Function at 0x1400b7b40
Capabilities:
Read .ini file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10880]
mov eax, 0x10980
call fcn.1401e33b0
sub rsp, rax
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x10870], rax
mov r15, rdx
mov qword [rsp + 0x58], rdx
mov qword [rbp - 0x68], rdx
xor esi, esi
lea rdx, str.SilentInstallManager::CheckDriverNameForSilent
lea rcx, [rbp - 0x60]
call fcn.14001abe0
nop
lea rbx, [0x1402a8360]
lea r13, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400b7c25
test byte [rcx + 0x1c], 1
je 0x1400b7bea
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rsi + 0x16]
lea r8, [0x14025b168]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400b7c25
test byte [rcx + 0x1c], 1
je 0x1400b7c25
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.WSOCK32.dll_socket
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
lea r8, [0x14025b168]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x70]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rbp + 0x870]
call fcn.1401e7e40
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
lea rcx, [rsp + 0x70]
call fcn.1401c8bf0
nop
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x70]
lea rdx, str.TEMPPATH
mov rcx, r9
call qword [case.0x1400136d6.0]
lea r8, str.InsDrv.ini
mov edx, 0x400
lea rcx, [rbp + 0x70]
call fcn.1401ec614
mov edx, 0x20
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [0x1402bbf58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x48]
lea r8, str.Driver
lea rdx, [rbp - 0x10]
mov rcx, r9
call qword [case.0x1400136d6.0]
lea r9, [rbp + 0x70]
mov r8d, 0x7fff
lea rdx, [rbp + 0x870]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jne 0x1400b7e35
mov rcx, qword [0x1402bbf68]
mov rax, qword [rcx]
lea r8, str.InsDrv.ini
mov edx, 0x19
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov byte [rbp - 0x58], 1
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400b7d86
test byte [rcx + 0x1c], 1
je 0x1400b7d86
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x18
mov dword [rsp + 0x20], esi
lea r8, [0x14025b168]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
nop
lea rcx, [rsp + 0x70]
call fcn.1401c8c10
nop
lea rax, vtable.WppTrace.0
mov qword [rbp - 0x60], rax
cmp byte [rbp - 0x58], 0
jne 0x1400b7def
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x1400b7def
test byte [rcx + 0x1c], 1
je 0x1400b7def
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
cmp qword [0x1402bbdc8], 8
cmovae r13, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp - 0x30]
call fcn.1400048a0
lea rcx, [rbp - 0x50]
call fcn.1400048a0
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov r14d, 0xffffffff
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1400b7e2e
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
xor eax, eax
jmp 0x1400b86cd
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400b8703
mov rax, qword [rax]
mov edx, 0x7fff
mov r8d, 2
mov rax, qword [rax]
call qword [case.0x1400136d6.0]
mov r12, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400b870e
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
cmp dword [rax + 0xc], 0x7fff
jl 0x1400b8714
mov dword [rax + 8], 0x7fff
mov word [rax + 0x10016], si
test rbx, rbx
jne 0x1400b7ea9
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x1400b7ebf
mov r8d, 0xfffe
lea rdx, [rbp + 0x870]
mov rcx, rbx
call fcn.1401e7770
nop
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400b871f
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400b872a
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov edi, esi
mov dword [rsp + 0x30], esi
mov r14d, 0xffffffff
nop dword [rax]
test edi, edi
js 0x1400b82de
cmp edi, dword [r12 + 8]
jge 0x1400b82de
movsxd rax, edi
lea rcx, [rbx + rax*2]
xor edx, edx
call fcn.1401e71f4
mov r15, rax
test rax, rax
je 0x1400b82de
sub r15, rbx
sar r15, 1
test r15d, r15d
jle 0x1400b82de
lea r13d, [r15 + 1]
mov eax, 0x7fffffff
sub eax, edi
cmp eax, r13d
jl 0x1400b8751
lea eax, [rdi + r13]
mov ecx, dword [r12 + 8]
mov edx, r13d
cmp eax, ecx
jle 0x1400b7f84
mov edx, ecx
sub edx, edi
cmp edi, ecx
cmovle esi, edx
test edi, edi
jne 0x1400b7faa
cmp esi, ecx
jne 0x1400b7faa
lea rcx, [rbx - 0x18]
call fcn.140004d00
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
xor esi, esi
jmp 0x1400b8093
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x1400b7fd3
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x1400b7fd3
mov eax, edi
lea r12, [rbx + rax*2]
mov rdi, r12
jmp 0x1400b8000
call fcn.1401bb0c4
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov rcx, rax
mov eax, edi
lea r12, [rbx + rax*2]
mov rdi, r12
test rcx, rcx
je 0x1400b8746
test rdi, rdi
jne 0x1400b800d
test esi, esi
jne 0x1400b8735
lfence
mov rax, qword [rcx]
mov r8d, 2
mov edx, esi
mov rax, qword [rax]
call qword [case.0x1400136d6.0]
test rax, rax
je 0x1400b8740
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
test esi, esi
js 0x1400b8735
cmp esi, dword [rbx - 0xc]
jg 0x1400b8735
mov dword [rbx - 0x10], esi
movsxd rax, esi
lea r8, [rax + rax]
xor esi, esi
mov word [r8 + rbx], si
test r8, r8
je 0x1400b808e
mov rcx, rbx
test rdi, rdi
je 0x1400b8072
lfence
mov rdx, rdi
call fcn.1401e7770
jmp 0x1400b808e
xor edx, edx
call fcn.1401e7e40
test r12, r12
jne 0x1400b808e
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
mov r12, qword [rsp + 0x68]
lea rcx, [rbx - 0x18]
mov rdi, qword [rsp + 0x38]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400b80fb
cmp dword [rdi + 0x10], 0
jl 0x1400b80e9
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400b80e9
call fcn.140004d00
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400b80de
lfence
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400b80fb
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140004e60
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b8124
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rsp + 0x38]
cmp dword [rbx - 0x10], 1
jl 0x1400b82de
mov edx, 0x3d
mov rcx, rbx
call fcn.1401e71f4
test rax, rax
jne 0x1400b814a
mov eax, r14d
jmp 0x1400b8150
sub rax, rbx
sar rax, 1
test eax, eax
cmovns esi, eax
cmp esi, dword [rbx - 0x10]
jl 0x1400b8174
lea rcx, [rbx - 0x18]
call fcn.140004d00
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov rdi, rbx
jmp 0x1400b8217
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x1400b8192
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x1400b81b6
call fcn.1401bb0c4
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x1400b8746
lfence
mov rax, qword [rcx]
mov r8d, 2
mov edx, esi
mov rax, qword [rax]
call qword [case.0x1400136d6.0]
test rax, rax
je 0x1400b8740
lea rbx, [rax + 0x18]
mov rdi, rbx
mov qword [rsp + 0x50], rbx
test esi, esi
js 0x1400b8735
cmp esi, dword [rbx - 0xc]
jg 0x1400b8735
mov dword [rbx - 0x10], esi
movsxd rax, esi
lea r8, [rax + rax]
xor eax, eax
mov word [r8 + rbx], ax
test r8, r8
je 0x1400b8217
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.1401e7770
nop
lea rcx, [rdi - 0x18]
mov rsi, qword [rsp + 0x40]
add rsi, 0xffffffffffffffe8
cmp rcx, rsi
je 0x1400b8284
cmp dword [rsi + 0x10], 0
jl 0x1400b8272
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x1400b8272
call fcn.140004d00
mov rbx, rax
mov ecx, r14d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x1400b8262
lfence
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x50]
jmp 0x1400b8284
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004e60
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b82a8
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea r8, [rsp + 0x40]
mov rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x70]
call fcn.1401c9128
mov edi, r13d
cmp r13d, dword [r12 + 8]
jg 0x1400b8735
movsxd rax, r15d
mov rbx, qword [rsp + 0x60]
xor esi, esi
cmp word [rbx + rax*2 + 2], si
jne 0x1400b7f20
mov rcx, qword [rbp - 0x80]
xor r12d, r12d
mov r15, qword [rsp + 0x58]
test rcx, rcx
jle 0x1400b8391
mov edi, r12d
test rdi, rdi
js 0x1400b86fd
cmp rdi, rcx
jge 0x1400b86fd
lfence
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + rdi*8]
sub rcx, 0x18
call fcn.140004d00
lea rcx, [rax + 0x18]
lea rbx, [rcx - 0x18]
mov rdx, qword [r15]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
mov eax, r14d
je 0x1400b836b
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400b8355
lfence
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
inc esi
inc rdi
movsxd rax, esi
mov rcx, qword [rbp - 0x80]
cmp rax, rcx
jl 0x1400b82f6
mov edi, r12d
jmp 0x1400b8395
mov edi, 1
lock xadd dword [rbx + 0x10], eax
sub eax, edi
jg 0x1400b8395
lfence
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
jmp 0x1400b8395
mov edi, dword [rsp + 0x30]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov rcx, rdx
call qword [case.0x1400136d6.0]
test eax, eax
je 0x1400b8445
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
call qword [case.0x1400136d6.0]
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rdx, qword [r15]
mov rcx, r8
call qword [case.0x1400136d6.0]
test eax, eax
jne 0x1400b8445
mov rcx, qword [0x1402a8360]
lea rsi, [0x1402a8360]
lea r13, [0x1402bbdb0]
cmp rcx, rsi
je 0x1400b8440
test byte [rcx + 0x1c], 4
je 0x1400b8440
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rax + 0x19]
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
lea r8, [0x14025b168]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov edi, r12d
jmp 0x1400b8453
lea rsi, [0x1402a8360]
lea r13, [0x1402bbdb0]
cmp dword [0x1402bbfc4], 0
jne 0x1400b8504
cmp dword [0x1402bbfcc], 0
jne 0x1400b8504
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rbx, rax
mov rcx, qword [r15]
cmp dword [rcx - 8], 1
jle 0x1400b8498
mov edx, dword [rcx - 0x10]
mov rcx, r15
call fcn.140005100
mov rcx, qword [rbx]
mov rax, qword [rcx + 0xe8]
mov rdx, qword [r15]
mov rcx, rbx
call qword [case.0x1400136d6.0]
test eax, eax
je 0x1400b8568
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1400b84ff
test byte [rcx + 0x1c], 4
je 0x1400b84ff
mov edx, 0x1b
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
lea r8, [0x14025b168]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rcx, qword [0x1402a8360]
mov edi, r12d
jmp 0x1400b856f
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rbx, rax
mov rcx, qword [r15]
cmp dword [rcx - 8], 1
jle 0x1400b852f
mov edx, dword [rcx - 0x10]
mov rcx, r15
call fcn.140005100
mov rcx, qword [rbx]
mov rax, qword [rcx + 0xf8]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, rbx
call qword [case.0x1400136d6.0]
test eax, eax
je 0x1400b8568
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1400b84ff
test byte [rcx + 0x1c], 4
je 0x1400b84ff
mov edx, 0x1a
jmp 0x1400b84cd
mov rcx, qword [0x1402a8360]
mov byte [rbp - 0x58], 1
cmp rcx, rsi
je 0x1400b85ab
test byte [rcx + 0x1c], 1
je 0x1400b85ab
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x1c
mov dword [rsp + 0x20], edi
lea r8, [0x14025b168]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b85d5
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b85ff
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b8629
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rcx, [rsp + 0x70]
call fcn.1401c8c10
nop
lea rax, vtable.WppTrace.0
mov qword [rbp - 0x60], rax
cmp byte [rbp - 0x58], 0
jne 0x1400b8692
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1400b8692
test byte [rcx + 0x1c], 1
je 0x1400b8692
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
cmp qword [0x1402bbdc8], 8
cmovae r13, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp - 0x30]
call fcn.1400048a0
lea rcx, [rbp - 0x50]
call fcn.1400048a0
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1400b86cb
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
mov eax, edi
mov rcx, qword [rbp + 0x10870]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x10980]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401bb848
nop
mov ecx, 0x80004005
call fcn.140001470
int3
call fcn.1400051f0
int3
mov ecx, 0x80070057
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80070057
call fcn.140001470
int3
call fcn.1400051f0
int3
mov ecx, 0x80004005
call fcn.140001470
int3
lfence
mov ecx, 0x80070216
call fcn.140001470
int3