Function at 0x4086d0
Capabilities:
Get common file path
Get file version info

Disassembly:
mov rax, rsp
sub rsp, 0x4f8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov qword [rax - 0x18], r14
mov rax, qword [0x00454a00]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
call fcn.00413cb8
mov rdx, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x408737
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
cmp byte [0x00456478], 0
jne 0x40877e
lea rdx, [rbx - 0x18]
mov r12, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x408b9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x408b9e
mov dword [rsp + 0x58], r13d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesWdf01000Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x58], 2
jne 0x408801
lea rdx, [rbx - 0x18]
mov r12, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x408b9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x408b9e
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x408851
lea rcx, str.Error_:_Get_windows_path_error_n
call fcn.004042c0
nop
lea rdx, [rbx - 0x18]
mov r12, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x408b9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x408b9e
mov rcx, r13
nop
nop
nop
movzx eax, byte [rsp + rcx + 0x2b0]
mov byte [rsp + rcx + 0x90], al
add rcx, 1
test al, al
jne 0x408860
lea rdx, str._system32driverswdf01000.sys
lea rcx, [rsp + 0x1a0]
call fcn.004209a0
lea rdi, [rsp + 0x90]
xor eax, eax
mov r12, 0xffffffffffffffff
mov rcx, r12
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x4088b0
xor edx, edx
lea rcx, [rsp + 0x90]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
mov ecx, eax
call fcn.004135f4
mov r14, rax
test rax, rax
jne 0x408905
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x408b9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x408b9e
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00420630
mov r9, r14
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x90]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x408959
mov rcx, r14
call fcn.004135ec
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x408b9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x408b9e
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x68], r13d
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x70]
lea rdx, [0x00439c94]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4089ae
mov rcx, r14
call fcn.004135ec
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x408b9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x408b9e
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 8]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0xc]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x64], eax
shr eax, 0x10
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ebp, ax
movzx ecx, word [rsp + 0x64]
call qword [sym.imp.WS2_32.dll_htons]
movzx esi, ax
movzx ecx, word [rsp + 0x62]
call qword [sym.imp.WS2_32.dll_htons]
movzx edi, ax
movzx ecx, word [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_htons]
movzx r8d, ax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
mov r9d, edi
lea rdx, str._d_d_d_d
lea rcx, [rsp + 0x3c0]
call fcn.004209a0
lea rdx, str.176001
lea rcx, [rsp + 0x3c0]
call fcn.0041ff80
test rax, rax
jne 0x408a72
mov rcx, r14
call fcn.004135ec
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x408b9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x408b9e
mov rcx, r14
call fcn.004135ec
mov r8, r14
lea rdx, str._nInfo__:_Find_beta_wdf1.07__delete_it._n_n
lea rcx, [rsp + 0x50]
call fcn.00403500
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.004042c0
lea rcx, [rsp + 0x90]
call fcn.00401ba0
test al, al
jne 0x408ae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x90]
lea rdx, str.Error_:_Remove_file___s__fail__err:__d_n
lea rcx, [rsp + 0x50]
call fcn.00403500
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.004042c0
nop
nop
movzx eax, byte [rsp + r13 + 0x2b0]
mov byte [rsp + r13 + 0x90], al
add r13, 1
test al, al
jne 0x408ae0
lea rdx, str._system32driverswdfldr.sys
lea rcx, [rsp + 0x1a0]
call fcn.004209a0
lea rdi, [rsp + 0x90]
xor eax, eax
mov rcx, r12
repne scasb al, byte [rdi]
lea r8, [rsp + 0x1a0]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [r8 + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x408b30
lea rcx, [rsp + 0x90]
call fcn.00401ba0
test al, al
jne 0x408b82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x90]
lea rdx, str.Error_:_Remove_file___s__fail__err:__d_n
lea rcx, [rsp + 0x50]
call fcn.00403500
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.004042c0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x408b9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.00420600
mov rbx, qword [rsp + 0x500]
mov rbp, qword [rsp + 0x508]
mov rsi, qword [rsp + 0x510]
mov rdi, qword [rsp + 0x518]
mov r12, qword [rsp + 0x4f0]
mov r13, qword [rsp + 0x4e8]
mov r14, qword [rsp + 0x4e0]
add rsp, 0x4f8
ret