Function at 0x405e04
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Create process on windows
Create service
Get disk information
Get file attributes
Get file size
Modify service
Persist via windows service
Query or enumerate registry value
Read file on windows
Set current directory
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d0
lea rsi, section..data
xor eax, eax
mov ecx, 0x17
lea rdi, [rsp + 0x154]
mov dword [rsp + 0x74], 0x44
rep stosd dword [rdi], eax
lea rbp, [rsp + 0x10c]
mov dword [rsp + 0x150], 0x60
mov ecx, 8
mov qword [rsp + 0x80], 0
lea rdi, [rsp + 0x90]
mov dword [rsp + 0xd8], 0x10000000
rep movsd dword [rdi], dword [rsi]
mov dword [rsp + 0xdc], 2
mov dword [rsp + 0xe0], 3
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0xf0], 0
mov dword [rsp + 0xf4], 0
mov dword [rsp + 0xf8], 5
mov qword [rsp + 0x100], rbp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x7c]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x7c], 2
mov rbx, rax
mov r12, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jle 0x405f25
mov rcx, qword [rax + 8]
lea rdx, str.NOTIF
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x405f25
lea rcx, str.imdisk.cpl
call r12
test rax, rax
je 0x4063f0
lea rdx, str.ImDiskNotifyShellDriveLetter
mov rcx, rax
call rdi
mov rdx, qword [rbx + 0x10]
xor ecx, ecx
call rax
jmp 0x4063f0
lea rcx, [0x0040c780]
mov dword [0x0040c780], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdx, str.RamDisk
lea rcx, [0x0040c6c0]
call sub.msvcrt.dll_wcscpy
lea rsi, [0x0040c758]
lea rdx, str.Temp_r_nSystem_Volume_Information
lea rcx, [0x0040bc80]
call sub.msvcrt.dll_wcscpy
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0
lea rdx, str.SOFTWAREImDisk
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x405fd0
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREImDisk
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rdx, [0x00407054]
lea rcx, str.DriveSize
call fcn.00401000
lea rdx, [0x00407050]
lea rcx, str.Unit
call fcn.00401000
lea rdx, [0x0040c720]
lea rcx, str.Dynamic
call fcn.00401000
lea rdx, [0x0040704c]
lea rcx, str.WantedDrive
call fcn.00401000
lea rdx, [0x0040c724]
lea rcx, str.FileSystem
call fcn.00401000
lea rdx, [0x00407048]
lea rcx, str.WinBoot
call fcn.00401000
test eax, eax
jne 0x406052
mov eax, dword [0x00407048]
mov dword [0x0040c70c], eax
lea rdx, [0x00407044]
lea rcx, str.TempFolder
call fcn.00401000
lea rdx, [0x0040c71c]
lea rcx, str.Cluster
call fcn.00401000
lea rsi, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
lea rax, [0x0040c6c0]
mov r13, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x78], 0x42
lea rdx, str.Label
mov rcx, qword [0x0040c758]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
lea r14, [0x0040c280]
call r13
lea rdx, [0x0040c718]
lea rcx, str.QuickFormat
call fcn.00401000
lea rdx, [0x0040c714]
lea rcx, str.Awealloc
call fcn.00401000
lea rdx, [0x0040c704]
lea rcx, str.DynMethod
call fcn.00401000
lea rdx, [0x0040703c]
lea rcx, str.CleanRatio
call fcn.00401000
lea rdx, [0x00407038]
lea rcx, str.CleanTimer
call fcn.00401000
lea rdx, [0x00407034]
lea rcx, str.MaxActivity
call fcn.00401000
lea rdx, [0x00407030]
lea rcx, str.BlockSize
call fcn.00401000
lea rdx, [0x0040c710]
lea rcx, str.RDUseMP
call fcn.00401000
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rsi
lea rax, [0x0040c4a0]
mov rcx, qword [0x0040c758]
mov dword [rsp + 0x78], 0x208
lea rdx, str.RDMountPoint
mov qword [rsp + 0x20], rax
call r13
lea rax, [0x0040c080]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AddParam
mov rcx, qword [0x0040c758]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x78], 0x1fe
mov qword [rsp + 0x20], rax
call r13
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x0040c758]
