Function at 0x140077370
Capabilities:
Read .ini file

Disassembly:
push rbp
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.14024c240
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1290], rbx
mov qword [rsp + 0x1298], rdi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rbp + 0x1170], rax
xor r8d, r8d
lea rdx, str.CBaseFuncSub::FS_CheckAndStopDOMSService
lea rcx, [rsp + 0x30]
call fcn.1400075a0
nop
call fcn.140102a14
mov r11, rax
xor edi, edi
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400773e7
mov ecx, 0x80004005
call fcn.140005210
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14024b970
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x170]
call fcn.14024b970
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
lea r8, str.SOFTWARECanonDOMS
mov rdx, 0xffffffff80000002
call qword [rax + 0xf0]
test eax, eax
je 0x14007748f
mov r9d, 1
lea r8, str.return___08x
lea edx, [r9 + 1]
lea rcx, [rsp + 0x30]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14007748a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
jmp 0x1400778a6
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x48]
call qword [rax + pe_nt_image_headers64]
mov word [rbp + 0x970], di
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x972]
call fcn.14024b970
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x170]
lea rdx, str.TEMPPATH
mov rcx, rax
call qword [r9 + 0x18]
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, str.InsDrv.ini
mov edx, 0x400
lea rcx, [rbp + 0x170]
call fcn.140246470
lea r11, [rbp + 0x170]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x400
lea r9, [rbp + 0x970]
lea r8, [0x1402dc4e0]
lea rdx, str.DomsServiceNAME
lea rcx, str.Installer_Info
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x970]
lea rdx, str.DOMSNAME
mov rcx, rax
call qword [r9 + 0x20]
mov rcx, qword [0x1403b9770]
lea r9, [rbp + 0x970]
lea r8, [rbp + 0x970]
mov edx, 0xa1
mov rax, qword [rcx]
cmp dword [0x1403b9778], 0
jne 0x1400775db
call qword [rax + 0x18]
cmp eax, 7
jne 0x14007770d
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rax - 5]
lea rcx, [rsp + 0x30]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400775ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x30]
call fcn.140007730
xor eax, eax
jmp 0x1400778b5
call qword [rax + 0x18]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x170]
lea rdx, str.SILENTPATH
mov rcx, rax
call qword [r9 + 0x18]
cmp word [rbp + 0x170], 0
jne 0x140077646
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x170]
lea rdx, str.WindowsFolder
mov rcx, rax
call qword [r9 + 0x18]
lea rdx, str.silent.ini
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r9, [rbp + 0x170]
lea r8, str._t_t_tSILENTPATH___s_
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.140007780
lea r11, [rbp + 0x170]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x60]
lea r8, [0x1402dc4e0]
lea rdx, str.DomsServiceCheck
lea rcx, str.DOMS
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r9, [rsp + 0x60]
lea r8, str._t_t_tDomsServiceCheck_____s_
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.140007780
lea rdx, [0x1402ed1b0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14007770d
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rax + 2]
lea rcx, [rsp + 0x30]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400776fc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x30]
call fcn.140007730
xor eax, eax
jmp 0x1400778b5
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x170]
lea rdx, str.TEMPPATH
mov rcx, rax
call qword [r9 + 0x18]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x16e], 0x5c
je 0x140077765
lea r8, [0x1402e5094]
mov edx, 0x400
lea rcx, [rbp + 0x170]
call fcn.140246470
lea r8, str.InsDrv.ini
mov edx, 0x400
lea rcx, [rbp + 0x170]
call fcn.140246470
lea r9, [rbp + 0x170]
lea r8, str._t_t_tInsDrv.ini
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.140007780
lea r11, [rbp + 0x170]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x60]
lea r8, [0x1402dc4e0]
lea rdx, str.DomsServiceSTOP
lea rcx, str.Installer_Info
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r9, [rsp + 0x60]
lea r8, str._t_t_tDomsServiceSTOP_____s_
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.140007780
lea rdx, [0x1402e2d58]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14007786e
mov rcx, qword [0x1403b9758]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r8, qword [rax]
xor edx, edx
mov rcx, rax
call qword [r8 + 0x130]
mov r8d, eax
lea rdx, [0x1402dc3ec]
lea rcx, [rsp + 0x40]
call fcn.14000de40
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rax + 8]
add rcx, 0x5814
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r9, rbx
lea r8, str._t_t_ttheApp.GetInfoMgr____GetInfoShareMem____mpMemdata__properties_5_.value____s_
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.140007780
mov r9d, 1
lea r8, str.return___08x
lea edx, [r9 + 1]
lea rcx, [rsp + 0x30]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400778a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x30]
call fcn.140007730
mov eax, 1
mov rcx, qword [rbp + 0x1170]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x1280]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret