Function at 0x180008d50
Capabilities:
Get disk information
Query environment variable

Disassembly:
push rbx
sub rsp, 0x1a0
cmp edx, 1
jne 0x180008fe8
mov dword [rsp + 0x48], 0x23d
lea rax, [0x180008290]
add rax, 0x23d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000e270
mov dword [rsp + 0x48], 0x17a
lea rax, [0x180008940]
add rax, 0x17a
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.1800124e0
xor ecx, ecx
call fcn.18008b920
mov ecx, eax
call fcn.180088428
mov dword [rsp + 0x48], 0x16e
lea rbx, [0x1800086b0]
lea rax, [rbx + 0x16e]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc0]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180012710
mov dword [rsp + 0x48], 0x21b
lea rdx, [rsp + 0x50]
add rbx, 0x21b
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180012710
mov dword [rsp + 0x48], 0x223
lea rax, [0x1800087a0]
add rax, 0x223
lea r9, [rsp + 0x130]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x40]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180012940
mov dword [rsp + 0x48], 0x243
lea rax, [0x180003c00]
add rax, 0x243
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000e270
cmp dword [0x18010c3d4], 0x1460c9c8
jne 0x1800090ce
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor ebx, ebx
xor r9d, r9d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWaitEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddScopedPolicyIDAce]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
mov eax, 1
add rsp, 0x1a0
pop rbx
ret
cmp edx, 3
jne 0x1800090ce
cmp dword [0x18010c3d4], 0xe720cd8e
jne 0x1800090ce
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassInfoW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckRadioButton]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ClientToScreen]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharUpperBuffW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawEdge]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdePostAdvise]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExcludeUpdateRgn]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadDescription]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
xor ebx, ebx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToAscii]
mov eax, 1
add rsp, 0x1a0
pop rbx
ret