Function at 0x14002fa10
Capabilities:
Copy file
Create directory
Delete service
Query environment variable

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x790]
sub rsp, 0x890
cmp byte [0x1400da620], 0
lea rbx, [0x1400da620]
mov r12d, 1
jne 0x14002fa4f
lea r8d, [r12 + 0x3b]
mov rdx, rbx
lea rcx, str._SYSTEMROOT__
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor edx, edx
lea rcx, [rbp + 0x120]
mov r8d, 0x104
call fcn.1400514f0
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x104
call fcn.1400514f0
xor edx, edx
lea rcx, [rbp + 0x230]
mov r8d, 0x104
call fcn.1400514f0
xor edx, edx
mov dword [rbp + 0x7b0], 0x104
mov r8d, 0x104
lea rcx, [rbp + 0x540]
call fcn.1400514f0
mov r8, rbx
mov dword [rbp + 0x7c0], 0x104
mov edx, 0x104
lea rcx, [rbp + 0x120]
call fcn.14007699c
lea r8, [0x1400b1998]
mov edx, 0x104
lea rcx, [rbp + 0x120]
call fcn.1400762b8
xor edx, edx
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r8, str._amdfendr
mov edx, 0x104
lea rcx, [rbp + 0x120]
call fcn.1400762b8
xor edx, edx
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rax, [rbp + 0x120]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x14002fb20
mov eax, ecx
mov byte [rbp + rax + 0x120], 0x5c
lea eax, [rcx + 1]
lea rcx, [rbp + 0x120]
add rax, rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x48], rax
mov byte [rax], 0
call fcn.14002f3e0
mov dword [rbp + 0x7c8], eax
test eax, eax
je 0x140030440
mov qword [rsp + 0x888], rsi
lea rax, [rbp + 0x7b0]
mov qword [rsp + 0x28], rax
lea r8, str.Owners
mov qword [rsp + 0x880], rdi
lea rax, [rbp + 0x230]
mov qword [rsp + 0x878], r13
lea rdx, str.SYSTEMCurrentControlSetServices_amdfendrmgr
mov qword [rsp + 0x870], r14
mov r9d, 3
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x868], r15
call fcn.140043e50
mov ecx, dword [rbp + 0x7b0]
lea r8, str.Owners
xor esi, esi
lea rdx, str.SYSTEMCurrentControlSetServices_amdlog
cmp eax, r12d
lea rax, [rbp + 0x7c0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x540]
cmovne ecx, esi
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7b0], ecx
lea r9d, [rsi + 3]
mov rcx, 0xffffffff80000002
call fcn.140043e50
mov ecx, dword [rbp + 0x7c0]
cmp eax, r12d
mov r8d, 0x200
mov r15d, esi
cmovne ecx, esi
xor edx, edx
mov dword [rbp + 0x7c0], ecx
lea rcx, [rbp + 0x340]
call fcn.1400514f0
xor r9d, r9d
mov dword [rbp + 0x7b8], 0x200
xor r8d, r8d
lea rdx, str.ROOTAMDLOG
lea rcx, [0x1400a76f8]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002fcf8
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 0x20
xor edx, edx
mov rcx, rax
mov ebx, esi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14002fcef
lea rax, [rbp + 0x7b8]
mov r8d, 4
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
mov eax, dword [rbp + 0x7b8]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rcx, rdi
lea rax, [rbp + 0x340]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x14002fcd9
lea rdx, str.amdfendrmgr
lea rcx, [rbp + 0x340]
call fcn.140078434
test eax, eax
cmove r15d, r12d
inc ebx
lea r8, [rsp + 0x50]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x14002fc81
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor edx, edx
lea rcx, [rbp + 0x340]
mov r8d, 0x200
mov r13d, esi
call fcn.1400514f0
xor r9d, r9d
mov dword [rbp + 0x7b8], 0x200
xor r8d, r8d
lea rdx, str.ROOTAMDLOG
lea rcx, [0x1400a76f8]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14002feaa
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 0x20
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14002fea1
lea rax, [rbp + 0x7b8]
mov r8d, 4
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
mov eax, dword [rbp + 0x7b8]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rcx, r14
lea rax, [rbp + 0x340]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x14002fe87
lea rdx, str.amdlog
lea rcx, [rbp + 0x340]
call fcn.140078434
test eax, eax
jne 0x14002fe87
mov r8d, r12d
xor edx, edx
xor ecx, ecx
mov r13d, r12d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x14002fdff
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x14002fe87
lea r9, str.Unable_to_open_ServiceManager.
mov r8d, r12d
mov edx, 0x60004004
call fcn.140040490
jmp 0x14002fe87
mov r8d, 0x10020
lea rdx, str.AMD_Log_Utility
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x14002fe48
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x14002fe87
lea r9, str.Unable_to_open_AMD_Log_Utility_service.
mov r8d, r12d
mov edx, 0x60004004
call fcn.140040490
jmp 0x14002fe87
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14002fe75
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x14002fe75
lea r9, str.Unable_to_delete_AMD_Log_Utility_service.
mov r8d, r12d
mov edx, 0x60004004
call fcn.140040490
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc esi
lea r8, [rsp + 0x50]
mov edx, esi
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x14002fd60
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
test r15d, r15d
jne 0x14002ff0a
mov edi, dword [rbp + 0x7b0]
test edi, edi
je 0x14002ff10
lea rbx, [rbp + 0x230]
cmp byte [rbp + 0x230], r15b
je 0x14002ff10
nop dword [rax]
xor r8d, r8d
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupUninstallOEMInfA]
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rbx + rdx], 0
jne 0x14002fee6
lea eax, [rdx + 2]
cmp eax, edi
jae 0x14002ff0a
lea ecx, [rdx + 1]
mov eax, 0xffffffff
sub eax, edx
add rbx, rcx
add edi, eax
cmp byte [rbx], 0
jne 0x14002fed0
mov edi, dword [rbp + 0x7b0]
test r13d, r13d
jne 0x14002ff70
mov esi, dword [rbp + 0x7c0]
test esi, esi
je 0x14002ff70
lea rbx, [rbp + 0x540]
cmp byte [rbp + 0x540], r13b
je 0x14002ff70
nop
xor r8d, r8d
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupUninstallOEMInfA]
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rbx + rdx], 0
jne 0x14002ff46
lea eax, [rdx + 2]
cmp eax, esi
jae 0x14002ff6a
lea ecx, [rdx + 1]
mov eax, 0xffffffff
sub eax, edx
add rbx, rcx
add esi, eax
cmp byte [rbx], 0
jne 0x14002ff30
mov edi, dword [rbp + 0x7b0]
mov dword [rsp + 0x40], 0x104
test r15d, r15d
je 0x140030260
test edi, edi
je 0x140030260
xor edx, edx
lea rcx, [rbp + 0x340]
mov r8d, 0x104
call fcn.1400514f0
lea rax, [rsp + 0x40]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea r8, str.LastKmdInstallPath
lea rax, [rbp + 0x340]
mov rcx, 0xffffffff80000002
lea rdx, [0x1400a65a8]
mov qword [rsp + 0x20], rax
call fcn.140043e50
cmp eax, r12d
jne 0x140030260
lea rax, [rbp + 0x10]
lea r8, [rbp + 0x340]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140030003
inc rax
test ecx, ecx
jne 0x14002fff0
test edx, edx
je 0x14003020a
mov esi, dword [rbp + 0x7c8]
lea rdx, [0x1400da620]
mov eax, dword [0x1400b1860]
movzx ebx, r12b
movsd xmm0, qword [str.amdfendr.itz]
xor ecx, ecx
mov qword [rbp + 0x7b8], rsi
movsd qword [rbp + rsi + 0x10], xmm0
mov dword [rbp + rsi + 0x18], eax
movzx eax, byte [0x1400b1864]
mov byte [rbp + rsi + 0x1c], al
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
mov byte [rbp + rcx + 0x650], al
lea rcx, [rcx + 1]
test al, al
jne 0x140030050
lea rcx, [rbp + 0x650]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140030070
mov eax, dword [str.INF_]
mov dword [rcx], eax
movzx eax, byte [0x1400b1a10]
mov byte [rcx + 4], al
lea rcx, [rbp + 0x650]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140030096
lea r8, [rbp + 0x230]
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400300b0
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x10]
call fcn.140030b10
test al, al
je 0x140030201
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x650]
call fcn.140030b10
test al, al
je 0x140030201
xor ebx, ebx
lea rcx, [rsp + 0x70]
xor edi, edi
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x140030100
test rax, rax
je 0x1400301ff
xor esi, esi
xor r14d, r14d
nop word [rax + rax]
movsxd r13, edi
lea rcx, [rbp - 0x40]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140030130
cmp r13, rax
jae 0x1400301f2
xor edx, edx
movsxd r12, ebx
lea rcx, [rsp + 0x70]
add rcx, r12
lea r8d, [rdx + 0xa]
call fcn.140078ad0
xor edx, edx
lea rcx, [rbp - 0x40]
add rcx, r13
mov r15d, eax
lea r8d, [rdx + 0xa]
call fcn.140078ad0
cmp r15d, eax
jg 0x140030254
jl 0x140030241
lea rax, [rsp + 0x70]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x140030190
cmp r12, rdx
jae 0x1400301b7
nop
movzx eax, byte [rsp + r14 + 0x70]
inc ebx
inc r14
cmp al, 0x2e
je 0x1400301b7
movsxd rax, ebx
cmp rax, rdx
jb 0x1400301a0
lea rax, [rbp - 0x40]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400301c2
cmp r13, rcx
jae 0x1400301e6
movzx eax, byte [rbp + rsi - 0x40]
inc edi
inc rsi
cmp al, 0x2e
je 0x1400301e6
movsxd rax, edi
cmp rax, rcx
jb 0x1400301d0
movsxd rax, ebx
cmp rax, rdx
jb 0x140030120
mov rsi, qword [rbp + 0x7b8]
mov r12d, 1
xor bl, bl
mov byte [rbp + rsi + 0x10], 0
test bl, bl
jne 0x140030260
mov eax, r12d
mov r14, qword [rsp + 0x870]
mov r13, qword [rsp + 0x878]
mov rdi, qword [rsp + 0x880]
mov rsi, qword [rsp + 0x888]
mov r15, qword [rsp + 0x868]
add rsp, 0x890
pop r12
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x7b8]
mov eax, 1
mov byte [rbp + rcx + 0x10], 0
jmp 0x14003020d
mov rcx, qword [rbp + 0x7b8]
mov byte [rbp + rcx + 0x10], 0
mov r15d, dword [rbp + 0x7c8]
lea rsi, [rbp + 0x10]
mov rdi, qword [rsp + 0x48]
lea r12, str.amdfendr.ctz
xor r13d, r13d
mov r14d, 1
mov dword [rbp + 0x7b8], r13d
add rsi, r15
mov ecx, r14d
mov ebx, r13d
mov edx, ebx
add rdx, rdx
mov rax, qword [r12 + rdx*8 + 8]
test rax, rax
je 0x14003033d
mov rdx, qword [r12 + rdx*8]
mov r8, rsi
sub r8, rdx
nop dword [rax]
movzx ecx, byte [rdx]
mov byte [rdx + r8], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400302b0
mov rdx, rdi
sub rdx, rax
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [rax + rdx], cl
lea rax, [rax + 1]
test cl, cl
jne 0x1400302d0
xor r8d, r8d
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
inc ebx
mov ecx, eax
test eax, eax
jne 0x140030290
mov dword [rbp + 0x7b8], 2
lea rax, [rbp + 0x7b8]
mov dword [rsp + 0x28], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.AmdlogInstallStatus
mov rcx, 0xffffffff80000002
lea rdx, [0x1400a65a8]
call fcn.1400442e0
mov eax, r14d
jmp 0x14003020d
test ecx, ecx
je 0x1400302fa
xor ecx, ecx
call sub.SETUPAPI.dll_CMP_WaitNoPendingInstallEvents
test eax, eax
je 0x140030390
mov eax, dword [rbp + 0x7b8]
mov r14d, r13d
cmp eax, 1
ja 0x140030304
lea rax, [rbp + 0x10]
mov dword [rsp + 0x28], r15d
mov r9d, 2
mov qword [rsp + 0x20], rax
lea r8, str.LastKmdInstallPath
mov byte [rsi], r13b
lea rdx, [0x1400a65a8]
mov rcx, 0xffffffff80000002
call fcn.1400442e0
jmp 0x140030304
xor r9d, r9d
lea rdx, [rbp + 0x120]
xor r8d, r8d
xor ecx, ecx
call sub.newdev.dll_DiInstallDriverA
test eax, eax
je 0x14003041d
mov r9d, 2
lea rcx, [0x1400a73b8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov r9d, 2
lea rdx, str.ROOTAMDXE
xor r8d, r8d
lea rcx, [0x1400a76f8]
mov rdi, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov rcx, rdi
mov rbx, rax
call fcn.140030810
mov rcx, rbx
call fcn.140030810
cmp rdi, 0xffffffffffffffff
je 0x140030402
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
cmp rbx, 0xffffffffffffffff
je 0x140030411
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov dword [rbp + 0x7b8], r14d
jmp 0x14003035a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x7b8], eax
cmp eax, 0x103
jne 0x140030355
mov dword [rbp + 0x7b8], r13d
jmp 0x14003035a
mov eax, r12d
add rsp, 0x890
pop r12
pop rbx
pop rbp
ret