Function at 0x18001dce4
Capabilities:
Create process on windows
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1490
call fcn.180080990
sub rsp, rax
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov qword [rsp + 0x14e0], rbx
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov rdi, rdx
mov rsi, rcx
mov ebx, 7
mov qword [rsp + 0x160], rbx
xor r15d, r15d
mov qword [rsp + 0x158], r15
mov word [rsp + 0x148], r15w
lea ebp, [rbx - 6]
mov eax, 0x400
lea r13d, [rbx + 0x44]
lea r14d, [rbx + 1]
cmp rdx, rax
jg 0x18001e0c6
cmp rdx, rax
je 0x18001e03e
cmp rdx, 0x20
jg 0x18001df14
cmp rdx, 0x20
je 0x18001deff
mov rax, rdx
sub rax, rbp
je 0x18001de7b
sub rax, rbp
je 0x18001e6a1
sub rax, 2
je 0x18001e6a1
sub rax, 4
je 0x18001e6a1
cmp rax, r14
jne 0x18001e13a
mov r8, rbp
lea rdx, [0x18008958c]
lea rcx, [rsp + 0x140]
call fcn.180018530
lea rcx, case.0x180031f8c.6
mov rax, qword [case.0x180031f8c.6]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea r8, [0x180089598]
lea rdx, [0x1800895a8]
lea rcx, [rsp + 0x20]
call fcn.180010c8c
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
mov rbx, qword [rsp + 0x20]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
mov r8, rcx
mov rdx, rbx
lea rcx, [rsp + 0x140]
call fcn.180018530
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
cmp eax, r15d
jg 0x18001de46
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov r8d, 3
lea rdx, [0x1800895b0]
lea rcx, [rsp + 0x140]
call fcn.180018530
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.18001c4a4
jmp 0x18001e706
mov r8, rbp
lea rdx, [0x1800895b8]
lea rcx, [rsp + 0x140]
call fcn.180018530
mov r8d, 3
lea rdx, [0x1800895c0]
lea rcx, [rsp + 0x140]
call fcn.180018530
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001ded9
call fcn.18005e62c
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r14
jb 0x18001dee9
mov rdx, qword [rax + 8]
jmp 0x18001deed
lea rdx, [rax + 8]
lea rcx, [rsp + 0x140]
call fcn.18001be64
jmp 0x18001e706
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.18001ce94
jmp 0x18001e706
cmp rdx, 0x40
jl 0x18001e13a
cmp rdx, 0x42
jle 0x18001df72
cmp rdx, 0x80
je 0x18001df5d
cmp rdx, 0x100
je 0x18001df48
cmp rdx, 0x200
je 0x18001e6c2
jmp 0x18001e13a
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.18001c9e4
jmp 0x18001e706
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.18001cb84
jmp 0x18001e706
lea r9, [0x1800895c8]
add edi, 0xffffffc0
mov rcx, qword [rcx + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rbx, 0x6666666666666667
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18001e00b
mov rcx, qword [rsi + 0x50]
sub rcx, qword [rsi + 0x48]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edi, edx
jge 0x18001e00b
movsxd rdi, edi
mov rcx, qword [rsi + 0x50]
sub rcx, qword [rsi + 0x48]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jb 0x18001dff0
call fcn.18005e62c
lea rax, [rdi + rdi*4]
mov rcx, qword [rsi + 0x48]
cmp qword [rcx + rax*8 + 0x20], r14
jb 0x18001e006
mov r9, qword [rcx + rax*8 + 8]
jmp 0x18001e00b
lea r9, [rcx + rax*8 + 8]
mov r8d, 0x104
lea rdx, [rsp + 0x230]
mov rcx, rsi
call fcn.18001b0b4
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.18001c824
jmp 0x18001e706
mov edx, 0x54
lea rcx, [rsp + 0x140]
call fcn.18001bc84
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x180], r15
mov word [rsp + 0x170], r15w
mov r8d, 2
lea rdx, [rsp + 0x168]
mov rcx, rsi
call fcn.18001bf34
lea rdx, [rsp + 0x170]
cmp qword [rsp + 0x188], r14
cmovae rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x140]
call fcn.18001be64
nop
cmp qword [rsp + 0x188], r14
jb 0x18001e706
mov rcx, qword [rsp + 0x170]
call fcn.18005c410
jmp 0x18001e706
cmp rdx, 0x1000
je 0x18001e6a1
mov eax, 0x40000
mov r12d, 0x20000
cmp rdx, 0x10000
je 0x18001e575
cmp rdx, r12
je 0x18001e575
cmp rdx, rax
je 0x18001e575
cmp rdx, 0x80000
je 0x18001e511
cmp rdx, 0x100000
je 0x18001e4af
cmp rdx, 0x200000
je 0x18001e44b
cmp rdx, 0x400000
je 0x18001e39a
cmp rdx, 0x800000
je 0x18001e14c
lea r8, [rsp + 0x140]
call fcn.18001d014
jmp 0x18001e706
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
mov r8, rbp
lea rdx, [0x18008940c]
lea rcx, [rsp + 0x50]
call fcn.1800038e0
nop
lea r8, [rsp + 0x50]
lea rdx, [0x18008949c]
lea rcx, [rsp + 0xa0]
call fcn.180021220
nop
or r12, 0xffffffffffffffff
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.1800017a4
nop
cmp qword [rsp + 0xc0], r14
jb 0x18001e1bd
mov rcx, qword [rsp + 0xa8]
call fcn.18005c410
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
cmp qword [rsp + 0x70], r14
jb 0x18001e1e7
mov rcx, qword [rsp + 0x58]
call fcn.18005c410
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rbx, 0x6666666666666667
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001e227
call fcn.18005e62c
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r14
jb 0x18001e237
mov rcx, qword [rax + 8]
jmp 0x18001e23b
lea rcx, [rax + 8]
lea rdx, [0x1800894a4]
call fcn.18005c474
cmp rax, r15
je 0x18001e358
mov edi, 7
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r15
mov word [rsp + 0x30], r15w
mov r8, rbp
lea rdx, [0x1800894a8]
lea rcx, [rsp + 0x28]
call fcn.1800038e0
nop
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x140]
call fcn.180018400
nop
cmp qword [rsp + 0x48], r14
jb 0x18001e2a4
mov rcx, qword [rsp + 0x30]
call fcn.18005c410
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r15
mov word [rsp + 0x30], r15w
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001e2da
call fcn.18005e62c
mov r9, r12
xor r8d, r8d
mov rdx, qword [rsi + 0x78]
lea rcx, [rsp + 0x140]
call fcn.180018400
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
mov r8, rbp
lea rdx, [0x1800894ac]
lea rcx, [rsp + 0x78]
call fcn.1800038e0
nop
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x140]
call fcn.180018400
nop
cmp qword [rsp + 0x98], r14
jb 0x18001e706
mov rcx, qword [rsp + 0x80]
call fcn.18005c410
jmp 0x18001e706
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001e37e
call fcn.18005e62c
mov r9, r12
xor r8d, r8d
mov rdx, qword [rsi + 0x78]
lea rcx, [rsp + 0x140]
call fcn.180018400
jmp 0x18001e706
mov r13d, Ordinal_79
cmp qword [rcx + 0x28], r14
jb 0x18001e3ac
mov rdx, qword [rcx + 0x10]
jmp 0x18001e3b0
lea rdx, [rcx + 0x10]
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001e3eb
call fcn.18005e62c
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r14
jb 0x18001e3fb
mov rdx, qword [rax + 8]
jmp 0x18001e3ff
lea rdx, [rax + 8]
lea rcx, [rsp + 0x850]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r9, [rsp + 0x850]
lea r8, str._unmount
lea rdx, str._s___s_
lea rcx, [rsp + 0xc60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xc60]
lea rcx, [rsp + 0x140]
call fcn.18001be64
jmp 0x18001e706
mov r13d, Ordinal_79
cmp qword [rcx + 0x28], r14
jb 0x18001e45d
mov r9, qword [rcx + 0x10]
jmp 0x18001e461
lea r9, [rcx + 0x10]
lea r8, str._eject
lea rdx, str.__s___s_
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1b0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x140]
call fcn.180018530
jmp 0x18001e706
mov ebx, Ordinal_79
mov edx, ebx
lea rcx, [rsp + 0x140]
call fcn.18001bc84
mov r13w, bx
cmp qword [rsi + 0x28], r14
jb 0x18001e4d3
mov rax, qword [rsi + 0x10]
jmp 0x18001e4d7
lea rax, [rsi + 0x10]
movzx r9d, word [rax]
lea r8, str._insertimage:
lea rdx, [0x180089528]
lea rcx, [rsp + 0x650]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x140]
call fcn.18001be64
jmp 0x18001e706
mov r13d, Ordinal_79
cmp qword [rcx + 0x28], r14
jb 0x18001e523
mov r9, qword [rcx + 0x10]
jmp 0x18001e527
lea r9, [rcx + 0x10]
lea r8, [0x1800894b0]
lea rdx, [0x1800894c8]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x140]
call fcn.180018530
jmp 0x18001e706
mov r13d, Ordinal_79
cmp rdx, rax
jne 0x18001e624
mov r8d, r14d
lea rdx, [rsp + 0x140]
call fcn.18001bf34
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001e5c1
call fcn.18005e62c
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r14
jb 0x18001e5d1
mov rdx, qword [rax + 8]
jmp 0x18001e5d5
lea rdx, [rax + 8]
lea rcx, [rsp + 0x140]
call fcn.18001be64
cmp qword [rsi + 0x28], r14
jb 0x18001e5ee
mov rax, qword [rsi + 0x10]
jmp 0x18001e5f2
lea rax, [rsi + 0x10]
movzx r9d, word [rax]
lea r8, str._drv:_c
mov rdx, r14
lea rcx, [rsp + 0x198]
call fcn.18005e798
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x140]
call fcn.18001be64
jmp 0x18001e637
mov r8d, 4
lea rdx, [rsp + 0x140]
call fcn.18001bf34
movabs rax, 0x5c003a0020
mov qword [rsp + 0x190], rax
mov ebx, 0x5a
mov word [rsp + 0x190], bx
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, ebp
je 0x18001e671
sub ebx, ebp
cmp ebx, 0x41
jge 0x18001e64e
jmp 0x18001e686
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x140]
call fcn.18001be64
cmp rdi, r12
jne 0x18001e706
lea rdx, str._drv:0
lea rcx, [rsp + 0x140]
call fcn.18001be64
jmp 0x18001e706
mov r8, rbp
lea rdx, [0x180089524]
lea rcx, [rsp + 0x140]
call fcn.180018530
cmp qword [rsp + 0x158], r15
jne 0x18001e6d9
mov r8, rbp
lea rdx, [0x180089588]
lea rcx, [rsp + 0x140]
call fcn.180018530
mov r8d, 3
lea rdx, [0x180089590]
lea rcx, [rsp + 0x140]
call fcn.180018530
mov r8, rdi
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.18001c4a4
cmp qword [rsp + 0x158], r15
je 0x18001e7df
movzx r8d, r13w
mov edx, 0x104
lea rcx, [rsp + 0x440]
call fcn.1800179a0
cmp eax, r15d
je 0x18001e7df
cmp qword [rsi + 0x28], r14
jb 0x18001e73f
mov rdi, qword [rsi + 0x10]
jmp 0x18001e743
lea rdi, [rsi + 0x10]
lea rax, [rsi + 0x124]
cmp word [rax], r15w
cmovne rdi, rax
mov dword [rsp + 0xd0], reloc.WS2_32.dll_WSASetLastError
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0xd4]
call fcn.18005c800
mov dword [rsp + 0x100], 5
mov qword [rsp + 0xf8], rdi
lea rax, [rsp + 0x440]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], r14
cmovae rax, qword [rsp + 0x148]
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
cmp qword [rsp + 0x160], r14
jb 0x18001e7db
mov rcx, qword [rsp + 0x148]
call fcn.18005c410
mov eax, edi
jmp 0x18001e7f8
cmp qword [rsp + 0x160], r14
jb 0x18001e7f6
mov rcx, qword [rsp + 0x148]
call fcn.18005c410
xor eax, eax
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.18005cb30
mov rbx, qword [rsp + 0x14e0]
add rsp, 0x1490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret