Function at 0x1400489d8
Capabilities:
Create thread
Get disk size
Set registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x220
mov r12, qword [0x1400b4af0]
mov edx, 0x147
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [sym.imp.USER32.dll_SendMessageW]
lea rbp, str..vhd
mov rcx, qword [r12]
call rsi
mov ecx, 0xd0f
mov rbx, rax
call fcn.14001e311
mov ecx, 0xd0e
mov qword [rsp + 0x60], rax
call fcn.14001e311
mov ecx, 0xd10
mov qword [rsp + 0x68], rax
call fcn.14001e311
lea rdx, [0x140117a00]
lea r10, [rsp + 0x98]
mov ecx, 0xc
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov rdi, rdx
mov qword [rsp + 0x90], rax
xor eax, eax
rep stosd dword [rdi], eax
mov qword [rsp + 0x80], r10
mov qword [rsp + 0x78], 3
mov qword [rsp + 0x88], rbp
test ebx, ebx
js 0x140048ea2
mov rdi, qword [0x1400b4a50]
cmp qword [rdi], 0
jne 0x140048ea2
movsxd rbx, ebx
mov rcx, r10
mov edx, pe_nt_image_headers64
imul rax, rbx, 0x38
add rax, qword [0x1400b4e30]
lea r8, [0x1400a61de]
mov r9, qword [rax + 0x18]
call qword [sym.imp.msvcrt.dll__snprintf]
xor r9d, r9d
mov rcx, qword [r12]
mov r8, rbx
mov edx, 0x150
mov byte [rsp + 0x117], 0
call rsi
mov ecx, eax
mov dword [0x140117a04], eax
call fcn.140007c0d
mov qword [0x140117a18], rax
mov rax, qword [0x1400b4c10]
cmp dword [rax], 0
je 0x140048b06
mov rax, qword [0x1400b4440]
cmp dword [rax + 0x1c], 1
je 0x140048b0f
mov qword [rsp + 0x78], 2
mov r13, qword [0x1400b4e50]
lea rax, str._NULL_
mov r14d, dword [rsp + 0x78]
mov dword [rsp + 0x50], 1
mov r12, qword [r13]
test r12, r12
cmove r12, rax
mov ebx, dword [rsp + 0x50]
cmp r14d, ebx
jb 0x140048b5e
lea eax, [rbx - 1]
mov rdx, r12
mov rcx, qword [rbp + rax*8]
add rcx, 2
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140048b66
inc ebx
mov dword [rsp + 0x50], ebx
jmp 0x140048b35
mov dword [rsp + 0x50], 2
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x78]
xor edx, edx
mov ecx, 1
call fcn.14003a9b3
mov qword [0x140117a20], rax
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140048b91
cmp dword [rsp + 0x78], eax
jae 0x140048bab
mov r8d, 0x46c
lea rdx, str.vhd.c
lea rcx, str.i___0__i____UINT_img_ext.count
call qword [sym.imp.msvcrt.dll__wassert]
dec eax
mov rbx, qword [rbp + rax*8]
mov rax, qword [0x1400b4c80]
mov r8, qword [rax]
add rbx, 2
mov qword [r13], rbx
test r8, r8
je 0x140048bdd
mov rdx, rbx
lea rcx, str.PreferredSaveImageType
call fcn.1400232db
jmp 0x140048cca
mov rcx, rbx
xor r14d, r14d
call sub.msvcrt.dll_strlen
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x58], r14
mov rbp, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x118], r14
mov r9d, 0x2001d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140048c28
xor r13d, r13d
mov qword [rsp + 0x58], r13
jmp 0x140048ca7
lea rax, [rsp + 0x54]
xor r11d, r11d
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rsp + 0x118]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREAkeo_ConsultingRufus
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140048c80
xor r10d, r10d
mov qword [rsp + 0x118], r10
jmp 0x140048ca7
mov dword [rsp + 0x28], ebp
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x118]
mov qword [rsp + 0x20], rbx
lea rdx, str.PreferredSaveImageType
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140048cb7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x140048cca
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [rsp + 0x50]
mov eax, 2
cmp edx, 1
je 0x140048ce8
cmp edx, 3
mov eax, 0x63
mov edx, 3
cmovne eax, edx
mov r12, qword [0x1400b4440]
mov dword [0x140117a00], eax
cmp qword [0x140117a18], 0
mov dword [0x140117a08], 0x2000000
mov rax, qword [r12]
mov qword [0x140117a10], rax
je 0x140048e72
cmp qword [0x140117a20], 0
je 0x140048e72
mov rbx, qword [0x1400b4b90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov rcx, qword [rbx]
call rsi
mov rbp, qword [0x1400b42b0]
xor r9d, r9d
cmp dword [0x140117a00], 2
mov dword [rbp], r9d
jne 0x140048dbf
xor r8d, r8d
lea r13, [rsp + 0x118]
mov rcx, qword [0x140117a20]
mov qword [rsp + 0x58], r8
mov rdx, r13
mov r8d, 0x104
call qword [sym.imp.KERNEL32.DLL_GetVolumePathNameA]
test eax, eax
je 0x140048dbf
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, r13
call qword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExA]
test eax, eax
je 0x140048dbf
mov rax, qword [r12]
add rax, 0x1ff
cmp rax, qword [rsp + 0x58]
jl 0x140048dbf
lea rcx, str.The_VHD_size_is_too_large_for_the_target_drive
call fcn.1400380b9
mov dword [rbp], 0xc00300df
jmp 0x140048e5e
xor edx, edx
xor ecx, ecx
call fcn.14002d51e
xor ecx, ecx
mov dword [rbp], ecx
mov ecx, 1
call fcn.14004499e
cmp dword [0x140117a00], 0x63
lea rax, [0x140045d53]
lea r8, [0x1400469a2]
cmove r8, rax
lea r9, [0x140117a00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rdi], rax
test rax, rax
je 0x140048e4b
lea rcx, str._r_nSave_to_VHD_operation_started
call fcn.1400380b9
or r9d, 0xffffffff
xor r8d, r8d
xor edx, edx
mov ecx, 1
call fcn.14001e4cb
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
call rsi
jmp 0x140048e72
lea rcx, str.Unable_to_start_VHD_save_thread
call fcn.1400380b9
mov dword [rbp], 0xe0031205
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
call qword [sym.imp.USER32.dll_PostMessageW]
cmp qword [rdi], 0
jne 0x140048ea2
mov rcx, qword [0x140117a18]
call sub.msvcrt.dll_free
mov rcx, qword [0x140117a20]
xor eax, eax
mov qword [0x140117a18], rax
call sub.msvcrt.dll_free
xor edx, edx
mov qword [0x140117a20], rdx
add rsp, 0x220
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret