Function at 0x14002fcd0
Capabilities:
Create thread
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14012a210]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov rbx, rdx
mov r13, rcx
call fcn.140004080
mov rcx, rax
test rax, rax
je 0x1400302b0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.1400061c0
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.140004310
nop
mov byte [rsp + 0x50], 0
mov byte [rsp + 0x51], 0
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x58]
call fcn.1400045c0
mov rsi, 0xffffffffffffffff
mov rbx, qword [rbp - 0x10]
test eax, eax
je 0x14003023b
cmp dword [rbx - 8], 1
jle 0x14002fd8d
mov edx, dword [rbx - 0x10]
lea rcx, [rbp - 0x10]
call fcn.140006a10
mov rbx, qword [rbp - 0x10]
mov r8, rbx
lea rdx, str.CDriveHandler::PerformAction._Got_command_s.
mov rcx, qword [0x140132990]
call fcn.140011f10
lea rdx, str.disableDrives
mov rcx, rbx
call fcn.1400bc088
test eax, eax
jne 0x1400301cd
xor edi, edi
mov qword [rbp + 8], rdi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], reloc.ACTIVEDS.dll_FreeADsMem
mov byte [rbp + 8], dil
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x58]
call fcn.140004700
test eax, eax
je 0x14003018c
mov dword [rbp - 0x18], edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x58]
call fcn.1400061c0
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.140004310
nop
lea rax, [rsp + 0x58]
mov qword [rbp - 0x38], rax
call fcn.140004080
mov rcx, rax
test rax, rax
je 0x1400302bb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [0x140104fb8]
cmp rdx, 0x10000
jae 0x14002fe59
movzx edx, dx
lea rcx, [rsp + 0x58]
call fcn.1400112e0
jmp 0x14002fe78
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14002fe60
mov r8d, eax
lea rcx, [rsp + 0x58]
call fcn.140011410
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x28]
call fcn.140004860
lea rax, [rsp + 0x60]
mov qword [rbp - 0x38], rax
call fcn.140004080
mov rcx, rax
test rax, rax
je 0x1400302c6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, [0x140104fb0]
cmp rdx, 0x10000
jae 0x14002fed3
movzx edx, dx
lea rcx, [rsp + 0x60]
call fcn.1400112e0
jmp 0x14002feee
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14002fed6
mov r8d, eax
lea rcx, [rsp + 0x60]
call fcn.140011410
nop
lea r8, [rsp + 0x51]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.140004860
lea r15, str._response_:_drivesDisabled_
mov r14d, 0x1d
lea rcx, [rbp - 0x18]
cmp byte [rsp + 0x50], 0
je 0x14002ff4b
call fcn.14002e9b0
test al, al
je 0x14002ff33
mov rdx, r15
mov r8d, r14d
lea rcx, [r13 + 8]
call fcn.140006590
jmp 0x14002ff50
lea rdx, str._response_:_disableDrivesFailed_
mov r8d, 0x22
lea rcx, [r13 + 8]
call fcn.140006590
jmp 0x14002ff50
call fcn.14002edc0
cmp byte [rsp + 0x51], 0
je 0x14003015f
xor r12b, r12b
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], 7
mov r8d, 5
lea rdx, str.CDROM
lea rcx, [rsp + 0x68]
call fcn.140011160
xor r9d, r9d
mov r8b, 1
lea rdx, [rsp + 0x68]
call fcn.14002f220
mov dword [rbp - 8], 1
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsRemovableStorageDevices53f56308_b6bf_11d0_94f2_00a0c91efb8b
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140030137
mov dword [rsp + 0x28], 4
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Deny_Execute
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x30]
test eax, eax
je 0x14003001d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140030137
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp], 1
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsRemovableStorageDevices53f56308_b6bf_11d0_94f2_00a0c91efb8b
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140030137
mov dword [rsp + 0x28], 4
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Deny_Write
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
test eax, eax
je 0x1400300a9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140030137
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x20], 1
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsRemovableStorageDevices53f56308_b6bf_11d0_94f2_00a0c91efb8b
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140030137
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Deny_Read
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x38]
test eax, eax
je 0x14003012e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140030137
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12b, 1
test r12b, r12b
mov eax, 0x22
cmove r14, rax
lea rax, str._response_:_disableDrivesFailed_
cmove r15, rax
lea rcx, [r13 + 8]
mov r8, r14
mov rdx, r15
call fcn.140006590
jmp 0x140030164
call fcn.14002f010
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140016600]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rbp + 0x30]
call fcn.140063a70
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x14003023b
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400301c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400302aa
call fcn.1400a59a4
jmp 0x14003023b
lea rdx, str.enableDrives
mov rcx, rbx
call fcn.1400bc088
test eax, eax
jne 0x14003023b
xor edi, edi
mov dword [rbp - 0x20], edi
lea rcx, [rbp - 0x20]
call fcn.14002edc0
test al, al
je 0x140030208
call fcn.14002f010
test al, al
je 0x140030208
lea rdx, str._response_:_drivesEnabled_
lea r8d, [rdi + 0x1c]
jmp 0x140030215
lea rdx, str._response_:_enableDrivesFailed_
mov r8d, 0x21
lea rcx, [r13 + 8]
call fcn.140006590
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140016600]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [r13 + 8]
cmp qword [r8 + 0x18], 0x10
jb 0x140030249
mov r8, qword [r8]
lea rdx, str.CDriveHandler::PerformAction._END_bRetVal_0_and_m_strResponseJSON__S.
mov rcx, qword [0x140132990]
call fcn.140011f10
nop
lea rcx, [rbp + 0x60]
call fcn.140063a70
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14003027e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.1400a5460
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b4704
nop
mov ecx, 0x80004005
call fcn.140003f50
nop
mov ecx, 0x80004005
call fcn.140003f50
int3
mov ecx, 0x80004005
call fcn.140003f50
int3