Function at 0x14001f6ec
Capabilities:
Get common file path
Get file attributes
Persist via run registry key
Set current directory
Set registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbd0]
sub rsp, 0xcd0
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0xbc0], rax
mov r12, qword [rcx + 0x30]
xor ebx, ebx
mov esi, r9d
mov r13d, edx
mov r14, rcx
mov edi, ebx
cmp edx, 3
je 0x14001f756
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14001f756
call fcn.140017448
test eax, eax
je 0x14001f756
mov rcx, r14
call fcn.14001f578
mov edi, eax
test eax, eax
js 0x14001ff84
test r12, r12
jne 0x14001f765
mov eax, 0x80004003
jmp 0x14001ff84
mov rcx, r12
call fcn.140017448
test eax, eax
jne 0x14001f77b
mov eax, 0x80070002
jmp 0x14001ff84
mov eax, dword [r14 + 0x58]
mov r15d, 1
cmp eax, r15d
je 0x14001fbbf
jle 0x14001fbb5
cmp eax, 4
jle 0x14001fafe
cmp eax, 5
je 0x14001f99e
cmp eax, 6
jne 0x14001fbb5
mov r15d, 0x104
lea rcx, [rbp - 0x80]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or edi, 0xffffffff
test eax, eax
je 0x14001f7f2
lea r8, str._rundll32.exe
mov edx, r15d
lea rcx, [rbp - 0x80]
call fcn.140001584
test eax, eax
js 0x14001f7f2
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x14001f7f2
test al, 0x10
je 0x14001f83e
mov edx, 0x103
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14001f93c
lea r8, str._rundll32.exe
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140001584
test eax, eax
js 0x14001f93c
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x14001f93c
test al, 0x10
jne 0x14001f93c
neg esi
lea rax, [0x14003f4a0]
lea r9, [rbp - 0x80]
mov edx, 0x208
sbb ecx, ecx
lea r8, str._s_advpack.dll_LaunchINFSectionEx__s__s___lu_N
and ecx, 0x200
add ecx, 0x2c
cmp qword [r14 + 0x28], rbx
mov dword [rsp + 0x30], ecx
lea rcx, [rbp + 0x7b0]
cmovne rax, qword [r14 + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call fcn.140001734
lea rdx, [rbp + 0x190]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r8, r12
lea rcx, [rbp + 0x5a0]
mov rdx, r15
call fcn.140001470
mov edx, 0x5c
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x14001f8c1
mov word [rax], bx
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8d, dword [r14 + 0x70]
lea rdx, [rbp + 0x7b0]
mov r9d, 0xffff
lea rcx, [rbp - 0x80]
call fcn.140019648
test eax, eax
je 0x14001f8f0
mov edi, ebx
jmp 0x14001f90e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test edi, edi
js 0x14001ff64
call fcn.140017b60
test eax, eax
je 0x14001ff64
lea r8, str.Advpack_INF
jmp 0x14001fadc
mov rcx, qword [0x140050310]
or r15, 0xffffffffffffffff
mov edi, 0x80070002
lea esi, [r15 + 3]
cmp rcx, r15
jne 0x14001f96c
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, r15
je 0x14001ff64
cmp dword [0x1400516e0], esi
jl 0x14001ff64
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], ebx
mov r8d, 0x53
mov qword [rsp + 0x20], rbx
lea rdx, str.ERROR:_Install_for_package_was_halted.__RunDll32.exe_was_not_found_on_the_system._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14001ff64
mov r15d, 0x104
lea rcx, [rbp - 0x80]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14001f9c8
lea r8, str._rundll32.exe
mov edx, r15d
lea rcx, [rbp - 0x80]
call fcn.140001584
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or edi, 0xffffffff
cmp eax, edi
je 0x14001f9dd
test al, 0x10
je 0x14001fa1d
mov edx, 0x103
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14001fa03
lea r8, str._rundll32.exe
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140001584
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x14001f93c
test al, 0x10
jne 0x14001f93c
mov esi, 0x208
lea r8, [rbp - 0x80]
mov edx, esi
lea rcx, [rbp + 0x190]
call fcn.140001470
lea rax, str._setupapi_InstallHinfSection_DefaultInstall_132
cmp r13d, 3
lea r8, str._setupapi_InstallHinfSection_Uninstall_132
mov edx, esi
cmovne r8, rax
lea rcx, [rbp + 0x190]
call fcn.140001584
mov r8, r12
lea rcx, [rbp + 0x190]
mov edx, esi
call fcn.140001584
mov r8, qword [r14 + 0x28]
test r8, r8
je 0x14001fa80
mov edx, esi
lea rcx, [rbp + 0x190]
call fcn.140001584
mov r8d, dword [r14 + 0x70]
lea rdx, [rbp + 0x190]
mov r9d, 0xffff
lea rcx, [rbp - 0x80]
call fcn.140019648
test eax, eax
je 0x14001faa2
mov edi, ebx
jmp 0x14001fac8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14001ff64
call fcn.140017b60
test eax, eax
je 0x14001ff64
lea r8, str.Setupapi_INF
or dword [0x140050558], 8
lea rdx, str.__Reboot_requested_due_to__S_file_copy._r_n
mov ecx, 2
call fcn.140016868
mov edi, 0xd2af9
jmp 0x14001ff64
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], 0x2a
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], ebx
call fcn.140017b60
mov dword [0x140050554], eax
lea r8, str.Uninstall
mov dword [0x14005055c], r15d
mov rax, qword [r14 + 0xc0]
mov qword [rsp + 0x68], rax
cmp r13d, 3
je 0x14001fb43
mov r8, qword [r14 + 0x28]
mov r9d, esi
lea rcx, [rsp + 0x58]
mov rdx, r12
call fcn.140034cdc
mov edi, eax
test eax, eax
jns 0x14001fb9d
cmp byte [r14 + 0x94], bl
je 0x14001fb81
or dword [0x1400516f0], 4
lea rdx, str.ERROR:_Install_of__S_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov r8, r12
mov ecx, 2
call fcn.140016868
mov edi, ebx
jmp 0x14001fb9d
mov dword [0x1400516f8], eax
mov rax, qword [r14 + 0xc0]
mov ecx, dword [rax + 0x64]
add ecx, dword [0x140050318]
mov dword [0x1400516f4], ecx
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001ff64
call fcn.14003c2b8
jmp 0x14001ff64
mov edi, 0x80004005
jmp 0x14001ff64
mov r8, r12
lea rcx, [rbp + 0x190]
mov edx, 0x207
call fcn.140001470
mov esi, 0x208
lea r8, reloc.ATL.DLL_AtlInternalQueryInterface
mov edx, esi
lea rcx, [rbp + 0x190]
call fcn.140001584
mov r8, qword [r14 + 0x28]
test r8, r8
je 0x14001fc04
mov edx, esi
lea rcx, [rbp + 0x190]
call fcn.140001584
mov rcx, qword [r14 + 0xc0]
xor edx, edx
call fcn.140025070
mov rcx, rax
cmp rax, 0x186a0
jae 0x14001fc2b
mov eax, 0xd1b71759
mul ecx
mov ecx, edx
shr ecx, 0xd
jmp 0x14001fc3b
mov eax, 0x4f8b588f
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x10
mov r13d, 0x64
cmp ecx, r13d
jbe 0x14001fc58
mov eax, 0xcccccccd
mul ecx
shr edx, 3
mov dword [0x140051700], edx
jmp 0x14001fc68
mov eax, 0x14
cmp ecx, eax
cmovb ecx, eax
mov dword [0x140051700], ecx
lea rdx, [0x140042eb0]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14001fc9a
mov ecx, r13d
mov dword [0x140051708], r15d
mov esi, 0x1f4
call fcn.1400159e8
mov r15d, dword [0x14005032c]
jmp 0x14001fcba
mov ecx, dword [0x140051700]
mov esi, 0x1388
mov dword [0x140051708], ebx
call fcn.1400159e8
mov ecx, 0x26ec
call fcn.140015b74
mov rcx, qword [0x1400516d8]
lea r9, [0x14001b310]
mov r8d, esi
mov edx, 0x2f00
call qword [sym.imp.USER32.dll_SetTimer]
mov esi, 2
mov rcx, r12
test r15d, r15d
je 0x14001fd27
mov r8d, dword [r14 + 0x70]
lea rdx, [rbp + 0x190]
mov r9d, 0xffff
call fcn.140019648
test eax, eax
je 0x14001fd04
mov edi, ebx
jmp 0x14001fe1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14001fe1e
lea rdx, [0x140042eb0]
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14001fe0d
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001fdfa
mov r15d, 0x104
lea rcx, [rbp - 0x80]
mov edx, r15d
call fcn.140017e34
test eax, eax
je 0x14001fdef
lea r8, str.wmdbexport.exe
mov edx, r15d
lea rcx, [rbp - 0x80]
call fcn.140001584
test eax, eax
js 0x14001fdef
lea rax, [rbp - 0x80]
or r15, 0xffffffffffffffff
inc r15
cmp word [rax + r15*2], bx
jne 0x14001fdb5
mov rcx, qword [rsp + 0x50]
lea eax, [r15*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.WMC_WMPDBExport
lea rax, [rbp - 0x80]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.wmdbexport.exe_was_not_run_as_wmp11_installs_did_not_complete.
mov ecx, 4
call fcn.140016868
jmp 0x14001fe1e
mov r8, r12
lea rdx, str.ERROR:__S_was_not_executed_as_the_WMP11_install_check_was__ve._Setup_will_not_fail_because_of_this_issue._r_n
mov ecx, esi
call fcn.140016868
cmp dword [0x140051708], ebx
mov ecx, r13d
jne 0x14001fe2f
mov ecx, dword [0x140051700]
call fcn.140015aec
mov rcx, qword [0x1400516d8]
mov edx, 0x2f00
call qword [sym.imp.USER32.dll_KillTimer]
test edi, edi
jns 0x14001fe6d
cmp byte [r14 + 0x94], bl
je 0x14001fe6d
or dword [0x1400516f0], 1
lea rdx, str.ERROR:_Execution_of__S_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov r8, r12
mov ecx, esi
call fcn.140016868
mov edi, ebx
mov r15d, 0xd2af9
cmp dword [r14 + 0x90], ebx
je 0x14001fed8
cmp edi, 0x80070bc2
je 0x14001fee9
cmp edi, 0x8007f901
jne 0x14001fe90
mov edi, ebx
jmp 0x14001ff08
cmp edi, 0x8007f02a
jne 0x14001fe9f
mov edi, 0xc00d2afb
jmp 0x14001ff08
test edi, edi
js 0x14001feba
call fcn.140017b60
mov dword [0x140050554], eax
mov dword [0x14005055c], 1
jmp 0x14001ff08
mov rax, qword [r14 + 0xc0]
mov dword [0x1400516f8], edi
mov ecx, dword [rax + 0x64]
add ecx, dword [0x140050318]
mov dword [0x1400516f4], ecx
jmp 0x14001ff08
test edi, edi
js 0x14001ff08
call fcn.140017b60
cmp dword [0x140050554], eax
jae 0x14001ff08
or dword [0x140050558], 8
lea r8, str.External_App
lea rdx, str.__Reboot_requested_due_to__S_file_copy._r_n
mov ecx, esi
call fcn.140016868
mov edi, r15d
mov edx, edi
mov rcx, r12
call fcn.14001b1a0
test eax, eax
jne 0x14001ff2a
or dword [0x1400516f0], esi
lea rdx, str.ERROR:_DRM_licence_migration_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov ecx, esi
call fcn.140016868
lea rdx, str.wmp11.exe
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x14001ff54
lea rdx, str.wmp11_64.exe
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14001ff64
test edi, edi
js 0x14001ff5e
cmp edi, r15d
setne bl
mov dword [0x14005032c], ebx
mov r8d, edi
lea rdx, str.__Package_install_complete.__Last_result_0x_x._r_n
mov ecx, 4
call fcn.140016868
xor edx, edx
mov rcx, r14
call fcn.14001dfc4
mov eax, edi
mov rcx, qword [rbp + 0xbc0]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0xd18]
add rsp, 0xcd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret