Function at 0x405e04
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Create process on windows
Get disk information
Get file attributes
Query or enumerate registry value
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d0
lea rsi, section..data
xor eax, eax
mov ecx, 0x17
lea rdi, [rsp + 0x154]
mov dword [rsp + 0x74], 0x44
rep stosd dword [rdi], eax
lea rbp, [rsp + 0x10c]
mov dword [rsp + 0x150], 0x60
mov ecx, 8
mov qword [rsp + 0x80], 0
lea rdi, [rsp + 0x90]
mov dword [rsp + 0xd8], 0x10000000
rep movsd dword [rdi], dword [rsi]
mov dword [rsp + 0xdc], 2
mov dword [rsp + 0xe0], 3
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0xf0], 0
mov dword [rsp + 0xf4], 0
mov dword [rsp + 0xf8], 5
mov qword [rsp + 0x100], rbp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x7c]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x7c], 2
mov rbx, rax
mov r12, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jle 0x405f25
mov rcx, qword [rax + 8]
lea rdx, str.NOTIF
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x405f25
lea rcx, str.imdisk.cpl
call r12
test rax, rax
je 0x4063f0
lea rdx, str.ImDiskNotifyShellDriveLetter
mov rcx, rax
call rdi
mov rdx, qword [rbx + 0x10]
xor ecx, ecx
call rax
jmp 0x4063f0
lea rcx, [0x0040c780]
mov dword [0x0040c780], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdx, str.RamDisk
lea rcx, [0x0040c6c0]
call sub.msvcrt.dll_wcscpy
lea rsi, [0x0040c758]
lea rdx, str.Temp_r_nSystem_Volume_Information
lea rcx, [0x0040bc80]
call sub.msvcrt.dll_wcscpy
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0
lea rdx, str.SOFTWAREImDisk
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x405fd0
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREImDisk
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rdx, [0x00407054]
lea rcx, str.DriveSize
call fcn.00401000
lea rdx, [0x00407050]
lea rcx, str.Unit
call fcn.00401000
lea rdx, [0x0040c720]
lea rcx, str.Dynamic
call fcn.00401000
lea rdx, [0x0040704c]
lea rcx, str.WantedDrive
call fcn.00401000
lea rdx, [0x0040c724]
lea rcx, str.FileSystem
call fcn.00401000
lea rdx, [0x00407048]
lea rcx, str.WinBoot
call fcn.00401000
test eax, eax
jne 0x406052
mov eax, dword [0x00407048]
mov dword [0x0040c70c], eax
lea rdx, [0x00407044]
lea rcx, str.TempFolder
call fcn.00401000
lea rdx, [0x0040c71c]
lea rcx, str.Cluster
call fcn.00401000
lea rsi, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
lea rax, [0x0040c6c0]
mov r13, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x78], 0x42
lea rdx, str.Label
mov rcx, qword [0x0040c758]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
lea r14, [0x0040c280]
call r13
lea rdx, [0x0040c718]
lea rcx, str.QuickFormat
call fcn.00401000
lea rdx, [0x0040c714]
lea rcx, str.Awealloc
call fcn.00401000
lea rdx, [0x0040c704]
lea rcx, str.DynMethod
call fcn.00401000
lea rdx, [0x0040703c]
lea rcx, str.CleanRatio
call fcn.00401000
lea rdx, [0x00407038]
lea rcx, str.CleanTimer
call fcn.00401000
lea rdx, [0x00407034]
lea rcx, str.MaxActivity
call fcn.00401000
lea rdx, [0x00407030]
lea rcx, str.BlockSize
call fcn.00401000
lea rdx, [0x0040c710]
lea rcx, str.RDUseMP
call fcn.00401000
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rsi
lea rax, [0x0040c4a0]
mov rcx, qword [0x0040c758]
mov dword [rsp + 0x78], 0x208
lea rdx, str.RDMountPoint
mov qword [rsp + 0x20], rax
call r13
lea rax, [0x0040c080]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AddParam
mov rcx, qword [0x0040c758]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x78], 0x1fe
mov qword [rsp + 0x20], rax
call r13
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x0040c758]
lea rdx, str.ImageFile
mov dword [rsp + 0x78], 0x20a
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
call r13
lea rdx, [0x00407040]
lea rcx, str.SyncFlags
call fcn.00401000
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rsi
lea rax, [0x0040bc80]
mov rcx, qword [0x0040c758]
mov dword [rsp + 0x78], 0x3e8
lea rdx, str.SyncExcluded
mov qword [rsp + 0x20], rax
call r13
lea rdx, [0x0040c70c]
lea rcx, str.RDMountCurrent
call fcn.00401000
mov eax, dword [0x0040c714]
mov rcx, r14
mov dword [0x0040bc64], eax
mov eax, dword [0x0040c710]
mov dword [0x0040bc60], eax
movzx eax, word [0x0040c280]
mov dword [0x0040bc5c], eax
mov eax, dword [0x00407040]
mov dword [0x0040bc58], eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
je 0x40627b
mov edx, eax
shr edx, 4
and edx, 1
shr eax, 4
mov r8, rbp
mov dword [0x0040bc50], edx
mov ecx, 1
lea rbp, [rsp + 0xb0]
xor eax, 1
xor edx, edx
lea r9, [rsp + 0x74]
and eax, 1
mov dword [0x0040bc54], eax
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
xor r8d, r8d
mov ecx, 1
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov rcx, rbp
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
mov rcx, rbp
mov edx, 1
mov r8, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov qword [0x0040c738], rbp
lea rcx, str.imdisk.cpl
mov dword [0x0040c730], 0x18
mov dword [0x0040c740], 0
call r12
test rax, rax
mov rbp, rax
jne 0x40636c
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov qword [rsp + 0x40], rsi
xor ecx, ecx
mov r9d, 0xe
lea rsi, str.Warning:_cannot_find_imdisk.cpl.
mov dword [rsp + 0x48], 0
mov edx, eax
mov dword [rsp + 0x38], 0
lea r8, [0x0040818e]
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x28], 0x42
mov qword [rsp + 0x20], rsi
call sub.WTSAPI32.dll_WTSSendMessageW
lea rdx, str.ImDiskOpenDeviceByMountPoint
mov rcx, rbp
call rdi
lea rdx, str.ImDiskNotifyShellDriveLetter
mov rcx, rbp
mov qword [0x0040c750], rax
call rdi
mov r8d, 0x104
xor ecx, ecx
lea rdx, [0x0040b940]
mov qword [0x0040c748], rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x0040b940]
lea rcx, [0x0040b720]
call sub.msvcrt.dll_wcscpy
lea rcx, [0x0040b940]
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
cmp dword [rsp + 0x7c], 1
jle 0x4063f8
mov rcx, qword [rbx + 8]
lea rdx, [0x00408a7a]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x4063f8
lea rcx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x0040c784], 5
jbe 0x40646a
cmp dword [rsp + 0x7c], 1
jg 0x406456
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea r8, str.UAC__d
mov edx, 0xff
lea rcx, [0x0040c080]
mov r9d, eax
call qword [sym.imp.msvcrt.dll__snwprintf]
mov dword [rsp + 0x28], 0xa
lea r9, [0x0040c080]
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea rdx, str.runas
mov r8, qword [rbx]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4063f0
mov rcx, qword [rbx + 8]
lea rdx, [0x00408a9c]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x406408
xor eax, eax
cmp dword [0x0040c784], 5
jbe 0x40647f
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [0x0040bb68], eax
lea rsi, [rsp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
mov r8d, 1
mov rbx, qword [sym.imp.USER32.dll_LoadImageW]
mov edx, 1
mov rcx, rax
mov qword [0x0040c778], rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
call rbx
xor r9d, r9d
mov r8d, 1
xor ecx, ecx
mov edx, 0x7f03
mov qword [0x0040c770], rax
mov dword [rsp + 0x28], 0x8040
mov dword [rsp + 0x20], 0
call rbx
lea rdx, str._SVC
lea rcx, [0x0040b940]
mov qword [0x0040c768], rax
call fcn.00551000
lea rcx, [0x0040b720]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [0x0040b720]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [0x0040b720]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, str.ImDiskTk_svc.exe
lea rcx, [0x0040b720]
call sub.msvcrt.dll_wcscat
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 3
mov dword [rsp + 0x20], 3
lea rcx, str.lang.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x40666a
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rdx, qword [rsp + 0x1b0]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdx, 0x20000
jle 0x4065b2
mov rcx, rbx
call rbp
jmp 0x40666a
add rdx, 2
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rsp + 0x88]
mov r8d, dword [rsp + 0x1b0]
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov rdi, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call rbp
lea rdx, str._RamDiskUI_
mov rcx, rdi
call sub.msvcrt.dll_wcsstr
test rax, rax
je 0x40666a
lea rdx, [0x00408afa]
mov rcx, rax
xor ebx, ebx
call 0x4069a0
lea r12, [0x00408afa]
lea rbp, [section..bss]
xor ecx, ecx
mov rdx, r12
call 0x4069a0
mov qword [rbp + rbx*8], rax
inc rbx
cmp rbx, 0x76
jne 0x40662a
mov edx, dword [rsp + 0x1b0]
xor eax, eax
shr edx, 1
mov dword [rsp + 0x1b0], edx
cmp edx, eax
jbe 0x40666a
cmp word [rdi + rax*2], 0x23
jne 0x406665
mov word [rdi + rax*2], 0xa
inc rax
jmp 0x406654
xor edx, edx
xor ecx, ecx
mov r8d, 3
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea rdx, [0x00408b00]
mov r8d, 0x10012
mov rcx, rax
mov qword [0x0040c8a0], rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea rcx, [0x0040861a]
test rax, rax
mov qword [0x0040c898], rax
lea rdx, [0x0040b940]
je 0x406705
mov qword [rsp + 0x38], rcx
or r8d, 0xffffffff
mov rcx, rax
mov r9d, 1
mov qword [rsp + 0x20], rdx
mov edx, 0x10
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x4067bb
mov qword [rsp + 0x50], rcx
mov r9d, 0x10012
mov rcx, qword [0x0040c8a0]
mov qword [rsp + 0x38], rdx
lea r8, str.ImDisk_RamDisk_starter
mov qword [rsp + 0x60], 0
lea rdx, [0x00408b00]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
mov qword [0x0040c898], rax
je 0x40679f
lea rdi, str.Mounts_a_RamDisk_at_system_startup.
mov edx, 1
mov rcx, rax
mov qword [rsp + 0x88], rdi
lea r8, [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
jmp 0x4067bb
mov r9d, 0x10
mov rdx, qword [0x0040b2a0]
xor ecx, ecx
lea r8, [0x0040818e]
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, 0x48
mov rdi, rsi
rep stosd dword [rdi], eax
mov rcx, qword [0x0040b018]
lea rdi, [0x00408b88]
movabs rdx, 0x40800000060
mov rax, qword [0x0040c778]
mov qword [rsp + 0x1c0], rdi
lea rdi, [0x00404ec3]
mov qword [rsp + 0x1b0], rdx
mov qword [rsp + 0x1d8], rdi
test rcx, rcx
mov qword [rsp + 0x1b8], rax
jne 0x406819
lea rcx, str.Basic
mov qword [rsp + 0x210], rdx
mov rdx, qword [0x0040b0b0]
lea rdi, [0x00408b92]
lea rbx, [0x00404163]
mov qword [rsp + 0x1d0], rcx
mov qword [rsp + 0x218], rax
mov qword [rsp + 0x220], rdi
test rdx, rdx
mov qword [rsp + 0x238], rbx
jne 0x406862
lea rdx, str.Advanced
mov qword [rsp + 0x230], rdx
mov rdx, qword [0x0040b190]
movabs rdi, 0x40800000060
mov qword [rsp + 0x270], rdi
lea rbx, str.TAB3
lea rdi, [0x00403a64]
mov qword [rsp + 0x278], rax
mov qword [rsp + 0x280], rbx
test rdx, rdx
mov qword [rsp + 0x298], rdi
jne 0x4068b5
lea rdx, str.Data
mov r9d, 2
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x290], rdx
mov rdx, qword [0x0040c770]
lea rbx, [0x0040818e]
mov qword [rsp + 0x170], rbx
mov dword [rsp + 0x154], 0x200008a
mov dword [rsp + 0x178], 3
mov qword [rsp + 0x168], rdx
lea rdx, str.tooltips_class32
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r9d, 0x3e8
xor r8d, r8d
mov edx, 0x418
mov rcx, rax
mov rbx, qword [sym.imp.USER32.dll_SendMessageW]
mov qword [0x0040b5a8], rax
call rbx
mov r9d, 0x4e20
mov r8d, 2
mov edx, 0x403
mov rcx, qword [0x0040b5a8]
call rbx
lea rcx, [rsp + 0x150]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
call fcn.00403801
nop
jmp qword [sym.imp.msvcrt.dll_wcstok]