lea rdx, str.ImageFile
mov dword [rsp + 0x78], 0x20a
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
call r13
lea rdx, [0x00407040]
lea rcx, str.SyncFlags
call fcn.00401000
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rsi
lea rax, [0x0040bc80]
mov rcx, qword [0x0040c758]
mov dword [rsp + 0x78], 0x3e8
lea rdx, str.SyncExcluded
mov qword [rsp + 0x20], rax
call r13
lea rdx, [0x0040c70c]
lea rcx, str.RDMountCurrent
call fcn.00401000
mov eax, dword [0x0040c714]
mov rcx, r14
mov dword [0x0040bc64], eax
mov eax, dword [0x0040c710]
mov dword [0x0040bc60], eax
movzx eax, word [0x0040c280]
mov dword [0x0040bc5c], eax
mov eax, dword [0x00407040]
mov dword [0x0040bc58], eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
je 0x40627b
mov edx, eax
shr edx, 4
and edx, 1
shr eax, 4
mov r8, rbp
mov dword [0x0040bc50], edx
mov ecx, 1
lea rbp, [rsp + 0xb0]
xor eax, 1
xor edx, edx
lea r9, [rsp + 0x74]
and eax, 1
mov dword [0x0040bc54], eax
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
xor r8d, r8d
mov ecx, 1
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov rcx, rbp
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
mov rcx, rbp
mov edx, 1
mov r8, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov qword [0x0040c738], rbp
lea rcx, str.imdisk.cpl
mov dword [0x0040c730], 0x18
mov dword [0x0040c740], 0
call r12
test rax, rax
mov rbp, rax
jne 0x40636c
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov qword [rsp + 0x40], rsi
xor ecx, ecx
mov r9d, 0xe
lea rsi, str.Warning:_cannot_find_imdisk.cpl.
mov dword [rsp + 0x48], 0
mov edx, eax
mov dword [rsp + 0x38], 0
lea r8, [0x0040818e]
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x28], 0x42
mov qword [rsp + 0x20], rsi
call sub.WTSAPI32.dll_WTSSendMessageW
lea rdx, str.ImDiskOpenDeviceByMountPoint
mov rcx, rbp
call rdi
lea rdx, str.ImDiskNotifyShellDriveLetter
mov rcx, rbp
mov qword [0x0040c750], rax
call rdi
mov r8d, 0x104
xor ecx, ecx
lea rdx, [0x0040b940]
mov qword [0x0040c748], rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x0040b940]
lea rcx, [0x0040b720]
call sub.msvcrt.dll_wcscpy
lea rcx, [0x0040b940]
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
cmp dword [rsp + 0x7c], 1
jle 0x4063f8
mov rcx, qword [rbx + 8]
lea rdx, [0x00408a7a]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x4063f8
lea rcx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x0040c784], 5
jbe 0x40646a
cmp dword [rsp + 0x7c], 1
jg 0x406456
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea r8, str.UAC__d
mov edx, 0xff
lea rcx, [0x0040c080]
mov r9d, eax
call qword [sym.imp.msvcrt.dll__snwprintf]
mov dword [rsp + 0x28], 0xa
lea r9, [0x0040c080]
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea rdx, str.runas
mov r8, qword [rbx]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4063f0
mov rcx, qword [rbx + 8]
lea rdx, [0x00408a9c]
call fcn.0057a000
test eax, eax
jne 0x406408
xor eax, eax
cmp dword [0x0040c784], 5
jbe 0x40647f
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [0x0040bb68], eax
lea rsi, [rsp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
mov r8d, 1
mov rbx, qword [sym.imp.USER32.dll_LoadImageW]
mov edx, 1
mov rcx, rax
mov qword [0x0040c778], rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
call rbx
xor r9d, r9d
mov r8d, 1
xor ecx, ecx
mov edx, 0x7f03
mov qword [0x0040c770], rax
mov dword [rsp + 0x28], 0x8040
mov dword [rsp + 0x20], 0
call rbx
lea rdx, str._SVC
lea rcx, [0x0040b940]
mov qword [0x0040c768], rax
call sub.msvcrt.dll_wcscat
lea rcx, [0x0040b720]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [0x0040b720]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [0x0040b720]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, str.ImDiskTk_svc.exe
lea rcx, [0x0040b720]
call sub.msvcrt.dll_wcscat
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 3
mov dword [rsp + 0x20], 3
lea rcx, str.lang.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x40666a
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rdx, qword [rsp + 0x1b0]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdx, 0x20000
jle 0x4065b2
mov rcx, rbx
call rbp
jmp 0x40666a
add rdx, 2
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rsp + 0x88]
mov r8d, dword [rsp + 0x1b0]
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov rdi, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call rbp
lea rdx, str._RamDiskUI_
mov rcx, rdi
call sub.msvcrt.dll_wcsstr
test rax, rax
je 0x40666a
lea rdx, [0x00408afa]
mov rcx, rax
xor ebx, ebx
call 0x4069a0
lea r12, [0x00408afa]
lea rbp, [section..bss]
xor ecx, ecx
mov rdx, r12
call 0x4069a0
mov qword [rbp + rbx*8], rax
inc rbx
cmp rbx, 0x76
jne 0x40662a
mov edx, dword [rsp + 0x1b0]
xor eax, eax
shr edx, 1
mov dword [rsp + 0x1b0], edx
cmp edx, eax
jbe 0x40666a
cmp word [rdi + rax*2], 0x23
jne 0x406665
mov word [rdi + rax*2], 0xa
inc rax
jmp 0x406654
xor edx, edx
xor ecx, ecx
mov r8d, 3
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea rdx, [0x00408b00]
mov r8d, 0x10012
mov rcx, rax
mov qword [0x0040c8a0], rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea rcx, [0x0040861a]
test rax, rax
mov qword [0x0040c898], rax
lea rdx, [0x0040b940]
je 0x406705
mov qword [rsp + 0x38], rcx
or r8d, 0xffffffff
mov rcx, rax
mov r9d, 1
mov qword [rsp + 0x20], rdx
mov edx, 0x10
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x4067bb
mov qword [rsp + 0x50], rcx
mov r9d, 0x10012
mov rcx, qword [0x0040c8a0]
mov qword [rsp + 0x38], rdx
lea r8, str.ImDisk_RamDisk_starter
mov qword [rsp + 0x60], 0
lea rdx, [0x00408b00]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
mov qword [0x0040c898], rax
je 0x40679f
lea rdi, str.Mounts_a_RamDisk_at_system_startup.
mov edx, 1
mov rcx, rax
mov qword [rsp + 0x88], rdi
lea r8, [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
jmp 0x4067bb
mov r9d, 0x10
mov rdx, qword [0x0040b2a0]
xor ecx, ecx
lea r8, [0x0040818e]
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, 0x48
mov rdi, rsi
rep stosd dword [rdi], eax
mov rcx, qword [0x0040b018]
lea rdi, [0x00408b88]
movabs rdx, 0x40800000060
mov rax, qword [0x0040c778]
mov qword [rsp + 0x1c0], rdi
lea rdi, [0x00404ec3]
mov qword [rsp + 0x1b0], rdx
mov qword [rsp + 0x1d8], rdi
test rcx, rcx
mov qword [rsp + 0x1b8], rax
jne 0x406819
lea rcx, str.Basic
mov qword [rsp + 0x210], rdx
mov rdx, qword [0x0040b0b0]
lea rdi, [0x00408b92]
lea rbx, [0x00404163]
mov qword [rsp + 0x1d0], rcx
mov qword [rsp + 0x218], rax
mov qword [rsp + 0x220], rdi
test rdx, rdx
mov qword [rsp + 0x238], rbx
jne 0x406862
lea rdx, str.Advanced
mov qword [rsp + 0x230], rdx
mov rdx, qword [0x0040b190]
movabs rdi, 0x40800000060
mov qword [rsp + 0x270], rdi
lea rbx, str.TAB3
lea rdi, [0x00403a64]
mov qword [rsp + 0x278], rax
mov qword [rsp + 0x280], rbx
test rdx, rdx
mov qword [rsp + 0x298], rdi
jne 0x4068b5
lea rdx, str.Data
mov r9d, 2
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x290], rdx
mov rdx, qword [0x0040c770]
lea rbx, [0x0040818e]
mov qword [rsp + 0x170], rbx
mov dword [rsp + 0x154], 0x200008a
mov dword [rsp + 0x178], 3
mov qword [rsp + 0x168], rdx
lea rdx, str.tooltips_class32
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r9d, 0x3e8
xor r8d, r8d
mov edx, 0x418
mov rcx, rax
mov rbx, qword [sym.imp.USER32.dll_SendMessageW]
mov qword [0x0040b5a8], rax
call rbx
mov r9d, 0x4e20
mov r8d, 2
mov edx, 0x403
mov rcx, qword [0x0040b5a8]
call rbx
lea rcx, [rsp + 0x150]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
call fcn.00403801
nop
jmp qword [sym.imp.msvcrt.dll_wcstok]