Function at 0x140002030
Capabilities:
Encrypt data using speck
Get disk information
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r12d, edx
mov r14, rcx
xor r15d, r15d
mov rdi, r15
mov qword [rsp + 0x90], r15
mov ebp, r15d
mov esi, r15d
mov dword [rsp + 0x50], r15d
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x70], eax
mov qword [rsp + 0xa8], r15
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rbx, str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionManual_Scan_Configuration
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r13, str.CFolderTreeCtrl::AddAllDrive
test eax, eax
jne 0x140002138
mov rdi, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x84], 4
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.ScanNetwork
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002133
cmp dword [rsp + 0x98], 4
jne 0x140002133
mov ebp, dword [rsp + 0x50]
jmp 0x140002163
mov ebp, r15d
jmp 0x140002163
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
lea r9, str._s___CRegKey::Open_key:__s__failed_with_Windows_error_code:__d_.
mov r8d, 0xb1
lea rdx, str..CFolderTreeCtrl.cpp
lea ecx, [r8 - 0x6c]
call fcn.1400580a0
mov qword [rsp + 0xa0], r15
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rbx, str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionReal_Time_Scan_Configuration
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002214
mov eax, r15d
test rdi, rdi
je 0x1400021ad
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rcx
test eax, eax
jne 0x140002214
mov dword [rsp + 0x80], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.USBScanConfirm
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000220f
cmp dword [rsp + 0x88], 4
jne 0x14000220f
mov esi, dword [rsp + 0x50]
jmp 0x14000223f
mov esi, r15d
jmp 0x14000223f
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
lea r9, str._s___CRegKey::Open_key:__s__failed_with_Windows_error_code:__d_.
mov r8d, 0xbc
lea rdx, str..CFolderTreeCtrl.cpp
lea ecx, [r8 - 0x77]
call fcn.1400580a0
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r13
lea r9, str._s___Trigger_By___d__Usb_Scan_Confirm___d
mov r8d, 0xc4
lea rdx, str..CFolderTreeCtrl.cpp
lea ecx, [r8 - 0x80]
call fcn.1400580a0
cmp byte [r14 + 0x141], 0
je 0x140002663
call fcn.140075174
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140002298
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, [0x1400e86b8]
or r13, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x1400022df
movzx edi, dx
mov ecx, edi
call fcn.140076014
test rax, rax
je 0x1400022fc
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140056a00
jmp 0x1400022fc
xor eax, eax
mov rcx, r13
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x78]
call fcn.140006a00
nop
mov dword [rsp + 0x28], send
mov byte [rsp + 0x20], 0
mov r9, 0xffffffffffff0000
lea r8, [rsp + 0x78]
lea rdx, [r14 + 0x110]
mov rcx, r14
call fcn.140005910
mov qword [0x14013b820], rax
mov rdx, qword [r14 + 0x110]
test rdx, rdx
jne 0x14000233c
mov ecx, r15d
jmp 0x140002356
xor eax, eax
mov rcx, r13
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140002658
cmp ecx, dword [rdx - 0xc]
jg 0x140002658
mov dword [rdx - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [r14 + 0x110]
mov word [rax + rcx*2], 0
mov r15d, 1
movsxd rbp, ebp
movsxd rsi, esi
lea ebx, [r15 + 0x40]
mov eax, dword [rsp + 0x70]
test eax, r15d
je 0x140002605
call fcn.140075174
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140002623
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.140075174
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140002618
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov r8d, ebx
lea rdx, [0x1400e83e8]
lea rcx, [rsp + 0x60]
call fcn.140007750
mov r8d, ebx
lea rdx, str._c:_
lea rcx, [rsp + 0x58]
call fcn.140007750
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x14000249a
test rbp, rbp
jne 0x14000249a
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x28], rdi
lea rax, str.CFolderTreeCtrl::AddAllDrive
mov qword [rsp + 0x20], rax
lea r9, str._s___DRIVE_REMOTE___s__found__and_skip
mov r8d, 0xd6
lea rdx, str..CFolderTreeCtrl.cpp
lea ecx, [rbp + 0x45]
call fcn.1400580a0
add r15d, r15d
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140002470
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140002608
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140002608
mov r9, qword [0x14013b820]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140005640
test eax, eax
je 0x140002535
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x28], rdi
lea rax, str.CFolderTreeCtrl::AddAllDrive
mov qword [rsp + 0x20], rax
lea r9, str._s___skip__s
mov r8d, 0xde
lea rdx, str..CFolderTreeCtrl.cpp
mov ecx, 0x45
call fcn.1400580a0
add r15d, r15d
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000250b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140002608
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140002608
cmp r12d, 2
jne 0x140002582
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, r12d
jne 0x140002582
cmp rsi, 1
jne 0x140002582
mov dword [rsp + 0x28], r13d
mov byte [rsp + 0x20], sil
mov r9, qword [0x14013b820]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140005910
movzx edx, sil
mov rcx, r14
call fcn.140002d80
jmp 0x1400025a5
mov dword [rsp + 0x28], r13d
mov byte [rsp + 0x20], 0
mov r9, qword [0x14013b820]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140005910
mov r9, qword [0x14013b820]
mov edx, 0x1102
mov r8d, 2
mov rcx, qword [r14 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400025e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140002605
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
add r15d, r15d
add ebx, 1
lea eax, [rbx - 0x41]
cmp eax, 0x1a
jge 0x14000262e
jmp 0x140002382
mov ecx, 0x80004005
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
add r13d, 0xffffffff
test r13d, r13d
jg 0x1400029b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1400029b4
mov ecx, 0x80070057
call fcn.140001000
nop
movabs rax, 0x5c003a0020
mov qword [rsp + 0xc8], rax
mov rax, qword [r14 + 0x110]
cmp dword [rax - 8], 1
jle 0x140002691
mov edx, dword [rax - 0x10]
lea rcx, [r14 + 0x110]
call fcn.140006670
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 7
lea r9d, [rsi + 7]
mov r8, qword [r14 + 0x110]
lea edx, [rsi + 0x23]
mov rcx, r14
call fcn.140076198
mov qword [0x14013b820], rax
mov rdx, qword [r14 + 0x110]
or r13, 0xffffffffffffffff
test rdx, rdx
jne 0x1400026e3
mov ecx, esi
jmp 0x1400026fd
xor eax, eax
mov rcx, r13
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x1400029c9
cmp ecx, dword [rdx - 0xc]
jg 0x1400029c9
mov dword [rdx - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [r14 + 0x110]
mov word [rax + rcx*2], si
mov word [rsp + 0xc8], 0x41
mov ebp, esi
mov r15d, 1
nop
nop
mov eax, dword [rsp + 0x70]
mov ecx, ebp
shr eax, cl
test al, 1
je 0x140002986
cmp ebp, 2
jge 0x14000296b
mov word [rsp + 0xb8], 0
xor eax, eax
mov qword [rsp + 0xba], rax
movzx r9d, word [rsp + 0xc8]
add r9d, ebp
lea r8, [0x1400e83e8]
lea edx, [rax + 2]
lea rcx, [rsp + 0xb8]
call fcn.14009c650
call fcn.140075174
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
je 0x1400029a9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0xb8]
lea rax, [rsp + 0xb8]
test rax, 0xffffffffffff0000
jne 0x1400027ec
movzx edi, cx
mov ecx, edi
call fcn.140076014
test rax, rax
je 0x1400028ec
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140056a00
mov rbx, qword [rsp + 0x68]
jmp 0x1400028ec
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0xb8]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140002862
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400028ec
cmp dword [rdx + 0x10], eax
jge 0x140002833
cmp dword [rbx - 0xc], eax
jl 0x140002993
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x1400028ec
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000284b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
jmp 0x1400028ec
mov esi, dword [rbx - 0x10]
lea r12, [rsp + 0xb8]
sub r12, rbx
sar r12, 1
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140002893
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.140006b70
mov rbx, qword [rsp + 0x68]
cmp r12, rsi
ja 0x1400028b3
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + r12*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14009ce60
jmp 0x1400028d0
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb8]
mov rdx, rsi
mov rcx, rbx
call fcn.14009d1a0
test edi, edi
js 0x14000299e
cmp edi, dword [rbx - 0xc]
jg 0x14000299e
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor esi, esi
mov qword [rsp + 0x48], 0xffffffffffff0002
mov rax, qword [0x14013b820]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 4
mov r9d, 4
lea r8, [rsp + 0xb8]
lea edx, [r9 + 0x1f]
mov rcx, r14
call fcn.140076198
mov r9, qword [0x14013b820]
mov edx, 0x1102
mov r8d, 2
mov rcx, qword [r14 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140002986
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140002986
lea eax, [rbp + 0x41]
mov word [rsp + 0xc8], ax
lea rdx, [rsp + 0xc8]
mov rcx, r14
call fcn.1400018e0
add ebp, 1
cmp ebp, 0x1a
jge 0x1400029b4
jmp 0x140002730
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
nop
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x1400029d4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400029d4
mov ecx, 0x80070057
call 0x120c17200
shl rax, 0xf
xor rsi, rbx
xor rdi, rdi
dec rbx
xor rsi, rbx
xor rdi, rdi
dec rbx
add r15, 0x59
mov rsi, qword [rsp + rdi]
subps xmm0, xmm15
inc r15
mov r15, 0x1ee0b493
test rdi, r13
mov r14, 0x1ee97603
test r13, r10
xorps xmm15, xmm9
xor r15, r14
pop rbx
mov rax, rbx
push rax
add rbx, rdi
sub rsi, r15
sub r11, 0xd6
cmp rbx, rax
mov r15, 0x327e5bfb
inc rax
xorps xmm13, xmm2
mov r14, 0x327328eb
xor rax, rdi
xor r15, r14
sub rax, r10
dec r11
add r15, rsi
subps xmm6, xmm11
mov rbx, qword [r15]
sub r13, 0xd3
mov r15, 0x1ba73c7d
push r11
pop rax
mov r10, 0x1bbc270d
addps xmm8, xmm8
xor r15, r10
add r12, rdi
sub rax, 0xb7
add r15, rsi
addps xmm15, xmm10
mov r14, 0x2af358e7
cmp rsi, rax
sub r10, 0x37
mov r12, 0x2af268b2
shl r13, 0x22
shr rdi, 0x10
xor r14, r12
lea r11, [r11 + 0xf3]
and r13, 0x41
mov rdi, 0x77
xor r11, rax
sub r11, r13
mov r12, reloc.WS2_32.dll_WSAStartup
or rsi, 0x47
xor rsi, 0xe9
xor rdi, r12
and r13, 0x27
pop r13
mov r10, r13
push r10
push r15
mov r11, r13
push r14
rol r11, 0x27
sub r12, 0x86