Function at 0x180020310
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1800e1080]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r15, rdx
mov r12, rcx
movabs r13, 0x64640a01e0000001
mov rdx, qword [rdx + 8]
mov rcx, qword [r15]
call fcn.180026cc0
mov rax, qword [r15]
mov qword [r15 + 8], rax
mov rdx, qword [r12 + 8]
mov rcx, qword [r12]
call fcn.180026cc0
mov rax, qword [r12]
mov qword [r12 + 8], rax
mov edi, 0x10000
mov r8, 0xffffffffffffffff
mov ecx, edi
mov eax, 2
mul rcx
mov rbx, rax
cmovo rbx, r8
mov rcx, rbx
call fcn.180088cfc
mov r14, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.18008b920
mov r8d, edi
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1800203f2
mov rcx, r14
call fcn.180088a1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800203d8
add edi, edi
jmp 0x18002037f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, eax
movabs rcx, 0x64640a1800000000
or rax, rcx
jmp 0x1800208c6
mov rsi, r14
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x180020400
test rax, rax
je 0x180020873
xor ebx, ebx
mov edi, 0x4a25
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18008b920
mov r9, 0xffffffffffffffff
mov r8, rsi
mov edx, 0x104
lea rcx, [rbp - 0x40]
call fcn.18008f43c
lea rax, [rbp - 0x40]
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180020450
inc rdx
lea rcx, [rbp - 0x40]
call fcn.180093b24
mov dword [rsp + 0x30], ebx
mov cl, 1
mov byte [rbp - 0x70], cl
mov dword [rbp - 0x6e], 0x4a4e4a55
mov dword [rbp - 0x6a], 0x4a5b4a5e
mov dword [rbp - 0x66], 0x4a494a40
mov dword [rbp - 0x62], 0x4a404a4a
mov dword [rbp - 0x5e], 0x4a5c4a69
mov dword [rbp - 0x5a], 0x4a464a46
mov dword [rbp - 0x56], 0x4a174a54
mov dword [rbp - 0x52], 0x4a344a46
xor eax, eax
mov word [rbp - 0x4e], ax
mov ecx, ebx
mov rdx, rbx
lea eax, [rdi + rcx]
xor word [rbp + rdx*2 - 0x6e], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 0x10
jb 0x1800204b2
mov word [rbp - 0x4e], bx
mov byte [rbp - 0x70], 0
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x6e]
lea rcx, [rbp - 0x40]
call fcn.180029490
cmp eax, 1
jne 0x180020661
movzx ecx, al
mov byte [rsp + 0x58], al
mov dword [rsp + 0x5a], 0x4a7a4a79
mov dword [rsp + 0x5e], 0x4a744a09
mov dword [rsp + 0x62], 0x4a29
mov ecx, ebx
mov rdx, rbx
nop dword [rax]
lea eax, [rdi + rcx]
xor word [rsp + rdx*2 + 0x5a], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 5
jb 0x180020510
mov word [rsp + 0x64], bx
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], bx
lea rax, [rsp + 0x5a]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180020551
lea rdx, [rsp + 0x5a]
lea rcx, [rsp + 0x38]
call fcn.1800018f0
nop
lea rax, [rbp - 0x40]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180020580
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1800205d7
lea rdi, [rcx + rdx]
mov qword [rsp + 0x48], rdi
lea rbx, [rsp + 0x38]
cmp r8, 8
cmovae rbx, qword [rsp + 0x38]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp - 0x40]
call fcn.18008b270
xor eax, eax
mov word [rbx + rdi*2], ax
xor ebx, ebx
mov edi, 0x4a25
jmp 0x1800205ed
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.18000aec0
mov rax, qword [r12 + 8]
cmp rax, qword [r12 + 0x10]
je 0x18002060e
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.180009580
add qword [r12 + 8], 0x20
jmp 0x18002061f
lea r8, [rsp + 0x38]
mov rdx, rax
mov rcx, r12
call fcn.180026b00
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x180020661
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002065c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800208f0
call fcn.180088a1c
mov cl, 1
mov byte [rsp + 0x78], cl
mov dword [rsp + 0x7a], 0x4a454a56
mov dword [rsp + 0x7e], 0x4a414a54
mov dword [rbp - 0x7e], 0x4a5f4a0c
mov dword [rbp - 0x7a], 0x4a2c4a11
xor eax, eax
mov word [rbp - 0x76], ax
mov ecx, ebx
mov rdx, rbx
lea eax, [rdi + rcx]
xor word [rsp + rdx*2 + 0x7a], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 8
jb 0x180020690
mov word [rbp - 0x76], bx
mov byte [rsp + 0x78], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x7a]
lea rcx, [rbp - 0x40]
call fcn.180029490
cmp eax, 1
jne 0x180020839
movzx ecx, al
mov byte [rsp + 0x68], al
mov dword [rsp + 0x6a], 0x4a7a4a79
mov dword [rsp + 0x6e], 0x4a744a09
mov dword [rsp + 0x72], 0x4a29
mov ecx, ebx
mov rdx, rbx
nop dword [rax]
lea eax, [rdi + rcx]
xor word [rsp + rdx*2 + 0x6a], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 5
jb 0x1800206f0
mov word [rsp + 0x74], bx
mov byte [rsp + 0x68], 0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], bx
lea rax, [rsp + 0x6a]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180020731
lea rdx, [rsp + 0x6a]
lea rcx, [rsp + 0x38]
call fcn.1800018f0
nop
lea rax, [rbp - 0x40]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180020760
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1800207b2
lea rdi, [rcx + rdx]
mov qword [rsp + 0x48], rdi
lea rbx, [rsp + 0x38]
cmp r8, 8
cmovae rbx, qword [rsp + 0x38]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp - 0x40]
call fcn.18008b270
xor eax, eax
mov word [rbx + rdi*2], ax
xor ebx, ebx
jmp 0x1800207c8
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.18000aec0
mov rax, qword [r15 + 8]
cmp rax, qword [r15 + 0x10]
je 0x1800207e6
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.180009580
add qword [r15 + 8], 0x20
jmp 0x1800207f7
lea r8, [rsp + 0x38]
mov rdx, rax
mov rcx, r15
call fcn.180026b00
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x180020839
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020834
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800208f6
call fcn.180088a1c
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rsi + rax*2], 0
jne 0x180020840
lea rsi, [rsi + rax*2]
add rsi, 2
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x180020860
test rax, rax
jne 0x180020416
mov rcx, r14
call fcn.180088a1c
mov rdx, qword [r12 + 8]
mov rcx, qword [r12]
mov r8, rdx
sub r8, rcx
sar r8, 5
test r8, r8
je 0x1800208a5
xor r9d, r9d
call fcn.180026f90
movabs r13, 0x64640a5200000000
mov rdx, qword [r15 + 8]
mov rcx, qword [r15]
mov r8, rdx
sub r8, rcx
sar r8, 5
test r8, r8
je 0x1800208c3
xor r9d, r9d
call fcn.180026f90
mov rax, r13
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.180088650
mov rbx, qword [rsp + 0x330]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180092abc
int3
call fcn.180092abc
int3