Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov r15, rcx
mov rax, qword [0x1400503c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rcx], 0
mov qword [rcx + 8], rcx
xor r12d, r12d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
test eax, eax
je 0x14000158b
mov edi, eax
mov eax, eax
lea rsi, [rax + rax]
add rsi, 2
mov rcx, rsi
call fcn.140036d20
test rax, rax
je 0x14000158b
mov r14, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.140033e10
mov ecx, edi
mov rdx, r14
call qword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
test eax, eax
je 0x140001145
mov ebp, eax
xor r12d, r12d
movaps xmm6, xmmword [section..rdata]
mov r13, qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov rdi, r14
jmp 0x1400010f7
mov rcx, rbx
mov rdx, rsi
mov r9, rdi
call fcn.1400015c0
mov rax, rbx
add rax, 0x20
mov qword [rbx + 0x20], 0
mov rcx, qword [r15 + 8]
mov qword [rbx + 0x28], rcx
mov qword [rcx], rbx
mov qword [r15 + 8], rax
movsxd rax, ebp
lea rdi, [rdi + rax*2]
add rdi, 2
add r12d, 1
mov rcx, rdi
call r13
mov ebp, eax
test eax, eax
je 0x140001145
mov ecx, gethostbyname
call fcn.140031dec
mov rbx, rax
mov qword [rax], 0
movups xmmword [rax + 0x10], xmm6
mov word [rax], 0
mov rcx, rdi
call fcn.140036e08
mov rsi, rax
cmp rax, 7
ja 0x1400010b0
mov qword [rbx + 0x10], rsi
mov r8, rsi
add r8, rsi
mov rcx, rbx
mov rdx, rdi
call fcn.140033760
mov word [rbx + rsi*2], 0
jmp 0x1400010be
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x21]
mov byte [rsp + 0x21], 0x51
mov byte [rsp + 0x22], 0x47
mov byte [rsp + 0x23], 0x69
mov byte [rsp + 0x24], 0x47
mov byte [rsp + 0x25], 0x7c
mov byte [rsp + 0x26], 0x47
mov byte [rsp + 0x27], 0x7b
mov byte [rsp + 0x28], 0x47
mov byte [rsp + 0x29], gethostbyname
mov byte [rsp + 0x2a], 0x47
mov byte [rsp + 0x2b], 3
mov byte [rsp + 0x2c], 0x47
mov byte [rsp + 0x2d], 0x28
mov byte [rsp + 0x2e], 0x47
mov byte [rsp + 0x2f], gethostbyname
mov byte [rsp + 0x30], 0x47
mov byte [rsp + 0x31], 3
mov byte [rsp + 0x32], 0x47
mov byte [rsp + 0x33], gethostbyname
mov byte [rsp + 0x34], 0x47
mov byte [rsp + 0x35], gethostbyname
mov byte [rsp + 0x36], 0x47
mov byte [rsp + 0x37], 0x56
mov byte [rsp + 0x38], 0x47
mov byte [rsp + 0x39], 0x6a
mov byte [rsp + 0x3a], 0x47
mov byte [rsp + 0x3b], 0x1f
mov byte [rsp + 0x3c], 0x47
mov byte [rsp + 0x3d], 0x21
mov byte [rsp + 0x3e], 0x47
mov byte [rsp + 0x3f], 0x2b
mov byte [rsp + 0x40], 0x47
mov byte [rsp + 0x41], 3
mov byte [rsp + 0x42], 0x47
mov byte [rsp + 0x43], 0x47
mov byte [rsp + 0x44], 0x47
mov al, byte [rsp + 0x20]
test al, 1
jne 0x14000129d
mov eax, 1
nop word cs:[rax + rax]
nop
movzx edx, byte [rsp + rax + 0x20]
movzx edx, dl
lea ebp, [rdx*8]
sub ebp, edx
mov edx, ebp
add edx, 0xfffffe0f
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ebp
add edx, 0xfffffe0f
movzx edx, dx
mov ebx, edx
shr ebx, 0xf
shr edx, 6
add edx, ebx
mov ebx, edx
shl ebx, 7
sub edx, ebx
add edx, ebp
add edx, 0xfffffe0f
add dl, 0x7f
movzx edx, dl
lea ebp, [rdx + rdx*2]
shr ebp, 8
mov ebx, edx
sub bl, bpl
shr bl, 1
add bl, bpl
shr bl, 6
movzx ebx, bl
mov ebp, ebx
shl ebp, 7
sub ebp, ebx
sub dl, bpl
mov byte [rsp + rax + 0x20], dl
add rax, 1
cmp rax, 0x25
jne 0x140001220
mov edx, r12d
call fcn.14000eec0
mov rsi, qword [r15]
test rsi, rsi
je 0x140001583
lea rdi, [rsp + 0x21]
jmp 0x1400012d5
mov rcx, rdi
call fcn.14000eec0
mov rsi, qword [rsi + 0x20]
test rsi, rsi
je 0x140001583
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x1400012e2
mov rdx, qword [rsi]
mov byte [rsp + 0x20], 0
mov byte [rsp + 0x21], 0x4e
mov byte [rsp + 0x22], 0x5e
mov byte [rsp + 0x23], 0x3a
mov byte [rsp + 0x24], 0x5e
mov byte [rsp + 0x25], 0x5e
mov byte [rsp + 0x26], 0x5e
movzx eax, byte [rsp + 0x20]
test al, 1
jne 0x1400012c0
movzx eax, byte [rsp + 0x21]
movzx eax, al
imul eax, eax, 0xffffffd6
mov ecx, eax
add ecx, 0xf6c
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xf6c
movzx ecx, cx
mov ebp, ecx
shr ebp, 0xf
shr ecx, 6
add ecx, ebp
mov ebp, ecx
shl ebp, 7
sub ecx, ebp
add eax, ecx
add eax, 0xf6c
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov ebx, eax
sub bl, cl
shr bl, 1
add bl, cl
shr bl, 6
movzx ebp, bl
mov ecx, ebp
shl ecx, 7
sub ecx, ebp
sub al, cl
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x22]
movzx eax, al
imul eax, eax, 0xffffffd6
mov ecx, eax
add ecx, 0xf6c
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xf6c
movzx ecx, cx
mov ebp, ecx
shr ebp, 0xf
shr ecx, 6
add ecx, ebp
mov ebp, ecx
shl ebp, 7
sub ecx, ebp
add eax, ecx
add eax, 0xf6c
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov ebx, eax
sub bl, cl
shr bl, 1
add bl, cl
shr bl, 6
movzx ebp, bl
mov ecx, ebp
shl ecx, 7
sub ecx, ebp
sub al, cl
mov byte [rsp + 0x22], al
movzx eax, byte [rsp + 0x23]
movzx eax, al
imul eax, eax, 0xffffffd6
mov ecx, eax
add ecx, 0xf6c
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xf6c
movzx ecx, cx
mov ebp, ecx
shr ebp, 0xf
shr ecx, 6
add ecx, ebp
mov ebp, ecx
shl ebp, 7
sub ecx, ebp
add eax, ecx
add eax, 0xf6c
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov ebx, eax
sub bl, cl
shr bl, 1
add bl, cl
shr bl, 6
movzx ebp, bl
mov ecx, ebp
shl ecx, 7
sub ecx, ebp
sub al, cl
mov byte [rsp + 0x23], al
movzx eax, byte [rsp + 0x24]
movzx eax, al
imul eax, eax, 0xffffffd6
mov ecx, eax
add ecx, 0xf6c
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xf6c
movzx ecx, cx
mov ebp, ecx
shr ebp, 0xf
shr ecx, 6
add ecx, ebp
mov ebp, ecx
shl ebp, 7
sub ecx, ebp
add eax, ecx
add eax, 0xf6c
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov ebx, eax
sub bl, cl
shr bl, 1
add bl, cl
shr bl, 6
movzx ebp, bl
mov ecx, ebp
shl ecx, 7
sub ecx, ebp
sub al, cl
mov byte [rsp + 0x24], al
movzx eax, byte [rsp + 0x25]
movzx eax, al
imul eax, eax, 0xffffffd6
mov ecx, eax
add ecx, 0xf6c
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xf6c
movzx ecx, cx
mov ebp, ecx
shr ebp, 0xf
shr ecx, 6
add ecx, ebp
mov ebp, ecx
shl ebp, 7
sub ecx, ebp
add eax, ecx
add eax, 0xf6c
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov ebx, eax
sub bl, cl
shr bl, 1
add bl, cl
shr bl, 6
movzx ebp, bl
mov ecx, ebp
shl ecx, 7
sub ecx, ebp
sub al, cl
mov byte [rsp + 0x25], al
movzx eax, byte [rsp + 0x26]
movzx eax, al
imul eax, eax, 0xffffffd6
mov ecx, eax
add ecx, 0xf6c
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, eax
add ecx, 0xf6c
movzx ecx, cx
mov ebp, ecx
shr ebp, 0xf
shr ecx, 6
add ecx, ebp
mov ebp, ecx
shl ebp, 7
sub ecx, ebp
add eax, ecx
add eax, 0xf6c
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov ebx, eax
sub bl, cl
shr bl, 1
add bl, cl
shr bl, 6
movzx ebp, bl
mov ecx, ebp
shl ecx, 7
sub ecx, ebp
sub al, cl
mov byte [rsp + 0x26], al
jmp 0x1400012c0
mov rcx, r14
call fcn.140036d0c
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140031ee0
mov eax, r12d
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret