Function at 0x10001d31c
Capabilities:
Check if file exists
Create thread
Get common file path
Get file attributes
Get file version info
Set registry value
Terminate process

Disassembly:
xor r13d, r13d
mov rdi, rcx
xor ecx, ecx
lea r14d, [r13 + 1]
mov ebx, r13d
mov rsi, r8
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x1b0], r14d
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x1b8], r13
mov dword [rsp + 0x1c0], r13d
mov dword [rsp + 0x1c4], r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [rsp + 0x1aa0]
mov r9d, 0x200
mov rcx, rax
mov edx, 0xd9
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r13d
je 0x10002f44f
mov rcx, qword [0x100073278]
call qword [sym.imp.msvcrt.dll_time]
lea r9, [0x100073280]
lea r8, [0x100074790]
lea rdx, [0x10003f1d4]
lea rcx, [0x100063db8]
call fcn.10001a60c
movabs rdx, 0x8001000000010000
cmp dword [0x1000747b4], r13d
jne 0x10002f45e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
call fcn.10001aa00
lea rax, [0x100001c58]
mov r15d, 0x50
xor ecx, ecx
mov dword [rsp + 0x280], r15d
mov dword [rsp + 0x284], r13d
mov qword [rsp + 0x288], rax
mov dword [rsp + 0x290], r13d
mov dword [rsp + 0x294], r13d
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0xe0], r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebp, 0xea
lea r9, [rsp + 0xe0]
mov r8d, r14d
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.COMCTL32.dll_Ordinal_380]
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], r13
mov qword [rsp + 0x2a0], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rsp + 0xe8]
xor r8d, r8d
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.COMCTL32.dll_Ordinal_380]
mov rdx, qword [rsp + 0xe8]
xor ecx, ecx
mov qword [rsp + 0x2c8], rdx
mov edx, 0x7f00
call qword [sym.imp.USER32.dll_LoadCursorW]
xor ecx, ecx
mov qword [rsp + 0x2a8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rsp + 0x178]
lea edx, [rbp - 0x4d]
mov r8d, r14d
mov rcx, rax
call fcn.100007b6c
mov rdx, qword [rsp + 0x178]
lea rbp, str.CalcFrame
lea rcx, [rsp + 0x280]
mov qword [0x1000735c8], rdx
mov qword [rsp + 0x2b0], r13
mov qword [rsp + 0x2b8], 0x6c
mov qword [rsp + 0x2c0], rbp
call qword [sym.imp.USER32.dll_RegisterClassExW]
cmp ax, r13w
je 0x10002f4b3
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r13
mov r12d, 0x80000000
mov qword [rsp + 0x40], r13
lea r8, [rsp + 0x1aa0]
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov r9d, 0xca0000
mov rdx, rbp
mov ecx, 0x100
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
lea rdx, str.CalcFrame
mov r9d, 0x40000000
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov rbp, rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, r15
mov qword [0x1000735d0], rax
call fcn.100001c10
mov r12d, 7
mov rdi, rax
cmp rax, r13
je 0x10002f4ba
lea r8d, [r12 + 1]
lea rdx, str._restart
lea rcx, [rsp + 0x258]
mov qword [rsp + 0x278], r12
mov qword [rsp + 0x270], r13
mov word [rsp + 0x260], r13w
call fcn.10001b608
lea rcx, [rdi + 0x20]
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
mov qword [rcx + 0x20], r12
mov qword [rcx + 0x18], r13
lea rdx, [rsp + 0x258]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov word [rcx + 8], r13w
mov ebx, r14d
call fcn.10001bb30
mov dword [rdi + 0x48], r13d
mov dword [rdi + 0x4c], r14d
jmp 0x100001306
mov qword [0x100073110], rdi
test r14b, bl
je 0x10000132d
and ebx, 0xfffffffe
cmp qword [rsp + 0x278], 8
jb 0x10000132d
mov rcx, qword [rsp + 0x260]
call sub.msvcrt.dll_free
mov rcx, r15
call fcn.100001c10
mov r15d, 2
mov rdi, rax
cmp rax, r13
je 0x10002f4ca
lea r8d, [r15 + 2]
lea rdx, str.Calc
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x248], r13
mov word [rsp + 0x238], r13w
call fcn.10001b608
mov rax, qword [0x100073110]
mov qword [rdi + 0x38], r12
mov qword [rdi + 0x30], r13
mov word [rdi + 0x20], r13w
mov ecx, 0x90
mov qword [rdi], rax
or ebx, r15d
mov dword [rdi + 0x40], 5
mov dword [rdi + 0x44], 0x12c
mov dword [rdi + 0x48], r13d
mov dword [rdi + 0x4c], r14d
call fcn.100001c10
cmp rax, r13
je 0x10002f4c2
lea rdx, [rsp + 0x230]
mov rcx, rax
