Function at 0x140091cf0
Capabilities:
Check os version
Copy file
Delete file
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x2a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x2d8], rbx
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov esi, r9d
mov rdi, r8
mov rbx, rcx
call fcn.140001280
mov qword [0x140167678], rbx
lea rcx, str.RICHED32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140167788], rax
xor ecx, ecx
lea rbp, str.ocxdrv32.dll
lea r12, [0x140167250]
nop
nop
movzx eax, byte [rcx + rbp]
mov byte [rcx + r12], al
add rcx, 1
test al, al
jne 0x140091d60
xor edx, edx
lea rcx, [0x140167050]
call fcn.1400b3df0
xor ecx, ecx
call fcn.1400c2a40
mov rcx, rax
call fcn.1400c2a90
mov rcx, rdi
call fcn.140007120
mov rcx, rdi
call fcn.1400881e0
mov r13d, 1
cmp dword [0x140167dec], 0
jne 0x140091faf
mov edx, 0x104
mov rcx, rbp
call fcn.140095240
test eax, eax
jne 0x140091ddd
xor r9d, r9d
mov r8d, r13d
lea rdx, [0x1400fde74]
mov rcx, rbp
call fcn.1400894c0
call fcn.140095e30
jmp 0x140091e45
cmp eax, r13d
jle 0x140091e45
mov rax, qword [0x140160e18]
mov qword [rsp + 0x20], rax
lea rdx, [0x1400e4ec8]
lea rcx, [rsp + 0x20]
call fcn.14002d430
xor r8d, r8d
mov edx, 0xdf13
lea rcx, [rsp + 0x20]
call fcn.14002e500
nop
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r9d, 0x30
lea r8, [0x1400eaaa8]
mov rdx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rsp + 0x20]
call fcn.14002d2c0
xor eax, eax
jmp 0x1400922d1
mov rdx, rbp
mov rcx, r12
call fcn.1400c1f80
test eax, eax
jne 0x140091f45
xor r9d, r9d
mov r8d, r13d
lea rdx, [0x1400fde74]
mov rcx, rbp
call fcn.1400894c0
mov byte [rsp + 0x180], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x181]
call fcn.1400c2840
mov byte [rsp + 0x70], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x71]
call fcn.1400c2840
mov edx, 0x104
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x180]
call fcn.1400b3390
lea rdi, [rsp + 0x180]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [r12 + rcx]
mov byte [rdi + rcx - 1], al
add rcx, r13
test al, al
jne 0x140091ee0
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x70]
call fcn.1400b3390
lea rdi, [rsp + 0x70]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rcx + rbp]
mov byte [rdi + rcx - 1], al
add rcx, r13
test al, al
jne 0x140091f20
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.140009630
cmp dword [0x140167dec], 0
jne 0x140091faf
mov rax, qword [0x140160e18]
mov qword [rsp + 0x20], rax
lea rdx, [0x1400e4ec8]
lea rcx, [rsp + 0x20]
call fcn.14002d430
xor r8d, r8d
mov edx, 0xe00b
lea rcx, [rsp + 0x20]
call fcn.14002e500
nop
mov rax, qword [rsp + 0x20]
lea rdi, [0x1401674f0]
sub rdi, rax
movzx ecx, byte [rax]
mov byte [rdi + rax], cl
add rax, 1
test cl, cl
jne 0x140091f92
lea rcx, [rsp + 0x20]
call fcn.14002d2c0
jmp 0x140092042
mov rax, qword [0x140160e18]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400e4ec8]
lea rcx, [rsp + 0x28]
call fcn.14002d430
xor r8d, r8d
mov edx, 0xe00c
lea rcx, [rsp + 0x28]
call fcn.14002e500
nop
mov rax, qword [0x140160e18]
mov qword [rsp + 0x20], rax
lea rdx, [0x1400e4ec8]
lea rcx, [rsp + 0x20]
call fcn.14002d430
xor r8d, r8d
mov edx, 0xe00d
lea rcx, [rsp + 0x20]
call fcn.14002e500
nop
mov r9, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
lea rdx, str._s__s
lea rcx, [0x1401674f0]
call fcn.1400c2cf0
nop
lea rcx, [rsp + 0x20]
call fcn.14002d2c0
nop
lea rcx, [rsp + 0x28]
call fcn.14002d2c0
lea r8, str.eb3xInstSetup
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov qword [0x1401673d8], rax
test rax, rax
jne 0x14009227d
lea r9, str.eb3xInstSetup
mov r8d, r13d
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov qword [0x1401673d8], rax
cmp dword [0x140167ef8], 0
jne 0x1400920e3
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1400920be
call fcn.1400b3860
test eax, eax
jne 0x1400920be
mov r8d, r13d
lea edx, [rax + 2]
lea rcx, str.This_product_requires_Administrator_rights_to_Install_or_Modify.
call fcn.140007590
mov eax, dword [0x1401643f0]
jmp 0x1400922d1
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1400920e3
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [0x140167de4]
cmp al, 6
cmovae ecx, r13d
mov dword [0x140167de4], ecx
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x34], 0x1ff
lea rcx, [rsp + 0x30]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, 0xf4fffe
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [0x140167ab8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov r8, qword [0x140167678]
lea rdx, [0x14008ec90]
mov ecx, 4
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x140167bc8], rax
mov rcx, rbx
call fcn.140091c30
test ax, ax
je 0x1400921e6
mov edx, esi
mov rcx, rbx
call fcn.140088140
test eax, eax
je 0x1400921e6
xor r9d, r9d
xor r8d, r8d
mov edx, 0x590
mov rcx, qword [0x140167898]
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jle 0x1400921ef
nop
nop
mov rcx, qword [0x1401679a8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400921b7
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1401679a8]
call qword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x1400921cd
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jg 0x140092190
jmp 0x1400921ef
mov qword [rsp + 0x50], 0
mov rcx, qword [0x140167bc8]
test rcx, rcx
je 0x140092201
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, qword [0x140167ab8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [0x140167138]
test rcx, rcx
je 0x140092238
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [0x140167140]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov qword [0x140167138], 0
mov rcx, qword [0x140167788]
test rcx, rcx
je 0x140092255
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140167788], 0
mov rcx, qword [0x1401674e8]
call qword [sym.imp.GDI32.dll_DeleteObject]
xor r8d, r8d
mov edx, r13d
mov rcx, qword [0x1401673d8]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [0x1401643f0]
jmp 0x1400922d1
mov rax, qword [0x140160e18]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400e4ec8]
lea rcx, [rsp + 0x28]
call fcn.14002d430
xor r8d, r8d
mov edx, 0xe00f
lea rcx, [rsp + 0x28]
call fcn.14002e500
nop
mov r8d, r13d
mov edx, 0x10
mov rcx, qword [rsp + 0x28]
call fcn.140007590
mov edi, dword [0x1401643f0]
lea rcx, [rsp + 0x28]
call fcn.14002d2c0
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2a0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret