Function at 0x180042660
Capabilities:
Get disk information
Get file size
Get session user name
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x670]
sub rsp, 0x770
mov rax, qword [0x1800ad828]
xor rax, rsp
mov qword [rbp + 0x660], rax
mov r15, rcx
mov qword [rbp - 0x48], rcx
imul ecx, r8d, 0x90a
mov eax, r8d
mov dword [rsp + 0x68], eax
mov rbx, rdx
mov qword [rbp - 0x30], rdx
mov r12d, r8d
mov dword [rsp + 0x44], ecx
cmp r8d, ecx
ja 0x180043071
movzx eax, byte [rsp + 0x40]
xor edx, edx
mov r14d, dword [rsp + 0x68]
movzx r13d, byte [rsp + 0x40]
mov rsi, qword [rbp - 0x58]
mov dword [rsp + 0x54], eax
mov r9d, 0x50
movabs r11, 0x6500720075
movabs r10, 0x6900720063
mov edi, 0x5073
lea r8d, [r9 - 0x4e]
cmp r12d, 0x12bd3
ja 0x180042921
je 0x1800428fd
cmp r12d, 0x9655
ja 0x18004287d
je 0x180042812
mov eax, r12d
sub eax, 0x6c
je 0x1800427ee
sub eax, 0x6b
je 0x180042762
cmp eax, 0x4aad
jne 0x180043058
movzx eax, word [0x1800a76ab]
mov word [rbp + 0x215], ax
movzx eax, byte [0x1800a76ad]
mov byte [rbp + 0x217], al
mov word [rbp + 0x213], di
jmp 0x180043058
lea rax, [rbp - 0x20]
cmp rbx, rax
je 0x180043058
mov rax, rbx
lea rcx, [rbp - 0x20]
mov edx, 4
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180042780
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
jmp 0x180043054
lea rdx, [0x1800a75f5]
lea rcx, [rbp + 0x210]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor edx, edx
mov word [rbp + 0x212], 0x6f
jmp 0x180043054
cmp dword [rbp + 0x200], 0
mov dword [rsp + 0x48], edx
je 0x180043058
mov rbx, r15
mov r15d, edx
nop dword [rax]
movzx eax, byte [rbp - 0x20]
lea r9, [rbp - 0x20]
mov byte [rbx], al
lea rcx, [rsp + 0x48]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x48], 8
xor edx, edx
mov qword [rsp + 0x20], rax
mov r8d, 0xc9
lea rbx, [rbx + 1]
inc r15d
call fcn.18002df80
cmp dword [rbp + 0x200], 0
jne 0x180042830
mov dword [rsp + 0x48], r15d
xor edx, edx
mov r15, qword [rbp - 0x48]
jmp 0x180043054
cmp r12d, 0x969c
je 0x1800428f1
cmp r12d, 0xe1b4
jne 0x180043058
lea rdx, [0x1800a7641]
lea rcx, [rbp + 0x218]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
cmp qword [rbx + 0x18], 8
mov rcx, rbx
mov byte [rbp + 0x21a], 0
jb 0x1800428bb
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x70], rax
xor edx, edx
jmp 0x180043054
mov byte [rbp + 0x218], 0
jmp 0x180043058
mov eax, dword [rsp + 0x48]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov dword [rsp + 0x70], eax
mov r8, r15
mov ecx, 0x93
call fcn.18006f8f0
xor edx, edx
jmp 0x180043054
cmp r12d, 0x20e14
ja 0x180042c91
je 0x180042d00
cmp r12d, 0x12ccc
je 0x1800429a9
cmp r12d, 0x177e4
je 0x180042985
cmp r12d, 0x1c2fc
jne 0x180043058
xor r9d, r9d
lea rax, [rbp + 0x210]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbp - 0x68], rax
xor edx, edx
jmp 0x180043054
mov rcx, qword [rbp - 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x58], eax
call fcn.180050e30
xor edx, edx
jmp 0x180043054
cmp qword [rbp - 0x70], 0xffffffffffffffff
mov byte [rsp + 0x40], 1
jne 0x180042c88
mov edi, 0x59
nop
cmp edi, 0x6ddc
ja 0x180042b13
je 0x180042b05
cmp edi, 0x59
je 0x180042ae5
cmp edi, 0x1640
je 0x180042ad8
cmp edi, 0x2c27
je 0x180042ac7
cmp edi, 0x420e
je 0x180042a83
cmp edi, 0x57f5
jne 0x180042c72
movzx eax, word [0x1800a75d0]
lea rdx, [0x1800a75d4]
mov word [rbp + 0x22b], ax
lea rcx, [rbp + 0x22d]
movzx eax, byte [0x1800a75d2]
mov r8d, 4
mov byte [rbp + 0x22d], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 2
lea rdx, [0x1800a75d8]
lea rcx, [rbp + 0x220]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x18009676c]
lea rcx, [rbp + 0x232]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor edx, edx
lea r8d, [rdx + 2]
lea r9d, [rdx + 0x50]
jmp 0x180042c72
movzx eax, word [0x180096768]
mov dword [rbp + 0x224], 0x6f4d3a
mov word [rbp + 0x227], ax
mov eax, 0x69
mov word [rbp + 0x228], ax
movzx eax, word [0x1800a75c8]
mov word [rbp + 0x229], ax
movzx eax, byte [0x1800a75ca]
mov byte [rbp + 0x22b], al
jmp 0x180042c72
mov eax, 0x49
mov word [rbp + 0x223], ax
jmp 0x180042c72
mov word [rbp + 0x222], r9w
jmp 0x180042c72
movzx eax, word [0x1800a75cc]
mov word [rbp + 0x220], ax
movzx eax, byte [0x1800a75ce]
mov byte [rbp + 0x222], al
jmp 0x180042c72
mov r13b, 1
mov r14d, 0x64
jmp 0x180042c72
cmp edi, 0x83c3
je 0x180042c6e
cmp edi, 0x99aa
je 0x180042c59
cmp edi, 0xaf91
je 0x180042c2c
cmp edi, 0xc578
je 0x180042b50
cmp edi, 0xdb5f
je 0x180042fc3
jmp 0x180042c72
test r13b, r13b
je 0x180042bee
mov ebx, 0xdb
nop
mov eax, ebx
sub eax, 0xdb
je 0x180042bda
sub eax, 1
je 0x180042bd2
sub eax, 1
je 0x180042ba5
cmp eax, 1
jne 0x180042be0
mov r9d, dword [rsp + 0x50]
lea rax, [rbp - 0x50]
mov r8d, r14d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x270]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
mov r8d, 2
lea r9d, [r8 + 0x4e]
jmp 0x180042be0
mov r9d, dword [rsp + 0x50]
lea rax, [rbp - 0x28]
mov r8d, r14d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x270]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
mov r8d, 2
lea r9d, [r8 + 0x4e]
jmp 0x180042be0
mov word [rsp + 0x50], r9w
jmp 0x180042be0
mov word [rsp + 0x52], r8w
inc ebx
cmp ebx, 0xdf
jb 0x180042b60
mov r9d, dword [rsp + 0x78]
lea r8, [rbp + 0x450]
mov edx, dword [rsp + 0x7c]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov r8d, dword [rbp - 0x80]
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
xor edx, edx
lea r8d, [rdx + 2]
lea r9d, [rdx + 0x50]
jmp 0x180042c72
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, 2
mov dword [rsp + 0x78], 0x104
mov rsi, rax
lea r9d, [r8 + 0x4e]
cmp rax, 0xffffffffffffffff
jne 0x180042c55
xor r13b, r13b
xor edx, edx
jmp 0x180042c72
mov dword [rsp + 0x7c], 0xffffffff
mov dword [rbp - 0x80], 0x32
mov dword [rsp + 0x50], edx
jmp 0x180042c72
mov qword [rbp - 0x40], rdx
add edi, 0x15e7
cmp edi, 0xf0ed
jbe 0x1800429c0
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x5c], edx
jmp 0x180043058
cmp r12d, 0x2592c
je 0x180042d54
cmp r12d, 0x2a444
jne 0x180043058
mov ebx, 0x41
cmp ebx, 0x41
je 0x180042cc4
cmp ebx, 0x20c1
jne 0x180042cf2
mov al, 1
jmp 0x180043076
cmp byte [rsp + 0x40], 0
je 0x180042ce1
mov rcx, qword [rbp - 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x7c]
lea rcx, [rbp + 0x340]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
add ebx, 0x2080
cmp ebx, 0x4100
jbe 0x180042cb0
xor edx, edx
mov rcx, r15
call fcn.180003640
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x5c]
mov rcx, qword [rbp - 0x70]
mov rdx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp - 0x70]
mov dword [rbp - 0x7c], 0x104
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x40]
xor edx, edx
mov ecx, edx
cmp qword [rbp - 0x68], rcx
cmovne ecx, eax
mov byte [rsp + 0x40], cl
jmp 0x180043054
mov eax, dword [rsp + 0x58]
cmp eax, dword [rsp + 0x5c]
je 0x180043058
mov edi, 0x5e
nop word [rax + rax]
cmp edi, 0x1d42a
ja 0x180042ef8
je 0x180042eba
cmp edi, 0xc8da
ja 0x180042e08
je 0x180042de8
cmp edi, 0x5e
je 0x180042dbd
cmp edi, 0x4332
je 0x180042db1
cmp edi, 0x8606
jne 0x180043042
mov qword [rbp + 0x246], r10
jmp 0x180043042
mov qword [rbp + 0x240], r11
jmp 0x180043042
mov eax, dword [0x1800a7618]
mov dword [rbp + 0x238], eax
mov eax, dword [0x1800a7620]
mov dword [rbp + 0x23c], eax
movzx eax, word [0x1800a7624]
mov word [rbp + 0x240], ax
jmp 0x180043042
movabs rax, 0x6900720065
mov dword [rbp + 0x24c], 0x74
mov qword [rbp + 0x24e], rax
jmp 0x180043042
cmp edi, 0x10bae
je 0x180042eab
cmp edi, 0x14e82
je 0x180042e56
cmp edi, 0x19156
jne 0x180043042
lea rcx, [rbp + 0x238]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180042e33
mov eax, dword [0x1800a7628]
mov dword [rcx], eax
movzx eax, word [0x1800a762c]
mov word [rcx + 4], ax
jmp 0x180043042
mov eax, dword [0x1800a75fc]
lea rdx, [0x1800a7608]
mov dword [rbp + 0x256], eax
lea rcx, [rbp + 0x238]
movzx eax, word [0x1800a7600]
mov r8d, 3
mov word [rbp + 0x25a], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x1800a7610]
xor edx, edx
mov dword [rbp + 0x260], eax
movzx eax, word [0x1800a7614]
mov word [rbp + 0x264], ax
jmp 0x18004302e
mov dword [rbp + 0x254], 0x61
jmp 0x180043042
mov eax, dword [0x1800a7630]
lea rcx, [rbp + 0x238]
mov dword [rbp + 0x268], eax
sub rcx, 2
movzx eax, word [0x1800a7634]
mov word [rbp + 0x26c], ax
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180042ee0
mov eax, dword [0x1800a7638]
mov dword [rcx], eax
jmp 0x180043042
cmp edi, 0x2df7a
ja 0x180042f72
je 0x180042f66
cmp edi, 0x216fe
je 0x180042f57
cmp edi, 0x259d2
je 0x180042f47
cmp edi, 0x29ca6
jne 0x180043042
mov qword [r15 + 0x10], rdx
mov rax, r15
cmp qword [r15 + 0x18], 0x10
jb 0x180042f2f
mov rax, qword [r15]
mov byte [rax], 0
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x60], 4
jmp 0x180043042
mov qword [rbp - 0x60], rdx
mov dword [rbp - 0x74], 0xffffffff
jmp 0x180043042
mov al, 1
mov qword [rbp - 0x38], rdx
mov dword [rsp + 0x54], eax
jmp 0x180043042
mov dword [rbp - 0x78], 0x104
jmp 0x180043042
cmp edi, 0x3224e
je 0x180042fca
cmp edi, 0x36522
jne 0x180043042
cmp byte [rsp + 0x54], 0
je 0x180042fc3
mov rax, qword [rbp - 0x60]
lea rcx, [rbp + 0x238]
mov r8d, dword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov edx, dword [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
jmp 0x180043076
mov r8d, dword [rsp + 0x60]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0x238]
mov qword [rsp + 0x30], rdx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x20], rdx
mov edx, dword [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
mov r9d, dword [rbp - 0x78]
lea r8, [rbp + 0x450]
mov edx, dword [rbp - 0x74]
mov ebx, eax
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov eax, dword [rsp + 0x54]
test ebx, ebx
movzx eax, al
mov edx, 0
cmovne eax, edx
mov dword [rsp + 0x54], eax
movabs r11, 0x6500720075
movabs r10, 0x6900720063
add edi, 0x42d4
cmp edi, 0x3a798
jbe 0x180042d70
mov ecx, dword [rsp + 0x44]
imul eax, dword [rsp + 0x68], 0xb2
add r12d, eax
cmp r12d, ecx
ja 0x180043071
mov rbx, qword [rbp - 0x30]
jmp 0x1800426d6
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rbp + 0x660]
xor rcx, rsp
call fcn.180092fc0
mov rbx, qword [rsp + 0x7c0]
add rsp, 0x770
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret