Function at 0x1400028fc
Capabilities:
Get common file path
Get disk information
Get system information on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rcx, str.ntdll.dll
call fcn.140002304
mov rbx, rax
test rax, rax
je 0x140002e38
lea rdx, str.RtlGetVersion
mov rcx, rax
call fcn.140002283
mov rdx, rax
test rax, rax
je 0x140002987
lea r8, [0x140018200]
mov ecx, 0x23
mov eax, 0
mov rdi, r8
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov dword [0x140018200], 0x11c
mov rcx, r8
call rdx
test eax, eax
jne 0x14000296a
mov esi, 0
jmp 0x14000298c
mov r8d, eax
lea rdx, str.sys_init
lea rcx, str._E____s_____RtlGetVersion_failed_res_08lx__n
call fcn.140002ef2
mov esi, 0x40000001
jmp 0x14000298c
mov esi, 0x40000001
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x1400029c3
and esi, 0x3fffffff
mov r8d, esi
lea rdx, str.sys_init
lea rcx, [0x140010c18]
call fcn.140002ef2
mov eax, 0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [0x140018200]
mov qword [0x140018078], rax
lea rbx, [0x140018320]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov qword [0x140018080], rbx
mov edx, 0x104
lea rcx, [0x1400180e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x140002ae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r8d, eax
lea rdx, str.sys_init
lea rcx, str._E____s_____GetWindowsDirectoryA_failed_gle_lu__n
call fcn.140002ef2
cmp esi, 0x20
ja 0x140002a43
ja case.0x140002a37.1
mov eax, esi
lea rdx, [0x140010c38]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov esi, 0x40000001
jmp 0x140002999
cmp esi, 0x94
je 0x140002e4c
cmp esi, 0x94
ja 0x140002a8e
cmp esi, 0x7f
ja 0x140002a78
cmp esi, 0x7e
jae 0x140002e56
cmp esi, 0x50
jne 0x140002e60
mov esi, 0x40000007
jmp 0x140002999
cmp esi, 0x91
jne 0x140002e6a
mov esi, 0x4000000d
jmp 0x140002999
cmp esi, 0xb7
je 0x140002e74
cmp esi, 0x80070005
je 0x140002e7e
cmp esi, 0xaa
je 0x140002ab8
mov esi, 0x40000001
jmp 0x140002999
mov esi, 0x4000000d
jmp 0x140002999
mov esi, 0x40000003
jmp 0x140002999
mov esi, 0x40000009
jmp 0x140002999
mov esi, 0x4000000d
jmp 0x140002999
lea r8, [0x1400180e0]
mov qword [0x140018068], r8
lea rdx, str.sys_init
lea rcx, str._I____s_____GetWindowsDirectoryA_done_sys_win_dir_s__n
call fcn.140002ef2
test esi, esi
jne 0x140002999
mov qword [rsp + 0x48], 0x25
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x1400180a0]
lea r8, str.MachineGuid
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call fcn.140009242
test eax, eax
je 0x140002bf0
test esi, esi
jne 0x140002999
mov rax, qword [0x140018068]
movzx eax, byte [rax]
mov byte [rsp + 0x48], al
mov byte [rsp + 0x49], 0x3a
mov byte [rsp + 0x4a], 0x5c
mov byte [rsp + 0x4b], 0
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, 0
mov edx, 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x140002ca7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r9d, eax
lea r8, [rsp + 0x48]
lea rdx, str.sys_init
lea rcx, str._E____s_____GetVolumeInformationA_failed_vol_s_gle_lu__n
call fcn.140002ef2
cmp ebx, 0x20
ja 0x140002c16
ja case.0x140002bee.1
mov ebx, ebx
lea rdx, [0x140010cbc]
movsxd rax, dword [rdx + rbx*4]
add rax, rdx
jmp rax
lea r8, [0x1400180a0]
mov qword [0x140018060], r8
lea rdx, str.sys_init
lea rcx, str._I____s_____GetWindowsDirectoryA_done_sys_mach_guid_s__n
call fcn.140002ef2
add byte [rax], al
add byte [rax], al
jmp 0x140002b45
cmp ebx, 0x94
je 0x140002d73
add byte [rax], al
add byte [rdi], cl
test byte [rcx + 1], dl
add byte [rax], al
ja 0x140002c5b
cmp ebx, 0x7f
ja 0x140002c45
cmp ebx, 0x7e
jae 0x140002d7d
cmp ebx, 0x50
jne 0x140002d87
mov esi, 0x40000007
jmp 0x140002999
cmp ebx, 0x91
jne 0x140002d91
mov esi, 0x4000000d
jmp 0x140002999
cmp ebx, 0xb7
je 0x140002d9b
cmp ebx, 0x80070005
je 0x140002da5
cmp ebx, 0xaa
jne 0x140002daf
mov esi, 0x4000000d
jmp 0x140002999
mov esi, 0x40000003
jmp 0x140002999
mov esi, 0x40000009
jmp 0x140002999
mov esi, 0x4000000d
jmp 0x140002999
mov r9d, dword [rsp + 0x44]
lea r8, [rsp + 0x48]
lea rdx, str.sys_init
lea rcx, str._I____s_____GetVolumeInformationA_done_vol_s_vol_sn_08lx__n
call fcn.140002ef2
mov rax, qword [0x140018080]
movzx ebx, word [rax + 0x2e]
mov rsi, qword [0x140018060]
test rsi, rsi
je 0x140002ced
mov rcx, rsi
call sub.msvcrt.dll_strlen
cmp rax, 0x24
clc
and al, 0xf
test ah, cl
add byte [rax], al
invalid
clc
and al, 0xf
test ah, cl
add byte [rax], al
add byte [rax - 0x75], cl
add eax, 0x1538c
mov rax, qword [0x140018080]
movzx esi, word [rax + 0x2c]
mov r8d, dword [rsp + 0x44]
movzx ebx, bx
shl rbx, 0x20
or r8, rbx
shl rsi, 0x30
or r8, rsi
mov qword [0x140018070], r8
mov rax, qword [0x140018078]
movzx edx, word [rax + 0x114]
mov r9d, dword [rax + 4]
movzx ecx, word [rax + 0x116]
mov dword [rsp + 0x38], ecx
movzx edx, dx
mov dword [rsp + 0x30], edx
mov edx, dword [rax + 0xc]
mov dword [rsp + 0x28], edx
mov eax, dword [rax + 8]
mov dword [rsp + 0x20], eax
lea rdx, str.sys_init
lea rcx, str._I____s_____Done_sys_uid_016llx_sys_os_ver_lu._lu._lu._d._d__n
call fcn.140002ef2
jmp 0x1400029b5
mov esi, 0x40000001
jmp 0x140002999
mov esi, 0x40000008
jmp 0x140002999
mov esi, 0x4000000d
jmp 0x140002999
mov esi, 0x40000003
jmp 0x140002999
mov esi, 0x40000001
jmp 0x140002999
mov esi, 0x40000001
jmp 0x140002999
mov esi, 0x40000007
jmp 0x140002999
mov esi, 0x40000009
jmp 0x140002999
mov esi, 0x40000001
jmp 0x140002999
cmp byte [rsi + 8], 0x2d
jne 0x140002ced
cmp byte [rsi + 0xd], 0x2d
jne 0x140002ced
mov rbp, qword [sym.imp.msvcrt.dll__errno]
call rbp
mov dword [rax], 0
mov rax, qword [0x140018060]
lea rcx, [rax + 9]
mov r8d, 0x10
mov edx, 0
call sub.msvcrt.dll_strtol
mov edi, eax
mov esi, eax
call rbp
cmp dword [rax], 0
jne 0x140002e10
test di, di
jne 0x140002cf8
jmp 0x140002ced
call qword [sym.imp.msvcrt.dll__errno]
mov r9d, dword [rax]
mov r8, qword [0x140018060]
lea rdx, str.sys_init
lea rcx, str._E____s_____strtol_failed_sys_mach_guid_s_errno_d__n
call fcn.140002ef2
jmp 0x140002ced
mov esi, 0x40000001
jmp 0x140002999
mov esi, 0x40000008
jmp 0x140002999
mov esi, 0x4000000d
jmp 0x140002999
mov esi, 0x40000003
jmp 0x140002999
mov esi, 0x40000001
jmp 0x140002999
mov esi, 0x40000001
jmp 0x140002999
mov esi, 0x40000007
jmp 0x140002999
mov esi, 0x40000009
jmp 0x140002999