Function at 0x14001f74c
Capabilities:
Get common file path
Get file attributes
Persist via run registry key
Set current directory
Set registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbd0]
sub rsp, 0xcd0
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0xbc0], rax
mov r12, qword [rcx + 0x30]
xor ebx, ebx
mov esi, r9d
mov r13d, edx
mov r14, rcx
mov edi, ebx
cmp edx, 3
je 0x14001f7b6
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14001f7b6
call fcn.140017488
test eax, eax
je 0x14001f7b6
mov rcx, r14
call fcn.14001f5d8
mov edi, eax
test eax, eax
js 0x14001ffe8
test r12, r12
jne 0x14001f7c5
mov eax, 0x80004003
jmp 0x14001ffe8
mov rcx, r12
call fcn.140017488
test eax, eax
jne 0x14001f7db
mov eax, 0x80070002
jmp 0x14001ffe8
mov eax, dword [r14 + 0x58]
mov r15d, 1
cmp eax, r15d
je 0x14001fc23
jle 0x14001fc19
cmp eax, 4
jle 0x14001fb5e
cmp eax, 5
je 0x14001f9fe
cmp eax, 6
jne 0x14001fc19
mov r15d, 0x104
lea rcx, [rbp - 0x80]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or edi, 0xffffffff
test eax, eax
je 0x14001f852
lea r8, str._rundll32.exe
mov edx, r15d
lea rcx, [rbp - 0x80]
call fcn.140001584
test eax, eax
js 0x14001f852
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x14001f852
test al, 0x10
je 0x14001f89e
mov edx, 0x103
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14001f99c
lea r8, str._rundll32.exe
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140001584
test eax, eax
js 0x14001f99c
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x14001f99c
test al, 0x10
jne 0x14001f99c
neg esi
lea rax, [0x14003f4a0]
lea r9, [rbp - 0x80]
mov edx, 0x208
sbb ecx, ecx
lea r8, str._s_advpack.dll_LaunchINFSectionEx__s__s___lu_N
and ecx, 0x200
add ecx, 0x2c
cmp qword [r14 + 0x28], rbx
mov dword [rsp + 0x30], ecx
lea rcx, [rbp + 0x7b0]
cmovne rax, qword [r14 + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call fcn.140001734
lea rdx, [rbp + 0x190]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r8, r12
lea rcx, [rbp + 0x5a0]
mov rdx, r15
call fcn.140001470
mov edx, 0x5c
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x14001f921
mov word [rax], bx
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8d, dword [r14 + 0x70]
lea rdx, [rbp + 0x7b0]
mov r9d, 0xffff
lea rcx, [rbp - 0x80]
call fcn.140019694
test eax, eax
je 0x14001f950
mov edi, ebx
jmp 0x14001f96e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test edi, edi
js 0x14001ffc8
call fcn.140017ba8
test eax, eax
je 0x14001ffc8
lea r8, str.Advpack_INF
jmp 0x14001fb3c
mov rcx, qword [0x140050310]
or r15, 0xffffffffffffffff
mov edi, 0x80070002
lea esi, [r15 + 3]
cmp rcx, r15
jne 0x14001f9cc
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, r15
je 0x14001ffc8
cmp dword [0x1400516e0], esi
jl 0x14001ffc8
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], ebx
mov r8d, 0x53
mov qword [rsp + 0x20], rbx
lea rdx, str.ERROR:_Install_for_package_was_halted.__RunDll32.exe_was_not_found_on_the_system._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14001ffc8
mov r15d, 0x104
lea rcx, [rbp - 0x80]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14001fa28
lea r8, str._rundll32.exe
mov edx, r15d
lea rcx, [rbp - 0x80]
call fcn.140001584
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or edi, 0xffffffff
cmp eax, edi
je 0x14001fa3d
test al, 0x10
je 0x14001fa7d
mov edx, 0x103
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14001fa63
lea r8, str._rundll32.exe
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140001584
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x14001f99c
test al, 0x10
jne 0x14001f99c
mov esi, 0x208
lea r8, [rbp - 0x80]
mov edx, esi
lea rcx, [rbp + 0x190]
call fcn.140001470
lea rax, str._setupapi_InstallHinfSection_DefaultInstall_132
cmp r13d, 3
lea r8, str._setupapi_InstallHinfSection_Uninstall_132
mov edx, esi
cmovne r8, rax
lea rcx, [rbp + 0x190]
call fcn.140001584
mov r8, r12
lea rcx, [rbp + 0x190]
mov edx, esi
call fcn.140001584
mov r8, qword [r14 + 0x28]
test r8, r8
je 0x14001fae0
mov edx, esi
lea rcx, [rbp + 0x190]
call fcn.140001584
mov r8d, dword [r14 + 0x70]
lea rdx, [rbp + 0x190]
mov r9d, 0xffff
lea rcx, [rbp - 0x80]
call fcn.140019694
test eax, eax
je 0x14001fb02
mov edi, ebx
jmp 0x14001fb28
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14001ffc8
call fcn.140017ba8
test eax, eax
je 0x14001ffc8
lea r8, str.Setupapi_INF
or dword [0x140050558], 8
lea rdx, str.__Reboot_requested_due_to__S_file_copy._r_n
mov ecx, 2
call fcn.1400168a8
mov edi, 0xd2af9
jmp 0x14001ffc8
xorps xmm0, xmm0
mov dword [rsp + 0x78], 0x2a
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], ebx
call fcn.140017ba8
mov dword [0x140050554], eax
lea r8, str.Uninstall
mov dword [0x14005055c], r15d
mov rax, qword [r14 + 0xc0]
mov qword [rsp + 0x68], rax
cmp r13d, 3
je 0x14001fba7
mov r8, qword [r14 + 0x28]
mov r9d, esi
lea rcx, [rsp + 0x58]
mov rdx, r12
call fcn.140034dd0
mov edi, eax
test eax, eax
jns 0x14001fc01
cmp byte [r14 + 0x94], bl
je 0x14001fbe5
or dword [0x1400516f0], 4
lea rdx, str.ERROR:_Install_of__S_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov r8, r12
mov ecx, 2
call fcn.1400168a8
mov edi, ebx
jmp 0x14001fc01
mov dword [0x1400516f8], eax
mov rax, qword [r14 + 0xc0]
mov ecx, dword [rax + 0x64]
add ecx, dword [0x140050318]
mov dword [0x1400516f4], ecx
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001ffc8
call fcn.14003c408
jmp 0x14001ffc8
mov edi, 0x80004005
jmp 0x14001ffc8
mov r8, r12
lea rcx, [rbp + 0x190]
mov edx, 0x207
call fcn.140001470
mov esi, 0x208
lea r8, reloc.ATL.DLL_AtlInternalQueryInterface
mov edx, esi
lea rcx, [rbp + 0x190]
call fcn.140001584
mov r8, qword [r14 + 0x28]
test r8, r8
je 0x14001fc68
mov edx, esi
lea rcx, [rbp + 0x190]
call fcn.140001584
mov rcx, qword [r14 + 0xc0]
xor edx, edx
call fcn.1400250d8
mov rcx, rax
cmp rax, 0x186a0
jae 0x14001fc8f
mov eax, 0xd1b71759
mul ecx
mov ecx, edx
shr ecx, 0xd
jmp 0x14001fc9f
mov eax, 0x4f8b588f
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x10
mov r13d, 0x64
cmp ecx, r13d
jbe 0x14001fcbc
mov eax, 0xcccccccd
mul ecx
shr edx, 3
mov dword [0x140051700], edx
jmp 0x14001fccc
mov eax, 0x14
cmp ecx, eax
cmovb ecx, eax
mov dword [0x140051700], ecx
lea rdx, [0x140042eb0]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14001fcfe
mov ecx, r13d
mov dword [0x140051708], r15d
mov esi, 0x1f4
call fcn.140015a28
mov r15d, dword [0x14005032c]
jmp 0x14001fd1e
mov ecx, dword [0x140051700]
mov esi, 0x1388
mov dword [0x140051708], ebx
call fcn.140015a28
mov ecx, 0x26ec
call fcn.140015bb4
mov rcx, qword [0x1400516d8]
lea r9, [0x14001b360]
mov r8d, esi
mov edx, 0x2f00
call qword [sym.imp.USER32.dll_SetTimer]
mov esi, 2
mov rcx, r12
test r15d, r15d
je 0x14001fd8b
mov r8d, dword [r14 + 0x70]
lea rdx, [rbp + 0x190]
mov r9d, 0xffff
call fcn.140019694
test eax, eax
je 0x14001fd68
mov edi, ebx
jmp 0x14001fe82
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14001fe82
lea rdx, [0x140042eb0]
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14001fe71
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001fe5e
mov r15d, 0x104
lea rcx, [rbp - 0x80]
mov edx, r15d
call fcn.140017e7c
test eax, eax
je 0x14001fe53
lea r8, str.wmdbexport.exe
mov edx, r15d
lea rcx, [rbp - 0x80]
call fcn.140001584
test eax, eax
js 0x14001fe53
lea rax, [rbp - 0x80]
or r15, 0xffffffffffffffff
inc r15
cmp word [rax + r15*2], bx
jne 0x14001fe19
mov rcx, qword [rsp + 0x50]
lea eax, [r15*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.WMC_WMPDBExport
lea rax, [rbp - 0x80]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.wmdbexport.exe_was_not_run_as_wmp11_installs_did_not_complete.
mov ecx, 4
call fcn.1400168a8
jmp 0x14001fe82
mov r8, r12
lea rdx, str.ERROR:__S_was_not_executed_as_the_WMP11_install_check_was__ve._Setup_will_not_fail_because_of_this_issue._r_n
mov ecx, esi
call fcn.1400168a8
cmp dword [0x140051708], ebx
mov ecx, r13d
jne 0x14001fe93
mov ecx, dword [0x140051700]
call fcn.140015b2c
mov rcx, qword [0x1400516d8]
mov edx, 0x2f00
call qword [sym.imp.USER32.dll_KillTimer]
test edi, edi
jns 0x14001fed1
cmp byte [r14 + 0x94], bl
je 0x14001fed1
or dword [0x1400516f0], 1
lea rdx, str.ERROR:_Execution_of__S_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov r8, r12
mov ecx, esi
call fcn.1400168a8
mov edi, ebx
mov r15d, 0xd2af9
cmp dword [r14 + 0x90], ebx
je 0x14001ff3c
cmp edi, 0x80070bc2
je 0x14001ff4d
cmp edi, 0x8007f901
jne 0x14001fef4
mov edi, ebx
jmp 0x14001ff6c
cmp edi, 0x8007f02a
jne 0x14001ff03
mov edi, 0xc00d2afb
jmp 0x14001ff6c
test edi, edi
js 0x14001ff1e
call fcn.140017ba8
mov dword [0x140050554], eax
mov dword [0x14005055c], 1
jmp 0x14001ff6c
mov rax, qword [r14 + 0xc0]
mov dword [0x1400516f8], edi
mov ecx, dword [rax + 0x64]
add ecx, dword [0x140050318]
mov dword [0x1400516f4], ecx
jmp 0x14001ff6c
test edi, edi
js 0x14001ff6c
call fcn.140017ba8
cmp dword [0x140050554], eax
jae 0x14001ff6c
or dword [0x140050558], 8
lea r8, str.External_App
lea rdx, str.__Reboot_requested_due_to__S_file_copy._r_n
mov ecx, esi
call fcn.1400168a8
mov edi, r15d
mov edx, edi
mov rcx, r12
call fcn.14001b1f0
test eax, eax
jne 0x14001ff8e
or dword [0x1400516f0], esi
lea rdx, str.ERROR:_DRM_licence_migration_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov ecx, esi
call fcn.1400168a8
lea rdx, str.wmp11.exe
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x14001ffb8
lea rdx, str.wmp11_64.exe
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14001ffc8
test edi, edi
js 0x14001ffc2
cmp edi, r15d
setne bl
mov dword [0x14005032c], ebx
mov r8d, edi
lea rdx, str.__Package_install_complete.__Last_result_0x_x._r_n
mov ecx, 4
call fcn.1400168a8
xor edx, edx
mov rcx, r14
call fcn.14001e018
mov eax, edi
mov rcx, qword [rbp + 0xbc0]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0xd18]
add rsp, 0xcd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret