Function at 0x18001fb40
Capabilities:
Create process on windows
Get disk information

Disassembly:
push rsi
push rdi
push r12
mov eax, 0x14e0
call fcn.180083120
sub rsp, rax
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov qword [rsp + 0x1510], rbx
mov qword [rsp + 0x1518], rbp
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0x14d0], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x170], 7
xor ebx, ebx
mov qword [rsp + 0x168], rbx
mov word [rsp + 0x158], bx
lea r12d, [rbx + 0x4b]
cmp rdx, 0x400
jg 0x18001ff0b
cmp rdx, 0x400
je 0x18001fe48
cmp rdx, 0x20
jg 0x18001fd45
cmp rdx, 0x20
je 0x18001fd30
mov rax, rdx
sub rax, 1
je 0x18001fcce
sub rax, 1
je 0x180020108
sub rax, 2
je 0x180020108
sub rax, 4
je 0x180020108
cmp rax, 8
jne 0x18002020e
lea r8d, [rbx + 1]
lea rdx, [0x18008c5ec]
lea rcx, [rsp + 0x150]
call fcn.180019270
lea rcx, case.0x180034a3c.6
mov rax, qword [case.0x180034a3c.6]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea r8, [0x18008c5f8]
lea rdx, [0x18008c608]
lea rcx, [rsp + 0x28]
call fcn.180011550
xor eax, eax
or rbp, 0xffffffffffffffff
mov rcx, rbp
mov rbx, qword [rsp + 0x28]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x150]
call fcn.180019270
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x18001fc99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov r8d, 3
lea rdx, [0x18008c610]
lea rcx, [rsp + 0x150]
call fcn.180019270
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x150]
mov rcx, rsi
call fcn.18001d880
jmp 0x1800205b4
mov r8d, 1
lea rdx, [0x18008c618]
lea rcx, [rsp + 0x150]
call fcn.180019270
mov r8d, 3
lea rdx, [0x18008c620]
lea rcx, [rsp + 0x150]
call fcn.180019270
lea rcx, [rsi + 0x60]
xor edx, edx
call fcn.180022c00
cmp qword [rax + 0x20], 8
jb 0x18001fd1a
mov rdx, qword [rax + 8]
jmp 0x18001fd1e
lea rdx, [rax + 8]
lea rcx, [rsp + 0x150]
call fcn.18001d140
jmp 0x1800205b4
xor r8d, r8d
lea rdx, [rsp + 0x150]
call fcn.18001e680
jmp 0x1800205b4
cmp rdx, 0x40
jl 0x18002020e
cmp rdx, 0x42
jle 0x18001fda3
cmp rdx, 0x80
je 0x18001fd8e
cmp rdx, 0x100
je 0x18001fd79
cmp rdx, 0x200
je 0x18002012d
jmp 0x18002020e
xor r8d, r8d
lea rdx, [rsp + 0x150]
call fcn.18001e080
jmp 0x1800205b4
xor r8d, r8d
lea rdx, [rsp + 0x150]
call fcn.18001e2d0
jmp 0x1800205b4
lea r9, [0x18008c628]
add edi, 0xffffffc0
mov rcx, qword [rcx + 0x80]
sub rcx, qword [rsi + 0x78]
movabs r8, 0x6666666666666667
mov rax, r8
imul rcx
sar rdx, 4
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
je 0x18001fe15
lea rcx, [rsi + 0x30]
mov rdx, qword [rcx + 0x20]
sub rdx, qword [rcx + 0x18]
mov rax, r8
imul rdx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edi, edx
jge 0x18001fe15
movsxd rdx, edi
call fcn.180022c00
cmp qword [rax + 0x20], 8
jb 0x18001fe11
mov r9, qword [rax + 8]
jmp 0x18001fe15
lea r9, [rax + 8]
mov r8d, 0x104
lea rdx, [rsp + 0x690]
mov rcx, rsi
call fcn.18001c320
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0x150]
mov rcx, rsi
call fcn.18001de10
jmp 0x1800205b4
mov r8d, 0x54
lea rdx, [0x18008c4dc]
lea rcx, [rsp + 0x1d8]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1d8]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x150]
call fcn.180019270
mov qword [rsp + 0x198], 7
mov qword [rsp + 0x190], rbx
mov word [rsp + 0x180], bx
mov r8d, 2
lea rdx, [rsp + 0x178]
mov rcx, rsi
call fcn.18001d220
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x150]
call fcn.18001d140
nop
cmp qword [rsp + 0x198], 8
jb 0x1800205b4
mov rcx, qword [rsp + 0x180]
call fcn.18005eeb4
jmp 0x1800205b4
cmp rdx, 0x80000
jg 0x1800201de
cmp rdx, 0x80000
je 0x180020179
cmp rdx, 0x1000
je 0x180020108
cmp rdx, 0x10000
je 0x18001ff51
cmp rdx, 0x20000
je 0x18001ff51
cmp rdx, 0x40000
jne 0x18002020e
mov r12d, Ordinal_79
cmp rdx, 0x40000
jne 0x18001ffda
lea r8d, [r12 - 0x45]
lea rdx, [rsp + 0x150]
call fcn.18001d220
lea rcx, [rsi + 0x60]
xor edx, edx
call fcn.180022c00
cmp qword [rax + 0x20], 8
jb 0x18001ff8a
mov rdx, qword [rax + 8]
jmp 0x18001ff8e
lea rdx, [rax + 8]
lea rcx, [rsp + 0x150]
call fcn.18001d140
lea rcx, [rsi + 8]
xor edx, edx
call fcn.180002430
movzx r9d, word [rax]
lea r8, str._drv:_c
mov edx, 8
lea rcx, [rsp + 0x1a8]
call fcn.180061228
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x150]
call fcn.18001d140
jmp 0x18001ffed
mov r8d, 4
lea rdx, [rsp + 0x150]
call fcn.18001d220
movabs rax, 0x5c003a0020
mov qword [rsp + 0x1a0], rax
mov ebx, 0x5a
nop word [rax + rax]
mov word [rsp + 0x1a0], bx
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x180020034
dec ebx
cmp ebx, 0x41
jge 0x180020010
jmp 0x180020049
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x150]
call fcn.18001d140
cmp rdi, 0x20000
jne 0x1800205b4
mov edx, Ordinal_35
lea rcx, str._drv:0
call fcn.180061804
mov rdi, rax
lea rcx, case.0x180034a3c.6
mov rdx, qword [case.0x180034a3c.6]
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x20], rax
test rdi, rdi
je 0x1800200a3
lea r8, str._drv:0
lea rdx, [0x18008c4e8]
lea rcx, [rsp + 0x20]
call fcn.180011550
jmp 0x1800200bb
lea r8, str._drv:0
lea rdx, [0x18008c4f0]
lea rcx, [rsp + 0x20]
call fcn.180011550
xor eax, eax
or rbp, 0xffffffffffffffff
mov rcx, rbp
mov rbx, qword [rsp + 0x20]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x150]
call fcn.180019270
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x1800205b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
jmp 0x1800205b4
mov r8d, 1
lea rdx, [0x18008c584]
lea rcx, [rsp + 0x150]
call fcn.180019270
cmp qword [rsp + 0x168], 0
jne 0x180020147
mov r8d, 1
lea rdx, [0x18008c5e8]
lea rcx, [rsp + 0x150]
call fcn.180019270
mov r8d, 3
lea rdx, [0x18008c5f0]
lea rcx, [rsp + 0x150]
call fcn.180019270
mov r8, rdi
lea rdx, [rsp + 0x150]
mov rcx, rsi
call fcn.18001d880
jmp 0x1800205b4
mov r12d, Ordinal_79
cmp qword [rcx + 0x28], 8
jb 0x18002018c
mov r9, qword [rcx + 0x10]
jmp 0x180020190
lea r9, [rcx + 0x10]
lea r8, [0x18008c510]
lea rdx, [0x18008c528]
lea rcx, [rsp + 0x240]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x240]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x150]
call fcn.180019270
jmp 0x1800205b4
cmp rdx, 0x100000
je 0x180020520
cmp rdx, 0x200000
je 0x1800204bb
cmp rdx, 0x400000
je 0x18002042e
cmp rdx, 0x800000
je 0x180020220
lea r8, [rsp + 0x150]
call fcn.18001e8b0
jmp 0x1800205b4
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
mov r8d, 1
lea rdx, [0x18008c46c]
lea rcx, [rsp + 0x30]
call fcn.180003900
nop
lea r8, [rsp + 0x30]
lea rdx, [0x18008c4fc]
lea rcx, [rsp + 0xa8]
call fcn.1800235e0
nop
or rbp, 0xffffffffffffffff
mov r9, rbp
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1800017b4
nop
cmp qword [rsp + 0xc8], 8
jb 0x180020298
mov rcx, qword [rsp + 0xb0]
call fcn.18005eeb4
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
cmp qword [rsp + 0x50], 8
jb 0x1800202c6
mov rcx, qword [rsp + 0x38]
call fcn.18005eeb4
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
xor edx, edx
lea rcx, [rsi + 0x60]
call fcn.180022c00
cmp qword [rax + 0x20], 8
jb 0x1800202f1
mov rcx, qword [rax + 8]
jmp 0x1800202f5
lea rcx, [rax + 8]
lea rdx, [0x18008c504]
call fcn.18005ef18
test rax, rax
je 0x180020408
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rbx
mov word [rsp + 0x60], bx
mov r8d, 1
lea rdx, [0x18008c508]
lea rcx, [rsp + 0x58]
call fcn.180003900
nop
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x150]
call fcn.180019120
nop
cmp qword [rsp + 0x78], 8
jb 0x180020360
mov rcx, qword [rsp + 0x60]
call fcn.18005eeb4
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rbx
mov word [rsp + 0x60], bx
xor edx, edx
lea rcx, [rsi + 0x60]
call fcn.180022c00
mov r9, rbp
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.180019120
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], rbx
mov word [rsp + 0x88], bx
mov r8d, 1
lea rdx, [0x18008c50c]
lea rcx, [rsp + 0x80]
call fcn.180003900
nop
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x150]
call fcn.180019120
nop
cmp qword [rsp + 0xa0], 8
jb 0x1800205b4
mov rcx, qword [rsp + 0x88]
call fcn.18005eeb4
jmp 0x1800205b4
xor edx, edx
lea rcx, [rsi + 0x60]
call fcn.180022c00
mov r9, rbp
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.180019120
jmp 0x1800205b4
mov r12d, Ordinal_79
cmp qword [rcx + 0x28], 8
jb 0x180020441
mov rdx, qword [rcx + 0x10]
jmp 0x180020445
lea rdx, [rcx + 0x10]
lea rcx, [rsp + 0x8a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsi + 0x60]
xor edx, edx
call fcn.180022c00
cmp qword [rax + 0x20], 8
jb 0x18002046b
mov rdx, qword [rax + 8]
jmp 0x18002046f
lea rdx, [rax + 8]
lea rcx, [rsp + 0x8a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r9, [rsp + 0x8a0]
lea r8, str._unmount
lea rdx, str._s___s_
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xcb0]
lea rcx, [rsp + 0x150]
call fcn.18001d140
jmp 0x1800205b4
mov r12d, Ordinal_79
cmp qword [rcx + 0x28], 8
jb 0x1800204ce
mov r9, qword [rcx + 0x10]
jmp 0x1800204d2
lea r9, [rcx + 0x10]
lea r8, str._eject
lea rdx, str.__s___s_
lea rcx, [rsp + 0x200]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x200]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x150]
call fcn.180019270
jmp 0x1800205b4
mov ebx, Ordinal_79
mov r8d, ebx
lea rdx, [0x18008c4dc]
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1b8]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x150]
call fcn.180019270
mov r12w, bx
cmp qword [rsi + 0x28], 8
jb 0x18002057b
mov rax, qword [rsi + 0x10]
jmp 0x18002057f
lea rax, [rsi + 0x10]
movzx r9d, word [rax]
lea r8, str._insertimage:
lea rdx, [0x18008c588]
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x150]
call fcn.18001d140
cmp qword [rsp + 0x168], 0
je 0x180020690
movzx r8d, r12w
mov edx, 0x104
lea rcx, [rsp + 0x480]
call fcn.180018540
test eax, eax
je 0x180020690
cmp qword [rsi + 0x28], 8
jb 0x1800205ee
mov rdi, qword [rsi + 0x10]
jmp 0x1800205f2
lea rdi, [rsi + 0x10]
lea rax, [rsi + 0x124]
cmp word [rax], 0
cmovne rdi, rax
mov dword [rsp + 0xe0], reloc.WS2_32.dll_WSASetLastError
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0xe4]
call fcn.18005f790
mov dword [rsp + 0x110], 5
mov qword [rsp + 0x108], rdi
lea rax, [rsp + 0x480]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae rax, qword [rsp + 0x158]
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0xe0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
cmp qword [rsp + 0x170], 8
jb 0x18002068c
mov rcx, qword [rsp + 0x158]
call fcn.18005eeb4
mov eax, edi
jmp 0x1800206aa
cmp qword [rsp + 0x170], 8
jb 0x1800206a8
mov rcx, qword [rsp + 0x158]
call fcn.18005eeb4
xor eax, eax
mov rcx, qword [rsp + 0x14d0]
xor rcx, rsp
call fcn.18005f4d0
lea r11, [rsp + 0x14e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret