Function at 0x4028d1
Capabilities:
Delete directory
Delete file
Delete service
Get common file path
Persist via windows service
Query or enumerate registry value
Set current directory
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x278
lea rcx, [0x00407855]
xor ebx, ebx
lea rbp, [0x0040b280]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, qword [sym.imp.msvcrt.dll__snwprintf]
mov r12, rax
lea rax, str.ImDiskRD
mov r8, qword [0x0040b200]
mov edx, 0x7fff
mov rcx, rbp
mov rdi, qword [rax + rbx*8]
inc rbx
mov r9, rdi
call rsi
mov rcx, rbp
mov word [0x0041b27e], 0
call fcn.004028b1
mov r9, rdi
mov edx, 0x8000
mov rcx, rbp
lea r8, str.net_stop__s__y
call rsi
mov ecx, 1
call fcn.00401182
mov rdx, rdi
mov r8d, 0x10000
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rdi
cmp rbx, 3
jne 0x402914
mov rcx, r12
call rdi
lea rdx, str.taskkill__f__im_ImDiskTk_svc.exe
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcscpy
mov ecx, 1
call fcn.00401182
cmp byte [0x0041bf90], 0
je 0x4029d9
lea rdx, str.SOFTWAREImDisk
mov rcx, 0xffffffff80000002
call fcn.00401428
jmp 0x402a0c
mov edx, 0x192
mov rcx, qword [0x0041bfc0]
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
jne 0x4029c4
lea rcx, [0x0040b280]
lea rdx, str.reg_copy_HKLMSYSTEMCurrentControlSetServicesImDiskParameters_HKLMSOFTWAREImDiskDriverBackup__f
call sub.msvcrt.dll_wcscpy
mov ecx, 1
call fcn.00401182
lea r12, [rsp + 0x38]
xor r8d, r8d
mov r9d, 0x102
mov rbp, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov qword [rsp + 0x20], r12
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallImDisk
mov rcx, 0xffffffff80000002
call rbp
test eax, eax
jne 0x402c73
cmp byte [0x0041bf90], 0
mov rbx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x402a6c
mov rcx, qword [rsp + 0x38]
call rbx
lea rcx, str.imdisk.cpl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x402ace
jmp 0x402ba2
mov edx, 0x191
mov rcx, qword [0x0041bfc0]
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
jne 0x402a4e
lea rax, str.ImDisk_Virtual_Disk_Driver
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
lea rdx, str.DisplayName
mov dword [rsp + 0x28], 0x1b
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x38]
call rbx
lea rcx, [0x00407316]
mov edx, 2
call fcn.004012a9
jmp 0x402c73
lea rdx, str.ImDiskGetDeviceListEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rdi, rax
je 0x402ba2
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x3e808
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, 0xfa02
mov rbx, rax
mov rdx, rax
call rdi
test rax, rax
je 0x402b91
cmp dword [rbx], 0
je 0x402b91
cmp byte [0x0041bf90], 0
jne 0x402b4d
mov r9d, 0x31
mov r8, qword [0x0040b1c8]
mov rdx, qword [0x0040b1f0]
mov rcx, qword [0x0041bfc0]
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
je 0x402ed6
mov rcx, qword [0x0040b1f8]
mov edi, 2
lea r14, str.imdisk__D__u__u
lea r13, [0x0040b280]
call fcn.004028b1
mov r9d, dword [rbx + rdi*4 - 4]
mov r8, r14
mov edx, 0x8000
mov rcx, r13
call rsi
mov ecx, 1
call fcn.00401182
mov eax, edi
inc rdi
cmp eax, dword [rbx]
jbe 0x402b6c
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r15, str.ImDskSvc
xor ebx, ebx
lea rdi, [0x0040b280]
lea r14, str.net_stop__s__y
mov r13, qword [r15 + rbx*8]
mov edx, 0x7fff
mov rcx, rdi
inc rbx
mov r8, qword [0x0040b200]
mov r9, r13
call rsi
mov rcx, rdi
mov word [0x0041b27e], 0
call fcn.004028b1
mov r9, r13
mov r8, r14
mov edx, 0x8000
mov rcx, rdi
call rsi
mov ecx, 1
call fcn.00401182
cmp rbx, 3
jne 0x402bb9
lea rdx, str.taskkill__f__im_imdsksvc.exe
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcscpy
lea rbx, [rsp + 0x40]
mov ecx, 1
call fcn.00401182
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 0x24
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [rsp + 0x20], rbx
cmp byte [0x0041bf90], 1
lea rcx, [0x0040b280]
mov edx, 0x8000
lea r8, str.rundll32_setupapi.dll_InstallHinfSection_DefaultUninstall__u__sinfimdisk.inf
sbb eax, eax
and eax, 4
lea r9d, [rax + 0x80]
call rsi
xor ecx, ecx
call fcn.00401182
mov rcx, qword [0x0040b208]
call fcn.004028b1
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov r9d, 0x101
mov word [rsp + 0x40], 0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallImDiskApp
mov rcx, 0xffffffff80000002
call rbp
test eax, eax
jne 0x402d15
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
lea rbx, [rsp + 0x40]
mov dword [rsp + 0x34], 0x230
lea rdx, str.DisplayIcon
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x5c
mov rcx, rbx
call sub.msvcrt.dll_wcsrchr
lea rdx, str.lang.txt
lea rcx, [rax + 2]
call sub.msvcrt.dll_wcscpy
cmp byte [0x0041bf90], 0
je 0x402d15
mov rcx, rbx
call fcn.00402587
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rbp, qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rbx, [0x0041bcc0]
mov edx, 0x10
mov qword [rsp + 0x20], rbx
call rbp
mov rcx, rbx
mov rdi, qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
call rdi
lea rcx, str.ImDisk_Virtual_Disk_Driver.lnk
mov qword [0x0041bca8], rax
call entry0
mov rcx, qword [0x0040b1a8]
call fcn.00401032
mov rcx, qword [0x0040b1a0]
call fcn.00401032
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 2
mov qword [rsp + 0x20], rbx
call rbp
lea rdx, [0x00407b36]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rcx, rbx
call rdi
lea rcx, str.ImDisk_Virtual_Disk_Driver.lnk
mov qword [0x0041bca8], rax
call entry0
mov rcx, qword [0x0040b1a8]
call fcn.00401032
mov rcx, qword [0x0040b1a0]
call fcn.00401032
mov r9, qword [0x0040b198]
lea r8, str._.94s.url
mov edx, 0x63
mov rcx, qword [0x0041bca8]
call rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x0040b190]
call fcn.00401032
mov rcx, qword [0x0040b188]
call fcn.00401032
mov rax, qword [0x0041bca8]
mov rcx, rbx
mov word [rax], 0
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp word [rsp + 0x40], 0
je 0x402ecd
lea rdi, [rsp + 0x40]
mov rcx, rbx
xor ebp, ebp
lea r12, str.DevioNet.dll
mov rdx, rdi
call sub.msvcrt.dll_wcscpy
mov edx, 0x5c
mov rcx, rbx
call sub.msvcrt.dll_wcsrchr
add rax, 2
mov qword [0x0041bca8], rax
mov rcx, qword [r12 + rbp*8]
inc rbp
call entry0
cmp rbp, 0xa
jne 0x402e50
mov rcx, qword [0x0041bca8]
lea rdx, str.config.exe
call sub.msvcrt.dll_wcscpy
lea rdx, [0x0041bcc0]
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov rax, qword [0x0041bca8]
mov r9, rdi
mov edx, 0x8000
lea r8, str.cmd__c__for__l___I_in__0_0_1__do__del___s_rd___s_if_not_exist___s__exit__
lea rcx, [0x0040b280]
mov word [rax - 2], 0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
call rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallImDiskApp
mov rcx, 0xffffffff80000002
call fcn.00401428
xor ecx, ecx
call fcn.00401182
cmp byte [0x0041bf90], 0
jne 0x402ee5
xor edx, edx
mov rcx, qword [0x0041bfc0]
call qword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
add rsp, 0x278
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret