Function at 0x140007980
Capabilities:
Check if file exists
Create process on windows
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push r12
push r13
lea rbp, [rsp - 0x5a8]
sub rsp, 0x6a8
mov rax, qword [0x140035030]
xor rax, rsp
mov qword [rbp + 0x580], rax
movdqa xmm0, xmmword [0x1400307c0]
lea rdx, str.version.dll
xor ebx, ebx
mov r12, r8
mov r13, rcx
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0x68]
movdqu xmmword [rsp + 0x78], xmm0
lea r8d, [rbx + 0xb]
call fcn.140001ae0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400075e0
cmp qword [rax + 0x18], 8
jb 0x1400079f0
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140007a3b
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a36
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088d7
call fcn.14000bb4c
movdqa xmm0, xmmword [0x1400307c0]
lea rdx, str.dbghelp.dll
mov r8d, 0xb
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0x68]
movdqu xmmword [rsp + 0x78], xmm0
call fcn.140001ae0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400075e0
cmp qword [rax + 0x18], 8
jb 0x140007a7e
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140007ac9
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ac4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088dd
call fcn.14000bb4c
movdqa xmm0, xmmword [0x1400307c0]
lea rdx, str.winmm.dll
mov r8d, 9
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0x68]
movdqu xmmword [rsp + 0x78], xmm0
call fcn.140001ae0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400075e0
cmp qword [rax + 0x18], 8
jb 0x140007b0c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140007b57
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b52
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088e3
call fcn.14000bb4c
movdqa xmm0, xmmword [0x1400307c0]
lea rdx, str.msimg32.dll
mov r8d, 0xb
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0x68]
movdqu xmmword [rsp + 0x78], xmm0
call fcn.140001ae0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400075e0
cmp qword [rax + 0x18], 8
jb 0x140007b9a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140007be5
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007be0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088e9
call fcn.14000bb4c
movdqa xmm0, xmmword [0x1400307c0]
lea rdx, str.uxtheme.dll
mov r8d, 0xb
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0x68]
movdqu xmmword [rsp + 0x78], xmm0
call fcn.140001ae0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400075e0
cmp qword [rax + 0x18], 8
jb 0x140007c28
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140007c73
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c6e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088ef
call fcn.14000bb4c
lea r8, [rbp - 0x78]
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
cmp qword [0x140037798], rbx
jne 0x140007cc5
lea rcx, [0x1400377a0]
mov qword [0x140037798], rcx
call qword [sym.imp.gdiplus.dll_GdipGetGenericFontFamilySansSerif]
mov rcx, qword [0x140037798]
mov dword [rcx + 8], eax
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8d, 0x1f4
call fcn.14000e080
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0xc8
call fcn.14000e080
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 4
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareTencentWeChat
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007d4b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.LANG_ID
lea rax, [0x140035a40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x140035a40], 4
je 0x140007d72
mov dword [0x140035a40], 1
lea rdx, str.Runtime_Error
jmp 0x140007d79
lea rdx, [0x140030598]
lea rcx, [rbp - 0x30]
call fcn.140009550
mov qword [rsp + 0x6d8], rsi
lea rdx, str.show_verify_error
mov qword [rsp + 0x6a0], rdi
mov rcx, rbx
mov qword [rsp + 0x698], r14
mov qword [rsp + 0x690], r15
nop dword [rax]
movzx eax, word [r12 + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x140007ddc
movzx eax, word [r12 + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x140007ddc
add rcx, 2
cmp rcx, 0x12
jne 0x140007db0
call fcn.140005650
jmp 0x140008887
lea rcx, [rsp + 0x68]
call fcn.140007390
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140007e27
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e22
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088f5
call fcn.14000bb4c
xor edx, edx
mov dword [rsp + 0x34], ebx
lea rcx, str.WeChatMainWndForPC
mov dil, 1
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140007f1e
xor edx, edx
lea rcx, str.WeChatLoginWndForPC
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140007f1e
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 4
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareTencentWeChat
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007ebd
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.NeedUpdateType
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x140007f0b
movdqa xmm0, xmmword [0x1400307c0]
lea r8d, [rax + 0xe]
lea rdx, str.NeedUpdateType
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0x68]
movdqu xmmword [rsp + 0x78], xmm0
call fcn.140001ae0
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x68]
call fcn.140008c00
mov eax, dword [rsp + 0x34]
cmp eax, 0x64
jl 0x140007f1e
call fcn.140008b30
test al, al
movzx edi, dil
cmovne edi, ebx
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0xa0]
call fcn.140006700
test al, al
jne 0x140007f72
cmp dword [0x140035a40], 1
lea rax, str.S_MRHr_g
lea rdx, str.The_current_version_is_required_to_run_on_Windows_7_or_above.Please_upgrade_the_system.
cmovne rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400094f0
xor r9d, r9d
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140008887
lea rcx, [rbp - 0x58]
call fcn.1400069f0
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x68]
mov r15, rbx
call fcn.140001690
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140007fd2
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007fcd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088f5
call fcn.14000bb4c
cmp dword [rsp + 0x30], 0x14
jl 0x140008033
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140008033
lea rdx, str.AddDllDirectory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x140008033
lea rdx, str.SetDefaultDllDirectories
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x140008033
cmp qword [rbp - 0x40], 8
lea rcx, [rbp - 0x58]
mov r14b, 1
cmovae rcx, qword [rbp - 0x58]
call rsi
jmp 0x14000804a
cmp qword [rbp - 0x40], 8
lea rcx, [rbp - 0x58]
cmovae rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor r14b, r14b
lea rcx, [rsp + 0x48]
test dil, dil
je 0x140008598
mov rdx, qword [rbp - 0x48]
lea r9, [rbp - 0x58]
xor esi, esi
mov qword [rsp + 0x60], 7
cmp qword [rbp - 0x40], 8
mov qword [rsp + 0x48], rsi
cmovae r9, qword [rbp - 0x58]
mov qword [rsp + 0x58], rsi
cmp rdx, 7
ja 0x1400080a5
lea rbx, [rdx + rdx]
mov qword [rsp + 0x58], rdx
mov r8, rbx
mov rdx, r9
call fcn.14000d9d0
mov word [rsp + rbx + 0x48], si
lea rbx, [rsp + 0x48]
jmp 0x1400080b2
mov qword [rsp + 0x20], rdx
call fcn.1400099e0
mov rbx, rax
mov rdx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov rcx, rdx
sub rcx, rax
cmp rcx, 0xe
jb 0x1400080f3
lea rdi, [rax + 0xe]
mov qword [rbx + 0x10], rdi
cmp rdx, 8
jb 0x1400080d7
mov rbx, qword [rbx]
lea rcx, [rbx + rax*2]
mov r8d, 0x1c
lea rdx, str.WeChatWin.dll
call fcn.14000d9d0
mov word [rbx + rdi*2], si
jmp 0x140008110
lea r9, str.WeChatWin.dll
mov qword [rsp + 0x20], 0xe
mov edx, 0xe
mov rcx, rbx
call fcn.1400099e0
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.140009270
mov rcx, rax
call fcn.140005760
test al, al
jne 0x140008134
call fcn.140005650
jmp 0x14000854b
lea rcx, [rsp + 0x48]
call fcn.140005e30
test al, al
je 0x14000854b
test r14b, r14b
je 0x140008153
mov ecx, 0xc00
call r15
cmp qword [rsp + 0x60], 8
lea rcx, [rsp + 0x48]
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
jne 0x1400081e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rsp + 0x60], 8
lea rcx, [rsp + 0x48]
mov ebx, eax
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [0x140035a40]
lea r8, [0x14002fc90]
test eax, eax
je 0x1400081bf
cmp ecx, 1
lea rax, [0x14002fe20]
lea rdx, str.Invalid_file___s__errCode:_d._Click__OK__to_get_the_latest_version_from_the_store
mov r9d, ebx
cmovne rdx, rax
jmp 0x1400084d0
cmp ecx, 1
lea rdx, str.File___s__missing._Click__OK__to_get_the_latest_version
lea rcx, [rbp + 0xa0]
je 0x1400081d9
lea rdx, [0x14002fee0]
call fcn.1400094f0
jmp 0x1400084dc
lea rdx, str.WechatLog
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400375f0], rax
test rax, rax
je 0x140008237
cmp qword [0x140035a58], rsi
jbe 0x140008237
cmp qword [0x140035a60], 0x10
lea rcx, [0x140035a48]
cmovae rcx, qword [0x140035a48]
call rax
xor r8d, r8d
lea rdx, [0x14002ef5b]
lea rcx, [0x140035a48]
call fcn.140001280
lea rdx, str.VerifyDllReport
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
call fcn.140002530
mov qword [rax], rsi
test rsi, rsi
je 0x140008286
cmp qword [rax + 0x78], 0
je 0x140008286
lea rbx, [rax + 0x68]
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x14000826f
mov rcx, qword [rbx]
call rsi
xor esi, esi
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 0x10
jb 0x140008281
mov rbx, qword [rbx]
mov byte [rbx], sil
jmp 0x140008288
xor esi, esi
lea rdx, str.StartWechat
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ShouldDoUpdate
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400082bb
call rax
test al, al
je 0x1400082bb
mov dil, 1
jmp 0x1400082be
xor dil, dil
mov rax, qword [0x1400375f0]
test rax, rax
jne 0x1400082f8
lea r8d, [rax + 0xe]
lea rdx, str.StartWechat_OK
lea rcx, [0x140035a48]
call fcn.1400013e0
mov r8d, 2
lea rdx, [0x14002ef58]
mov rcx, rax
call fcn.1400013e0
jmp 0x140008301
lea rcx, str.StartWechat_OK
call rax
test rbx, rbx
je 0x1400084ad
mov rdx, r12
mov rcx, r13
call rbx
xor edx, edx
lea rcx, str.WeChatMainWndForPC
mov ebx, eax
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14000854d
xor edx, edx
lea rcx, str.WeChatLoginWndForPC
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14000854d
test dil, dil
je 0x14000854d
lea rax, [rbp - 0x78]
mov dword [rsp + 0x30], esi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x38], 4
lea rdx, str.SoftwareTencentWeChat
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000849e
mov rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.NeedUpdateType
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000849e
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x78]
