Function at 0x100007904
Capabilities:
Create thread
Get common file path
Get file attributes
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1810
call fcn.1000078c0
sub rsp, rax
mov rax, qword [0x1000f6188]
xor rax, rsp
mov qword [rsp + 0x1800], rax
lea rdx, [0x1000b26b0]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r11, [rsp + 0xb8]
mov r14d, 4
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x110]
mov r9d, r14d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ntdll.dll_NtQueryLicenseValue]
xor edi, edi
cmp eax, edi
jl 0x100007999
cmp dword [rsp + 0x64], r14d
jne 0x10003d882
cmp dword [rsp + 0x6c], edi
je 0x10003d882
mov rcx, qword [rsp + 0x1800]
xor rcx, rsp
call fcn.1000011e0
lea r11, [rsp + 0x1810]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x4c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov esi, 1
mov r12d, 0x104
cmp eax, edi
je 0x10003e770
cmp dword [rsp + 0x4c], edi
je 0x10003e01c
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
cmp eax, edi
je 0x10003e770
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov ebp, edi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r13, rax
cmp rax, rdi
je 0x10003e007
lea rdx, str.sppuinotify
mov r8d, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
cmp rax, rdi
je 0x10003d987
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, edi
jne 0x10003d97e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10003d97e
mov ebx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, rdi
jne 0x10003d949
mov ebp, esi
jmp 0x10003d97e
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, edi
je 0x10003d96a
cmp dword [rbx + 4], r14d
cmovne ebp, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebp, edi
je 0x10003e007
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov ebp, edi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r13, rax
cmp rax, rdi
je 0x10003e007
lea rdx, str.sppsvc
mov r8d, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
cmp rax, rdi
je 0x10003da56
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, edi
jne 0x10003da4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10003da4d
mov ebx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, rdi
jne 0x10003da18
mov ebp, esi
jmp 0x10003da4d
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, edi
je 0x10003da39
cmp dword [rbx + 4], r14d
cmovne ebp, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebp, edi
je 0x10003e007
xor r9d, r9d
lea rax, [rsp + 0xfc0]
xor r8d, r8d
lea edx, [r9 + 0x25]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jl 0x10003e007
lea r8, [rsp + 0xfc0]
lea rax, [rsp + 0xdb0]
mov r12d, 0x104
lea rcx, [rsp + 0xdb0]
mov r9d, edi
sub r8, rax
mov rdx, r12
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x10003dad7
movzx eax, word [r8 + rcx]
cmp ax, di
je 0x10003dad7
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x10003dab5
mov r14d, 0x8007007a
cmp rdx, rdi
jne 0x10003dae9
sub rcx, 2
mov r9d, r14d
cmp r9d, edi
mov word [rcx], di
jl 0x10003e007
lea r8, str._sppuinotify.dll
lea rcx, [rsp + 0xdb0]
mov rdx, r12
call fcn.1000159d0
cmp eax, edi
jl 0x10003e007
lea rcx, [rsp + 0xdb0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or r15d, 0xffffffff
cmp eax, r15d
je 0x10003e007
lea r8, [rsp + 0x8c]
lea rdx, [rsp + 0xdb0]
xor ecx, ecx
mov r13d, edi
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov ebp, eax
cmp eax, edi
jbe 0x10003e007
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
cmp rax, rdi
je 0x10003dc69
mov r8d, dword [rsp + 0x8c]
lea rdx, [rsp + 0xdb0]
mov r9d, ebp
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.VERSION.dll_GetFileVersionInfoExW
cmp eax, edi
je 0x10003dc4c
lea r9, [rsp + 0x54]
lea r8, [rsp + 0xf8]
lea rdx, str.VarFileInfoTranslation
mov rcx, r12
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003dc4c
cmp dword [rsp + 0x54], 4
jb 0x10003dc4c
mov rax, qword [rsp + 0xf8]
lea r8, str.StringFileInfo_04x_04xOriginalFilename
mov edx, 0x30
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x120]
call fcn.1000039fc
cmp eax, edi
jl 0x10003dc4c
lea r9, [rsp + 0x74]
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x120]
mov rcx, r12
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003dc4c
mov ebx, dword [rsp + 0x74]
lea rcx, [rsp + 0xdb0]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0x98]
mov r8, rbx
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, edi
cmove r13d, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, edi
je 0x10003e007
lea r8, [rsp + 0xfc0]
lea rax, [rsp + 0x780]
mov r12d, 0x104
lea rcx, [rsp + 0x780]
mov r9d, edi
sub r8, rax
mov rdx, r12
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x10003dcb2
movzx eax, word [r8 + rcx]
cmp ax, di
je 0x10003dcb2
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x10003dc90
cmp rdx, rdi
jne 0x10003dcbe
sub rcx, 2
mov r9d, r14d
cmp r9d, edi
mov word [rcx], di
jl 0x10003e007
lea r8, str._slui.exe
lea rcx, [rsp + 0x780]
mov rdx, r12
call fcn.1000159d0
cmp eax, edi
jl 0x10003e007
lea rcx, [rsp + 0x780]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r15d
je 0x10003e007
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x780]
xor ecx, ecx
mov r13d, edi
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov r12d, eax
cmp eax, edi
jbe 0x10003e007
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
cmp rax, rdi
je 0x10003de3b
mov r8d, dword [rsp + 0x5c]
lea rdx, [rsp + 0x780]
mov r9d, r12d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.VERSION.dll_GetFileVersionInfoExW
cmp eax, edi
je 0x10003de1e
lea r9, [rsp + 0x84]
lea r8, [rsp + 0xe8]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003de1e
cmp dword [rsp + 0x84], 4
jb 0x10003de1e
mov rax, qword [rsp + 0xe8]
lea r8, str.StringFileInfo_04x_04xOriginalFilename
mov edx, 0x30
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x1e0]
call fcn.1000039fc
cmp eax, edi
jl 0x10003de1e
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0x1e0]
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003de1e
mov ebx, dword [rsp + 0x40]
lea rcx, [rsp + 0x780]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0xc8]
mov r8, rbx
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, edi
cmove r13d, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, edi
je 0x10003e007
lea r8, [rsp + 0xfc0]
lea rax, [rsp + 0x360]
mov r12d, 0x104
lea rcx, [rsp + 0x360]
mov r9d, edi
sub r8, rax
mov rdx, r12
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x10003de84
movzx eax, word [r8 + rcx]
cmp ax, di
je 0x10003de84
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x10003de62
cmp rdx, rdi
jne 0x10003de90
sub rcx, 2
mov r9d, r14d
cmp r9d, edi
mov word [rcx], di
jl 0x10003e007
lea r8, str._sppsvc.exe
lea rcx, [rsp + 0x360]
mov rdx, r12
call fcn.1000159d0
cmp eax, edi
jl 0x10003e007
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r15d
je 0x10003e007
lea r8, [rsp + 0x7c]
lea rdx, [rsp + 0x360]
xor ecx, ecx
mov r12d, edi
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov r13d, eax
cmp eax, edi
jbe 0x10003e007
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
cmp rax, rdi
je 0x10003e003
mov r8d, dword [rsp + 0x7c]
lea rdx, [rsp + 0x360]
mov r9d, r13d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.VERSION.dll_GetFileVersionInfoExW
cmp eax, edi
je 0x10003dfea
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x108]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003dfea
cmp dword [rsp + 0x44], 4
jb 0x10003dfea
mov rax, qword [rsp + 0x108]
lea r8, str.StringFileInfo_04x_04xOriginalFilename
mov edx, 0x30
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x2a0]
call fcn.1000039fc
cmp eax, edi
jl 0x10003dfea
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x2a0]
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003dfea
mov ebx, dword [rsp + 0x48]
lea rcx, [rsp + 0x360]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0xd8]
mov r8, rbx
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, edi
cmove r12d, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12d, edi
je 0x10003e007
mov ebx, esi
jmp 0x10003e009
mov ebx, edi
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x10003e762
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov ebp, edi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r13, rax
cmp rax, rdi
je 0x10003e760
lea rdx, str.sppuinotify
mov r8d, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
cmp rax, rdi
je 0x10003e0da
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, edi
jne 0x10003e0d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10003e0d1
mov ebx, dword [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, rdi
jne 0x10003e09c
mov ebp, esi
jmp 0x10003e0d1
mov r8d, dword [rsp + 0x34]
lea r9, [rsp + 0x34]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, edi
je 0x10003e0bd
cmp dword [rbx + 4], r14d
cmovne ebp, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebp, edi
je 0x10003e760
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov ebp, edi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r13, rax
cmp rax, rdi
je 0x10003e760
lea rdx, str.sppsvc
mov r8d, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
cmp rax, rdi
je 0x10003e1a9
lea r9, [rsp + 0x3c]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, edi
jne 0x10003e1a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10003e1a0
mov ebx, dword [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, rdi
jne 0x10003e16b
mov ebp, esi
jmp 0x10003e1a0
mov r8d, dword [rsp + 0x3c]
lea r9, [rsp + 0x3c]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, edi
je 0x10003e18c
cmp dword [rbx + 4], r14d
cmovne ebp, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebp, edi
je 0x10003e760
xor r9d, r9d
lea rax, [rsp + 0x11d0]
xor r8d, r8d
lea edx, [r9 + 0x25]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jl 0x10003e760
lea r8, [rsp + 0x11d0]
lea rax, [rsp + 0xba0]
mov r12d, 0x104
lea rcx, [rsp + 0xba0]
mov r9d, edi
sub r8, rax
mov rdx, r12
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x10003e22a
movzx eax, word [r8 + rcx]
cmp ax, di
je 0x10003e22a
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x10003e208
mov r14d, 0x8007007a
cmp rdx, rdi
jne 0x10003e23c
sub rcx, 2
mov r9d, r14d
cmp r9d, edi
mov word [rcx], di
jl 0x10003e760
lea r8, str._sppuinotify.dll
lea rcx, [rsp + 0xba0]
mov rdx, r12
call fcn.1000159d0
cmp eax, edi
jl 0x10003e760
lea rcx, [rsp + 0xba0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or r15d, 0xffffffff
cmp eax, r15d
je 0x10003e760
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xba0]
xor ecx, ecx
mov r13d, edi
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov ebp, eax
cmp eax, edi
jbe 0x10003e760
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
cmp rax, rdi
je 0x10003e3b6
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0xba0]
mov r9d, ebp
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.VERSION.dll_GetFileVersionInfoExW
cmp eax, edi
je 0x10003e399
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xb0]
lea rdx, str.VarFileInfoTranslation
mov rcx, r12
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003e399
cmp dword [rsp + 0x58], 4
jb 0x10003e399
mov rax, qword [rsp + 0xb0]
lea r8, str.StringFileInfo_04x_04xOriginalFilename
mov edx, 0x30
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x180]
call fcn.1000039fc
cmp eax, edi
jl 0x10003e399
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x180]
mov rcx, r12
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003e399
mov ebx, dword [rsp + 0x60]
lea rcx, [rsp + 0xba0]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0xc0]
mov r8, rbx
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, edi
cmove r13d, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, edi
je 0x10003e760
lea r8, [rsp + 0x11d0]
lea rax, [rsp + reloc.MFC42u.dll_CMonikerFile::Detach]
mov r12d, 0x104
lea rcx, [rsp + reloc.MFC42u.dll_CMonikerFile::Detach]
mov r9d, edi
sub r8, rax
mov rdx, r12
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x10003e3ff
movzx eax, word [r8 + rcx]
cmp ax, di
je 0x10003e3ff
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x10003e3dd
cmp rdx, rdi
jne 0x10003e40b
sub rcx, 2
mov r9d, r14d
cmp r9d, edi
mov word [rcx], di
jl 0x10003e760
lea r8, str._slui.exe
lea rcx, [rsp + reloc.MFC42u.dll_CMonikerFile::Detach]
mov rdx, r12
call fcn.1000159d0
cmp eax, edi
jl 0x10003e760
lea rcx, [rsp + reloc.MFC42u.dll_CMonikerFile::Detach]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r15d
je 0x10003e760
lea r8, [rsp + 0x68]
lea rdx, [rsp + reloc.MFC42u.dll_CMonikerFile::Detach]
xor ecx, ecx
mov r13d, edi
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov r12d, eax
cmp eax, edi
jbe 0x10003e760
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
cmp rax, rdi
je 0x10003e582
mov r8d, dword [rsp + 0x68]
lea rdx, [rsp + reloc.MFC42u.dll_CMonikerFile::Detach]
mov r9d, r12d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.VERSION.dll_GetFileVersionInfoExW
cmp eax, edi
je 0x10003e565
lea r9, [rsp + 0x70]
lea r8, [rsp + 0xd0]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003e565
cmp dword [rsp + 0x70], 4
jb 0x10003e565
mov rax, qword [rsp + 0xd0]
lea r8, str.StringFileInfo_04x_04xOriginalFilename
mov edx, 0x30
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x240]
call fcn.1000039fc
cmp eax, edi
jl 0x10003e565
lea r9, [rsp + 0x78]
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0x240]
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003e565
mov ebx, dword [rsp + 0x78]
lea rcx, [rsp + reloc.MFC42u.dll_CMonikerFile::Detach]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0xe0]
mov r8, rbx
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, edi
cmove r13d, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, edi
je 0x10003e760
lea r8, [rsp + 0x11d0]
lea rax, [rsp + 0x570]
mov r12d, 0x104
lea rcx, [rsp + 0x570]
mov r9d, edi
sub r8, rax
mov rdx, r12
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x10003e5cb
movzx eax, word [r8 + rcx]
cmp ax, di
je 0x10003e5cb
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x10003e5a9
cmp rdx, rdi
jne 0x10003e5d7
sub rcx, 2
mov r9d, r14d
cmp r9d, edi
mov word [rcx], di
jl 0x10003e760
lea r8, str._sppsvc.exe
lea rcx, [rsp + 0x570]
mov rdx, r12
call fcn.1000159d0
cmp eax, edi
jl 0x10003e760
lea rcx, [rsp + 0x570]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r15d
je 0x10003e760
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x570]
xor ecx, ecx
mov r12d, edi
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov r13d, eax
cmp eax, edi
jbe 0x10003e760
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
cmp rax, rdi
je 0x100007999
mov r8d, dword [rsp + 0x80]
lea rdx, [rsp + 0x570]
mov r9d, r13d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.VERSION.dll_GetFileVersionInfoExW
cmp eax, edi
je 0x10003e743
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xf0]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003e743
cmp dword [rsp + 0x88], 4
jb 0x10003e743
mov rax, qword [rsp + 0xf0]
lea r8, str.StringFileInfo_04x_04xOriginalFilename
mov edx, 0x30
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x300]
call fcn.1000039fc
cmp eax, edi
jl 0x10003e743
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x300]
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x10003e743
mov ebx, dword [rsp + 0x90]
lea rcx, [rsp + 0x570]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0x100]
mov r8, rbx
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, edi
cmove r12d, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12d, edi
jne 0x100007999
mov ebx, edi
cmp ebx, edi
jne 0x100007999
mov r12d, 0x104
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, edi
jne 0x100007999
mov r8d, esi
mov edx, 0x1acb
xor ecx, ecx
call sub.ntdll.dll_WinSqmIncrementDWORD
xchg dword [0x1000fd318], esi
lea rcx, [0x100000000]
cmp esi, edi
je 0x10003e7e8
lea r8, [rsp + 0x13e0]
mov r9d, r12d
mov edx, 0xc804
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, edi
je 0x100007999
lea rdx, [rsp + 0x13e0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, rdi
je 0x100007999
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x100007999
lea rdx, [rsp + 0x15f0]
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, edi
je 0x100007999
cmp eax, r12d
jne 0x10003e815
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x100007999
lea rcx, [rsp + 0x15f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, rdi
je 0x100007999
lea rax, [rsp + 0xa8]
lea r8, [0x100084bb0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, rdi
je 0x10003e864
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100007999
xchg dword [0x1000fd318], edi
jmp 0x100007999