Function at 0x18001dbd1
Capabilities:
Execute anti-debugging instructions
Get disk information
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
rol r9d, 0x1a
xchg r9w, r9w
cmp r10w, 0xe3bf
mov qword [rsp + 0x20], rdi
add eax, r9d
rol r9b, 0x19
push rbp
push r12
bsr r12w, di
cbw
push r13
or bp, 0x218f
movsxd r12, edx
sar al, 0x26
push r14
push r15
rcr bp, 0x92
shrd r12w, r8w, 0xba
movzx r12w, r13b
lea rbp, [rsp - 0x10]
inc eax
btr r9, 0x9c
movzx eax, cx
sub rsp, 0x110
mov rax, qword [0x180015010]
xor rax, rsp
movzx r12w, r11b
ror r12w, 0xad
sub r12b, r13b
mov qword [rbp], rax
and al, 0x1b
rcl r12, cl
dec r9w
mov r12, rcx
movzx ax, bpl
mov qword [rsp + 0x70], rcx
sar r9d, 0x31
rcr rax, cl
sub r13d, r13d
sar r9d, cl
rcr r9b, 0x28
shl ah, 0x28
xorps xmm0, xmm0
cwde
movups xmmword [rbp - 0x80], xmm0
sal ecx, cl
mov qword [rbp - 0x70], r13
add cx, 0x4d1b
test sil, 2
bsf cx, r11w
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
movsx r9, r8w
mov byte [rbp - 0x80], r13b
test ecx, r10d
rcr cx, cl
sal r9b, 0x88
movabs rax, 0x12e74a4aaf16717b
mov qword [rbp - 0x20], rax
bt r9d, 0x3d
and ecx, 0x5633d594
movabs rcx, 0xa96264d7e81c18b4
mov qword [rbp - 0x18], rcx
rol eax, 0xb5
adc ah, 0x8e
movabs rax, 0x12e74a4aaf4a4b38
bts r9d, r9d
mov r9b, 0x19
mov qword [rsp + 0x70], rax
btr r9w, r15w
mov qword [rsp + 0x78], rcx
movsx rcx, r8w
movaps xmm0, xmmword [rsp + 0x70]
test r9b, 0x3a
xorps xmm0, xmmword [rbp - 0x20]
shr r9b, cl
sbb cl, 0x85
movdqa xmmword [rbp - 0x20], xmm0
movsx r9d, r13w
mov dword [rsp + 0x38], r13d
btc ecx, ebp
shl r9d, 5
mov qword [rsp + 0x30], r13
sal cx, cl
btr cx, 0x1b
mov qword [rsp + 0x28], r13
sar r9b, 0x8d
add r9w, r12w
mov qword [rsp + 0x20], r13
bt ecx, ecx
movzx cx, cl
lea r9, [rsp + 0x70]
or cx, 0xeb97
xor r8d, r8d
cmp r11d, edx
sub edx, edx
sets ch
lea rcx, [rbp - 0x20]
jmp 0x18001dd6d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea r9, [rbp - 0xb]
movzx r8d, r9w
mov r8d, dword [rsp + 0x70]
movsx edx, r10w
nop dword [rax]
rdtsc
movsxd rcx, r10d
nop word [rax + rax]
jmp 0x18001dda0
dec r9
sar cl, cl
bsr ax, r15w
mov eax, 0xcccccccd
rcr ch, cl
jmp 0x18001ddb9
mul r8d
cbw
adc rcx, r12
shr edx, 3
movzx eax, dl
cmc
shl al, 2
adc cl, 0x2b
movzx cx, spl
lea ecx, [rax + rdx]
cmp ah, 0x96
add cl, cl
test r9b, r10b
test r10b, 0xf
sub r8b, cl
add r8b, 0x30
cmp r11w, sp
cmc
clc
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jmp 0x18001ddfc
jne 0x18001dda0
lea r8, [rbp - 0xb]
movzx edx, r10w
jmp 0x18001de0f
mov rdx, r9
not cl
lea rcx, [rsp + 0x48]
call fcn.180002590
nop
cmp dl, sil
bts ax, bx
lea r9, [rsp + 0x48]
or r14b, r13b
movzx cx, spl
bts ax, r14w
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
cmp rsi, 0x10
cmovae r9, rdi
sbb ah, ch
btc r15d, 3
test r11b, 0xb1
mov r15, qword [rbp - 0x70]
cwde
movzx r14, r8w
stc
mov rcx, qword [rbp - 0x68]
mov rax, rcx
not r14b
neg r14w
rcl r14d, cl
sub rax, r15
xchg r14d, r14d
mov r14, qword [rsp + 0x58]
cmp r9b, sil
cmc
cmp r14, rax
ja 0x18001decd
lea rax, [r14 + r15]
mov qword [rbp - 0x70], rax
lea rbx, [rbp - 0x80]
cmp rcx, 0x10
mov r8b, r11b
cmovae rbx, qword [rbp - 0x80]
mov dl, r14b
lea rcx, [rbx + r15]
mov r8, r14
setle dl
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rbx]
jmp 0x18001debe
mov byte [rax + r15], 0
jmp 0x18001dec8
jmp 0x18001defe
mov qword [rsp + 0x20], r14
mov rdx, r14
movsx ecx, r9w
movsx rcx, r9w
lea rcx, [rbp - 0x80]
jmp 0x18001dee6
call fcn.180002300
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x48]
clc
test cl, 0xb5
jmp 0x18001defe
cmp rsi, 0x10
jmp 0x18001df07
jb 0x18001df7e
lea rdx, [rsi + 1]
shld eax, r9d, 0x12
cmove ax, r10w
mov rax, rdi
clc
cmp di, r9w
cmc
cmp rdx, 0x1000
jmp 0x18001df30
jb 0x18001df71
add rdx, 0x27
jmp 0x18001df43
mov rdi, qword [rdi - 8]
cmp spl, 0xa6
sub rax, rdi
clc
test rdx, rax
test ebp, 0xbd0d2a81
add rax, 0xfffffffffffffff8
jmp 0x18001df62
cmp rax, 0x1f
jmp 0x18001df6b
ja 0x18001e339
mov rcx, rdi
jmp 0x18001df79
call fcn.18000f46c
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
neg edx
sbb edx, 0xe225d00f
shld rdx, rax, 0xb4
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
rol rdx, cl
cqo
cmp ecx, 0x412ade24
mov byte [rbp - 0x48], 0
xor cx, cx
shrd cx, r10w, 0xc
mov dword [rbp - 0x60], 0x67452301
mov dword [rbp - 0x5c], 0xefcdab89
or ecx, 0x578da121
bts cx, r14w
shl ch, cl
mov dword [rbp - 0x58], 0x98badcfe
movsxd rdx, r14d
sal ch, 0x2d
mov dword [rbp - 0x54], 0x10325476
movzx rdx, bp
mov ch, 0x3c
mov dword [rbp - 0x50], 0xc3d2e1f0
xor r8d, r8d
lea rdx, [0x180011639]
movzx cx, r10b
not cl
lea rcx, [rbp - 0x48]
jmp 0x18001e00d
call fcn.180002050
mov qword [rbp - 0x28], r13
shl al, cl
movsx rcx, di
shr cl, 0x15
mov rsi, qword [rbp - 0x70]
btr cx, 0x97
movsx eax, r9w
bt cx, 0x18
movabs rcx, 0x7fffffffffffffff
rol ah, cl
mov rax, rcx
sub rax, rsi
cmp bx, 0x2402
cmp rax, 0xb
jmp 0x18001e051
jb 0x18001e47c
lea r15, [rbp - 0x80]
rol edi, cl
cmc
btc r14w, di
cmp qword [rbp - 0x68], 0x10
cmovae r15, qword [rbp - 0x80]
movzx rbx, cx
xor dil, 0x2d
shrd r14, r11, 0x98
xorps xmm0, xmm0
movsx ebx, r15w
sar edi, 0x80
btr r14w, cx
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea r14, [rsi + 0xb]
or bl, r10b
shr bl, cl
mov ebx, reloc.WS2_32.dll_ntohs
btc di, cx
stc
ror di, cl
lea rdi, [rbp - 0x20]
cmp r14w, 0x698
jmp 0x18001e0ba
cmp r14, rbx
jmp 0x18001e0c2
jbe 0x18001e1bd
mov rbx, r14
stc
clc
or rbx, 0xf
cmp dl, r8b
test r13w, sp
cmp rbx, rcx
jmp 0x18001e0e0
jbe 0x18001e0ee
mov rbx, rcx
jmp 0x18001e10c
mov eax, socket
sal cx, 0x13
cmp rbx, rax
cmovp cx, cx
cmovb rbx, rax
rol cx, 0xf
xor al, bpl
cmp r15, rax
mov rcx, rbx
shl ax, cl
add rcx, 1
movzx eax, r13w
movsx eax, si
movsxd rax, r13d
mov rax, 0xffffffffffffffff
jmp 0x18001e12c
cmovb rcx, rax
cmp r13, rcx
cmp rcx, 0x1000
jmp 0x18001e13f
jb 0x18001e192
lea rax, [rcx + 0x27]
cmp dil, 0x17
stc
cmp rax, rcx
jmp 0x18001e156
jbe 0x18001e471
mov rcx, rax
jmp 0x18001e164
call fcn.18000f430
test rax, rax
jmp 0x18001e171
je 0x18001e2a6
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
jmp 0x18001e184
mov qword [rdi - 8], rax
jmp 0x18001e18d
jmp 0x18001e1b9
test rcx, rcx
jmp 0x18001e19a
je 0x18001e1b2
call fcn.18000f430
mov rdi, rax
jmp 0x18001e1ad
jmp 0x18001e1b9
mov rdi, r13
not r8b
cdq
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], rbx
xchg cx, dx
movzx ecx, r15w
movsx ecx, r9w
mov r8, rsi
movsx cx, r10b
mov rdx, r15
jmp 0x18001e1e6
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.KF_DU_____]
not dl
movsd qword [rdi + rsi], xmm0
movzx ecx, dx
movzx ax, r14b
movzx eax, word [0x180011798]
bswap cx
mov word [rdi + rsi + 8], ax
mov cx, 0xd19
rdtsc
movzx eax, byte [0x18001179a]
mov byte [rdi + rsi + 0xa], al
movsxd rcx, r9d
mov byte [rdi + r14], 0
lea rdx, [rbp - 0x20]
jmp 0x18001e236
lea rcx, [rbp - 0x60]
jmp 0x18001e23f
call fcn.18000d570
nop
btr dx, r13w
cmovge rdx, rdi
bts rdx, rbp
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x18001e2b7
inc rdx
rol cx, 0x20
cmc
mov rcx, qword [rbp - 0x20]
cdqe
mov rax, rcx
stc
jmp 0x18001e277
cmp rdx, 0x1000
jb 0x18001e2b2
add rdx, 0x27
test rsi, rsi
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
stc
cmp rax, 0x1f
jmp 0x18001e2a0
jbe 0x18001e2b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000f46c
mov rdx, r12
lea rcx, [rbp - 0x60]
jmp 0x18001e2c3
call fcn.18000d7f0
nop
mov rdx, qword [rbp - 0x30]
cmc
cmp dil, 0xb
cmp rdx, 0x10
jmp 0x18001e2db
jb 0x18001e34a
inc rdx
movsx ecx, r12w
mov rcx, qword [rbp - 0x48]
mov rax, rcx
jmp 0x18001e2f7
cmp rdx, 0x1000
jmp 0x18001e303
jb 0x18001e345
add rdx, 0x27
stc
mov rcx, qword [rcx - 8]
test r8b, 0x23
cmp bpl, r13b
sub rax, rcx
add rax, 0xfffffffffffffff8
test bpl, r15b
cmp r12, 0xfffffffffa38142f
cmp rax, 0x1f
jmp 0x18001e333
jbe 0x18001e345
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000f46c
mov qword [rbp - 0x38], r13
sub dl, 0x3b
btc rdx, r8
shr dl, 4
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
xor dx, di
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x68]
cmp r12b, r15b
cmp rdx, 0x10
jmp 0x18001e377
jb 0x18001e3f9
inc rdx
ror ah, cl
inc ax
mov rcx, qword [rbp - 0x80]
cmovae ax, r9w
mov rax, rcx
cmp rdx, 0x1000
jmp 0x18001e39d
jb 0x18001e3f4
add rdx, 0x27
test r8, rax
cmc
cmp r14, r11
mov rcx, qword [rcx - 8]
test r11b, sil
test rsi, 0xffffffff8033b187
cmp dx, 0x858d
sub rax, rcx
test r14, 0xffffffffefa5eaa9
stc
add rax, 0xfffffffffffffff8
jmp 0x18001e3d9
cmp rax, 0x1f
jmp 0x18001e3e2
jbe 0x18001e3f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000f46c
mov rax, r12
sal cx, 0x84
mov rcx, qword [rbp]
cmp r11, 0xffffffffdb9f3b12
jmp 0x18001e413
xor rcx, rsp
jmp 0x18001e41b
call fcn.18000f410
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
movzx r14d, r15w
mov rsi, qword [r11 + 0x40]
cmovg r12w, r15w
movzx r13, r11w
mov rdi, qword [r11 + 0x48]
mov rsp, r11
setle r13b
pop r15
movsxd r12, r14d
pop r14
cmovnp r12d, ebp
movsx r13d, ax
pop r13
movsx bp, bpl
not r12
pop r12
bswap bp
movzx ebp, r10w
pop rbp
jmp 0x18001e470
ret
call fcn.180001430
nop
jmp 0x18000e18d
call fcn.1800014d0
nop
jmp 0x18001e487
jmp 0x18000e193