Function at 0x18001d650
Capabilities:
Create process on windows
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1490
call fcn.180080020
sub rsp, rax
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov qword [rsp + 0x14e0], rbx
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov rdi, rdx
mov rsi, rcx
mov ebx, 7
mov qword [rsp + 0x160], rbx
xor r15d, r15d
mov qword [rsp + 0x158], r15
mov word [rsp + 0x148], r15w
lea ebp, [rbx - 6]
mov eax, 0x400
lea r13d, [rbx + 0x44]
lea r14d, [rbx + 1]
cmp rdx, rax
jg 0x18001da32
cmp rdx, rax
je 0x18001d9aa
cmp rdx, 0x20
jg 0x18001d880
cmp rdx, 0x20
je 0x18001d86b
mov rax, rdx
sub rax, rbp
je 0x18001d7e7
sub rax, rbp
je 0x18001e00d
sub rax, 2
je 0x18001e00d
sub rax, 4
je 0x18001e00d
cmp rax, r14
jne 0x18001daa6
mov r8, rbp
lea rdx, [0x18008848c]
lea rcx, [rsp + 0x140]
call fcn.180017e9c
lea rcx, case.0x18003191c.6
mov rax, qword [case.0x18003191c.6]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea r8, [0x180088498]
lea rdx, [0x1800884a8]
lea rcx, [rsp + 0x20]
call fcn.180010c18
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
mov rbx, qword [rsp + 0x20]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
mov r8, rcx
mov rdx, rbx
lea rcx, [rsp + 0x140]
call fcn.180017e9c
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
cmp eax, r15d
jg 0x18001d7b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov r8d, 3
lea rdx, [0x1800884b0]
lea rcx, [rsp + 0x140]
call fcn.180017e9c
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.18001be10
jmp 0x18001e072
mov r8, rbp
lea rdx, [0x1800884b8]
lea rcx, [rsp + 0x140]
call fcn.180017e9c
mov r8d, 3
lea rdx, [0x1800884c0]
lea rcx, [rsp + 0x140]
call fcn.180017e9c
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001d845
call fcn.18005dfbc
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r14
jb 0x18001d855
mov rdx, qword [rax + 8]
jmp 0x18001d859
lea rdx, [rax + 8]
lea rcx, [rsp + 0x140]
call fcn.18001b7d0
jmp 0x18001e072
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.18001c800
jmp 0x18001e072
cmp rdx, 0x40
jl 0x18001daa6
cmp rdx, 0x42
jle 0x18001d8de
cmp rdx, 0x80
je 0x18001d8c9
cmp rdx, 0x100
je 0x18001d8b4
cmp rdx, 0x200
je 0x18001e02e
jmp 0x18001daa6
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.18001c350
jmp 0x18001e072
xor r8d, r8d
lea rdx, [rsp + 0x140]
call fcn.18001c4f0
jmp 0x18001e072
lea r9, [0x1800884c8]
add edi, 0xffffffc0
mov rcx, qword [rcx + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rbx, 0x6666666666666667
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18001d977
mov rcx, qword [rsi + 0x50]
sub rcx, qword [rsi + 0x48]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edi, edx
jge 0x18001d977
movsxd rdi, edi
mov rcx, qword [rsi + 0x50]
sub rcx, qword [rsi + 0x48]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jb 0x18001d95c
call fcn.18005dfbc
lea rax, [rdi + rdi*4]
mov rcx, qword [rsi + 0x48]
cmp qword [rcx + rax*8 + 0x20], r14
jb 0x18001d972
mov r9, qword [rcx + rax*8 + 8]
jmp 0x18001d977
lea r9, [rcx + rax*8 + 8]
mov r8d, 0x104
lea rdx, [rsp + 0x230]
mov rcx, rsi
call fcn.18001aa20
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.18001c190
jmp 0x18001e072
mov edx, 0x54
lea rcx, [rsp + 0x140]
call fcn.18001b5f0
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x180], r15
mov word [rsp + 0x170], r15w
mov r8d, 2
lea rdx, [rsp + 0x168]
mov rcx, rsi
call fcn.18001b8a0
lea rdx, [rsp + 0x170]
cmp qword [rsp + 0x188], r14
cmovae rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x140]
call fcn.18001b7d0
nop
cmp qword [rsp + 0x188], r14
jb 0x18001e072
mov rcx, qword [rsp + 0x170]
call fcn.18005bda0
jmp 0x18001e072
cmp rdx, 0x1000
je 0x18001e00d
mov eax, 0x40000
mov r12d, 0x20000
cmp rdx, 0x10000
je 0x18001dee1
cmp rdx, r12
je 0x18001dee1
cmp rdx, rax
je 0x18001dee1
cmp rdx, 0x80000
je 0x18001de7d
cmp rdx, 0x100000
je 0x18001de1b
cmp rdx, 0x200000
je 0x18001ddb7
cmp rdx, 0x400000
je 0x18001dd06
cmp rdx, 0x800000
je 0x18001dab8
lea r8, [rsp + 0x140]
call fcn.18001c980
jmp 0x18001e072
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
mov r8, rbp
lea rdx, [0x18008830c]
lea rcx, [rsp + 0x50]
call fcn.180003900
nop
lea r8, [rsp + 0x50]
lea rdx, [0x18008839c]
lea rcx, [rsp + 0xa0]
call fcn.180020b9c
nop
or r12, 0xffffffffffffffff
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.1800017b8
nop
cmp qword [rsp + 0xc0], r14
jb 0x18001db29
mov rcx, qword [rsp + 0xa8]
call fcn.18005bda0
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
cmp qword [rsp + 0x70], r14
jb 0x18001db53
mov rcx, qword [rsp + 0x58]
call fcn.18005bda0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rbx, 0x6666666666666667
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001db93
call fcn.18005dfbc
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r14
jb 0x18001dba3
mov rcx, qword [rax + 8]
jmp 0x18001dba7
lea rcx, [rax + 8]
lea rdx, [0x1800883a4]
call fcn.18005be04
cmp rax, r15
je 0x18001dcc4
mov edi, 7
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r15
mov word [rsp + 0x30], r15w
mov r8, rbp
lea rdx, [0x1800883a8]
lea rcx, [rsp + 0x28]
call fcn.180003900
nop
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x140]
call fcn.180017d6c
nop
cmp qword [rsp + 0x48], r14
jb 0x18001dc10
mov rcx, qword [rsp + 0x30]
call fcn.18005bda0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r15
mov word [rsp + 0x30], r15w
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001dc46
call fcn.18005dfbc
mov r9, r12
xor r8d, r8d
mov rdx, qword [rsi + 0x78]
lea rcx, [rsp + 0x140]
call fcn.180017d6c
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
mov r8, rbp
lea rdx, [0x1800883ac]
lea rcx, [rsp + 0x78]
call fcn.180003900
nop
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x140]
call fcn.180017d6c
nop
cmp qword [rsp + 0x98], r14
jb 0x18001e072
mov rcx, qword [rsp + 0x80]
call fcn.18005bda0
jmp 0x18001e072
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001dcea
call fcn.18005dfbc
mov r9, r12
xor r8d, r8d
mov rdx, qword [rsi + 0x78]
lea rcx, [rsp + 0x140]
call fcn.180017d6c
jmp 0x18001e072
mov r13d, Ordinal_79
cmp qword [rcx + 0x28], r14
jb 0x18001dd18
mov rdx, qword [rcx + 0x10]
jmp 0x18001dd1c
lea rdx, [rcx + 0x10]
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001dd57
call fcn.18005dfbc
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r14
jb 0x18001dd67
mov rdx, qword [rax + 8]
jmp 0x18001dd6b
lea rdx, [rax + 8]
lea rcx, [rsp + 0x850]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r9, [rsp + 0x850]
lea r8, str._unmount
lea rdx, str._s___s_
lea rcx, [rsp + 0xc60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xc60]
lea rcx, [rsp + 0x140]
call fcn.18001b7d0
jmp 0x18001e072
mov r13d, Ordinal_79
cmp qword [rcx + 0x28], r14
jb 0x18001ddc9
mov r9, qword [rcx + 0x10]
jmp 0x18001ddcd
lea r9, [rcx + 0x10]
lea r8, str._eject
lea rdx, str.__s___s_
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1b0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x140]
call fcn.180017e9c
jmp 0x18001e072
mov ebx, Ordinal_79
mov edx, ebx
lea rcx, [rsp + 0x140]
call fcn.18001b5f0
mov r13w, bx
cmp qword [rsi + 0x28], r14
jb 0x18001de3f
mov rax, qword [rsi + 0x10]
jmp 0x18001de43
lea rax, [rsi + 0x10]
movzx r9d, word [rax]
lea r8, str._insertimage:
lea rdx, [0x180088428]
lea rcx, [rsp + 0x650]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x140]
call fcn.18001b7d0
jmp 0x18001e072
mov r13d, Ordinal_79
cmp qword [rcx + 0x28], r14
jb 0x18001de8f
mov r9, qword [rcx + 0x10]
jmp 0x18001de93
lea r9, [rcx + 0x10]
lea r8, [0x1800883b0]
lea rdx, [0x1800883c8]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x140]
call fcn.180017e9c
jmp 0x18001e072
mov r13d, Ordinal_79
cmp rdx, rax
jne 0x18001df90
mov r8d, r14d
lea rdx, [rsp + 0x140]
call fcn.18001b8a0
mov rcx, qword [rsi + 0x80]
sub rcx, qword [rsi + 0x78]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001df2d
call fcn.18005dfbc
mov rax, qword [rsi + 0x78]
cmp qword [rax + 0x20], r14
jb 0x18001df3d
mov rdx, qword [rax + 8]
jmp 0x18001df41
lea rdx, [rax + 8]
lea rcx, [rsp + 0x140]
call fcn.18001b7d0
cmp qword [rsi + 0x28], r14
jb 0x18001df5a
mov rax, qword [rsi + 0x10]
jmp 0x18001df5e
lea rax, [rsi + 0x10]
movzx r9d, word [rax]
lea r8, str._drv:_c
mov rdx, r14
lea rcx, [rsp + 0x198]
call fcn.18005e128
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x140]
call fcn.18001b7d0
jmp 0x18001dfa3
mov r8d, 4
lea rdx, [rsp + 0x140]
call fcn.18001b8a0
movabs rax, 0x5c003a0020
mov qword [rsp + 0x190], rax
mov ebx, 0x5a
mov word [rsp + 0x190], bx
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, ebp
je 0x18001dfdd
sub ebx, ebp
cmp ebx, 0x41
jge 0x18001dfba
jmp 0x18001dff2
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x140]
call fcn.18001b7d0
cmp rdi, r12
jne 0x18001e072
lea rdx, str._drv:0
lea rcx, [rsp + 0x140]
call fcn.18001b7d0
jmp 0x18001e072
mov r8, rbp
lea rdx, [0x180088424]
lea rcx, [rsp + 0x140]
call fcn.180017e9c
cmp qword [rsp + 0x158], r15
jne 0x18001e045
mov r8, rbp
lea rdx, [0x180088488]
lea rcx, [rsp + 0x140]
call fcn.180017e9c
mov r8d, 3
lea rdx, [0x180088490]
lea rcx, [rsp + 0x140]
call fcn.180017e9c
mov r8, rdi
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.18001be10
cmp qword [rsp + 0x158], r15
je 0x18001e14b
movzx r8d, r13w
mov edx, 0x104
lea rcx, [rsp + 0x440]
call fcn.18001730c
cmp eax, r15d
je 0x18001e14b
cmp qword [rsi + 0x28], r14
jb 0x18001e0ab
mov rdi, qword [rsi + 0x10]
jmp 0x18001e0af
lea rdi, [rsi + 0x10]
lea rax, [rsi + 0x124]
cmp word [rax], r15w
cmovne rdi, rax
mov dword [rsp + 0xd0], reloc.WS2_32.dll_WSASetLastError
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0xd4]
call fcn.18005c190
mov dword [rsp + 0x100], 5
mov qword [rsp + 0xf8], rdi
lea rax, [rsp + 0x440]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], r14
cmovae rax, qword [rsp + 0x148]
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
cmp qword [rsp + 0x160], r14
jb 0x18001e147
mov rcx, qword [rsp + 0x148]
call fcn.18005bda0
mov eax, edi
jmp 0x18001e164
cmp qword [rsp + 0x160], r14
jb 0x18001e162
mov rcx, qword [rsp + 0x148]
call fcn.18005bda0
xor eax, eax
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.18005c4c0
mov rbx, qword [rsp + 0x14e0]
add rsp, 0x1490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret