Function at 0x140025664
Capabilities:
Get disk information
Get disk size
Persist via windows service
Read .ini file
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x498]
sub rsp, 0x570
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x1400c2688]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov dword [rbp - 0x80], edx
mov r12, rcx
mov qword [rbp - 0x30], rcx
xor esi, esi
mov r13d, esi
mov edx, 0x3ec
call fcn.140032178
mov rdi, rax
call fcn.1400293ac
lea rdx, [rbp - 0x70]
mov rcx, qword [rax + 8]
call fcn.14000ddc8
nop
call fcn.1400279a4
mov rcx, rax
test rax, rax
je 0x14002607f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
mov edx, 0x433
mov rcx, r12
call fcn.140032178
mov rcx, rax
xor edx, edx
call fcn.140032030
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
lea ebx, [rsi + 0x43]
movzx r14d, bx
or r15d, 0xffffffff
movsd xmm8, qword [0x14008ff98]
movzx ecx, r14w
call fcn.140002d60
test eax, eax
je 0x140025ddd
cmp r14w, bx
jne 0x14002576a
call fcn.1400293ac
mov rcx, qword [rax + 8]
cmp dword [rcx + 0x198], esi
jne 0x140025ddd
movabs rax, 0x5c003a0020
mov qword [rbp - 8], rax
mov word [rbp - 8], r14w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x220]
call fcn.140064220
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0x104
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov word [rbp - 4], si
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x50]
call fcn.140003464
nop
mov rax, qword [rsp + 0x50]
cmp dword [rax - 0x10], esi
jne 0x1400257ed
lea rcx, [rbp - 8]
call fcn.1400675ec
lea rdx, [rbp - 8]
jmp 0x14002583a
lea rcx, [0x1400943c0]
call fcn.1400675ec
mov r8d, eax
lea rdx, [0x1400943c0]
lea rcx, [rsp + 0x50]
call fcn.1400054b4
lea rcx, [rbp - 8]
call fcn.1400675ec
mov r8d, eax
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x50]
call fcn.1400054b4
lea rcx, [0x1400943c8]
call fcn.1400675ec
lea rdx, [0x1400943c8]
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400054b4
mov rbx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov r9, rbx
mov r8d, eax
mov edx, 3
mov rcx, rdi
call fcn.1400368bc
mov r15d, eax
mov eax, 0x5c
mov word [rbp - 4], ax
mov dword [rbp - 0x14], esi
mov qword [rbp - 0x10], rsi
lea rdx, [rbp - 0x18]
movzx ecx, r14w
call fcn.1400620e0
mov ebx, 1
cmp dword [rbp - 0x14], ebx
jne 0x1400259b9
mov r13d, ebx
mov edx, 0x433
mov rcx, r12
call fcn.140032178
mov rcx, rax
mov edx, ebx
call fcn.140032030
mov dword [rsp + 0x58], esi
lea rdx, [rsp + 0x58]
movzx ecx, r14w
call fcn.140061f10
test byte [rsp + 0x58], bl
je 0x140025952
call fcn.1400293ac
lea r8d, [rbx + 0x63]
lea rdx, [rbp - 0x58]
mov rcx, qword [rax + 8]
call fcn.14000d8dc
nop
mov r9, qword [rax]
mov r8d, ebx
mov edx, r15d
mov rcx, rdi
call fcn.140036bbc
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140025930
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov eax, 2
mov dword [rsp + 0x28], eax
mov r9d, eax
jmp 0x140025a20
call fcn.1400293ac
mov r8d, 0x64
lea rdx, [rbp - 0x50]
mov rcx, qword [rax + 8]
call fcn.14000d8dc
nop
mov r9, qword [rax]
mov r8d, ebx
mov edx, r15d
mov rcx, rdi
call fcn.140036bbc
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14002599e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 1
jmp 0x140025a1a
call fcn.1400293ac
mov r8d, 0x65
lea rdx, [rbp - 0x48]
mov rcx, qword [rax + 8]
call fcn.14000d8dc
nop
mov r9, qword [rax]
mov r8d, ebx
mov edx, r15d
mov rcx, rdi
call fcn.140036bbc
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140025a05
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov r9d, 2
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov edx, r15d
mov rcx, rdi
call fcn.140036aac
mov dword [rsp + 0x5c], esi
call fcn.140061820
lea rdx, [rsp + 0x5c]
movzx ecx, r14w
call fcn.140061f10
call fcn.140061710
test byte [rsp + 0x5c], 1
je 0x140025a8a
call fcn.1400293ac
mov r8d, 0x64
lea rdx, [rbp - 0x40]
mov rcx, qword [rax + 8]
call fcn.14000d8dc
nop
mov r9, qword [rax]
mov r8d, 2
mov edx, r15d
mov rcx, rdi
call fcn.140036bbc
nop
mov rdx, qword [rbp - 0x40]
jmp 0x140025abc
call fcn.1400293ac
mov r8d, 0x65
lea rdx, [rbp - 0x38]
mov rcx, qword [rax + 8]
call fcn.14000d8dc
nop
mov r9, qword [rax]
mov r8d, 2
mov edx, r15d
mov rcx, rdi
call fcn.140036bbc
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140025ad6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x38], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rax, [rbp]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
lea r8, [rsp + 0x74]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov ecx, dword [rsp + 0x70]
mov eax, dword [rsp + 0x74]
imul rcx, rax
mov ebx, dword [rsp + 0x78]
imul rbx, rcx
cmp dword [rbp - 0x14], 1
jne 0x140025b46
mov rax, qword [rbp - 0x10]
jmp 0x140025b4e
mov eax, dword [rsp + 0x7c]
imul rax, rcx
mov rsi, rbx
cmp rax, rbx
cmovbe rsi, rax
call fcn.1400279a4
test rax, rax
je 0x1400260ab
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov eax, 0x40000000
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
cmp rbx, rax
jbe 0x140025bc5
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
test rbx, rbx
jns 0x140025b9c
addsd xmm2, xmm8
divsd xmm2, xmm7
movq r8, xmm2
lea rdx, str._.2f_GB
lea rcx, [rsp + 0x68]
call fcn.140004f88
mov eax, 0x100000
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
jmp 0x140025c03
mov eax, 0x100000
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
test rbx, rbx
jns 0x140025bdc
addsd xmm2, xmm8
divsd xmm2, xmm6
movq r8, xmm2
lea rdx, str._.2f_MB
lea rcx, [rsp + 0x68]
call fcn.140004f88
mov eax, 0x40000000
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
call fcn.1400279a4
test rax, rax
je 0x1400260a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov eax, 0x40000000
xorps xmm2, xmm2
cvtsi2sd xmm2, rsi
cmp rsi, rax
jbe 0x140025c4c
test rsi, rsi
jns 0x140025c3f
addsd xmm2, xmm8
divsd xmm2, xmm7
lea rdx, str._.2f_GB
jmp 0x140025c61
test rsi, rsi
jns 0x140025c56
addsd xmm2, xmm8
divsd xmm2, xmm6
lea rdx, str._.2f_MB
movq r8, xmm2
lea rcx, [rsp + 0x60]
call fcn.140004f88
call fcn.1400279a4
test rax, rax
je 0x140026095
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
imul rax, rsi, 0x64
xor edx, edx
div rbx
mov r8, rax
lea rdx, [0x140088a80]
lea rcx, [rbp - 0x78]
call fcn.140004f88
lea rcx, [0x1400943cc]
call fcn.1400675ec
mov r8d, eax
lea rdx, [0x1400943cc]
lea rcx, [rbp - 0x78]
call fcn.1400054b4
lea r9, [rbp]
mov r8d, 3
mov edx, r15d
mov rcx, rdi
call fcn.140036bbc
mov r9, qword [rsp + 0x68]
mov r8d, 4
mov edx, r15d
mov rcx, rdi
call fcn.140036bbc
mov r9, qword [rsp + 0x60]
mov r8d, 5
mov edx, r15d
mov rcx, rdi
call fcn.140036bbc
mov rbx, qword [rbp - 0x78]
mov r9, rbx
mov r8d, 6
mov edx, r15d
mov rcx, rdi
call fcn.140036bbc
movzx eax, r14w
mov qword [rsp + 0x40], rax
xor esi, esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
xor r8d, r8d
mov edx, r15d
mov rcx, rdi
call fcn.140036a5c
nop
lea rdx, [rbx - 0x18]
or r15d, 0xffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140025d73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140025d95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140025db7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140025dd8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, 0x43
inc r14w
cmp r14w, 0x5a
jbe 0x14002573e
mov ebx, 2
mov r9d, ebx
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call fcn.140036b8c
cmp dword [rbp - 0x80], esi
je 0x140025f0c
test r13d, r13d
jne 0x140025f0c
call fcn.1400279a4
mov rcx, rax
test rax, rax
je 0x14002608a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
call fcn.140061820
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x20]
lea r8, [0x140085170]
lea rdx, str.volume
lea rcx, str.common
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.140061710
lea rcx, [rbp + 0x20]
call fcn.1400675ec
mov r8d, eax
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x68]
call fcn.14000521c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14, rax
mov rbx, qword [rbp - 0x68]
test eax, eax
jle 0x140025ef0
lea r12d, [r13 + 1]
mov edx, esi
mov rcx, rdi
call fcn.1400364f4
mov ecx, dword [rbx - 0x10]
test ecx, ecx
je 0x140025ed7
jle 0x140025ee4
movzx edx, ax
mov rcx, rbx
call fcn.140064488
test rax, rax
je 0x140025ee4
sub rax, rbx
sar rax, 1
cmp eax, r15d
je 0x140025ee4
mov r8d, r12d
mov edx, esi
mov rcx, rdi
call fcn.14004350c
add esi, r12d
cmp esi, r14d
jl 0x140025ea9
mov r12, qword [rbp - 0x30]
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140025f0c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140061820
mov r9, qword [rbp - 0x70]
xor r8d, r8d
lea rdx, [0x140094380]
lea rcx, str.common
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
call fcn.140061710
call fcn.1400279a4
mov rcx, rax
test rax, rax
je 0x140026074
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x60], rax
mov r8d, esi
lea rdx, [0x140088a80]
lea rcx, [rbp - 0x60]
call fcn.140004f88
mov r14d, 0x460
mov edx, r14d
mov rcx, r12
call fcn.140032178
mov rcx, rax
mov rbx, qword [rbp - 0x60]
mov rdx, rbx
call fcn.140032d38
xor edi, edi
test r13d, r13d
sete dil
mov edx, r14d
mov rcx, r12
call fcn.140032178
mov rcx, rax
mov edx, edi
call fcn.140032030
mov dword [rbp - 0x7c], esi
mov ecx, 4
mov dword [rsp + 0x28], ecx
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x20], rax
mov r9d, ecx
lea r8, str.CacheSize
lea rdx, str.SYSTEMCurrentControlSetServicesdiskpt
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140025ff4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140026015
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140026035
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.14005ef50
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140003bc0
nop
mov ecx, 0x80004005
call fcn.140003bc0
nop
mov ecx, 0x80004005
call fcn.140003bc0
nop
mov ecx, 0x80004005
call fcn.140003bc0
nop
mov ecx, 0x80004005
call fcn.140003bc0
nop
mov ecx, 0x80004005
call fcn.140003bc0
int3