Function at 0x1400010c0
Capabilities:
Delete file
Get file attributes
Get geographical location
Query or enumerate registry value
Terminate process

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x14000e008]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, str.c:prtatibminstall.log
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
jne 0x14000114a
lea r8, str.failed_to_open_log_file_fatal_err
lea rdx, [0x140007a8c]
lea rcx, [0x14000ead0]
call fcn.140005e20
xor r9d, r9d
lea r8, str.Print_ibm_install
lea rdx, [0x14000ead0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, str.____________Start_of_print_ibm_install_log______________
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwarePrintatIBM
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001722
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x48]
xor eax, eax
lea rdx, [0x14000748c]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
test eax, eax
jne 0x140001217
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000177c
lea r8, str.____________Installation_begins_no_registration_needed_______________
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call fcn.1400021b0
jmp 0x1400016cb
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000177c
lea r8, str.1._______________check_if_the_user_is_registered_______________
mov qword [rsp + 0x170], rdi
lea rdx, [0x14000c71c]
mov rcx, rax
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor edx, edx
mov dword [rsp + 0x30], 0xff
mov r8d, 0xff
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREPrintatIBM
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.IntranetID
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea r8, [rsp + 0x50]
mov edx, 0xff
lea rcx, [0x14000ef70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.Geography
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rdi, [0x14000e740]
mov edx, 0xff
mov rcx, rdi
lea r8, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.user_is_registered_in_this_geo:
mov qword [rsp + 0x28], rdi
lea r9, [0x14000ef70]
mov qword [rsp + 0x20], rax
lea r8, str.user_is_registered_with_this_id:
lea rdx, str._s_s__s_s
lea rcx, [0x14000ead0]
call fcn.140005e20
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, qword [rsp + 0x170]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000173d
lea r8, [0x14000ead0]
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
cmp byte [0x14000ef70], 0
jne 0x140001427
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000173d
lea r8, str.User_registration_not_found
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r9d, 0x10
lea r8, str.Print_IBM_Message_Registration_Error:_w3id_not_found
lea rdx, str.The_w3id_registeration_not_found._n_nPlease_verify_connection_to_the_IBM_network_and_that_this_workstation_is_joined_to_Azure_AD_using_your_primary_w3id__then_retry_this_installation.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strupr]
mov rcx, rax
lea rdx, str.UNINST
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400014a9
lea rcx, str.user_has_passed_uninst_as_a_param_so_we_will_start_to_uninstall_ricoh_code_now
call fcn.140005c20
xor r9d, r9d
lea r8, str.Print_ibm_msg
lea rdx, str.this_is_going_to_uninstall_ALL_ricoh_code_off_your_box__my_documents_or_print_at_ibm.._prts_driver_etc
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140002a50
lea rcx, str.All_should_be_deleted_now_check_there_is_no_c:program_fileslrs_dir_and_reboot
call fcn.140005c20
lea rcx, str.____________END__of_print_ibm_install_log______________
call fcn.140005c20
xor r9d, r9d
lea r8, str.Print_ibm_msg
lea rdx, str.All_Ricoh_code_etc_should_be_deleted._Please_now_reboot
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400021b0
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000177c
lea r8, str.check_the_language_the_users_system_is_using_just_in_case
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r9d, 6
lea r8, [0x14000e840]
mov ecx, 0x800
lea edx, [r9 - 3]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea r9, [0x14000e840]
lea r8, str.The_users_system_language_is:_
lea rdx, str._s_s
lea rcx, [0x14000ead0]
call fcn.140005e20
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000177c
lea r8, [0x14000ead0]
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000177c
lea r8, str._____________The_above_concludes_base_checks_on_users_reg__lang__USER_WILL_BE_ADVISED_if_they_are_NOT_registered_and_print_ibm_will_exit
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000177c
lea r8, str.2.____starting_checks_if_the_user_ever_had_any_ricoh_installed_past_or_present____
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [0x140007848]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
cmp eax, 0x10
jne 0x140001692
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000177c
lea r8, str.the_user_has_some_or_parts_of_ricoh_code_installed_as_the_c:program_fileslrs_dir_is_there_so_we_will_start_to_remove_it_here_first
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call fcn.140002a50
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000177c
lea r8, str.now_we_will_try_to_install_the_ricoh_code
jmp 0x1400016af
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000177c
lea r8, str.1._____must_be_a_clean_box_so_we_will_try_to_just_install_the_ricoh_code
lea rdx, [0x14000c71c]
mov rcx, rax
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call fcn.1400045f0
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x14000177c
lea r8, str.____________END_of_print_ibm_install_log______________
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140005f50
add rsp, 0x160
pop rbx
ret
lea r8, str.failed_to_open_log_file_fatal_err
lea rdx, [0x140007a8c]
lea rcx, [0x14000ead0]
call fcn.140005e20
xor r9d, r9d
lea r8, str.Print_ibm_install
lea rdx, [0x14000ead0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, str.failed_to_open_log_file_fatal_err
lea rdx, [0x140007a8c]
lea rcx, [0x14000ead0]
call fcn.140005e20
xor r9d, r9d
lea r8, str.Print_ibm_install
lea rdx, [0x14000ead0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3