Function at 0x14000afcc
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x950]
sub rsp, 0xa50
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x940], rax
xor r13d, r13d
mov r15, rcx
cmp dword [0x1400502e0], 3
mov edi, r13d
mov ebx, r13d
jne 0x14000b150
cmp dword [0x140051658], r13d
lea r8d, [r13 + 1]
mov edx, r13d
mov qword [rsp + 0x38], r13
sete dl
lea rcx, [rsp + 0x38]
call fcn.1400035c8
movsxd rdi, eax
test eax, eax
jle 0x14000b696
mov rcx, qword [0x140050310]
lea r14d, [r13 + 2]
cmp rcx, 0xffffffffffffffff
jne 0x14000b069
mov edx, r14d
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b094
cmp dword [0x1400516e0], r14d
jl 0x14000b094
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x28
mov qword [rsp + 0x20], r13
lea rdx, str.UnInstall_warning:_dependencies_found._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b0d6
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, 0x400
mov edx, 0x11c
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x14000b0db
mov edx, 0x44d
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 1
mov edx, 0x44e
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r14, qword [rsp + 0x38]
mov r15, rdi
mov r12, rax
test rax, rax
je 0x14000b11d
test edi, edi
jle 0x14000b13f
mov rdi, r13
mov r9, qword [r14 + rdi*8]
xor r8d, r8d
mov edx, 0x180
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
inc rdi
cmp rdi, r15
jl 0x14000b100
test r15, r15
jle 0x14000b13f
mov rdi, r13
mov rcx, qword [r14 + rdi*8]
test rcx, rcx
je 0x14000b137
call fcn.14003c2b8
mov qword [r14 + rdi*8], r13
inc rdi
cmp rdi, r15
jl 0x14000b125
test r14, r14
je 0x14000b696
mov rcx, r14
jmp 0x14000b691
lea rax, section..data
cmp rax, qword [str.6ij]
jne 0x14000b350
cmp qword [0x140051660], r13
mov r12d, 0x400
mov r14d, 2
je 0x14000b282
call fcn.140013f90
test rax, rax
je 0x14000b282
call fcn.140013f90
mov rcx, rax
call fcn.140026b04
test eax, eax
je 0x14000b282
xor edx, edx
lea rcx, str.WMPlayerApp
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14000b282
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000b1da
mov edx, r14d
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b205
cmp dword [0x1400516e0], r14d
jl 0x14000b205
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x34
mov qword [rsp + 0x20], r13
lea rdx, str.NOTICE:_Windows_Media_Player_is_currently_running._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b27d
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, r12d
mov edx, 0x96
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b282
cmp dword [0x140050c44], r13d
je 0x14000b261
mov ecx, 0x800
call fcn.14003c310
mov rbx, rax
test rax, rax
je 0x14000b27d
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x14000b27d
mov rcx, rbx
call fcn.14003c2b8
jmp 0x14000b27d
mov edx, 0x3ee
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 1
call fcn.14001733c
mov rcx, rax
movabs rax, 0x624dd2f1a9fbe77
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
and rcx, 0xfffffffffffffc00
cmp rcx, 0xc800
ja 0x14000b696
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000b2da
mov edx, r14d
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b305
cmp dword [0x1400516e0], r14d
jl 0x14000b305
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x38
mov qword [rsp + 0x20], r13
lea rdx, str.ALERT:_Less_then_50MB_of_free_disk_space_is_available._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b349
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, r12d
mov edx, 0x14d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b696
lea edx, [rbx + 0x3ee]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
inc ebx
jmp 0x14000b696
xor edx, edx
lea rcx, str.WMPlayerApp
call qword [sym.imp.USER32.dll_FindWindowW]
mov r13d, 0x800
mov r12d, 0x400
mov r14d, 2
test rax, rax
jne 0x14000b383
call fcn.1400043c4
test eax, eax
je 0x14000b44b
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000b3a5
mov edx, r14d
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b3cf
cmp dword [0x1400516e0], r14d
jl 0x14000b3cf
and dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], rbx
lea rdx, str.NOTICE:_Windows_Media_Player_is_currently_running._r_n
mov r8d, 0x34
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b446
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, r12d
mov edx, 0x96
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b44b
cmp dword [0x140050c44], ebx
je 0x14000b42a
mov rcx, r13
call fcn.14003c310
mov rdi, rax
test rax, rax
je 0x14000b446
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x14000b446
mov rcx, rdi
call fcn.14003c2b8
xor edi, edi
jmp 0x14000b446
mov edx, 0x3ee
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 1
call fcn.1400042a8
test eax, eax
je 0x14000b553
cmp qword [0x140050310], 0xffffffffffffffff
jne 0x14000b46a
mov edx, r14d
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b4a3
cmp dword [0x1400516e0], r14d
jl 0x14000b4a3
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, str.NOTICE:_Deskband_is_currently_running._r_n
mov r8d, 0x28
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b551
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, r12d
mov edx, 0xa3
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b553
cmp dword [0x140050c44], 0
je 0x14000b534
test rdi, rdi
jne 0x14000b4fe
mov rcx, r13
call fcn.14003c310
mov rdi, rax
test rax, rax
je 0x14000b551
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rax
call fcn.140001470
jmp 0x14000b524
lea r8, [0x1400408ec]
mov rdx, r12
mov rcx, rdi
call fcn.140001584
test eax, eax
js 0x14000b528
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rdi
call fcn.140001584
test eax, eax
jns 0x14000b551
mov rcx, rdi
call fcn.14003c2b8
xor edi, edi
jmp 0x14000b551
lea edx, [rbx + 0x3ee]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
inc ebx
cmp ebx, 3
jae 0x14000b610
mov rax, qword [str.6ij]
lea rcx, str.K
cmp rcx, rax
je 0x14000b610
lea rcx, section..data
cmp rcx, rax
jne 0x14000b610
cmp qword [0x140050310], 0xffffffffffffffff
jne 0x14000b595
mov edx, r14d
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b5ce
cmp dword [0x1400516e0], r14d
jl 0x14000b5ce
and dword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
and qword [rsp + 0x20], 0
lea rdx, str.NOTICE:_This_system_is_a_MUI_SKU._r_n
mov r8d, 0x23
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b60e
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, r12d
mov edx, 0x98
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b610
lea edx, [rbx + 0x3ee]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
inc ebx
cmp dword [0x140050c44], 0
je 0x14000b689
test rdi, rdi
je 0x14000b696
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
test rax, rax
je 0x14000b689
lea rdx, str._NonSilentPlayerWarning
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14000b689
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x740]
mov r9d, 0x100
lea edx, [r9 - 0x53]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b689
mov al, byte [0x14005172e]
lea r8, [rbp + 0x740]
neg al
mov rdx, rdi
mov rcx, r15
sbb r9d, r9d
and r9d, 0x180000
add r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
test rdi, rdi
je 0x14000b696
mov rcx, rdi
call fcn.14003c2b8
mov eax, ebx
mov rcx, qword [rbp + 0x940]
xor rcx, rsp
call fcn.14003c6c0
lea r11, [rsp + 0xa50]
mov rbx, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret