Function at 0x1400fa73c
Capabilities:
Get disk size
Get memory capacity
Query environment variable
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a8]
sub rsp, 0x5a8
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rbp + 0x490], rax
mov r15, r9
mov qword [rsp + 0x60], r9
mov r12, r8
mov qword [rsp + 0x78], r8
mov esi, edx
mov r14, rcx
call fcn.1400fb298
xor ebx, ebx
test eax, eax
je 0x1400fa895
mov rax, qword [0x14014d1e0]
mov qword [rsp + 0x58], rax
mov rdi, rax
test rax, rax
jne 0x1400fa85d
cmp qword [0x14014d1f0], rbx
je 0x1400fa895
mov rdi, qword [0x14014d1d0]
test rdi, rdi
je 0x1400fa895
mov rcx, rdi
call qword [fcn.140015690]
lea rdx, [0x1400fb278]
lea rcx, [rbp - 0x50]
call rdi
mov rdi, qword [0x14014d1f0]
lea rax, [rbp - 0x50]
mov rcx, rdi
mov dword [rbp - 0x80], 0x30
mov qword [rbp - 0x78], rbx
mov dword [rbp - 0x68], 0x40
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
call qword [fcn.140015690]
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x58]
mov edx, 0x100001
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 7
call rdi
test eax, eax
js 0x1400fa895
mov rcx, qword [rsp + 0x58]
xor eax, eax
lock cmpxchg qword [0x14014d1e0], rcx
mov rdi, rax
je 0x1400fa858
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], rdi
jmp 0x1400fa85d
mov rdi, qword [rsp + 0x58]
mov eax, dword [r15]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov r9d, esi
mov r8, r14
mov edx, 0x390008
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400fa895
mov eax, 1
jmp 0x1400fb250
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0xe04
xor edx, edx
mov rcx, rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x1400fb250
mov ebx, edi
cmp esi, edi
ja 0x1400fafae
mov r8, rsi
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea eax, [rsi + 8]
mov r14d, 0xfffffff8
and eax, r14d
cmp eax, edi
jbe 0x1400fa8e9
xor ebx, ebx
jmp 0x1400fafae
mov esi, eax
sub ebx, eax
add rsi, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsi], eax
cmp ebx, 8
jb 0x1400fa8e2
add ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 8], eax
cmp ebx, 8
jb 0x1400fa8e2
add ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsi + 0x10], eax
cmp ebx, 8
jb 0x1400fa8e2
add ebx, r14d
cmp ebx, 0x10
jb 0x1400fafae
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp ebx, 0x18
jb 0x1400fa8e2
add ebx, 0xffffffe8
cmp ebx, 8
jb 0x1400fafae
lea rcx, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp ebx, 0x10
jb 0x1400fa8e2
add ebx, 0xfffffff0
cmp ebx, 0x40
jb 0x1400fafae
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x40], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp ebx, 0x48
jb 0x1400fa8e2
add ebx, 0xffffffb8
cmp ebx, 0x10
jb 0x1400fafae
lea rax, [rsi + 0x94]
lea r9, [rsi + 0x90]
lea r8, [rsi + 0x8c]
lea rdx, [rsi + 0x88]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
cmp ebx, 0x18
jb 0x1400fa8e2
add ebx, 0xffffffe8
cmp dword [0x14014cdb0], 0
jne 0x1400faaab
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r15, rax
test rax, rax
jne 0x1400fa9f2
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov r12d, 1
mov r15, rax
test rax, rax
je 0x1400faa9c
lea rcx, [rbp - 0x30]
call fcn.1400fb3c8
mov r14, r15
xor edi, edi
mov eax, edi
mov edx, 0x7fff
test r12d, r12d
jne 0x1400faa23
add rax, 2
add r14, rax
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcsnlen]
mov rdi, rax
add edi, edi
jmp 0x1400faa34
inc rax
add r14, rax
mov rcx, r14
call qword [sym.imp.msvcrt.dll_strnlen]
mov edi, eax
lea r8, [rbp - 0x30]
mov edx, edi
mov rcx, r14
call fcn.1400fb404
test edi, edi
jne 0x1400faa00
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x30]
call fcn.1400fb6fc
mov eax, dword [rbp + 0x2c]
mov dword [0x14014cdb8], eax
mov eax, dword [rbp + 0x30]
mov rcx, r15
mov dword [0x14014cdbc], eax
mov eax, dword [rbp + 0x34]
mov dword [0x14014cdc0], eax
mov eax, dword [rbp + 0x38]
mov dword [0x14014cdc4], eax
mov eax, dword [rbp + 0x3c]
mov dword [0x14014cdc8], eax
test r12d, r12d
jne 0x1400faa90
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400faa96
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov r14d, 0xfffffff8
mov r12, qword [rsp + 0x78]
mov dword [0x14014cdb0], 1
cmp ebx, 0x14
jb 0x1400fafae
mov rax, qword [0x14014cdb8]
mov qword [rsi + 0xa0], rax
mov rax, qword [0x14014cdc0]
mov qword [rsi + 0xa8], rax
mov eax, dword [0x14014cdc8]
mov dword [rsi + 0xb0], eax
cmp ebx, 0x18
jb 0x1400fa8e2
add rsi, 0xb8
add ebx, 0xffffffe8
call fcn.1400fb298
test eax, eax
je 0x1400fafae
cmp ebx, 0x40
jb 0x1400fafae
mov rdi, qword [0x14014d1d8]
test rdi, rdi
je 0x1400fafae
mov rcx, rdi
mov dword [rsp + 0x50], ebx
call qword [fcn.140015690]
xor r9d, r9d
mov r8d, ebx
lea ecx, [r9 + 5]
mov rdx, rsi
call rdi
lea rcx, [rbp + 0x40]
call fcn.1400fb3c8
mov edx, dword [rsp + 0x50]
lea r8, [rbp + 0x40]
mov rcx, rsi
call fcn.1400fb404
lea rcx, [rbp + 0x40]
mov rdx, rsi
call fcn.1400fb6fc
cmp ebx, 0x18
jb 0x1400fa8e2
add ebx, 0xffffffe8
add rsi, 0x18
cmp ebx, 0x30
jb 0x1400fafae
mov rdi, qword [0x14014d1d8]
mov rcx, rdi
call qword [fcn.140015690]
mov r8d, 0x30
lea r9, [rsp + 0x50]
lea ecx, [r8 - 0x2d]
mov rdx, rsi
call rdi
test eax, eax
js 0x1400fabb0
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r14d
cmp ecx, ebx
ja 0x1400fa8e2
mov eax, ecx
add rsi, rax
sub ebx, ecx
cmp ebx, 0x18
jb 0x1400fafae
mov rdi, qword [0x14014d1d8]
mov rcx, rdi
call qword [fcn.140015690]
mov r8d, DispGetParam
lea r9, [rsp + 0x50]
lea ecx, [r8 - 0x11]
mov rdx, rsi
call rdi
test eax, eax
js 0x1400fabfa
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r14d
cmp ecx, ebx
ja 0x1400fa8e2
mov eax, ecx
add rsi, rax
sub ebx, ecx
cmp ebx, 0xb0
jb 0x1400fafae
mov rdi, qword [0x14014d1d8]
mov rcx, rdi
call qword [fcn.140015690]
mov r8d, 0xb0
lea r9, [rsp + 0x50]
lea ecx, [r8 - 0x60]
mov rdx, rsi
call rdi
test eax, eax
js 0x1400fac47
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r14d
cmp ecx, ebx
ja 0x1400fa8e2
mov eax, ecx
add rsi, rax
sub ebx, ecx
cmp ebx, 0x40
jb 0x1400fafae
mov rdi, qword [0x14014d1d8]
mov rcx, rdi
call qword [fcn.140015690]
mov r8d, 0x40
lea r9, [rsp + 0x50]
lea ecx, [r8 - 0x2b]
mov rdx, rsi
call rdi
test eax, eax
js 0x1400fac91
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r14d
cmp ecx, ebx
ja 0x1400fa8e2
mov eax, ecx
add rsi, rax
sub ebx, ecx
cmp ebx, 0x158
jb 0x1400fafae
mov rdi, qword [0x14014d1d8]
mov rcx, rdi
call qword [fcn.140015690]
lea r9, [rsp + 0x50]
mov r8d, 0x158
mov rdx, rsi
mov ecx, 2
call rdi
test eax, eax
js 0x1400facdf
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r14d
cmp ecx, ebx
ja 0x1400fa8e2
mov eax, ecx
add rsi, rax
sub ebx, ecx
cmp ebx, 0x10
jb 0x1400fafae
mov rdi, qword [0x14014d1d8]
mov rcx, rdi
call qword [fcn.140015690]
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r9, [rsp + 0x50]
lea ecx, [r8 + 0x11]
mov rdx, rsi
call rdi
test eax, eax
js 0x1400fad29
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r14d
cmp ecx, ebx
ja 0x1400fa8e2
mov eax, ecx
add rsi, rax
sub ebx, ecx
cmp ebx, 0x20
jb 0x1400fafae
mov rdi, qword [0x14014d1d8]
mov rcx, rdi
call qword [fcn.140015690]
mov r8d, 0x20
lea r9, [rsp + 0x50]
lea ecx, [r8 + 0xd]
mov rdx, rsi
call rdi
test eax, eax
js 0x1400fad73
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r14d
cmp ecx, ebx
ja 0x1400fa8e2
mov eax, ecx
add rsi, rax
sub ebx, ecx
mov rdi, qword [0x14014d1d8]
mov dword [rsp + 0x50], ebx
mov rcx, rdi
call qword [fcn.140015690]
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rsi
mov ecx, 8
call rdi
test eax, eax
js 0x1400fadec
cmp ebx, 0x14
jb 0x1400fafae
lea rcx, [rbp + 0x190]
call fcn.1400fb3c8
mov edx, dword [rsp + 0x50]
lea r8, [rbp + 0x190]
mov rcx, rsi
call fcn.1400fb404
lea rcx, [rbp + 0x190]
mov rdx, rsi
call fcn.1400fb6fc
cmp ebx, 0x18
jb 0x1400fa8e2
mov r14d, 0xffffffe8
add rsi, 0x18
add ebx, r14d
jmp 0x1400fadf2
mov r14d, 0xffffffe8
mov rdi, qword [0x14014d1d8]
mov dword [rsp + 0x50], ebx
mov rcx, rdi
call qword [fcn.140015690]
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rsi
mov ecx, 0x3d
call rdi
test eax, eax
js 0x1400fae63
cmp ebx, 0x14
jb 0x1400fafae
lea rcx, [rbp + 0xb0]
call fcn.1400fb3c8
mov edx, dword [rsp + 0x50]
lea r8, [rbp + 0xb0]
mov rcx, rsi
call fcn.1400fb404
lea rcx, [rbp + 0xb0]
mov rdx, rsi
call fcn.1400fb6fc
cmp ebx, 0x18
jb 0x1400fa8e2
add rsi, 0x18
add ebx, r14d
mov rdi, qword [0x14014d1d8]
mov dword [rsp + 0x50], ebx
mov rcx, rdi
call qword [fcn.140015690]
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rsi
mov ecx, SafeArrayAccessData
call rdi
test eax, eax
js 0x1400faed4
cmp ebx, 0x14
jb 0x1400fafae
lea rcx, [rbp + 0x120]
call fcn.1400fb3c8
mov edx, dword [rsp + 0x50]
lea r8, [rbp + 0x120]
mov rcx, rsi
call fcn.1400fb404
lea rcx, [rbp + 0x120]
mov rdx, rsi
call fcn.1400fb6fc
cmp ebx, 0x18
jb 0x1400fa8e2
add rsi, 0x18
add ebx, r14d
mov rdi, qword [0x14014d1d8]
mov dword [rsp + 0x50], ebx
mov rcx, rdi
call qword [fcn.140015690]
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rsi
mov ecx, reloc.Cabinet.dll_FDIDestroy
call rdi
test eax, eax
js 0x1400faf45
cmp ebx, 0x14
jb 0x1400fafae
lea rcx, [rbp + 0x200]
call fcn.1400fb3c8
mov edx, dword [rsp + 0x50]
lea r8, [rbp + 0x200]
mov rcx, rsi
call fcn.1400fb404
lea rcx, [rbp + 0x200]
mov rdx, rsi
call fcn.1400fb6fc
cmp ebx, 0x18
jb 0x1400fa8e2
add rsi, 0x18
add ebx, r14d
mov rdi, qword [0x14014d1d8]
mov dword [rsp + 0x50], ebx
mov rcx, rdi
call qword [fcn.140015690]
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rsi
mov ecx, 0x2a
call rdi
test eax, eax
js 0x1400fafae
cmp ebx, 0x14
jb 0x1400fafae
lea rcx, [rbp + 0x270]
call fcn.1400fb3c8
mov edx, dword [rsp + 0x50]
lea r8, [rbp + 0x270]
mov rcx, rsi
call fcn.1400fb404
lea rcx, [rbp + 0x270]
mov rdx, rsi
call fcn.1400fb6fc
cmp ebx, 0x18
jb 0x1400fa8e2
add ebx, r14d
mov rax, qword [0x14014cef0]
lea r8, [rbp + 0x3f0]
lea rcx, [rbp + 0x2e0]
mov qword [rbp + 0x3f0], rax
mov rax, qword [0x14014cef8]
mov edx, 0x50
mov qword [rbp + 0x3f8], rax
mov rax, qword [0x14014cf00]
mov qword [rbp + 0x400], rax
mov rax, qword [0x14014cf08]
mov qword [rbp + 0x408], rax
mov rax, qword [0x14014cf10]
mov qword [rbp + 0x410], rax
mov rax, qword [0x14014cf18]
mov qword [rbp + 0x418], rax
mov rax, qword [0x14014cf20]
mov qword [rbp + 0x420], rax
mov rax, qword [0x14014cf28]
mov qword [rbp + 0x428], rax
mov rax, qword [0x14014cf30]
mov qword [rbp + 0x430], rax
mov rax, qword [0x14014cf38]
mov qword [rbp + 0x438], rax
call fcn.1400fb9b0
mov eax, 0xe04
mov edx, eax
lea r8, [rbp + 0x3f0]
mov rcx, r13
sub edx, ebx
cmp edx, eax
cmova edx, eax
call fcn.140102440
mov rdx, qword [rbp + 0x428]
mov rbx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x418]
mov rcx, qword [rbp + 0x430]
mov r11, qword [rbp + 0x400]
mov r10, qword [rbp + 0x408]
mov r9, qword [rbp + 0x410]
mov rsi, qword [rbp + 0x3f0]
mov rdi, qword [rbp + 0x420]
mov r14d, eax
mov rax, qword [rbp + 0x438]
mov qword [rbp + 0x448], rbx
mov qword [0x14014cef8], rbx
mov qword [rbp + 0x468], r8
mov qword [rbp + 0x480], rcx
mov qword [0x14014cf18], r8
mov qword [0x14014cf30], rcx
mov qword [rbp + 0x478], rdx
mov qword [0x14014cf28], rdx
mov ebx, 0x50
lea r8, [rbp + 0x440]
lea rcx, [rbp + 0x2e0]
mov edx, ebx
mov qword [rbp + 0x488], rax
mov qword [0x14014cf38], rax
mov qword [rbp + 0x440], rsi
mov qword [rbp + 0x450], r11
mov qword [rbp + 0x458], r10
mov qword [rbp + 0x460], r9
mov qword [rbp + 0x470], rdi
mov qword [0x14014cef0], rsi
mov qword [0x14014cf00], r11
mov qword [0x14014cf08], r10
mov qword [0x14014cf10], r9
mov qword [0x14014cf20], rdi
call fcn.140001020
lea rax, [rsp + 0x70]
lea rdx, [0x140009750]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov r15, qword [rsp + 0x60]
jne 0x1400fb1dc
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x440]
lea r9d, [rbx - 0x4d]
lea rdx, [0x140009740]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea rdi, [rbp + 0x440]
mov rcx, rbx
rep stosb byte [rdi], al
lea r8, [rbp + 0x3f0]
lea rcx, [rbp + 0x2e0]
mov edx, ebx
call fcn.1400fb9b0
mov edx, dword [r15]
xor eax, eax
lea rdi, [rbp + 0x3f0]
mov rcx, rbx
mov r8, r12
rep stosb byte [rdi], al
lea rcx, [rbp + 0x2e0]
call fcn.140001020
xor eax, eax
lea rdi, [rbp + 0x2e0]
mov ecx, 0x108
rep stosb byte [rdi], al
mov rdi, r13
mov ecx, 0xe04
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r14d
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.140001000
add rsp, 0x5a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret