Function at 0x4636dc
Capabilities:
Copy file
Create directory
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xda0
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0xd90], rax
mov rbp, rdx
mov r14, rcx
xor r15d, r15d
mov byte [r11 - 0xb98], r15b
xor edx, edx
mov r8d, 0x103
lea rcx, [r11 - 0xb97]
call fcn.00449860
call fcn.004551b8
mov rbx, qword [rax + 0x70]
cmp rbx, r15
je 0x46255f
lea rdx, str.STATUS:_Searching_for_the_Watson_binaries.
mov rcx, rbx
call fcn.0045fe58
lea rdx, str.STATUS:_Searching_the_registry__installed_DW2.0_.
mov rcx, rbx
call fcn.0045fe58
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftPCHealthErrorReportingDWInstalled
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or rsi, 0xffffffffffffffff
lea r13d, [rsi + 9]
cmp eax, r15d
jne 0x4626bd
mov dword [rsp + 0xc8], 0x104
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DW0200
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, r15d
jne 0x4626bd
lea rax, [rsp + 0x138]
mov qword [rsp + 0x130], rax
lea r8d, [rsi + 4]
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x130]
call fcn.00411dd8
nop
xor eax, eax
mov rcx, rsi
mov rdx, qword [rsp + 0x130]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.00404e54
cmp qword [rbp + 0x20], r13
jb 0x46264e
lea rdi, [rbp + 8]
mov rcx, qword [rdi]
jmp 0x462655
lea rdi, [rbp + 8]
mov rcx, rdi
xor edx, edx
call fcn.00445770
cmp eax, r15d
jne 0x4626a3
cmp rbx, r15
je 0x462682
cmp qword [rbp + 0x20], r13
jb 0x46266f
mov rdi, qword [rdi]
mov r8, rdi
lea rdx, str.STATUS:_Watson_binaries_found_in_Shared_install_location_at:__s
mov rcx, rbx
call fcn.0045fe58
nop
lea rdx, [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
cmp rcx, rdx
je 0x46269c
call fcn.0044460c
mov al, 1
jmp 0x463219
lea rax, [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
cmp rcx, rax
je 0x4626bd
call fcn.0044460c
mov word [rsp + 0x350], r15w
xor edx, edx
mov r8d, 0x618
lea rcx, [rsp + 0x352]
call fcn.00449860
mov word [rsp + 0xb80], r15w
mov edi, 0x208
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0xb82]
call fcn.00449860
mov word [rsp + 0x970], r15w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x972]
call fcn.00449860
mov r8d, 0x30c
lea rdx, [rsp + 0x350]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov eax, 0x105
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x970]
mov r8, rax
lea rdx, [rsp + 0xb80]
lea rcx, [rsp + 0x350]
call fcn.0044504c
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x970]
lea r8, [rsp + 0xb80]
mov edx, 0x30d
lea rcx, [rsp + 0x350]
call fcn.004453a0
cmp rbx, r15
je 0x4627aa
lea rdx, str.STATUS:_Searching_the_current_folder.
mov rcx, rbx
call fcn.0045fe58
mov r12d, 7
mov qword [rsp + 0x100], r12
mov qword [rsp + 0xf8], r15
mov word [rsp + 0xe8], r15w
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x350]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0xe0]
call fcn.00404e54
nop
mov r8, qword [str.dw20.exe]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x50]
call fcn.0040c560
nop
mov r9, rsi
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
call fcn.004020b0
nop
cmp qword [rsp + 0x70], r13
jb 0x462833
mov rcx, qword [rsp + 0x58]
call fcn.00443d3c
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
cmp qword [rsp + 0x100], r13
jb 0x46285a
mov rcx, qword [rsp + 0xe8]
call fcn.00443d3c
mov qword [rsp + 0x100], r12
mov qword [rsp + 0xf8], r15
mov word [rsp + 0xe8], r15w
cmp qword [rbp + 0x20], r13
jb 0x462882
lea rsi, [rbp + 8]
mov rcx, qword [rsi]
jmp 0x462889
lea rsi, [rbp + 8]
mov rcx, rsi
xor edx, edx
call fcn.00445770
cmp eax, r15d
jne 0x462f95
mov qword [rsp + 0x100], r12
mov qword [rsp + 0xf8], r15
mov word [rsp + 0xe8], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x350]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0xe0]
call fcn.00404e54
nop
mov r8, qword [0x004c2650]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x78]
call fcn.0040c560
nop
lea r8, [r14 + 0x38]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.0040c644
nop
mov r8, qword [0x004c2650]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.0040c560
nop
mov r8, qword [str.dwintl20.dll]
mov rdx, rax
lea rcx, [rsp + 0x108]
call fcn.0040c560
nop
cmp qword [rsp + 0x70], r13
jb 0x46294d
mov rcx, qword [rsp + 0x58]
call fcn.00443d3c
mov edi, 7
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
cmp qword [rsp + 0xc0], r13
jb 0x462979
mov rcx, qword [rsp + 0xa8]
call fcn.00443d3c
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
cmp qword [rsp + 0x98], r13
jb 0x4629a9
mov rcx, qword [rsp + 0x80]
call fcn.00443d3c
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
cmp qword [rsp + 0x100], r13
jb 0x4629d9
mov rcx, qword [rsp + 0xe8]
call fcn.00443d3c
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf8], r15
mov word [rsp + 0xe8], r15w
lea rcx, [rsp + 0x110]
cmp qword [rsp + 0x128], r13
cmovae rcx, qword [rsp + 0x110]
xor edx, edx
call fcn.00445770
cmp eax, r15d
jne 0x462a6f
cmp rbx, r15
je 0x462a38
cmp qword [rbp + 0x20], r13
jb 0x462a25
mov rsi, qword [rsi]
mov r8, rsi
lea rdx, str.STATUS:_Watson_binaries_found_in_current_folder_at:__s
mov rcx, rbx
call fcn.0045fe58
nop
cmp qword [rsp + 0x128], r13
jb 0x462a4f
mov rcx, qword [rsp + 0x110]
call fcn.00443d3c
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x120], r15
mov word [rsp + 0x110], r15w
mov al, 1
jmp 0x463219
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x350]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x50]
call fcn.00404e54
nop
mov r8, qword [0x004c2650]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.0040c560
nop
mov r8, qword [str.dwintl20.dll]
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.0040c560
nop
cmp qword [rsp + 0x98], r13
jb 0x462af0
mov rcx, qword [rsp + 0x80]
call fcn.00443d3c
mov edi, 7
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
cmp qword [rsp + 0x70], r13
jb 0x462b1f
mov rcx, qword [rsp + 0x58]
call fcn.00443d3c
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
lea rcx, [rsp + 0xe8]
cmp qword [rsp + 0x100], r13
cmovae rcx, qword [rsp + 0xe8]
xor edx, edx
call fcn.00445770
cmp eax, r15d
jne 0x462eea
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x350]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x50]
call fcn.00404e54
nop
lea r8, [r14 + 0x38]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
call fcn.0040c644
nop
mov r8, qword [0x004c2650]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.0040c560
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [r14 + 0x60]
call fcn.004020b0
nop
cmp qword [rsp + 0x98], r13
jb 0x462bea
mov rcx, qword [rsp + 0x80]
call fcn.00443d3c
mov edi, 7
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
cmp qword [rsp + 0xc0], r13
jb 0x462c1f
mov rcx, qword [rsp + 0xa8]
call fcn.00443d3c
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
cmp qword [rsp + 0x70], r13
jb 0x462c49
mov rcx, qword [rsp + 0x58]
call fcn.00443d3c
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
cmp qword [r14 + 0x80], r13
jb 0x462c68
mov rcx, qword [r14 + 0x68]
jmp 0x462c6c
lea rcx, [r14 + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
jne 0x462ebb
mov r8, qword [str.dwintl20.dll]
lea rdx, [r14 + 0x60]
lea rcx, [rsp + 0xa0]
call fcn.0040c560
mov r13, rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x350]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x50]
call fcn.00404e54
nop
mov r8, qword [str.dwintl20.dll]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.0040c560
nop
cmp qword [r13 + 0x20], 8
jb 0x462cf7
mov rdx, qword [r13 + 8]
jmp 0x462cfb
lea rdx, [r13 + 8]
mov r13d, 8
cmp qword [rax + 0x20], r13
jb 0x462d0d
mov rcx, qword [rax + 8]
jmp 0x462d11
lea rcx, [rax + 8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
sete dil
cmp qword [rsp + 0x98], r13
jb 0x462d38
mov rcx, qword [rsp + 0x80]
call fcn.00443d3c
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
cmp qword [rsp + 0x70], r13
jb 0x462d66
mov rcx, qword [rsp + 0x58]
call fcn.00443d3c
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
cmp qword [rsp + 0xc0], r13
jb 0x462d91
mov rcx, qword [rsp + 0xa8]
call fcn.00443d3c
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
cmp dil, r15b
je 0x462e44
cmp rbx, r15
je 0x462dd8
cmp qword [rbp + 0x20], r13
jb 0x462dc5
mov rsi, qword [rsi]
mov r8, rsi
lea rdx, str.STATUS:_Watson_binaries_found_in_current_folder_at:__s
mov rcx, rbx
call fcn.0045fe58
nop
cmp qword [rsp + 0x100], r13
jb 0x462def
mov rcx, qword [rsp + 0xe8]
call fcn.00443d3c
mov edi, 7
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf8], r15
mov word [rsp + 0xe8], r15w
cmp qword [rsp + 0x128], r13
jb 0x462e24
mov rcx, qword [rsp + 0x110]
call fcn.00443d3c
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x120], r15
mov word [rsp + 0x110], r15w
mov al, 1
jmp 0x463219
cmp rbx, r15
je 0x462f1f
mov r8, qword [str.dwintl20.dll]
lea rdx, [r14 + 0x60]
lea rcx, [rsp + 0x78]
call fcn.0040c560
nop
cmp qword [rax + 0x20], r13
jb 0x462e6f
mov r8, qword [rax + 8]
jmp 0x462e73
lea r8, [rax + 8]
lea rdx, str.WARNING:_Failed_to_copy_watson_dll_to_new_location:__s__attempting_to_look_for_watson_elsewhere
mov rcx, rbx
call fcn.0045fe58
nop
cmp qword [rsp + 0x98], r13
jb 0x462e9a
mov rcx, qword [rsp + 0x80]
call fcn.00443d3c
mov r12d, 7
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
jmp 0x462f35
cmp rbx, r15
je 0x462f27
cmp qword [r14 + 0x80], r13
jb 0x462ecf
mov r8, qword [r14 + 0x68]
jmp 0x462ed3
lea r8, [r14 + 0x68]
lea rdx, str.WARNING:_Failed_to_create_Directory:__s__attempting_to_look_for_watson_elsewhere
mov rcx, rbx
call fcn.0045fe58
mov r12d, 7
jmp 0x462f35
cmp rbx, r15
je 0x462f2f
lea r8, [rsp + 0xe8]
cmp qword [rsp + 0x100], r13
cmovae r8, qword [rsp + 0xe8]
lea rdx, str.WARNING:_Failed_to_find_source_dll_for_copying:__s__attempting_to_look_for_watson_elsewhere
mov rcx, rbx
call fcn.0045fe58
mov r12d, 7
jmp 0x462f35
mov r12d, 7
jmp 0x462f35
mov r12d, 7
jmp 0x462f35
mov r12d, 7
cmp qword [rsp + 0x100], r13
jb 0x462f4c
mov rcx, qword [rsp + 0xe8]
call fcn.00443d3c
mov qword [rsp + 0x100], r12
mov qword [rsp + 0xf8], r15
mov word [rsp + 0xe8], r15w
cmp qword [rsp + 0x128], r13
jb 0x462f7c
mov rcx, qword [rsp + 0x110]
call fcn.00443d3c
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x120], r15
mov word [rsp + 0x110], r15w
mov r8d, 0x30c
lea rdx, [rsp + 0x350]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov r8d, 0x105
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x970]
lea rdx, [rsp + 0xb80]
lea rcx, [rsp + 0x350]
call fcn.0044504c
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x970]
lea r8, [rsp + 0xb80]
mov edx, 0x30d
lea rcx, [rsp + 0x350]
call fcn.004453a0
lea rdx, str.STATUS:_Searching_the_VSSetupWatson_sub_folder.
mov rcx, rbx
call fcn.0045fe58
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x350]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x50]
call fcn.00404e54
nop
lea r8, str.VSSetupWatson
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xe0]
call fcn.0040c560
nop
mov r8, qword [0x004c2650]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.0040c560
nop
mov r8, qword [str.dw20.exe]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.0040c560
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
call fcn.004020b0
nop
cmp qword [rsp + 0x98], r13
jb 0x4630ce
mov rcx, qword [rsp + 0x80]
call fcn.00443d3c
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
cmp qword [rsp + 0xc0], r13
jb 0x4630fe
mov rcx, qword [rsp + 0xa8]
call fcn.00443d3c
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
cmp qword [rsp + 0x100], r13
jb 0x46312e
mov rcx, qword [rsp + 0xe8]
call fcn.00443d3c
mov qword [rsp + 0x100], r12
mov qword [rsp + 0xf8], r15
mov word [rsp + 0xe8], r15w
cmp qword [rsp + 0x70], r13
jb 0x463158
mov rcx, qword [rsp + 0x58]
call fcn.00443d3c
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
cmp qword [rbp + 0x20], r13
jb 0x463173
mov rcx, qword [rsi]
jmp 0x463176
mov rcx, rsi
xor edx, edx
call fcn.00445770
cmp eax, r15d
jne 0x4631a6
cmp rbx, r15
je 0x4631a2
cmp qword [rbp + 0x20], r13
jb 0x463190
mov rsi, qword [rsi]
mov r8, rsi
lea rdx, str.STATUS:_Watson_binaries_found_in_VSSetupWatson_sub_folder_at:__s
mov rcx, rbx
call fcn.0045fe58
mov al, 1
jmp 0x463219
lea rdx, str.STATUS:_Searching_the_MSI_for_binaries_to_extract.
mov rcx, rbx
call fcn.0045fe58
mov rdx, rbp
mov rcx, r14
call fcn.0046096c
cmp al, r15b
je 0x463203
cmp qword [rbp + 0x20], r13
jb 0x4631d0
mov rcx, qword [rsi]
jmp 0x4631d3
mov rcx, rsi
xor edx, edx
call fcn.00445770
cmp eax, r15d
jne 0x463203
cmp rbx, r15
je 0x4631ff
cmp qword [rbp + 0x20], r13
jb 0x4631ed
mov rsi, qword [rsi]
mov r8, rsi
lea rdx, str.STATUS:_Watson_binaries_found_in_MSI_Cab__Located_at:__s
mov rcx, rbx
call fcn.0045fe58
mov al, 1
jmp 0x463219
cmp rbx, r15
je 0x463217
lea rdx, str.ERROR:_Watson_binaries_not_found.
mov rcx, rbx
call fcn.0045fe58
xor al, al
mov rcx, qword [rsp + 0xd90]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0xdf0]
add rsp, 0xda0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
or r9, 0xffffffffffffffff
xor r8d, r8d
add rcx, 0x38
call fcn.004020b0
lea rdx, [rbx + 0x10]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x4624d8