call fcn.10001df54
jmp 0x1000013cd
mov qword [rdi + 8], rax
jmp 0x1000013d3
mov qword [0x100073118], rdi
test r15b, bl
je 0x1000013ee
cmp qword [rsp + 0x250], 8
jae 0x10002f4d2
lea rdx, [rsp + 0x1ea0]
lea rcx, [rsp + 0x138]
or rdi, 0xffffffffffffffff
mov r9, rsi
mov r8d, 0x400
mov qword [rsp + 0x138], r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.msvcrt.dll_mbstowcs_s]
mov rcx, rdi
xor eax, eax
lea rdi, [rsp + 0x1ea0]
lea rdx, [rsp + 0x1ea0]
repne scasw ax, word [rdi]
mov qword [rsp + 0x228], r12
mov qword [rsp + 0x220], r13
not rcx
mov word [rsp + 0x210], r13w
sub rcx, r14
mov r8, rcx
lea rcx, [rsp + 0x208]
call fcn.10001b608
mov rcx, qword [0x100073110]
lea rdx, [rsp + 0x208]
call fcn.10001db70
cmp qword [rsp + 0x228], 8
mov r12d, eax
jae 0x10002f4e5
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x180]
xor r8d, r8d
call sub.gdiplus.dll_GdiplusStartup
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rdx, str.SoftwareMicrosoftCalc
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x60]
cmp eax, r13d
lea rdx, str.layout
cmovne rcx, r13
mov r8d, r14d
mov qword [rsp + 0x60], rcx
call fcn.10001ac70
cmp eax, 4
mov edi, eax
jge 0x10002f4f8
mov rcx, qword [rsp + 0x60]
lea rdx, str.UseSep
xor r8d, r8d
call fcn.10001ac70
mov rcx, qword [rsp + 0x60]
lea rdx, str.ShowHistory
xor r8d, r8d
mov ebx, eax
call fcn.10001ac70
movzx ecx, byte [0x100073584]
lea rdx, str.UnitConv
cmp eax, r13d
mov dword [0x10007400c], r13d
cmovne ecx, r14d
xor r8d, r8d
mov byte [0x100073584], cl
mov rcx, qword [rsp + 0x60]
call fcn.10001ac70
cmp eax, r13d
jne 0x10002f539
mov rcx, qword [rsp + 0x60]
lea rdx, str.Templates
xor r8d, r8d
call fcn.10001ac70
cmp eax, r13d
jne 0x10001474b
mov rcx, qword [rsp + 0x60]
lea rdx, str.DateTime
xor r8d, r8d
call fcn.10001ac70
movzx ecx, byte [0x100073587]
cmp eax, r13d
cmovne ecx, r14d
mov byte [0x100073587], cl
mov rcx, qword [rsp + 0x60]
cmp rcx, r13
je 0x1000015c0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x1000735d0]
mov dword [0x100073580], edi
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
mov edx, 0x130
lea r9d, [rdi + 0x130]
lea r8d, [rdx + 3]
mov rcx, rax
mov rsi, rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov edx, ebx
neg edx
mov rcx, rsi
mov edx, 0x12f
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
lea rcx, [0x100073460]
call fcn.10001a52c
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov eax, 0x80000000
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], eax
lea r8, [0x100062c88]
lea rdx, str.EDIT
mov r9d, 0x10000000
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, 0x2c
lea rcx, [rsp + 0x1d8]
xor edx, edx
mov r8, rdi
mov qword [0x100073460], rax
call sub.msvcrt.dll_memset
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0x1d8]
lea rcx, str.Window_Placement
mov dword [rsp + 0xc8], edi
call fcn.100019ed0
cmp eax, r13d
jne 0x10001877d
mov edx, 0xffffffe0
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetClassWord]
xor edx, edx
lea rcx, [rsp + 0x304]
lea r8d, [rdx + 0x2c]
movzx edi, ax
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x1d8]
lea r8, [rsp + 0x300]
movdqu xmm5, xmmword [0x1000732b0]
mov qword [rsp + 0x310], rax
lea rax, [0x100063e68]
lea rdx, [0x10001b730]
movdqu xmmword [rsp + 0x300], xmm5
xor ecx, ecx
mov word [rsp + 0x318], di
mov qword [rsp + 0x320], rax
call qword [sym.imp.USER32.dll_EnumDesktopWindows]
lea rcx, [rsp + 0x1f4]
movdqu xmm5, xmmword [rsp + 0x1f4]
movdqu xmmword [0x1000732b0], xmm5
call fcn.10001d830
lea rcx, [rsp + 0x330]
lea rdx, [rsp + 0x1d8]
mov r8d, 0x2c
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x330]
mov rcx, rbp
mov dword [rsp + 0x338], r13d
call qword [sym.imp.USER32.dll_SetWindowPlacement]
cmp qword [0x1000735d0], r13
je 0x10002f551
lea rbp, [0x100073460]
mov rcx, rbp
call fcn.10001c690
mov rax, qword [0x100073578]
lea rdx, [0x100063380]
mov qword [rsp + 0x2d0], rdx
mov qword [rsp + 0x2e0], rbp
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x2e8], rcx
mov rcx, qword [0x100073110]
call fcn.10001acc0
mov rdx, qword [0x100073118]
lea rcx, [rsp + 0x2d0]
mov rax, qword [rdx + 8]
mov qword [rdx + 0x10], rcx
lea rcx, [0x100053274]
mov qword [rsp + 0x2d8], rax
mov r8d, dword [rdx + 0x40]
xor r9d, r9d
imul r8d, r8d, 0x3e8
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
cmp r12d, r13d
jne 0x10002f569
mov dl, r14b
mov rcx, rbp
call fcn.10001a34c
xor edx, edx
mov rcx, rbp
call fcn.1000234a8
mov rcx, qword [0x1000735d0]
call qword [sym.imp.USER32.dll_GetParent]
lea rcx, [rsp + 0x1d8]
mov rdx, rax
call fcn.10001a164
mov rdx, qword [0x100073578]
mov rax, qword [rdx + 0x20]
mov rcx, qword [rax]
cmp dword [rcx + 0x358], ebx
jne 0x10002f587
cmp dword [0x1000747b4], r13d
jne 0x10002f5a5
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, r13d
jl 0x10002f4b3
xor edx, edx
mov rcx, rbp
call fcn.100023a50
cmp byte [0x100073586], r13b
jne 0x100018332
mov rcx, rbp
call fcn.100022610
mov rcx, qword [0x1000735f0]
mov edx, 0x96
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
call fcn.100001bd8
lea rcx, [0x100073a58]
xor edx, edx
call fcn.1000021a0
call fcn.100001ef0
mov rcx, qword [0x1000735d0]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea rdx, [0x100073480]
cmp rdx, r13
je 0x100001909
mov ecx, r13d
lea rdi, [rsp + 0x360]
cmp word [rdx], r13w
jne 0x10002f604
cmp ecx, r13d
jg 0x10002f61f
lea rdx, str.Security_SPP_GenuineLocalStatus
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rdx, [rsp + 0x198]
lea r8, [rsp + 0x84]
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x2f0]
lea rdx, [rsp + 0xd0]
mov r9d, 4
call qword [sym.imp.ntdll.dll_NtQueryLicenseValue]
cmp eax, r13d
jl 0x100001970
cmp dword [rsp + 0xd0], 4
jne 0x10002f6b9
cmp dword [rsp + 0x84], r13d
je 0x10002f6b9
lea rcx, [rsp + 0x100]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r13d
je 0x100001a95
lea rdi, [0x100073460]
mov rdx, qword [0x1000735b8]
mov rcx, qword [0x1000735d0]
lea r8, [rsp + 0x100]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
cmp eax, r13d
jne 0x100001a76
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.100001fd4
cmp eax, r13d
jne 0x100001a76
lea rcx, [rsp + 0x100]
call fcn.100002090
cmp al, r13b
jne 0x100001a76
cmp dword [rsp + 0x108], 0x201
je 0x100004ff2
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.10000203c
cmp eax, r13d
jne 0x100001a76
mov rdx, qword [0x1000735c0]
mov rcx, qword [0x1000735d0]
lea r8, [rsp + 0x100]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
cmp eax, r13d
jne 0x100001a76
movsxd rdx, dword [0x100073588]
mov rcx, qword [0x1000735d0]
lea r8, [rsp + 0x100]
mov rdx, qword [rdi + rdx*8 + 0x130]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
cmp eax, r13d
jne 0x100001a76
lea rcx, [rsp + 0x100]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x100]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x100]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r13d
jne 0x100001996
lea rcx, [0x100073280]
call fcn.100018bec
call fcn.100001bd8
mov esi, 1
mov rbx, rax
cmp rax, r13
je 0x100001ad6
mov rdi, r13
mov rcx, qword [rbx + rdi*8]
cmp rcx, r13
je 0x100001ac5
call qword [sym.imp.GDI32.dll_DeleteObject]
add rdi, rsi
cmp rdi, 0x1e
jl 0x100001ab6
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, qword [0x100073278]
call fcn.100019768
mov rcx, qword [0x100073138]
call sub.msvcrt.dll_free
mov qword [0x100073138], r13
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x180]
call sub.gdiplus.dll_GdiplusShutdown
mov rcx, qword [0x100074810]
cmp rcx, r13
je 0x100001b1a
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdi, [0x1000745e0]
mov rcx, qword [rdi]
cmp rcx, r13
je 0x100001b32
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], r13
lea rax, [0x100074600]
add rdi, 8
cmp rdi, rax
jl 0x100001b21
mov rdi, qword [0x100073118]
cmp rdi, r13
je 0x100001b75
mov rcx, qword [rdi + 8]
cmp rcx, r13
je 0x100001b5e
mov edx, esi
call fcn.100019924
lea rcx, [rdi + 0x18]
xor r8d, r8d
mov dl, sil
call fcn.100018b80
mov rcx, rdi
call sub.msvcrt.dll_free
mov rdi, qword [0x100073110]
cmp rdi, r13
je 0x100001ba0
lea rcx, [rdi + 0x20]
xor r8d, r8d
mov dl, sil
call fcn.100018b80
mov rcx, rdi
call fcn.100019f90
mov rcx, rdi
call sub.msvcrt.dll_free
mov eax, dword [rsp + 0x110]
mov rcx, qword [rsp + 0x26a0]
xor rcx, rsp
call fcn.100001c30
mov rbx, qword [rsp + 0x26f8]
add rsp, 0x26b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov ecx, 0xff515780
test rcx, rax
je 0x1000019fb
jmp 0x100030794
dec eax
mov byte [0x100073586], r14b
mov dword [0x10007400c], eax
cmp eax, 3
jbe 0x1000015b0
jmp 0x10002f545
mov edx, 0x3cd
or r9d, 0xffffffff
mov rcx, rsi
lea r8d, [rdx + 6]
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov r9d, dword [0x10007400c]
mov edx, 0x2710
lea r8d, [rdx + 3]
mov rcx, rsi
add r9d, 0x2710
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov edx, dword [0x10007400c]
mov rcx, qword [0x100073578]
add edx, 0x2710
call fcn.100018398
nop
jmp 0x10000188e
lea rcx, [rsp + 0x1d8]
xor r8d, r8d
mov rdx, rbp
call fcn.1000187a0
nop
jmp 0x1000016b3
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x26b0
call fcn.10001d350
sub rsp, rax
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x26a0], rax
jmp section..text
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_exit]
int3
mov al, byte [0x1000747b8]
cmp al, 4
jae 0x10002f471
cmp al, r13b
jne 0x1000010ab
test qword [0x1000747a0], rdx
je 0x1000010ab
mov rcx, qword [0x1000747a8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000010ab
mov rcx, qword [0x100073280]
lea rdx, [0x100064b68]
mov r8d, 5
call fcn.10003f210
nop
jmp 0x1000010ab
xor eax, eax
jmp 0x100001ba7
mov rdi, r13
jmp 0x100001306
mov rax, r13
jmp 0x1000013cd
mov rdi, r13
jmp 0x1000013d3
mov rcx, qword [rsp + 0x238]
call sub.msvcrt.dll_free
nop
jmp 0x1000013ee
mov rcx, qword [rsp + 0x210]
call sub.msvcrt.dll_free
nop
jmp 0x10000148b
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0xc0]
lea rdx, str.layout
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov edi, r14d
mov dword [rsp + 0xc0], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
jmp 0x100001509
mov byte [0x100073585], r14b
jmp 0x1000015b0
mov dword [0x10007400c], r13d
jmp 0x1000015b0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
jmp 0x100001785
mov rcx, qword [0x100073118]
call fcn.100052cb4
mov rcx, qword [0x100073118]
call fcn.100053388
nop
jmp 0x10000180d
mov dword [rcx + 0x358], ebx
cmp dword [rcx + 0x35c], r13d
jne 0x100001859
call fcn.100003eb4
nop
jmp 0x100001859
mov al, byte [0x1000747b8]
cmp al, 4
jae 0x10002f5b8
cmp al, r13b
jne 0x100001866
movabs rdx, 0x8001000000010000
test qword [0x1000747a0], rdx
je 0x100001866
mov rcx, qword [0x1000747a8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100001866
mov rcx, qword [0x100073280]
lea rdx, [0x100064b78]
mov r8d, 6
call fcn.10003f210
nop
jmp 0x100001866
mov al, byte [rdx]
add ecx, r14d
add rdx, r15
mov byte [rdi], al
add rdi, r14
cmp ecx, 0x52
jae 0x100001900
jmp 0x1000018f6
movsxd rax, ecx
lea r8, [rsp + 0x360]
mov rcx, rbp
mov byte [rsp + rax + 0x360], r13b
lea r9, [rsp + rax + 0x361]
mov rax, qword [0x1000735e0]
mov rdx, qword [rax + 8]
mov byte [rsp + 0x20], r13b
mov rdx, qword [rdx + 8]
call fcn.100026ac0
mov rcx, qword [0x100073578]
mov edx, 0x93
call fcn.1000048cc
mov rcx, qword [0x1000735f0]
lea rdx, [rsp + 0x1c8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rdx, qword [0x1000735d0]
mov rcx, qword [0x1000735f0]
lea r8, [rsp + 0x1c8]
mov r9d, r15d
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rcx, qword [0x1000735d0]
lea rdx, [rsp + 0x1c8]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
nop
jmp 0x100001909
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0xcc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov esi, 0x104
cmp eax, r13d
je 0x1000302a0
cmp dword [rsp + 0xcc], r13d
je 0x10002fec6
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
cmp eax, r13d
je 0x1000302a0
mov r8d, r14d
xor edx, edx
xor ecx, ecx
mov ebx, r13d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
cmp rax, r13
je 0x10002fac8
lea rdx, str.sppuinotify
mov r8d, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
cmp rax, r13
je 0x10002f7c5
lea r9, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, r13d
jne 0x10002f7bc
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x10002f7bc
mov edi, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, r13
jne 0x10002f785
mov ebx, r14d
jmp 0x10002f7bc
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x70]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, r13d
je 0x10002f7a8
cmp dword [rdi + 4], 4
cmovne ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, r13d
je 0x10002fac8
mov r8d, r14d
xor edx, edx
xor ecx, ecx
mov ebx, r13d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
cmp rax, r13
je 0x10002fac8
lea rdx, str.sppsvc
mov r8d, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
cmp rax, r13
je 0x10002f899
lea r9, [rsp + 0x74]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, r13d
jne 0x10002f890
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x10002f890
mov edi, dword [rsp + 0x74]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, r13
jne 0x10002f859
mov ebx, r14d
jmp 0x10002f890
mov r8d, dword [rsp + 0x74]
lea r9, [rsp + 0x74]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, r13d
je 0x10002f87c
cmp dword [rdi + 4], 4
cmovne ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, r13d
je 0x10002fac8
xor r9d, r9d
lea rax, [rsp + 0x1260]
xor r8d, r8d
lea edx, [r9 + 0x25]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, r13d
jl 0x10002fac8
lea rdi, [rsp + 0x1260]
lea rax, [rsp + 0x810]
mov esi, 0x104
lea rcx, [rsp + 0x810]
mov r8d, r13d
sub rdi, rax
mov rdx, rsi
lea rax, [rdx + 0x7ffffefa]
cmp rax, r13
je 0x10002f91a
movzx eax, word [rcx + rdi]
cmp ax, r13w
je 0x10002f91a
mov word [rcx], ax
add rcx, r15
sub rdx, r14
jne 0x10002f8f9
mov r12d, 0x8007007a
cmp rdx, r13
jne 0x10002f92b
sub rcx, r15
mov r8d, r12d
cmp r8d, r13d
mov word [rcx], r13w
jl 0x10002fac8
lea r8, str._sppuinotify.dll
lea rcx, [rsp + 0x810]
mov rdx, rsi
call fcn.1000031d4
cmp eax, r13d
jl 0x10002fac8
lea rcx, [rsp + 0x810]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10002fac8
lea r8, [rsp + 0x8c]
lea rdx, [rsp + 0x810]
xor ecx, ecx
mov ebp, r13d
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov esi, eax
cmp eax, r13d
jbe 0x10002fac8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r13, [0x100065a78]
lea r14, str.StringFileInfo_04x_04xOriginalFilename
mov rbx, rax
xor eax, eax
lea r15d, [rax + 0x30]
cmp rbx, rax
je 0x10002fade
mov r8d, dword [rsp + 0x8c]
lea rdx, [rsp + 0x810]
mov r9d, esi
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call sub.VERSION.dll_GetFileVersionInfoExW
xor esi, esi
cmp eax, esi
je 0x10002faa7
lea r9, [rsp + 0xb4]
lea r8, [rsp + 0x1a8]
mov rdx, r13
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, esi
je 0x10002faa7
cmp dword [rsp + 0xb4], 4
jb 0x10002faa7
mov rax, qword [rsp + 0x1a8]
mov r8, r14
mov rdx, r15
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x4e0]
call fcn.10001e3d4
cmp eax, esi
jl 0x10002faa7
lea r9, [rsp + 0x94]
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x4e0]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, esi
je 0x10002faa7
mov edi, dword [rsp + 0x94]
lea rcx, [rsp + 0x810]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0x148]
mov r8, rdi
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, esi
lea eax, [rsi + 1]
cmove ebp, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, esi
jne 0x10002fae0
mov r14d, 1
xor r13d, r13d
mov edi, r13d
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x100030292
xor esi, esi
lea rdi, [rsp + 0x1260]
lea rax, [rsp + 0xa20]
mov r9d, 0x104
lea rcx, [rsp + 0xa20]
mov r8d, esi
mov r12d, 1
sub rdi, rax
mov rdx, r9
lea rax, [rdx + 0x7ffffefa]
cmp rax, rsi
je 0x10002fb2e
movzx eax, word [rcx + rdi]
cmp ax, si
je 0x10002fb2e
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x10002fb0d
mov r12d, 0x8007007a
cmp rdx, rsi
jne 0x10002fb40
sub rcx, 2
mov r8d, r12d
cmp r8d, esi
mov word [rcx], si
jl 0x10002fabf
lea r8, str._slui.exe
lea rcx, [rsp + 0xa20]
mov rdx, r9
call fcn.1000031d4
cmp eax, esi
jl 0x10002fabf
lea rcx, [rsp + 0xa20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10002fabf
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0xa20]
xor ecx, ecx
mov ebp, esi
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov esi, eax
xor eax, eax
cmp esi, eax
jbe 0x10002fabf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
xor eax, eax
cmp rbx, rax
je 0x10002fcbc
mov r8d, dword [rsp + 0xd8]
lea rdx, [rsp + 0xa20]
mov r9d, esi
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call sub.VERSION.dll_GetFileVersionInfoExW
xor esi, esi
cmp eax, esi
je 0x10002fc9e
lea r9, [rsp + 0x9c]
lea r8, [rsp + 0x188]
mov rdx, r13
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, esi
je 0x10002fc9e
cmp dword [rsp + 0x9c], 4
jb 0x10002fc9e
mov rax, qword [rsp + 0x188]
mov r8, r14
mov rdx, r15
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x480]
call fcn.10001e3d4
cmp eax, esi
jl 0x10002fc9e
lea r9, [rsp + 0x7c]
lea r8, [rsp + 0x158]
lea rdx, [rsp + 0x480]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, esi
je 0x10002fc9e
mov edi, dword [rsp + 0x7c]
lea rcx, [rsp + 0xa20]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0x158]
mov r8, rdi
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, esi
lea eax, [rsi + 1]
cmove ebp, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, esi
je 0x10002fabf
jmp 0x10002fcbe
xor esi, esi
lea rdi, [rsp + 0x1260]
lea rax, [rsp + 0xe40]
mov r9d, 0x104
lea rcx, [rsp + 0xe40]
mov r8d, esi
mov r12d, 1
sub rdi, rax
mov rdx, r9
lea rax, [rdx + 0x7ffffefa]
cmp rax, rsi
je 0x10002fd0c
movzx eax, word [rcx + rdi]
cmp ax, si
je 0x10002fd0c
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x10002fceb
mov r12d, 0x8007007a
cmp rdx, rsi
jne 0x10002fd1e
sub rcx, 2
mov r8d, r12d
cmp r8d, esi
mov word [rcx], si
jl 0x10002fabf
lea r8, str._sppsvc.exe
lea rcx, [rsp + 0xe40]
mov rdx, r9
call fcn.1000031d4
cmp eax, esi
jl 0x10002fabf
lea rcx, [rsp + 0xe40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10002fabf
lea r8, [rsp + 0xa4]
lea rdx, [rsp + 0xe40]
xor ecx, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeExW
xor r12d, r12d
mov ebp, eax
cmp eax, r12d
jbe 0x10002fabf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, r12
je 0x10002feb7
mov r8d, dword [rsp + 0xa4]
lea rdx, [rsp + 0xe40]
mov r9d, ebp
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.VERSION.dll_GetFileVersionInfoExW
cmp eax, r12d
je 0x10002fe8f
lea r9, [rsp + 0xd4]
lea r8, [rsp + 0x190]
mov rdx, r13
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
xor r13d, r13d
cmp eax, r13d
je 0x10002fe92
cmp dword [rsp + 0xd4], 4
jb 0x10002fe92
mov rax, qword [rsp + 0x190]
mov r8, r14
mov rdx, r15
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x540]
call fcn.10001e3d4
cmp eax, r13d
jl 0x10002fe92
lea r9, [rsp + 0xac]
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x540]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, r13d
je 0x10002fe92
mov edi, dword [rsp + 0xac]
lea rcx, [rsp + 0xe40]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0xf0]
mov r8, rdi
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
lea r14d, [r12 + 1]
cmp eax, r13d
cmove esi, r14d
jmp 0x10002fe98
xor r13d, r13d
mov r14d, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, r13d
je 0x10002fac8
jmp 0x10002febe
xor r13d, r13d
lea r14d, [r13 + 1]
mov edi, r14d
jmp 0x10002facb
mov r8d, r14d
xor edx, edx
xor ecx, ecx
mov ebx, r13d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
cmp rax, r13
je 0x10003028f
lea rdx, str.sppuinotify
mov r8d, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
cmp rax, r13
je 0x10002ff88
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, r13d
jne 0x10002ff7f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x10002ff7f
mov edi, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, r13
jne 0x10002ff48
mov ebx, r14d
jmp 0x10002ff7f
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x68]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, r13d
je 0x10002ff6b
cmp dword [rdi + 4], 4
cmovne ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, r13d
je 0x10003028f
mov r8d, r14d
xor edx, edx
xor ecx, ecx
mov ebx, r13d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
cmp rax, r13
je 0x10003028f
lea rdx, str.sppsvc
mov r8d, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
cmp rax, r13
je 0x10003005c
lea r9, [rsp + 0x6c]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, r13d
jne 0x100030053
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x100030053
mov edi, dword [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, r13
jne 0x10003001c
mov ebx, r14d
jmp 0x100030053
mov r8d, dword [rsp + 0x6c]
lea r9, [rsp + 0x6c]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, r13d
je 0x10003003f
cmp dword [rdi + 4], 4
cmovne ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, r13d
je 0x10003028f
xor r9d, r9d
lea rax, [rsp + 0x1470]
xor r8d, r8d
lea edx, [r9 + 0x25]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, r13d
jl 0x10003028f
lea rdi, [rsp + 0x1470]
lea rax, [rsp + 0x600]
mov esi, 0x104
lea rcx, [rsp + 0x600]
mov r8d, r13d
sub rdi, rax
mov rdx, rsi
lea rax, [rdx + 0x7ffffefa]
cmp rax, r13
je 0x1000300dd
movzx eax, word [rcx + rdi]
cmp ax, r13w
je 0x1000300dd
mov word [rcx], ax
add rcx, r15
sub rdx, r14
jne 0x1000300bc
mov r12d, 0x8007007a
cmp rdx, r13
jne 0x1000300ee
sub rcx, r15
mov r8d, r12d
cmp r8d, r13d
mov word [rcx], r13w
jl 0x10003028f
lea r8, str._sppuinotify.dll
lea rcx, [rsp + 0x600]
mov rdx, rsi
call fcn.1000031d4
cmp eax, r13d
jl 0x10003028f
lea rcx, [rsp + 0x600]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10003028f
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x600]
xor ecx, ecx
mov ebp, r13d
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov esi, eax
cmp eax, r13d
jbe 0x10003028f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r13, [0x100065a78]
lea r14, str.StringFileInfo_04x_04xOriginalFilename
mov rbx, rax
xor eax, eax
lea r15d, [rax + 0x30]
cmp rbx, rax
je 0x100030322
mov r8d, dword [rsp + 0x80]
lea rdx, [rsp + 0x600]
mov r9d, esi
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call sub.VERSION.dll_GetFileVersionInfoExW
xor esi, esi
cmp eax, esi
je 0x10003026a
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xf8]
mov rdx, r13
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, esi
je 0x10003026a
cmp dword [rsp + 0x88], 4
jb 0x10003026a
mov rax, qword [rsp + 0xf8]
mov r8, r14
mov rdx, r15
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x420]
call fcn.10001e3d4
cmp eax, esi
jl 0x10003026a
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x420]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, esi
je 0x10003026a
mov edi, dword [rsp + 0x90]
lea rcx, [rsp + 0x600]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0x130]
mov r8, rdi
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, esi
lea eax, [rsi + 1]
cmove ebp, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, esi
jne 0x100030324
mov r14d, 1
xor r13d, r13d
mov edi, r13d
cmp edi, r13d
jne 0x100001970
mov esi, 0x104
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, r13d
jne 0x100001970
mov r8d, r14d
mov edx, 0x1acb
xor ecx, ecx
call sub.ntdll.dll_WinSqmIncrementDWORD
mov edx, r14d
lea rcx, [0x100000000]
xchg dword [0x100077e38], edx
cmp edx, r13d
je 0x100030702
lea r8, [rsp + 0x1890]
mov r9d, esi
mov edx, 0xc804
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r13d
je 0x100001970
lea rdx, [rsp + 0x1890]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, r13
je 0x100001970
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x100001970
xor esi, esi
lea rdi, [rsp + 0x1470]
lea rax, [rsp + 0xc30]
mov r9d, 0x104
lea rcx, [rsp + 0xc30]
mov r8d, esi
mov r12d, 1
sub rdi, rax
mov rdx, r9
lea rax, [rdx + 0x7ffffefa]
cmp rax, rsi
je 0x100030372
movzx eax, word [rcx + rdi]
cmp ax, si
je 0x100030372
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x100030351
mov r12d, 0x8007007a
cmp rdx, rsi
jne 0x100030384
sub rcx, 2
mov r8d, r12d
cmp r8d, esi
mov word [rcx], si
jl 0x100030286
lea r8, str._slui.exe
lea rcx, [rsp + 0xc30]
mov rdx, r9
call fcn.1000031d4
cmp eax, esi
jl 0x100030286
lea rcx, [rsp + 0xc30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100030286
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0xc30]
xor ecx, ecx
mov ebp, esi
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov esi, eax
xor eax, eax
cmp esi, eax
jbe 0x100030286
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
xor eax, eax
cmp rbx, rax
je 0x10003050a
mov r8d, dword [rsp + 0x98]
lea rdx, [rsp + 0xc30]
mov r9d, esi
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call sub.VERSION.dll_GetFileVersionInfoExW
xor esi, esi
cmp eax, esi
je 0x1000304ec
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x140]
mov rdx, r13
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, esi
je 0x1000304ec
cmp dword [rsp + 0xa0], 4
jb 0x1000304ec
mov rax, qword [rsp + 0x140]
mov r8, r14
mov rdx, r15
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x3c0]
call fcn.10001e3d4
cmp eax, esi
jl 0x1000304ec
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x150]
lea rdx, [rsp + 0x3c0]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, esi
je 0x1000304ec
mov edi, dword [rsp + 0xa8]
lea rcx, [rsp + 0xc30]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0x150]
mov r8, rdi
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, esi
lea eax, [rsi + 1]
cmove ebp, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, esi
je 0x100030286
jmp 0x10003050c
xor esi, esi
lea rdi, [rsp + 0x1470]
lea rax, [rsp + 0x1050]
mov r9d, 0x104
lea rcx, [rsp + 0x1050]
mov r8d, esi
mov r12d, 1
sub rdi, rax
mov rdx, r9
lea rax, [rdx + 0x7ffffefa]
cmp rax, rsi
je 0x10003055a
movzx eax, word [rcx + rdi]
cmp ax, si
je 0x10003055a
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x100030539
mov r12d, 0x8007007a
cmp rdx, rsi
jne 0x10003056c
sub rcx, 2
mov r8d, r12d
cmp r8d, esi
mov word [rcx], si
jl 0x100030286
lea r8, str._sppsvc.exe
lea rcx, [rsp + 0x1050]
mov rdx, r9
call fcn.1000031d4
cmp eax, esi
jl 0x100030286
lea rcx, [rsp + 0x1050]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100030286
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x1050]
xor ecx, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeExW
xor r12d, r12d
mov ebp, eax
cmp eax, r12d
jbe 0x100030286
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, r12
je 0x10003078c
mov r8d, dword [rsp + 0xb0]
lea rdx, [rsp + 0x1050]
mov r9d, ebp
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.VERSION.dll_GetFileVersionInfoExW
cmp eax, r12d
je 0x1000306d7
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0x160]
mov rdx, r13
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
xor r13d, r13d
cmp eax, r13d
je 0x1000306da
cmp dword [rsp + 0xb8], 4
jb 0x1000306da
mov rax, qword [rsp + 0x160]
mov r8, r14
mov rdx, r15
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x5a0]
call fcn.10001e3d4
cmp eax, r13d
jl 0x1000306da
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x5a0]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, r13d
je 0x1000306da
mov edi, dword [rsp + 0x78]
lea rcx, [rsp + 0x1050]
mov dx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdx, qword [rsp + 0x170]
mov r8, rdi
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcsncmp]
lea r14d, [r12 + 1]
cmp eax, r13d
cmove esi, r14d
jmp 0x1000306e0
xor r13d, r13d
mov r14d, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, r13d
jne 0x100001970
jmp 0x10003028f
lea rdx, [rsp + 0x1680]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, r13d
je 0x100001970
cmp eax, esi
jne 0x10003072e
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
je 0x100001970
lea rcx, [rsp + 0x1680]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, r13
je 0x100001970
lea rax, [rsp + 0x168]
lea r8, [0x1000520e8]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r13
je 0x10003077e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100001970
mov eax, r13d
xchg dword [0x100077e38], eax
jmp 0x100001970
xor r13d, r13d
jmp 0x100001970
mov rax, qword [0x100073278]
or dword [rax + 0x30], 4
jmp 0x1000019fb