Function at 0x18000fa44
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800764c0]
xor rax, rsp
mov qword [rsp + 0x108], rax
lea rcx, [0x180060ef8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetTickCount64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebp, ebp
cmp rax, rbp
je 0x18000faa4
call rax
mov r11, rax
jmp 0x18000faad
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
mov rax, r11
sub rax, qword [0x18007aa78]
cmp rax, 0xbb8
jb 0x18000fe83
mov qword [0x18007aa78], r11
lea rcx, str.swvv
call fcn.18001ca18
cmp eax, ebp
je 0x18000fe83
lea rcx, [rsp + 0xa8]
call fcn.1800388dc
nop
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov qword [rsp + 0x100], 0xf
mov qword [rsp + 0xf8], rbp
mov byte [rsp + 0xe8], bpl
mov rbx, qword [rsp + 0xd0]
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmp rsi, rbp
je 0x18000fb4a
cmp rsi, rax
je 0x18000fb4f
call fcn.18003c608
cmp rdi, rbx
je 0x18000fd81
cmp rsi, rbp
jne 0x18000fb67
call fcn.18003c608
mov r11, rbp
jmp 0x18000fb6a
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x18000fb75
call fcn.18003c608
cmp rsi, rbp
jne 0x18000fb84
call fcn.18003c608
mov r11, rbp
jmp 0x18000fb87
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x18000fb92
call fcn.18003c608
cmp qword [rdi + 0x38], 0x10
jb 0x18000fb9f
mov rcx, qword [rdi + 0x20]
jmp 0x18000fba3
lea rcx, [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18000fc46
cmp rsi, rbp
jne 0x18000fbc1
call fcn.18003c608
mov r11, rbp
jmp 0x18000fbc4
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x18000fbcf
call fcn.18003c608
cmp rsi, rbp
jne 0x18000fbde
call fcn.18003c608
mov r11, rbp
jmp 0x18000fbe1
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x18000fbec
call fcn.18003c608
cmp qword [rdi + 0x38], 0x10
jb 0x18000fbf9
mov rdx, qword [rdi + 0x20]
jmp 0x18000fbfd
lea rdx, [rdi + 0x20]
movsx r8d, byte [rdi + 0x10]
lea rcx, [0x180060260]
call fcn.180018ed8
cmp rsi, rbp
jne 0x18000fc1d
call fcn.18003c608
mov r11, rbp
jmp 0x18000fc20
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x18000fc2b
call fcn.18003c608
mov r8b, byte [rdi + 0x10]
mov edx, 1
lea rcx, [rsp + 0xe0]
call fcn.1800134cc
jmp 0x18000fd4c
cmp rsi, rbp
jne 0x18000fc55
call fcn.18003c608
mov r11, rbp
jmp 0x18000fc58
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x18000fc63
call fcn.18003c608
cmp qword [rdi + 0x38], 0x10
jb 0x18000fc70
mov rcx, qword [rdi + 0x20]
jmp 0x18000fc74
lea rcx, [rdi + 0x20]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x18000fd38
cmp rsi, rbp
jne 0x18000fcb7
call fcn.18003c608
mov r11, rbp
jmp 0x18000fcba
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x18000fcc5
call fcn.18003c608
cmp rsi, rbp
jne 0x18000fcd4
call fcn.18003c608
mov r11, rbp
jmp 0x18000fcd7
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x18000fce2
call fcn.18003c608
cmp qword [rdi + 0x38], 0x10
jb 0x18000fcef
mov rdx, qword [rdi + 0x20]
jmp 0x18000fcf3
lea rdx, [rdi + 0x20]
movsx r8d, byte [rdi + 0x10]
lea rcx, [0x180060298]
call fcn.180018ed8
cmp rsi, rbp
jne 0x18000fd13
call fcn.18003c608
mov r11, rbp
jmp 0x18000fd16
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x18000fd21
call fcn.18003c608
mov r8b, byte [rdi + 0x10]
mov edx, 1
lea rcx, [rsp + 0xe0]
call fcn.1800134cc
nop
cmp rbx, 0xffffffffffffffff
je 0x18000fd4c
cmp rbx, rbp
je 0x18000fd4c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rbp
jne 0x18000fd5b
call fcn.18003c608
mov r11, rbp
jmp 0x18000fd5e
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x18000fd69
call fcn.18003c608
mov rdi, qword [rdi]
mov rbx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xa8]
jmp 0x18000fb40
cmp qword [rsp + 0xf8], rbp
je 0x18000fe42
and dword [rsp + 0x80], 0xfffffe00
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x50]
call fcn.180025558
mov rbx, rax
lea rdx, str.letters
lea rcx, [rsp + 0x78]
call fcn.180026aa8
mov rcx, rax
mov rdx, rbx
call fcn.1800257e4
mov r8d, 7
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rbp
mov word [rsp + 0x58], bp
lea rdx, str.unmount
lea rcx, [rsp + 0x50]
call fcn.180002638
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.18000ecbc
nop
cmp qword [rsp + 0x70], 8
jb 0x18000fe37
mov rcx, qword [rsp + 0x58]
call fcn.18003c660
nop
lea rcx, [rsp + 0x78]
call fcn.18002574c
nop
cmp qword [rsp + 0x100], 0x10
jb 0x18000fe5a
mov rcx, qword [rsp + 0xe8]
call fcn.18003c660
mov qword [rsp + 0x100], 0xf
mov qword [rsp + 0xf8], rbp
mov byte [rsp + 0xe8], bpl
lea rcx, [rsp + 0xa8]
call fcn.1800133ac
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.18003c1a0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret