Function at 0x140006a84
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Encode data using xor
Get file attributes
Log keystrokes via polling
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x308]
sub rsp, 0x3e0
lea rcx, [0x140005960]
call qword [sym.imp.msvcrt.dll_int____cdecl___unsigned_long_long_unsigned___int64_____cdecl__set_new_handler_int____cdecl___unsigned_long_long_unsigned___int64___]
call fcn.140002584
lea rcx, [rbp + 0x1c0]
mov dword [rbp + 0x1c0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edi, edi
test eax, eax
je 0x1400088d5
cmp dword [rbp + 0x1d0], 2
jne 0x1400088d5
cmp dword [rbp + 0x1c4], 5
jb 0x1400088d5
or dword [rbp - 0x28], 0xffffffff
or dword [rbp - 0x38], 0xffffffff
lea rax, [0x140025fdc]
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x30], rax
mov byte [str.___InstallEnd__], 0x3b
mov byte [str.___Install__UTF_8_], 0x3b
mov byte [rsp + 0x31], dil
mov byte [rsp + 0x30], dil
mov byte [rsp + 0x33], dil
mov byte [rsp + 0x32], dil
call fcn.140018288
lea rcx, [rbp + 0x60]
call fcn.140018288
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
call fcn.140004eec
lea rdx, [0x140026424]
lea rcx, [rbp + 0x30]
call fcn.140018824
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.140005370
lea rcx, [rbp + 0x30]
mov rdx, rax
call fcn.140018910
lea rcx, [rbp + 0x30]
call fcn.140003d30
mov r12, qword [rbp + 0x30]
mov rcx, r12
mov r14, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r13d, [rdi + 1]
lea rdx, [0x140024ca8]
movsxd rcx, eax
mov r8d, r13d
lea r15, [r12 + rcx*2]
lea rcx, str.SfxVarModulePlatform
call fcn.1400048fc
call fcn.140002e94
lea rcx, str.SfxVarSystemPlatform
mov rdx, rax
mov r8d, r13d
call fcn.1400048fc
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, str.SfxVarCmdLine0
mov rdx, rax
mov r8d, r13d
call fcn.1400048fc
movzx ebx, word [0x14002bae0]
lea esi, [rdi + 0x20]
lea rcx, [rsp + 0x78]
mov edx, esi
call fcn.140003890
lea rdx, [0x14002639c]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x78]
mov r11d, edi
cmp word [rcx], di
je 0x140006c2b
mov rax, rcx
add rax, 2
add r11d, r13d
cmp word [rax], di
jne 0x140006c1f
mov eax, r11d
mov dword [rbp - 0x80], r11d
mov r8d, r13d
mov word [rcx + rax*2], di
mov rdx, qword [rsp + 0x78]
lea rcx, str.SfxVarSystemLanguage
call fcn.1400048fc
lea rdx, str.sfxlang
mov rcx, r12
call fcn.1400054f8
test rax, rax
je 0x140006ca9
cmp word [rax], 0x3a
jne 0x140006ca9
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll__wtol]
movzx edx, word [0x14002bae0]
lea ecx, [rax - 1]
cmp ecx, 0xfffe
cmovbe dx, ax
mov word [0x14002bae0], dx
add r12, 2
cmp word [r12], si
ja 0x140006c89
jmp 0x140006c9f
cmp ax, si
ja 0x140006ca9
add r12, 2
movzx eax, word [r12]
test ax, ax
jne 0x140006c96
lea rdx, str.sfxversion
mov rcx, r12
call fcn.1400054f8
test rax, rax
je 0x140006cc7
call fcn.140005d10
jmp 0x1400086bb
lea rdx, str.sfxwaitall
mov rcx, r12
call fcn.1400054f8
test rax, rax
je 0x140006cea
mov rcx, rax
call fcn.1400062a4
mov edi, eax
jmp 0x1400086bb
lea rdx, str.sfxelevation
mov rcx, r12
mov r13b, dil
call fcn.1400054f8
test rax, rax
je 0x140006d1a
mov r13b, 1
jmp 0x140006d0f
cmp cx, si
ja 0x140006d17
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140006d06
mov r12, rax
mov ebx, 0x208
lea rcx, [0x14002bbe0]
mov edx, ebx
call fcn.140003890
mov r8d, ebx
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140006d54
lea edx, [rax + 6]
lea ecx, [rax + 1]
call fcn.14000b850
mov edi, 1
jmp 0x1400086bb
mov rdx, qword [0x14002bbe0]
mov eax, edi
cmp word [rdx], di
je 0x140006d70
mov rcx, rdx
add rcx, 2
inc eax
cmp word [rcx], di
jne 0x140006d65
mov dword [0x14002bbe8], eax
mov word [rdx + rax*2], di
lea rdx, str.sfxtest
mov rcx, r12
call fcn.1400054f8
mov r8d, 0x61
mov rbx, rax
test rax, rax
je 0x140006f92
cmp word [rax], 0x3a
je 0x140006dab
mov edi, 0x64
jmp 0x1400086bb
movzx edx, word [rax + 2]
mov ecx, edx
or ecx, esi
sub ecx, r8d
je 0x140006f05
sub ecx, 2
je 0x140006eed
dec ecx
je 0x140006e31
sub ecx, 0xb
je 0x140006ddd
cmp ecx, 7
jne 0x140006da1
mov edi, 0x4f30
jmp 0x1400086bb
cmp word [rax + 4], 0x3a
jne 0x1400086bb
movzx ecx, word [rax + 6]
sub ecx, 0x31
je 0x140006d4a
dec ecx
je 0x140006e27
dec ecx
je 0x140006e1d
dec ecx
je 0x140006e13
dec ecx
jne 0x1400086bb
mov edi, 7
jmp 0x1400086bb
mov edi, 0x3ff
jmp 0x1400086bb
mov edi, 0x1f
jmp 0x1400086bb
mov edi, 0x5ff
jmp 0x1400086bb
cmp edx, 0x44
jne 0x140006ee7
cmp word [rax + 4], 0x3a
jne 0x140006da1
lea r12d, [rdx - 0x24]
mov edx, dword [0x14002bc58]
add rbx, 6
movzx esi, word [rbx]
cmp si, r12w
jbe 0x140006e9d
cmp si, 0x3a
je 0x140006e9d
cmp dword [0x14002bc5c], edx
jne 0x140006e7c
lea rcx, [0x14002bc50]
call fcn.140018178
mov edx, dword [0x14002bc58]
mov rcx, qword [0x14002bc50]
mov eax, edx
inc edx
mov word [rcx + rax*2], si
mov word [rcx + rdx*2], di
mov dword [0x14002bc58], edx
mov eax, edx
add rbx, 2
jmp 0x140006e53
test edx, edx
je 0x140006da1
mov esi, 0x20
mov dword [0x14002bc48], edi
cmp word [rbx], 0x3a
jne 0x140006ed1
lea rcx, [rbx + 2]
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x14002bc48], eax
cmp eax, 0xe10
ja 0x140006ed1
test eax, eax
jne 0x140006edb
mov dword [0x14002bc48], 0xa
mov dword [0x14002bc4c], 1
jmp 0x140006f15
add rbx, 4
jmp 0x140006eaa
movzx eax, word [rax + 4]
sub ax, 0x63
neg ax
sbb eax, eax
add eax, 4
mov dword [0x14002bc4c], eax
jmp 0x140006f15
mov dword [0x14002bc4c], 2
jmp 0x140006f15
add rbx, 2
cmp word [rbx], si
ja 0x140006f11
jmp 0x140006f25
cmp ax, si
ja 0x140006f2d
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x140006f1c
lea rdx, str.sfxconfig
mov rcx, rbx
mov r12, rbx
call fcn.1400054f8
mov rcx, rax
test rax, rax
je 0x140006f92
cmp word [rax], 0x3a
jne 0x140006f58
jmp 0x140006f54
cmp ax, si
ja 0x140006f60
add rcx, 2
movzx eax, word [rcx]
test ax, ax
jne 0x140006f4f
mov rax, qword [rsp + 0x78]
mov dword [rbp - 0x80], edi
lea rdx, [rsp + 0x78]
mov word [rax], di
call fcn.140005370
cmp dword [0x14002bc4c], 2
mov r12, rax
je 0x140006f92
lea rdx, [rsp + 0x78]
lea rcx, [0x14002bbe0]
call fcn.1400182fc
lea rdx, [0x14002bbe0]
lea rcx, [0x14002bb90]
call fcn.1400182fc
lea rdx, [0x14002bbe0]
lea rcx, [0x14002bba0]
call fcn.1400182fc
lea rcx, [0x14002bbe0]
call fcn.14000254c
test eax, eax
js 0x140007084
mov rcx, qword [0x14002bb90]
mov edx, eax
mov dword [0x14002bb98], eax
mov word [rcx + rdx*2], di
movsxd rbx, eax
mov rax, qword [0x14002bbe0]
lea rdx, [rax + rbx*2 + 2]
lea rcx, [0x14002bba0]
call fcn.140018880
mov r11, qword [0x14002bbe0]
lea rdx, [r11 + rbx*2 + 2]
lea rbx, [0x14002bbc0]
mov rcx, rbx
call fcn.140018880
mov edx, 0x2e
mov rcx, rbx
call fcn.1400183fc
test eax, eax
jle 0x140007039
mov dword [0x14002bbc8], eax
mov ecx, eax
mov rax, qword [0x14002bbc0]
mov word [rax + rcx*2], di
lea rcx, [0x14002bbb0]
mov rdx, rbx
call fcn.1400182fc
mov ecx, 4
call fcn.140002c2c
lea rcx, [0x14002bbb0]
mov rdx, rax
call fcn.140018910
mov r11, qword [0x14002bbc0]
mov rax, qword [0x14002bbb0]
mov qword [0x14002bb28], r11
mov qword [0x14002bb38], rax
mov qword [0x14002bb40], r11
call fcn.140002e94
lea rcx, [0x14002bbd0]
mov rdx, rax
call fcn.140018880
mov ecx, 0x38
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
mov qword [rbp], rax
test rax, rax
je 0x1400070c5
mov dword [rax + 8], edi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
lea rax, [0x140026120]
mov qword [rbx], rax
jmp 0x1400070cc
mov rbx, rdi
mov qword [rbp], rbx
test rbx, rbx
je 0x1400070da
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
mov rdx, qword [0x14002bbe0]
mov rcx, rbx
call fcn.14000c034
test al, al
jne 0x140007119
mov r8, qword [0x14002bbe0]
mov edx, 7
lea ecx, [rdx - 6]
call fcn.14000b850
test rbx, rbx
je 0x14000710f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 2
jmp 0x1400086bb
lea rcx, [rsp + 0x68]
call fcn.140017fbc
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.140003640
test al, al
jne 0x140007162
mov edx, 9
xor ecx, ecx
call fcn.14000b850
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x140007158
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 3
jmp 0x1400086bb
cmp dword [0x14002bc4c], edi
jne 0x14000720e
lea rdx, str.sfxconfig
mov rcx, r12
call fcn.1400054f8
test rax, rax
je 0x14000720e
cmp word [rax], 0x3a
jne 0x140007190
add rax, 2
movzx ecx, word [rax]
test cx, cx
je 0x1400071ed
cmp cx, si
ja 0x1400071a9
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140007198
cmp word [rax], di
je 0x1400071ed
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140006908
test al, al
jne 0x1400071ed
mov edx, 0xa
xor ecx, ecx
call fcn.14000b850
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x1400071e3
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 4
jmp 0x1400086bb
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x1400086bb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x1400086bb
lea rcx, [rsp + 0x48]
call fcn.140006898
cmp dword [rsp + 0x70], edi
je 0x140007234
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
xor r8d, r8d
call fcn.140004a20
test al, al
je 0x1400071cb
cmp dword [0x14002bc4c], 4
je 0x1400071ed
mov eax, dword [0x14002b060]
lea rsi, [0x14002b060]
test eax, eax
je 0x140007290
mov ebx, 0x20
lea rdx, str.SfxString_d
lea rcx, [rbp + 0x160]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsi]
call fcn.140002c2c
lea rcx, [rbp + 0x160]
xor r8d, r8d
mov rdx, rax
call fcn.1400048fc
add rsi, rbx
mov eax, dword [rsi]
test eax, eax
jne 0x140007253
mov rbx, qword [rbp]
lea rcx, [rsp + 0x48]
call fcn.1400055a4
sub r12, 2
lea rdx, [0x140024c04]
lea rcx, str.SfxVarCmdLine2
mov r8d, 1
mov qword [rbp - 0x60], r12
call fcn.1400048fc
mov ecx, 0x20
mov r8d, 0x2d
lea edx, [r8 - 0xc]
cmp word [r12], cx
jbe 0x1400072e0
add r12, 2
cmp word [r12], cx
ja 0x1400072d1
mov qword [rbp - 0x60], r12
movzx eax, word [r12]
test ax, ax
je 0x140007301
cmp ax, cx
ja 0x1400072fd
add r12, 2
movzx eax, word [r12]
test ax, ax
jne 0x1400072ea
mov qword [rbp - 0x60], r12
cmp word [r12], 0x2f
je 0x140007314
cmp word [r12], r8w
jne 0x140007675
cmp word [r12 + 2], dx
je 0x140007665
lea rdx, [0x1400262d8]
lea rcx, [r12 + 2]
call fcn.1400050ac
test rax, rax
je 0x1400073a4
lea rax, [r12 + 6]
mov ecx, 0x30
cmp word [rax], cx
jb 0x14000734b
cmp word [rax], 0x39
jbe 0x140007367
mov ecx, 0x61
cmp word [rax], cx
jb 0x14000735b
cmp word [rax], 0x7a
jbe 0x140007367
cmp word [rax], 0x41
jb 0x14000737b
cmp word [rax], 0x5a
ja 0x14000737b
mov qword [rbp - 0x30], rax
mov al, 1
mov byte [rsp + 0x31], 1
mov byte [rsp + 0x30], al
jmp 0x1400072bb
mov ecx, 0x20
cmp word [rax], cx
ja 0x140007675
lea rax, [0x140025fdc]
mov byte [rsp + 0x31], 1
mov qword [rbp - 0x30], rax
mov al, 1
mov byte [rsp + 0x30], al
jmp 0x1400072c0
lea rdx, [0x1400262d0]
lea rcx, [r12 + 2]
call fcn.1400050ac
test rax, rax
je 0x1400073cb
lea rdx, [r12 + 6]
lea rcx, str.OverwriteMode
jmp 0x140007550
lea rdx, [0x1400262c8]
lea rcx, [r12 + 2]
call fcn.1400050ac
test rax, rax
je 0x14000741b
lea rdx, [r12 + 6]
mov eax, 0x30
cmp word [rdx], ax
jb 0x140007675
cmp word [rdx], 0x32
ja 0x140007675
mov eax, 0x20
cmp word [r12 + 8], ax
ja 0x140007675
lea rcx, str.GUIMode
jmp 0x140007550
lea rdx, [0x1400262c0]
lea rcx, [r12 + 2]
call fcn.1400050ac
test rax, rax
je 0x140007442
lea rdx, [r12 + 6]
lea rcx, str.GUIFlags
jmp 0x140007550
lea rdx, [0x1400262b8]
lea rcx, [r12 + 2]
call fcn.1400050ac
test rax, rax
je 0x140007469
lea rdx, [r12 + 6]
lea rcx, str.MiscFlags
jmp 0x140007550
lea rdx, [0x1400262b0]
lea rcx, [r12 + 2]
call fcn.1400050ac
test rax, rax
je 0x1400074b9
lea rdx, [r12 + 6]
mov eax, 0x30
cmp word [rdx], ax
je 0x14000749c
mov eax, 0x31
cmp word [rdx], ax
jne 0x140007675
mov eax, 0x20
cmp word [r12 + 8], ax
ja 0x140007675
lea rcx, str.SelfDelete
jmp 0x140007550
lea rdx, [0x1400262a8]
lea rcx, [r12 + 2]
call fcn.1400050ac
test rax, rax
je 0x1400074ea
mov ecx, 0x20
cmp word [r12 + 6], cx
ja 0x140007675
mov byte [rsp + 0x33], 1
jmp 0x1400072c0
lea rdx, [0x1400262a0]
lea rcx, [r12 + 2]
call fcn.1400050ac
test rax, rax
je 0x14000752e
lea rcx, [r12 + 6]
mov eax, 0x30
cmp word [rcx], ax
jb 0x140007675
cmp word [rcx], 0x39
ja 0x140007675
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x14002b634], eax
jmp 0x1400072bb
lea rdx, [0x140026298]
lea rcx, [r12 + 2]
call fcn.1400050ac
test rax, rax
je 0x14000755f
lea rdx, [r12 + 8]
lea rcx, str.BeginPromptTimeout
lea r8, [rsp + 0x48]
call fcn.140005ac8
jmp 0x1400072bb
cmp word [r12 + 2], 0x70
je 0x1400075ff
cmp word [r12 + 2], 0x50
je 0x1400075ff
cmp word [r12 + 2], 0x79
je 0x14000758b
cmp word [r12 + 2], 0x59
jne 0x1400075a3
mov ecx, 0x20
cmp word [r12 + 4], cx
ja 0x1400075a8
mov al, 1
mov byte [rsp + 0x31], al
jmp 0x1400072c0
mov ecx, 0x20
cmp word [r12 + 2], 0x3f
je 0x1400075c3
cmp word [r12 + 2], 0x68
je 0x1400075c3
cmp word [r12 + 2], 0x48
jne 0x1400075d5
cmp word [r12 + 4], cx
ja 0x1400075d5
mov byte [rsp + 0x32], 1
jmp 0x1400072c0
lea rdx, [rsp + 0x48]
lea rcx, [r12 + 2]
call fcn.140005988
test rax, rax
je 0x140007675
cmp rax, 1
je 0x140007643
mov r12, rax
mov qword [rbp - 0x60], rax
jmp 0x1400072bb
lea rcx, [rbp + 0x20]
call fcn.140018288
lea rcx, [r12 + 4]
lea rdx, [rbp + 0x20]
call fcn.140005370
mov rdx, qword [rbp + 0x20]
lea rcx, [0x14002bac8]
lea r12, [rax - 2]
mov qword [rbp - 0x60], r12
call fcn.140018880
mov rcx, qword [rbp + 0x20]
mov byte [0x14002bac4], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400072bb
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x14000765b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 0x20
jmp 0x1400086bb
mov rsi, r12
add r12, 4
mov qword [rbp - 0x60], r12
test rsi, rsi
jne 0x140007678
mov rsi, r12
cmp r14, rsi
je 0x1400076dc
lea rcx, [rsp + 0x58]
mov rdx, r14
call fcn.140018824
sub rsi, r14
lea r8, [rsp + 0x58]
sar rsi, 1
lea rcx, [rbp - 0x58]
mov edx, esi
call fcn.1400181bc
mov rdx, qword [rbp - 0x58]
lea rcx, [rsp + 0x78]
call fcn.140018880
mov rcx, qword [rbp - 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x78]
call fcn.140018430
lea rcx, [rsp + 0x78]
call fcn.1400189f4
mov rdx, qword [rsp + 0x78]
jmp 0x1400076e3
lea rdx, [0x140024c04]
lea rcx, str.SfxVarCmdLine1
mov r8d, 1
call fcn.1400048fc
lea rcx, [rsp + 0x58]
mov rdx, r12
call fcn.140018824
sub r15, r12
lea r8, [rsp + 0x58]
sar r15, 1
lea rcx, [rbp - 0x58]
mov edx, r15d
call fcn.1400181bc
mov rdx, qword [rbp - 0x58]
lea rcx, [rsp + 0x78]
call fcn.140018880
mov rcx, qword [rbp - 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x78]
call fcn.140018430
lea rcx, [rsp + 0x78]
call fcn.1400189f4
mov rdx, qword [rsp + 0x78]
lea rcx, str.SfxVarCmdLine2
mov r8d, 1
call fcn.1400048fc
lea rcx, [rsp + 0x48]
call fcn.1400055a4
test r13b, r13b
jne 0x1400078e0
test byte [0x14002bb58], 4
je 0x1400078e0
call fcn.140002ecc
test eax, eax
jne 0x1400078e0
lea rcx, [rbp]
call fcn.140018288
lea rcx, [rbp + 0x10]
call fcn.140018288
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rbp]
mov rcx, rax
call fcn.140005370
lea rcx, [rbp + 0x20]
mov rdx, rax
call fcn.140018824
lea r8, [rbp]
lea rdx, [0x140025fd0]
lea rcx, [rbp - 0x48]
call fcn.1400187e0
lea r8, [0x140026080]
lea rcx, [rbp - 0x10]
mov rdx, rax
call fcn.14001879c
lea r8, str.sfxelevation
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.14001879c
lea rcx, [rbp - 0x58]
mov r8d, 0x20
mov rdx, rax
call fcn.140018700
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x58]
call fcn.140018770
lea rcx, [rbp + 0x10]
mov rdx, qword [rax]
call fcn.140018880
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x20]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, qword [rbp + 0x10]
xor r8d, r8d
lea edx, [r8 + 2]
call fcn.140005e6c
mov rcx, qword [rbp + 0x20]
test eax, eax
jne 0x1400078c4
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x1400078ba
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 0xb
jmp 0x1400086bb
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400071ed
mov dword [rbp - 0x64], edi
jmp 0x140007935
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.140018824
mov rcx, qword [rsp + 0x58]
mov edx, 0x3d
call fcn.140017df4
mov rcx, qword [rsp + 0x58]
test eax, eax
jle 0x140007954
mov edx, eax
mov dword [rsp + 0x60], eax
cdqe
mov word [rcx + rdx*2], di
mov rcx, qword [rsp + 0x58]
lea rdx, [rsi + rax*2 + 2]
xor r8d, r8d
call fcn.1400048fc
mov rcx, qword [rsp + 0x58]
inc dword [rbp - 0x64]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r8, [rbp - 0x64]
lea rdx, str.SetEnvironment
lea rcx, [rsp + 0x48]
call fcn.140003ec4
mov rsi, rax
test rax, rax
jne 0x1400078e5
jmp 0x140007959
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
call fcn.140006424
mov r11d, dword [0x14002b628]
mov al, byte [rsp + 0x32]
cmp r11d, 0xffffffff
cmove r11d, edi
mov dword [0x14002b628], r11d
test al, al
je 0x1400079f8
lea rdx, str.HelpText
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
mov rsi, rax
test rax, rax
jne 0x1400079a3
lea ecx, [rax + 0x18]
call fcn.140002c2c
mov rsi, rax
lea rcx, [rbp + 0xb0]
call fcn.140009a0c
mov r8, qword [0x14002bb28]
lea r11, [0x140025b80]
lea rcx, [rbp + 0xb0]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rbp + 0xb0], r11
mov dword [rbp + 0x100], 0x7d6
mov qword [rsp + 0x20], rdi
call fcn.140009d44
lea rcx, [rbp + 0xb0]
call fcn.140009a8c
jmp 0x1400071ed
mov r14b, byte [rsp + 0x31]
test r14b, r14b
je 0x140007a0e
btr r11d, 8
mov dword [0x14002b628], r11d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, str.SfxAuthor
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
mov rsi, rax
test rax, rax
je 0x140007b45
lea rcx, [rbp + 0xb0]
call fcn.14000d5e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0xb0]
mov rdx, rsi
movsxd r8, eax
add r8, r8
call fcn.14000d8a0
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14000dc00
lea rcx, [rbp + 0x130]
lea rdx, str.123456789ABCDEFGHJKMNPQRSTUVWXYZ
mov r8d, 0x21
call sub.msvcrt.dll_memcpy
mov r11, rdi
mov eax, dword [rbp + r11*4 + 0x50]
inc r11
xor dword [rbp + r11*4 + 0x3c], eax
cmp r11, 4
jl 0x140007a8c
mov r10d, edi
mov r9d, edi
lea r8, [rbp + 0x160]
mov esi, 0x2d
mov eax, r9d
cdq
and edx, 7
add eax, edx
mov ecx, eax
and eax, 7
sar ecx, 3
sub eax, edx
movsxd rcx, ecx
movzx r11d, byte [rbp + rcx + 0x40]
mov cl, al
shr r11d, cl
and r11d, 0x1f
test r9d, r9d
je 0x140007b00
mov eax, 0x51eb851f
imul r9d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x19
cmp r9d, edx
jne 0x140007b00
mov word [r8], si
inc r10d
add r8, 2
movsxd rax, r11d
add r9d, 5
inc r10d
movsx edx, byte [rbp + rax + 0x130]
mov word [r8], dx
add r8, 2
cmp r9d, 0x7d
jl 0x140007ab1
movsxd rax, r10d
lea rdx, [rbp + 0x160]
lea rcx, [0x14002bac8]
mov word [rbp + rax*2 + 0x160], di
call fcn.140018880
mov byte [0x14002bac4], 1
lea rdx, str.InstallPath
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
test rax, rax
je 0x140007b6d
lea rcx, [0x14002bb80]
mov rdx, rax
call fcn.140018880
lea rcx, [0x14002bb80]
call fcn.14000503c
lea rdx, str.BeginPromptTimeout
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
test rax, rax
je 0x140007ba1
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x14002bb64], eax
cmp dword [0x14002bc58], edi
je 0x140007bd4
lea rcx, [rsp + 0x48]
call fcn.14000c204
mov rcx, qword [rsp + 0x68]
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x140007bcd
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + InitCommonControls]
mov edi, esi
jmp 0x1400086bb
cmp dword [0x14002bc4c], 3
jne 0x140007be9
lea rcx, [rsp + 0x48]
call fcn.14000c0d4
jmp 0x140007bb3
test byte [0x14002bb58], 8
jne 0x140007c2a
mov rcx, rbx
call fcn.1400017f4
test eax, eax
jne 0x140007c2a
lea edx, [rax + 8]
xor ecx, ecx
call fcn.14000b850
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x140007c20
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 5
jmp 0x1400086bb
mov sil, byte [rsp + 0x30]
lea rdx, str.BeginPrompt
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
test rax, rax
je 0x140007c95
test r14b, r14b
jne 0x140007c95
mov rcx, qword [0x14002bb28]
mov rdx, rax
call fcn.14000b47c
test eax, eax
je 0x140007c08
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140007c85
mov r14b, 1
mov byte [rsp + 0x31], r14b
mov sil, r14b
mov byte [rsp + 0x30], r14b
cmp dword [0x14002bc28], edi
je 0x140007c95
btr dword [0x14002b628], 7
lea rcx, [rsp + 0x38]
call fcn.140018288
mov r15, qword [rbp - 0x30]
test sil, sil
je 0x140007d8e
mov rsi, r15
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x38]
call fcn.140018880
mov edx, dword [rsp + 0x40]
movzx r13d, word [rsi]
cmp dword [rsp + 0x44], edx
jne 0x140007cdc
lea rcx, [rsp + 0x38]
call fcn.140018178
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov eax, edx
inc edx
mov word [rcx + rax*2], r13w
mov word [rcx + rdx*2], di
mov dword [rsp + 0x40], edx
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
test rax, rax
je 0x140007e4a
add rsi, 2
mov eax, 0x30
cmp word [rsi], ax
jb 0x140007d21
cmp word [rsi], 0x39
jbe 0x140007caf
mov eax, 0x61
cmp word [rsi], ax
jb 0x140007d35
cmp word [rsi], 0x7a
jbe 0x140007caf
cmp word [rsi], 0x41
jb 0x140007d45
cmp word [rsi], 0x5a
jbe 0x140007caf
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x38]
call fcn.140018880
mov edx, dword [rsp + 0x40]
movzx esi, word [r15]
cmp dword [rsp + 0x44], edx
jne 0x140007d72
lea rcx, [rsp + 0x38]
call fcn.140018178
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov eax, edx
inc edx
mov word [rcx + rax*2], si
mov sil, byte [rsp + 0x30]
mov word [rcx + rdx*2], di
mov dword [rsp + 0x40], edx
jmp 0x140007d92
mov edx, dword [rsp + 0x40]
mov byte [rsp + 0x32], dil
test edx, edx
jne 0x140007dfa
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
test rax, rax
je 0x140007dca
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0x38]
call fcn.140018880
mov byte [rsp + 0x32], 1
cmp dword [rsp + 0x40], edi
jne 0x140007dfa
lea rdx, str.RunProgram
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
test rax, rax
je 0x140007dfa
lea rdx, str.RunProgram
lea rcx, [rsp + 0x38]
call fcn.140018880
test sil, sil
jne 0x140007e91
test r14b, r14b
jne 0x140007e91
mov eax, dword [0x14002b628]
and eax, 0xc0
cmp al, 0x80
jne 0x140007e91
mov rdx, qword [0x14002bb10]
mov rcx, qword [0x14002bb18]
call fcn.14000b558
test eax, eax
jne 0x140007e91
cmp byte [0x14002bb68], dil
mov rcx, qword [rsp + 0x38]
je 0x140007e87
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140007c2f
mov r8, qword [rsp + 0x38]
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000b850
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x140007e7d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 6
jmp 0x1400086bb
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140007c08
cmp dword [0x14002bb88], edi
jne 0x140007eca
lea rdx, str.7ZipSfx._03x
lea rcx, [rbp - 0x58]
call fcn.140006318
lea rcx, [0x14002bb80]
mov rdx, rax
call fcn.1400182fc
mov rcx, qword [rbp - 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov byte [0x14002baf0], dil
jmp 0x140007f0d
lea rdx, [0x14002bb80]
lea rcx, [rsp + 0x58]
call fcn.1400182c0
lea rcx, [rsp + 0x58]
call fcn.14000503c
cmp dword [rsp + 0x60], edi
je 0x140007efc
lea rdx, [rsp + 0x58]
lea rcx, [0x14002bb80]
call fcn.1400182fc
mov rcx, qword [rsp + 0x58]
mov byte [0x14002baf0], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov edx, dword [0x14002bb88]
mov rcx, qword [0x14002bb80]
dec edx
cmp word [rcx + rdx*2], 0x5c
je 0x140007f2a
cmp word [rcx + rdx*2], 0x2f
jne 0x140007f3b
mov dword [0x14002bb88], edx
mov word [rcx + rdx*2], di
mov rcx, qword [0x14002bb80]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test r14b, r14b
je 0x140007f4d
or dword [0x14002bb58], 3
cmp dword [0x14002bc48], edi
jne 0x140007f66
lea rdx, [0x14002bb80]
mov rcx, rbx
call fcn.140001e3c
jmp 0x140007f74
call fcn.14000b5f4
test eax, eax
jne 0x140007fb9
mov eax, 0x80004005
test eax, eax
je 0x140007fb9
cmp byte [0x14002baf0], dil
jne 0x140007f8d
mov rcx, qword [0x14002bb80]
call fcn.140003310
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x140007faf
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 8
jmp 0x1400086bb
call fcn.140006424
mov r13b, byte [rsp + 0x33]
test r13b, r13b
je 0x140007fd5
cmp byte [0x14002baf0], dil
jne 0x140008797
lea rcx, [rsp + 0x58]
mov dword [rbp - 0x68], edi
call fcn.140018288
test sil, sil
jne 0x140007ff6
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.1400052e0
mov byte [rsp + 0x34], dil
mov r13, r15
mov qword [rbp + 0x10], r15
lea rcx, [rbp - 0x78]
mov r15d, edi
mov byte [rsp + 0x30], dil
call fcn.140018288
lea rcx, [rbp - 0x48]
call fcn.140018288
mov r14d, edi
cmp dword [rsp + 0x40], edi
jne 0x1400080f0
cmp byte [0x14002baf0], dil
jne 0x1400086fa
lea r8, [0x140024d14]
lea rdx, [0x14002bb80]
lea rcx, [rbp + 0x90]
lea rsi, str.setup.exe
call fcn.14001879c
lea r8, str.setup.exe
lea rcx, [rbp + 0x80]
mov rdx, rax
call fcn.14001879c
lea rcx, [rbp - 0x78]
mov rdx, qword [rax]
call fcn.140018880
mov rcx, qword [rbp + 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp + 0x90]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400085c9
mov byte [rsp + 0x34], 1
lea rcx, [rbp - 0x48]
mov rdx, rsi
call fcn.140018880
lea rcx, [rbp - 0x48]
call fcn.140005080
mov rsi, qword [rbp - 0x48]
mov bx, 0x3a
lea rdx, str.waitall
mov rcx, rsi
call fcn.1400050ac
test rax, rax
je 0x1400081c3
cmp word [rax], bx
jne 0x1400081ae
add rax, 2
jmp 0x1400081b1
mov rdx, qword [rsp + 0x38]
lea r8, [rbp - 0x68]
lea rcx, [rsp + 0x48]
call fcn.140003ec4
mov rsi, rax
test rax, rax
jne 0x1400080a9
add r13, 2
lea eax, [rsi + 0x30]
mov qword [rbp + 0x10], r13
cmp word [r13], ax
jb 0x140008125
cmp word [r13], 0x39
jbe 0x140008151
mov eax, 0x61
cmp word [r13], ax
jb 0x140008139
cmp word [r13], 0x7a
jbe 0x140008151
cmp word [r13], 0x41
jb 0x1400086fa
cmp word [r13], 0x5a
ja 0x1400086fa
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x38]
call fcn.140018880
mov edx, dword [rsp + 0x40]
movzx esi, word [r13]
cmp dword [rsp + 0x44], edx
jne 0x14000817f
lea rcx, [rsp + 0x38]
call fcn.140018178
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov eax, edx
inc edx
mov word [rcx + rax*2], si
mov word [rcx + rdx*2], di
mov rcx, qword [rbp - 0x48]
mov dword [rsp + 0x40], edx
mov dword [rbp - 0x68], edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140008002
mov rax, rdi
test rax, rax
je 0x1400081c3
mov rsi, rax
mov byte [rsp + 0x30], 1
jmp 0x1400080c6
lea rdx, str.hidcon
mov rcx, rsi
call fcn.1400050ac
test rax, rax
je 0x1400081f6
cmp word [rax], bx
jne 0x1400081e2
add rax, 2
jmp 0x1400081e5
mov rax, rdi
test rax, rax
je 0x1400081f6
mov rsi, rax
or r14d, 1
jmp 0x1400080c6
lea rdx, str.nowait
mov rcx, rsi
call fcn.1400050ac
test rax, rax
je 0x14000822f
cmp word [rax], bx
jne 0x140008215
add rax, 2
jmp 0x140008218
mov rax, rdi
test rax, rax
je 0x14000822f
cmp byte [0x14002baf0], dil
mov rsi, rax
je 0x1400080c6
jmp 0x140008259
lea rdx, str.forcenowait
mov rcx, rsi
call fcn.1400050ac
test rax, rax
je 0x140008263
cmp word [rax], bx
jne 0x14000824e
add rax, 2
jmp 0x140008251
mov rax, rdi
test rax, rax
je 0x140008263
mov rsi, rax
bts r14d, 0x10
jmp 0x1400080c6
lea rdx, [0x1400262a0]
mov r8d, 2
mov rcx, rsi
call fcn.140005108
mov r13, rax
test rax, rax
je 0x1400082a1
cmp dword [0x14002b634], 0xffffffff
jne 0x140008299
lea rcx, [rsi + 4]
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x14002b634], eax
mov rsi, r13
jmp 0x1400080c6
mov r13d, 3
lea rdx, [0x1400261b0]
mov rcx, rsi
mov r8d, r13d
call fcn.140005108
test rax, rax
je 0x1400082d0
movzx ebx, word [rsi + 6]
mov rsi, rax
sub ebx, 0x30
mov dword [rbp - 0x28], ebx
jmp 0x1400080c2
lea rdx, [0x1400261a8]
mov r8d, r13d
mov rcx, rsi
call fcn.140005108
test rax, rax
je 0x1400082fc
movzx r12d, word [rsi + 6]
mov rsi, rax
sub r12d, 0x30
mov dword [rbp - 0x38], r12d
jmp 0x1400080c6
lea rdx, [0x140024cb0]
mov rcx, rsi
call fcn.1400050ac
test rax, rax
je 0x140008323
cmp word [rax], bx
jne 0x14000831b
add rax, 2
jmp 0x14000831e
mov rax, rdi
test rax, rax
jne 0x14000834a
lea rdx, str.i386
mov rcx, rsi
call fcn.1400050ac
test rax, rax
je 0x140008358
cmp word [rax], bx
jne 0x140008342
add rax, 2
jmp 0x140008345
mov rax, rdi
test rax, rax
je 0x140008358
mov rsi, rax
mov r15d, 1
jmp 0x1400080c6
lea rdx, str.amd64
mov rcx, rsi
call fcn.1400050ac
test rax, rax
je 0x14000837f
cmp word [rax], bx
jne 0x140008377
add rax, 2
jmp 0x14000837a
mov rax, rdi
test rax, rax
jne 0x1400083a6
lea rdx, [0x140024ca8]
mov rcx, rsi
call fcn.1400050ac
test rax, rax
je 0x1400083b4
cmp word [rax], bx
jne 0x14000839e
add rax, 2
jmp 0x1400083a1
mov rax, rdi
test rax, rax
je 0x1400083b4
mov rsi, rax
mov r15d, 2
jmp 0x1400080c6
mov r13b, byte [rsp + 0x32]
mov rbx, qword [rbp]
mov r12, qword [rbp - 0x60]
lea rcx, [rbp - 0x78]
test r13b, r13b
je 0x140008430
cmp word [rsi], 0x22
je 0x1400083fa
lea rdx, [0x140025fd0]
call fcn.140018880
lea rcx, [rbp - 0x78]
mov rdx, rsi
call fcn.140018910
lea rdx, [0x140025fd0]
lea rcx, [rbp - 0x78]
call fcn.140018910
jmp 0x140008402
mov rdx, rsi
call fcn.140018880
lea rdx, str.ExecuteParameters
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
mov rsi, rax
test rax, rax
je 0x140008446
lea rdx, [0x140026424]
lea rcx, [rbp - 0x78]
call fcn.140018910
jmp 0x14000843a
lea rdx, [rsp + 0x58]
call fcn.1400182fc
lea rcx, [rbp - 0x78]
mov rdx, rsi
call fcn.140018910
lea rcx, [rbp - 0x20]
call fcn.140018288
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x20]
call fcn.140005370
lea rcx, [rbp - 0x10]
mov rdx, rax
call fcn.140018824
lea rcx, [rbp - 0x20]
call fcn.140005080
cmp dword [0x14002bc4c], edi
jne 0x140008579
mov ecx, r15d
call fcn.140002eb8
test eax, eax
je 0x140008579
cmp word [r12], di
je 0x1400084b6
lea rcx, [rbp - 0x10]
mov rdx, r12
call fcn.140018910
cmp word [r12], di
je 0x1400084b6
add r12, 2
cmp word [r12], di
jne 0x1400084a7
mov qword [rbp - 0x60], r12
lea rcx, [rbp - 0x10]
call fcn.140005080
cmp byte [rsp + 0x30], dil
jne 0x140008561
mov rcx, qword [0x14002bb80]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r8, [rbp - 0x20]
lea rdx, [0x140025fd0]
lea rcx, [rbp + 0x40]
call fcn.1400187e0
lea r8, [0x14002605c]
lea rcx, [rbp + 0x70]
mov rdx, rax
call fcn.14001879c
lea r8, [rbp - 0x10]
lea rcx, [rbp + 0xa0]
mov rdx, rax
call fcn.140018770
lea rcx, [rbp - 0x58]
mov rdx, qword [rax]
call fcn.140018824
mov rcx, qword [rbp + 0xa0]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r8, qword [0x14002bb80]
mov rcx, qword [rbp - 0x58]
mov edx, r14d
call fcn.140005e6c
mov rcx, qword [rbp - 0x58]
test eax, eax
je 0x140008631
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140008579
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x20]
mov r8d, r14d
call fcn.140005f98
test eax, eax
jne 0x140008638
test r13b, r13b
jne 0x1400086e8
cmp byte [rsp + 0x34], dil
jne 0x1400086e8
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x60], edi
mov word [rax], di
mov rcx, qword [rbp - 0x10]
inc dword [rbp - 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x20]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r13, qword [rbp + 0x10]
jmp 0x140008002
cmp byte [0x14002baf0], dil
jne 0x1400085de
mov rcx, qword [0x14002bb80]
call fcn.140003310
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000b850
mov rcx, qword [rbp - 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x140006e09
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x140006e09
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140008640
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, qword [rbp - 0x78]
mov edx, InitCommonControls
lea ecx, [rdx - 0xf]
call fcn.14000b850
cmp byte [0x14002baf0], dil
jne 0x140008666
mov rcx, qword [0x14002bb80]
call fcn.140003310
mov rcx, qword [rbp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x20]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x1400086b6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 9
mov rcx, qword [rbp + 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x48]
call fcn.140006824
mov rcx, qword [rbp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, edi
jmp 0x1400088f6
mov rcx, qword [rbp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x20]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp - 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp dword [0x14002bc4c], edi
jne 0x140008783
call fcn.140006424
mov eax, dword [rbp - 0x28]
mov rsi, qword [rbp - 0x30]
lea r8, str.Shortcut
lea rdx, [rsp + 0x48]
lea rcx, [0x14000649c]
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.140005bb4
mov rcx, qword [0x14002bb90]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [rbp - 0x38]
lea r8, str.Delete
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x48]
lea rcx, [0x140005b80]
mov r9, rsi
call fcn.140005bb4
cmp byte [0x14002baf0], dil
jne 0x140008783
mov rcx, qword [0x14002bb80]
call fcn.140003310
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r14b, byte [rsp + 0x31]
mov r13b, byte [rsp + 0x33]
mov eax, dword [0x14002b634]
cmp eax, 0xffffffff
jne 0x1400087b6
test r14b, r14b
jne 0x140008840
mov eax, 1
mov dword [0x14002b634], eax
test eax, eax
jle 0x140008840
lea rdx, str.FinishMessage
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
mov rsi, rax
test rax, rax
je 0x140008840
mov ecx, dword [0x14002b634]
mov eax, 0x3e7
cmp ecx, eax
cmovg ecx, eax
mov dword [0x14002b634], ecx
lea rcx, [rbp + 0xb0]
call fcn.140009a0c
mov r8, qword [0x14002bb28]
lea r11, [0x140025ea0]
lea rcx, [rbp + 0xb0]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rbp + 0xb0], r11
mov dword [rbp + 0x100], 0x7d5
mov qword [rsp + 0x20], rdi
call fcn.140009d44
lea rcx, [rbp + 0xb0]
call fcn.140009a8c
test r13b, r13b
jne 0x140008889
cmp dword [0x14002bc4c], edi
jne 0x140008889
lea rdx, str.SelfDelete
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140003ec4
test rax, rax
je 0x140008889
mov ecx, 0x31
cmp word [rax], cx
jne 0x140008889
lea rdx, [0x14002bbe0]
lea rcx, [rbp + 0x40]
call fcn.1400182c0
lea rcx, [rbp + 0x40]
call fcn.1400065b4
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x1400088ab
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov rcx, qword [rbp + 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x48]
call fcn.140006824
mov rcx, qword [rbp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
jmp 0x1400088f6
lea r8, [0x140025e68]
lea rdx, str.Sorry__this_program_requires_Microsoft_Windows_2000_or_later.
mov r9d, InitCommonControls
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x14
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret