Function at 0x4067c0
Capabilities:
Check os version
Get installed programs

Disassembly:
mov rax, rsp
sub rsp, 0x178
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov rax, qword [0x0045c120]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r13d, edx
mov r14, rcx
call fcn.00418ad4
mov rcx, rax
xor r12d, r12d
mov eax, r12d
test rcx, rcx
setne al
test eax, eax
jne 0x40682a
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.00418ad4
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x406859
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rdx, [0x004404b5]
mov rbp, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x4068a8
movzx edi, dx
mov ecx, edi
call fcn.00418ac0
test rax, rax
je 0x4068c8
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.00402bb0
mov rbx, qword [rsp + 0x30]
jmp 0x4068c8
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.00402d50
mov rbx, qword [rsp + 0x30]
test r13d, r13d
jne 0x40690e
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4068e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x38]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x406907
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x406f47
cmp dword [0x00453010], 2
jne 0x406f0b
xor edx, edx
mov r8d, 0x94
lea rcx, [rsp + 0x60]
call fcn.00425320
mov dword [rsp + 0x60], 0x94
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x64], 5
jne 0x406ecd
cmp dword [rsp + 0x68], 1
jne 0x406ecd
lea rsi, [rsp + 0x74]
lea rdi, str.Service_Pack
mov ecx, 0xd
repe cmpsb byte [rsi], byte [rdi]
je 0x406e8f
lea rsi, [rsp + 0x74]
lea rdi, str.Service_Pack_1
mov ecx, 0xf
repe cmpsb byte [rsi], byte [rdi]
je 0x406e8f
lea rsi, [rsp + 0x74]
lea rdi, str.Service_Pack_2
mov ecx, 0xf
repe cmpsb byte [rsi], byte [rdi]
jne 0x406bfc
test r13d, r13d
je 0x406f0b
nop
nop
xor eax, eax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rax
mov ecx, r12d
mov esi, r12d
imul rsi, rsi, 0x1cc
add rsi, r14
mov rdx, rsi
imul rcx, rcx, 0x1cc
lea rdi, [rsp + 0x100]
sub rdi, rcx
sub rdi, r14
nop
nop
movzx eax, byte [rdx]
mov byte [rdi + rdx], al
add rdx, 1
test al, al
jne 0x406a20
lea rcx, [rsp + 0x100]
call fcn.004251a0
mov r8, rsi
lea rdx, [0x00440928]
lea rcx, [rsp + 0x30]
call fcn.00403da0
mov rbx, qword [rsp + 0x30]
mov r8, rbx
mov edx, r12d
lea rcx, str.templogCheckRndisBKExist___FileDescList__d_.szFileName:_sztemp__s_n
call fcn.00405500
lea rsi, [rsp + 0x100]
lea rdi, str.kb909394
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x406ab2
lea rsi, [rsp + 0x100]
lea rdi, [0x004408b8]
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x406ab2
lea rsi, [rsp + 0x100]
lea rdi, [0x004408a8]
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
jne 0x406b55
mov rdx, rbx
lea rcx, str.templogCheckRndisBKExist____s_n
call fcn.00405500
lea r8, [rsp + 0x30]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea rcx, [rsp + 0x48]
call fcn.00403390
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov ecx, ebp
lock xadd dword [rdx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x406b1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
jne 0x406ba6
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
lea rcx, str.templogCheckRndisBKExist___1_already_installed__s_n
call fcn.00405500
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r12d, 1
cmp r12d, r13d
jae 0x406f0b
jmp 0x4069b0
mov rdx, rbx
lea rcx, str.templogCheckRndisBKExist___3__s_not_in_the_cfg_files_n
call fcn.00405500
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x406b81
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x38]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x406b9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x406f47
mov rdi, qword [rsp + 0x30]
mov rdx, rdi
lea rcx, str.templogCheckRndisBKExist___2__s_not_installed_n
call fcn.00405500
nop
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x406bd7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x38]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x406bf5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x406f47
lea rsi, [rsp + 0x74]
lea rdi, str.Service_Pack_3
mov ecx, 0xf
repe cmpsb byte [rsi], byte [rdi]
jne 0x406f0b
test r13d, r13d
je 0x406f0b
nop
xor eax, eax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rax
mov ecx, r12d
mov esi, r12d
imul rsi, rsi, 0x1cc
add rsi, r14
mov rdx, rsi
imul rcx, rcx, 0x1cc
lea rdi, [rsp + 0x100]
sub rdi, rcx
sub rdi, r14
nop
nop
movzx eax, byte [rdx]
mov byte [rdi + rdx], al
add rdx, 1
test al, al
jne 0x406c90
lea rcx, [rsp + 0x100]
call fcn.004251a0
mov r8, rsi
lea rdx, [0x00440928]
lea rcx, [rsp + 0x30]
call fcn.00403da0
mov rbx, qword [rsp + 0x30]
mov r8, rbx
mov edx, r12d
lea rcx, str.templogCheckRndisBKExist___FileDescList__d_.szFileName:_sztemp__s_n
call fcn.00405500
lea rsi, [rsp + 0x100]
lea rdi, [0x004408b8]
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x406d3b
lea rsi, [rsp + 0x100]
lea rdi, [0x004408a8]
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x406d3b
lea rsi, [rsp + 0x100]
lea rdi, str.kb909394
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
jne 0x406de3
mov r8, rbx
lea rdx, [rsp + 0x74]
lea rcx, str.templogCheckRndisBKExist___5_systemVersion_is__s__s_not_need_n
call fcn.00405500
jmp 0x406dd1
mov rdx, rbx
lea rcx, str.templogCheckRndisBKExist____s_n
call fcn.00405500
lea r8, [rsp + 0x30]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea rcx, [rsp + 0x50]
call fcn.00403390
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, ebp
lock xadd dword [rdx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x406da5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
jne 0x406e34
mov rbx, qword [rsp + 0x30]
mov r8, rbx
lea rdx, [rsp + 0x74]
lea rcx, str.templogCheckRndisBKExist___4_systemVersion_is__s__s__already_be_installed_n
call fcn.00405500
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r12d, 1
cmp r12d, r13d
jae 0x406f0b
jmp 0x406c20
mov rdx, rbx
lea rcx, str.templogCheckRndisBKExist___6__s_not_in_the_cfg_files_n
call fcn.00405500
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x406e0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x38]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x406e2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x406f47
mov rdi, qword [rsp + 0x30]
mov r8, rdi
lea rdx, [rsp + 0x74]
lea rcx, str.templogCheckRndisBKExist___5_systemVersion_is__s__s_not_installed_n
call fcn.00405500
nop
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x406e6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x38]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x406e88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x406f47
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x406eab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x38]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x406ec9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x406f47
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x406ee9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x38]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x406f07
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x406f47
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x406f27
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x38]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x406f45
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.004252f0
mov rbx, qword [rsp + 0x190]
mov rbp, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x168]
mov r12, qword [rsp + 0x160]
mov r13, qword [rsp + 0x158]
mov r14, qword [rsp + 0x150]
add rsp, 0x178
ret