Function at 0x404e0d
Capabilities:
Get disk information
Get hostname
Get session user name

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5f8
lea rcx, [0x0040a79c]
mov rbx, rdx
lea rdi, [rsp + 0xcc]
mov dword [rsp + 0x94], 0
lea rbp, [rsp + 0x3ee]
call fcn.00405bb0
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0x94]
mov r12, rax
mov rcx, rax
lea r13, [rsp + 0x1ee]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea r14, [rsp + 0xbc]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rcx, r12
call fcn.00405c32
lea rdx, [rsp + 0x9c]
mov rcx, rdi
mov dword [rsp + 0x9c], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r8, [rsp + 0x98]
mov rdx, r13
mov ecx, 2
mov dword [rsp + 0x98], 0x100
mov word [rsp + 0x1ee], 0
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rdx, [rsp + 0xa0]
mov rcx, rbp
mov dword [rsp + 0xa0], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
or r8d, 0xffffffff
mov rcx, rbx
lea edx, [rax + rax]
call fcn.00401d90
xor eax, dword [rsp + 0x94]
or r8d, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0x9c]
lea edx, [rax + rax]
call fcn.00401d90
or r8d, 0xffffffff
mov rcx, rbp
mov esi, eax
mov eax, dword [rsp + 0xa0]
lea edx, [rax + rax]
call fcn.00401d90
mov rcx, r14
xor esi, eax
mov dword [rsp + 0xb4], esi
call fcn.00404f80
lea rcx, [0x00409100]
call fcn.00405b30
lea rcx, [0x00409040]
mov r12, rax
call fcn.00405bb0
mov qword [rsp + 0x38], r12
mov r9, rdi
mov r8, r13
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xac]
lea rcx, [rsp + 0xb0]
mov rdx, r14
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
call fcn.004025c4
mov qword [rsp + 0x68], rax
test rax, rax
je 0x4049cd
mov edx, dword [rsp + 0xac]
mov rcx, rax
call fcn.00402543
mov r13, rax
test rax, rax
je 0x4049c3
xor esi, esi
lea rbp, [0x0040a7ac]
lea rcx, [0x00409180]
call fcn.00405bb0
lea rcx, [0x00409140]
mov r14, rax
call fcn.00405bb0
cmp dword [0x00409020], 0
mov qword [rsp + 0x28], r13
mov rcx, r14
mov r15, rax
mov eax, 1
mov dword [rsp + 0x38], 0
movzx r8d, word [0x00409024]
cmovne esi, eax
mov qword [rsp + 0x20], rbp
mov r9d, 1
mov rdx, r15
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x40], rax
call fcn.00401dd0
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x60], rax
test rax, rax
je 0x404945
cmp dword [rsp + 0xa4], 4
jbe 0x404945
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
mov rdx, r12
repne scasb al, byte [rdi]
lea r10, [rsp + 0xec]
mov qword [rsp + 0x70], r10
not rcx
lea r8, [rcx - 1]
mov rcx, r10
call fcn.00405270
mov r8, qword [rsp + 0x60]
mov r10, qword [rsp + 0x70]
mov r9d, dword [rsp + 0xa4]
mov rdx, r8
mov rcx, r10
call fcn.004052c5
mov eax, dword [rsp + 0xa4]
xor r8d, r8d
lea edx, [rax - 4]
mov rax, qword [rsp + 0x60]
lea rcx, [rax + 4]
call fcn.00401d90
mov rbx, qword [rsp + 0x60]
cmp eax, dword [rbx]
jne 0x40493b
mov eax, dword [rbx + 4]
mov dword [rsp + 0x70], 0
lea rbx, [rbx + 8]
mov dword [rsp + 0x84], eax
mov edi, dword [rsp + 0x84]
cmp dword [rsp + 0x70], edi
je 0x40493b
mov edx, dword [rbx]
lea eax, [rdx - 1]
cmp eax, 0xa
ja case.0x4045e5.9
lea rdi, [0x0040a820]
movsxd rax, dword [rdi + rax*4]
add rax, rdi
jmp rax
lea rax, [rsp + 0xac]
mov edx, dword [rbx + 4]
mov r9d, 1
mov r8, r12
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
call fcn.0040284f
jmp 0x404771
lea rax, [rsp + 0xac]
mov edx, dword [rbx + 4]
mov r9d, 1
mov r8, r12
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
call fcn.00402bd1
jmp 0x404771
lea rax, [rsp + 0xac]
mov edx, dword [rbx + 4]
mov r9d, 1
mov r8, r12
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
call fcn.00403153
jmp 0x404771
lea rax, [rsp + 0xac]
mov edx, dword [rbx + 4]
lea rdi, [rbx + 0x10]
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xb0]
mov r9, r12
mov r8, rdi
call fcn.00403821
mov rbx, rax
test rax, rax
je 0x40492f
mov dword [rsp + 0x48], esi
mov rcx, r14
mov r9d, 2
mov rdx, r15
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rbx
movzx r8d, word [0x00409024]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xac]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x20], rbp
call fcn.00401dd0
mov rcx, rax
test rax, rax
je 0x4046f4
call fcn.00404f58
mov rcx, rbx
call fcn.00404f58
jmp 0x40492f
lea r8, [rsp + 0xac]
mov eax, dword [rbx + 0x10]
mov edx, dword [rbx + 4]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], r8
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x28], r12
mov r8d, dword [rbx + 0x14]
lea r9, [rbx + rax - 8]
mov dword [rsp + 0x20], r8d
lea r8, [rbx + 0x18]
call fcn.0040333b
jmp 0x404841
lea rax, [rsp + 0xac]
mov edx, dword [rbx + 4]
mov r9, r12
lea r8, [rbx + 0x10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0x20], 1
call fcn.0040359c
mov rdi, rax
test rax, rax
je 0x404910
mov dword [rsp + 0x48], esi
mov rcx, r14
mov r9d, 2
mov rdx, r15
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rdi
movzx r8d, word [0x00409024]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xac]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x20], rbp
call fcn.00401dd0
mov rcx, rax
test rax, rax
je 0x4047ce
call fcn.00404f58
mov rcx, rdi
call fcn.00404f58
jmp 0x404910
lea r9, [rsp + 0xac]
mov eax, dword [rbx + 8]
mov r8d, dword [rbx + 4]
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x50], r9
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x40], r12
mov r9d, dword [rbx + 0x24]
mov dword [rsp + 0x38], r9d
mov r9d, dword [rbx + 0x20]
lea r9, [rbx + r9 - 8]
mov qword [rsp + 0x30], r9
mov r9d, dword [rbx + 0x18]
lea r9, [rbx + r9 - 8]
mov qword [rsp + 0x28], r9
mov r9d, dword [rbx + 0x10]
lea r9, [rbx + r9 - 8]
mov qword [rsp + 0x20], r9
lea r9, [rbx + rax - 8]
call fcn.00403cea
mov rdi, rax
test rax, rax
je 0x4048a2
mov dword [rsp + 0x48], esi
mov rcx, r14
mov r9d, 2
mov rdx, r15
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rdi
movzx r8d, word [0x00409024]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xac]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x20], rbp
call fcn.00401dd0
mov rcx, rax
test rax, rax
je 0x40489a
call fcn.00404f58
mov rcx, rdi
call fcn.00404f58
lea rdi, [rbx + 0x10]
jmp 0x40492f
lea rcx, [0x0040a7b0]
call fcn.00405b30
lea rcx, [0x0040a7be]
mov rdi, rax
call fcn.00405b30
mov r8d, dword [rbx + 0xc]
mov ecx, 2
lea r9, [0x0040a3d0]
mov r10, rax
mov eax, dword [rbx + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], r10
lea rdx, [rbx + rax - 8]
mov qword [rsp + 0x88], r10
call fcn.00405d9d
mov rcx, rdi
call fcn.00405c32
mov r10, qword [rsp + 0x88]
mov rcx, r10
call fcn.00405c32
lea rdi, [rbx + 8]
jmp 0x40492f
call fcn.00404191
lea rdi, [rbx + 8]
mov dword [rsp + 0x80], 1
jmp 0x40492f
mov rdi, rbx
inc dword [rsp + 0x70]
mov rbx, rdi
jmp 0x4045b8
mov rcx, qword [rsp + 0x60]
call fcn.00404f58
mov rcx, r15
call fcn.00405c32
mov rcx, r14
call fcn.00405c32
lea rcx, [0x0040a7ce]
call fcn.00405bb0
mov ecx, 0x100000
xor edx, edx
mov r14, rax
mov r8, rax
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rcx, rax
test rax, rax
je 0x40498d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x80], 1
mov rcx, r14
call fcn.00405c32
cmp dword [rsp + 0x80], 0
jne 0x4049bb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xfff
lea ecx, [rax + 0xbb8]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40449a
mov rcx, r13
call fcn.00404f58
mov rcx, qword [rsp + 0x68]
call fcn.00404f58
mov rcx, qword [rsp + 0x78]
call fcn.00405c32
mov rcx, r12
call fcn.00405c32
nop
add rsp, 0x5f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov r13, rdx
call fcn.00406c5e
test eax, eax
je 0x404e37
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp 0x4042ac
mov rcx, r12
call fcn.00404c91
test eax, eax
je 0x404e24
add rsp, 0x28
pop r12
pop r13
ret