Function at 0x140012a10
Capabilities:
Contain obfuscated stackstrings
Delete file
Get common file path

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x190
mov qword [rsp + 0x170], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov rbp, rcx
mov qword [r11 - 0x50], rcx
and qword [r11 - 0xe0], 0
and qword [r11 - 0xd8], 0
and dword [rsp + 0xe8], 0
mov r8d, 0xa
mov rdx, rcx
lea rcx, [r11 - 0xe0]
call fcn.140012830
lea rcx, [rsp + 0x60]
call fcn.140004508
nop
lea rdx, str.New_Version_SHA256
lea rcx, [rsp + 0x48]
call fcn.140004c38
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140012938
lea rcx, [rsp + 0x60]
call fcn.14000418c
test eax, eax
je 0x140012ae3
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0xd8]
call fcn.140012050
nop
mov rcx, rbp
call fcn.140004268
xor eax, eax
jmp 0x140013cb9
lea rcx, [rsp + 0xa0]
call fcn.140004508
nop
lea rdx, str.New_Version
lea rcx, [rsp + 0x48]
call fcn.140004c38
lea r8, [rsp + 0xa0]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140012938
lea rcx, [rsp + 0x88]
call fcn.140004508
nop
lea rcx, [rsp + 0x68]
call fcn.140004508
nop
lea rdx, str.New_Version_Base64_len
lea rcx, [rsp + 0x48]
call fcn.140004c38
lea r8, [rsp + 0x88]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140012938
lea rcx, [rsp + 0xa0]
call fcn.140004178
lea rdx, str.New_Version_len
lea rcx, [rsp + 0x48]
call fcn.140004c38
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140012938
lea rcx, [rsp + 0xc0]
call fcn.140004508
nop
lea rcx, [rsp + 0x78]
call fcn.140004508
nop
lea rcx, [rsp + 0x80]
call fcn.140004508
nop
lea rcx, [rsp + 0xb8]
call fcn.140004508
nop
mov byte [rsp + 0x178], 0x62
mov byte [rsp + 0x179], 0x61
mov byte [rsp + 0x17a], 0x73
mov byte [rsp + 0x17b], 0x65
mov byte [rsp + 0x17c], 0x5f
mov byte [rsp + 0x17d], 0x36
mov byte [rsp + 0x17e], 0x34
mov byte [rsp + 0x17f], 0x5f
mov byte [rsp + 0x180], 0x63
mov byte [rsp + 0x181], 0x6f
mov byte [rsp + 0x182], 0x64
mov byte [rsp + 0x183], 0x65
mov byte [rsp + 0x184], 0
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0xb8]
call fcn.140004d58
lea rcx, [rsp + 0xa8]
call fcn.140004508
nop
mov byte [rsp + 0x178], 0x74
mov byte [rsp + 0x179], 0x69
mov byte [rsp + 0x17a], 0x6d
mov byte [rsp + 0x17b], 0x65
mov byte [rsp + 0x17c], 0x5f
mov byte [rsp + 0x17d], 0x62
mov byte [rsp + 0x17e], 0x61
mov byte [rsp + 0x17f], 0x73
mov byte [rsp + 0x180], 0x65
mov byte [rsp + 0x181], 0x5f
mov byte [rsp + 0x182], 0x36
mov byte [rsp + 0x183], 0x34
mov byte [rsp + 0x184], 0
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0xa8]
call fcn.140004d58
lea rcx, [rsp + 0xb0]
call fcn.140004508
nop
mov byte [rsp + 0x178], 0x74
mov byte [rsp + 0x179], 0x69
mov byte [rsp + 0x17a], 0x6d
mov byte [rsp + 0x17b], 0x65
mov byte [rsp + 0x17c], 0x5f
mov byte [rsp + 0x17d], 0x62
mov byte [rsp + 0x17e], 0x61
mov byte [rsp + 0x17f], 0x73
mov byte [rsp + 0x180], 0x65
mov byte [rsp + 0x181], 0x5f
mov byte [rsp + 0x182], 0x36
mov byte [rsp + 0x183], 0x34
mov byte [rsp + 0x184], 0x5f
mov byte [rsp + 0x185], 0x32
mov byte [rsp + 0x186], 0
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0xb0]
call fcn.140004d58
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x48]
call fcn.140005290
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140012938
test eax, eax
je 0x140012e2e
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x48]
call fcn.140005290
lea r8, [rsp + 0xc0]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140012938
lea rcx, [rsp + 0x140]
call fcn.1400054d4
nop
and qword [rsp + 0x40], 0
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.140010b44
mov rdi, qword [rsp + 0x40]
mov rdx, rdi
lea rcx, [rsp + 0x140]
call fcn.140005b48
lea rcx, [rsp + 0x140]
call fcn.14000552c
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140004d58
nop
test rdi, rdi
je 0x140012e21
mov rcx, rdi
call fcn.140022534
nop
lea rcx, [rsp + 0x140]
call fcn.1400054f4
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x48]
call fcn.140005290
lea r8, [rsp + 0x80]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140012938
test eax, eax
je 0x140012ed0
lea rcx, [rsp + 0x140]
call fcn.1400054d4
nop
and qword [rsp + 0x40], 0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.140010b44
mov rdi, qword [rsp + 0x40]
mov rdx, rdi
lea rcx, [rsp + 0x140]
call fcn.140005b48
lea rcx, [rsp + 0x140]
call fcn.14000552c
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140004d58
nop
test rdi, rdi
je 0x140012ec3
mov rcx, rdi
call fcn.140022534
nop
lea rcx, [rsp + 0x140]
call fcn.1400054f4
mov rcx, qword [rsp + 0x80]
call fcn.1400221e4
mov r13d, eax
mov rcx, qword [rsp + 0x78]
call fcn.1400221e4
mov r12d, eax
lea rcx, [rsp + 0x50]
call fcn.140004508
nop
lea rcx, [rsp + 0x108]
call fcn.1400054d4
nop
and qword [rsp + 0x100], 0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x100]
call fcn.140010b44
mov rbx, qword [rsp + 0x100]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140004c38
mov rdx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x40]
sub rdi, rdx
movzx ecx, word [rdx]
movzx eax, word [rdx + rdi]
sub ecx, eax
jne 0x140012f5c
add rdx, 2
test eax, eax
jne 0x140012f49
test ecx, ecx
sete dil
lea rcx, [rsp + 0x40]
call fcn.140004268
xor esi, esi
lea r15d, [rsi + 1]
test dil, dil
cmovne esi, r15d
mov rdx, rbx
lea rcx, [rsp + 0x108]
call fcn.140005b48
lea rcx, [rsp + 0x98]
call fcn.140004508
nop
mov rdi, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x68]
call fcn.1400221e4
mov dword [rsp + 0x128], eax
lea r9, [rsp + 0x98]
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0xc8]
call fcn.140011428
lea rcx, [rsp + 0x60]
call fcn.14000477c
lea rcx, [rsp + 0x98]
call fcn.14000477c
mov rcx, qword [rsp + 0x88]
call fcn.1400221e4
movsxd rdx, eax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, r15
cmp rcx, rdx
je 0x1400131e1
lea rcx, [rsp + 0x40]
call fcn.140004508
nop
lea rdx, str._d____d
lea rcx, [rsp + 0x48]
call fcn.140004c38
nop
mov rsi, qword [rax]
mov rcx, qword [rsp + 0x88]
call fcn.1400221e4
mov r9d, eax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, r15
mov r8, rcx
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.1400054b0
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
lea rdx, str.__1__Base64_r_n
lea rcx, [rsp + 0x58]
call fcn.140004c38
nop
lea rdx, str.AutoUpdate_Error
lea rcx, [rsp + 0x90]
call fcn.140004c38
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140004000
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
mov rdi, qword [rax]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov r9d, 0x40000
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x90]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
nop
lea rcx, [rsp + 0x98]
call fcn.140004268
nop
test rbx, rbx
je 0x140013128
mov rcx, rbx
call fcn.140022534
nop
lea rcx, [rsp + 0x108]
call fcn.1400054f4
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0xb0]
call fcn.140004268
nop
lea rcx, [rsp + 0xa8]
call fcn.140004268
nop
lea rcx, [rsp + 0xb8]
call fcn.140004268
nop
lea rcx, [rsp + 0x80]
call fcn.140004268
nop
lea rcx, [rsp + 0x78]
call fcn.140004268
nop
lea rcx, [rsp + 0xc0]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x88]
call fcn.140004268
nop
lea rcx, [rsp + 0xa0]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0xd8]
call fcn.140012050
nop
mov rcx, rbp
call fcn.140004268
xor eax, eax
jmp 0x140013cb9
mov edi, dword [rsp + 0x128]
mov rcx, qword [rsp + 0x68]
call fcn.1400221e4
cmp eax, edi
je 0x1400133c4
lea rcx, [rsp + 0x40]
call fcn.140004508
nop
lea rdx, str.from_base:_d_nfile_len:_d
lea rcx, [rsp + 0x48]
call fcn.140004c38
nop
mov edi, dword [rsp + 0x128]
mov rsi, qword [rax]
mov rcx, qword [rsp + 0x68]
call fcn.1400221e4
mov r9d, eax
mov r8d, edi
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.1400054b0
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
lea rdx, str.__2__Base64
lea rcx, [rsp + 0x58]
call fcn.140004c38
nop
lea rdx, str.AutoUpdate_Error
lea rcx, [rsp + 0x90]
call fcn.140004c38
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140004000
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
mov rdi, qword [rax]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov r9d, 0x40000
mov r8, rdi
mov rdx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x90]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
nop
lea rcx, [rsp + 0x98]
call fcn.140004268
nop
test rbx, rbx
je 0x14001330b
mov rcx, rbx
call fcn.140022534
nop
lea rcx, [rsp + 0x108]
call fcn.1400054f4
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0xb0]
call fcn.140004268
nop
lea rcx, [rsp + 0xa8]
call fcn.140004268
nop
lea rcx, [rsp + 0xb8]
call fcn.140004268
nop
lea rcx, [rsp + 0x80]
call fcn.140004268
nop
lea rcx, [rsp + 0x78]
call fcn.140004268
nop
lea rcx, [rsp + 0xc0]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x88]
call fcn.140004268
nop
lea rcx, [rsp + 0xa0]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0xd8]
call fcn.140012050
nop
mov rcx, rbp
call fcn.140004268
xor eax, eax
jmp 0x140013cb9
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x98]
sub rdx, rax
movzx ecx, word [rax]
movzx edi, word [rax + rdx]
sub ecx, edi
jne 0x1400133e7
add rax, 2
test edi, edi
jne 0x1400133d4
test ecx, ecx
je 0x1400135ed
lea rdx, str._nOut:
lea rcx, [rsp + 0x58]
call fcn.140004c38
nop
lea rdx, str.__2b__In:
lea rcx, [rsp + 0x40]
call fcn.140004c38
nop
lea rdx, str.Sha256_error_
lea rcx, [rsp + 0xf8]
call fcn.140004c38
mov rdi, rax
lea rdx, str.AutoUpdate_Error
lea rcx, [rsp + 0xf0]
call fcn.140004c38
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140004000
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140004000
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140004000
nop
lea r8, [rsp + 0x98]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
mov rdi, qword [rdi]
mov rsi, qword [rax]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov r9d, 0x40000
mov r8, rdi
mov rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x90]
call fcn.140004268
nop
lea rcx, [rsp + 0xd0]
call fcn.140004268
nop
lea rcx, [rsp + 0xf0]
call fcn.140004268
nop
lea rcx, [rsp + 0xf8]
call fcn.140004268
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x98]
call fcn.140004268
nop
test rbx, rbx
je 0x140013534
mov rcx, rbx
call fcn.140022534
nop
lea rcx, [rsp + 0x108]
call fcn.1400054f4
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0xb0]
call fcn.140004268
nop
lea rcx, [rsp + 0xa8]
call fcn.140004268
nop
lea rcx, [rsp + 0xb8]
call fcn.140004268
nop
lea rcx, [rsp + 0x80]
call fcn.140004268
nop
lea rcx, [rsp + 0x78]
call fcn.140004268
nop
lea rcx, [rsp + 0xc0]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x88]
call fcn.140004268
nop
lea rcx, [rsp + 0xa0]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0xd8]
call fcn.140012050
nop
mov rcx, rbp
call fcn.140004268
xor eax, eax
jmp 0x140013cb9
mov edx, dword [0x140053008]
cmp r12d, edx
je 0x140013746
lea rdx, str.__3_
lea rcx, [rsp + 0x40]
call fcn.140004c38
nop
lea rdx, str.AutoUpdate_Error
lea rcx, [rsp + 0x70]
call fcn.140004c38
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
mov rdi, qword [rax]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov r9d, 0x40000
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
nop
lea rcx, [rsp + 0x98]
call fcn.140004268
nop
test rbx, rbx
je 0x14001368d
mov rcx, rbx
call fcn.140022534
nop
lea rcx, [rsp + 0x108]
call fcn.1400054f4
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0xb0]
call fcn.140004268
nop
lea rcx, [rsp + 0xa8]
call fcn.140004268
nop
lea rcx, [rsp + 0xb8]
call fcn.140004268
nop
lea rcx, [rsp + 0x80]
call fcn.140004268
nop
lea rcx, [rsp + 0x78]
call fcn.140004268
nop
lea rcx, [rsp + 0xc0]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x88]
call fcn.140004268
nop
lea rcx, [rsp + 0xa0]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0xd8]
call fcn.140012050
nop
mov rcx, rbp
call fcn.140004268
xor eax, eax
jmp 0x140013cb9
mov eax, edx
imul eax, eax, 0x1e61
cmp r13d, eax
je 0x1400138a1
lea rdx, str.__3b_
lea rcx, [rsp + 0x40]
call fcn.140004c38
nop
lea rdx, str.AutoUpdate_Error
lea rcx, [rsp + 0x70]
call fcn.140004c38
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
mov rdi, qword [rax]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov r9d, 0x40000
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
nop
lea rcx, [rsp + 0x98]
call fcn.140004268
nop
test rbx, rbx
je 0x1400137e8
mov rcx, rbx
call fcn.140022534
nop
lea rcx, [rsp + 0x108]
call fcn.1400054f4
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0xb0]
call fcn.140004268
nop
lea rcx, [rsp + 0xa8]
call fcn.140004268
nop
lea rcx, [rsp + 0xb8]
call fcn.140004268
nop
lea rcx, [rsp + 0x80]
call fcn.140004268
nop
lea rcx, [rsp + 0x78]
call fcn.140004268
nop
lea rcx, [rsp + 0xc0]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x88]
call fcn.140004268
nop
lea rcx, [rsp + 0xa0]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0xd8]
call fcn.140012050
nop
mov rcx, rbp
call fcn.140004268
xor eax, eax
jmp 0x140013cb9
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, r15
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8d, dword [rsp + 0x128]
lea rdx, str.Base_cur_leb:__d_nok:_d_nstrlen:_d_ntime_chk:_d___d
lea rcx, [rsp + 0x50]
call fcn.1400054b0
lea rdx, str._nno_Base64_len:
lea rcx, [rsp + 0x130]
call fcn.140004c38
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x50]
call fcn.14000451c
nop
lea rcx, [rsp + 0x130]
call fcn.140004268
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.14000451c
lea rdx, str._nBase64_len:
lea rcx, [rsp + 0x138]
call fcn.140004c38
nop
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x50]
call fcn.14000451c
nop
lea rcx, [rsp + 0x138]
call fcn.140004268
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x50]
call fcn.14000451c
lea rdx, str._nbase_64_code_str:
lea rcx, [rsp + 0xf8]
call fcn.140004c38
nop
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x50]
call fcn.14000451c
nop
lea rcx, [rsp + 0xf8]
call fcn.140004268
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.14000451c
lea rdx, str._ntime_base_64_str:
lea rcx, [rsp + 0xf0]
call fcn.140004c38
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x50]
call fcn.14000451c
nop
lea rcx, [rsp + 0xf0]
call fcn.140004268
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.14000451c
lea rcx, [rsp + 0x58]
call fcn.140004508
nop
mov edx, 0x105
lea rcx, [rsp + 0x58]
call fcn.140004588
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
or edx, 0xffffffff
lea rcx, [rsp + 0x58]
call fcn.140004b7c
mov rdx, qword [0x140047568]
lea rcx, [rsp + 0x58]
call fcn.140004544
lea rdx, str._Autoupdate.exe
lea rcx, [rsp + 0xd0]
call fcn.140004c38
nop
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x58]
call fcn.14000451c
nop
lea rcx, [rsp + 0xd0]
call fcn.140004268
lea rdx, str._n_nt:_n
lea rcx, [rsp + 0x90]
call fcn.140004c38
nop
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.14000451c
nop
lea rcx, [rsp + 0x90]
call fcn.140004268
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14000451c
lea rcx, [rsp + 0x40]
call fcn.140015edc
nop
lea rdx, [0x14003a280]
lea rcx, [rsp + 0x70]
call fcn.140004c38
nop
mov rdx, qword [0x140047568]
lea rcx, [rsp + 0xd0]
call fcn.1400052d4
nop
mov r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.140004000
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x90]
call fcn.140004268
nop
lea rcx, [rsp + 0xd0]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
lea rdx, str._Autoupdate.exe
lea rcx, [rsp + 0x48]
call fcn.140004c38
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
xor edi, edi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x178]
call fcn.140005290
xor r8d, r8d
lea rdx, [rsp + 0x108]
mov rcx, rax
call fcn.14001161c
test eax, eax
jne 0x140013b89
mov edi, r15d
jmp 0x140013b94
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x178]
call fcn.140005290
mov r8d, r15d
lea rdx, [rsp + 0x108]
mov rcx, rax
call fcn.14001161c
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.140005290
mov edx, edi
mov rcx, rax
call fcn.1400119fc
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x98]
call fcn.140004268
nop
test rbx, rbx
je 0x140013c05
mov rcx, rbx
call fcn.140022534
nop
lea rcx, [rsp + 0x108]
call fcn.1400054f4
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0xb0]
call fcn.140004268
nop
lea rcx, [rsp + 0xa8]
call fcn.140004268
nop
lea rcx, [rsp + 0xb8]
call fcn.140004268
nop
lea rcx, [rsp + 0x80]
call fcn.140004268
nop
lea rcx, [rsp + 0x78]
call fcn.140004268
nop
lea rcx, [rsp + 0xc0]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x88]
call fcn.140004268
nop
lea rcx, [rsp + 0xa0]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0xd8]
call fcn.140012050
nop
mov rcx, rbp
call fcn.140004268
xor eax, eax
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140021e20
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret