Create a gist now

Instantly share code, notes, and snippets.

What would you like to do?
.text:00000600000AF3C0 ; =============== S U B R O U T I N E =======================================
.text:00000600000AF3C0
.text:00000600000AF3C0
.text:00000600000AF3C0 ; __int64 IsDeviceServiceable(void)
.text:00000600000AF3C0 ?IsDeviceServiceable@@YAHXZ proc near ; CODE XREF: sub_6000008C990:loc_6000008CA79p
.text:00000600000AF3C0 ; CAgentUpdateManager::FindUpdates(CSearchCall &)+53Fp ...
.text:00000600000AF3C0
.text:00000600000AF3C0 var_28 = dword ptr -28h
.text:00000600000AF3C0 var_20 = dword ptr -20h
.text:00000600000AF3C0 var_18 = dword ptr -18h
.text:00000600000AF3C0
.text:00000600000AF3C0 push rbx
.text:00000600000AF3C2 sub rsp, 40h
.text:00000600000AF3C6 xor ebx, ebx
.text:00000600000AF3C8 cmp cs:dword_600002EE948, ebx
.text:00000600000AF3CE jnz short loc_600000AF3D8
.text:00000600000AF3D0 mov eax, cs:dword_600002EE94C
.text:00000600000AF3D6 jmp short loc_600000AF43C
.text:00000600000AF3D8 ; ---------------------------------------------------------------------------
.text:00000600000AF3D8
.text:00000600000AF3D8 loc_600000AF3D8: ; CODE XREF: IsDeviceServiceable(void)+Ej
.text:00000600000AF3D8 call ?IsCPUSupported@@YAHXZ ; IsCPUSupported(void)
.text:00000600000AF3DD mov cs:dword_600002EE94C, eax
.text:00000600000AF3E3 call ?__AreTestKeysAllowed@@YAHXZ ; __AreTestKeysAllowed(void)
.text:00000600000AF3E8 cmp eax, ebx
.text:00000600000AF3EA jz short loc_600000AF42E
.text:00000600000AF3EC mov [rsp+48h+var_18], 1
.text:00000600000AF3F4 or [rsp+48h+var_20], 0FFFFFFFFh
.text:00000600000AF3F9 lea r8, aForceunsupport ; "ForceUnsupportedCPU"
.text:00000600000AF400 lea rdx, aSoftwareMicr_3 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVe"...
.text:00000600000AF407 xor r9d, r9d
.text:00000600000AF40A mov rcx, 0FFFFFFFF80000002h
.text:00000600000AF411 mov [rsp+48h+var_28], ebx
.text:00000600000AF415 call ?RegQueryDwordValueWithDefaultAndRangeCheck@@YAKPEAUHKEY__@@PEBG1KKKW4RegistryHiveType@@@Z ; RegQueryDwordValueWithDefaultAndRangeCheck(HKEY__ *,ushort const *,ushort const *,ulong,ulong,ulong,RegistryHiveType)
.text:00000600000AF41A mov ecx, cs:dword_600002EE94C
.text:00000600000AF420 cmp eax, 1
.text:00000600000AF423 cmovz ecx, ebx
.text:00000600000AF426 mov cs:dword_600002EE94C, ecx
.text:00000600000AF42C jmp short loc_600000AF434
.text:00000600000AF42E ; ---------------------------------------------------------------------------
.text:00000600000AF42E
.text:00000600000AF42E loc_600000AF42E: ; CODE XREF: IsDeviceServiceable(void)+2Aj
.text:00000600000AF42E mov ecx, cs:dword_600002EE94C
.text:00000600000AF434
.text:00000600000AF434 loc_600000AF434: ; CODE XREF: IsDeviceServiceable(void)+6Cj
.text:00000600000AF434 mov cs:dword_600002EE948, ebx
.text:00000600000AF43A mov eax, ecx
.text:00000600000AF43C
.text:00000600000AF43C loc_600000AF43C: ; CODE XREF: IsDeviceServiceable(void)+16j
.text:00000600000AF43C add rsp, 40h
.text:00000600000AF440 pop rbx
.text:00000600000AF441 retn
.text:00000600000AF441 ; ---------------------------------------------------------------------------
.text:00000600000AF442 align 8
.text:00000600000AF442 ?IsDeviceServiceable@@YAHXZ endp
__int64 IsDeviceServiceable(void)
{
__int64 result; // rax@2
int v1; // eax@4
int v2; // ecx@4
if ( dword_600002EE948 )
{
dword_600002EE94C = IsCPUSupported();
if ( (unsigned int)__AreTestKeysAllowed() )
{
v1 = RegQueryDwordValueWithDefaultAndRangeCheck(
(HKEY)0x80000002,
L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Test\\Scan",
L"ForceUnsupportedCPU",
0,
0,
0xFFFFFFFF);
v2 = dword_600002EE94C;
if ( v1 == 1 )
v2 = 0;
dword_600002EE94C = v2;
}
else
{
v2 = dword_600002EE94C;
}
dword_600002EE948 = 0;
result = (unsigned int)v2;
}
else
{
result = (unsigned int)dword_600002EE94C;
}
return result;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment