Function at 0x180007380
Capabilities:
Check os version
Extract resource via kernel32 functions
Get disk information
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x6c0], rbx
mov rax, qword [0x18002e010]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov rsi, rdx
mov qword [rsp + 0x78], rdx
mov r15, rcx
mov qword [rbp - 0x78], rcx
xor r13d, r13d
mov dword [rsp + 0x20], r13d
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r13w
test rdx, rdx
jne 0x180007416
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rcx + 0x10], xmm1
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r13w
jmp 0x180007c40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x180028210]
movdqu xmmword [rsp + 0x68], xmm1
mov word [rsp + 0x58], r13w
mov r8d, 0xc
lea rdx, str.Kernel32.dll
lea rcx, [rsp + 0x58]
call fcn.180003080
nop
call fcn.18000ad10
mov rcx, rax
lea rdx, [rsp + 0x58]
call fcn.18000adb0
mov rdi, rax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1800074a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800074a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007c8c
call fcn.18000c054
movdqa xmm0, xmmword [0x180028210]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r13w
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x180028210]
movdqu xmmword [rsp + 0x38], xmm1
mov word [rsp + 0x28], r13w
mov r8d, 9
lea rdx, str.Psapi.dll
lea rcx, [rsp + 0x28]
call fcn.180003080
nop
call fcn.18000ad10
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.18000adb0
mov r12, rax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18000754c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007547
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007c92
call fcn.18000c054
movdqa xmm0, xmmword [0x180028210]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], r13w
test r12, r12
je 0x180007c1e
test rdi, rdi
je 0x180007c1e
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 4]
call fcn.18000dba0
mov dword [rbp], 0x11c
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18000769c
cmp dword [rbp + 4], 6
ja 0x1800075b2
jne 0x180007650
cmp dword [rbp + 8], 2
jb 0x180007650
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x180007650
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x180007650
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180007650
movups xmm0, xmmword [0x180027b00]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [0x180027b10]
movups xmmword [rbp + 0x130], xmm1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180007650
lea rcx, [rax + 6]
lea rdx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180007650
cmp word [rbx + 2], ax
jbe 0x180007650
movzx edx, word [rbx + 0x32]
movzx eax, word [rbx + 0x30]
movzx ecx, word [rbx + 0x36]
mov dword [rbp + 4], edx
mov dword [rbp + 8], eax
mov dword [rbp + 0xc], ecx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x18000769c
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 0x144]
call fcn.18000dba0
mov dword [rbp + 0x140], 0x11c
lea rcx, [rbp + 0x140]
call rbx
mov r14, 0xffffffffffffffff
cmp dword [rbp + 4], 6
jb 0x18000773d
lea rdx, str.QueryFullProcessImageNameW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x18000773d
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp + 0x140]
call fcn.18000dba0
mov dword [rbp - 0x30], 0x208
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x140]
xor edx, edx
mov rcx, rsi
call rbx
test eax, eax
je 0x18000773d
mov eax, dword [rbp - 0x30]
cmp eax, 0x208
jae 0x180007718
add rax, rax
cmp rax, 0x412
jae 0x180007c98
mov word [rbp + rax + 0x140], r13w
lea rax, [rbp + 0x140]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180007722
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x50]
call fcn.180003080
cmp qword [rbp - 0x40], 0
jne 0x180007b3e
lea rdx, str.GetProcessImageFileNameW
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x180007778
lea rdx, str.GetProcessImageFileNameW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1800077eb
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp + 0x140]
call fcn.18000dba0
mov r8d, 0x208
lea rdx, [rbp + 0x140]
mov rcx, rsi
call rbx
lea ecx, [rax - 1]
cmp ecx, 0x206
ja 0x1800077eb
mov eax, eax
add rax, rax
cmp rax, 0x412
jae 0x180007c9e
mov word [rbp + rax + 0x140], r13w
lea rax, [rbp + 0x140]
mov r8, r14
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800077d0
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x50]
call fcn.180003080
cmp qword [rbp - 0x40], 0
je 0x180007a92
mov ecx, 0x410
call fcn.18000ca90
mov rsi, rax
xor edx, edx
mov r8d, 0x410
mov rcx, rax
call fcn.18000dba0
xor eax, eax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r13
lea rcx, [rbp + 0x120]
call fcn.18000aa40
mov rax, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x180007a0d
xor ebx, ebx
mov r12d, ebx
nop dword [rax + rax]
lea rdi, [rcx + r12]
cmp qword [rdi + 0x10], 3
jb 0x1800078a2
mov rax, rdi
mov rcx, qword [rdi + 0x18]
cmp rcx, 8
jb 0x18000788b
mov rax, qword [rdi]
cmp word [rax + 4], 0x5c
jne 0x1800078a2
mov rax, rdi
cmp rcx, 8
jb 0x18000789e
mov rax, qword [rdi]
mov word [rax + 4], bx
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1800078af
mov rcx, qword [rdi]
mov r8d, 0x208
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1800078c5
mov word [rsi], bx
mov rbx, r14
nop dword [rax + rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1800078d0
test ebx, ebx
je 0x180007901
mov r8d, ebx
cmp r8, qword [rbp - 0x40]
jae 0x180007901
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
mov rdx, rsi
call fcn.180012088
test eax, eax
je 0x18000792d
inc r13
add r12, 0x20
mov rax, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
sub rax, rcx
sar rax, 5
cmp r13, rax
jae 0x180007a03
xor ebx, ebx
jmp 0x180007870
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
movdqa xmm1, xmmword [0x180028210]
movdqu xmmword [rbp - 0x18], xmm1
xor r13d, r13d
mov word [rbp - 0x28], r13w
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
cmp qword [rdi + 0x18], 8
jb 0x180007962
mov rdi, qword [rdi]
mov eax, ebx
lea r9, [rcx + rax*2]
mov r8, rdi
lea rdx, str._s_s
lea rcx, [rbp - 0x28]
call fcn.180005d30
movups xmm2, xmmword [rbp - 0x50]
movups xmmword [rbp - 0x70], xmm2
movups xmm3, xmmword [rbp - 0x40]
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x28], xmm2
movups xmmword [rbp - 0x18], xmm3
psrldq xmm3, 8
movq rdx, xmm3
cmp rdx, 8
jb 0x1800079e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800079e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007ca4
call fcn.18000c054
movdqa xmm0, xmmword [0x180028210]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r13w
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
jmp 0x180007a10
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
xor r13d, r13d
mov rcx, rsi
call fcn.18000c054
nop
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x180007a82
mov rdx, qword [rbp + 0x128]
call fcn.180004290
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x120]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007a6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007caa
call fcn.18000c054
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r13
cmp qword [rbp - 0x40], 0
jne 0x180007b3e
mov rsi, qword [rsp + 0x78]
lea rdx, str.GetModuleFileNameExW
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x180007ac2
lea rdx, str.GetModuleFileNameExW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x180007b3e
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp + 0x140]
call fcn.18000dba0
mov r9d, 0x208
lea r8, [rbp + 0x140]
xor edx, edx
mov rcx, rsi
call rbx
lea ecx, [rax - 1]
cmp ecx, 0x206
ja 0x180007b3e
mov eax, eax
add rax, rax
cmp rax, 0x412
jae 0x180007cb6
mov word [rbp + rax + 0x140], r13w
lea rax, [rbp + 0x140]
nop word [rax + rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x180007b20
mov r8, r14
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x50]
call fcn.180003080
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x28]
call fcn.18000a570
mov rbx, rax
lea rax, [rbp - 0x50]
cmp rax, rbx
je 0x180007bc8
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180007b98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007b93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007cb0
call fcn.18000c054
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r13w
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x180007c0a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007c05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007c86
call fcn.18000c054
movdqa xmm0, xmmword [0x180028210]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], r13w
movups xmm0, xmmword [rbp - 0x50]
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [r15], xmm0
mov word [rbp - 0x50], r13w
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r13
movups xmmword [r15 + 0x10], xmm1
mov dword [rsp + 0x20], 1
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r13w
mov rax, r15
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.18000c030
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800101e4
int3
call fcn.1800101e4
int3
call fcn.1800101e4
int3
call fcn.18000c8fc
int3
call fcn.18000c8fc
nop
call fcn.1800101e4
nop
call fcn.1800101e4
nop
call fcn.1800101e4
nop
call fcn.18000c8fc
int3