Function at 0x1400225a0
Capabilities:
Get disk information
Set registry value

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1400a3100]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
lea r9, [rbp - 0x21]
mov dword [rsp + 0x38], edi
lea rcx, [0x14005f930]
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140022883
mov edx, dword [rbp - 0x21]
lea rcx, [rbp + 0x27]
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], rsi
call fcn.140022060
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.14001a890
lea r8, str.DefaultIcon
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x19]
call fcn.14001c2e0
lea rsi, str.C:WindowsTRUST.ico
mov rdx, rsi
lea rcx, [rbp - 0x49]
call fcn.140019c40
lea rcx, [rbp - 0x49]
call fcn.1400222e0
mov rdx, qword [rbp - 0x31]
movzx ebx, al
cmp rdx, 7
jbe 0x14002268f
mov rcx, qword [rbp - 0x49]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002268a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400228a6
call fcn.14002f6d8
test bl, bl
je 0x140022790
cmp qword [rbp + 0x1f], 7
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], rdi
lea rdx, [rbp + 7]
cmova rdx, qword [rbp + 7]
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022790
mov rcx, qword [rbp - 0x29]
lea rax, str.ENCRYPTED_BY_TRUST
mov dword [rsp + 0x28], 0x26
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x29]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp - 1], 7
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], rdi
lea rdx, [rbp - 0x19]
cmova rdx, qword [rbp - 0x19]
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022790
mov rcx, qword [rbp - 0x29]
mov r9d, 1
mov dword [rsp + 0x28], 0x2a
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x29]
test eax, eax
sete al
and bl, al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140022792
xor bl, bl
mov rdx, qword [rbp - 1]
cmp rdx, 7
jbe 0x1400227d2
mov rcx, qword [rbp - 0x19]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400227cd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400228a0
call fcn.14002f6d8
mov rdx, qword [rbp + 0x1f]
movdqa xmm0, xmmword [0x14009b9a0]
mov word [rbp - 0x19], di
movdqu xmmword [rbp - 9], xmm0
cmp rdx, 7
jbe 0x14002282b
mov rcx, qword [rbp + 7]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002281e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400228a0
call fcn.14002f6d8
movdqa xmm0, xmmword [0x14009b9a0]
mov rdx, qword [rbp + 0x3f]
mov word [rbp + 7], di
movdqu xmmword [rbp + 0x17], xmm0
cmp rdx, 7
jbe 0x140022870
mov rcx, qword [rbp + 0x27]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002286b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400228a0
call fcn.14002f6d8
mov rsi, qword [rsp + 0x108]
movzx eax, bl
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14002f0b0
mov rdi, qword [rsp + 0x110]
add rsp, 0xf0
pop rbp
ret
call fcn.14003501c
int3
call fcn.14003501c
int3