Function at 0x409b70
Capabilities:
Get common file path
Get file version info

Disassembly:
mov rax, rsp
sub rsp, 0x4f8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov qword [rax - 0x18], r14
mov rax, qword [0x0045c120]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
call fcn.00418ad4
mov rdx, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x409bd7
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
cmp byte [0x0045db98], 0
jne 0x409c1e
lea rdx, [rbx - 0x18]
mov r12, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40a03e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40a03e
mov dword [rsp + 0x58], r13d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesWdf01000Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x58], 2
jne 0x409ca1
lea rdx, [rbx - 0x18]
mov r12, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40a03e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40a03e
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x409cf1
lea rcx, str.Error_:_Get_windows_path_error_n
call fcn.00405500
nop
lea rdx, [rbx - 0x18]
mov r12, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40a03e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40a03e
mov rcx, r13
nop
nop
nop
movzx eax, byte [rsp + rcx + 0x2b0]
mov byte [rsp + rcx + 0x90], al
add rcx, 1
test al, al
jne 0x409d00
lea rdx, str._system32driverswdf01000.sys
lea rcx, [rsp + 0x1a0]
call fcn.00427d80
lea rdi, [rsp + 0x90]
xor eax, eax
mov r12, 0xffffffffffffffff
mov rcx, r12
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x409d50
xor edx, edx
lea rcx, [rsp + 0x90]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
mov ecx, eax
call fcn.0041859c
mov r14, rax
test rax, rax
jne 0x409da5
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40a03e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40a03e
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00425320
mov r9, r14
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x90]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x409df9
mov rcx, r14
call fcn.004185a4
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40a03e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40a03e
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x68], r13d
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x70]
lea rdx, [0x00440e0c]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x409e4e
mov rcx, r14
call fcn.004185a4
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40a03e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40a03e
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 8]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0xc]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x64], eax
shr eax, 0x10
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ebp, ax
movzx ecx, word [rsp + 0x64]
call qword [sym.imp.WS2_32.dll_htons]
movzx esi, ax
movzx ecx, word [rsp + 0x62]
call qword [sym.imp.WS2_32.dll_htons]
movzx edi, ax
movzx ecx, word [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_htons]
movzx r8d, ax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
mov r9d, edi
lea rdx, str._d_d_d_d
lea rcx, [rsp + 0x3c0]
call fcn.00427d80
lea rdx, str.176001
lea rcx, [rsp + 0x3c0]
call fcn.00424c70
test rax, rax
jne 0x409f12
mov rcx, r14
call fcn.004185a4
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40a03e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40a03e
mov rcx, r14
call fcn.004185a4
mov r8, r14
lea rdx, str._nInfo__:_Find_beta_wdf1.07__delete_it._n_n
lea rcx, [rsp + 0x50]
call fcn.00403da0
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.00405500
lea rcx, [rsp + 0x90]
call fcn.00401b70
test al, al
jne 0x409f80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x90]
lea rdx, str.Error_:_Remove_file___s__fail__err:__d_n
lea rcx, [rsp + 0x50]
call fcn.00403da0
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.00405500
nop
nop
movzx eax, byte [rsp + r13 + 0x2b0]
mov byte [rsp + r13 + 0x90], al
add r13, 1
test al, al
jne 0x409f80
lea rdx, str._system32driverswdfldr.sys
lea rcx, [rsp + 0x1a0]
call fcn.00427d80
lea rdi, [rsp + 0x90]
xor eax, eax
mov rcx, r12
repne scasb al, byte [rdi]
lea r8, [rsp + 0x1a0]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [r8 + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x409fd0
lea rcx, [rsp + 0x90]
call fcn.00401b70
test al, al
jne 0x40a022
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x90]
lea rdx, str.Error_:_Remove_file___s__fail__err:__d_n
lea rcx, [rsp + 0x50]
call fcn.00403da0
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.00405500
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40a03e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.004252f0
mov rbx, qword [rsp + 0x500]
mov rbp, qword [rsp + 0x508]
mov rsi, qword [rsp + 0x510]
mov rdi, qword [rsp + 0x518]
mov r12, qword [rsp + 0x4f0]
mov r13, qword [rsp + 0x4e8]
mov r14, qword [rsp + 0x4e0]
add rsp, 0x4f8
ret