Function at 0x140004224
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x9a0
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0x990], rax
mov rdi, rcx
xor esi, esi
or ecx, 0xffffffff
mov r12d, esi
mov dword [rsp + 0x28], esi
call sub.IMM32.dll_ImmDisableIME
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea ebp, [rsi + 2]
cmp dword [rsp + 0x20], ebp
mov rbx, rax
jl 0x1400043fa
mov rcx, qword [rax]
lea rdx, str._se1
call fcn.140022510
cmp eax, esi
jne 0x140004425
call fcn.140003958
cmp al, sil
je 0x1400043c4
lea rcx, [rsp + 0x150]
xor edx, edx
mov r8d, 0x208
call fcn.140024b80
lea rdx, [rsp + 0x150]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x14004120c]
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x120], 7
mov qword [rsp + 0x118], rsi
mov word [rsp + 0x108], si
call fcn.1400058fc
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x100]
call fcn.14000538c
lea rdx, [0x140041210]
lea rcx, [rsp + 0x100]
call fcn.14000538c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x100]
mov rdx, rax
call fcn.14000538c
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x34], esi
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, esi
jl 0x1400043ac
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x100]
call fcn.140004108
mov r8d, dword [rsp + 0x34]
cmp r8d, esi
je 0x1400043ac
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rsi
je 0x140004390
mov edx, 0x7148
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rsp + 0x120], 8
jb 0x1400043a8
mov rcx, qword [rsp + 0x108]
call fcn.1400141b8
xor eax, eax
jmp 0x1400043fd
cmp qword [rsp + 0x120], 8
jb 0x1400043c4
mov rcx, qword [rsp + 0x108]
call fcn.1400141b8
cmp dword [rsp + 0x20], 3
jne 0x1400043fa
mov rcx, qword [rbx + 0x10]
call fcn.1400225a4
xor r8d, r8d
mov rcx, qword [rbx + 8]
mov edx, eax
call fcn.140003728
mov ebx, esi
cmp eax, esi
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, esi
je 0x1400043a8
cmp eax, 0x4c7
je 0x1400043a8
or eax, 0xffffffff
mov rcx, qword [rsp + 0x990]
xor rcx, rsp
call fcn.140021c70
lea r11, [rsp + 0x9a0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rbx]
lea rdx, str._se2
call fcn.140022510
cmp eax, esi
jne 0x140004585
call fcn.140003958
cmp al, sil
je 0x140004566
lea rcx, [rsp + 0x570]
xor edx, edx
mov r8d, 0x208
call fcn.140024b80
lea rdx, [rsp + 0x570]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x14004120c]
lea rcx, [rsp + 0x128]
mov qword [rsp + 0x148], 7
mov qword [rsp + 0x140], rsi
mov word [rsp + 0x130], si
call fcn.1400058fc
lea rdx, [rsp + 0x570]
lea rcx, [rsp + 0x128]
call fcn.14000538c
lea rdx, [0x140041210]
lea rcx, [rsp + 0x128]
call fcn.14000538c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x128]
mov rdx, rax
call fcn.14000538c
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x30], esi
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, esi
jl 0x14000454e
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x128]
call fcn.140004108
mov r8d, dword [rsp + 0x30]
cmp r8d, esi
je 0x14000454e
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rsi
je 0x140004532
mov edx, 0x7148
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rsp + 0x148], 8
jb 0x1400043a8
mov rcx, qword [rsp + 0x130]
jmp 0x1400043a3
cmp qword [rsp + 0x148], 8
jb 0x140004566
mov rcx, qword [rsp + 0x130]
call fcn.1400141b8
cmp dword [rsp + 0x20], 3
jne 0x1400043fa
mov rcx, qword [rbx + 0x10]
call fcn.1400225a4
mov r8d, 1
jmp 0x1400043d7
mov rcx, qword [rbx]
lea rdx, str._sex1
call fcn.140022510
cmp eax, esi
jne 0x14000470d
cmp dword [rsp + 0x20], 3
jne 0x1400045da
mov rcx, qword [rbx + 0x10]
call fcn.1400225a4
mov rcx, qword [rbx + 8]
xor r8d, r8d
mov edx, eax
call fcn.140003728
mov ebx, esi
cmp eax, esi
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, esi
je 0x1400043a8
cmp eax, 0x4c7
je 0x1400043a8
call fcn.140003958
cmp al, sil
je 0x1400043fa
lea rcx, [rsp + 0x360]
xor edx, edx
mov r8d, 0x208
call fcn.140024b80
lea rdx, [rsp + 0x360]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x14004120c]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0xd0], 7
mov qword [rsp + 0xc8], rsi
mov word [rsp + 0xb8], si
call fcn.1400058fc
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0xb0]
call fcn.14000538c
lea rdx, [0x140041210]
lea rcx, [rsp + 0xb0]
call fcn.14000538c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0xb0]
mov rdx, rax
call fcn.14000538c
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x2c], esi
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, esi
jl 0x1400046ec
lea rdx, [rsp + 0x2c]
lea rcx, [rsp + 0xb0]
call fcn.140004108
mov r8d, dword [rsp + 0x2c]
cmp r8d, esi
je 0x1400046ec
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rsi
je 0x1400046d0
mov edx, 0x7148
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rsp + 0xd0], 8
jb 0x1400043a8
mov rcx, qword [rsp + 0xb8]
jmp 0x1400043a3
cmp qword [rsp + 0xd0], 8
jb 0x1400043fa
mov rcx, qword [rsp + 0xb8]
call fcn.1400141b8
jmp 0x1400043fa
mov rcx, qword [rbx]
lea rdx, str._sex2
call fcn.140022510
cmp eax, esi
jne 0x140004893
cmp dword [rsp + 0x20], 3
jne 0x140004765
mov rcx, qword [rbx + 0x10]
call fcn.1400225a4
mov rcx, qword [rbx + 8]
mov r8d, 1
mov edx, eax
call fcn.140003728
mov ebx, esi
cmp eax, esi
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, esi
je 0x1400043a8
cmp eax, 0x4c7
je 0x1400043a8
call fcn.140003958
cmp al, sil
je 0x1400043fa
lea rcx, [rsp + 0x780]
xor edx, edx
mov r8d, 0x208
call fcn.140024b80
lea rdx, [rsp + 0x780]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x14004120c]
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0xf8], 7
mov qword [rsp + 0xf0], rsi
mov word [rsp + 0xe0], si
call fcn.1400058fc
lea rdx, [rsp + 0x780]
lea rcx, [rsp + 0xd8]
call fcn.14000538c
lea rdx, [0x140041210]
lea rcx, [rsp + 0xd8]
call fcn.14000538c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0xd8]
mov rdx, rax
call fcn.14000538c
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], esi
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, esi
jl 0x140004877
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0xd8]
call fcn.140004108
mov r8d, dword [rsp + 0x28]
cmp r8d, esi
je 0x140004877
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rsi
je 0x14000485b
mov edx, 0x7148
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rsp + 0xf8], 8
jb 0x1400043a8
mov rcx, qword [rsp + 0xe0]
jmp 0x1400043a3
cmp qword [rsp + 0xf8], 8
jb 0x1400043fa
mov rcx, qword [rsp + 0xe0]
jmp 0x140004703
mov rcx, qword [rbx + 8]
lea rdx, str._se1
call fcn.140022510
cmp eax, esi
jne 0x1400048ce
cmp dword [rsp + 0x20], 4
jne 0x1400043fa
mov rcx, qword [rbx + 0x18]
call fcn.1400225a4
xor r8d, r8d
mov rcx, qword [rbx + 0x10]
mov edx, eax
call fcn.140003728
jmp 0x140004a3f
mov rcx, qword [rbx + 8]
lea rdx, str._se2
call fcn.140022510
cmp eax, esi
jne 0x1400048fe
cmp dword [rsp + 0x20], 4
jne 0x1400043fa
mov rcx, qword [rbx + 0x18]
call fcn.1400225a4
mov r8d, 1
jmp 0x1400048be
mov rcx, qword [rbx + 8]
lea rdx, str.ieoption
call fcn.140022510
cmp eax, esi
jne 0x14000494a
cmp dword [rsp + 0x20], ebp
mov edi, esi
jle 0x140004925
mov rcx, qword [rbx + 0x10]
call fcn.1400225a4
mov edi, eax
mov ecx, edi
call fcn.1400084e8
cmp al, sil
jne 0x1400043a8
mov ecx, edi
call fcn.1400083cc
cmp al, sil
sete sil
mov eax, esi
jmp 0x1400043fd
mov rcx, qword [rbx + 8]
lea rdx, str.uninstallui
call fcn.140022510
cmp eax, esi
jne 0x140004973
call fcn.140008140
cmp al, sil
jne 0x1400043a8
call fcn.140008040
jmp 0x14000493c
mov rcx, qword [rbx + 8]
lea rdx, str.queryicon
call fcn.140022510
cmp eax, esi
jne 0x140004a0f
lea rdx, str.Program_manager
lea rcx, str.Progman
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, str.Program_manager
lea rcx, str.Progman
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, rsi
je 0x1400043fa
or dword [rsp + 0x24], 0xffffffff
lea rdx, [rsp + 0x24]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x24], 0xffffffff
je 0x1400043fa
lea r8, str.360DTA
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
cmp rax, rsi
je 0x140004a01
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400043a8
mov ecx, dword [rsp + 0x24]
call fcn.140003574
jmp 0x1400043a8
mov rcx, qword [rbx + 8]
lea rdx, str.ievolume
call fcn.140022510
cmp eax, esi
jne 0x140004a46
cmp dword [rsp + 0x20], 4
jne 0x140004a46
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
movss xmm2, dword [0x140043538]
call fcn.1400014f8
cmp eax, esi
jmp 0x14000493f
mov rcx, qword [rbx + 8]
lea rdx, str.lockhomepage
call fcn.140022510
cmp eax, esi
jne 0x140004a67
mov rcx, rdi
call fcn.140004168
jmp 0x1400043fd
mov rcx, qword [rbx + 8]
lea rdx, str.lspscan
call fcn.140022510
cmp eax, esi
jne 0x140004ae9
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400412d4]
call fcn.140022510
cmp eax, esi
jne 0x140004a96
mov edi, 1
jmp 0x140004aa8
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400412dc]
call fcn.140022510
mov edi, ebp
mov rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0x78]
call fcn.1400077ac
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
call fcn.140007af8
lea rdx, [rsp + 0x88]
mov ecx, edi
add rax, 0x18
mov qword [rsp + 0x88], rax
call fcn.1400027a4
mov rdx, qword [rsp + 0x78]
jmp 0x140004e66
mov rcx, qword [rbx + 8]
lea rdx, str.lspfix
call fcn.140022510
cmp eax, esi
jne 0x140004b6b
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400412d4]
call fcn.140022510
cmp eax, esi
jne 0x140004b18
mov edi, 1
jmp 0x140004b2a
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400412dc]
call fcn.140022510
mov edi, ebp
mov rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0x70]
call fcn.1400077ac
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
call fcn.140007af8
lea rdx, [rsp + 0x90]
mov ecx, edi
add rax, 0x18
mov qword [rsp + 0x90], rax
call fcn.140002210
mov rdx, qword [rsp + 0x70]
jmp 0x140004e66
mov rcx, qword [rbx + 8]
lea rdx, str.setowner
call fcn.140022510
cmp eax, esi
jne 0x140004c7b
mov rcx, qword [rbx + 0x10]
lea rdx, str.file
call fcn.140022510
cmp eax, esi
jne 0x140004bb1
mov r8, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0xa8]
call fcn.14000a684
jmp 0x1400043a8
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140041320]
call fcn.140022510
cmp eax, esi
jne 0x1400043a8
mov rcx, qword [rbx + 0x18]
lea rdx, str.HKCR
call fcn.140022510
cmp eax, esi
jne 0x140004be6
mov rbp, 0xffffffff80000000
jmp 0x140004c3f
mov rcx, qword [rbx + 0x18]
lea rdx, str.HKCU
call fcn.140022510
cmp eax, esi
jne 0x140004c03
mov rbp, 0xffffffff80000001
jmp 0x140004c3f
mov rcx, qword [rbx + 0x18]
lea rdx, str.HKLM
call fcn.140022510
cmp eax, esi
jne 0x140004c20
mov rbp, 0xffffffff80000002
jmp 0x140004c3f
mov rcx, qword [rbx + 0x18]
lea rdx, [0x140041430]
call fcn.140022510
cmp eax, esi
jne 0x1400043fa
mov rbp, 0xffffffff80000003
mov rdi, qword [rbx + 0x20]
mov rbx, qword [rbx + 0x28]
lea rdx, str.TrustedInstaller
mov rcx, rbx
call fcn.140022510
lea r9, str.NT_SERVICETrustedInstaller
lea rcx, [rsp + 0x98]
cmp eax, esi
mov r8, rdi
mov rdx, rbp
cmovne r9, rbx
call fcn.14000a748
jmp 0x1400043a8
mov rcx, qword [rbx + 8]
lea rdx, str.EnumProcDLL:
call fcn.140022510
cmp eax, esi
jne 0x1400043fa
cmp dword [rsp + 0x20], ebp
jle 0x1400043a8
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x38]
call fcn.1400077ac
mov rcx, qword [rsp + 0x38]
cmp dword [rcx - 0x10], esi
jl 0x140004e4e
lea rdx, [0x140040fdc]
call fcn.14002202c
cmp rax, rsi
je 0x140004e4e
sub rax, qword [rsp + 0x38]
sar rax, 1
cmp eax, 0xffffffff
je 0x140004e4e
mov ecx, 8
call fcn.14001416c
cmp rax, rsi
je 0x140004cf8
lea rcx, [rsp + 0x40]
mov qword [rax], rcx
jmp 0x140004cfb
mov rax, rsi
lea rdx, [0x140040fdc]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
call fcn.1400077ac
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x38]
mov rdx, rax
call fcn.140002b98
mov r11, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
sub r11, rcx
sar r11, 3
cmp r11, rbp
jbe 0x140004d5d
mov rcx, qword [rcx + 0x10]
call fcn.1400225a4
mov rcx, qword [rsp + 0x58]
mov ebx, eax
jmp 0x140004d5f
mov ebx, esi
mov rax, qword [rsp + 0x60]
mov edi, 1
sub rax, rcx
sar rax, 3
cmp rax, rdi
jbe 0x140004d7b
lea rax, [rcx + 8]
jmp 0x140004d97
lea rdx, [0x140041464]
lea rcx, [rsp + 0x80]
mov r12d, edi
call fcn.1400077ac
mov rcx, qword [rsp + 0x58]
mov rbp, qword [rax]
mov rax, qword [rsp + 0x60]
sub rax, rcx
sar rax, 3
cmp rax, rsi
ja 0x140004db5
call fcn.140022768
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov r8d, ebx
mov rdx, rbp
call fcn.14000310c
test dil, r12b
je 0x140004deb
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, esi
jg 0x140004deb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
cmp rbx, rsi
je 0x140004e33
mov rdi, qword [rsp + 0x60]
cmp rbx, rdi
je 0x140004e2b
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, esi
jg 0x140004e1d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 8
cmp rbx, rdi
jne 0x140004dff
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400141b8
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
call fcn.1400141b8
jmp 0x140004e61
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140041464]
xor r8d, r8d
call fcn.14000310c
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, esi
jg 0x1400043a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400043a8