Function at 0x1400bc980
Capabilities:
Copy file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a90]
mov eax, 0x1b90
call fcn.1401e33b0
sub rsp, rax
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x1a80], rax
lea rdx, str.UninstallerInstall::CheckUnInstVersion
lea rcx, [rbp + 0x20]
call fcn.14001abe0
nop
lea rsi, [0x1402a8360]
lea r12, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1400bca17
test byte [rcx + 0x1c], 1
je 0x1400bca17
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, recv
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1280]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xa80]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x70]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x280]
call fcn.1401e7e40
lea r15, vtable.CMap_class_ATL::CStringT_unsigned_short_int__class_StrTraitMFC_unsigned_short_int__class_ATL::ChTraitsCRT_unsigned_short_int_____unsigned_short_int_const____ptr64__unsigned_char____ptr64__unsigned_char____ptr64_.0
mov qword [rsp + 0x68], r15
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x78], reloc.COMCTL32.dll_InitCommonControls
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x14026f400]
movdqa xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
lfence
lea ecx, [r14 + 0x48]
call fcn.1401baa78
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x60], r14
mov rcx, qword [rbp - 0x80]
mov rax, rcx
neg rax
sbb rdi, rdi
test rcx, rcx
je 0x1400bcc2d
nop dword [rax]
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400bd930
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov r9, qword [rsp + 0x70]
test r9, r9
je 0x1400bd92a
mov rsi, rdi
test rdi, rdi
je 0x1400bd92a
mov r8d, dword [rsp + 0x78]
cmp rdi, 0xffffffffffffffff
jne 0x1400bcb4f
mov ecx, r14d
test r8d, r8d
je 0x1400bcb4f
mov eax, ecx
mov rsi, qword [r9 + rax*8]
test rsi, rsi
jne 0x1400bcb4f
inc ecx
cmp ecx, r8d
jb 0x1400bcb34
test rsi, rsi
je 0x1400bd92a
mov rdi, qword [rsi + 0x10]
test rdi, rdi
jne 0x1400bcb77
xor edx, edx
mov eax, dword [rsi + 0x18]
div r8d
inc edx
cmp edx, r8d
jae 0x1400bcb77
mov rdi, qword [r9 + rdx*8]
test rdi, rdi
jne 0x1400bcb77
inc edx
cmp edx, r8d
jb 0x1400bcb67
mov rdx, qword [rsi]
lea rcx, [rdx - 0x18]
lea r14, [rbx - 0x18]
cmp rcx, r14
je 0x1400bcbe2
cmp dword [r14 + 0x10], 0
jl 0x1400bcbcf
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x1400bcbcf
call fcn.140004d00
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x1400bcbc4
lfence
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
add rbx, 0x18
mov qword [rsp + 0x50], rbx
jmp 0x1400bcbe2
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140004e60
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400bcbf1
call fcn.1400079c0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400bcc17
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
test rdi, rdi
mov r14d, 0
jne 0x1400bcae0
lea rsi, [0x1402a8360]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400bcc9b
mov edi, r14d
mov edx, dword [rsp + 0x78]
test edx, edx
je 0x1400bcc91
mov eax, edi
mov rbx, qword [rcx + rax*8]
test rbx, rbx
je 0x1400bcc8b
nop dword [rax]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400bcc79
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400bcc50
mov edx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
inc edi
cmp edi, edx
jb 0x1400bcc42
call fcn.1400079c0
mov qword [rsp + 0x70], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov rcx, qword [rbp - 0x70]
call fcn.1401bc020
mov qword [rbp - 0x70], r14
mov rbx, qword [rbp - 0x60]
mov r8, qword [rbx + 8]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.140008f00
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rbp - 0x58], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea r13, str.SOFTWARECanonPrnUninst
mov rdx, r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400bcdb8
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1400bcd4c
test byte [rcx + 0x1c], 4
je 0x1400bcd4c
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, send
mov qword [rsp + 0x20], r13
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rcx, qword [0x1402a8360]
mov byte [rbp + 0x28], 1
cmp rcx, rsi
je 0x1400bcd89
test byte [rcx + 0x1c], 1
je 0x1400bcd89
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.WSOCK32.dll_recv
mov dword [rsp + 0x20], r14d
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
nop
lea rcx, [rsp + 0x60]
call fcn.140007a90
nop
lea rax, vtable.WppTrace.0
mov qword [rbp + 0x20], rax
cmp byte [rbp + 0x28], 0
jne 0x1400bd8db
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
jmp 0x1400bd898
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x1280]
lea rdx, str.UninstallerRegKeyName
mov rcx, r9
call qword [case.0x1400136d6.0]
mov qword [rsp + 0x40], r14
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1280]
lea rcx, [rsp + 0x60]
call fcn.140007cf0
test eax, eax
jne 0x1400bce67
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1400bce58
test byte [rcx + 0x1c], 4
je 0x1400bce58
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rax + 0x11]
lea rax, [rbp + 0x1280]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.14002fbe0
mov rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r14
mov dword [rbp - 0x28], reloc.COMCTL32.dll_InitCommonControls
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14026f400]
movdqa xmmword [rbp - 0x10], xmm1
mov qword [rbp], r14
mov qword [rbp + 8], r14
lfence
mov ecx, 0x48
call fcn.1401baa78
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp], rax
mov qword [rbp - 0x40], r14
mov r15, qword [rsp + 0x60]
test r15, r15
je 0x1400bd180
mov rcx, qword [rbp - 0x20]
mov rax, rcx
neg rax
sbb rdi, rdi
test rcx, rcx
je 0x1400bd024
nop dword [rax]
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400bd91f
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov r9, qword [rbp - 0x30]
test r9, r9
je 0x1400bd93b
mov rsi, rdi
test rdi, rdi
je 0x1400bd93b
mov r8d, dword [rbp - 0x28]
cmp rdi, 0xffffffffffffffff
jne 0x1400bcf4d
mov ecx, r14d
test r8d, r8d
je 0x1400bcf4d
mov eax, ecx
mov rsi, qword [r9 + rax*8]
test rsi, rsi
jne 0x1400bcf4d
inc ecx
cmp ecx, r8d
jb 0x1400bcf32
test rsi, rsi
je 0x1400bd93b
mov rdi, qword [rsi + 0x10]
test rdi, rdi
jne 0x1400bcf75
xor edx, edx
mov eax, dword [rsi + 0x18]
div r8d
inc edx
cmp edx, r8d
jae 0x1400bcf75
mov rdi, qword [r9 + rdx*8]
test rdi, rdi
jne 0x1400bcf75
inc edx
cmp edx, r8d
jb 0x1400bcf65
mov rdx, qword [rsi]
lea rcx, [rdx - 0x18]
lea r14, [rbx - 0x18]
cmp rcx, r14
je 0x1400bcfe0
cmp dword [r14 + 0x10], 0
jl 0x1400bcfcd
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x1400bcfcd
call fcn.140004d00
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x1400bcfc2
lfence
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
add rbx, 0x18
mov qword [rsp + 0x48], rbx
jmp 0x1400bcfe0
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140004e60
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400bcfef
call fcn.1400079c0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400bd015
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
test rdi, rdi
mov r14d, 0
jne 0x1400bcee0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400bd098
mov edi, r14d
mov edx, dword [rbp - 0x28]
test edx, edx
je 0x1400bd08f
nop word [rax + rax]
mov eax, edi
mov rbx, qword [rcx + rax*8]
test rbx, rbx
je 0x1400bd089
nop dword [rax + rax]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400bd079
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400bd050
mov edx, dword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
inc edi
cmp edi, edx
jb 0x1400bd040
call fcn.1400079c0
mov qword [rbp - 0x30], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov rcx, qword [rbp - 0x10]
call fcn.1401bc020
mov qword [rbp - 0x10], r14
mov rbx, qword [rbp]
mov r8, qword [rbx + 8]
lea rdx, [rbp]
lea rcx, [rbp]
call fcn.140008f00
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rbp + 8], r14
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1280]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400bd180
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rbx, str.exePath
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.140007cf0
test eax, eax
jne 0x1400bd180
mov rcx, qword [0x1402a8360]
lea rax, [0x1402a8360]
cmp rcx, rax
je 0x1400bd171
test byte [rcx + 0x1c], 4
je 0x1400bd171
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, send
mov qword [rsp + 0x30], rbx
lea rax, [rbp + 0x1280]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.14001d060
mov rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [0x1402a8360]
lea rbx, [0x1402a8360]
cmp rcx, rbx
je 0x1400bd1ca
test byte [rcx + 0x1c], 4
je 0x1400bd1ca
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.WSOCK32.dll_send
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x1400bd2a0
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400bd21d
test byte [rcx + 0x1c], 4
je 0x1400bd21d
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, socket
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rcx, qword [0x1402a8360]
mov dword [0x1402bbd98], 0x21
mov byte [rbp + 0x28], 1
cmp rcx, rbx
je 0x1400bd267
test byte [rcx + 0x1c], 1
je 0x1400bd267
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, socket
mov dword [rsp + 0x20], 0x80010021
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
nop
lea rcx, [rbp - 0x40]
call fcn.140007a90
nop
lea rcx, [rsp + 0x60]
call fcn.140007a90
nop
lea rax, vtable.WppTrace.0
mov qword [rbp + 0x20], rax
cmp byte [rbp + 0x28], 0
jne 0x1400bd8db
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
jmp 0x1400bd898
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x280]
lea rdx, str.TEMPPATH
mov rcx, r9
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x27e], 0x5c
je 0x1400bd304
lea rdx, [0x140251df8]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.Uninst.ini
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0xa80]
lea rdx, str.SOURCEDIR
mov rcx, r9
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0xa80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0xa7e], 0x5c
je 0x1400bd37c
lea rdx, [0x140251df8]
lea rcx, [rbp + 0xa80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.Uninst.ini
lea rcx, [rbp + 0xa80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400bd420
test byte [rcx + 0x1c], 4
je 0x1400bd3e1
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, socket
lea rax, [rbp + 0xa80]
mov qword [rsp + 0x20], rax
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400bd420
test byte [rcx + 0x1c], 4
je 0x1400bd420
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.WSOCK32.dll_socket
lea rax, [rbp + 0x280]
mov qword [rsp + 0x20], rax
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
xor r8d, r8d
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0xa80]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400bd473
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400bd473
test byte [rcx + 0x1c], 4
je 0x1400bd473
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rax + 0x18]
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov edx, 0x20
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x280]
lea rdx, str.TEMPPATH
mov rcx, r9
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x27e], 0x5c
je 0x1400bd4e9
lea rdx, [0x140251df8]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.UNINSTAL.exe
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0xa80]
lea rdx, str.SOURCEDIR
mov rcx, r9
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0xa80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0xa7e], 0x5c
je 0x1400bd561
lea rdx, [0x140251df8]
lea rcx, [rbp + 0xa80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.UNINSTAL.exe
lea rcx, [rbp + 0xa80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400bd605
test byte [rcx + 0x1c], 4
je 0x1400bd5c6
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x19
lea rax, [rbp + 0xa80]
mov qword [rsp + 0x20], rax
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400bd605
test byte [rcx + 0x1c], 4
je 0x1400bd605
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x1a
lea rax, [rbp + 0x280]
mov qword [rsp + 0x20], rax
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
xor r8d, r8d
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0xa80]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400bd658
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400bd658
test byte [rcx + 0x1c], 4
je 0x1400bd658
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rax + 0x1b]
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov edx, 0x20
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0xa80]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x6e], 0x5c
je 0x1400bd6b5
lea rdx, [0x140251df8]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.UNINSTAL.exe
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp - 0x50]
call fcn.140091e00
nop
mov r9d, 1
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0xa80]
lea rcx, [rbp - 0x50]
call fcn.1400948e0
test eax, eax
jg 0x1400bd723
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
lea r8, [0x140253384]
lea rdx, str.UNINSTALLSUPPORT
mov rcx, r9
call qword [case.0x1400136d6.0]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x280]
lea rdx, str.TEMPPATH
mov rcx, r9
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x27e], 0x5c
je 0x1400bd787
lea rdx, [0x140251df8]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x280]
call fcn.140019a00
lea rdx, [rbp + 0x280]
call fcn.140019bd0
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x280]
lea rdx, str.UNINSTALLSUPPORT
mov rcx, r9
call qword [case.0x1400136d6.0]
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400bd821
test byte [rcx + 0x1c], 4
je 0x1400bd821
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x1c
lea rax, [rbp + 0x280]
mov qword [rsp + 0x20], rax
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rcx, qword [0x1402a8360]
mov byte [rbp + 0x28], 1
cmp rcx, rbx
je 0x1400bd85e
test byte [rcx + 0x1c], 1
je 0x1400bd85e
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x1d
mov dword [rsp + 0x20], r14d
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
nop
lea rcx, [rbp - 0x50]
call fcn.140091f70
nop
lea rcx, [rbp - 0x40]
call fcn.140007a90
nop
lea rcx, [rsp + 0x60]
call fcn.140007a90
nop
lea rax, vtable.WppTrace.0
mov qword [rbp + 0x20], rax
cmp byte [rbp + 0x28], 0
jne 0x1400bd8db
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400bd8db
test byte [rcx + 0x1c], 1
je 0x1400bd8db
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rax, qword [rbp + 0x30]
cmp qword [0x1402bbdc8], 8
cmovae r12, qword [0x1402bbdb0]
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, [0x140252818]
mov edx, 0xa
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp + 0x50]
call fcn.1400048a0
lea rcx, [rbp + 0x30]
call fcn.1400048a0
xor eax, eax
mov rcx, qword [rbp + 0x1a80]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x1b90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001470
nop
call fcn.1401bb848
nop
mov ecx, 0x80004005
call fcn.140001470
nop
call fcn.1401bb848
int3