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x18001d25d
mov eax, dword [rbp + 0x1318]
mov dword [rbp + 0x2c4], eax
jmp 0x18001d264
mov dword [rbp + 0x2c4], r15d
lea rcx, [rbp - 0x20]
call fcn.18001caa0
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rbp + 0x2d0]
call fcn.180061610
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov eax, 1
xor ecx, ecx
cpuid
mov edi, eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x4c], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
movzx ecx, dil
and cl, 0xf
mov byte [rbp + 0x2c8], cl
mov ecx, edi
sar ecx, 0xc
mov eax, edi
sar eax, 4
xor al, cl
and al, 0xf
xor al, cl
mov byte [rbp + 0x2c9], al
mov eax, edi
sar eax, 8
and al, 0xf
mov byte [rbp + 0x2ca], al
and cl, 3
mov byte [rbp + 0x2cb], cl
mov eax, edi
sar eax, 0x10
and al, 0xf
mov byte [rbp + 0x2cc], al
sar edi, 0x14
mov byte [rbp + 0x2cd], dil
mov byte [rsp + 0x40], 0
xor eax, eax
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
mov eax, r15d
mov dword [rbp - 0x60], eax
mov qword [rbp - 0x58], r15
mov dword [rbp - 0x50], 0x6a09e667
mov dword [rbp - 0x4c], 0xbb67ae85
mov dword [rbp - 0x48], 0x3c6ef372
mov dword [rbp - 0x44], 0xa54ff53a
mov dword [rbp - 0x40], 0x510e527f
mov dword [rbp - 0x3c], 0x9b05688c
mov dword [rbp - 0x38], 0x1f83d9ab
mov dword [rbp - 0x34], 0x5be0cd19
lea rbx, [rbp + 0x280]
nop dword [rax + rax]
mov ecx, eax
movzx eax, byte [rbx]
mov byte [rsp + rcx + 0x60], al
mov eax, dword [rbp - 0x60]
inc eax
mov dword [rbp - 0x60], eax
cmp eax, 0x40
jne 0x18001d3c3
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.18001c6d0
add qword [rbp - 0x58], 0x200
mov eax, r15d
mov dword [rbp - 0x60], eax
inc rbx
sub r14, 1
jne 0x18001d390
mov ecx, eax
lea edx, [rax + 1]
mov byte [rsp + rcx + 0x60], 0x80
cmp eax, 0x38
jae 0x18001d3f7
cmp edx, 0x38
jae 0x18001d442
mov ecx, gethostname
sub ecx, edx
mov eax, edx
lea rdi, [rsp + 0x60]
add rdi, rax
xor eax, eax
rep stosb byte [rdi], al
jmp 0x18001d442
cmp edx, 0x40
jae 0x18001d411
mov ecx, 0x40
sub ecx, edx
mov eax, edx
lea rdi, [rsp + 0x60]
add rdi, rax
xor eax, eax
rep stosb byte [rdi], al
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.18001c6d0
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov eax, dword [rbp - 0x60]
lea ecx, [rax*8]
mov rdx, qword [rbp - 0x58]
add rdx, rcx
mov qword [rbp - 0x58], rdx
movzx eax, dl
mov byte [rbp - 0x61], dl
mov rax, rdx
shr rax, 8
mov byte [rbp - 0x62], al
mov rax, rdx
shr rax, 0x10
mov byte [rbp - 0x63], al
mov rax, rdx
shr rax, 0x18
mov byte [rbp - 0x64], al
mov rax, rdx
shr rax, 0x20
mov byte [rbp - 0x65], al
mov rax, rdx
shr rax, 0x28
mov byte [rbp - 0x66], al
mov rax, rdx
shr rax, 0x30
mov byte [rbp - 0x67], al
shr rdx, 0x38
mov byte [rbp - 0x68], dl
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.18001c6d0
lea rdi, [rsp + 0x40]
mov ebx, r15d
lea rdx, [rsp + 0x48]
mov r8d, dword [rbp - 0x34]
mov r9d, dword [rbp - 0x38]
mov r10d, dword [rbp - 0x3c]
mov r11d, dword [rbp - 0x40]
mov r14d, dword [rbp - 0x44]
mov r15d, dword [rbp - 0x48]
mov r12d, dword [rbp - 0x4c]
mov r13d, dword [rbp - 0x50]
nop dword [rax]
mov ecx, Ordinal_26
sub ecx, ebx
mov eax, r13d
shr eax, cl
mov byte [rdi], al
mov eax, r12d
shr eax, cl
mov byte [rdx - 4], al
mov eax, r15d
shr eax, cl
mov byte [rdx], al
mov eax, r14d
shr eax, cl
mov byte [rdx + 4], al
mov eax, r11d
shr eax, cl
mov byte [rdx + 8], al
mov eax, r10d
shr eax, cl
mov byte [rdx + 0xc], al
mov eax, r9d
shr eax, cl
mov byte [rdx + 0x10], al
mov eax, r8d
shr eax, cl
mov byte [rdx + 0x14], al
add ebx, 8
lea rdx, [rdx + 1]
lea rdi, [rdi + 1]
cmp ebx, 0x20
jb 0x18001d4e0
lea rdx, [rsp + 0x40]
lea rcx, [rbp]
call fcn.18001c510
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp]
lea rcx, [0x180119fe0]
call fcn.180003480
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
xor ebx, ebx
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 0x10
jb 0x18001d575
mov rax, qword [rsi]
jmp 0x18001d578
mov rax, rsi
mov byte [rax], bl
lea rdx, [rbp]
mov rcx, rsi
call fcn.180003010
nop
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x18001d5dd
inc rax
mov rcx, qword [rbp]
cmp rax, 0x1000
jb 0x18001d5d8
test cl, 0x1f
je 0x18001d5ab
call fcn.180063584
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18001d5ba
call fcn.180063584
int3
sub rcx, rax
cmp rcx, 8
jae 0x18001d5c9
call fcn.180063584
int3
cmp rcx, 0x27
jbe 0x18001d5d5
call fcn.180063584
int3
mov rcx, rax
call fcn.18005c288
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x10], rbx
mov byte [rbp], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x18001d643
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x18001d63e
test cl, 0x1f
je 0x18001d611
call fcn.180063584
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18001d620
call fcn.180063584
int3
sub rcx, rax
cmp rcx, 8
jae 0x18001d62f
call fcn.180063584
int3
cmp rcx, 0x27
jbe 0x18001d63b
call fcn.180063584
int3
mov rcx, rax
call fcn.18005c288
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rbx
mov byte [rbp - 0x20], 0
mov rax, qword [rbp + 0x60]
cmp rax, 0x10
jb 0x18001d6a9
inc rax
mov rcx, qword [rbp + 0x48]
cmp rax, 0x1000
jb 0x18001d6a4
test cl, 0x1f
je 0x18001d677
call fcn.180063584
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18001d686
call fcn.180063584
int3
sub rcx, rax
cmp rcx, 8
jae 0x18001d695
call fcn.180063584
int3
cmp rcx, 0x27
jbe 0x18001d6a1
call fcn.180063584
int3
mov rcx, rax
call fcn.18005c288
mov rax, rsi
mov rbx, qword [rsp + 0x1410]
add rsp, 0x13d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret