Function at 0x140024a2c
Capabilities:
Get common file path
Persist via run registry key
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xbd0]
sub rsp, 0xcd0
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0xbc0], rax
mov r15, qword [rcx + 0x30]
xor ebx, ebx
mov dword [rsp + 0x50], edx
mov r12d, r9d
mov r14d, edx
mov rsi, rcx
mov edi, ebx
cmp edx, 3
je 0x140024a9c
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x140024a9c
call fcn.140019eb0
test eax, eax
je 0x140024a9c
mov rcx, rsi
call fcn.140022b30
mov edi, eax
test eax, eax
js 0x14002529f
test r15, r15
jne 0x140024aab
mov eax, 0x80004003
jmp 0x14002529f
mov rcx, r15
call fcn.140019eb0
test eax, eax
jne 0x140024ac1
mov eax, 0x80070002
jmp 0x14002529f
mov ecx, dword [rsi + 0x58]
test ecx, ecx
je 0x14002527a
sub ecx, 1
je 0x140024ea2
sub ecx, 1
je 0x140024dfd
sub ecx, 1
je 0x140024dfd
sub ecx, 1
je 0x140024dfd
sub ecx, 1
je 0x140024cb4
cmp ecx, 1
jne 0x14002527a
mov r14d, 0x104
lea rcx, [rbp - 0x80]
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140024b43
lea r8, str._rundll32.exe
mov edx, r14d
lea rcx, [rbp - 0x80]
call fcn.140010470
test eax, eax
js 0x140024b43
lea rcx, [rbp - 0x80]
call fcn.140019eb0
test eax, eax
jne 0x140024b8c
mov edx, 0x103
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140024c99
lea r8, str._rundll32.exe
mov rdx, r14
lea rcx, [rbp - 0x80]
call fcn.140010470
test eax, eax
js 0x140024c99
lea rcx, [rbp - 0x80]
call fcn.140019eb0
test eax, eax
je 0x140024c99
neg r12d
lea rax, [0x140040718]
lea r9, [rbp - 0x80]
mov edx, 0x208
sbb ecx, ecx
lea r8, str._s_advpack.dll_LaunchINFSectionEx__s__s___lu_N
and ecx, 0x200
add ecx, 0x2c
cmp qword [rsi + 0x28], rbx
mov dword [rsp + 0x30], ecx
lea rcx, [rbp + 0x7b0]
cmovne rax, qword [rsi + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call fcn.1400104f4
lea rdx, [rbp + 0x190]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
mov r8, r15
lea rcx, [rbp + 0x5a0]
mov rdx, r14
call fcn.1400104bc
mov edx, 0x5c
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x140024c1c
mov word [rax], bx
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop dword [rax + rax]
mov r8d, dword [rsi + 0x70]
lea rdx, [rbp + 0x7b0]
mov r9d, 0xffff
lea rcx, [rbp - 0x80]
call fcn.140019884
test eax, eax
je 0x140024c51
mov edi, ebx
jmp 0x140024c65
call fcn.140015998
mov edi, eax
test eax, eax
jle 0x140024c65
movzx edi, ax
or edi, 0x80070000
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop dword [rax + rax]
test edi, edi
js 0x14002527f
call fcn.14001d870
test eax, eax
je 0x14002527f
lea r8, str.Advpack_INF
jmp 0x140024de9
lea rdx, str.ERROR:_Install_for_package_was_halted.__RunDll32.exe_was_not_found_on_the_system._r_n
mov ecx, 2
mov edi, 0x80070002
call fcn.140018e9c
jmp 0x14002527f
mov r14d, 0x104
lea rcx, [rbp - 0x80]
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140024ce4
lea r8, str._rundll32.exe
mov edx, r14d
lea rcx, [rbp - 0x80]
call fcn.140010470
lea rcx, [rbp - 0x80]
call fcn.140019eb0
test eax, eax
jne 0x140024d2e
mov edx, 0x103
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140024d1d
lea r8, str._rundll32.exe
mov rdx, r14
lea rcx, [rbp - 0x80]
call fcn.140010470
lea rcx, [rbp - 0x80]
call fcn.140019eb0
test eax, eax
je 0x140024c99
mov r12d, 0x208
lea r8, [rbp - 0x80]
mov edx, r12d
lea rcx, [rbp + 0x190]
call fcn.1400104bc
cmp dword [rsp + 0x50], 3
lea rax, str._setupapi_InstallHinfSection_DefaultInstall_132
lea r8, str._setupapi_InstallHinfSection_Uninstall_132
mov edx, r12d
cmovne r8, rax
lea rcx, [rbp + 0x190]
call fcn.140010470
mov r8, r15
lea rcx, [rbp + 0x190]
mov edx, r12d
call fcn.140010470
mov r8, qword [rsi + 0x28]
test r8, r8
je 0x140024d97
mov edx, r12d
lea rcx, [rbp + 0x190]
call fcn.140010470
mov r8d, dword [rsi + 0x70]
lea rdx, [rbp + 0x190]
mov r9d, 0xffff
lea rcx, [rbp - 0x80]
call fcn.140019884
test eax, eax
je 0x140024db9
mov edi, ebx
jmp 0x140024dd5
call fcn.140015998
mov edi, eax
test eax, eax
jle 0x140024dcd
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x14002527f
call fcn.14001d870
test eax, eax
je 0x14002527f
lea r8, str.Setupapi_INF
mov edx, 8
call fcn.14001d60c
mov edi, 0xd2af9
jmp 0x14002527f
mov edx, 1
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], 0x2a
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], ebx
call fcn.14001d5d8
mov rax, qword [rsi + 0xc0]
lea r8, str.Uninstall
mov qword [rsp + 0x68], rax
cmp r14d, 3
je 0x140024e3a
mov r8, qword [rsi + 0x28]
mov r9d, r12d
lea rcx, [rsp + 0x58]
mov rdx, r15
call fcn.140033548
mov edi, eax
test eax, eax
jns 0x140024e93
cmp byte [rsi + 0x94], bl
je 0x140024e77
or dword [0x140053828], 4
lea rdx, str.ERROR:_Install_of__S_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov r8, r15
mov ecx, 2
call fcn.140018ed8
mov edi, ebx
jmp 0x140024e93
mov dword [0x140053830], eax
mov rax, qword [rsi + 0xc0]
mov ecx, dword [rax + 0x64]
add ecx, dword [0x140051600]
mov dword [0x14005382c], ecx
lea rcx, [rsp + 0x58]
call fcn.1400324dc
jmp 0x14002527f
mov r8, r15
mov dword [rsp + 0x50], 1
mov edx, 0x207
lea rcx, [rbp + 0x190]
call fcn.1400104bc
mov r12d, 0x208
lea r8, reloc.ATL.DLL_AtlInternalQueryInterface
mov edx, r12d
lea rcx, [rbp + 0x190]
call fcn.140010470
mov r8, qword [rsi + 0x28]
test r8, r8
je 0x140024ef2
mov edx, r12d
lea rcx, [rbp + 0x190]
call fcn.140010470
mov rcx, qword [rsi + 0xc0]
xor edx, edx
call fcn.1400232a0
mov rcx, rax
cmp rax, 0x186a0
jae 0x140024f19
mov eax, 0xd1b71759
mul ecx
mov ecx, edx
shr ecx, 0xd
jmp 0x140024f29
mov eax, 0x4f8b588f
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x10
mov r12d, 0x64
cmp ecx, r12d
jbe 0x140024f46
mov eax, 0xcccccccd
mul ecx
shr edx, 3
mov dword [0x140053838], edx
jmp 0x140024f56
mov eax, 0x14
cmp ecx, eax
cmovb ecx, eax
mov dword [0x140053838], ecx
lea rdx, [0x1400444d0]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x140024f95
mov ecx, r12d
mov dword [0x140053840], 1
mov r14d, 0x1f4
call fcn.140018674
mov eax, dword [0x140051614]
mov dword [rsp + 0x50], eax
jmp 0x140024fb6
mov ecx, dword [0x140053838]
mov r14d, 0x1388
mov dword [0x140053840], ebx
call fcn.140018674
mov ecx, 0x26ec
call fcn.140018384
mov rcx, qword [0x140053810]
lea r9, [0x140025f50]
mov r8d, r14d
mov edx, 0x2f00
call qword [sym.imp.USER32.dll_SetTimer]
nop dword [rax + rax]
mov rcx, r15
cmp dword [rsp + 0x50], ebx
je 0x14002501f
mov r8d, dword [rsi + 0x70]
lea rdx, [rbp + 0x190]
mov r9d, 0xffff
call fcn.140019884
test eax, eax
je 0x140025002
mov edi, ebx
jmp 0x140025133
call fcn.140015998
mov edi, eax
test eax, eax
jle 0x140025133
movzx edi, ax
or edi, 0x80070000
jmp 0x140025133
lea rdx, [0x1400444d0]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14002511f
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002510c
mov r14d, 0x104
lea rcx, [rbp - 0x80]
mov edx, r14d
call fcn.14001a520
test eax, eax
je 0x1400250fb
lea r8, str.wmdbexport.exe
mov edx, r14d
lea rcx, [rbp - 0x80]
call fcn.140010470
test eax, eax
js 0x1400250fb
lea rcx, [rbp - 0x80]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400250bd
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.WMC_WMPDBExport
lea rax, [rbp - 0x80]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rdx, str.wmdbexport.exe_was_not_run_as_wmp11_installs_did_not_complete.
mov ecx, 4
call fcn.140018ed8
jmp 0x140025133
mov r8, r15
lea rdx, str.ERROR:__S_was_not_executed_as_the_WMP11_install_check_was__ve._Setup_will_not_fail_because_of_this_issue._r_n
mov ecx, 2
call fcn.140018ed8
cmp dword [0x140053840], ebx
mov ecx, r12d
jne 0x140025144
mov ecx, dword [0x140053838]
call fcn.140018480
mov rcx, qword [0x140053810]
mov edx, 0x2f00
call qword [sym.imp.USER32.dll_KillTimer]
nop dword [rax + rax]
test edi, edi
jns 0x14002518a
cmp byte [rsi + 0x94], bl
je 0x14002518a
or dword [0x140053828], 1
lea rdx, str.ERROR:_Execution_of__S_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov r8, r15
mov ecx, 2
call fcn.140018ed8
mov edi, ebx
mov r14d, 0xd2af9
cmp dword [rsi + 0x90], ebx
je 0x1400251e9
cmp edi, 0x80070bc2
je 0x1400251fa
cmp edi, 0x8007f901
jne 0x1400251ac
mov edi, ebx
jmp 0x14002520e
cmp edi, 0x8007f02a
jne 0x1400251bb
mov edi, 0xc00d2afb
jmp 0x14002520e
test edi, edi
js 0x1400251cb
mov edx, 1
call fcn.14001d5d8
jmp 0x14002520e
mov rax, qword [rsi + 0xc0]
mov dword [0x140053830], edi
mov ecx, dword [rax + 0x64]
add ecx, dword [0x140051600]
mov dword [0x14005382c], ecx
jmp 0x14002520e
test edi, edi
js 0x14002520e
call fcn.14001b6f0
cmp dword [0x140052794], eax
jae 0x14002520e
lea r8, str.External_App
mov edx, 8
call fcn.14001d60c
mov edi, r14d
mov edx, edi
mov rcx, r15
call fcn.140021f60
test eax, eax
jne 0x140025232
or dword [0x140053828], 2
lea rdx, str.ERROR:_DRM_licence_migration_failed._Setup_will_not_fail_because_of_this_issue._r_n
lea ecx, [rax + 2]
call fcn.140018ed8
lea rdx, str.wmp11.exe
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x140025268
lea rdx, str.wmp11_64.exe
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14002527f
test edi, edi
js 0x140025272
cmp edi, r14d
setne bl
mov dword [0x140051614], ebx
jmp 0x14002527f
mov edi, 0x80004005
mov r8d, edi
lea rdx, str.__Package_install_complete.__Last_result_0x_x._r_n
mov ecx, 4
call fcn.140018ed8
xor edx, edx
mov rcx, rsi
call fcn.1400220f8
mov eax, edi
mov rcx, qword [rbp + 0xbc0]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0xcd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret