Function at 0x14000afec
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x950]
sub rsp, 0xa50
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x940], rax
xor r13d, r13d
mov r15, rcx
cmp dword [0x1400502e0], 3
mov edi, r13d
mov ebx, r13d
jne 0x14000b170
cmp dword [0x140051658], r13d
lea r8d, [r13 + 1]
mov edx, r13d
mov qword [rsp + 0x38], r13
sete dl
lea rcx, [rsp + 0x38]
call fcn.1400035c8
movsxd rdi, eax
test eax, eax
jle 0x14000b6b6
mov rcx, qword [0x140050310]
lea r14d, [r13 + 2]
cmp rcx, 0xffffffffffffffff
jne 0x14000b089
mov edx, r14d
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b0b4
cmp dword [0x1400516e0], r14d
jl 0x14000b0b4
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x28
mov qword [rsp + 0x20], r13
lea rdx, str.UnInstall_warning:_dependencies_found._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b0f6
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, 0x400
mov edx, 0x11c
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x14000b0fb
mov edx, 0x44d
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 1
mov edx, 0x44e
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r14, qword [rsp + 0x38]
mov r15, rdi
mov r12, rax
test rax, rax
je 0x14000b13d
test edi, edi
jle 0x14000b15f
mov rdi, r13
mov r9, qword [r14 + rdi*8]
xor r8d, r8d
mov edx, 0x180
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
inc rdi
cmp rdi, r15
jl 0x14000b120
test r15, r15
jle 0x14000b15f
mov rdi, r13
mov rcx, qword [r14 + rdi*8]
test rcx, rcx
je 0x14000b157
call fcn.14003c408
mov qword [r14 + rdi*8], r13
inc rdi
cmp rdi, r15
jl 0x14000b145
test r14, r14
je 0x14000b6b6
mov rcx, r14
jmp 0x14000b6b1
lea rax, section..data
cmp rax, qword [str.6ij]
jne 0x14000b370
cmp qword [0x140051660], r13
mov r12d, 0x400
mov r14d, 2
je 0x14000b2a2
call fcn.140013fc4
test rax, rax
je 0x14000b2a2
call fcn.140013fc4
mov rcx, rax
call fcn.140026b64
test eax, eax
je 0x14000b2a2
xor edx, edx
lea rcx, str.WMPlayerApp
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14000b2a2
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000b1fa
mov edx, r14d
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b225
cmp dword [0x1400516e0], r14d
jl 0x14000b225
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x34
mov qword [rsp + 0x20], r13
lea rdx, str.NOTICE:_Windows_Media_Player_is_currently_running._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b29d
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, r12d
mov edx, 0x96
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b2a2
cmp dword [0x140050c44], r13d
je 0x14000b281
mov ecx, 0x800
call fcn.14003c460
mov rbx, rax
test rax, rax
je 0x14000b29d
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x14000b29d
mov rcx, rbx
call fcn.14003c408
jmp 0x14000b29d
mov edx, 0x3ee
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 1
call fcn.14001737c
mov rcx, rax
movabs rax, 0x624dd2f1a9fbe77
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
and rcx, 0xfffffffffffffc00
cmp rcx, 0xc800
ja 0x14000b6b6
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000b2fa
mov edx, r14d
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b325
cmp dword [0x1400516e0], r14d
jl 0x14000b325
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x38
mov qword [rsp + 0x20], r13
lea rdx, str.ALERT:_Less_then_50MB_of_free_disk_space_is_available._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b369
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, r12d
mov edx, 0x14d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b6b6
lea edx, [rbx + 0x3ee]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
inc ebx
jmp 0x14000b6b6
xor edx, edx
lea rcx, str.WMPlayerApp
call qword [sym.imp.USER32.dll_FindWindowW]
mov r13d, 0x800
mov r12d, 0x400
mov r14d, 2
test rax, rax
jne 0x14000b3a3
call fcn.1400043d0
test eax, eax
je 0x14000b46b
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000b3c5
mov edx, r14d
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b3ef
cmp dword [0x1400516e0], r14d
jl 0x14000b3ef
and dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], rbx
lea rdx, str.NOTICE:_Windows_Media_Player_is_currently_running._r_n
mov r8d, 0x34
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b466
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, r12d
mov edx, 0x96
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b46b
cmp dword [0x140050c44], ebx
je 0x14000b44a
mov rcx, r13
call fcn.14003c460
mov rdi, rax
test rax, rax
je 0x14000b466
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x14000b466
mov rcx, rdi
call fcn.14003c408
xor edi, edi
jmp 0x14000b466
mov edx, 0x3ee
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 1
call fcn.1400042b4
test eax, eax
je 0x14000b573
cmp qword [0x140050310], 0xffffffffffffffff
jne 0x14000b48a
mov edx, r14d
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b4c3
cmp dword [0x1400516e0], r14d
jl 0x14000b4c3
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, str.NOTICE:_Deskband_is_currently_running._r_n
mov r8d, 0x28
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b571
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, r12d
mov edx, 0xa3
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b573
cmp dword [0x140050c44], 0
je 0x14000b554
test rdi, rdi
jne 0x14000b51e
mov rcx, r13
call fcn.14003c460
mov rdi, rax
test rax, rax
je 0x14000b571
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rax
call fcn.140001470
jmp 0x14000b544
lea r8, [0x1400408ec]
mov rdx, r12
mov rcx, rdi
call fcn.140001584
test eax, eax
js 0x14000b548
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rdi
call fcn.140001584
test eax, eax
jns 0x14000b571
mov rcx, rdi
call fcn.14003c408
xor edi, edi
jmp 0x14000b571
lea edx, [rbx + 0x3ee]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
inc ebx
cmp ebx, 3
jae 0x14000b630
mov rax, qword [str.6ij]
lea rcx, [0x14004f2b0]
cmp rcx, rax
je 0x14000b630
lea rcx, section..data
cmp rcx, rax
jne 0x14000b630
cmp qword [0x140050310], 0xffffffffffffffff
jne 0x14000b5b5
mov edx, r14d
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000b5ee
cmp dword [0x1400516e0], r14d
jl 0x14000b5ee
and dword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
and qword [rsp + 0x20], 0
lea rdx, str.NOTICE:_This_system_is_a_MUI_SKU._r_n
mov r8d, 0x23
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15, r15
je 0x14000b62e
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x40]
mov r9d, r12d
mov edx, 0x98
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b630
lea edx, [rbx + 0x3ee]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
inc ebx
cmp dword [0x140050c44], 0
je 0x14000b6a9
test rdi, rdi
je 0x14000b6b6
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
test rax, rax
je 0x14000b6a9
lea rdx, str._NonSilentPlayerWarning
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14000b6a9
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x740]
mov r9d, 0x100
lea edx, [r9 - 0x53]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000b6a9
mov al, byte [0x14005172e]
lea r8, [rbp + 0x740]
neg al
mov rdx, rdi
mov rcx, r15
sbb r9d, r9d
and r9d, 0x180000
add r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
test rdi, rdi
je 0x14000b6b6
mov rcx, rdi
call fcn.14003c408
mov eax, ebx
mov rcx, qword [rbp + 0x940]
xor rcx, rsp
call fcn.14003c810
lea r11, [rsp + 0xa50]
mov rbx, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret