Function at 0x140088f60
Capabilities:
Get common file path
Get disk size
Get memory capacity
Get session user name
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor esi, esi
mov rax, qword [rcx + 8]
mov qword [rcx + 0xb50], rsi
mov rbx, rcx
mov qword [rcx + 0xb58], rsi
mov r8d, 0x208
mov qword [rcx + 0xb38], rsi
mov qword [rcx + 0xb40], rsi
mov qword [rcx + 0xb48], rsi
mov qword [rcx + 0xb30], rsi
mov dword [rcx + 0xb20], esi
mov dword [rcx + 0xad8], esi
mov dword [rcx + 0xb98], esi
mov qword [rcx + 0xca0], rsi
mov qword [rcx + 0xc28], rsi
mov qword [rcx + 0xc30], rsi
mov qword [rcx + 0xc78], rsi
mov qword [rcx + 0xc80], rsi
mov qword [rcx + 0xc88], rsi
mov qword [rcx + 0xc90], rsi
mov qword [rcx + 0xe00], rsi
mov qword [rcx + 0xe20], rsi
mov qword [rcx + 0xe40], rsi
mov qword [rcx + 0xea0], rsi
mov qword [rcx + 0xea8], rsi
mov qword [rcx + 0xeb0], rsi
mov qword [rcx + 0xeb8], rsi
mov qword [rcx + 0xec0], rsi
mov qword [rcx + 0xf08], rsi
mov qword [rcx + 0xf10], rsi
mov byte [rcx + 0xe98], sil
mov dword [rcx + 0xf18], esi
mov qword [rcx + 0xb24], 1
lea rcx, [0x140456bf0]
cmp qword [0x140457e70], 0x10
mov qword [0x140456df8], rax
lea rax, [0x140457e58]
cmovae rax, qword [0x140457e58]
mov qword [0x140457e68], rsi
mov dword [0x140455b64], esi
mov dword [reloc.WS2_32.dll_accept], 1
mov byte [rax], sil
lea rax, [0x140457e78]
cmp qword [0x140457e90], 0x10
mov qword [0x140457e88], rsi
cmovae rax, qword [0x140457e78]
mov dword [0x1404565b8], esi
mov dword [0x1404563ac], esi
mov dword [0x140456198], esi
mov byte [rax], sil
lea rax, [0x140457e38]
cmp qword [0x140457e50], 0x10
mov qword [0x140457e48], rsi
cmovae rax, qword [0x140457e38]
xor edx, edx
mov dword [0x14045619c], esi
mov byte [rax], sil
call fcn.1402767a0
xor edx, edx
lea rcx, [0x1404563b0]
mov r8d, 0x208
call fcn.1402767a0
xor r9d, r9d
lea r8d, [rsi + 5]
lea rdx, [0x1404563b0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r9, [0x1404563b0]
mov edx, 0x104
lea r8, str._sCleanupSys.ini
lea rcx, [0x140456bf0]
call fcn.14004e9f0
xor edx, edx
lea rcx, [0x1404565c0]
mov r8d, 0x208
call fcn.1402767a0
xor edx, edx
lea rcx, [0x140456e00]
mov r8d, 0x208
call fcn.1402767a0
xor edx, edx
mov r8d, 0x208
lea rcx, [0x1404561a0]
call fcn.1402767a0
xor edx, edx
lea rcx, [0x140455d80]
mov r8d, 0x208
call fcn.1402767a0
xor edx, edx
lea rcx, [0x140455b70]
mov r8d, 0x208
call fcn.1402767a0
xor edx, edx
lea rcx, [0x140455f90]
mov r8d, 0x208
call fcn.1402767a0
lea rbp, [0x140457010]
xor edx, edx
mov rcx, rbp
mov r8d, 0x208
call fcn.1402767a0
xor edx, edx
lea rcx, [0x140457480]
mov r8d, 0x208
call fcn.1402767a0
xor edx, edx
lea rcx, [0x140457270]
mov r8d, 0x208
call fcn.1402767a0
lea rdi, [0x1404567d0]
xor edx, edx
mov rcx, rdi
mov r8d, 0x208
call fcn.1402767a0
xor edx, edx
lea rcx, [0x1404569e0]
mov r8d, 0x208
call fcn.1402767a0
xor r9d, r9d
lea rdx, [0x1404565c0]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [rsi + 0x19]
lea rdx, [0x140456e00]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [rsi + 6]
lea rdx, [0x1404561a0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [rsi + 0xe]
lea rdx, [0x140455d80]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [rsi + 0x27]
lea rdx, [0x140455b70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [rsi + 0xd]
lea rdx, [0x140455f90]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8d, 0x104
lea rdx, [0x140457270]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x140457480]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [0x140457270]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
sub rdi, rax
nop dword [rax + rax]
movzx ecx, word [rax]
mov word [rdi + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400892f0
lea rdx, [0x1404569e0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edx, edx
lea rcx, str.X:UsersAdministrator
mov r8d, 0x208
call fcn.1402767a0
cmp dword [0x140455d78], esi
je 0x140089356
call fcn.14007f5e0
mov word [0x140456be8], ax
call fcn.14007f6b0
test rax, rax
je 0x140089379
mov r8, rax
mov edx, 0x104
mov rcx, rbp
call fcn.140285f3c
jmp 0x140089379
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x104
mov rcx, rbp
mov word [0x140456be8], ax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
movzx r9d, word [0x140455b60]
lea r8, str._C:Users_s
mov edx, 0x104
mov qword [rsp + 0x20], rbp
lea rcx, str.X:UsersAdministrator
call fcn.14004e9f0
lea rcx, [rsp + 0x48]
call fcn.14007c990
mov rdx, rax
call fcn.14009cb70
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400893da
mov rdx, qword [rsp + 0x50]
call fcn.140056290
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
sub r8, rdx
sar r8, 5
call fcn.140056110
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
movzx eax, byte [rsp + 0x69]
cmp al, 0x80
je 0x1400893fc
mov dword [0x1404565bc], 1
cmp al, 0xff
jne 0x140089402
mov dword [0x1404565bc], esi
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x88]
mov edi, esi
movzx ecx, word [0x140455b60]
mov qword [0x1404567c8], rax
call fcn.14004f3b0
test eax, eax
js 0x140089445
mov ecx, eax
call fcn.14004edd0
mov edi, eax
mov rcx, qword [0x14043bd80]
lea r9, [0x140455b68]
movzx eax, word [0x140455b60]
xor r8d, r8d
mov word [str.X:WindowsWinSxS], ax
xor edx, edx
mov dword [0x1404569dc], edi
movzx eax, word [rcx + 0x30]
mov word [str.X:WindowsSystem32cmd.exe], ax
movzx eax, byte [rcx + 0x30]
mov byte [str.X:Windowsexplorer.exe], al
movzx eax, word [rcx + 0x30]
lea rcx, [0x140330dc8]
mov word [str.X:Windows_regedit.exe], ax
mov qword [0x140455b68], rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x64
call fcn.14004ef80
lea rcx, str.X:Windows_regedit.exe
mov dword [0x1404569d8], eax
call fcn.14004d760
lea r8, [rsp + 0x40]
mov dword [rsp + 0x60], esi
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x40], esi
mov rcx, rax
call fcn.14004d640
mov edx, dword [rsp + 0x40]
lea rcx, [rbx + 0x58]
mov r9d, dword [rsp + 0x60]
mov r8, rax
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], edx
lea rdx, str.X:Windows_regedit.exe
call fcn.1400c1220
lea rcx, [rbx + 0xba0]
lea r8, str.X:Windows_regedit.exe
lea rdx, [0x14032d8c0]
call fcn.1400c3460
lea rcx, [0x140455f88]
call fcn.14004d760
lea rcx, [rbx + 0xce8]
mov qword [rbx + 0xdf8], rax
lea rdx, str.file2.png_dest0_7_18_25
call fcn.1400c3460
lea rcx, [rbx + 0xd70]
lea rdx, str.file3.png_dest0_7_18_25
call fcn.1400c3460
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140125a70
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret