Function at 0x22915443e
Capabilities:
Get disk information
Get hostname
Get session user name

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5d8
lea rcx, [0x22915d669]
mov r12, rdx
mov dword [rsp + 0x74], 0
lea rsi, [rsp + 0xac]
lea rdi, [rsp + 0x3ce]
call fcn.2291551d0
lea r9, [rsp + 0x74]
xor r8d, r8d
xor edx, edx
mov r13, rax
mov rcx, rax
lea rbp, [rsp + 0x1ce]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rcx, r13
lea r13, [rsp + 0x9c]
call fcn.229155252
lea r8, [rsp + 0x78]
mov rdx, rbp
mov ecx, 2
mov dword [rsp + 0x78], 0x100
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rdx, [rsp + 0x7c]
mov rcx, rsi
mov dword [rsp + 0x7c], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rdx, [rsp + 0x80]
mov rcx, rdi
mov dword [rsp + 0x80], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov rcx, r12
or r8d, 0xffffffff
lea edx, [rax + rax]
call fcn.229151de0
xor eax, dword [rsp + 0x74]
or r8d, 0xffffffff
mov rcx, rsi
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x7c]
lea edx, [rax + rax]
call fcn.229151de0
or r8d, 0xffffffff
mov rcx, rdi
mov ebx, eax
mov eax, dword [rsp + 0x80]
lea edx, [rax + rax]
call fcn.229151de0
mov rcx, r13
xor ebx, eax
mov dword [rsp + 0x94], ebx
call fcn.2291545a0
lea rcx, [0x22915c080]
call fcn.229155150
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbp
mov r12, rax
lea rax, [rsp + 0x8c]
mov dword [rsp + 0x30], 1
mov rdx, r13
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x28], r12
call fcn.229152612
mov qword [rsp + 0x58], rax
test rax, rax
je 0x229154163
mov edx, dword [rsp + 0x8c]
mov rcx, rax
call fcn.229152591
mov r13, rax
test rax, rax
je 0x229154159
lea rbp, [0x22915d678]
lea rcx, [0x22915c100]
call fcn.2291551d0
lea rcx, [0x22915c0c0]
mov r14, rax
call fcn.2291551d0
mov dword [rsp + 0x48], 0
mov r9d, 1
mov rcx, r14
mov r15, rax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], r13
movzx r8d, word [section..data]
mov qword [rsp + 0x40], rax
mov rdx, r15
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rbp
call fcn.229151e20
mov dword [rsp + 0x68], 0
mov rsi, rax
test rax, rax
je 0x22915411f
cmp dword [rsp + 0x84], 4
jbe 0x22915411f
mov rcx, r12
call sub.msvcrt.dll_strlen
lea rcx, [rsp + 0xcc]
mov rdx, r12
mov r8, rax
mov qword [rsp + 0x60], rcx
call fcn.229154890
mov rcx, qword [rsp + 0x60]
mov r8, rsi
mov rdx, rsi
mov r9d, dword [rsp + 0x84]
call fcn.2291548e5
mov eax, dword [rsp + 0x84]
xor r8d, r8d
lea rcx, [rsi + 4]
lea edx, [rax - 4]
call fcn.229151de0
cmp eax, dword [rsi]
jne 0x229154117
mov eax, dword [rsi + 4]
mov dword [rsp + 0x60], 0
lea rbx, [rsi + 8]
mov dword [rsp + 0x6c], eax
mov edi, dword [rsp + 0x6c]
cmp dword [rsp + 0x60], edi
je 0x229154117
mov eax, dword [rbx]
dec eax
cmp eax, 9
ja case.0x229153e91.7
lea rdi, [0x22915d67c]
movsxd rax, dword [rdi + rax*4]
add rax, rdi
jmp rax
lea rax, [rsp + 0x8c]
mov edx, dword [rbx + 4]
mov r9d, 1
mov r8, r12
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x90]
call fcn.2291527b7
jmp 0x22915408a
lea rax, [rsp + 0x8c]
mov edx, dword [rbx + 4]
mov r9d, 1
mov r8, r12
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x90]
call fcn.229152b0a
jmp 0x22915408a
lea rax, [rsp + 0x8c]
mov edx, dword [rbx + 4]
mov r9d, 1
mov r8, r12
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x90]
call fcn.229153056
jmp 0x22915408a
lea rax, [rsp + 0x8c]
mov edx, dword [rbx + 4]
lea rdi, [rbx + 0x10]
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x90]
mov r9, r12
mov r8, rdi
call fcn.2291536f7
mov rbx, rax
test rax, rax
je 0x22915410b
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rbx
mov rcx, r14
mov rdx, r15
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x8c]
mov r9d, 2
mov dword [rsp + 0x48], 0
movzx r8d, word [section..data]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbp
call fcn.229151e20
mov rcx, rax
test rax, rax
je 0x229153fa4
call fcn.229154578
mov rcx, rbx
call fcn.229154578
jmp 0x22915410b
lea r8, [rsp + 0x8c]
mov eax, dword [rbx + 0x10]
mov edx, dword [rbx + 4]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], r8
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x28], r12
mov r8d, dword [rbx + 0x14]
lea r9, [rbx + rax - 8]
mov dword [rsp + 0x20], r8d
lea r8, [rbx + 0x18]
call fcn.229153237
mov rdi, rax
test rax, rax
je 0x229154055
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rdi
mov rcx, r14
mov rdx, r15
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x8c]
mov r9d, 2
mov dword [rsp + 0x48], 0
movzx r8d, word [section..data]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbp
call fcn.229151e20
mov rcx, rax
test rax, rax
je 0x22915404d
call fcn.229154578
mov rcx, rdi
call fcn.229154578
lea rdi, [rbx + 0x10]
jmp 0x22915410b
lea rax, [rsp + 0x8c]
mov edx, dword [rbx + 4]
mov r9, r12
lea r8, [rbx + 0x10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x20], 1
call fcn.22915347d
mov rdi, rax
test rax, rax
je 0x2291540ef
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rdi
mov rcx, r14
mov rdx, r15
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x8c]
mov r9d, 2
mov dword [rsp + 0x48], 0
movzx r8d, word [section..data]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbp
call fcn.229151e20
mov rcx, rax
test rax, rax
je 0x2291540e7
call fcn.229154578
mov rcx, rdi
call fcn.229154578
lea rdi, [rbx + 8]
jmp 0x22915410b
call fcn.229153b9e
lea rdi, [rbx + 8]
mov dword [rsp + 0x68], 1
jmp 0x22915410b
mov rdi, rbx
inc dword [rsp + 0x60]
mov rbx, rdi
jmp 0x229153e68
mov rcx, rsi
call fcn.229154578
mov rcx, r15
call fcn.229155252
mov rcx, r14
call fcn.229155252
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
lea ecx, [rax + 0xbb8]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x68], 0
je 0x229153d76
mov rcx, r13
call fcn.229154578
mov rcx, qword [rsp + 0x58]
call fcn.229154578
mov rcx, r12
call fcn.229155252
nop
add rsp, 0x5d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov r13, rdx
call fcn.229151d46
test eax, eax
je 0x229154468
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp 0x229153bcc
mov rcx, r12
call fcn.229154398
test eax, eax
je 0x229154455
add rsp, 0x28
pop r12
pop r13
ret