Function at 0x140001000
Capabilities:
Accept command line arguments
Delete directory
Get common file path

Disassembly:
sub rsp, 0x28
mov r8, 0x228
xor rdx, rdx
movabs rcx, 0x140017a00
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.dll_GetModuleHandleA
mov qword [0x140017a08], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x140017a00], rax
call fcn.140011f20
call fcn.140011c50
call fcn.14000f980
call fcn.14000f184
call fcn.14000e740
call fcn.14000e2c4
call fcn.14000e090
call fcn.14000debc
call fcn.14000de28
call fcn.14000c790
call fcn.14000b3d8
call fcn.140009fe4
call fcn.140009b90
call fcn.140008c1c
call fcn.140008748
mov rcx, qword [0x140017c00]
call fcn.140009bbc
mov r9, 7
movabs r8, 0x140016230
lea rdx, [0x140017c00]
mov rcx, 0xc
call fcn.140009ab0
mov rdx, 0x401
sub rsp, 8
movabs rax, 0x140017bf0
push rax
sub rsp, 0x20
movabs r9, 0x140016250
mov r8, 7
mov rcx, 0xc
call fcn.140011acc
add rsp, 0x30
mov qword [0x140017bf0], rax
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140017c20]
xor r8, r8
mov rdx, 0x15
mov rcx, 8
sub rsp, 0x20
call fcn.14000f9ac
add rsp, 0x28
add rsp, 8
mov rcx, qword [0x140017c10]
call fcn.140009bbc
mov r9, 7
movabs r8, 0x140016240
lea rdx, [0x140017c10]
mov rcx, 0xc
call fcn.140009ab0
movabs rdx, str.Continue_
lea rcx, [0x140017a38]
call fcn.140011fb0
movabs rdx, str.Error_
lea rcx, [0x140017bc0]
call fcn.140011fb0
movabs rdx, 0x140016025
lea rcx, [0x140017a80]
call fcn.140011fb0
movabs rdx, str.Cannot_allocate_the_memory.
lea rcx, [0x140017b20]
call fcn.140011fb0
movabs rdx, str.Wrong_password.
lea rcx, [0x140017b68]
call fcn.140011fb0
movabs rdx, str.An_unknown_error_occured._The_program_will_be_terminated.
lea rcx, [0x140017b18]
call fcn.140011fb0
movabs rdx, str.This_program_is_not_supported_on_your_operating_system.
lea rcx, [0x140017b90]
call fcn.140011fb0
movabs rdx, str.Choose_a_location_to_save_the_files.
lea rcx, [0x140017b60]
call fcn.140011fb0
movabs rdx, str.Password
lea rcx, [0x140017b98]
call fcn.140011fb0
movabs rdx, str.Please_enter_the_password.
lea rcx, [0x140017ac0]
call fcn.140011fb0
call fcn.14000b0fc
mov r15, rax
cmp r15, 0x32
jge 0x140001273
movabs r8, 0x10
mov rdx, qword [0x140017b90]
mov rcx, qword [0x140017bc0]
call fcn.140008784
jmp 0x1400028e9
push 1
lea rax, [0x1400033f4]
mov rcx, rax
pop rdx
call sub.KERNEL32.dll_SetConsoleCtrlHandler
lea rax, [0x14000337c]
mov rcx, rax
call fcn.140009690
call fcn.140008e24
mov qword [0x140017b78], rax
movabs rcx, 0
call sub.KERNEL32.dll_GetModuleHandleA
mov qword [0x140017ae0], rax
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.140008e40
add rsp, 0x28
lea rcx, [0x140017b70]
pop rdx
call fcn.1400120a0
mov rcx, qword [0x140017b70]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov r15, qword [0x140017b78]
and r15, r15
jle 0x140001495
mov qword [0x140017a88], 0
mov r15, qword [0x140017b78]
dec r15
cmp r15, qword [0x140017a88]
jl 0x1400013c2
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
mov rcx, qword [0x140017a88]
pop rdx
sub rsp, 0x20
call fcn.140008db8
add rsp, 0x28
lea rcx, [0x140017b48]
pop rdx
call fcn.1400120a0
push qword [0x140017b48]
movabs rcx, str._b2epass
pop rdx
call fcn.140012160
or rax, rax
je 0x140001376
mov qword [0x140017a70], 1
jmp 0x1400013b5
mov r15, qword [0x140017a70]
cmp r15, 1
jne 0x1400013b5
mov rcx, qword [0x140017b48]
push qword [0x140018190]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
lea rcx, [0x140017ba8]
pop rdx
call fcn.1400120a0
mov qword [0x140017a70], 0
inc qword [0x140017a88]
jno 0x140001308
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
mov rdx, qword [0x140018190]
push rdx
push rdx
sub rsp, 8
push qword [0x140018190]
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.dll_GetCommandLineA
add rsp, 0x28
mov rcx, rax
pop rdx
sub rsp, 0x20
call fcn.14000e0c0
add rsp, 0x28
mov rdx, qword [0x1400181a0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call sub.SHLWAPI.DLL_PathGetArgsA
add rsp, 0x20
pop qword [0x140018190]
mov rcx, rax
pop rdx
sub rsp, 0x20
call fcn.14000e0c0
add rsp, 0x28
lea rcx, [0x140017ac8]
pop rdx
call fcn.1400120a0
mov rcx, qword [0x140017b70]
push qword [0x140018190]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
movabs rcx, 0x14001601f
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
mov rcx, qword [0x140017ac8]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
lea rcx, [0x140017ac8]
pop rdx
call fcn.1400120a0
jmp 0x1400014bc
mov rcx, qword [0x140017b70]
push qword [0x140018190]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
lea rcx, [0x140017ac8]
pop rdx
call fcn.1400120a0
movabs rax, 0x140016097
mov rdx, rax
mov rcx, qword [0x140017ae0]
call fcn.140004220
and rax, rax
je 0x1400014f6
mov rax, qword [0x140017a20]
mov qword [0x140017b38], rax
mov rcx, qword [0x140017b38]
call fcn.14000356d
jmp 0x140001526
movabs r8, 0x10
mov rdx, qword [0x140017b18]
mov rcx, qword [0x140017bc0]
call fcn.140008784
mov rax, 1
mov qword [0x140017a10], rax
jmp 0x1400028e9
movabs rax, str.NOPSX
mov rdx, rax
mov rcx, qword [0x140017ae0]
call fcn.140004220
and rax, rax
je 0x14000157d
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
mov rdx, qword [0x140017a40]
mov rcx, qword [0x140017a20]
pop r8
sub rsp, 0x20
call fcn.14000e140
add rsp, 0x28
lea rcx, [0x140017b10]
pop rdx
call fcn.1400120a0
jmp 0x1400015ad
movabs r8, 0x10
mov rdx, qword [0x140017b18]
mov rcx, qword [0x140017bc0]
call fcn.140008784
mov rax, 1
mov qword [0x140017a10], rax
jmp 0x1400028e9
movabs rax, 0x14001607e
mov rdx, rax
mov rcx, qword [0x140017ae0]
call fcn.140004220
and rax, rax
je 0x1400015f7
mov rax, qword [0x140017a20]
mov qword [0x140017a90], rax
mov rax, qword [0x140017a40]
mov qword [0x140017a28], rax
mov rax, qword [0x140017a90]
mov qword [0x140017b88], rax
jmp 0x140001627
movabs r8, 0x10
mov rdx, qword [0x140017b18]
mov rcx, qword [0x140017bc0]
call fcn.140008784
mov rax, 1
mov qword [0x140017a10], rax
jmp 0x1400028e9
movabs rax, 0x140016084
mov rdx, rax
mov rcx, qword [0x140017ae0]
call fcn.140004220
and rax, rax
je 0x14000166f
mov rax, qword [0x140017a20]
mov qword [0x140017aa0], rax
mov rax, qword [0x140017a40]
mov qword [0x140017ab0], rax
mov rax, qword [0x140017aa0]
mov qword [0x140017b30], rax
movabs rax, 0x140016082
mov rdx, rax
mov rcx, qword [0x140017ae0]
call fcn.140004220
and rax, rax
je 0x1400016b7
mov rax, qword [0x140017a20]
mov qword [0x140017a98], rax
mov rax, qword [0x140017a40]
mov qword [0x140017a30], rax
mov rax, qword [0x140017a98]
mov qword [0x140017bc8], rax
movabs rax, 0x140016099
mov rdx, rax
mov rcx, qword [0x140017ae0]
call fcn.140004220
and rax, rax
je 0x140001b01
mov rcx, qword [0x140017ba8]
xor rdx, rdx
call fcn.140012160
or rax, rax
jne 0x140001719
mov rcx, qword [0x140017ba8]
push qword [0x140018190]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
lea rcx, [0x140017b58]
pop rdx
call fcn.1400120a0
jmp 0x1400019c0
sub rsp, 8
push 0xc80001
push qword [0x140017b98]
push 0x6e
movabs r9, 0xc8
movabs r8, 0
movabs rdx, 0
movabs rcx, 0
sub rsp, 0x20
call fcn.14000b7c0
add rsp, 0x40
push qword [0x140017ac0]
push 0x14
movabs r9, 0x9e
movabs r8, 0xf
movabs rdx, 0x15
movabs rcx, 1
sub rsp, 0x20
call fcn.14000a404
add rsp, 0x30
sub rsp, 8
push 0x20
movabs rax, 0x14001601e
push rax
push 0x14
movabs r9, 0x9e
movabs r8, 0x28
movabs rdx, 0x15
movabs rcx, 2
sub rsp, 0x20
call fcn.14000a66c
add rsp, 0x40
movabs rax, 0x1400161e0
push rax
push 0x14
movabs r9, 0x4e
movabs r8, 0x4b
movabs rdx, 0x3d
movabs rcx, 3
sub rsp, 0x20
call fcn.14000ab20
add rsp, 0x30
movabs r8, 4
movabs rdx, 0xd
movabs rcx, 0
call fcn.14000b824
movabs rcx, 2
call fcn.14000ab48
call fcn.14000ba90
push rax
mov r15, 0x333c
cmp r15, qword [rsp]
jne 0x1400018aa
sub rsp, 8
mov rcx, qword [0x140017bb8]
sub rsp, 0x20
call sub.KERNEL32.dll_RemoveDirectoryA
add rsp, 0x28
xor rax, rax
mov qword [0x140017a10], rax
add rsp, 0xfffffffffffffff8
jmp 0x1400028e9
mov r15, 0x332d
cmp r15, qword [rsp]
jne 0x140001936
sub rsp, 8
sub rsp, 0x20
call fcn.14000f2c0
add rsp, 0x28
push rax
mov r15, 4
cmp r15, qword [rsp]
jne 0x140001930
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
movabs rcx, 2
pop rdx
sub rsp, 0x20
call fcn.14000ab94
add rsp, 0x28
lea rcx, [0x140017b58]
pop rdx
sub rsp, 0x20
call fcn.1400120a0
add rsp, 0x20
movabs rcx, 0
sub rsp, 0x20
call fcn.14000b278
add rsp, 0x20
add rsp, 0x10
jmp 0x1400019c0
pop rax
jmp 0x1400019ba
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x1400019ba
sub rsp, 8
sub rsp, 0x20
call fcn.14000f2dc
add rsp, 0x28
push rax
mov r15, 3
cmp r15, qword [rsp]
jne 0x1400019b9
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
movabs rcx, 2
pop rdx
sub rsp, 0x20
call fcn.14000ab94
add rsp, 0x28
lea rcx, [0x140017b58]
pop rdx
sub rsp, 0x20
call fcn.1400120a0
add rsp, 0x20
movabs rcx, 0
sub rsp, 0x20
call fcn.14000b278
add rsp, 0x20
add rsp, 0x10
jmp 0x1400019c0
pop rax
pop rax
jmp 0x140001867
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rcx, qword [0x140017b58]
sub rsp, 0x20
call fcn.140005060
add rsp, 0x28
push rax
mov rax, qword [0x140017b58]
mov rcx, rax
pop rdx
pop r8
sub rsp, 0x20
call fcn.140010180
add rsp, 0x28
inc qword [0x140018190]
mov rdx, qword [0x140018190]
push rdx
push rdx
mov rdx, qword [0x140017a40]
mov rcx, qword [0x140017a20]
pop r8
sub rsp, 0x20
call fcn.14000e140
add rsp, 0x20
pop rcx
pop rdx
mov qword [0x140018190], rdx
add rdx, qword [0x1400181a0]
add rcx, qword [0x1400181a0]
call fcn.140012160
or rax, rax
jne 0x140001a8a
movabs r8, 0x10
mov rdx, qword [0x140017b68]
mov rcx, qword [0x140017bc0]
call fcn.140008784
mov rcx, qword [0x140017bb8]
call sub.KERNEL32.dll_RemoveDirectoryA
mov rax, 1
mov qword [0x140017a10], rax
jmp 0x1400028e9
movabs rax, 0x14001609b
mov rdx, rax
mov rcx, qword [0x140017ae0]
call fcn.140004220
and rax, rax
je 0x140001ab6
mov rax, qword [0x140017a20]
mov qword [0x140017b80], rax
sub rsp, 8
push qword [0x140017a30]
push qword [0x140017ab0]
push qword [0x140017a28]
push qword [0x140017b80]
push qword [0x140017a98]
mov r9, qword [0x140017aa0]
mov r8, qword [0x140017a90]
mov rdx, qword [0x140017b58]
mov rcx, qword [0x140017ae0]
sub rsp, 0x20
call fcn.1400043ec
add rsp, 0x50
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
mov rdx, qword [0x140017a28]
mov rcx, qword [0x140017b88]
pop r8
sub rsp, 0x20
call fcn.14000e140
add rsp, 0x28
lea rcx, [0x140017b08]
pop rdx
call fcn.1400120a0
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
mov rdx, qword [0x140017ab0]
mov rcx, qword [0x140017b30]
pop r8
sub rsp, 0x20
call fcn.14000e140
add rsp, 0x28
lea rcx, [0x140017a60]
pop rdx
call fcn.1400120a0
movabs rax, 0x140016080
mov rdx, rax
mov rcx, qword [0x140017ae0]
call fcn.140004220
and rax, rax
je 0x140001dae
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
movabs rcx, 0
pop rdx
sub rsp, 0x20
call fcn.140008db8
add rsp, 0x28
inc qword [0x140018190]
mov rdx, qword [0x140018190]
push rdx
push rdx
mov rdx, qword [0x140017a40]
mov rcx, qword [0x140017a20]
pop r8
sub rsp, 0x20
call fcn.14000e140
add rsp, 0x20
pop rcx
pop rdx
mov qword [0x140018190], rdx
add rdx, qword [0x1400181a0]
add rcx, qword [0x1400181a0]
call fcn.140012160
or rax, rax
je 0x140001c1a
mov r15, qword [0x140017b78]
cmp r15, 1
jne 0x140001c1a
mov rax, 1
jmp 0x140001c1d
xor rax, rax
and rax, rax
je 0x140001dae
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
mov rdx, qword [0x140018190]
push rdx
push rdx
pop rcx
sub rsp, 0x20
call fcn.14000e2dc
add rsp, 0x20
inc qword [0x140018190]
push qword [0x140017b60]
mov rdx, qword [0x1400181a0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140008838
add rsp, 0x28
lea rcx, [0x140017a58]
pop rdx
call fcn.1400120a0
mov rcx, qword [0x140017a58]
xor rdx, rdx
call fcn.140012160
or rax, rax
jne 0x140001d2c
mov rcx, qword [0x140017a58]
push qword [0x140018190]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
lea rcx, [0x140017b00]
pop rdx
call fcn.1400120a0
mov rcx, qword [0x140017b00]
call fcn.14000e33c
mov rcx, qword [0x140017a60]
xor rdx, rdx
call fcn.140012160
or rax, rax
jne 0x140001cec
mov rcx, qword [0x140017a60]
call fcn.14000371f
mov rdx, qword [0x140017b10]
movabs rcx, 1
call fcn.14000eaa0
and rax, rax
je 0x140001d2c
mov rdx, qword [0x140017b08]
movabs rcx, 1
call fcn.14000eda0
movabs rcx, 1
call fcn.14000e6a0
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rdx, qword [0x140018190]
push rdx
push rdx
mov rcx, qword [0x140018190]
sub rsp, 0x20
call fcn.140008e40
add rsp, 0x20
mov rdx, qword [0x1400181a0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000e358
add rsp, 0x28
mov rdx, qword [0x1400181a0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14000e33c
add rsp, 0x28
pop qword [0x140018190]
mov rcx, qword [0x140017bb8]
call sub.KERNEL32.dll_RemoveDirectoryA
xor rax, rax
mov qword [0x140017a10], rax
jmp 0x1400028e9
movabs rax, 0x14001609d
mov rdx, rax
mov rcx, qword [0x140017ae0]
call fcn.140004220
and rax, rax
je 0x140001f7f
movabs rcx, 0x400
call fcn.14000e1f0
mov qword [0x140017ad0], rax
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.14000e3f4
add rsp, 0x28
lea rcx, [0x140017bd8]
pop rdx
call fcn.1400120a0
push qword [0x140017ad0]
push 0
movabs rax, 0x14001601e
mov rdx, rax
mov rcx, qword [0x140017bd8]
pop r8
pop r9
call sub.KERNEL32.dll_GetTempFileNameA
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
mov rcx, qword [0x140017ad0]
pop rdx
sub rsp, 0x20
call fcn.14000e0c0
add rsp, 0x28
lea rcx, [0x140017bb0]
pop rdx
call fcn.1400120a0
mov rcx, qword [0x140017ad0]
call fcn.14000e210
mov rcx, qword [0x140017bb0]
call fcn.14000e4c0
mov rcx, qword [0x140017bb0]
call fcn.14000e4c8
mov rcx, qword [0x140017bb0]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov rcx, qword [0x140017bb0]
push qword [0x140018190]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
movabs rcx, str.extd.exe
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
lea rcx, [0x140017af8]
pop rdx
call fcn.1400120a0
mov rdx, qword [0x140017af8]
movabs rcx, 0
call fcn.14000eaa0
mov r8, qword [0x140017a40]
mov rdx, qword [0x140017a20]
movabs rcx, 0
call fcn.14000ee50
movabs rcx, 0
call fcn.14000e6a0
mov rcx, qword [0x140017af8]
push qword [0x140018190]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
lea rcx, [0x140017ae8]
pop rdx
call fcn.1400120a0
mov rcx, qword [0x140017ae8]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push qword [0x140017ae8]
movabs rax, str.b2eextd
mov rcx, rax
pop rdx
call fcn.140008f18
movabs rax, str._call:extd
push rax
movabs rax, str.extd
mov rcx, rax
pop rdx
call fcn.140008f18
mov rcx, qword [0x140017bb8]
push qword [0x140018190]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
movabs rcx, str.BDFI
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
mov rcx, qword [0x140017b10]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
lea rcx, [0x140017b10]
pop rdx
call fcn.1400120a0
mov rdx, qword [0x140017b10]
movabs rcx, 1
call fcn.14000eaa0
and rax, rax
je 0x140002260
movabs rax, str._shift__0
mov rdx, rax
movabs rcx, 1
call fcn.14000eee0
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rdx, qword [0x140018190]
push rdx
push rdx
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.dll_GetCommandLineA
add rsp, 0x28
mov rcx, rax
pop rdx
sub rsp, 0x20
call fcn.14000e0c0
add rsp, 0x28
mov rdx, qword [0x1400181a0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call sub.SHLWAPI.DLL_PathGetArgsA
add rsp, 0x20
pop qword [0x140018190]
mov rcx, rax
pop rdx
sub rsp, 0x20
call fcn.14000e0c0
add rsp, 0x28
inc qword [0x140018190]
movabs rax, 0x14001609f
push rax
mov rdx, qword [0x1400181a0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008f18
add rsp, 0x28
pop qword [0x140018190]
mov rdx, qword [0x140017b08]
movabs rcx, 1
call fcn.14000eee0
movabs rax, 0x14001609d
mov rdx, rax
mov rcx, qword [0x140017ae0]
call fcn.140004220
and rax, rax
je 0x14000224f
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
movabs rbp, 0x14001630d
mov r15, rbp
movabs rbp, 0x140016260
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140016260
mov rax, rbp
mov rcx, rax
pop rdx
pop r8
sub rsp, 0x20
call fcn.14000e140
add rsp, 0x28
lea rcx, [0x140017aa8]
pop rdx
call fcn.1400120a0
mov rcx, qword [0x140017aa8]
call fcn.140005060
mov qword [0x140017ad8], rax
mov rcx, qword [0x140017ad8]
call fcn.14000e1f0
mov qword [0x140017af0], rax
mov rcx, qword [0x140017ad8]
call fcn.14000e1f0
mov qword [0x140017ab8], rax
mov rdx, qword [0x140017aa8]
mov rcx, qword [0x140017af0]
call fcn.14000e230
mov qword [0x140017a88], 0
mov rax, qword [0x140017ad8]
cmp rax, qword [0x140017a88]
jl 0x1400021f6
mov r15, qword [0x140017af0]
add r15, qword [0x140017a88]
mov rax, r15
mov rcx, rax
call fcn.14000e260
mov r15, rax
imul r15, r15, 0xffffffffffffffff
mov rax, r15
push rax
mov r15, qword [0x140017ab8]
add r15, qword [0x140017a88]
mov rax, r15
mov rcx, rax
pop rdx
call fcn.14000e270
inc qword [0x140017a88]
jno 0x14000219f
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rdx, qword [0x140018190]
mov rcx, qword [0x140017ab8]
sub rsp, 0x20
call fcn.14000e0c0
add rsp, 0x28
inc qword [0x140018190]
push 1
mov rdx, qword [0x1400181a0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000eee0
add rsp, 0x28
pop qword [0x140018190]
movabs rcx, 1
call fcn.14000e6a0
jmp 0x1400022ad
mov rcx, qword [0x140017b10]
call fcn.14000e4c0
call fcn.1400047fe
movabs r8, 0x10
mov rdx, qword [0x140017b18]
mov rcx, qword [0x140017bc0]
call fcn.140008784
mov rcx, qword [0x140017bb8]
call sub.KERNEL32.dll_RemoveDirectoryA
mov rax, 1
mov qword [0x140017a10], rax
jmp 0x1400028e9
mov rcx, qword [0x140017a60]
xor rdx, rdx
call fcn.140012160
or rax, rax
jne 0x1400022cd
mov rcx, qword [0x140017a60]
call fcn.14000371f
movabs rcx, 0x400
call fcn.14000e1f0
mov qword [0x140017ba0], rax
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.14000e3f4
add rsp, 0x28
lea rcx, [0x140017a50]
pop rdx
call fcn.1400120a0
push qword [0x140017ba0]
push 0
movabs rax, 0x14001601e
mov rdx, rax
mov rcx, qword [0x140017a50]
pop r8
pop r9
call sub.KERNEL32.dll_GetTempFileNameA
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
mov rcx, qword [0x140017ba0]
pop rdx
sub rsp, 0x20
call fcn.14000e0c0
add rsp, 0x28
lea rcx, [0x140017bd0]
pop rdx
call fcn.1400120a0
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
movabs rcx, 0x800
pop rdx
sub rsp, 0x20
call fcn.140005090
add rsp, 0x28
lea rcx, [0x140017b40]
pop rdx
call fcn.1400120a0
push qword [0x140018190]
sub rsp, 8
push 0x800
push qword [0x140017b40]
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.140008e40
add rsp, 0x28
mov rdx, qword [0x1400181a0]
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call sub.KERNEL32.dll_GetShortPathNameA
add rsp, 0x28
pop qword [0x140018190]
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rcx, qword [0x140018190]
sub rsp, 0x20
call fcn.140008e40
add rsp, 0x28
inc qword [0x140018190]
movabs rax, str.b2eprogramname
push rax
mov rdx, qword [0x1400181a0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008f18
add rsp, 0x28
pop qword [0x140018190]
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rdx, qword [0x140018190]
push rdx
push rdx
mov rcx, qword [0x140018190]
sub rsp, 0x20
call fcn.140008e40
add rsp, 0x20
mov rdx, qword [0x1400181a0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000e61c
add rsp, 0x28
inc qword [0x140018190]
movabs rax, str.b2eprogramfilename
push rax
mov rdx, qword [0x1400181a0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008f18
add rsp, 0x28
pop qword [0x140018190]
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rdx, qword [0x140018190]
push rdx
push rdx
mov rcx, qword [0x140018190]
sub rsp, 0x20
call fcn.140008e40
add rsp, 0x20
mov rdx, qword [0x1400181a0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000e358
add rsp, 0x28
inc qword [0x140018190]
movabs rax, str.b2eprogrampathname
push rax
mov rdx, qword [0x1400181a0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008f18
add rsp, 0x28
pop qword [0x140018190]
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rdx, qword [0x140018190]
mov rcx, qword [0x140017b40]
sub rsp, 0x20
call fcn.1400051d0
add rsp, 0x28
inc qword [0x140018190]
movabs rax, str.b2eprogramshortname
push rax
mov rdx, qword [0x1400181a0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008f18
add rsp, 0x28
pop qword [0x140018190]
mov rcx, qword [0x140017b00]
push qword [0x140018190]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
lea rcx, [0x140017be8]
pop rdx
call fcn.1400120a0
mov rcx, qword [0x140017be8]
call sub.SHLWAPI.DLL_PathAddBackslashA
push qword [0x140017be8]
movabs rax, 0x140016086
mov rcx, rax
pop rdx
call fcn.140008f18
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rdx, qword [0x140018190]
mov rcx, qword [0x140017a48]
sub rsp, 0x20
call fcn.1400052f0
add rsp, 0x28
inc qword [0x140018190]
movabs rax, str.b2eincfilecount
push rax
mov rdx, qword [0x1400181a0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008f18
add rsp, 0x28
pop qword [0x140018190]
push qword [0x140017bd0]
movabs rax, str.b2etempfile
mov rcx, rax
pop rdx
call fcn.140008f18
mov rcx, qword [0x140017b10]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov rcx, qword [0x140017b10]
push qword [0x140018190]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
movabs rcx, 0x14001601f
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
mov rcx, qword [0x140017ac8]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
lea rcx, [0x140017ac8]
pop rdx
call fcn.1400120a0
mov rcx, qword [0x140017ac8]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
movabs rcx, 0x800
pop rdx
sub rsp, 0x20
call fcn.140005090
add rsp, 0x28
lea rcx, [0x140017be0]
pop rdx
call fcn.1400120a0
movabs rdx, 0x800
mov rcx, qword [0x140017be0]
call sub.KERNEL32.dll_GetSystemDirectoryA
mov rcx, qword [0x140017be0]
call sub.SHLWAPI.DLL_PathAddBackslashA
push qword [0x140018190]
sub rsp, 8
push 0x44
push qword [0x140017b00]
push qword [0x140018190]
movabs rcx, 0x1400160d7
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
mov rcx, qword [0x140017ac8]
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
inc qword [0x140018190]
mov rcx, qword [0x140017be0]
push qword [0x140018190]
sub rsp, 0x20
call fcn.1400121c0
add rsp, 0x20
movabs rcx, 0x14001612e
sub rsp, 0x20
call fcn.1400121c0
add rsp, 0x20
mov rdx, qword [0x1400181a0]
add qword [rsp], rdx
mov rdx, qword [0x1400181a0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140009504
add rsp, 0x28
pop qword [0x140018190]
mov qword [0x140017b28], rax
mov rcx, qword [0x140017b28]
call fcn.140009554
mov r15, rax
and r15, r15
jne 0x1400027e0
jmp 0x1400027f1
movabs rcx, 5
call fcn.14000b228
jmp 0x1400027ca
mov rcx, qword [0x140017b28]
call fcn.1400095bc
mov qword [0x140017a78], rax
mov rcx, qword [0x140017b28]
call fcn.1400095e0
push 0
lea rax, [0x1400033f4]
mov rcx, rax
pop rdx
call sub.KERNEL32.dll_SetConsoleCtrlHandler
call fcn.1400047fe
mov rcx, qword [0x140017b10]
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
mov rcx, qword [0x140017b10]
call fcn.14000e4c0
mov rcx, qword [0x140017bd0]
call fcn.14000e4c0
mov rcx, qword [0x140017af8]
call fcn.14000e4c0
mov rax, qword [0x140018190]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rdx, qword [0x140018190]
push rdx
push rdx
mov rcx, qword [0x140018190]
sub rsp, 0x20
call fcn.140008e40
add rsp, 0x20
mov rdx, qword [0x1400181a0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000e358
add rsp, 0x28
mov rdx, qword [0x1400181a0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14000e33c
add rsp, 0x28
pop qword [0x140018190]
mov rcx, qword [0x140017bb0]
call sub.KERNEL32.dll_RemoveDirectoryA
mov rcx, qword [0x140017bb8]
call sub.KERNEL32.dll_RemoveDirectoryA
mov rax, qword [0x140017a78]
mov qword [0x140017a10], rax
jmp 0x1400028e9
call 0x14000290b
call fcn.140011f80
mov rcx, qword [0x140017a00]
call sub.KERNEL32.dll_HeapDestroy
mov rcx, qword [0x140017a10]
call sub.KERNEL32.dll_ExitProcess
sub rsp, 0x28
call fcn.1400099f0
call fcn.14000a074
call fcn.14000b3b8
call fcn.14000c7e8
call fcn.14000de1c
call fcn.14000e628
call fcn.14000e730
call fcn.14000f7f4
call fcn.14000e0b0
add rsp, 0x28
ret