Function at 0x7ffbf1cc2158
Capabilities:
Get disk size
Get memory capacity
Query environment variable
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5a8
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov rbp, r9
mov qword [rsp + 0x60], r9
mov r12, r8
mov qword [rsp + 0x68], r8
mov ebx, edx
mov rsi, rcx
call fcn.7ffbf1cc2b0c
xor r14d, r14d
cmp eax, r14d
je 0x7ffbf1cc22c1
mov rax, qword [0x7ffbf1d6b030]
mov qword [rsp + 0x58], rax
mov rdi, rax
cmp rax, r14
jne 0x7ffbf1cc2288
cmp qword [0x7ffbf1d6ab40], r14
je 0x7ffbf1cc22c1
mov rax, qword [0x7ffbf1d6b028]
cmp rax, r14
je 0x7ffbf1cc22c1
lea rdx, [0x7ffbf1cb5678]
lea rcx, [rsp + 0xb0]
call rax
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x58]
mov edx, 0x100001
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], r14
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov dword [rsp + 0x20], 7
call qword [0x7ffbf1d6ab40]
cmp eax, r14d
jl 0x7ffbf1cc22c1
mov rcx, qword [rsp + 0x58]
xor eax, eax
lock cmpxchg qword [0x7ffbf1d6b030], rcx
mov rdi, rax
je 0x7ffbf1cc2283
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], rdi
jmp 0x7ffbf1cc2288
mov rdi, qword [rsp + 0x58]
mov eax, dword [rbp]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov r9d, ebx
mov r8, rsi
mov edx, 0x390008
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r14d
je 0x7ffbf1cc22c1
mov eax, 1
jmp 0x7ffbf1cc2ae6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0xe04
xor edx, edx
mov rcx, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
cmp rax, r14
jne 0x7ffbf1cc22e9
xor eax, eax
jmp 0x7ffbf1cc2ae6
mov rcx, rdi
cmp ebx, ecx
ja 0x7ffbf1cc295a
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.7ffbf1cd51bc
lea r11d, [rbx + 8]
mov r13d, 0xfffffff8
and r11d, r13d
mov rax, rdi
cmp r11d, eax
jbe 0x7ffbf1cc231f
mov edi, r14d
jmp 0x7ffbf1cc295a
mov ebx, r11d
sub edi, r11d
add rbx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx], eax
cmp edi, 8
jb 0x7ffbf1cc2317
add edi, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 8], eax
cmp edi, 8
jb 0x7ffbf1cc2317
add edi, r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x10], eax
cmp edi, 8
jb 0x7ffbf1cc2317
add edi, r13d
add rbx, 0x18
cmp edi, 0x10
jb 0x7ffbf1cc295a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, 0x18
cmp edi, esi
jb 0x7ffbf1cc2317
add edi, 0xffffffe8
add rbx, rsi
cmp edi, 8
jb 0x7ffbf1cc295a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp edi, 0x10
jb 0x7ffbf1cc2317
add edi, 0xfffffff0
cmp edi, 0x38
jb 0x7ffbf1cc295a
lea rcx, [rbx + 0x10]
mov dword [rbx + 0x10], 0x38
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp edi, 0x40
jb 0x7ffbf1cc2317
add edi, 0xffffffc0
add rbx, 0x50
cmp edi, 0x10
jb 0x7ffbf1cc295a
lea rax, [rbx + 0xc]
lea r9, [rbx + 8]
lea r8, [rbx + 4]
mov rdx, rbx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp edi, esi
jb 0x7ffbf1cc2317
add rbx, rsi
add edi, 0xffffffe8
cmp dword [0x7ffbf1d6a6f8], r14d
jne 0x7ffbf1cc24e2
mov r13d, r14d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, rax
cmp rax, r14
jne 0x7ffbf1cc242c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov r13d, 1
mov rsi, rax
cmp rax, r14
je 0x7ffbf1cc24cd
lea rcx, [rsp + 0xd0]
call fcn.7ffbf1cd5304
mov r12, rsi
mov ebp, r14d
mov eax, ebp
test r13d, r13d
jne 0x7ffbf1cc245a
lea r12, [r12 + rax + 2]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
add ebp, ebp
jmp 0x7ffbf1cc246a
lea r12, [r12 + rax + 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
lea r8, [rsp + 0xd0]
mov edx, ebp
mov rcx, r12
call fcn.7ffbf1cd5340
test ebp, ebp
jne 0x7ffbf1cc243f
lea rdx, [rsp + 0x12c]
lea rcx, [rsp + 0xd0]
call fcn.7ffbf1cd55e0
lea rcx, [0x7ffbf1d6ab18]
lea rdx, [rsp + 0x12c]
lea r8d, [rbp + 0x14]
call fcn.7ffbf1cd51bc
mov rcx, rsi
cmp r13d, r14d
jne 0x7ffbf1cc24bd
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x7ffbf1cc24c3
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov dword [0x7ffbf1d6a6f8], 1
mov esi, 0x18
mov r13d, 0xfffffff8
cmp edi, 0x14
jb 0x7ffbf1cc295a
mov rax, qword [0x7ffbf1d6ab18]
mov qword [rbx], rax
mov rax, qword [0x7ffbf1d6ab20]
mov qword [rbx + 8], rax
mov eax, dword [0x7ffbf1d6ab28]
mov dword [rbx + 0x10], eax
cmp edi, esi
jb 0x7ffbf1cc2317
add rbx, rsi
add edi, 0xffffffe8
call fcn.7ffbf1cc2b0c
cmp eax, r14d
je 0x7ffbf1cc295a
cmp edi, 0x40
jb 0x7ffbf1cc295a
mov rax, qword [0x7ffbf1d6ab38]
cmp rax, r14
je 0x7ffbf1cc295a
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
lea ecx, [r9 + 5]
mov dword [rsp + 0x50], edi
call rax
cmp edi, 0x14
jb 0x7ffbf1cc295a
lea rcx, [rsp + 0x140]
call fcn.7ffbf1cd5304
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x140]
mov rcx, rbx
call fcn.7ffbf1cd5340
lea rcx, [rsp + 0x140]
mov rdx, rbx
call fcn.7ffbf1cd55e0
cmp edi, esi
jb 0x7ffbf1cc2317
add edi, 0xffffffe8
add rbx, rsi
cmp edi, 0x30
jb 0x7ffbf1cc295a
mov r8d, 0x30
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 - 0x2d]
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc25d8
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x7ffbf1cc2317
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, esi
jb 0x7ffbf1cc295a
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, rbx
mov ecx, 7
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc2614
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x7ffbf1cc2317
mov eax, ecx
add rbx, rax
sub edi, ecx
mov r8d, 0xa8
cmp edi, r8d
jb 0x7ffbf1cc295a
lea r9, [rsp + 0x50]
lea ecx, [r8 - 0x58]
mov rdx, rbx
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc2653
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x7ffbf1cc2317
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, 0x40
jb 0x7ffbf1cc295a
mov r8d, 0x40
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 - 0x2b]
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc2692
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x7ffbf1cc2317
mov eax, ecx
add rbx, rax
sub edi, ecx
mov r8d, 0x148
cmp edi, r8d
jb 0x7ffbf1cc295a
lea r9, [rsp + 0x50]
mov rdx, rbx
mov ecx, 2
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc26d2
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x7ffbf1cc2317
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, 0x10
jb 0x7ffbf1cc295a
mov r8d, 0x10
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 + 0x11]
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc2711
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x7ffbf1cc2317
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, 0x20
jb 0x7ffbf1cc295a
mov r8d, 0x20
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 + 0xd]
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc2750
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x7ffbf1cc2317
mov eax, ecx
add rbx, rax
sub edi, ecx
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 8
mov dword [rsp + 0x50], edi
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc27bf
cmp edi, 0x14
jb 0x7ffbf1cc295a
lea rcx, [rsp + 0x290]
call fcn.7ffbf1cd5304
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x290]
mov rcx, rbx
call fcn.7ffbf1cd5340
lea rcx, [rsp + 0x290]
mov rdx, rbx
call fcn.7ffbf1cd55e0
cmp edi, esi
jb 0x7ffbf1cc2317
mov r13d, 0xffffffe8
add rbx, rsi
add edi, r13d
jmp 0x7ffbf1cc27c5
mov r13d, 0xffffffe8
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x3d
mov dword [rsp + 0x50], edi
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc282c
cmp edi, 0x14
jb 0x7ffbf1cc295a
lea rcx, [rsp + 0x1b0]
call fcn.7ffbf1cd5304
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x1b0]
mov rcx, rbx
call fcn.7ffbf1cd5340
lea rcx, [rsp + 0x1b0]
mov rdx, rbx
call fcn.7ffbf1cd55e0
cmp edi, esi
jb 0x7ffbf1cc2317
add rbx, rsi
add edi, r13d
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x12
mov dword [rsp + 0x50], edi
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc2893
cmp edi, 0x14
jb 0x7ffbf1cc295a
lea rcx, [rsp + 0x220]
call fcn.7ffbf1cd5304
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x220]
mov rcx, rbx
call fcn.7ffbf1cd5340
lea rcx, [rsp + 0x220]
mov rdx, rbx
call fcn.7ffbf1cd55e0
cmp edi, esi
jb 0x7ffbf1cc2317
add rbx, rsi
add edi, r13d
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x17
mov dword [rsp + 0x50], edi
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc28fa
cmp edi, 0x14
jb 0x7ffbf1cc295a
lea rcx, [rsp + 0x300]
call fcn.7ffbf1cd5304
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x300]
mov rcx, rbx
call fcn.7ffbf1cd5340
lea rcx, [rsp + 0x300]
mov rdx, rbx
call fcn.7ffbf1cd55e0
cmp edi, esi
jb 0x7ffbf1cc2317
add rbx, rsi
add edi, r13d
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x2a
mov dword [rsp + 0x50], edi
call qword [0x7ffbf1d6ab38]
cmp eax, r14d
jl 0x7ffbf1cc295a
cmp edi, 0x14
jb 0x7ffbf1cc295a
lea rcx, [rsp + 0x370]
call fcn.7ffbf1cd5304
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x370]
mov rcx, rbx
call fcn.7ffbf1cd5340
lea rcx, [rsp + 0x370]
mov rdx, rbx
call fcn.7ffbf1cd55e0
cmp edi, esi
jb 0x7ffbf1cc2317
add edi, r13d
mov esi, 0x50
lea rcx, [rsp + 0x4f0]
lea rdx, [0x7ffbf1d6a580]
mov r8, rsi
call fcn.7ffbf1cd51bc
lea r8, [rsp + 0x4f0]
lea rcx, [rsp + 0x3e0]
mov edx, esi
call fcn.7ffbf1d1e4ec
mov eax, 0xe04
lea r8, [rsp + 0x4f0]
mov edx, eax
mov rcx, r15
sub edx, edi
cmp edx, eax
cmova edx, eax
call fcn.7ffbf1cc2c8c
lea rcx, [rsp + 0x540]
lea rdx, [rsp + 0x4f0]
mov r8, rsi
mov ebx, eax
call fcn.7ffbf1cd51bc
lea rcx, [0x7ffbf1d6a580]
lea rdx, [rsp + 0x4f0]
mov r8, rsi
call fcn.7ffbf1cd51bc
lea r8, [rsp + 0x540]
lea rcx, [rsp + 0x3e0]
mov edx, esi
call fcn.7ffbf1d1e494
lea rdx, [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
lea rdx, [0x7ffbf1cb5700]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, r14d
jne 0x7ffbf1cc2a6d
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x540]
lea r9d, [rsi - 0x4d]
lea rdx, [0x7ffbf1cb56f8]
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea rdi, [rsp + 0x540]
mov rcx, rsi
rep stosb byte [rdi], al
lea r8, [rsp + 0x4f0]
lea rcx, [rsp + 0x3e0]
mov edx, esi
call fcn.7ffbf1d1e4ec
mov edx, dword [rbp]
xor eax, eax
lea rdi, [rsp + 0x4f0]
mov rcx, rsi
mov r8, r12
rep stosb byte [rdi], al
lea rcx, [rsp + 0x3e0]
call fcn.7ffbf1d1e494
xor eax, eax
lea rdi, [rsp + 0x3e0]
mov ecx, 0x108
rep stosb byte [rdi], al
mov rdi, r15
mov ecx, 0xe04
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.7ffbf1d2cc34
add rsp, 0x5a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret