Function at 0x18000f300
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xaa8]
sub rsp, 0xb90
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rbp + 0xa80], rax
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000fbe4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, str.OnCommand_Uninstall
mov rbx, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x18000f382
movzx edx, dx
lea rcx, [rsp + 0x30]
call fcn.18000cc80
jmp 0x18000f39d
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000f385
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.18000fcf0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.18000b530
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000f3cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x240]
call fcn.180027560
mov edx, 1
lea rcx, [rbp + 0x240]
call fcn.1800094b0
test eax, eax
jne 0x18000f530
lea rdx, str.fail_GetInstallLdsShellExtDllPath
lea rcx, [rsp + 0x70]
call fcn.18000b860
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000fbef
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.uninstall_fail
cmp rdx, 0x10000
jae 0x18000f448
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.18000cc80
jmp 0x18000f468
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000f450
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000fbfa
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000f4a7
movzx edx, dx
lea rcx, [rsp + 0x38]
call fcn.18000cc80
jmp 0x18000f4c8
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000f4b0
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000f509
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000fba1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x18000fba1
xor esi, esi
mov r15d, esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x450]
call fcn.180027560
lea edx, [rsi + 1]
lea rcx, [rbp + 0x450]
call fcn.1800094b0
mov edi, 0x104
test eax, eax
je 0x18000f5fb
mov ecx, edi
lea rax, [rbp + 0x450]
nop
cmp word [rax], si
je 0x18000f57f
add rax, 2
sub rcx, 1
jne 0x18000f570
mov rax, rdi
sub rax, rcx
mov r8, rsi
test rcx, rcx
cmovne r8, rax
je 0x18000f5e7
mov rdx, rdi
sub rdx, r8
lea rcx, [rbp + 0x450]
lea rcx, [rcx + r8*2]
je 0x18000f5d9
lea rax, [rdx + 0x7ffffefa]
add rax, r8
lea r9, str..service.dll
sub r9, rcx
test rax, rax
je 0x18000f5d9
movzx r8d, word [rcx + r9]
test r8w, r8w
je 0x18000f5d9
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x18000f5b8
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x450]
call fcn.180009de0
mov r15, rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x30]
call fcn.180027560
mov edx, 1
lea rcx, [rbp + 0x30]
call fcn.1800094b0
test eax, eax
je 0x18000f6b2
mov rcx, rdi
lea rax, [rbp + 0x30]
nop dword [rax]
cmp word [rax], si
je 0x18000f63f
add rax, 2
sub rcx, 1
jne 0x18000f630
mov rax, rdi
sub rax, rcx
mov rdx, rsi
test rcx, rcx
cmovne rdx, rax
je 0x18000f69f
sub rdi, rdx
lea rcx, [rbp + 0x30]
lea rcx, [rcx + rdx*2]
je 0x18000f691
lea rax, [rdi + 0x7ffffefa]
add rax, rdx
lea r8, str..helper.exe
sub r8, rcx
test rax, rax
je 0x18000f691
movzx edx, word [rcx + r8]
test dx, dx
je 0x18000f691
mov word [rcx], dx
add rcx, 2
dec rax
sub rdi, 1
jne 0x18000f672
lea rax, [rcx - 2]
test rdi, rdi
cmovne rax, rcx
mov word [rax], si
lea rcx, [rbp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov edi, 1
jne 0x18000f6b4
mov edi, esi
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov r14d, eax
test eax, eax
je 0x18000f830
movdqa xmm0, xmmword [0x180047150]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
test edi, edi
je 0x18000f945
mov r8d, 7
lea rdx, str.__dll_
lea rcx, [rbp + 0x10]
call fcn.1800083e0
lea rax, [rbp + 0x240]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x18000f705
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x10]
call fcn.18000a4a0
mov r8d, 0x26
lea rdx, str.____entryShellOpen_Ludashi32W___verb
lea rcx, [rbp + 0x10]
call fcn.18000a4a0
mov r8d, 8
lea rdx, str.DllUnreg
lea rcx, [rbp + 0x10]
call fcn.18000a4a0
mov dword [rbp - 0x60], 0x70
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rbp - 0x5c]
call fcn.180027560
mov qword [rbp - 0x58], r15
mov rax, qword [str.RunAs]
mov qword [rbp - 0x50], rax
lea rax, [rbp + 0x30]
mov qword [rbp - 0x48], rax
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rax, qword [rbp + 0x10]
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x30], 5
mov dword [rbp - 0x5c], 0x40
lea rcx, [rbp - 0x60]
call fcn.180009e60
test eax, eax
je 0x18000f7ba
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.180009290
jmp 0x18000f7d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.fail_unregsvr32_d
lea rcx, [rsp + 0x70]
call fcn.18000b860
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x18000f7e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x240]
call fcn.1800091e0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x18000f830
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f82b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fc05
call fcn.18001dbb8
test edi, edi
je 0x18000f83d
lea rcx, [rbp + 0x30]
call fcn.1800091e0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x660]
call fcn.180027560
mov edx, 1
lea rcx, [rbp + 0x660]
call fcn.1800094b0
test eax, eax
je 0x18000f8a5
lea rcx, [rbp + 0x660]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.1800097d0
lea rcx, str.Base64.dll
lea rdx, str.Base.dll
test al, al
cmovne rdx, rcx
lea rcx, [rbp + 0x660]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x660]
call fcn.1800091e0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x870]
call fcn.180027560
mov edx, 1
lea rcx, [rbp + 0x870]
call fcn.1800093d0
lea rdx, str.inst_bizhi_ui.exe
lea rcx, [rbp + 0x870]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x870]
call fcn.1800091e0
lea rcx, [rbp + 0x450]
call fcn.1800091e0
test r14d, r14d
je 0x18000fb93
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000fc0b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, str.uninstall_succeed
cmp rdx, 0x10000
jae 0x18000fabe
movzx edx, dx
lea rcx, [rsp + 0x60]
call fcn.18000cc80
jmp 0x18000fad9
lea rdx, str.fail_bRealInstallHelper
lea rcx, [rsp + 0x70]
call fcn.18000b860
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000fc16
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, str.uninstall_fail
cmp rdx, 0x10000
jae 0x18000f995
movzx edx, dx
lea rcx, [rsp + 0x50]
call fcn.18000cc80
jmp 0x18000f9b8
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000f9a0
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000fc21
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000f9f7
movzx edx, dx
lea rcx, [rsp + 0x48]
call fcn.18000cc80
jmp 0x18000fa18
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000fa00
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000fa57
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18000fa74
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x18000fab4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000faaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fc2c
call fcn.18001dbb8
mov ebx, 0xfffffffe
jmp 0x18000fba1
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000fac1
mov r8d, eax
lea rcx, [rsp + 0x60]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000fbd9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000fb18
movzx edx, dx
lea rcx, [rsp + 0x58]
call fcn.18000cc80
jmp 0x18000fb38
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000fb20
mov r8d, eax
lea rcx, [rsp + 0x58]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000fb77
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18000fb93
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov edx, 1
xor ecx, ecx
call fcn.180014560
mov ebx, esi
lea rcx, [rsp + 0x70]
call fcn.18000b6c0
mov eax, ebx
mov rcx, qword [rbp + 0xa80]
xor rcx, rsp
call fcn.18001e0c0
lea r11, [rsp + 0xb90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
call fcn.180029c54
int3
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
call fcn.180029c54
int3