Function at 0x180014800
Capabilities:
Get disk information
Get disk size
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3e8
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov rax, qword [0x1800824d0]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov r15, r9
mov r14, r8
mov r13, rdx
movsx edi, cl
movzx esi, di
mov dword [rsp + 0xe0], esi
mov r8d, esi
lea rdx, [0x180068160]
lea rcx, [rsp + 0x158]
call fcn.18002132c
nop
xor r12d, r12d
mov dword [rsp + 0xb0], r12d
xor eax, eax
mov dword [rsp + 0xb4], eax
mov dword [rsp + 0x110], r12d
mov dword [rsp + 0x114], eax
lea rcx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rcx, qword [rsp + 0x160]
lea r9, [rsp + 0x110]
lea r8, [rsp + 0xb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea ebp, [r12 + 0xf]
mov rax, qword [rsp + 0xb0]
cmp rax, r12
je 0x180014a22
cmp rax, 0x40000000
jae 0x180014a22
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x68], r12b
lea r8d, [r12 + 0x13]
lea rdx, str.ignoreSmallUsbStore
lea rcx, [rsp + 0x60]
call fcn.1800026f8
nop
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xd0], r12
mov byte [rsp + 0xc0], r12b
lea r8d, [r12 + 0xa]
lea rdx, str.usbRuleCfg
lea rcx, [rsp + 0xb8]
call fcn.1800026f8
nop
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x88]
call fcn.1800051bc
mov rbx, rax
cmp byte [rax + 8], 7
jne 0x180014981
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18002c660
mov rcx, rax
call fcn.18002c980
cmp al, r12b
je 0x180014981
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18002c660
mov rcx, rax
call fcn.18002b69c
jmp 0x180014986
mov eax, 1
cmp eax, 1
sete bl
lea rcx, [rsp + 0x88]
call fcn.18002b33c
nop
cmp qword [rsp + 0xd8], 0x10
jb 0x1800149b2
mov rcx, qword [rsp + 0xc0]
call fcn.180043070
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xd0], r12
mov byte [rsp + 0xc0], r12b
cmp qword [rsp + 0x80], 0x10
jb 0x1800149df
mov rcx, qword [rsp + 0x68]
call fcn.180043070
cmp bl, r12b
je 0x180014a14
mov edx, esi
lea rcx, str.usb_drive__c_too_small__ignore_it
call fcn.18001e148
nop
cmp qword [rsp + 0x178], 8
jb 0x180015554
mov rcx, qword [rsp + 0x160]
call fcn.180043070
jmp 0x180015554
mov edx, esi
lea rcx, str.small_usb_storage_managed_on_config:__c
call fcn.18001dfb0
mov dword [rsp + 0x44], r12d
mov ebx, r12d
lea rdx, [rsp + 0x44]
mov cl, dil
call fcn.18003a110
cmp al, r12b
jne 0x180014a5a
lea rcx, str.GetUsbStorageUnique_failed__retry_later
call fcn.18001e2e0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 5
jl 0x180014a2a
mov r8d, dword [rsp + 0x44]
cmp r8d, r12d
jne 0x180014a92
lea rcx, str.USB_unique_is_0x00000000_
call fcn.18001e148
nop
cmp qword [rsp + 0x178], 8
jb 0x180015554
mov rcx, qword [rsp + 0x160]
call fcn.180043070
jmp 0x180015554
lea rdx, str._08x
lea rcx, [rsp + 0x180]
call fcn.1800213d4
nop
mov word [rsp + 0x1d0], r12w
mov ebx, 0xfe
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x1d2]
call fcn.180045560
mov word [rsp + 0x2d0], r12w
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x2d2]
call fcn.180045560
lea rcx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rcx, qword [rsp + 0x160]
lea r8d, [rbx - 0x7e]
mov dword [rsp + 0x38], r8d
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dl, dil
lea rcx, [rsp + 0x1a8]
call fcn.180014518
nop
lea rax, [0x1800866a0]
mov qword [rsp + 0x50], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rbp, qword [0x180087120]
mov rbx, qword [0x1800870f0]
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0x118]
lea rcx, [0x1800870f0]
call fcn.180007c00
mov rsi, rax
cmp qword [rax], r12
je 0x180014b8b
cmp qword [rax], rbx
je 0x180014b90
call fcn.180043018
cmp qword [rsi + 8], rbp
setne bpl
lea rcx, [0x1800866a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, r12d
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x58], r12d
xor eax, eax
cmp byte [0x18008672c], al
jne 0x180014bc0
mov ebx, eax
jmp 0x180014be4
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x180]
call fcn.180011c24
mov ebx, eax
mov esi, dword [rsp + 0x44]
mov r12d, dword [rsp + 0x58]
xor eax, eax
mov qword [rsp + 0x150], 7
mov qword [rsp + 0x148], rax
mov word [rsp + 0x138], ax
mov r8d, 4
lea rdx, [0x1800690d8]
lea rcx, [rsp + 0x130]
call fcn.18000297c
nop
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x48], 0
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov cl, dil
call fcn.18003ab6c
mov byte [rsp + 0x40], al
cmp ebx, 2
jne 0x180014cf3
lea r8d, [rbx + 2]
lea rdx, [0x1800690e8]
lea rcx, [rsp + 0x130]
call fcn.18000297c
xor r14d, r14d
cmp bpl, r14b
jne 0x180014ce2
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, [0x1800690f8]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, r14d
jne 0x180014cb2
cmp dword [rsp + 0x44], 4
jne 0x180014cb2
mov eax, dword [rsp + 0x50]
jmp 0x180014cb5
mov eax, r14d
cmp eax, r14d
jne 0x180014ce2
mov cl, dil
call fcn.180011dd4
cmp eax, r14d
je 0x180014cd1
mov byte [r13], 1
jmp 0x180014d93
lea rcx, [0x180069118]
call fcn.18001e2e0
jmp 0x180014d93
mov cl, dil
call fcn.180013e88
mov byte [r13], al
jmp 0x180014d93
cmp ebx, 1
jne 0x180014d20
lea r8d, [rbx + 4]
lea rdx, [0x180069128]
lea rcx, [rsp + 0x130]
call fcn.18000297c
mov cl, dil
call fcn.18001404c
mov byte [r14], al
xor r14d, r14d
jmp 0x180014d93
cmp ebx, 3
jne 0x180014d4d
lea r8d, [rbx + 2]
lea rdx, [0x180069138]
lea rcx, [rsp + 0x130]
call fcn.18000297c
mov cl, dil
call fcn.18001424c
mov byte [r15], al
xor r14d, r14d
jmp 0x180014d93
xor r14d, r14d
cmp ebx, r14d
jne 0x180014d93
cmp esi, r14d
je 0x180014d93
cmp r12d, r14d
je 0x180014d79
lea r8d, [r14 + 0xa]
lea rdx, [0x180069148]
lea rcx, [rsp + 0x130]
call fcn.18000297c
jmp 0x180014d93
mov r8d, 0xa
lea rdx, [0x180069160]
lea rcx, [rsp + 0x130]
call fcn.18000297c
mov dword [rsp + 0x20], ebx
mov r9, qword [rsp + 0xb0]
lea r8, [rsp + 0x1d0]
mov dl, dil
lea rcx, [rsp + 0x180]
call fcn.1800113c8
cmp bpl, r14b
je 0x180014dcc
lea rdx, [rsp + 0x180]
mov cl, dil
call fcn.180012f74
and dword [rsp + 0xc0], 0xfffffe00
mov qword [rsp + 0xc8], r14
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0xd8], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov r8d, edi
lea rdx, str._c:_
lea rcx, [rsp + 0x88]
call fcn.1800213d4
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18002b148
mov rdi, rax
lea rdx, str.us_drive
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rdi
call fcn.18002b3d4
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x180014e59
mov rcx, qword [rsp + 0x90]
call fcn.180043070
or rsi, 0xffffffffffffffff
cmp word [rsp + 0x1d0], r14w
je 0x180014f52
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x50], rax
lea ebp, [rsi + 8]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x78], r14
mov word [rsp + 0x68], r14w
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x1d0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x60]
call fcn.18000297c
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x88]
call fcn.180003fdc
nop
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.18002b148
mov rdi, rax
lea rdx, str.us_label
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rdi
call fcn.18002b3d4
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x180014f17
mov rcx, qword [rsp + 0x90]
call fcn.180043070
mov ebx, 0xf
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
cmp qword [rsp + 0x80], 8
jb 0x18001501d
mov rcx, qword [rsp + 0x68]
call fcn.180043070
jmp 0x18001501d
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x50], rax
mov ebp, 7
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x78], r14
mov word [rsp + 0x68], r14w
lea r8d, [rbp - 5]
lea rdx, [0x18006919c]
lea rcx, [rsp + 0x60]
call fcn.18000297c
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x88]
call fcn.180003fdc
nop
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.18002b148
mov rdi, rax
lea rdx, str.us_label
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rdi
call fcn.18002b3d4
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x180014feb
mov rcx, qword [rsp + 0x90]
call fcn.180043070
mov ebx, 0xf
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
cmp qword [rsp + 0x80], 8
jb 0x18001501d
mov rcx, qword [rsp + 0x68]
call fcn.180043070
mov rdx, qword [rsp + 0xb0]
cmp rdx, r14
jbe 0x180015099
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x88]
call fcn.18002021c
nop
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.18002b148
mov rdi, rax
lea rdx, str.us_capacity
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rdi
call fcn.18002b3d4
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x18001515c
mov rcx, qword [rsp + 0x90]
call fcn.180043070
jmp 0x18001515c
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x78], r14
mov word [rsp + 0x68], r14w
mov r8d, 2
lea rdx, [0x1800691b4]
lea rcx, [rsp + 0x60]
call fcn.18000297c
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x88]
call fcn.180003fdc
nop
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.18002b148
mov rdi, rax
lea rdx, str.us_capacity
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rdi
call fcn.18002b3d4
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x18001512f
mov rcx, qword [rsp + 0x90]
call fcn.180043070
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
cmp qword [rsp + 0x80], 8
jb 0x18001515c
mov rcx, qword [rsp + 0x68]
call fcn.180043070
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0xe8]
call fcn.18002b148
mov rdi, rax
lea rdx, str.us_unique
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rdi
call fcn.18002b3d4
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x50], rcx
xor r8d, r8d
lea rdx, str._08x
lea rcx, [rsp + 0x88]
call fcn.1800213d4
nop
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.18002b148
mov rdi, rax
lea rdx, str.us_searial
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rdi
call fcn.18002b3d4
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x180015210
mov rcx, qword [rsp + 0x90]
call fcn.180043070
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x88]
call fcn.180003fdc
nop
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.18002b148
mov rdi, rax
lea rdx, str.us_action
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rdi
call fcn.18002b3d4
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x18001527e
mov rcx, qword [rsp + 0x90]
call fcn.180043070
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x68], 1
btr dword [rsp + 0x68], 8
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov rax, r14
cmp byte [rsp + 0x40], r14b
setne al
mov qword [rsp + 0x60], rax
lea rdx, str.us_encrypted
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.18002b3d4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x50], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [0x180067700]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, r14d
jne 0x180015331
cmp dword [rsp + 0x58], 4
jne 0x180015331
mov ecx, dword [rsp + 0x44]
jmp 0x180015334
mov ecx, r14d
mov byte [rsp + 0x68], 1
btr dword [rsp + 0x68], 8
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov rax, r14
cmp ecx, r14d
setne al
mov qword [rsp + 0x60], rax
lea rdx, str.i_audit
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.18002b3d4
lea rdx, [rsp + 0xe8]
mov qword [rsp + 0x118], rdx
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0xe8]
call fcn.18002b148
mov rdi, rax
lea rdx, str.__serial
lea rcx, [rsp + 0xb8]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rdi
call fcn.18002b3d4
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0xb8]
lea rcx, str.t_usbstorage_log
call fcn.18003c260
lea r8, [rsp + 0x138]
cmp qword [rsp + 0x150], 8
cmovae r8, qword [rsp + 0x138]
mov edx, dword [rsp + 0xe0]
lea rcx, str.usb_drive__c:_process_result:__s
call fcn.18001dfb0
cmp r12d, r14d
je 0x18001549d
mov ecx, 0x28
call fcn.18004316c
mov rdi, rax
mov qword [rsp + 0x118], rax
cmp rax, r14
je 0x180015458
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], r14
mov byte [rax + 8], r14b
mov r9, rsi
xor r8d, r8d
lea rdx, [rsp + 0x180]
mov rcx, rax
call fcn.180002398
jmp 0x18001545b
mov rdi, r14
mov rax, qword [0x1800879e8]
cmp rax, r14
jne 0x180015488
call fcn.18001dc34
mov rcx, rax
lea rdx, str.A0746EA1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800879e8], rax
cmp rax, r14
je 0x18001549d
xor r9d, r9d
mov r8, rdi
mov edx, 0x2710
lea rcx, [0x18001444c]
call rax
nop
lea rcx, [rsp + 0xb8]
call fcn.18002b33c
nop
cmp qword [rsp + 0x150], 8
jb 0x1800154c3
mov rcx, qword [rsp + 0x138]
call fcn.180043070
mov qword [rsp + 0x150], rbp
mov qword [rsp + 0x148], r14
mov word [rsp + 0x138], r14w
cmp qword [rsp + 0x1c8], 0x10
jb 0x1800154f4
mov rcx, qword [rsp + 0x1b0]
call fcn.180043070
mov qword [rsp + 0x1c8], rbx
mov qword [rsp + 0x1c0], r14
mov byte [rsp + 0x1b0], r14b
cmp qword [rsp + 0x1a0], 0x10
jb 0x180015524
mov rcx, qword [rsp + 0x188]
call fcn.180043070
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x198], r14
mov byte [rsp + 0x188], r14b
cmp qword [rsp + 0x178], 8
jb 0x180015554
mov rcx, qword [rsp + 0x160]
call fcn.180043070
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.180042bb0
add rsp, 0x3e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret