Function at 0x180018d10
Capabilities:
Create process on windows
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1490
call fcn.18003be30
sub rsp, rax
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov qword [rsp + 0x14e0], rbx
mov rax, qword [0x180056150]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov rdi, rdx
mov rsi, rcx
mov r15d, 7
mov qword [rsp + 0x160], r15
xor r14d, r14d
mov qword [rsp + 0x158], r14
mov word [rsp + 0x148], r14w
mov eax, 0x200
lea r12d, [r15 + 0x44]
lea r13d, [r15 + 1]
cmp rdx, rax
jg 0x180019098
cmp rdx, rax
je 0x18001904c
cmp rdx, 0x10
jg 0x180018f11
cmp rdx, 0x10
je 0x180018e49
mov rax, rdx
sub rax, 1
je 0x180018df6
sub rax, 1
je 0x180018dc9
sub rax, 2
je 0x180018dc9
cmp rax, 4
jne 0x18001910b
mov r8d, 1
lea rdx, [0x18004407c]
lea rcx, [rsp + 0x140]
call fcn.180013544
cmp qword [rsp + 0x158], r14
jne 0x180019066
jmp 0x18001904c
mov rcx, qword [rcx + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x180018e23
call fcn.180025824
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r13
jb 0x180018e33
mov rdx, qword [rax + 8]
jmp 0x180018e37
lea rdx, [rax + 8]
lea rcx, [rsp + 0x140]
call fcn.1800168b0
jmp 0x1800196fa
mov r8d, 1
lea rdx, [0x1800440e4]
lea rcx, [rsp + 0x140]
call fcn.180013544
lea rcx, [0x180056020]
mov rax, qword [0x180056020]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea r8, [0x1800440f0]
lea rdx, [0x180044100]
lea rcx, [rsp + 0x20]
call fcn.18000da7c
xor eax, eax
or rbp, 0xffffffffffffffff
mov rcx, rbp
mov rbx, qword [rsp + 0x20]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x140]
call fcn.180013544
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
cmp eax, r14d
jg 0x180018edc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r8d, 3
lea rdx, [0x180044108]
lea rcx, [rsp + 0x140]
call fcn.180013544
mov r8d, 0x10
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.180016ef0
jmp 0x1800196fa
cmp rdx, 0x20
je 0x180019037
cmp rdx, 0x3f
jle 0x18001910b
cmp rdx, 0x42
jle 0x180018f6b
cmp rdx, 0x80
je 0x180018f56
cmp rdx, 0x100
jne 0x18001910b
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.180017350
jmp 0x1800196fa
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.1800174f0
jmp 0x1800196fa
lea r9, str..zip
add edi, 0xffffffc0
mov rcx, qword [rcx + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rbx, 0x6666666666666667
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x180019004
mov rcx, qword [rsi + 0x50]
sub rcx, qword [rsi + 0x48]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edi, edx
jge 0x180019004
movsxd rdi, edi
mov rcx, qword [rsi + 0x50]
sub rcx, qword [rsi + 0x48]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jb 0x180018fe9
call fcn.180025824
lea rax, [rdi + rdi*4]
mov rcx, qword [rsi + 0x48]
cmp qword [rcx + rax*8 + 0x20], r13
jb 0x180018fff
mov r9, qword [rcx + rax*8 + 8]
jmp 0x180019004
lea r9, [rcx + rax*8 + 8]
mov r8d, 0x104
lea rdx, [rsp + 0x230]
mov rcx, rsi
call fcn.180016160
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.180017190
jmp 0x1800196fa
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.180017800
jmp 0x1800196fa
mov r8d, 1
lea rdx, [0x1800440e0]
lea rcx, [rsp + 0x140]
call fcn.180013544
mov r8d, 3
lea rdx, [0x1800440e8]
lea rcx, [rsp + 0x140]
call fcn.180013544
mov r8, rdi
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.180016ef0
jmp 0x1800196fa
cmp rdx, 0x400
je 0x18001967b
mov ebp, 0x20000
mov eax, 0x40000
cmp rdx, 0x10000
je 0x18001954a
cmp rdx, rbp
je 0x18001954a
cmp rdx, rax
je 0x18001954a
cmp rdx, 0x80000
je 0x1800194e6
cmp rdx, 0x100000
je 0x180019484
cmp rdx, 0x200000
je 0x180019420
cmp rdx, 0x400000
je 0x18001936f
cmp rdx, 0x800000
je 0x18001911d
lea r8, [rsp + 0x140]
call fcn.180018110
jmp 0x1800196fa
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov r8d, 1
lea rdx, [0x180043eec]
lea rcx, [rsp + 0x50]
call fcn.180007420
nop
lea r8, [rsp + 0x50]
lea rdx, [0x180043ffc]
lea rcx, [rsp + 0xa0]
call fcn.18001ca58
nop
or rbp, 0xffffffffffffffff
mov r9, rbp
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.180007810
nop
cmp qword [rsp + 0xc0], r13
jb 0x180019191
mov rcx, qword [rsp + 0xa8]
call fcn.1800228ac
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xb8], r14
mov word [rsp + 0xa8], r14w
cmp qword [rsp + 0x70], r13
jb 0x1800191bb
mov rcx, qword [rsp + 0x58]
call fcn.1800228ac
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rbx, 0x6666666666666667
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x1800191fb
call fcn.180025824
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r13
jb 0x18001920b
mov rcx, qword [rax + 8]
jmp 0x18001920f
lea rcx, [rax + 8]
lea rdx, [0x180043f2c]
call fcn.180022910
cmp rax, r14
je 0x18001932d
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r14
mov word [rsp + 0x30], r14w
mov r8d, 1
lea rdx, [0x180043f84]
lea rcx, [rsp + 0x28]
call fcn.180007420
nop
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x140]
call fcn.180013414
nop
cmp qword [rsp + 0x48], r13
jb 0x180019276
mov rcx, qword [rsp + 0x30]
call fcn.1800228ac
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r14
mov word [rsp + 0x30], r14w
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x1800192ac
call fcn.180025824
mov r9, rbp
xor r8d, r8d
mov rdx, qword [rsi + 0x78]
lea rcx, [rsp + 0x140]
call fcn.180013414
mov qword [rsp + 0x98], r15
mov qword [rsp + 0x90], r14
mov word [rsp + 0x80], r14w
mov r8d, 1
lea rdx, [0x180044004]
lea rcx, [rsp + 0x78]
call fcn.180007420
nop
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x140]
call fcn.180013414
nop
cmp qword [rsp + 0x98], r13
jb 0x1800196fa
mov rcx, qword [rsp + 0x80]
call fcn.1800228ac
jmp 0x1800196fa
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x180019353
call fcn.180025824
mov r9, rbp
xor r8d, r8d
mov rdx, qword [rsi + 0x78]
lea rcx, [rsp + 0x140]
call fcn.180013414
jmp 0x1800196fa
mov r12d, 0x4d
cmp qword [rcx + 0x28], r13
jb 0x180019381
mov rdx, qword [rcx + 0x10]
jmp 0x180019385
lea rdx, [rcx + 0x10]
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x1800193c0
call fcn.180025824
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r13
jb 0x1800193d0
mov rdx, qword [rax + 8]
jmp 0x1800193d4
lea rdx, [rax + 8]
lea rcx, [rsp + 0x850]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r9, [rsp + 0x850]
lea r8, str._unmount
lea rdx, str._s___s_
lea rcx, [rsp + 0xc60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xc60]
lea rcx, [rsp + 0x140]
call fcn.1800168b0
jmp 0x1800196fa
mov r12d, 0x4d
cmp qword [rcx + 0x28], r13
jb 0x180019432
mov r9, qword [rcx + 0x10]
jmp 0x180019436
lea r9, [rcx + 0x10]
lea r8, str._eject
lea rdx, str.__s___s_
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1b0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x140]
call fcn.180013544
jmp 0x1800196fa
mov ebx, 0x4d
mov edx, ebx
lea rcx, [rsp + 0x140]
call fcn.180016620
mov r12w, bx
cmp qword [rsi + 0x28], r13
jb 0x1800194a8
mov rax, qword [rsi + 0x10]
jmp 0x1800194ac
lea rax, [rsi + 0x10]
movzx r9d, word [rax]
lea r8, str._insertimage:
lea rdx, [0x180044080]
lea rcx, [rsp + 0x650]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x140]
call fcn.1800168b0
jmp 0x1800196fa
mov r12d, 0x4d
cmp qword [rcx + 0x28], r13
jb 0x1800194f8
mov r9, qword [rcx + 0x10]
jmp 0x1800194fc
lea r9, [rcx + 0x10]
lea r8, [0x180044008]
lea rdx, [0x180044020]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x140]
call fcn.180013544
jmp 0x1800196fa
mov r12d, 0x4d
cmp rdx, rax
jne 0x1800195f9
mov r8d, r13d
lea rdx, [rsp + 0x140]
call fcn.180016980
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x180019596
call fcn.180025824
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r13
jb 0x1800195a6
mov rdx, qword [rax + 8]
jmp 0x1800195aa
lea rdx, [rax + 8]
lea rcx, [rsp + 0x140]
call fcn.1800168b0
cmp qword [rsi + 0x28], r13
jb 0x1800195c3
mov rax, qword [rsi + 0x10]
jmp 0x1800195c7
lea rax, [rsi + 0x10]
movzx r9d, word [rax]
lea r8, str._drv:_c
mov rdx, r13
lea rcx, [rsp + 0x198]
call fcn.18002561c
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x140]
call fcn.1800168b0
jmp 0x18001960c
mov r8d, 4
lea rdx, [rsp + 0x140]
call fcn.180016980
movabs rax, 0x5c003a0020
mov qword [rsp + 0x190], rax
mov ebx, 0x5a
mov word [rsp + 0x190], bx
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x180019647
dec ebx
cmp ebx, 0x41
jge 0x180019623
jmp 0x18001965c
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x140]
call fcn.1800168b0
cmp rdi, rbp
jne 0x1800196fa
lea rdx, str._drv:0
lea rcx, [rsp + 0x140]
call fcn.1800168b0
jmp 0x1800196fa
mov edx, 0x54
lea rcx, [rsp + 0x140]
call fcn.180016620
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x180], r14
mov word [rsp + 0x170], r14w
mov r8d, 2
lea rdx, [rsp + 0x168]
mov rcx, rsi
call fcn.180016980
lea rdx, [rsp + 0x170]
cmp qword [rsp + 0x188], r13
cmovae rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x140]
call fcn.1800168b0
nop
cmp qword [rsp + 0x188], r13
jb 0x1800196fa
mov rcx, qword [rsp + 0x170]
call fcn.1800228ac
cmp qword [rsp + 0x158], r14
je 0x1800197d3
movzx r8d, r12w
mov edx, 0x104
lea rcx, [rsp + 0x440]
call fcn.180012ec4
cmp eax, r14d
je 0x1800197d3
cmp qword [rsi + 0x28], r13
jb 0x180019733
mov rdi, qword [rsi + 0x10]
jmp 0x180019737
lea rdi, [rsi + 0x10]
lea rax, [rsi + 0x124]
cmp word [rax], r14w
cmovne rdi, rax
mov dword [rsp + 0xd0], 0x70
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0xd4]
call fcn.180022ca0
mov dword [rsp + 0x100], 5
mov qword [rsp + 0xf8], rdi
lea rax, [rsp + 0x440]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], r13
cmovae rax, qword [rsp + 0x148]
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
cmp qword [rsp + 0x160], r13
jb 0x1800197cf
mov rcx, qword [rsp + 0x148]
call fcn.1800228ac
mov eax, edi
jmp 0x1800197ec
cmp qword [rsp + 0x160], r13
jb 0x1800197ea
mov rcx, qword [rsp + 0x148]
call fcn.1800228ac
xor eax, eax
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.180022fd0
mov rbx, qword [rsp + 0x14e0]
add rsp, 0x1490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret