Function at 0x140079af1
Capabilities:
Create directory
Get disk information
Hash data using murmur3
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0x3a32d035
pushf
not eax
add eax, 0x2e486c4b
xor eax, 0x4855af79
rol eax, 0x2a
popf
pushf
not eax
add eax, 0x12874dc1
xor eax, 0x58815e25
rol eax, 0x63
popf
pushf
not eax
add eax, 0x4e31b857
xor eax, 0x46b9104
rol eax, 0x11
popf
cmp eax, 0xe
jne 0x140079b41
popf
pop rax
jmp 0x14007a489
cmp eax, 0xb
jne 0x140079b50
popf
pop rax
jmp 0x14007a28d
cmp eax, 2
jne 0x140079b5f
popf
pop rax
jmp 0x140079dc9
cmp eax, 0xa
jne 0x140079b6e
popf
pop rax
jmp 0x14007a234
cmp eax, 0x12
jne 0x140079b7d
popf
pop rax
jmp 0x14007a849
cmp eax, 1
jne 0x140079b8c
popf
pop rax
jmp 0x140079d78
cmp eax, 0x13
jne 0x140079b9b
popf
pop rax
jmp 0x14007a8bc
cmp eax, 0x11
jne 0x140079baa
popf
pop rax
jmp 0x14007a7af
cmp eax, 6
jne 0x140079bb9
popf
pop rax
jmp 0x14007a076
cmp eax, 8
jne 0x140079bc8
popf
pop rax
jmp 0x14007a16f
cmp eax, 0x14
jne 0x140079bd7
popf
pop rax
jmp 0x14007a8f2
cmp eax, 0xc
jne 0x140079be6
popf
pop rax
jmp 0x14007a2e2
cmp eax, 0xf
jne 0x140079bf5
popf
pop rax
jmp 0x14007a58f
cmp eax, 4
jne 0x140079c04
popf
pop rax
jmp 0x140079f48
cmp eax, 5
jne 0x140079c13
popf
pop rax
jmp 0x140079fe2
cmp eax, 0
jne 0x140079c22
popf
pop rax
jmp 0x140079c6d
cmp eax, 3
jne 0x140079c31
popf
pop rax
jmp 0x140079ef7
cmp eax, 9
jne 0x140079c40
popf
pop rax
jmp 0x14007a1aa
cmp eax, 0xd
jne 0x140079c4f
popf
pop rax
jmp 0x14007a412
cmp eax, 7
jne 0x140079c5e
popf
pop rax
jmp 0x14007a0d8
cmp eax, 0x10
jne 0x140079c6d
popf
pop rax
jmp 0x14007a712
push rdi
mov eax, 0x95d3f730
pushf
not eax
add eax, 0x36c5cc14
xor eax, 0x67fc90d1
rol eax, 0xeb
popf
pushf
not eax
add eax, 0x55a9217d
xor eax, 0x5cb13325
rol eax, 0x35
popf
pushf
not eax
add eax, 0x20d6efad
xor eax, 0x14a018c5
rol eax, 0xe2
popf
call fcn.14008c714
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x4030], rax
xor r8d, r8d
xor edx, edx
call fcn.140080b6c
mov rdi, rax
test rax, rax
jne 0x140079d32
push rax
pushf
mov eax, 0xa15cf14c
pushf
not eax
add eax, 0x3371f532
xor eax, 0x4ad80580
rol eax, 0xa3
popf
pushf
not eax
add eax, 0x1247d6e8
xor eax, 0x357faebb
rol eax, 0x67
popf
pushf
not eax
add eax, 0xf9ac7b7
xor eax, 0x3d019908
rol eax, 0x82
popf
pushf
not eax
add eax, 0x11603957
xor eax, 0x700bb58
rol eax, 0xed
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0x70304275
pushf
not eax
add eax, 0x469464e6
xor eax, 0x62f200ab
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x4fbb0f01
xor eax, 0x26a86835
rol eax, 0x75
popf
pushf
not eax
add eax, 0x1c93c062
xor eax, 0x6732d76c
rol eax, 0x58
popf
jmp 0x140079b32
lea rcx, [0x1abf1f585]
pushf
sub rcx, 0x6bef2025
popf
call fcn.1400608a1
xor eax, eax
jmp 0x14007a8fa
mov r8d, 0xfd621978
pushf
not r8d
add r8d, 0x6775634f
xor r8d, 0x43c25830
rol r8d, 0x13
popf
pushf
not r8d
add r8d, 0x3edf76dd
xor r8d, 0x8c62960
rol r8d, 0x2d
popf
pushf
not r8d
add r8d, 0x61e2d4fb
xor r8d, 0x4425f0a9
rol r8d, 0x3b
popf
pushf
not r8d
add r8d, 0x601f3bf7
xor r8d, 0x3ef26c71
rol r8d, 0x23
popf
mov qword [rsp + 0x4058], rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
jmp 0x140079e44
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.1400d61fc
test ebx, ebx
jne 0x140079eb1
push rax
pushf
mov eax, 0x7cdbaa11
pushf
not eax
add eax, 0xe1de07a
xor eax, 0x52dd197b
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x4b2f8c3d
xor eax, 0x3340da02
rol eax, 0x75
popf
pushf
not eax
add eax, 0x920bdf3
xor eax, 0x21fa5944
rol eax, 0xe1
popf
pushf
not eax
add eax, 0x2137ab07
xor eax, 0x4498630b
rol eax, 0x18
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0x4b9fcbb
pushf
not eax
add eax, 0x28870ec3
xor eax, 0x5daa04d1
rol eax, 0xba
popf
pushf
not eax
add eax, 0x507cf48e
xor eax, 0x7f2af528
rol eax, 0x7e
popf
pushf
not eax
add eax, 0x40caa538
xor eax, 0x1e6039f1
rol eax, 0x63
popf
jmp 0x140079b32
lea rcx, [0x1a462ae3e]
pushf
sub rcx, 0x645fd85e
popf
call fcn.1400608a1
xor eax, eax
jmp 0x14007a8f2
lea rcx, [rsp + 0x30]
call fcn.14007ffb6
test eax, eax
je 0x140079f9c
push rax
pushf
mov eax, 0xafe4c4ec
pushf
not eax
add eax, 0x6718e339
xor eax, 0x51f4b715
rol eax, 0x44
popf
pushf
not eax
add eax, 0x35c81506
xor eax, 0x216f8b0a
rol eax, 0x86
popf
pushf
not eax
add eax, 0x4b721406
xor eax, 0x16b4f88e
rol eax, 0xa0
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0x7285b46c
pushf
not eax
add eax, 0x73cf32c0
xor eax, 0x4203bc5
rol eax, 0xa
popf
pushf
not eax
add eax, 0x1663ac67
xor eax, 0x2981be89
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x42191d7f
xor eax, 0x7f51b628
rol eax, 0x32
popf
jmp 0x140079b32
cmp word [rsp + 0x34], 0x5c
je 0x14007a01d
push rax
pushf
mov eax, 0xfc1b0c1d
pushf
not eax
add eax, 0x6ec2e0ba
xor eax, 0x743aaf2
rol eax, 0x72
popf
pushf
not eax
add eax, 0x2523cb51
xor eax, 0x2b69f3b9
rol eax, 0xc0
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0x8f6741a6
pushf
not eax
add eax, 0x6f439422
xor eax, 0x22130dae
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x2116ecbe
xor eax, 0x2a63392a
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x1939b0a5
xor eax, 0x5f6a566a
rol eax, 0x7a
popf
pushf
not eax
add eax, 0x3eb09e98
xor eax, 0x3458f802
rol eax, 0xd7
popf
jmp 0x140079b32
lea rcx, [rsp + 0x30]
sub rcx, 2
push rax
pushf
mov eax, 0xb9f45d0
pushf
not eax
add eax, 0x497591f0
xor eax, 0x7b376ae5
rol eax, 0x98
popf
pushf
not eax
add eax, 0x1cb966d4
xor eax, 0x229a7b5c
rol eax, 0xcf
popf
pushf
not eax
add eax, 0x5f68feec
xor eax, 0x2a924004
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x48c23fbe
xor eax, 0x44557d0
rol eax, 0x21
popf
jmp 0x140079b32
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14007a116
push rax
pushf
mov eax, 0xbbd75aaf
pushf
not eax
add eax, 0x64a9a6ce
xor eax, 0x21c89db5
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x7f39ff72
xor eax, 0x3457b8bd
rol eax, 0xe6
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0x5e6be795
pushf
not eax
add eax, 0x2c399670
xor eax, 0xada057
rol eax, 0x57
popf
pushf
not eax
add eax, 0x4063aa9b
xor eax, 0x522d89f3
rol eax, 0x29
popf
pushf
not eax
add eax, 0x6dc84337
xor eax, 0x1b654200
rol eax, 0x3c
popf
pushf
not eax
add eax, 0x2a72e36f
xor eax, 0x1d5a7730
rol eax, 0xf3
popf
jmp 0x140079b32
mov eax, dword [0x14002d670]
mov dword [rcx], eax
push rax
pushf
mov eax, 0x5caf7da8
pushf
not eax
add eax, 0x46160db8
xor eax, 0x46350c69
rol eax, 0x88
popf
pushf
not eax
add eax, 0x5a533bfe
xor eax, 0x6fed54e
rol eax, 0xd
popf
jmp 0x140079b32
lea rcx, [rsp + 0x30]
jmp 0x14007a1b0
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jg 0x14007a1ee
push rax
pushf
mov eax, 0x7dfe97b8
pushf
not eax
add eax, 0x5a8f1929
xor eax, 0x72fc4d69
rol eax, 0x87
popf
pushf
not eax
add eax, 0x7c2145ce
xor eax, 0x40bb38f6
rol eax, 0x89
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0xf517008c
pushf
not eax
add eax, 0x2923b683
xor eax, 0x4d6d0309
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x5efc3eb9
xor eax, 0x2da7b266
rol eax, 0x3d
popf
pushf
not eax
add eax, 0x7602c862
xor eax, 0x7c4cef3c
rol eax, 0x24
popf
jmp 0x140079b32
mov r8d, eax
lea rdx, [rsp + 0x30]
lea rcx, [0x190796fc6]
pushf
sub rcx, 0x50769946
popf
call fcn.1400608a1
xor eax, eax
jmp 0x14007a8f2
lea rcx, [rsp + 0x30]
call fcn.1400ee0f3
jmp 0x14007a8f2
mov r8d, 0x282dc971
pushf
not r8d
add r8d, 0x384ad26e
xor r8d, 0x524ed1cf
rol r8d, 6
popf
pushf
not r8d
add r8d, 0x781d5d3
xor r8d, 0x5838f428
rol r8d, 6
popf
pushf
not r8d
add r8d, 0x12e5a9cd
xor r8d, 0x275ddcd2
rol r8d, 0x3d
popf
pushf
not r8d
add r8d, 0x6cf38fb5
xor r8d, 0x64c85f42
rol r8d, 0x1e
popf
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.1400f0b9c
mov rbx, rax
test rax, rax
jne 0x14007a3b9
push rax
pushf
mov eax, 0x4e96be9c
pushf
not eax
add eax, 0x7ed28fa3
xor eax, 0x7c8af5c5
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x6a9ce549
xor eax, 0x74e82d8b
rol eax, 0xd9
popf
pushf
not eax
add eax, 0x38d8f165
xor eax, 0x5daaa012
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x27d1ac43
xor eax, 0x437f6e6d
rol eax, 0x69
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0x81d0456
pushf
not eax
add eax, 0x6a9a60ad
xor eax, 0x14b62713
rol eax, 0xee
popf
pushf
not eax
add eax, 0x3ca45553
xor eax, 0xe4b63a4
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x12e3cb46
xor eax, 0x44568ac9
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x3d904c03
xor eax, 0x204d1efe
rol eax, 0xe
popf
jmp 0x140079b32
lea rcx, [0x182bdd4dc]
pushf
sub rcx, 0x42bafdcc
popf
call fcn.1400608a1
xor eax, eax
jmp 0x14007a8f2
mov edx, 0x54f730b4
pushf
not edx
add edx, 0x4fec4017
xor edx, 0x62811262
rol edx, 0xa8
popf
pushf
not edx
add edx, 0x734df553
xor edx, 0x195bb62c
rol edx, 0x27
popf
pushf
not edx
add edx, 0x7a546313
xor edx, 0x6ab3179f
rol edx, 0xe9
popf
mov rcx, rbx
call fcn.140090743
mov rdi, rax
test rax, rax
je 0x14007a536
push rax
pushf
mov eax, 0xf13ca6f0
pushf
not eax
add eax, 0x7e78360e
xor eax, 0x7c96fc16
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xc03449d
xor eax, 0x4a47e84f
rol eax, 4
popf
pushf
not eax
add eax, 0x6333db55
xor eax, 0x34cf01a4
rol eax, 0x7a
popf
pushf
not eax
add eax, 0x46f64141
xor eax, 0x67abc15b
rol eax, 0xf
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0xd1694e5c
pushf
not eax
add eax, 0x6dd4cea5
xor eax, 0x495e9276
rol eax, 0x61
popf
pushf
not eax
add eax, 0x42181faa
xor eax, 0x618630b3
rol eax, 0x90
popf
pushf
not eax
add eax, 0x798a32ea
xor eax, 0x43a21d1b
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x3ff028aa
xor eax, 0x51a80f04
rol eax, 0x39
popf
jmp 0x140079b32
mov r9, rdi
mov qword [rsp + 0x20], rbx
push rbx
not rbx
add r9, rbx
pop rbx
add r9, 1
lea r8, [0x1a35c8c95]
pushf
sub r8, 0x6359b4fd
popf
sar r9, 1
lea rcx, [rsp + 0x2030]
mov edx, 0xa2f5857f
pushf
not edx
add edx, 0x57b14a6d
xor edx, 0x5c40eba4
rol edx, 0x82
popf
pushf
not edx
add edx, 0x61f13663
xor edx, 0x1ee0ef50
rol edx, 0x22
popf
pushf
not edx
add edx, 0x310b22c
xor edx, 0x6d1b25f4
rol edx, 0x20
popf
pushf
not edx
add edx, 0x28972ea0
xor edx, 0x16319116
rol edx, 0xbf
popf
call fcn.14006048e
xor edx, edx
lea rcx, [rsp + 0x2030]
jmp 0x14007a629
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x14c075c4
pushf
not edx
add edx, 0x4b1e1e12
xor edx, 0x67ee1a95
rol edx, 0x5e
popf
pushf
not edx
add edx, 0x65215e5
xor edx, 0x38d4320
rol edx, 0xdf
popf
pushf
not edx
add edx, 0x1ba0b0eb
xor edx, 0x67c7d1d3
rol edx, 0xf7
popf
pushf
not edx
add edx, 0x560c65bf
xor edx, 0x3dac4fe9
rol edx, 0x54
popf
lea rcx, [rdi + 2]
call fcn.140090743
mov rdi, rax
test rax, rax
jne 0x14007a6df
push rax
pushf
mov eax, 0xd73d7735
pushf
not eax
add eax, 0x600750c
xor eax, 0x6a9b3d64
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x12eda129
xor eax, 0x3d19eaf
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x21ff9671
xor eax, 0x51774f16
rol eax, 0x82
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0x49a4df42
pushf
not eax
add eax, 0x5ce78683
xor eax, 0x463a92d3
rol eax, 0x1e
popf
pushf
not eax
add eax, 0x3e974e8f
xor eax, 0x68d9412a
rol eax, 0xeb
popf
jmp 0x140079b32
xor edx, edx
mov rcx, rbx
jmp 0x14007a718
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14007a755
push rax
pushf
mov eax, 0xaaaf4e67
pushf
not eax
add eax, 0x4ce88daa
xor eax, 0x3e15e5e6
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x18b280c3
xor eax, 0x6547ee16
rol eax, 0x5e
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0x430cc4cc
pushf
not eax
add eax, 0x4932496d
xor eax, 0x188ed782
rol eax, 0x10
popf
pushf
not eax
add eax, 0x59792cc7
xor eax, 0x2a2d5daa
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x1c556449
xor eax, 0x7eb24601
rol eax, 0xb7
popf
pushf
not eax
add eax, 0x7e119860
xor eax, 0x2cc19fd4
rol eax, 0x1f
popf
jmp 0x140079b32
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14007a802
push rax
pushf
mov eax, 0xe95b1eb3
pushf
not eax
add eax, 0x7e1c3801
xor eax, 0x4a827197
rol eax, 0x11
popf
pushf
not eax
add eax, 0x5825bf91
xor eax, 0x5894ac16
rol eax, 0x54
popf
pushf
not eax
add eax, 0x3cc7439d
xor eax, 0x4afb1552
rol eax, 0x93
popf
jmp 0x140079b32
push rax
pushf
mov eax, 0x36593cc0
pushf
not eax
add eax, 0x5d7502c3
xor eax, 0x19eb0d85
rol eax, 0x51
popf
pushf
not eax
add eax, 0x62f80451
xor eax, 0x260749f5
rol eax, 0x49
popf
pushf
not eax
add eax, 0x38d92a25
xor eax, 0x5b3b9449
rol eax, 0x73
popf
jmp 0x140079b32
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
lea r8, [0x187976d59]
pushf
sub r8, 0x479495a9
popf
mov edx, eax
lea rcx, [0x1abf0e986]
pushf
sub rcx, 0x6bee116e
popf
call fcn.14006170f
mov rcx, rbx
call fcn.1400d61fc
xor eax, eax
jmp 0x14007a8f2
mov rax, rbx
push rax
pushf
mov eax, 0xb9dc8c8d
pushf
not eax
add eax, 0x2964fc70
xor eax, 0x752b27d3
rol eax, 0x92
popf
pushf
not eax
add eax, 0x5453c8ae
xor eax, 0x738f5e21
rol eax, 0x64
popf
jmp 0x140079b32
mov rbx, qword [rsp + 0x4058]
mov rcx, qword [rsp + 0x4030]
xor rcx, rsp
call fcn.140089a05
add rsp, 0x4040
pop rdi
ret