Function at 0x40b520
Capabilities:
Get common file path
Get file version info

Disassembly:
mov rax, rsp
sub rsp, 0x4f8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov qword [rax - 0x18], r14
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
call fcn.00418c7c
mov rdx, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x40b587
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
cmp byte [0x00461138], 0
jne 0x40b5ce
lea rdx, [rbx - 0x18]
mov r12, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40b9ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40b9ee
mov dword [rsp + 0x58], r13d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesWdf01000Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x58], 2
jne 0x40b651
lea rdx, [rbx - 0x18]
mov r12, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40b9ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40b9ee
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40b6a1
lea rcx, str.Error_:_Get_windows_path_error_n
call fcn.00404a90
nop
lea rdx, [rbx - 0x18]
mov r12, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40b9ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40b9ee
mov rcx, r13
nop
nop
nop
movzx eax, byte [rsp + rcx + 0x2b0]
mov byte [rsp + rcx + 0x90], al
add rcx, 1
test al, al
jne 0x40b6b0
lea rdx, str._system32driverswdf01000.sys
lea rcx, [rsp + 0x1a0]
call fcn.00427fd0
lea rdi, [rsp + 0x90]
xor eax, eax
mov r12, 0xffffffffffffffff
mov rcx, r12
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x40b700
xor edx, edx
lea rcx, [rsp + 0x90]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
mov ecx, eax
call fcn.00418744
mov r14, rax
test rax, rax
jne 0x40b755
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40b9ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40b9ee
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.004255a0
mov r9, r14
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x90]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40b7a9
mov rcx, r14
call fcn.0041873c
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40b9ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40b9ee
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x68], r13d
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x70]
lea rdx, [0x0044244c]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40b7fe
mov rcx, r14
call fcn.0041873c
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40b9ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40b9ee
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 8]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0xc]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x64], eax
shr eax, 0x10
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ebp, ax
movzx ecx, word [rsp + 0x64]
call qword [sym.imp.WS2_32.dll_htons]
movzx esi, ax
movzx ecx, word [rsp + 0x62]
call qword [sym.imp.WS2_32.dll_htons]
movzx edi, ax
movzx ecx, word [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_htons]
movzx r8d, ax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
mov r9d, edi
lea rdx, str._d_d_d_d
lea rcx, [rsp + 0x3c0]
call fcn.00427fd0
lea rdx, str.176001
lea rcx, [rsp + 0x3c0]
call fcn.00424e10
test rax, rax
jne 0x40b8c2
mov rcx, r14
call fcn.0041873c
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40b9ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40b9ee
mov rcx, r14
call fcn.0041873c
mov r8, r14
lea rdx, str._nInfo__:_Find_beta_wdf1.07__delete_it._n_n
lea rcx, [rsp + 0x50]
call fcn.004038f0
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.00404a90
lea rcx, [rsp + 0x90]
call fcn.00401bf0
test al, al
jne 0x40b930
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x90]
lea rdx, str.Error_:_Remove_file___s__fail__err:__d_n
lea rcx, [rsp + 0x50]
call fcn.004038f0
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.00404a90
nop
nop
movzx eax, byte [rsp + r13 + 0x2b0]
mov byte [rsp + r13 + 0x90], al
add r13, 1
test al, al
jne 0x40b930
lea rdx, str._system32driverswdfldr.sys
lea rcx, [rsp + 0x1a0]
call fcn.00427fd0
lea rdi, [rsp + 0x90]
xor eax, eax
mov rcx, r12
repne scasb al, byte [rdi]
lea r8, [rsp + 0x1a0]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [r8 + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x40b980
lea rcx, [rsp + 0x90]
call fcn.00401bf0
test al, al
jne 0x40b9d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x90]
lea rdx, str.Error_:_Remove_file___s__fail__err:__d_n
lea rcx, [rsp + 0x50]
call fcn.004038f0
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.00404a90
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40b9ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.00425570
mov rbx, qword [rsp + 0x500]
mov rbp, qword [rsp + 0x508]
mov rsi, qword [rsp + 0x510]
mov rdi, qword [rsp + 0x518]
mov r12, qword [rsp + 0x4f0]
mov r13, qword [rsp + 0x4e8]
mov r14, qword [rsp + 0x4e0]
add rsp, 0x4f8
ret