Function at 0x180009510
Capabilities:
Create directory
Get disk information
Terminate process

Disassembly:
push rbx
sub rsp, 0x1a0
cmp edx, 1
jne 0x18000978e
mov dword [rsp + 0x48], 0x23f
lea rax, [0x180008a10]
add rax, 0x23f
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000e8b0
mov dword [rsp + 0x48], 0x287
lea rax, [0x180009100]
add rax, 0x287
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180010f00
xor ecx, ecx
call fcn.18007b330
mov ecx, eax
call fcn.180077e38
mov dword [rsp + 0x48], 0x17c
lea rbx, [0x180008e70]
lea rax, [rbx + 0x17c]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc0]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180011080
mov dword [rsp + 0x48], 0x1e7
lea rdx, [rsp + 0x50]
add rbx, 0x1e7
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180011080
mov dword [rsp + 0x48], 0x238
lea rax, [0x180008f60]
add rax, 0x238
lea r9, [rsp + 0x130]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x40]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180011200
mov dword [rsp + 0x48], 0x1e0
lea rax, [0x180003b80]
add rax, 0x1e0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000e8b0
cmp dword [0x1800fc3e8], 0xc335eb41
jne 0x180009780
xor ebx, ebx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileById]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
xor r9d, r9d
mov word [rsp + 0x20], bx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryMemoryResourceNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
lock add dword [rbx], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
mov eax, 1
add rsp, 0x1a0
pop rbx
ret
cmp edx, 2
je 0x180009780
cmp edx, 3
jne 0x1800098db
cmp dword [0x1800fc3e8], 0x823facae
jne 0x180009780
xor ecx, ecx
call qword [sym.imp.USER32.dll_LockWindowUpdate]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowRgnBox]
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DlgDirListComboBoxW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
lock inc dword [rbx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CloseWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClassWord]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PaintDesktop]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, 1
add rsp, 0x1a0
pop rbx
ret
test edx, edx
jne 0x180009780
mov ecx, 0xffffecd8
nop dword [rax + rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x1800098f0
mov eax, 0xfffff7ad
nop dword [rax]
inc eax
test al, 1
jne 0x180009910
cmp ecx, 0xffffecda
jne 0x180009929
cmp eax, 0xfffff7ae
je 0x180009780
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]