Function at 0x1400024b0
Capabilities:
Check os version
Copy file
Create directory
Extract resource via kernel32 functions
Get common file path
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4f0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14006a030]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov r15, rdx
mov qword [rsp + 0x90], rdx
xor ebx, ebx
mov dword [rsp + 0xa0], ebx
cmp ecx, 3
jne 0x1400027bc
lea rdx, [0x140061c00]
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140003426
cmp qword [r15 + 8], rbx
je 0x140003426
mov edx, 0x100
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.SecurityHealthSecurityHealthSetup.exe
lea rcx, [rsp + 0x60]
call fcn.1400045a0
mov rdi, rax
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0xd0]
call fcn.1400045a0
nop
mov r9, rdi
mov r8, rax
lea rcx, [rsp + 0xa8]
call fcn.1400058b0
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x1400025be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a8b
call fcn.14002e30c
movdqa xmm0, xmmword [0x140061fb0]
movdqu xmmword [rsp + 0xe0], xmm0
mov word [rsp + 0xd0], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002619
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002614
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a91
call fcn.14002e30c
lea rdx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rdx, qword [rsp + 0xa8]
xor r8d, r8d
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140003a97
lea rcx, str.test
call fcn.1400023e0
mov dword [rsp + 0xa0], ebx
mov qword [rsp + 0x90], rbx
lea rcx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
mov ecx, eax
call fcn.140035674
mov rdi, rax
lea rcx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rcx, qword [rsp + 0xa8]
mov r9, rax
mov r8d, ebx
mov edx, dword [rsp + 0xa0]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140003b02
lea r9, [rsp + 0xc8]
lea r8, [rsp + 0x90]
lea rdx, str.StringFileInfo040904B0FileVersion
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400026fd
mov rcx, qword [rsp + 0x90]
call fcn.1400023e0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140003ab3
mov r8d, 0x100
lea rdx, str.securityhealthservice
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140003ac1
lea r8, [rsp + 0x118]
mov edx, 0xca
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140003ada
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rsp + 0xc0]
cmp rdx, 8
jb 0x140003a52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003afc
call fcn.14002e30c
jmp 0x140003a52
cmp ecx, 2
jne 0x140003426
mov esi, ebx
lea r14, [0x140061f00]
mov eax, 0xa
mov r8d, eax
mov rdx, qword [r14]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r13d, eax
mov rdx, qword [r15 + 8]
lea rcx, [rsp + 0x140]
call fcn.1400045a0
nop
lea r8, [rsp + 0x140]
cmp qword [rsp + 0x158], 8
setae dl
mov r9, qword [rsp + 0x140]
cmovae r8, r9
mov rax, qword [rsp + 0x150]
lea r15, [r8 + rax*2]
lea rcx, [rsp + 0x140]
test dl, dl
je 0x140002859
lea rdi, [r9 + rax*2]
jmp 0x140002865
lea rdi, [rcx + rax*2]
lea r9, [rsp + 0x140]
mov r8d, 0x22
mov rdx, rdi
mov rcx, r9
call fcn.14000cdd0
mov r10, rax
cmp rax, rdi
je 0x1400028a1
add rax, 2
cmp rax, rdi
je 0x1400028a1
movzx ecx, word [rax]
cmp cx, 0x22
je 0x140002898
mov word [r10], cx
add r10, 2
add rax, 2
cmp rax, rdi
jne 0x140002887
lea rcx, [rsp + 0x140]
cmp qword [rsp + 0x158], 8
setae r8b
cmovae rcx, qword [rsp + 0x140]
mov r9, r10
sub r9, rcx
sar r9, 1
sub r15, r10
sar r15, 1
mov rdi, qword [rsp + 0x150]
mov rax, rdi
sub rax, r9
cmp rax, r15
cmovb r15, rax
lea rax, [rsp + 0x140]
test r8b, r8b
cmovne rax, qword [rsp + 0x140]
lea rcx, [rax + r9*2]
sub rdi, r15
mov r8, rdi
sub r8, r9
lea r8, [r8*2 + 2]
lea rdx, [rcx + r15*2]
call fcn.140030140
mov qword [rsp + 0x150], rdi
mov rdx, qword [r14]
lea rcx, [rsp + 0xd0]
call fcn.1400045a0
mov rdi, rax
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x160]
call fcn.140004f70
nop
mov r9, rdi
mov r8, rax
lea rcx, [rsp + 0xf8]
call fcn.1400058b0
or dword [rsp + 0xa0], 0x80
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x1400029ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b1e
call fcn.14002e30c
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], bx
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x140002a10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b24
call fcn.14002e30c
lea rdx, [rsp + 0xf8]
cmp qword [rsp + 0x110], 8
cmovae rdx, qword [rsp + 0xf8]
lea r8, [0x140061d30]
lea rcx, [rsp + 0x88]
call fcn.140034a84
mov r9, qword [rsp + 0x88]
test r9, r9
je 0x140002a69
mov rdx, r13
mov r8d, 1
mov rcx, r12
call fcn.140035070
mov rcx, qword [rsp + 0x88]
call fcn.140034c68
mov rdx, qword [rsp + 0x110]
cmp rdx, 8
jb 0x140002ab1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b2a
call fcn.14002e30c
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0x110], 7
mov word [rsp + 0xf8], bx
mov rdx, qword [rsp + 0x158]
cmp rdx, 8
jb 0x140002b15
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b30
call fcn.14002e30c
inc esi
add r14, 8
cmp esi, 8
jae 0x140002b2d
mov r15, qword [rsp + 0x90]
jmp 0x1400027ce
mov dword [rsp + 0x50], ebx
mov r15, rbx
mov qword [rsp + 0x88], rbx
mov r12d, 0x5c
mov esi, ebx
mov dword [rsp + 0xa0], ebx
mov r14, rbx
mov qword [rsp + 0x58], rbx
lea r13, [0x140000000]
nop word [rax + rax]
mov rdx, qword [r13 + r15*8 + 0x61db0]
lea rcx, [rsp + 0x118]
call fcn.1400045a0
mov rdi, rax
mov rdx, qword [r13 + r14*8 + 0x61da0]
lea rcx, [rsp + 0x30]
call fcn.1400045a0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x140002bc2
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 8
jb 0x140002bb5
mov rax, qword [rcx]
mov word [rax + rdx*2], 0x28
mov word [rax + r8*2], bx
jmp 0x140002be1
mov qword [rsp + 0x20], 1
lea r9, [0x140061d3c]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.140005b70
mov rcx, rax
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0xd0], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0xe0], xmm1
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 7
mov word [rcx], bx
mov r9, rdi
lea r8, [rsp + 0xd0]
lea rcx, [rsp + 0xa8]
call fcn.1400058b0
nop
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140002c6e
lea rax, [rcx + 1]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xa8]
cmp rdx, 8
cmovae rax, qword [rsp + 0xa8]
mov dword [rax + rcx*2], 0x29
lea rax, [rsp + 0xa8]
jmp 0x140002c92
mov qword [rsp + 0x20], 1
lea r9, [0x140061d38]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0xa8]
call fcn.140005b70
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0x110], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xf8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x108], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rsp + 0xc0]
cmp rdx, 8
jb 0x140002d1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b36
call fcn.14002e30c
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], 7
mov word [rsp + 0xa8], bx
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x140002d80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b3c
call fcn.14002e30c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140002dc2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b42
call fcn.14002e30c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bx
mov rdx, qword [rsp + 0x130]
cmp rdx, 8
jb 0x140002e1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b48
call fcn.14002e30c
mov qword [rsp + 0x128], rbx
mov qword [rsp + 0x130], 7
mov word [rsp + 0x118], bx
lea rdx, [rsp + 0xf8]
cmp qword [rsp + 0x110], 8
cmovae rdx, qword [rsp + 0xf8]
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400033a1
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400033a1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x80], rax
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0xc8], eax
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax + 8]
lea rdi, [0x140061d40]
test rcx, rcx
cmovne rdi, rcx
mov rdx, qword [r13 + r15*8 + 0x61db0]
lea rcx, [rsp + 0xd0]
call fcn.1400045a0
mov rsi, rax
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.1400045a0
nop
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rcx, r9
sub rcx, r8
cmp rcx, 1
mov rcx, rax
jb 0x140002f15
lea rdx, [r8 + 1]
mov qword [rax + 0x10], rdx
cmp r9, 8
jb 0x140002f0a
mov rcx, qword [rax]
mov word [rcx + r8*2], r12w
mov word [rcx + rdx*2], bx
jmp 0x140002f31
mov qword [rsp + 0x20], 1
lea r9, [0x140061d2c]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.140005b70
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x118], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x128], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov r9, rsi
lea r8, [rsp + 0x118]
lea rcx, [rsp + 0x160]
call fcn.1400058b0
nop
mov rdx, qword [rsp + 0x130]
cmp rdx, 8
jb 0x140002fb9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b4e
call fcn.14002e30c
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002ffb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ff6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b54
call fcn.14002e30c
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], bx
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x140003056
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003051
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b5a
call fcn.14002e30c
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], bx
lea rcx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rcx, qword [rsp + 0x160]
call fcn.14003498c
test eax, eax
je 0x1400030b8
call fcn.1400351e8
mov rcx, rax
call fcn.140035208
test eax, eax
jne 0x140003352
call fcn.1400351e8
cmp dword [rax], 0x11
jne 0x140003352
mov rdx, qword [r13 + r14*8 + 0x61da0]
lea rcx, [rsp + 0xa8]
call fcn.1400045a0
mov r13, rax
mov r15, qword [rsp + 0x170]
movabs rax, 0x7ffffffffffffffe
mov rcx, rax
sub rcx, r15
cmp rcx, 1
jb 0x140003b7e
lea r12, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae r12, qword [rsp + 0x160]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea r14, [r15 + 1]
mov edi, 7
lea rsi, [rsp + 0x30]
cmp r14, rdi
jbe 0x1400031c7
mov rdi, r14
or rdi, 7
cmp rdi, rax
jbe 0x140003154
mov rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140003184
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140003b60
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400031b0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b60
mov rcx, rax
call fcn.14002e2d0
test rax, rax
je 0x140003b66
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400031c2
test rcx, rcx
je 0x1400031bf
call fcn.14002e2d0
mov rsi, rax
jmp 0x1400031c2
mov rsi, rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rdi
lea rdi, [r15 + r15]
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call fcn.140030140
mov r12d, 0x5c
mov word [rsi + rdi], r12w
mov word [rsi + r14*2], bx
mov r9, r13
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x118]
call fcn.1400058b0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14000324c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003246
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b66
call fcn.14002e30c
nop
mov rdx, qword [rsp + 0xc0]
cmp rdx, 8
jb 0x140003294
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000328f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b6c
call fcn.14002e30c
lea rdx, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae rdx, qword [rsp + 0x118]
lea r8, [0x140061d30]
lea rcx, [rsp + 0x98]
call fcn.140034a84
mov r9, qword [rsp + 0x98]
test r9, r9
je 0x1400032f6
mov edx, dword [rsp + 0xc8]
mov r8d, 1
mov rcx, qword [rsp + 0x80]
call fcn.140035070
mov rcx, qword [rsp + 0x98]
call fcn.140034c68
mov rdx, qword [rsp + 0x130]
cmp rdx, 8
jb 0x14000333e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003339
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b72
call fcn.14002e30c
lea r13, [0x140000000]
mov r15, qword [rsp + 0x88]
mov r14, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x14000339a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003395
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b78
call fcn.14002e30c
mov esi, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0x110]
cmp rdx, 8
jb 0x1400033e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b84
call fcn.14002e30c
inc esi
mov dword [rsp + 0xa0], esi
inc r14
mov qword [rsp + 0x58], r14
cmp esi, 2
jb 0x140002b60
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
inc r15
mov qword [rsp + 0x88], r15
cmp eax, 0x2a
jae 0x140003a52
jmp 0x140002b42
mov dword [rsp + 0x1a0], 0x11c
mov dword [rsp + 0x1ac], 0x1869f
mov r8b, 5
mov edx, 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
mov edx, 4
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1400039e3
call fcn.140001da0
mov r12d, eax
lea rdx, [rsp + 0x2c0]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x100
lea rdx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rbx
lea rax, [rsp + 0x2c0]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400034d0
movabs r13, 0x7ffffffffffffffe
cmp rdi, r13
ja 0x140003b8a
mov qword [rsp + 0xc0], 7
cmp rdi, 8
jae 0x14000352f
mov qword [rsp + 0xb8], rdi
add rdi, rdi
mov r8, rdi
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0xa8]
call fcn.140030140
mov word [rsp + rdi + 0xa8], bx
jmp 0x1400035ec
mov rsi, rdi
or rsi, 7
movabs r15, 0x7fffffffffffffff
cmp rsi, r13
jbe 0x14000354e
mov rsi, r13
lea rcx, [r15 + r15]
jmp 0x140003573
mov edx, 0xa
cmp rsi, rdx
cmovb rsi, rdx
lea rcx, [rsi + 1]
cmp rcx, r15
ja 0x140003b8f
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000359f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b94
mov rcx, rax
call fcn.14002e2d0
test rax, rax
je 0x140003b99
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400035b1
test rcx, rcx
je 0x1400035ae
call fcn.14002e2d0
mov r14, rax
jmp 0x1400035b1
mov r14, rbx
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
add rdi, rdi
mov r8, rdi
lea rdx, [rsp + 0x2c0]
mov rcx, r14
call fcn.140030140
mov word [rdi + r14], bx
mov r15, qword [rsp + 0x90]
mov r14d, 0xa
mov rdx, qword [r15]
lea rcx, [rsp + 0x60]
call fcn.1400045a0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x140003638
lea r9, [rdx + 2]
mov qword [rcx + 0x10], r9
mov rax, rcx
cmp r8, 8
jb 0x14000362a
mov rax, qword [rcx]
mov dword [rax + rdx*2], 0x220020
mov word [rax + r9*2], bx
jmp 0x140003657
mov qword [rsp + 0x20], 2
lea r9, [0x140061d54]
xor r8d, r8d
lea edx, [r8 + 2]
call fcn.140005b70
mov rcx, rax
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0xd0], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0xe0], xmm1
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 7
mov word [rcx], bx
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.1400058b0
nop
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rsi
cmp rax, 5
jb 0x1400036e5
lea rax, [rsi + 5]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x30]
cmp rcx, 8
cmovae rdi, qword [rsp + 0x30]
lea rcx, [rdi + rsi*2]
mov r8, r14
lea rdx, str.__nul
call fcn.140030140
mov word [rdi + rsi*2 + 0xa], bx
lea rax, [rsp + 0x30]
jmp 0x140003706
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140005b70
movups xmm7, xmmword [rax]
movups xmmword [rsp + 0x118], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rsp + 0x128], xmm6
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14000376e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003769
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b9f
call fcn.14002e30c
movdqa xmm0, xmmword [0x140061fb0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], bx
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x1400037ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ba5
call fcn.14002e30c
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000380c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003807
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bab
call fcn.14002e30c
movdqa xmm0, xmmword [0x140061fb0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], bx
mov rdx, qword [rsp + 0xc0]
cmp rdx, 8
jb 0x140003867
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003862
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bb1
call fcn.14002e30c
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rbx
lea r14, [rsp + 0x118]
movq rsi, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 8
cmovae r14, rsi
movq rdi, xmm6
cmp rdi, r13
ja 0x140003bb7
mov qword [rsp + 0xc0], 7
cmp rdi, 8
jae 0x1400038de
mov qword [rsp + 0xb8], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0xa8], xmm0
jmp 0x140003991
mov rax, rdi
or rax, 7
cmp rax, r13
jbe 0x1400038fa
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000392d
mov r13, rax
cmp rax, 0xa
mov eax, 0xa
cmovb r13, rax
lea rcx, [r13 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140003bbc
add rcx, rcx
cmp rcx, 0x1000
jb 0x140003959
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003bc1
mov rcx, rax
call fcn.14002e2d0
test rax, rax
je 0x140003bc6
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140003966
test rcx, rcx
je 0x140003966
call fcn.14002e2d0
mov rbx, rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], r13
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rbx
call fcn.140030140
lea rdx, [rsp + 0xa8]
mov ecx, r12d
call fcn.140001fb0
nop
cmp r15, 8
jb 0x140003a52
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400039d9
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bcc
mov rcx, rsi
call fcn.14002e30c
jmp 0x140003a52
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140003bd2
mov r8d, 0x100
lea rdx, str.securityhealthservice
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140003be0
lea r8, [rsp + 0xd0]
mov edx, 0xce
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140003bf9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor eax, eax
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.14002e2b0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400355fc
nop
call fcn.1400355fc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, str.CopyError
call fcn.1400023e0
mov ecx, ebx
call fcn.140034980
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140034980
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call fcn.140034980
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call fcn.140034980
int3
call fcn.1400355fc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, str.VersionError
call fcn.1400023e0
mov ecx, ebx
call fcn.140034980
nop
call fcn.1400355fc
nop
call fcn.1400355fc
int3
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.140001170
int3
call fcn.1400355fc
nop
call fcn.1400355fc
int3
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.140001210
nop
call fcn.1400355fc
nop
call fcn.140001210
call fcn.140001170
call fcn.140001170
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.1400355fc
nop
call fcn.1400355fc
int3
call fcn.140001210
call fcn.140001170
call fcn.140001170
call fcn.1400355fc
nop
call fcn.1400355fc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140034980
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call fcn.140034980
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call fcn.140034980
int3