mov dword [rsp + 0x30], 0xc8
call fcn.140007390
cmp qword [rbp - 0x60], 8
lea rcx, [rbp - 0x78]
cmovae rcx, qword [rbp - 0x78]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140008455
call fcn.140008b30
test al, al
je 0x140008455
xor edx, edx
lea rcx, [rbp + 0x2a0]
mov r8d, 0xc8
call fcn.14000e080
mov ecx, dword [rsp + 0x30]
lea rdx, [rbp + 0x2a0]
mov r9d, 0xa
lea r8d, [r9 + 0x5a]
call fcn.140016de0
cmp qword [rbp - 0x60], 8
lea r8, [rbp - 0x78]
mov dword [rsp + 0x28], 1
lea r9, str.1002
cmovae r8, qword [rbp - 0x78]
lea rdx, str.open
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000854d
mov rcx, qword [rbp - 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008494
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088fb
call fcn.14000bb4c
jmp 0x14000854d
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000854d
cmp dword [0x140035a40], 1
lea rax, [0x14002fe20]
lea rdx, str.Invalid_file___s__errCode:_d._Click__OK__to_get_the_latest_version_from_the_store
cmovne rdx, rax
lea r8, [0x14002fc90]
xor r9d, r9d
lea rcx, [rbp + 0xa0]
call fcn.1400094f0
mov r9d, 1
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x14000854b
mov dword [rsp + 0x28], eax
lea r8, str.http:__pc.weixin.qq.com_
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x14000854b
mov dword [rsp + 0x28], 1
lea r9, str.http:__pc.weixin.qq.com_
lea r8, str.iexplore.exe
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, esi
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000883b
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000858e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008901
call fcn.14000bb4c
jmp 0x14000883b
call fcn.140007390
cmp qword [rsp + 0x60], 8
lea rcx, [rsp + 0x48]
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14000874e
xor edx, edx
lea rcx, [rbp + 0x2a0]
mov r8d, 0xc8
call fcn.14000e080
mov ecx, dword [rsp + 0x34]
lea rdx, [rbp + 0x2a0]
mov r9d, 0xa
lea r8d, [r9 + 0x5a]
call fcn.140016de0
lea rcx, [rbp - 0x78]
call fcn.140007390
xor edx, edx
lea rcx, [rbp + 0x370]
mov r8d, 0x20a
call fcn.14000e080
cmp qword [rbp - 0x60], 8
lea r8, [rbp - 0x78]
mov edx, 0x105
lea rcx, [rbp + 0x370]
cmovae r8, qword [rbp - 0x78]
call fcn.140016e00
lea rcx, [rbp + 0x370]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor esi, esi
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x68], rsi
lea rax, [rbp + 0x370]
mov qword [rsp + 0x78], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x140008655
lea rdx, [rbp + 0x370]
lea rcx, [rsp + 0x68]
call fcn.140001ae0
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400086b0
mov rcx, qword [rbp - 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400086ab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008907
call fcn.14000bb4c
cmp qword [rbp - 0x80], 8
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x28], 1
cmovae rax, qword [rsp + 0x68]
lea r9, str.1001
cmp qword [rsp + 0x60], 8
lea rdx, str.open
mov qword [rbp - 0x68], rsi
cmovae r8, qword [rsp + 0x48]
xor ecx, ecx
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], si
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400087e4
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008744
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000890d
call fcn.14000bb4c
jmp 0x1400087e4
cmp dword [0x140035a40], 1
lea rax, [0x140030170]
lea rdx, str.WeChatUpdate.exe_missing._Clicking__OK__to_navigate_to_official_website_http:__pc.weixin.qq.com___and_get_the_latest_version
cmovne rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400094f0
mov r9d, 1
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
cmp eax, 1
jne 0x1400087e4
mov dword [rsp + 0x28], eax
lea r8, str.http:__pc.weixin.qq.com_
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x1400087e4
mov dword [rsp + 0x28], 1
lea r9, str.http:__pc.weixin.qq.com_
lea r8, str.iexplore.exe
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x60]
mov ebx, esi
cmp rdx, 8
jb 0x140008828
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008823
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088d1
call fcn.14000bb4c
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140008877
mov rcx, qword [rbp - 0x58]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008872
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088d1
call fcn.14000bb4c
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], si
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov r14, qword [rsp + 0x698]
mov eax, ebx
mov rdi, qword [rsp + 0x6a0]
mov rsi, qword [rsp + 0x6d8]
mov r15, qword [rsp + 0x690]
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14000b8a0
add rsp, 0x6a8
pop r13
pop r12
pop rbx
pop rbp
ret
call fcn.140011f28
int3
call fcn.140011f28
int3
call fcn.140011f28
int3
call fcn.140011f28
int3
call fcn.140011f28
int3
call fcn.140011f28
int3
call fcn.140011f28
int3
call fcn.140011f28
int3
call fcn.140011f28
int3
call fcn.140011f28
int3
call fcn.140011f28
int3