Function at 0x140006230
Capabilities:
Contain obfuscated stackstrings
Get disk information
Get disk information via ioctl
Read file on windows
Set registry value

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1270]
mov eax, 0x1370
call fcn.140092620
sub rsp, rax
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rbp + 0x1260], rax
xor esi, esi
mov dword [rbp - 0x80], ecx
mov edi, ecx
mov dword [rbp - 0x70], 0x5c3a53
xor edx, edx
mov dword [rsp + 0x70], esi
mov r8d, 0x1000
lea rcx, [rbp + 0x60]
lea r13d, [rsi - 1]
mov r14d, esi
call fcn.140093c00
cmp dword [0x1401429e0], 0xa0
mov r15d, esi
mov dword [rbp - 0x68], 0x5441460b
mov dword [rbp - 0x64], 0x20202020
mov dword [rbp - 0x60], 0x41460120
mov dword [rbp - 0x5c], 0x20323154
mov dword [rbp - 0x58], 0x460e2020
mov dword [rbp - 0x54], 0x36315441
mov dword [rbp - 0x50], 0xc202020
mov dword [rbp - 0x4c], 0x33544146
mov dword [rbp - 0x48], 0x20202032
jae 0x1400062ee
lea rcx, str.ESP_toggling_is_only_available_for_Windows_10_or_later
call fcn.140041aa0
xor eax, eax
jmp 0x140006bb1
mov qword [rsp + 0x13a8], rbx
mov ecx, edi
mov qword [rsp + 0x13b0], r12
call fcn.140003f00
mov r9d, 1
xor edx, edx
mov r8d, r9d
mov rcx, rax
mov rbx, rax
call fcn.140003b60
mov rcx, rbx
mov qword [rbp - 0x78], rax
mov r12, rax
call fcn.14009b5a0
cmp r12, 0xffffffffffffffff
jne 0x140006337
xor eax, eax
jmp 0x140006ba1
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp + 0x60]
mov dword [rsp + 0x28], 0x1000
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70050
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140006b7b
cmp dword [rsp + 0x78], esi
jbe 0x140006b7b
mov r10, qword [rbp + 0x64]
mov edx, esi
test r10d, r10d
jle 0x14000643a
mov r9d, dword [rbp + 0x60]
mov r11, qword [0x1400d8938]
mov rbx, qword [0x1400d8930]
nop
test r9d, r9d
jne 0x1400063f7
movsxd rdi, edx
lea rax, [rdi + rdi*8]
add rax, rax
cmp byte [rbp + rax*8 + 0xb0], 0xef
jne 0x14000642f
mov r13d, edx
test edx, edx
js 0x14000643a
lea r15, [rdi + rdi*8]
shl r15, 4
cmp r9d, 1
jne 0x140006509
lea rdx, [rbp + 0xd8]
add rdx, r15
lea rcx, str.ESP_name:__S
call fcn.140041aa0
lea r12, [rbp + 0xc0]
add r12, r15
jmp 0x140006522
cmp r9d, 1
jne 0x14000642f
movsxd rdi, edx
lea r8, [rbp + 0xb0]
lea rax, [rdi + rdi*8]
shl rax, 4
add r8, rax
je 0x14000642f
mov rcx, qword [r8]
sub rcx, rbx
jne 0x140006423
mov rcx, qword [r8 + 8]
sub rcx, r11
test rcx, rcx
mov eax, esi
sete al
test eax, eax
jne 0x1400063b9
inc edx
cmp edx, r10d
jl 0x1400063a0
mov edi, dword [rsp + 0x70]
lea rbx, [0x140155247]
mov r12d, 1
nop dword [rax + rax]
test r13d, r13d
jns 0x140006639
mov edx, 0x10
movzx eax, r12b
lea r9, str.ToggleEsp_02u
mov dword [rsp + 0x20], eax
lea rcx, [rbp - 0x30]
lea r8, [rdx - 0x11]
call fcn.1400034e0
mov rdx, qword [0x1401128c8]
mov byte [rbp - 0x21], sil
test rdx, rdx
je 0x14000675c
mov r8d, 1
mov byte [0x140142e20], sil
lea rcx, [rbp - 0x30]
call fcn.140020e30
mov r14, rax
test rax, rax
je 0x1400064f8
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r14 + rax], sil
jne 0x1400064b3
inc rax
lea rcx, [0x140142e20]
mov ebx, 0x200
mov rdx, r14
cmp rax, rbx
cmovb rbx, rax
mov r8, rbx
call fcn.140093550
lea rax, [0x140142e20]
mov rcx, r14
mov byte [rbx + rax - 1], sil
call fcn.14009b5a0
lea rbx, [0x140155247]
mov r14d, dword [rsp + 0x70]
lea rcx, [0x140142e20]
jmp 0x140006773
mov eax, dword [rbp + 0x68]
lea r12, [rbp - 0x40]
mov dword [rbp - 0x40], eax
mov rax, qword [rbp + r15 + 0x98]
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x3c], esi
mov bl, 1
nop dword [rax]
nop dword [rax + rax]
mov edx, 0x10
movzx eax, bl
lea r9, str.ToggleEsp_02u
mov dword [rsp + 0x20], eax
lea rcx, [rbp - 0x30]
lea r8, [rdx - 0x11]
