Function at 0x140051a10
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
movaps xmmword [rsp + 0x130], xmm6
mov rax, qword [0x1400b4040]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rdx
xor ebx, ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400a3b08]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1400521d1
mov edx, dword [rbp - 0x38]
lea rcx, [rbp]
call fcn.14004d050
nop
mov ecx, 3
call fcn.140054200
call fcn.1400540b0
mov r13, rax
test rax, rax
je 0x140052092
lea r8, str.https:__deocotienmuahost.click_AuthCheck_AuthCheckCPP.php
mov edx, 0x2712
mov rcx, rax
call fcn.140054170
movabs r8, 0x7fffffffffffffff
mov rcx, r8
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 5
jb 0x1400521c5
lea r9, [rbp]
mov r14, qword [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r9, r14
mov qword [rsp + 0x40], r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea rdx, [rax + 5]
mov qword [rbp - 0x38], rdx
mov ebx, reloc.WS2_32.dll_ntohs
lea r15, [rsp + 0x48]
cmp rdx, rbx
jbe 0x140051bad
mov rbx, rdx
or rbx, 0xf
cmp rbx, r8
jbe 0x140051b5a
mov rbx, r8
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140052ef0
test rax, rax
je 0x140051b8c
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140051b9b
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140051b74
xor r15d, r15d
jmp 0x140051ba8
cmp rcx, 0x1000
jb 0x140051b93
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400521cb
jmp 0x140051b3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052ef0
mov r15, rax
mov r9, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x38]
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rbx
mov ecx, dword [str.hwid]
mov dword [r15], ecx
movzx ecx, byte [0x1400a3ca4]
mov byte [r15 + 4], cl
lea rcx, [r15 + 5]
mov r8, rax
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp - 0x38]
mov byte [r15 + rax], 0
mov r8d, 5
lea rdx, str.Key
lea rcx, [rsp + 0x48]
call fcn.14000e4b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov r8, rsi
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.140052b70
nop
mov r8d, 7
lea rdx, str.appid
mov rcx, rax
call fcn.14000e4b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov r8, rdi
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x20]
call fcn.140052b70
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140051ccf
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051cca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051cca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
movdqa xmm6, xmmword [0x1400a3f60]
movdqu xmmword [rsp + 0x78], xmm6
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140051d20
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051d1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051d1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
movdqu xmmword [rbp - 0x48], xmm6
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140051d67
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051d62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051d62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
movdqu xmmword [rbp - 0x68], xmm6
mov byte [rbp - 0x78], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140051db0
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051dab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051dab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
movdqu xmmword [rsp + 0x58], xmm6
mov byte [rsp + 0x48], 0
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r8, qword [rbp - 0x20]
mov edx, 0x271f
mov rcx, r13
call fcn.140054170
lea r8, [0x140050400]
mov edx, 0x4e2b
mov rcx, r13
call fcn.140054170
mov r8, r12
mov edx, 0x2711
mov rcx, r13
call fcn.140054170
mov rcx, r13
call fcn.140054160
test eax, eax
je 0x140051e85
mov ecx, eax
call fcn.140054e80
mov rbx, rax
lea rdx, str.Failed_to_perform_HTTP_POST_request:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004d9f0
mov rcx, rax
mov rdx, rbx
call fcn.14004d9f0
mov rcx, rax
lea rdx, [0x14004d770]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ebx, ebx
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140051fba
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051fb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051fb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r8, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 0xf
jbe 0x140051e96
mov r12, qword [r12]
cmp r8, 0x10
jne 0x140051e40
lea rdx, str.Login_successful
mov rcx, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140051e40
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140051ee6
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051ee1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051e7e
call fcn.140052f40
movdqu xmmword [rbp - 0x10], xmm6
mov byte [rbp - 0x20], 0
mov rax, qword [rbp + 0x18]
cmp rax, 0xf
jbe 0x140051f2b
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140051f22
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051ff2
mov rcx, r14
call fcn.140052f40
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140051f65
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140051f60
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140052084
mov rcx, r8
call fcn.140052f40
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140051fae
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140051fa9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005208b
mov rcx, r8
call fcn.140052f40
mov al, 1
jmp 0x140052179
call fcn.140052f40
movdqu xmmword [rbp - 0x10], xmm6
mov byte [rbp - 0x20], 0
mov rax, qword [rbp + 0x18]
cmp rax, 0xf
jbe 0x140052002
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140051ff9
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051ff9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140052f40
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140052038
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140052033
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140052084
mov rcx, r8
call fcn.140052f40
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14005207d
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140052078
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005208b
mov rcx, r8
call fcn.140052f40
xor al, al
jmp 0x140052179
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.Failed_to_initialize_libcurl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004d9f0
mov rcx, rax
lea rdx, [0x14004d770]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400541a0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400520fa
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400520f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400520f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140052134
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14005212f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400521b7
mov rcx, r8
call fcn.140052f40
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140052179
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140052174
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400521be
mov rcx, r8
call fcn.140052f40
mov byte [rdi], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], rbx
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140052db0
mov rbx, qword [rsp + 0x198]
movaps xmm6, xmmword [rsp + 0x130]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000bc30
int3
call fcn.14000bb90
nop
lea rdx, str.failed_to_get_hwid
lea rcx, [rbp - 0x20]
call fcn.1400405a0
lea rdx, [0x1400b0260]
lea rcx, [rbp - 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3