Function at 0x14000b4c8
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Get memory capacity
Get system information on windows
Move file
Query environment variable
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a18]
mov eax, 0x1af0
call fcn.140040840
sub rsp, rax
mov rax, qword [0x14006f5c0]
xor rax, rsp
mov qword [rbp + 0x19e0], rax
mov r14, r8
call fcn.14002cdf0
xor r13d, r13d
test rax, rax
je 0x14000b53c
cmp word [rax], r13w
je 0x14000b53c
mov r8, rax
lea rcx, [rbp + 0x15e0]
mov edx, 0x200
call fcn.140050560
neg eax
mov edi, 0x65b
sbb ecx, ecx
and ecx, edi
jmp 0x14000b543
mov edi, 0x65b
mov ecx, edi
test ecx, ecx
jne 0x14000b563
lea rcx, [rbp + 0x15e0]
call fcn.14002cf90
test eax, eax
jne 0x14000b563
lea rcx, [rbp + 0x15e0]
call fcn.140007e24
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x14000cb9f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rdx, [rbp - 0x78]
lea rcx, [0x140000000]
mov qword [rbp - 0x78], rax
call fcn.14001bfb4
mov rbx, qword [rbp - 0x78]
mov esi, eax
test eax, eax
jne 0x14000cb6d
mov rcx, rbx
call fcn.14001c2d0
mov esi, eax
test eax, eax
jne 0x14000cb6d
or r15, 0xffffffffffffffff
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b5d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor edx, edx
mov dword [rbp + 0x290], VarUI4FromDisp
mov r8d, VarUI4FromDisp
lea rcx, [rbp + 0x294]
call sub.msvcrt.dll_memset
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000cb63
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov eax, dword [rbp + 0x294]
cmp dword [rcx + 0x118], eax
jne 0x14000cb63
mov eax, dword [rbp + 0x298]
cmp dword [rcx + 0x11c], eax
jne 0x14000cb63
movzx eax, word [rcx + 0x120]
cmp eax, dword [rbp + 0x29c]
jne 0x14000cb63
mov r12d, 1
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [rsp + 0x54], r13d
test r14, r14
je 0x14000b67b
cmp word [r14], r13w
je 0x14000b67b
lea rdx, [rsp + 0x54]
mov rcx, r14
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
jmp 0x14000b67e
mov r14, r13
or ecx, 0xffffffff
call qword [sym.imp.IMM32.dll_ImmDisableIME]
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x14000b6c6
mov eax, 5
mov rcx, qword [rbp + 0x19e0]
xor rcx, rsp
call fcn.1400408d0
lea r11, [rsp + 0x1af0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r8d, r8d
lea r9, [rsp + 0x64]
mov dl, r12b
lea ecx, [r8 + 0x11]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
xor r8d, r8d
lea r9, [rsp + 0x65]
mov dl, r12b
lea ecx, [r8 + 0x12]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x14000cb9f
mov rax, qword [rax]
call qword [rax + 0x18]
xor r8d, r8d
lea rcx, str.WuaRegistryWorkRoot
xor edx, edx
lea rbx, [rax + 0x18]
mov qword [rbp - 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14000b73d
lea rcx, [rbp - 0x70]
call fcn.140001f40
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
jmp 0x14000b84a
test esi, esi
js 0x14000cb94
mov eax, dword [rbx - 0xc]
mov edx, r12d
sub edx, dword [rbx - 8]
sub eax, esi
or eax, edx
jge 0x14000b763
mov edx, esi
lea rcx, [rbp - 0x70]
call fcn.1400020a8
mov rbx, qword [rbp - 0x70]
mov r8d, esi
lea rcx, str.WuaRegistryWorkRoot
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400462c0
test eax, eax
js 0x14000cb94
cmp eax, dword [rbx - 0xc]
jg 0x14000cb94
mov dword [rbx - 0x10], eax
lea rdx, str.HKLM
cdqe
mov r8d, 4
mov rcx, rbx
mov word [rbx + rax*2], r13w
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x14000b7d6
lea rax, [rbx + 8]
mov r8d, 0x5c
cmp word [rax], r8w
je 0x14000b7cd
cmp word [rax], r13w
jne 0x14000b846
mov rcx, 0xffffffff80000002
jmp 0x14000b80d
mov r8d, 4
lea rdx, str.HKCU
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x14000b846
lea rax, [rbx + 8]
mov r8d, 0x5c
cmp word [rax], r8w
je 0x14000b806
cmp word [rax], r13w
jne 0x14000b846
mov rcx, 0xffffffff80000001
cmp word [rax], r8w
lea rdx, [rax + 2]
mov qword [0x14006f5e0], rcx
cmovne rdx, rax
test rdx, rdx
jne 0x14000b82a
mov eax, r13d
jmp 0x14000b837
mov rax, r15
inc rax
cmp word [rdx + rax*2], r13w
jne 0x14000b82d
mov r8d, eax
lea rcx, [0x140071ca0]
call fcn.1400021bc
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b862
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, fcn.1400129d0
mov byte [rsp + 0x50], r13b
mov qword [rbp + 0x190], rax
lea rdx, [rbp + 0x1d0]
lea rax, [rsp + 0x50]
mov qword [rbp + 0x208], r13
mov qword [rbp + 0x198], rax
lea rcx, [rbp + 0x190]
lea rax, [rbp + 0x190]
mov qword [rbp + 0x1c8], rax
call fcn.1400129d0
mov rcx, qword [rbp + 0x1c8]
mov qword [rbp + 0x208], rax
test rcx, rcx
je 0x14000b8cf
mov rax, qword [rcx]
lea rdx, [rbp + 0x190]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
xor edx, edx
lea rcx, [rbp - 0x28]
lea r8d, [rdx + 0x30]
call sub.msvcrt.dll_memset
cmp dword [rsp + 0x54], r13d
je 0x14000c652
mov rcx, qword [r14]
test rcx, rcx
je 0x14000c652
lea rdx, [0x14005b828]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000b9e8
mov rcx, qword [r14 + 8]
lea r8d, [rax + 3]
lea rdx, [0x14005b830]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x14000cb26
call fcn.14000b2bc
mov edi, eax
test eax, eax
jne 0x14000cb22
mov byte [rsp + 0x50], r12b
lea rcx, [rbp - 0x58]
mov rdx, qword [r14 + 8]
add rdx, 6
call fcn.1400022c8
mov rbx, qword [rbp - 0x58]
cmp dword [rbx - 0x10], 2
jl 0x14000b9ac
cmp dword [rbx - 0x10], r13d
jl 0x14000cb94
cmp word [rbx], 0x22
jne 0x14000b9ac
cmp dword [rbx - 8], r12d
jle 0x14000b97c
mov edx, dword [rbx - 0x10]
lea rcx, [rbp - 0x58]
call fcn.140001fb0
mov rbx, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400462c0
test eax, eax
js 0x14000cb94
cmp eax, dword [rbx - 0xc]
jg 0x14000cb94
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000cc9c
mov esi, eax
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000c649
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14000c649
mov rcx, qword [r14]
lea rdx, str._IsBusy
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000ba37
call fcn.14000b2bc
mov esi, eax
test eax, eax
jne 0x14000c649
lea rcx, [0x14006f660]
mov byte [rsp + 0x50], r12b
call fcn.1400088c0
mov esi, eax
test eax, eax
jne 0x14000c649
lea rcx, [0x14006f660]
call fcn.140008cd8
jmp 0x14000be7e
mov rcx, qword [r14]
lea rdx, str._specucheck
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000baa4
xor r9d, r9d
lea r8d, [rax + 4]
lea rdx, [rsp + 0x68]
mov ecx, 0xc9
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14000ba86
test byte [rsp + 0x68], 8
jne 0x14000c646
test byte [rsp + 0x68], 0x10
jne 0x14000c646
mov esi, 0xa0010001
jmp 0x14000c649
add eax, 0x3ffffffe
cmp eax, r12d
jbe 0x14000ba9a
mov esi, 0x80004005
jmp 0x14000c649
mov esi, 0xa0010002
jmp 0x14000c649
mov rcx, qword [r14]
lea rdx, str._Embedding3
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14000c53f
mov rcx, qword [r14]
lea rdx, str._Embedding4
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14000c53f
mov rcx, qword [r14]
lea rdx, str._Embedding5
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000be1a
mov eax, dword [rsp + 0x54]
sub eax, r12d
mov dword [rsp + 0x54], eax
cmp eax, 3
je 0x14000bb06
mov esi, 0x80070057
jmp 0x14000c649
xor edx, edx
mov dword [rbp + 0x210], 0x40
lea rcx, [rbp + 0x214]
lea r8d, [rdx + 0x3c]
call sub.msvcrt.dll_memset
lea rcx, [rbp + 0x210]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp + 0x230], 0x10000000
jb 0x14000c58e
call fcn.14000b2bc
mov esi, eax
test eax, eax
jne 0x14000c649
mov byte [rsp + 0x50], r12b
lea r8d, [rax + 0x10]
mov rcx, qword [r14 + 0x10]
xor edx, edx
call qword [sym.imp.msvcrt.dll_wcstoul]
mov r9, qword [r14 + 0x18]
lea rcx, [0x14006f660]
mov rdx, qword [r14 + 8]
mov r8d, eax
call fcn.140008680
mov esi, eax
test eax, eax
jne 0x14000c649
xor r9d, r9d
lea rcx, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14000c646
mov esi, 0x8007000e
mov ecx, 0x80004002
cmp eax, r15d
je 0x14000bdf6
mov eax, dword [rbp - 0x20]
cmp eax, 0x8123
jne 0x14000bd12
cmp dword [rbp - 0x10], 8
lea rdx, [rbp + 0x3b0]
mov rbx, qword [rbp - 0x18]
jb 0x14000bdd3
cmp dword [rbx + 4], 0xd
jae 0x14000bd0b
mov eax, dword [rbx + 4]
lea r8, [0x140000000]
mov r10, qword [r8 + rax*8 + 0x6f5f0]
test r10, r10
je 0x14000bd0b
mov edi, dword [rbp - 0x10]
mov r9d, r13d
sub rdi, 8
shr rdi, 4
mov qword [rbp - 0x78], rdi
test rdi, rdi
je 0x14000bc6c
mov rcx, r13
add rcx, rcx
mov r8, rdx
mov eax, dword [rbx + rcx*8 + 8]
test eax, eax
je 0x14000bc56
cmp eax, r12d
je 0x14000bc46
jle 0x14000bcc0
cmp eax, 3
jle 0x14000bc46
cmp eax, 4
je 0x14000bc46
cmp eax, 5
je 0x14000bc4d
cmp eax, 6
je 0x14000bc56
cmp eax, 7
jne 0x14000bcc0
mov rax, qword [rbx + rcx*8 + 0x10]
jmp 0x14000bc5a
lea rax, [0x14000236c]
jmp 0x14000bc5a
mov eax, dword [rbx + rcx*8 + 0x10]
add r9d, r12d
mov qword [r8], rax
mov ecx, r9d
add rdx, 8
cmp rcx, rdi
jne 0x14000bc14
lea rax, [rbp + 0x3b0]
mov rcx, r10
sub rdx, rax
sar rdx, 3
mov r8d, edx
lea rdx, [rbp + 0x3b0]
call fcn.140041920
mov dword [rbx], eax
test rdi, rdi
je 0x14000bdbb
mov rcx, qword [rbp - 0x78]
lea rdi, [rbx + 0x10]
mov eax, dword [rdi - 8]
test eax, eax
js 0x14000bcb5
cmp eax, 4
jl 0x14000bcf7
je 0x14000bccb
add eax, 0xfffffffb
cmp eax, 2
jbe 0x14000bcf7
mov dword [rbx], 0x8000ffff
jmp 0x14000bdbb
mov dword [rbx], 0x8000ffff
jmp 0x14000bdd3
mov r14, qword [rdi]
test r14, r14
je 0x14000bcf7
mov r14, qword [r14]
test r14, r14
je 0x14000bcf3
mov rcx, r14
call qword [sym.imp.msvcrt.dll__msize]
mov rcx, qword [rdi]
mov qword [rcx], r14
mov rcx, qword [rbp - 0x78]
mov dword [rdi - 4], eax
jmp 0x14000bcf7
and dword [rdi - 4], 0
add r13d, r12d
add rdi, 0x10
movsxd rax, r13d
cmp rax, rcx
jne 0x14000bc9f
jmp 0x14000bdbb
mov dword [rbx], ecx
jmp 0x14000bdd3
cmp eax, 0x8124
jne 0x14000bdc0
mov rbx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
mov dword [rsp + 0x60], eax
test rbx, rbx
je 0x14000bdd3
xor r14d, r14d
test eax, eax
je 0x14000bda8
mov edi, r14d
add rdi, rdi
mov ecx, dword [rbx + rdi*8 + 8]
lea eax, [rcx - 2]
cmp eax, r12d
jbe 0x14000bd7f
cmp ecx, 4
jne 0x14000bd72
cmp qword [rbx + rdi*8 + 0x10], 0
je 0x14000bd9b
mov ecx, 8
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
je 0x14000bda5
and qword [rax], 0
mov qword [rbx + rdi*8 + 0x10], rax
jmp 0x14000bd9b
cmp ecx, 7
jne 0x14000bd9b
and qword [rbx + rdi*8 + 0x10], 0
jmp 0x14000bd9b
cmp qword [rbx + rdi*8 + 0x10], 0
je 0x14000bd9b
mov ecx, dword [rbx + rdi*8 + 0xc]
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbx + rdi*8 + 0x10], rax
test rax, rax
je 0x14000bda5
add r14d, r12d
cmp r14d, dword [rsp + 0x60]
jmp 0x14000bd36
mov r13d, esi
mov dword [rbx], r13d
test r13d, r13d
je 0x14000bdbb
mov edx, r14d
mov rcx, rbx
call fcn.14000238c
xor r13d, r13d
jmp 0x14000bdd3
cmp eax, 0x8125
jne 0x14000bde2
mov edx, dword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
call fcn.14000238c
mov rcx, qword [0x14006f768]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x14000bdf6
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
mov ecx, 0x80004002
test eax, eax
jne 0x14000bba9
jmp 0x14000c646
mov rcx, qword [r14]
lea rdx, str._InitializeWinRE
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000be8f
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
movzx edx, word [rcx + 0x118]
movzx eax, word [rcx + 0x11c]
shl edx, 0x10
or edx, eax
cmp edx, 0x60001
jb 0x14000be61
mov al, r12b
cmp edx, 0x60002
jne 0x14000be64
mov al, r13b
test al, al
jne 0x14000be72
mov esi, 0x80004001
jmp 0x14000c649
cmp dword [rsp + 0x54], r12d
jne 0x14000be85
call fcn.140006488
mov esi, eax
jmp 0x14000c649
mov eax, 0x80004002
jmp 0x14000c64b
mov rcx, qword [r14]
lea rdx, str._EnableRestore
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000bf2f
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
movzx edx, word [rcx + 0x118]
movzx eax, word [rcx + 0x11c]
shl edx, 0x10
or edx, eax
cmp edx, 0x60001
jb 0x14000beda
mov al, r12b
cmp edx, 0x60002
jne 0x14000bedd
mov al, r13b
test al, al
je 0x14000c535
cmp dword [rsp + 0x54], 2
mov rbx, r13
jne 0x14000bf03
mov rcx, qword [r14 + 8]
xor edx, edx
lea r8d, [rdx + 0x10]
call sub.msvcrt.dll__wcstoui64
mov rbx, rax
jmp 0x14000bf0e
cmp dword [rsp + 0x54], r12d
jne 0x14000cb26
mov rcx, rbx
call fcn.140006b64
mov esi, eax
test rbx, rbx
je 0x14000cb2b
mov rcx, rbx
call qword [fcn.140037368]
jmp 0x14000cb2b
mov rcx, qword [r14]
lea rdx, str._DisableRestore
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000c0d0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
movzx edx, word [rcx + 0x118]
movzx eax, word [rcx + 0x11c]
shl edx, 0x10
or edx, eax
cmp edx, 0x60001
jb 0x14000bf77
cmp edx, 0x60002
jne 0x14000bf7a
mov r12b, r13b
test r12b, r12b
je 0x14000c535
cmp dword [rsp + 0x54], 2
mov edi, r13d
jl 0x14000bfac
mov rcx, qword [r14 + 8]
lea rdx, str._Force
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
sete dil
test eax, eax
je 0x14000c0c4
call fcn.140001b5c
test rax, rax
je 0x14000cb9f
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, [rbp - 0x50]
lea rcx, str._SystemDrive_360SysRt360PatchMgrResult.txt
mov qword [rbp - 0x50], rax
call fcn.14001bdc4
test eax, eax
jne 0x14000c0a4
call fcn.140001b5c
test rax, rax
je 0x14000cb9f
mov r8, qword [rax]
mov rcx, rax
call qword [r8 + 0x18]
add rax, 0x18
lea rdx, [rsp + 0x70]
lea rcx, [0x140000000]
mov qword [rsp + 0x70], rax
call fcn.14001bfb4
mov rbx, qword [rsp + 0x70]
test eax, eax
jne 0x14000c088
lea edx, [rax + 0x5c]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x14000c088
sub rax, rbx
sar rax, 1
cmp eax, r15d
je 0x14000c088
lea ecx, [rax + 1]
test ecx, ecx
js 0x14000cb94
cmp ecx, dword [rbx - 0xc]
jg 0x14000cb94
mov dword [rbx - 0x10], ecx
lea rdx, str.360PatchMgrResult.txt
cdqe
lea rcx, [rsp + 0x70]
mov r8d, 0x15
mov word [rbx + rax*2 + 2], r13w
call fcn.140019f84
mov rbx, qword [rsp + 0x70]
mov r8d, 3
mov rcx, qword [rbp - 0x50]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000c0a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x50]
mov eax, r15d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000c0c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ecx, edi
call fcn.1400075f4
jmp 0x14000c64b
mov rcx, qword [r14]
lea rdx, str._ProxyCall
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000c509
mov eax, dword [rsp + 0x54]
cmp eax, 2
jl 0x14000cb26
sub eax, r12d
lea rdx, str._EvaluateApplicability
mov dword [rsp + 0x54], eax
mov rcx, qword [r14 + 8]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000c309
mov eax, dword [rsp + 0x54]
add eax, 0xfffffffc
cmp eax, r12d
ja 0x14000cb26
mov rdx, qword [r14 + 0x10]
lea rcx, [rsp + 0x78]
call fcn.1400022c8
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x78]
call fcn.14001bdc4
mov rcx, qword [rsp + 0x78]
call fcn.14002d080
test eax, eax
jne 0x14000c15a
mov esi, 0x80070241
jmp 0x14000c2df
mov rcx, qword [rsp + 0x78]
call fcn.14001b83c
mov rdi, rax
test rax, rax
je 0x14000c2c0
mov rsi, qword [r14 + 0x18]
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x14000cbaa
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x68], rbx
test rsi, rsi
je 0x14000c1c1
cmp rsi, 0x10000
jae 0x14000c1c1
movzx esi, si
mov ecx, esi
call fcn.140001c74
test rax, rax
je 0x14000c1d1
mov r8d, esi
lea rcx, [rbp - 0x68]
mov rdx, rax
call fcn.1400013fc
jmp 0x14000c1cd
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.140010fc0
mov rbx, qword [rbp - 0x68]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbx - 0x18]
mov ecx, r15d
mov rsi, rax
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x14000c1fd
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rsi, rsi
je 0x14000c2c0
cmp dword [rsp + 0x54], 5
lea rbx, [0x14005cfb0]
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], r13
jne 0x14000c279
mov rcx, qword [r14 + 0x28]
xor edx, edx
lea r8d, [rdx + 0x10]
call sub.msvcrt.dll__wcstoui64
xor r9d, r9d
mov qword [rsp + 0x20], 0x400000
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000c279
cmp dword [rax], r13d
jne 0x14000c279
cmp dword [rax + 4], 0x3ffff4
ja 0x14000c279
lea rdx, str.WuaSetContext
mov qword [rbp - 0x40], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c279
lea rcx, [rbp - 0x48]
call rax
mov rcx, qword [r14 + 0x20]
xor edx, edx
lea r8d, [rdx + 0xa]
call qword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, eax
call rsi
test eax, eax
jne 0x14000c298
mov esi, 0x600f0001
jmp 0x14000c2a7
mov esi, 0x600f0002
cmp eax, r12d
je 0x14000c2a7
mov esi, 0x80004005
mov rcx, qword [rbp - 0x40]
mov qword [rbp - 0x48], rbx
test rcx, rcx
je 0x14000c2c7
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp - 0x40], r13
jmp 0x14000c2c7
call fcn.14001b570
mov esi, eax
test rdi, rdi
je 0x14000c2df
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x14000c2df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000cb2b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14000cb2b
mov rcx, qword [r14 + 8]
lea rdx, str._RunTarget
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000cb26
mov eax, dword [rsp + 0x54]
add eax, 0xfffffffa
cmp eax, r12d
ja 0x14000cb26
mov rdx, qword [r14 + 0x10]
lea rcx, [rbp - 0x80]
call fcn.1400022c8
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp - 0x80]
call fcn.14001bdc4
mov rcx, qword [rbp - 0x80]
call fcn.14002d080
test eax, eax
jne 0x14000c363
mov esi, 0x80070241
jmp 0x14000c500
mov rcx, qword [rbp - 0x80]
call fcn.14001b83c
mov rdi, rax
test rax, rax
je 0x14000c4e1
mov rsi, qword [r14 + 0x18]
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x14000cbb5
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x60], rbx
test rsi, rsi
je 0x14000c3c9
cmp rsi, 0x10000
jae 0x14000c3c9
movzx esi, si
mov ecx, esi
call fcn.140001c74
test rax, rax
je 0x14000c3d9
mov r8d, esi
lea rcx, [rbp - 0x60]
mov rdx, rax
call fcn.1400013fc
jmp 0x14000c3d5
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.140010fc0
mov rbx, qword [rbp - 0x60]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbx - 0x18]
mov ecx, r15d
mov rsi, rax
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x14000c405
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rsi, rsi
je 0x14000c4e1
cmp dword [rsp + 0x54], 7
lea rbx, [0x14005cfb0]
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], r13
jne 0x14000c481
mov rcx, qword [r14 + 0x38]
xor edx, edx
lea r8d, [rdx + 0x10]
call sub.msvcrt.dll__wcstoui64
xor r9d, r9d
mov qword [rsp + 0x20], 0x400000
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000c481
cmp dword [rax], r13d
jne 0x14000c481
cmp dword [rax + 4], 0x3ffff4
ja 0x14000c481
lea rdx, str.WuaSetContext
mov qword [rbp - 0x30], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c481
lea rcx, [rbp - 0x38]
call rax
mov rcx, qword [r14 + 0x30]
xor edx, edx
lea r8d, [rdx + 0x10]
call sub.msvcrt.dll__wcstoui64
mov rcx, qword [r14 + 0x28]
xor edx, edx
mov qword [rbp + 0x58], rax
lea r8d, [rdx + 0xa]
call qword [sym.imp.msvcrt.dll_wcstoul]
mov rcx, qword [r14 + 0x20]
xor edx, edx
mov dword [rbp + 0x60], eax
lea r8d, [rdx + 0xa]
call qword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, eax
lea r8, [rbp + 0x58]
lea rdx, [0x14000cbe8]
call rsi
mov rcx, qword [rbp - 0x30]
mov esi, eax
mov qword [rbp - 0x38], rbx
test rcx, rcx
je 0x14000c4e8
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp - 0x30], r13
jmp 0x14000c4e8
call fcn.14001b570
mov esi, eax
test rdi, rdi
je 0x14000c500
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x14000c500
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp - 0x80]
jmp 0x14000c2e4
mov rcx, qword [r14]
lea rdx, str._Hotfix
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14000c535
mov rcx, qword [r14]
lea rdx, str._SpecialLog
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14000cb26
mov esi, 0x80004001
jmp 0x14000cb2b
mov eax, dword [rsp + 0x54]
sub eax, r12d
mov dword [rsp + 0x54], eax
add eax, 0xfffffffd
test eax, 0xfffffffd
jne 0x14000bafc
xor edx, edx
mov dword [rbp + 0x250], 0x40
lea rcx, [rbp + 0x254]
lea r8d, [rdx + 0x3c]
call sub.msvcrt.dll_memset
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp + 0x270], 0x10000000
jae 0x14000c598
mov esi, 0x8007000e
jmp 0x14000c649
call fcn.14000b2bc
mov esi, eax
test eax, eax
jne 0x14000c649
mov byte [rsp + 0x50], r12b
lea r8d, [rax + 0x10]
mov rcx, qword [r14 + 0x10]
xor edx, edx
call qword [sym.imp.msvcrt.dll_wcstoul]
mov rcx, qword [r14 + 8]
lea r8d, [rsi + 0x10]
xor edx, edx
mov ebx, eax
call sub.msvcrt.dll__wcstoui64
mov r9, qword [r14 + 0x18]
lea rcx, [0x14006f660]
mov rdx, rax
mov r8d, ebx
call fcn.140008470
mov esi, eax
test eax, eax
jne 0x14000c649
jmp 0x14000c630
cmp eax, r15d
je 0x14000c630
cmp dword [rbp - 0x20], 0x8123
jne 0x14000c61c
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov rcx, qword [0x14006f780]
call fcn.140011900
mov rcx, qword [0x14006f768]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x14000c630
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14000c5eb
mov esi, r13d
mov eax, esi
mov esi, eax
jmp 0x14000cb2b
call fcn.14000494c
test eax, eax
je 0x14000cb26
call fcn.1400093f8
cmp eax, r12d
jne 0x14000ca2d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
test eax, eax
jne 0x14000cb2b
xor r8d, r8d
mov byte [rsp + 0x50], r12b
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x40], r12d
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], r13
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
lea rcx, [rbp + 8]
mov dword [rbp + 8], 8
mov dword [rbp + 0xc], 4
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rax, qword [0x1400722f8]
mov rbx, qword [0x1400722f0]
mov qword [0x140071c68], r13
jmp 0x14000c6f9
mov rdx, qword [rbx]
test rdx, rdx
je 0x14000c6f5
mov cl, r12b
call qword [rdx + 0x38]
mov rax, qword [0x1400722f8]
add rbx, 8
cmp rbx, rax
jb 0x14000c6e0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0x18
mov qword [0x140071c78], r13
mov dword [0x140071c70], eax
call fcn.1400408f4
lea rcx, [rbp + 0x70]
mov qword [rax], r13
mov qword [rax + 8], r13
mov dword [rax + 0x10], r13d
mov qword [0x140071c78], rax
mov qword [0x140071c80], r13
call fcn.1400098b0
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
mov rax, qword [rbp + 0x98]
test rax, rax
jne 0x14000c771
call fcn.1400392cc
mov qword [rbp + 0x98], rax
test rax, rax
jne 0x14000c771
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, r15
jmp 0x14000c7ef
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400393fc
lea rax, [rbp + 0x70]
mov qword [rbp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [0x1400723f8]
mov dword [rbp + 0x88], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140072420]
lea rcx, [0x1400723f8]
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x80]
mov qword [0x140072420], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x14006ff30]
lea r9, [0x140011750]
mov r8, rbx
mov qword [rsp + 0x20], r13
mov edx, 0x81
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rbx, rax
call fcn.140015850
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
call fcn.140001b5c
test rax, rax
je 0x14000cbd6
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, [rsp + 0x58]
lea rcx, [0x140000000]
mov qword [rsp + 0x58], rax
call fcn.14001bfb4
cmp ebx, r12d
jne 0x14000c97e
call fcn.140001b5c
test rax, rax
je 0x14000cbd6
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov r9d, dword [rbp + 0x110]
lea rdx, str._Result__r_nType_u_r_nResult0x_.8X
add rax, 0x18
lea rcx, [rbp + 0x10]
xor r8d, r8d
mov qword [rbp + 0x10], rax
call fcn.14001577c
mov rbx, qword [rsp + 0x58]
lea rsi, [rbx - 0x10]
cmp dword [rsi], r13d
je 0x14000c8c8
lea r8, str..del
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x38]
call fcn.140010bd8
mov r8d, r12d
mov rcx, rbx
mov rdx, qword [rax]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rdx, qword [rbp + 0x38]
mov eax, r15d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000c8c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x58]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rdi, qword [rbp + 0x10]
test rax, rax
je 0x14000c930
sub rax, rbx
sar rax, 1
cmp eax, r15d
je 0x14000c930
lea ecx, [rax + 1]
test ecx, ecx
js 0x14000cbc0
cmp ecx, dword [rbx - 0xc]
jg 0x14000cbc0
mov dword [rsi], ecx
lea rdx, str.360PatchMgrResult.txt
cdqe
lea rcx, [rsp + 0x58]
mov r8d, 0x15
mov word [rbx + rax*2 + 2], r13w
call fcn.140019f84
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call fcn.14001bec4
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000c94c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x58]
mov eax, r15d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000c96d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp + 0x70]
call fcn.14000b1b8
mov edi, r13d
jmp 0x14000cb22
movdqa xmm0, xmmword [0x1400653f0]
mov edx, 0x5c
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
mov byte [rbp + 0x13c0], r13b
movdqu xmmword [rbp + 0x13b0], xmm0
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x14000ca08
sub rax, rbx
sar rax, 1
cmp eax, r15d
je 0x14000ca08
lea ecx, [rax + 1]
test ecx, ecx
js 0x14000cbcb
cmp ecx, dword [rbx - 0xc]
jg 0x14000cbcb
mov dword [rbx - 0x10], ecx
lea rdx, str.360PatchMgrResult.txt
cdqe
lea rcx, [rsp + 0x58]
mov r8d, 0x15
mov word [rbx + rax*2 + 2], r13w
call fcn.140019f84
mov rbx, qword [rsp + 0x58]
lea rdx, [rbp + 0x13b0]
mov rcx, rbx
mov r8d, 0x10
call fcn.14001bec4
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000ca24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp + 0x70]
call fcn.14000b1b8
xor edx, edx
mov dword [rbp + 0x120], 0x68
lea rcx, [rbp + 0x128]
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
xor eax, eax
mov word [rbp + 0x160], r12w
xor edx, edx
mov qword [rbp + 0x18], rax
mov r8d, 0x208
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x13d0]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x15c], r12d
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rbp + 0x13d0]
lea rcx, str._SystemDrive__sources_recoveryRecEnv.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rbp + 0x18]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x13d0]
lea rax, [rbp + 0x120]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000cae6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
cmovne edi, eax
jmp 0x14000cb22
mov rcx, qword [rbp + 0x18]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x18]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x80004005
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x20]
call qword [fcn.140037368]
mov rcx, qword [rbp + 0x18]
call qword [fcn.140037368]
mov edi, dword [rsp + 0x60]
mov esi, edi
jmp 0x14000cb2b
mov esi, 0x80070057
mov rcx, qword [rbp + 0x208]
test rcx, rcx
je 0x14000cbe1
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp + 0x208]
test rcx, rcx
je 0x14000cb8d
mov r8, qword [rcx]
lea rax, [rbp + 0x1d0]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
jmp 0x14000cb8d
mov eax, 0x8007000a
jmp 0x14000b696
or r15, 0xffffffffffffffff
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000cb8d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, esi
jmp 0x14000b696
mov ecx, 0x80070057
call fcn.140002198
int3
mov ecx, 0x80004005
call fcn.140002198
int3
mov ecx, 0x80004005
call fcn.140002198
int3
mov ecx, 0x80004005
call fcn.140002198
int3
mov ecx, 0x80070057
call fcn.140002198
int3
mov ecx, 0x80070057
call fcn.140002198
int3
mov ecx, 0x80004005
call fcn.140002198
int3
call fcn.1400398f8
int3