call fcn.1400034e0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x21], sil
call fcn.140003850
test rax, rax
je 0x1400065ed
cmp byte [rax], sil
je 0x1400065ed
inc bl
cmp bl, 8
jbe 0x140006530
mov r14b, 1
nop dword [rax]
mov edx, 0x10
movzx ebx, r14b
lea r9, str.ToggleEsp_02u
mov dword [rsp + 0x20], ebx
lea rcx, [rbp - 0x30]
lea r8, [rdx - 0x11]
call fcn.1400034e0
mov edx, 0x10
mov byte [rbp - 0x21], sil
lea eax, [rbx + 1]
lea r9, str.ToggleEsp_02u
mov dword [rsp + 0x20], eax
lea rcx, [rbp - 0x20]
lea r8, [rdx - 0x11]
call fcn.1400034e0
lea rcx, [rbp - 0x20]
mov byte [rbp - 0x11], sil
call fcn.140003850
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140003910
inc r14b
cmp r14b, 8
jb 0x140006580
lea rbx, [rbp - 0x20]
jmp 0x1400065f1
lea rbx, [rbp - 0x30]
mov rcx, r12
call fcn.1400420c0
mov rdx, rax
mov rcx, rbx
call fcn.140003910
test eax, eax
jne 0x14000661d
lea rcx, str.ESP_toggling_data_could_not_be_stored
call fcn.140041aa0
mov r12, qword [rbp - 0x78]
jmp 0x140006b91
mov eax, dword [rbp + 0x60]
cmp eax, 1
jne 0x1400066a0
movups xmm0, xmmword [0x1400d8e10]
movups xmmword [rbp + r15 + 0xb0], xmm0
mov edi, dword [rsp + 0x70]
mov r12, qword [rbp - 0x78]
lea r8, [rbp + 0x60]
mov r9d, dword [rsp + 0x78]
mov edx, 0x7c054
mov qword [rsp + 0x38], rsi
mov rcx, r12
movsxd rax, r13d
lea r14, [rax + rax*8]
lea rax, [rsp + 0x78]
add r14, r14
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov byte [rbp + r14*8 + 0xac], 1
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140006909
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_set_drive_layout:__s
call fcn.140041aa0
jmp 0x140006b91
test eax, eax
jne 0x140006635
mov rbx, qword [rbp - 0x78]
xor r9d, r9d
mov rdx, qword [rbp + r15 + 0x98]
mov rcx, rbx
xor r8d, r8d
mov byte [rbp + r15 + 0xb0], 0xb
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140006635
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x20], rsi
mov r8d, 0x200
lea rdx, [rbp + 0x1060]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006635
cmp dword [rbp - 0x6c], 0x200
jne 0x140006635
lea r8, [rbp + 0x1096]
mov r9d, 2
mov ecx, esi
nop dword [rax]
nop word [rax + rax]
movsxd rax, ecx
lea rdx, [rax + rax*8]
mov rax, qword [r8]
cmp rax, qword [rbp + rdx - 0x67]
je 0x14000673a
inc ecx
cmp ecx, 4
jb 0x140006720
jmp 0x14000674d
movzx eax, byte [rbp + rdx - 0x68]
lea rcx, [rdi + rdi*8]
add rcx, rcx
mov byte [rbp + rcx*8 + 0xb0], al
add r8, 0x1c
sub r9, 1
jne 0x140006711
jmp 0x140006635
lea rdx, [rbp - 0x30]
mov byte [0x140142c20], sil
call fcn.140003620
lea rcx, [0x140142c20]
mov qword [rsp + 0x60], rbx
lea rax, [0x140155246]
mov qword [rsp + 0x58], rax
lea r9, [0x14015523c]
lea rax, [0x140155245]
mov qword [rsp + 0x50], rax
lea r8, [0x140155238]
lea rax, [0x140155244]
mov qword [rsp + 0x48], rax
lea rdx, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
lea rax, [0x140155243]
mov qword [rsp + 0x40], rax
lea rax, [0x140155242]
mov qword [rsp + 0x38], rax
lea rax, [0x140155241]
mov qword [rsp + 0x30], rax
lea rax, [0x140155240]
mov qword [rsp + 0x28], rax
lea rax, [0x14015523e]
mov qword [rsp + 0x20], rax
call fcn.140001e20
cmp eax, 0xb
jne 0x1400068d7
mov edi, esi
cmp dword [rbp + 0x64], esi
jle 0x1400068d7
movups xmm0, xmmword [0x1400d8930]
mov r8, qword [0x140155240]
mov r9, qword [0x140155238]
mov edx, dword [rbp + 0x60]
nop
test r13d, r13d
jns 0x1400068d2
cmp edx, 1
jne 0x140006885
movsxd rax, edi
lea r15, [rbp + 0xc0]
lea rcx, [rax + rax*8]
shl rcx, 4
add r15, rcx
test r15, r15
je 0x1400068c7
mov rcx, r9
sub rcx, qword [r15]
jne 0x140006857
mov rcx, r8
sub rcx, qword [r15 + 8]
test rcx, rcx
mov eax, esi
sete al
test eax, eax
je 0x1400068c7
mov r14d, 1
mov r13d, edi
cmp edx, r14d
jne 0x1400068ae
movsxd rax, edi
lea rcx, [rax + rax*8]
add rcx, rcx
movups xmmword [rbp + rcx*8 + 0xb0], xmm0
jmp 0x1400068c4
test edx, edx
jne 0x140006843
mov eax, dword [rbp + 0x68]
lea r15, [rbp - 0x40]
mov dword [rbp - 0x40], eax
movsxd rax, edi
mov dword [rbp - 0x3c], esi
lea rax, [rax + rax*8]
add rax, rax
mov rax, qword [rbp + rax*8 + 0x98]
mov qword [rbp - 0x38], rax
jmp 0x140006848
test edx, edx
jne 0x1400068c7
movsxd rax, edi
lea rcx, [rax + rax*8]
add rcx, rcx
mov byte [rbp + rcx*8 + 0xb0], 0xef
mov edx, dword [rbp + 0x60]
inc edi
cmp edi, dword [rbp + 0x64]
jl 0x140006820
mov dword [rsp + 0x70], r14d
inc r12d
mov eax, r13d
cmp r12d, 8
jle 0x140006450
mov dword [rsp + 0x70], r14d
test eax, eax
jns 0x140006639
lea rcx, str.No_partition_to_toggle
call fcn.140041aa0
mov r12, qword [rbp - 0x78]
jmp 0x140006b91
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov edx, 0x70140
mov qword [rsp + 0x20], rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000694c
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_refresh_drive_layout:__s
call fcn.140041aa0
cmp dword [rsp + 0x70], esi
je 0x140006aac
mov edx, 0x10
movzx eax, dil
lea r9, str.ToggleEsp_02u
mov dword [rsp + 0x20], eax
lea rcx, [rbp - 0x40]
lea r8, [rdx - 0x11]
call fcn.1400034e0
cmp qword [0x1401128c8], rsi
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x31], sil
je 0x14000699e
lea rdx, [0x1400d756a]
call fcn.140020f90
mov esi, 1
jmp 0x140006b91
mov edx, 0x5c
mov qword [rbp - 0x80], rsi
mov qword [rsp + 0x70], rsi
call fcn.140093068
test rax, rax
je 0x1400069cf
mov r8d, 0x91
lea rdx, str.C:_src_r3dusb_src_registry.h
lea rcx, str.strchr_key_name_____NULL
call fcn.1400a15c4
mov edx, 0x5c
lea rcx, [rbp - 0x40]
call fcn.140093068
test rax, rax
jne 0x140006b74
lea rax, [rbp - 0x80]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140006a11
mov qword [rbp - 0x80], rsi
jmp 0x140006a8e
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREAlex313031R3dusb
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140006a57
mov qword [rsp + 0x70], rsi
jmp 0x140006a7f
mov rcx, qword [rsp + 0x70]
lea rax, [0x1400d756a]
mov dword [rsp + 0x28], esi
lea rdx, [rbp - 0x40]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140006a8e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006b74
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x140006b91
movzx edi, byte [rbp - 0x70]
lea rdx, [rbp - 0x10]
mov ecx, 0x69
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x140006ae1
call fcn.140041e50
mov rdx, rax
lea rcx, str.GetLogicalDriveStrings_failed:__s
call fcn.140041aa0
mov esi, 1
jmp 0x140006b91
cmp eax, 0x69
jbe 0x140006b04
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
mov edx, eax
call fcn.140041aa0
mov esi, 1
jmp 0x140006b91
movzx eax, byte [rbp - 0x10]
lea rbx, [rbp - 0x10]
test al, al
je 0x140006b46
movsx ecx, al
call fcn.1400a1974
cmp dil, al
je 0x140006b74
test rbx, rbx
jne 0x140006b27
mov rax, rsi
jmp 0x140006b39
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rbx + rax], sil
jne 0x140006b30
inc rbx
add rbx, rax
movzx eax, byte [rbx]
test al, al
jne 0x140006b10
mov rdx, qword [rbp + r14*8 + 0x98]
xor r9d, r9d
mov ecx, dword [rbp - 0x80]
lea r8d, [r9 + 1]
call fcn.140003fa0
mov rdx, rax
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.140007ce0
mov rcx, rbx
call fcn.14009b5a0
mov esi, 1
jmp 0x140006b91
call fcn.140041e50
mov r8, rax
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov edx, edi
call fcn.140041aa0
test r12, r12
je 0x140006b9f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rbx, qword [rsp + 0x13a8]
mov r12, qword [rsp + 0x13b0]
mov rcx, qword [rbp + 0x1260]
xor rcx, rsp
call fcn.140092060
mov rsi, qword [rsp + 0x13b8]
add rsp, 0x1370
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret