Function at 0x14000f520
Capabilities:
Get disk information
Modify service

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x338]
sub rsp, 0x410
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov esi, edx
mov rdi, rcx
call sub.SHELL32.dll_IsUserAnAdmin
test eax, eax
jne 0x14000f57e
call fcn.14001ed90
test eax, eax
je 0x14000f57e
mov ecx, esi
call fcn.14000a690
jmp 0x14000f9b2
xor r13d, r13d
mov ebx, r13d
test esi, esi
sete bl
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
jne 0x14000f5ce
lea rax, [0x1400cc930]
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x58], eax
lea rax, str.VeraCrypt::BootEncryption::SetDriverServiceStartType:1258
mov qword [rbp - 0x50], rax
lea rdx, [0x140143380]
lea rcx, [rbp - 0x60]
call fcn.1400a5d24
int3
mov qword [rsp + 0x60], rax
mov r8d, 2
lea rdx, [0x1400cd980]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x14000f621
lea rax, [0x1400cc930]
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x58], eax
lea rax, str.VeraCrypt::BootEncryption::SetDriverServiceStartType:1263
mov qword [rbp - 0x50], rax
lea rdx, [0x140143380]
lea rcx, [rbp - 0x60]
call fcn.1400a5d24
int3
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r13
mov word [rsp + 0x78], r13w
test ebx, ebx
je 0x14000f8ac
mov ecx, 0xb
call fcn.14001c740
test eax, eax
jne 0x14000f893
lea rdx, [rbp - 0x38]
mov rcx, rdi
call fcn.14000e270
nop
mov r8d, 0x16
lea rdx, str.drivers_veracrypt.sys
lea rcx, [rbp - 0x38]
call fcn.14000b850
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
mov r8d, 0x104
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x14000f883
mov dword [rsp + 0x38], 0x80
lea rax, [rbp + 0x200]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x14000f883
mov ecx, 3
lea rdx, [0x1400ca270]
lea rdi, [rbp + 0x200]
nop word [rax + rax]
movzx eax, word [rdx]
or r14, 0xffffffffffffffff
cmp word [rdi], ax
jne 0x14000f70b
add rdi, 2
add rdx, 2
dec rcx
jne 0x14000f6f0
jmp 0x14000f71f
mov ecx, 1
cmp word [rdi], ax
cmovb ecx, r14d
test ecx, ecx
jne 0x14000f883
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
mov r8d, 0x104
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
jne 0x14000f771
lea rax, [0x1400cc930]
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x58], eax
lea rax, str.VeraCrypt::BootEncryption::SetDriverServiceStartType:1282
mov qword [rbp - 0x50], rax
lea rdx, [0x140143380]
lea rcx, [rbp - 0x60]
call fcn.1400a5d24
int3
xor eax, eax
mov rcx, r14
lea rdi, [rbp - 0x10]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140006260
mov r9d, 1
mov r8, r14
lea rdx, [0x1400ca248]
lea rcx, [rsp + 0x78]
call fcn.140009b30
lea r8, [rax - 1]
mov r9d, 1
lea rdx, [0x1400ca248]
lea rcx, [rsp + 0x78]
call fcn.140009b30
lea r8, [rax - 1]
mov r9d, 1
lea rdx, [0x1400ca248]
lea rcx, [rsp + 0x78]
call fcn.140009b30
lea r8, [rax + 1]
mov r9, r14
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call fcn.140006410
mov rdi, rax
lea rax, [rsp + 0x78]
cmp rax, rdi
je 0x14000f872
cmp qword [rbp - 0x70], 8
jb 0x14000f815
mov rcx, qword [rsp + 0x78]
call fcn.1400a58b8
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r13
mov word [rsp + 0x78], r13w
cmp qword [rdi + 0x18], 8
jae 0x14000f847
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.1400a4990
jmp 0x14000f852
mov rax, qword [rdi]
mov qword [rsp + 0x78], rax
mov qword [rdi], r13
mov rax, qword [rdi + 0x10]
mov qword [rbp - 0x78], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp - 0x70], rax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r13
mov word [rdi], r13w
cmp qword [rbp - 0x48], 8
jb 0x14000f883
mov rcx, qword [rbp - 0x60]
call fcn.1400a58b8
nop
cmp qword [rbp - 0x20], 8
jb 0x14000f893
mov rcx, qword [rbp - 0x38]
call fcn.1400a58b8
cmp qword [rbp - 0x78], 0
je 0x14000f8ac
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
jmp 0x14000f8af
mov rcx, r13
lea rdx, str.Filter
mov rax, r13
test ebx, ebx
cmovne rax, rdx
mov r9d, r13d
setne r9b
inc r9d
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
or r8d, 0xffffffff
or edx, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x14000f930
lea rax, [0x1400cc930]
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x58], eax
lea rax, str.VeraCrypt::BootEncryption::SetDriverServiceStartType:1294
mov qword [rbp - 0x50], rax
lea rdx, [0x140143380]
lea rcx, [rbp - 0x60]
call fcn.1400a5d24
int3
mov r8d, esi
lea rdx, str.Start
lea rcx, str.SYSTEMCurrentControlSetServices_veracrypt
call fcn.14003fa00
test eax, eax
jne 0x14000f97a
lea rax, [0x1400cc930]
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x58], eax
lea rax, str.VeraCrypt::BootEncryption::SetDriverServiceStartType:1297
mov qword [rbp - 0x50], rax
lea rdx, [0x140143380]
lea rcx, [rbp - 0x60]
call fcn.1400a5d24
nop
cmp qword [rbp - 0x70], 8
jb 0x14000f98b
mov rcx, qword [rsp + 0x78]
call fcn.1400a58b8
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r13
mov word [rsp + 0x78], r13w
lea rcx, [rsp + 0x68]
call fcn.1400082a0
nop
lea rcx, [rsp + 0x60]
call fcn.1400082a0
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.1400a4e70
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret