Function at 0x403139
Capabilities:
Copy file
Create directory
Create service
Delete directory
Delete file
Delete registry value
Get common file path
Get installed programs
Manipulate user privileges
Modify service
Move file
Persist via lnk shortcut
Persist via run registry key
Persist via windows service
Query or enumerate registry value
Set registry value
Start service

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3d8
or rax, 0xffffffffffffffff
mov r9d, 0x104
mov edx, 0x12d
lea rsi, str.SeLockMemoryPrivilege
lea r8, [0x0041bcc0]
mov r15, rcx
mov qword [rsp + 0xc0], rax
mov ecx, 0xb
mov qword [rsp + 0xc8], rax
xor eax, eax
lea rdi, [rsp + 0x124]
mov dword [rsp + 0xa8], 0x44
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xc
mov dword [rsp + 0xe0], 0x2c002a
lea rdi, [rsp + 0x150]
rep stosd dword [rdi], eax
lea rax, [rsp + 0x124]
mov rcx, r15
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xe8], rax
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
xor edx, edx
mov r13, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [0x0041bcc0]
call r13
test eax, eax
jne 0x403226
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403226
cmp dword [0x0041bf94], 1
jg 0x404802
mov r9d, 0x10
mov r8, qword [0x0040b020]
mov rcx, r15
mov rdx, qword [0x0040b0f8]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x404802
lea rdx, [0x0041bcc0]
lea rcx, [0x0041baa0]
call sub.msvcrt.dll_wcscpy
lea rcx, [0x0041bcc0]
mov r12, qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
call r12
mov edx, 1
mov rcx, r15
mov qword [0x0041bca8], rax
lea rsi, [rsp + 0xb8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov r8, qword [0x0040b0e8]
mov edx, 1
mov rcx, r15
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
xor r9d, r9d
mov r8d, 2
xor ecx, ecx
mov edx, 0x7f02
mov dword [rsp + 0x28], 0x8040
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea rcx, str.ImDisk_UAC.exe
call entry0
lea rcx, str.setup.exe
call entry0
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov r9d, 0x102
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
mov rbp, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rbp
test eax, eax
jne 0x40331a
mov rcx, qword [rsp + 0xb8]
lea rdx, str.ImDisk_notif
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsxd rdx, dword [0x0040b26c]
lea rax, str.english
mov rdi, qword [sym.imp.msvcrt.dll__snwprintf]
lea r8, str.lang_s.txt
lea rcx, [0x0040b280]
lea rbx, [0x0041b280]
mov r9, qword [rax + rdx*8]
mov edx, 0x8000
call rdi
lea rdx, str.lang.txt
xor r8d, r8d
lea rcx, [0x0040b280]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rcx, str.lang.txt
call fcn.004030c7
lea rcx, str.ImDisk_Dlg.exe
call fcn.004030c7
lea rcx, str.config.exe
call fcn.004030c7
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [0x00407b36]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
xor edx, edx
mov rcx, rbx
call r13
mov rcx, rbx
call r12
mov r9, qword [0x0040b190]
lea r8, str._.94s.lnk
mov edx, 0x63
mov r14, rax
mov rcx, rax
call rdi
lea rcx, [0x00407d84]
call fcn.004022f5
mov r9, qword [0x0040b188]
mov edx, 0x63
mov rcx, r14
lea r8, str._.94s.lnk
call rdi
xor ecx, ecx
call fcn.004022f5
mov r9, qword [0x0040b198]
mov edx, 0x63
mov rcx, r14
lea r8, str._.94s.url
call rdi
movaps xmm0, xmmword [section..data]
lea rax, [rsp + 0xd0]
xor edx, edx
movaps xmm1, xmmword [0x00406010]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x104]
mov r8d, 1
movups xmmword [rsp + 0x104], xmm0
lea rcx, section..data
movups xmmword [rsp + 0x114], xmm1
mov byte [rsp + 0x104], pe_nt_image_headers64
mov dword [rsp + 0x114], 0x10b
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4034e8
mov rcx, qword [rsp + 0xd0]
xor r8d, r8d
lea rdx, str.https:__sourceforge.net_projects_imdisk_toolkit_
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0x114]
lea r8, [rsp + 0xd8]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x4034da
mov rcx, qword [rsp + 0xd8]
mov r8d, 1
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edx, 0x196
mov rcx, r15
mov r12, qword [sym.imp.USER32.dll_IsDlgButtonChecked]
call r12
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallImDiskApp
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea rcx, [0x0041bcc0]
call sub.msvcrt.dll_wcslen
lea r10, [0x0041bcc0]
xor r8d, r8d
mov r9d, 1
lea eax, [rax + rax + 2]
mov qword [rsp + 0x20], r10
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x70], r10
lea rdx, str.DisplayIcon
mov r13, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], eax
call r13
lea rax, str.ImDisk_Toolkit
mov rbx, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor r8d, r8d
mov r9d, 1
mov rcx, qword [rsp + 0xb8]
mov dword [rsp + 0x28], 0xf
lea rdx, str.DisplayName
mov qword [rsp + 0x20], rax
call rbx
lea rax, str.20190419
xor r8d, r8d
mov r9d, 1
lea rdx, str.DisplayVersion
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 9
call rbx
lea rax, [0x00406030]
xor r8d, r8d
mov r9d, 4
lea rdx, str.EstimatedSize
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
call rbx
mov r10, qword [rsp + 0x70]
lea rcx, [0x0040b280]
lea rbx, [0x0040b280]
mov rdx, r10
call sub.msvcrt.dll_wcscpy
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
lea rdx, [0x00407d84]
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcscat
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcslen
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0xb8]
lea eax, [rax + rax + 2]
mov qword [rsp + 0x20], rbx
lea rdx, str.UninstallString
mov dword [rsp + 0x28], eax
call r13
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
xor ecx, ecx
mov r8d, 3
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edx, 0x191
mov rcx, r15
mov qword [rsp + 0x70], rax
call r12
test eax, eax
je 0x4036fe
mov r8d, 1
mov rcx, qword [rsp + 0x70]
lea rdx, [0x00407dfa]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x4036e1
mov byte [0x0041bfad], 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [0x0040b280]
lea rdx, str.rundll32_setupapi.dll_InstallHinfSection_DefaultInstall_128_driverimdisk.inf
call sub.msvcrt.dll_wcscpy
mov ecx, 1
call fcn.00401182
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov r9d, 0x102
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallImDisk
call rbp
test eax, eax
mov dword [rsp + 0x7c], eax
jne 0x403940
xor r9d, r9d
xor r8d, r8d
mov r12, qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov edx, 0x25
call r12
lea rdx, str.imdisk.cpl.manifest
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcscat
mov rbp, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rax
call rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, 0x29
xor ecx, ecx
xor ebx, ebx
call r12
lea rdx, str.imdisk.cpl.manifest
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcscat
lea r12, str.ImDskSvc
mov rcx, rax
call rbp
lea rdx, str.reg_copy_HKLMSOFTWAREImDiskDriverBackup_HKLMSYSTEMCurrentControlSetServicesImDiskParameters__f
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcscpy
mov ecx, 1
call fcn.00401182
lea rdx, str.SOFTWAREImDiskDriverBackup
mov rcx, 0xffffffff80000002
call fcn.00401428
mov edx, 0x197
mov rcx, r15
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov r13d, eax
mov eax, 3
sub eax, r13d
mov dword [rsp + 0x8c], eax
cmp rbx, 3
mov dword [rsp + 0x88], ebx
je 0x4038a7
mov rdx, qword [r12 + rbx*8]
mov r8d, 0x12
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rbx, rbx
mov rbp, rax
jne 0x40387c
test r13d, r13d
jne 0x403825
cmp dword [0x004060b0], 4
je 0x40387c
or r9d, 0xffffffff
mov rcx, rbp
mov qword [rsp + 0x50], 0
mov r8d, dword [rsp + 0x8c]
mov qword [rsp + 0x48], 0
mov edx, r9d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov eax, dword [rsp + 0x88]
or eax, r13d
je 0x403896
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbp
inc rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4037e9
xor r8d, r8d
mov edx, 0x191
mov rcx, r15
call qword [sym.imp.USER32.dll_CheckDlgButton]
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.ImDisk_Virtual_Disk_Driver.lnk
mov rcx, r14
call sub.msvcrt.dll_wcscpy
xor r8d, r8d
mov rbx, qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [0x0041b280]
lea rcx, str.cp.lnk
call rbx
mov rcx, qword [0x0041b550]
lea rdx, str.ImDisk_Virtual_Disk_Driver.lnk
call sub.msvcrt.dll_wcscpy
cmp dword [rsp + 0x78], 0
je 0x403933
lea rdx, [0x0041b560]
xor r8d, r8d
lea rcx, [0x0041b280]
call rbx
jmp 0x403940
lea rcx, [0x0041b560]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r9, qword [0x0040b1a8]
lea r8, str._.94s.lnk
mov edx, 0x63
mov rcx, r14
call rdi
mov rcx, qword [0x0041b550]
mov rdx, r14
call sub.msvcrt.dll_wcscpy
mov edx, 0x192
mov rcx, r15
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x403cec
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov r9d, 0x101
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoft.NETFramework_v4.0.30319
mov rbx, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rbx
test eax, eax
je 0x4039b5
xor ebp, ebp
cmp dword [0x0041bf94], 0
sete bpl
jmp 0x4039c5
mov rcx, qword [rsp + 0xb8]
xor ebp, ebp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.DiscUtils.dll
call fcn.004030c7
lea rcx, str.DiscUtilsDevio.exe
call fcn.004030c7
lea rcx, str.DevioNet.dll
call fcn.004030c7
lea rcx, str.ImDiskNet.dll
call fcn.004030c7
lea rcx, str.MountImg.exe
call fcn.004030c7
xor ecx, ecx
call fcn.004022f5
cmp dword [rsp + 0x78], 0
je 0x403a28
lea rdx, [0x0041b560]
xor r8d, r8d
lea rcx, [0x0041b280]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x403a35
lea rcx, [0x0041b560]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov r9d, 0x101
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREImDisk
call rbx
test eax, eax
jne 0x403d43
xor r9d, r9d
xor r8d, r8d
mov rdi, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r12d, r12d
lea rax, [rsp + 0x94]
mov rcx, qword [rsp + 0xb8]
mov dword [rsp + 0xac], 0xffffffff
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x20], rax
lea rdx, str.ImMaxReg
mov dword [rsp + 0x94], 4
lea r13, str.Im_d
call rdi
cmp dword [rsp + 0xac], r12d
jl 0x403cdc
mov r9d, r12d
mov r8, r13
mov edx, 0x8000
lea rcx, [0x0040b280]
call qword [sym.imp.msvcrt.dll__snwprintf]
lea rsi, [0x0040b280]
lea rdx, str.FileName
cdqe
add rax, rax
lea rbx, [rax + rsi]
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
jne 0x403cd4
lea rdx, str.Device
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], 0
call rdi
cmp eax, 2
jne 0x403cd4
lea rdx, [0x0041bcc0]
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
lea rdx, str.__SVC
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov r8d, 0x12
mov rcx, qword [rsp + 0x70]
lea rdx, str.ImDiskImg
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
lea rax, str.ImDisk
je 0x403c01
mov qword [rsp + 0x50], 0
mov r9d, 1
or r8d, 0xffffffff
mov rcx, rbx
mov qword [rsp + 0x48], 0
mov edx, 0x10
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x403c6e
mov qword [rsp + 0x50], rax
mov r9d, 0x12
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x60], 0
lea r8, str.ImDisk_Image_File_mounter
mov qword [rsp + 0x58], 0
lea rdx, str.ImDiskImg
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
mov rbx, rax
je 0x403cac
lea rax, str.Mounts_image_files_at_system_startup.
mov rcx, rbx
mov edx, 1
lea r8, [rsp + 0xb0]
mov qword [rsp + 0xb0], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rbx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x403cdc
cmp dword [0x0041bf94], 1
jg 0x403cdc
mov r9d, 0x10
mov r8, qword [0x0040b020]
mov rcx, r15
mov rdx, qword [0x0040b100]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403cdc
inc r12d
jmp 0x403ab3
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403d43
lea rcx, [0x0041b280]
mov rbx, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebp, ebp
call rbx
lea rcx, [0x0041b560]
call rbx
lea rcx, str.DiscUtils.dll
call entry0
lea rcx, str.DiscUtilsDevio.exe
call entry0
lea rcx, str.DevioNet.dll
call entry0
lea rcx, str.ImDiskNet.dll
call entry0
lea rcx, str.MountImg.exe
call entry0
mov r9, qword [0x0040b1a0]
lea r8, str._.94s.lnk
mov rcx, r14
mov edx, 0x63
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [0x0041b550]
mov rdx, r14
call sub.msvcrt.dll_wcscpy
mov edx, 0x193
mov rcx, r15
mov r14, qword [sym.imp.USER32.dll_IsDlgButtonChecked]
call r14
test eax, eax
je 0x404597
lea rcx, str.RamDyn.exe
call fcn.004030c7
lea rcx, str.ImDiskTk_svc.exe
call fcn.004030c7
lea rcx, str.RamDiskUI.exe
call fcn.004030c7
xor ecx, ecx
call fcn.004022f5
cmp dword [rsp + 0x78], 0
je 0x403dd3
lea rdx, [0x0041b560]
xor r8d, r8d
lea rcx, [0x0041b280]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x403de0
lea rcx, [0x0041b560]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov r9d, 0x101
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREImDisk
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4045c8
lea rax, [rsp + 0x98]
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rbx, [rsp + 0x94]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x28], rbx
lea rdx, str.RDMountCurrent
mov dword [rsp + 0x94], 4
call rsi
test eax, eax
jne 0x404587
lea rax, [rsp + 0x9c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x94], 4
mov qword [rsp + 0x28], rbx
lea rdx, str.Awealloc
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call rsi
test eax, eax
je 0x403ea0
mov dword [rsp + 0x9c], 0
lea rax, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x94], 4
mov qword [rsp + 0x28], rbx
lea rdx, str.Dynamic
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call rsi
test eax, eax
je 0x403ee3
mov dword [rsp + 0xa0], 0
lea rax, [rsp + 0xa4]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x94], 4
mov qword [rsp + 0x28], rbx
lea rdx, str.SyncFlags
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call rsi
test eax, eax
je 0x403f26
mov dword [rsp + 0xa4], 0
lea rax, [rsp + 0x1c8]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x94], 0x208
mov qword [rsp + 0x28], rbx
lea rdx, str.ImageFile
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call rsi
test eax, eax
je 0x403f68
mov word [rsp + 0x1c8], 0
mov eax, dword [rsp + 0x98]
xor r12d, r12d
mov edi, dword [rsp + 0x9c]
and edi, dword [rsp + 0xa0]
and edi, eax
test dword [rsp + 0xa4], eax
je 0x403f9b
xor r12d, r12d
cmp word [rsp + 0x1c8], 0
setne r12b
mov r13, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rsi, [0x0040b280]
mov word [0x0040b280], 0x30
cmp word [rsi], 0x5a
ja 0x404158
lea rdx, str._Awealloc
lea rcx, [0x0040b282]
call sub.msvcrt.dll_wcscpy
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x9c]
mov rdx, rsi
mov dword [rsp + 0x94], 4
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call r13
test eax, eax
jne 0x404138
lea rdx, str.Dynamic
mov dword [rsp + 0x98], 1
lea rcx, [0x0040b284]
call sub.msvcrt.dll_wcscpy
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0xa0]
mov rdx, rsi
mov dword [rsp + 0x94], 4
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call r13
test eax, eax
je 0x404066
mov dword [rsp + 0xa0], 0
lea rdx, str.SyncFlags
lea rcx, [0x0040b284]
call sub.msvcrt.dll_wcscpy
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0xa4]
mov rdx, rsi
mov dword [rsp + 0x94], 4
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call r13
test eax, eax
je 0x4040b9
mov dword [rsp + 0xa4], 0
lea rdx, str.ImageFile
lea rcx, [0x0040b284]
call sub.msvcrt.dll_wcscpy
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x1c8]
mov rdx, rsi
mov dword [rsp + 0x94], 0x208
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call r13
test eax, eax
je 0x40410b
mov word [rsp + 0x1c8], 0
mov eax, dword [rsp + 0x9c]
and eax, dword [rsp + 0xa0]
or edi, eax
xor eax, eax
test byte [rsp + 0xa4], 1
je 0x404135
xor eax, eax
cmp word [rsp + 0x1c8], 0
setne al
or r12d, eax
mov eax, dword [rsi]
cmp ax, 0x39
jne 0x40414e
mov word [0x0040b280], 0x41
jmp 0x403fb2
inc eax
mov word [rsi], ax
jmp 0x403fb2
cmp dword [rsp + 0x98], 0
je 0x404587
test edi, edi
je 0x40426e
mov dword [rsp + 0xf4], 1
mov dword [rsp + 0x100], 2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xc0]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x404208
lea rbx, [rsp + 0x184]
xor edx, edx
mov ecx, 0x1a
lea r9, [rsp + 0xa8]
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea rdx, [rsp + 0x150]
mov r8d, 0x800
xor ecx, ecx
lea r9, [rsp + 0xc8]
call sub.ADVAPI32.dll_LsaOpenPolicy
mov rcx, qword [rsp + 0xc8]
mov r9d, 1
mov rdx, rbx
lea r8, [rsp + 0xe0]
call sub.ADVAPI32.dll_LsaAddAccountRights
mov byte [0x0041bfad], 1
jmp 0x40426e
xor ecx, ecx
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea rbx, [rsp + 0xf4]
test eax, eax
je 0x4041a4
xor r9d, r9d
xor edx, edx
mov r8, rbx
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4041a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4041a4
lea rdx, [0x0041bcc0]
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcscpy
lea rbx, str.ImDisk
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
lea rdx, str._SVC
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcscat
mov r8d, 0x12
mov rcx, qword [rsp + 0x70]
lea rdx, str.ImDiskRD
mov rdi, qword [sym.imp.ADVAPI32.dll_OpenServiceW]
call rdi
mov rsi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rax, rax
mov r13, rax
je 0x404326
lea rax, [0x0040b280]
or r8d, 0xffffffff
mov qword [rsp + 0x50], 0
mov r9d, 1
mov qword [rsp + 0x38], rbx
mov edx, 0x10
mov rcx, r13
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x40439a
mov qword [rsp + 0x50], rbx
mov r9d, 0x12
mov rcx, qword [rsp + 0x70]
lea rax, [0x0040b280]
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
lea r8, str.ImDisk_RamDisk_starter
mov qword [rsp + 0x48], 0
lea rdx, str.ImDiskRD
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
mov r13, rax
je 0x4043d4
lea rax, str.Mounts_a_RamDisk_at_system_startup.
mov rcx, r13
mov edx, 1
lea r8, [rsp + 0xb0]
mov qword [rsp + 0xb0], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, r13
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, r13
call rsi
jmp 0x4043fa
cmp dword [0x0041bf94], 1
jg 0x4043fa
mov r9d, 0x10
mov r8, qword [0x0040b020]
mov rcx, r15
mov rdx, qword [0x0040b100]
call qword [sym.imp.USER32.dll_MessageBoxW]
test r12d, r12d
je 0x404587
mov rcx, qword [0x0041bca8]
lea rdx, str.ImDiskTk_svc.exe
call sub.msvcrt.dll_wcscpy
mov r8d, 0x12
mov rcx, qword [rsp + 0x70]
lea rdx, str.ImDiskTk_svc
call rdi
test rax, rax
mov rdi, rax
lea rax, [0x0041bcc0]
je 0x404491
lea rbx, str.ImDisk
or r8d, 0xffffffff
mov qword [rsp + 0x50], 0
mov r9d, 1
mov qword [rsp + 0x38], rbx
mov edx, 0x10
mov rcx, rdi
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x4044fe
mov qword [rsp + 0x50], rbx
mov r9d, 0x12
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x60], 0
lea r8, str.ImDisk_Toolkit_helper_service
mov qword [rsp + 0x58], 0
lea rdx, str.ImDiskTk_svc
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
mov rdi, rax
je 0x404561
lea rax, str.Service_used_for_data_synchronization_at_system_shutdown.
mov edx, 1
mov rcx, rdi
mov rbx, qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov qword [rsp + 0xb0], rax
lea r8, [rsp + 0xb0]
call rbx
cmp dword [0x0041c084], 5
jbe 0x40454c
lea r8, [rsp + 0x90]
mov edx, 7
mov rcx, rdi
mov dword [rsp + 0x90], 0x36ee80
call rbx
mov rcx, rdi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
call rsi
jmp 0x404587
cmp dword [0x0041bf94], 1
jg 0x404587
mov r9d, 0x10
mov r8, qword [0x0040b020]
mov rcx, r15
mov rdx, qword [0x0040b100]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4045c8
lea rcx, [0x0041b280]
mov rbx, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rbx
lea rcx, [0x0041b560]
call rbx
lea rcx, str.RamDiskUI.exe
call entry0
lea rcx, str.RamDyn.exe
call entry0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x7c], 0
jne 0x404634
mov edx, 0x194
mov rcx, r15
call r14
test eax, eax
je 0x404610
mov rax, qword [0x0041bca8]
mov rcx, r15
mov edx, 0x195
mov word [rax], 0
call r14
lea rcx, [0x0041bcc0]
mov edx, eax
call fcn.004012a9
jmp 0x404634
lea rcx, str._shellImDiskMountFile
call fcn.004014a3
lea rcx, str.Drive_shellImDiskSaveImage
call fcn.004014a3
lea rcx, str.Drive_shellImDiskUnmount
call fcn.004014a3
cmp word [0x0041b840], 0
je 0x404744
lea rdx, [0x0041b840]
lea rcx, [0x0041baa0]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x404744
cmp dword [0x0041bf94], 0
je 0x4046a2
lea rdx, [0x0041b840]
xor ebx, ebx
lea rcx, [0x0041bcc0]
call sub.msvcrt.dll_wcscpy
lea rsi, str.DevioNet.dll
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [0x0041bca8], rax
mov r12, qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x4046fb
mov rdx, qword [0x0040b108]
mov r8, qword [0x0040b020]
test rdx, rdx
jne 0x4046bc
lea rdx, str.The_previous_installation_is_in_another_folder._nDo_you_want_to_remove_it_
mov r9d, 0x24
mov rcx, r15
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x404744
jmp 0x404666
call rdi
cmp eax, 5
jne 0x4046f2
lea rcx, [0x0041bcc0]
mov r8d, 4
xor edx, edx
call r12
mov byte [0x0041bfad], 1
inc rbx
cmp rbx, 0xd
je 0x40470a
mov rcx, qword [rsi + rbx*8]
call entry0
test eax, eax
jne 0x4046f2
jmp 0x4046d2
mov rax, qword [0x0041bca8]
lea rcx, [0x0041bcc0]
mov word [rax - 2], 0
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x404744
lea rcx, [0x0041bcc0]
mov r8d, 4
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x0041bfad], 1
test ebp, ebp
je 0x40476f
mov qword [rsp + 0x20], 0
lea r9, [0x004023b1]
mov r8, r15
mov rcx, qword [0x0041c078]
lea rdx, str.DOTNETBOX
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp byte [0x0041bfad], 0
je 0x404791
cmp dword [0x0041bf94], 1
jg 0x4047f6
xor r8d, r8d
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupPromptReboot]
jmp 0x4047f6
test ebp, ebp
jne 0x4047f6
cmp dword [0x0041bf94], 0
jne 0x4047f6
mov rdx, qword [0x0040b110]
test rdx, rdx
jne 0x4047b1
lea rdx, str.Installation_finished.
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcscpy
cmp dword [0x0041c084], 5
jbe 0x4047d9
lea rdx, [0x004083b2]
lea rcx, [0x0040b280]
call sub.msvcrt.dll_wcscat
mov r9d, 0x40
mov r8, qword [0x0040b020]
mov rcx, r15
lea rdx, [0x0040b280]
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_EndDialog]
nop
add rsp, 0x3d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret