Function at 0x180013f38
Capabilities:
Create process on windows
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1490
call fcn.18003f390
sub rsp, rax
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov qword [rsp + 0x14e0], rbx
mov rax, qword [0x180059640]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov rdi, rdx
mov rsi, rcx
mov r15d, 7
mov qword [rsp + 0x160], r15
xor r14d, r14d
mov qword [rsp + 0x158], r14
mov word [rsp + 0x148], r14w
mov eax, 0x200
lea r12d, [r15 + 0x44]
lea r13d, [r15 + 1]
cmp rdx, rax
jg 0x1800142c0
cmp rdx, rax
je 0x180014274
cmp rdx, 0x10
jg 0x180014139
cmp rdx, 0x10
je 0x180014071
mov rax, rdx
sub rax, 1
je 0x18001401e
sub rax, 1
je 0x180013ff1
sub rax, 2
je 0x180013ff1
cmp rax, 4
jne 0x180014333
mov r8d, 1
lea rdx, [0x18004709c]
lea rcx, [rsp + 0x140]
call fcn.18000e764
cmp qword [rsp + 0x158], r14
jne 0x18001428e
jmp 0x180014274
mov rcx, qword [rcx + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001404b
call fcn.180028d94
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r13
jb 0x18001405b
mov rdx, qword [rax + 8]
jmp 0x18001405f
lea rdx, [rax + 8]
lea rcx, [rsp + 0x140]
call fcn.180011ad8
jmp 0x180014922
mov r8d, 1
lea rdx, [0x180047104]
lea rcx, [rsp + 0x140]
call fcn.18000e764
lea rcx, [0x180059508]
mov rax, qword [0x180059508]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea r8, [0x180047110]
lea rdx, [0x180047120]
lea rcx, [rsp + 0x20]
call fcn.180008ca4
xor eax, eax
or rbp, 0xffffffffffffffff
mov rcx, rbp
mov rbx, qword [rsp + 0x20]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x140]
call fcn.18000e764
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
cmp eax, r14d
jg 0x180014104
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r8d, 3
lea rdx, [0x180047128]
lea rcx, [rsp + 0x140]
call fcn.18000e764
mov r8d, 0x10
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.180012118
jmp 0x180014922
cmp rdx, 0x20
je 0x18001425f
cmp rdx, 0x3f
jle 0x180014333
cmp rdx, 0x42
jle 0x180014193
cmp rdx, 0x80
je 0x18001417e
cmp rdx, 0x100
jne 0x180014333
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.180012578
jmp 0x180014922
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.180012718
jmp 0x180014922
lea r9, str..zip
add edi, 0xffffffc0
mov rcx, qword [rcx + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rbx, 0x6666666666666667
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18001422c
mov rcx, qword [rsi + 0x50]
sub rcx, qword [rsi + 0x48]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edi, edx
jge 0x18001422c
movsxd rdi, edi
mov rcx, qword [rsi + 0x50]
sub rcx, qword [rsi + 0x48]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jb 0x180014211
call fcn.180028d94
lea rax, [rdi + rdi*4]
mov rcx, qword [rsi + 0x48]
cmp qword [rcx + rax*8 + 0x20], r13
jb 0x180014227
mov r9, qword [rcx + rax*8 + 8]
jmp 0x18001422c
lea r9, [rcx + rax*8 + 8]
mov r8d, 0x104
lea rdx, [rsp + 0x230]
mov rcx, rsi
call fcn.180011388
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.1800123b8
jmp 0x180014922
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.180012a28
jmp 0x180014922
mov r8d, 1
lea rdx, [0x180047100]
lea rcx, [rsp + 0x140]
call fcn.18000e764
mov r8d, 3
lea rdx, [0x180047108]
lea rcx, [rsp + 0x140]
call fcn.18000e764
mov r8, rdi
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.180012118
jmp 0x180014922
cmp rdx, 0x400
je 0x1800148a3
mov ebp, 0x20000
mov eax, 0x40000
cmp rdx, 0x10000
je 0x180014772
cmp rdx, rbp
je 0x180014772
cmp rdx, rax
je 0x180014772
cmp rdx, 0x80000
je 0x18001470e
cmp rdx, 0x100000
je 0x1800146ac
cmp rdx, 0x200000
je 0x180014648
cmp rdx, 0x400000
je 0x180014597
cmp rdx, 0x800000
je 0x180014345
lea r8, [rsp + 0x140]
call fcn.180013338
jmp 0x180014922
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov r8d, 1
lea rdx, [0x180046f0c]
lea rcx, [rsp + 0x50]
call fcn.180001990
nop
lea r8, [rsp + 0x50]
lea rdx, [0x18004701c]
lea rcx, [rsp + 0xa0]
call fcn.180017c8c
nop
or rbp, 0xffffffffffffffff
mov r9, rbp
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.180001e30
nop
cmp qword [rsp + 0xc0], r13
jb 0x1800143b9
mov rcx, qword [rsp + 0xa8]
call fcn.180025e24
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xb8], r14
mov word [rsp + 0xa8], r14w
cmp qword [rsp + 0x70], r13
jb 0x1800143e3
mov rcx, qword [rsp + 0x58]
call fcn.180025e24
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rbx, 0x6666666666666667
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x180014423
call fcn.180028d94
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r13
jb 0x180014433
mov rcx, qword [rax + 8]
jmp 0x180014437
lea rcx, [rax + 8]
lea rdx, [0x180046f4c]
call fcn.180025e88
cmp rax, r14
je 0x180014555
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r14
mov word [rsp + 0x30], r14w
mov r8d, 1
lea rdx, [0x180046fa4]
lea rcx, [rsp + 0x28]
call fcn.180001990
nop
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x140]
call fcn.18000e634
nop
cmp qword [rsp + 0x48], r13
jb 0x18001449e
mov rcx, qword [rsp + 0x30]
call fcn.180025e24
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r14
mov word [rsp + 0x30], r14w
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x1800144d4
call fcn.180028d94
mov r9, rbp
xor r8d, r8d
mov rdx, qword [rsi + 0x78]
lea rcx, [rsp + 0x140]
call fcn.18000e634
mov qword [rsp + 0x98], r15
mov qword [rsp + 0x90], r14
mov word [rsp + 0x80], r14w
mov r8d, 1
lea rdx, [0x180047024]
lea rcx, [rsp + 0x78]
call fcn.180001990
nop
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x140]
call fcn.18000e634
nop
cmp qword [rsp + 0x98], r13
jb 0x180014922
mov rcx, qword [rsp + 0x80]
call fcn.180025e24
jmp 0x180014922
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001457b
call fcn.180028d94
mov r9, rbp
xor r8d, r8d
mov rdx, qword [rsi + 0x78]
lea rcx, [rsp + 0x140]
call fcn.18000e634
jmp 0x180014922
mov r12d, 0x4d
cmp qword [rcx + 0x28], r13
jb 0x1800145a9
mov rdx, qword [rcx + 0x10]
jmp 0x1800145ad
lea rdx, [rcx + 0x10]
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x1800145e8
call fcn.180028d94
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r13
jb 0x1800145f8
mov rdx, qword [rax + 8]
jmp 0x1800145fc
lea rdx, [rax + 8]
lea rcx, [rsp + 0x850]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r9, [rsp + 0x850]
lea r8, str._unmount
lea rdx, str._s___s_
lea rcx, [rsp + 0xc60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xc60]
lea rcx, [rsp + 0x140]
call fcn.180011ad8
jmp 0x180014922
mov r12d, 0x4d
cmp qword [rcx + 0x28], r13
jb 0x18001465a
mov r9, qword [rcx + 0x10]
jmp 0x18001465e
lea r9, [rcx + 0x10]
lea r8, str._eject
lea rdx, str.__s___s_
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1b0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x140]
call fcn.18000e764
jmp 0x180014922
mov ebx, 0x4d
mov edx, ebx
lea rcx, [rsp + 0x140]
call fcn.180011848
mov r12w, bx
cmp qword [rsi + 0x28], r13
jb 0x1800146d0
mov rax, qword [rsi + 0x10]
jmp 0x1800146d4
lea rax, [rsi + 0x10]
movzx r9d, word [rax]
lea r8, str._insertimage:
lea rdx, [0x1800470a0]
lea rcx, [rsp + 0x650]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x140]
call fcn.180011ad8
jmp 0x180014922
mov r12d, 0x4d
cmp qword [rcx + 0x28], r13
jb 0x180014720
mov r9, qword [rcx + 0x10]
jmp 0x180014724
lea r9, [rcx + 0x10]
lea r8, [0x180047028]
lea rdx, [0x180047040]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x140]
call fcn.18000e764
jmp 0x180014922
mov r12d, 0x4d
cmp rdx, rax
jne 0x180014821
mov r8d, r13d
lea rdx, [rsp + 0x140]
call fcn.180011ba8
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x1800147be
call fcn.180028d94
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r13
jb 0x1800147ce
mov rdx, qword [rax + 8]
jmp 0x1800147d2
lea rdx, [rax + 8]
lea rcx, [rsp + 0x140]
call fcn.180011ad8
cmp qword [rsi + 0x28], r13
jb 0x1800147eb
mov rax, qword [rsi + 0x10]
jmp 0x1800147ef
lea rax, [rsi + 0x10]
movzx r9d, word [rax]
lea r8, str._drv:_c
mov rdx, r13
lea rcx, [rsp + 0x198]
call fcn.180028b8c
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x140]
call fcn.180011ad8
jmp 0x180014834
mov r8d, 4
lea rdx, [rsp + 0x140]
call fcn.180011ba8
movabs rax, 0x5c003a0020
mov qword [rsp + 0x190], rax
mov ebx, 0x5a
mov word [rsp + 0x190], bx
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x18001486f
dec ebx
cmp ebx, 0x41
jge 0x18001484b
jmp 0x180014884
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x140]
call fcn.180011ad8
cmp rdi, rbp
jne 0x180014922
lea rdx, str._drv:0
lea rcx, [rsp + 0x140]
call fcn.180011ad8
jmp 0x180014922
mov edx, 0x54
lea rcx, [rsp + 0x140]
call fcn.180011848
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x180], r14
mov word [rsp + 0x170], r14w
mov r8d, 2
lea rdx, [rsp + 0x168]
mov rcx, rsi
call fcn.180011ba8
lea rdx, [rsp + 0x170]
cmp qword [rsp + 0x188], r13
cmovae rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x140]
call fcn.180011ad8
nop
cmp qword [rsp + 0x188], r13
jb 0x180014922
mov rcx, qword [rsp + 0x170]
call fcn.180025e24
cmp qword [rsp + 0x158], r14
je 0x1800149fb
movzx r8d, r12w
mov edx, 0x104
lea rcx, [rsp + 0x440]
call fcn.18000e0e4
cmp eax, r14d
je 0x1800149fb
cmp qword [rsi + 0x28], r13
jb 0x18001495b
mov rdi, qword [rsi + 0x10]
jmp 0x18001495f
lea rdi, [rsi + 0x10]
lea rax, [rsi + 0x124]
cmp word [rax], r14w
cmovne rdi, rax
mov dword [rsp + 0xd0], 0x70
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0xd4]
call fcn.180026210
mov dword [rsp + 0x100], 5
mov qword [rsp + 0xf8], rdi
lea rax, [rsp + 0x440]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], r13
cmovae rax, qword [rsp + 0x148]
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
cmp qword [rsp + 0x160], r13
jb 0x1800149f7
mov rcx, qword [rsp + 0x148]
call fcn.180025e24
mov eax, edi
jmp 0x180014a14
cmp qword [rsp + 0x160], r13
jb 0x180014a12
mov rcx, qword [rsp + 0x148]
call fcn.180025e24
xor eax, eax
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.180026540
mov rbx, qword [rsp + 0x14e0]
add rsp, 0x1490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret