Function at 0x14009cb60
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1210]
mov eax, 0x1310
call fcn.1401e33b0
sub rsp, rax
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x1200], rax
lea rdx, str.OperateService::CheckAndStopDOMSService
lea rcx, [rbp - 0x60]
call fcn.14001abe0
nop
lea rsi, [0x1402a8360]
lea r13, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14009cbf7
test byte [rcx + 0x1c], 1
je 0x14009cbf7
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, MsiOpenDatabaseW
lea r8, [0x140259e30]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x14009d74b
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x200]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.1401e7e40
lea rax, vtable.CMap_class_ATL::CStringT_unsigned_short_int__class_StrTraitMFC_unsigned_short_int__class_ATL::ChTraitsCRT_unsigned_short_int_____unsigned_short_int_const____ptr64__unsigned_char____ptr64__unsigned_char____ptr64_.0
mov qword [rsp + 0x48], rax
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], reloc.COMCTL32.dll_InitCommonControls
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x14026f400]
movdqa xmmword [rsp + 0x70], xmm1
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
lfence
lea ecx, [r12 + 0x48]
call fcn.1401baa78
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], r12
mov rcx, qword [rsp + 0x60]
mov rax, rcx
neg rax
sbb rdi, rdi
lea r14d, [r12 - 1]
test rcx, rcx
je 0x14009ce00
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x14009d75c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x70], rbx
mov r9, qword [rsp + 0x50]
test r9, r9
je 0x14009d756
mov rsi, rdi
test rdi, rdi
je 0x14009d756
mov r8d, dword [rsp + 0x58]
cmp rdi, 0xffffffffffffffff
jne 0x14009cd2f
mov ecx, r12d
test r8d, r8d
je 0x14009cd2f
mov eax, ecx
mov rsi, qword [r9 + rax*8]
test rsi, rsi
jne 0x14009cd2f
inc ecx
cmp ecx, r8d
jb 0x14009cd14
test rsi, rsi
je 0x14009d756
mov rdi, qword [rsi + 0x10]
test rdi, rdi
jne 0x14009cd57
xor edx, edx
mov eax, dword [rsi + 0x18]
div r8d
inc edx
cmp edx, r8d
jae 0x14009cd57
mov rdi, qword [r9 + rdx*8]
test rdi, rdi
jne 0x14009cd57
inc edx
cmp edx, r8d
jb 0x14009cd47
mov rdx, qword [rsi]
lea rcx, [rdx - 0x18]
lea r15, [rbx - 0x18]
cmp rcx, r15
je 0x14009cdbd
cmp dword [r15 + 0x10], 0
jl 0x14009cdac
mov rax, qword [r15]
cmp qword [rcx], rax
jne 0x14009cdac
call fcn.140004d00
mov rbx, rax
mov ecx, r14d
lock xadd dword [r15 + 0x10], ecx
sub ecx, 1
jg 0x14009cda2
lfence
mov rcx, qword [r15]
mov r8, qword [rcx]
mov rdx, r15
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
add rbx, 0x18
mov qword [rbp - 0x70], rbx
jmp 0x14009cdbd
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x70]
call fcn.140004e60
mov rbx, qword [rbp - 0x70]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14009cdcc
call fcn.1400079c0
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009cdf0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
test rdi, rdi
jne 0x14009ccc1
lea rsi, [0x1402a8360]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14009ce69
mov edi, r12d
mov edx, dword [rsp + 0x58]
test edx, edx
je 0x14009ce5f
mov eax, edi
mov rbx, qword [rcx + rax*8]
test rbx, rbx
je 0x14009ce59
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009ce47
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14009ce20
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
inc edi
cmp edi, edx
jb 0x14009ce15
call fcn.1400079c0
mov qword [rsp + 0x50], r12
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, qword [rsp + 0x70]
call fcn.1401bc020
mov qword [rsp + 0x70], r12
mov rbx, qword [rbp - 0x80]
mov r8, qword [rbx + 8]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.140008f00
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rbp - 0x78], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARECanonDOMS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14009cefe
mov byte [rbp - 0x58], 1
mov r12d, 1
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14009d40b
test byte [rcx + 0x1c], r12b
je 0x14009d40b
lea edx, [r12 + 0x54]
jmp 0x14009d3e3
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14009cf1e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
test eax, eax
cmove rcx, r12
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
neg rax
sbb rdi, rdi
test rcx, rcx
je 0x14009d078
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x14009d740
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov r9, qword [rsp + 0x50]
test r9, r9
je 0x14009d767
mov rsi, rdi
test rdi, rdi
je 0x14009d767
mov r8d, dword [rsp + 0x58]
cmp rdi, 0xffffffffffffffff
jne 0x14009cfab
mov ecx, r12d
test r8d, r8d
je 0x14009cfab
nop dword [rax]
mov eax, ecx
mov rsi, qword [r9 + rax*8]
test rsi, rsi
jne 0x14009cfab
inc ecx
cmp ecx, r8d
jb 0x14009cf90
test rsi, rsi
je 0x14009d767
mov rdi, qword [rsi + 0x10]
test rdi, rdi
jne 0x14009cfd3
xor edx, edx
mov eax, dword [rsi + 0x18]
div r8d
inc edx
cmp edx, r8d
jae 0x14009cfd3
mov rdi, qword [r9 + rdx*8]
test rdi, rdi
jne 0x14009cfd3
inc edx
cmp edx, r8d
jb 0x14009cfc3
mov rdx, qword [rsi]
lea rcx, [rdx - 0x18]
lea r15, [rbx - 0x18]
cmp rcx, r15
je 0x14009d03c
cmp dword [r15 + 0x10], 0
jl 0x14009d029
mov rax, qword [r15]
cmp qword [rcx], rax
jne 0x14009d029
call fcn.140004d00
mov rbx, rax
mov ecx, r14d
lock xadd dword [r15 + 0x10], ecx
sub ecx, 1
jg 0x14009d01e
lfence
mov rcx, qword [r15]
mov r8, qword [rcx]
mov rdx, r15
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
add rbx, 0x18
mov qword [rsp + 0x38], rbx
jmp 0x14009d03c
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140004e60
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14009d04b
call fcn.1400079c0
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009d06f
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
test rdi, rdi
jne 0x14009cf35
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14009d0e9
mov edi, r12d
mov edx, dword [rsp + 0x58]
test edx, edx
je 0x14009d0df
nop dword [rax]
mov eax, edi
mov rbx, qword [rcx + rax*8]
test rbx, rbx
je 0x14009d0d9
nop dword [rax + rax]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009d0c7
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14009d0a0
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
inc edi
cmp edi, edx
jb 0x14009d090
call fcn.1400079c0
mov qword [rsp + 0x50], r12
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, qword [rsp + 0x70]
call fcn.1401bc020
mov qword [rsp + 0x70], r12
mov rbx, qword [rbp - 0x80]
mov r8, qword [rbx + 8]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.140008f00
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rbp - 0x78], r12
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xa00]
call fcn.1401e7e40
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x200]
lea rdx, str.TEMPPATH
mov rcx, r9
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, str.InsDrv.ini
mov edx, 0x400
lea rcx, [rbp + 0x200]
call fcn.1401ec614
lea rax, [rbp + 0x200]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rbp + 0xa00]
lea r8, [0x140251dfc]
lea rdx, str.DomsServiceNAME
lea rcx, str.Installer_Info
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
lea r8, [rbp + 0xa00]
lea rdx, str.DOMSNAME
mov rcx, r9
call qword [case.0x1400136d6.0]
mov rcx, qword [0x1402bbf68]
lea r9, [rbp + 0xa00]
lea r8, [rbp + 0xa00]
mov edx, 0xa1
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
cmp dword [0x1402bbf70], 0
jne 0x14009d264
call qword [case.0x1400136d6.0]
cmp eax, 7
jne 0x14009d415
mov byte [rbp - 0x58], 1
mov rcx, qword [0x1402a8360]
lea rsi, [0x1402a8360]
cmp rcx, rsi
je 0x14009d40b
test byte [rcx + 0x1c], 1
je 0x14009d40b
lea edx, [rax + 0x4f]
jmp 0x14009d3e3
call qword [case.0x1400136d6.0]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x200]
lea rdx, str.SILENTPATH
mov rcx, r9
call qword [case.0x1400136d6.0]
cmp word [rbp + 0x200], 0
jne 0x14009d2f2
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x200]
lea rdx, str.WindowsFolder
mov rcx, r9
call qword [case.0x1400136d6.0]
lea rdx, str.silent.ini
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [0x1402a8360]
lea rsi, [0x1402a8360]
cmp rcx, rsi
je 0x14009d33f
test byte [rcx + 0x1c], 4
je 0x14009d33f
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, MsiOpenDatabaseW
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
lea r8, [0x140259e30]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rax, [rbp + 0x200]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp - 0x10]
lea r8, [0x140251dfc]
lea rdx, str.DomsServiceCheck
lea rcx, str.DOMS
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14009d3b5
test byte [rcx + 0x1c], 4
je 0x14009d3b5
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.msi.dll_MsiOpenDatabaseW
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r8, [0x140259e30]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rdx, [0x140255944]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14009d41c
mov byte [rbp - 0x58], 1
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14009d40b
test byte [rcx + 0x1c], 1
je 0x14009d40b
lea edx, [rax + 0x59]
mov r9, r13
cmp qword [0x1402bbdc8], 8
mov dword [rsp + 0x20], r12d
cmovae r9, qword [0x1402bbdb0]
lea r8, [0x140259e30]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
mov rbx, qword [rsp + 0x30]
jmp 0x14009d66e
lea rsi, [0x1402a8360]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x200]
lea rdx, str.TEMPPATH
mov rcx, r9
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x1fe], 0x5c
je 0x14009d484
lea r8, [0x140251df8]
mov edx, 0x400
lea rcx, [rbp + 0x200]
call fcn.1401ec614
lea r8, str.InsDrv.ini
mov edx, 0x400
lea rcx, [rbp + 0x200]
call fcn.1401ec614
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14009d4e2
test byte [rcx + 0x1c], 4
je 0x14009d4e2
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x5a
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
lea r8, [0x140259e30]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rax, [rbp + 0x200]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp - 0x10]
lea r8, [0x140251dfc]
lea rdx, str.DomsServiceSTOP
lea rcx, str.Installer_Info
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14009d558
test byte [rcx + 0x1c], 4
je 0x14009d558
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x5b
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r8, [0x140259e30]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rdx, [0x140254ca8]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14009d61f
mov rcx, qword [0x1402bbf58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x118]
xor edx, edx
mov rcx, r8
call qword [case.0x1400136d6.0]
mov r8d, eax
lea rdx, [0x1402524b4]
lea rcx, [rsp + 0x30]
call fcn.140018e20
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov rcx, qword [rax + 8]
add rcx, 0x5814
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14009d62b
test byte [rcx + 0x1c], 4
je 0x14009d62b
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x5c
mov qword [rsp + 0x20], rbx
lea r8, [0x140259e30]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
jmp 0x14009d624
mov rbx, qword [rsp + 0x30]
mov rcx, qword [0x1402a8360]
mov byte [rbp - 0x58], 1
mov r12d, 1
cmp rcx, rsi
je 0x14009d66e
test byte [rcx + 0x1c], r12b
je 0x14009d66e
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [r12 + 0x5c]
mov dword [rsp + 0x20], r12d
lea r8, [0x140259e30]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
nop
lea rcx, [rsp + 0x40]
call fcn.140007a90
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14009d69d
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rax, vtable.WppTrace.0
mov qword [rbp - 0x60], rax
cmp byte [rbp - 0x58], 0
jne 0x14009d6fb
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14009d6fb
test byte [rcx + 0x1c], 1
je 0x14009d6fb
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r8, qword [rbp - 0x50]
cmp qword [0x1402bbdc8], 8
cmovae r13, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], r8
mov r9, r13
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp - 0x30]
call fcn.1400048a0
lea rcx, [rbp - 0x50]
call fcn.1400048a0
mov eax, r12d
mov rcx, qword [rbp + 0x1200]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x1310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
call fcn.1401bb848
nop
mov ecx, 0x80004005
call fcn.140001470
nop
call fcn.1401bb848
int3