Function at 0x1800209c0
Capabilities:
Get disk information
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x180090f80]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
lea eax, [rdx + 0xa6e]
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x40], eax
mov rsi, r8
mov edi, edx
mov r9, rcx
cmp edx, eax
jae 0x180020e3b
movzx r13d, word [rsp + 0x40]
movzx r15d, byte [rsp + 0x40]
mov r12, qword [rsp + 0x60]
mov r14, qword [rsp + 0x60]
xor ebx, ebx
movabs rcx, 0x74006100720061
mov edx, 0x7261
cmp edi, 0x45d
ja 0x180020bb7
je 0x180020b6b
cmp edi, 0x195
ja 0x180020af7
je 0x180020d8d
mov eax, edi
sub eax, 0x31
je 0x180020ac6
sub eax, 0xb2
je 0x180020a93
cmp eax, 0x1b
jne 0x180020e0f
mov rax, qword [0x180091078]
test rax, rax
je 0x180020e0f
mov rcx, qword [r9]
xor edx, edx
mov r8d, 0x8000
call rax
jmp 0x180020e0f
mov eax, dword [0x1800824c7]
lea rdx, [0x1800824fd]
mov dword [rbp - 0x49], eax
lea rcx, [rbp - 0x44]
movzx eax, byte [0x1800824cb]
mov r8d, 2
mov byte [rbp - 0x45], al
mov byte [rbp - 0x44], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180020e0f
mov word [rbp - 0x50], dx
lea rcx, [rbp - 0x50]
lea rdx, [0x1800824ac]
mov byte [rbp - 0x4e], 0
mov r8d, 3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x2e34
mov byte [rbp - 0x49], 0
mov word [rbp - 0x4b], ax
jmp 0x180020e0f
cmp edi, 0x247
je 0x180020b43
cmp edi, 0x2f9
je 0x180020b37
cmp edi, 0x3ab
jne 0x180020e13
mov qword [rbp - 0x26], rcx
lea rdx, [0x1800823de]
lea rcx, [rbp - 0x1e]
mov word [rbp - 0x1e], bx
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x180020e0f
mov dword [rbp - 0x2a], 0x700065
jmp 0x180020e13
movsd xmm0, qword [0x18008256a]
movzx eax, word [0x180082572]
movsd qword [rbp - 0x38], xmm0
mov word [rbp - 0x30], ax
mov byte [rbp - 0x3f], 0
mov dword [rbp - 0x2e], 0x730020
jmp 0x180020e0f
cmp qword [r9 + 0x18], 8
mov rcx, r9
mov dword [rbp - 0x1c], 0x730072
mov word [rbp - 0x18], bx
jb 0x180020b83
mov rcx, qword [r9]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
mov r15b, 1
jmp 0x180020e0f
cmp edi, 0x725
ja 0x180020d16
je 0x180020cc9
cmp edi, 0x50f
je 0x180020c1d
cmp edi, 0x5c1
je 0x180020bfd
cmp edi, 0x673
jne 0x180020e13
mov edx, dword [rsp + 0x44]
xor r8d, r8d
mov rcx, rsi
call fcn.18005d5c0
mov dword [rsp + 0x4c], ebx
jmp 0x180020e0f
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov r13d, 0x100
mov dword [rsp + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x44], eax
jmp 0x180020e0f
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x180020cbd
mov ebx, 0x128
nop
cmp ebx, 0x128
je 0x180020c7d
cmp ebx, 0x1bd
jne 0x180020ca7
lea r8, [rsp + 0x54]
mov dword [rsp + 0x54], 0
lea rdx, [rbp - 0x68]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x30
lea r8, [rsp + 0x68]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor al, al
jmp 0x180020e40
mov r12, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
xorps xmm1, xmm1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x68], xmm0
mov dword [rbp - 0x58], eax
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm1
movups xmmword [rbp - 0x78], xmm1
add ebx, 0x95
cmp ebx, 0x252
jb 0x180020c30
mov eax, dword [rsp + 0x40]
mov r14, 0xffffffffffffffff
jmp 0x180020e13
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x180020cd6
mov rdx, qword [rsi]
mov r8d, dword [rsp + 0x44]
lea r9, [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x4c]
lea rdx, [rbp - 0x50]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rsp + 0x50], eax
jmp 0x180020e0f
cmp edi, 0x7d7
je 0x180020dd9
cmp edi, 0x889
je 0x180020dc5
cmp edi, 0x93b
jne 0x180020e13
mov ebx, 0x90
nop
cmp ebx, 0x90
je 0x180020d57
cmp ebx, 0x131
jne 0x180020d7f
mov al, 1
jmp 0x180020e40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test r15b, r15b
je 0x180020d6d
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymCleanup]
movsx edx, r13w
lea r8, [rbp - 0x38]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
add ebx, 0xa1
cmp ebx, 0x1d2
jb 0x180020d40
mov r8d, 2
mov byte [rbp - 0x42], 0
lea rdx, [0x180082447]
lea rcx, [rbp - 0x42]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 1
mov byte [rbp - 0x40], 0
lea rdx, [0x180082478]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180020e0f
cmp dword [rsp + 0x50], 0
mov ecx, ebx
movzx eax, r15b
cmovne ecx, eax
movzx r15d, cl
jmp 0x180020e0f
mov eax, dword [rsp + 0x44]
cmp eax, dword [rsp + 0x48]
je 0x180020e0f
mov ecx, 0x52
mov eax, ecx
sub eax, 0x51
je 0x180020e27
cmp eax, 1
jne 0x180020e08
mov qword [rsi + 0x10], rbx
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x180020e05
mov rax, qword [rsi]
mov byte [rax], 0
dec ecx
cmp ecx, 0x50
ja 0x180020de8
mov eax, dword [rsp + 0x40]
add edi, 0xb2
cmp edi, eax
jae 0x180020e3b
mov r9, qword [rsp + 0x60]
jmp 0x180020a25
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor al, al
jmp 0x180020e40
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.180076c30
mov rbx, qword [rsp + 0x348]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret