Function at 0x14000781c
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Get file attributes
Log keystrokes via polling
Parse credit card information
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x340
lea rcx, [0x140005b6c]
call qword [sym.imp.msvcrt.dll_int____cdecl___unsigned_long_long_unsigned___int64_____cdecl__set_new_handler_int____cdecl___unsigned_long_long_unsigned___int64___]
call fcn.1400020d8
lea rcx, [rsp + 0x220]
mov dword [rsp + 0x220], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edi, edi
cmp eax, edi
je 0x1400099bf
cmp dword [rsp + 0x230], 2
jne 0x1400099bf
cmp dword [rsp + 0x224], 5
jb 0x1400099bf
or dword [rsp + 0x128], 0xffffffff
or dword [rsp + 0x110], 0xffffffff
lea rax, [0x14001ecb4]
lea ebx, [rdi + 3]
lea rcx, [rsp + 0x118]
mov r13b, dil
mov edx, ebx
mov byte [str.___InstallEnd__], 0x3b
mov byte [str.___Install__UTF_8_], 0x3b
mov qword [rsp + 0x130], rax
mov byte [rsp + 0x30], dil
mov dword [rsp + 0x38], r13d
mov byte [rsp + 0x32], dil
mov r15b, dil
mov qword [rsp + 0x118], rdi
mov dword [rsp + 0x120], edi
mov dword [rsp + 0x124], edi
call fcn.140001140
lea rcx, [rsp + 0x140]
mov edx, ebx
mov qword [rsp + 0x140], rdi
mov dword [rsp + 0x148], edi
mov dword [rsp + 0x14c], edi
call fcn.140001140
lea rax, [0x14001e980]
lea ebx, [rdi + 1]
lea rcx, [rsp + 0x100]
mov edx, ebx
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0xb4], edi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], 8
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x100], rdi
mov dword [rsp + 0x108], edi
mov dword [rsp + 0x10c], edi
call fcn.140001140
mov rax, qword [rsp + 0x100]
lea ebp, [rdi + 0x20]
mov word [rax], bp
mov rax, qword [rsp + 0x100]
mov word [rax + 2], di
mov dword [rsp + 0x108], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x118]
mov rcx, rax
call fcn.1400063f0
lea rcx, [rsp + 0x100]
mov rdx, rax
call fcn.140002d54
lea rcx, [rsp + 0x100]
call fcn.140003764
mov r14, qword [rsp + 0x100]
lea rdx, str.sfxlang
add r14, 2
mov rcx, r14
call fcn.140005ae0
cmp rax, rdi
je 0x140007a33
cmp word [rax], 0x3a
jne 0x140007a33
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll__wtol]
movzx edx, word [0x140023bc4]
lea ecx, [rax - 1]
cmp ecx, 0xfffe
cmovbe dx, ax
mov word [0x140023bc4], dx
jmp 0x140007a19
add r14, 2
cmp word [r14], bp
ja 0x140007a15
jmp 0x140007a2a
cmp ax, bp
ja 0x140007a33
add r14, 2
movzx eax, word [r14]
cmp ax, di
jne 0x140007a21
call fcn.1400061a8
lea rdx, str.sfxversion
mov rcx, r14
call fcn.140005ae0
cmp rax, rdi
je 0x140007a56
call fcn.140006938
jmp 0x1400096dc
lea rdx, str.sfxwaitall
mov rcx, r14
call fcn.140005ae0
cmp rax, rdi
je 0x140007a79
mov rcx, rax
call fcn.140006fd8
mov edi, eax
jmp 0x1400096dc
lea rdx, str.sfxelevation
mov rcx, r14
mov r12b, dil
call fcn.140005ae0
cmp rax, rdi
je 0x140007aa9
mov r12b, bl
jmp 0x140007a9e
cmp cx, bp
ja 0x140007aa6
add rax, 2
movzx ecx, word [rax]
cmp cx, di
jne 0x140007a95
mov r14, rax
mov ebx, 0x208
lea rsi, [0x140023ca8]
cmp dword [0x140023cb4], ebx
jg 0x140007ac7
mov edx, ebx
mov rcx, rsi
call fcn.140001140
mov rdx, qword [0x140023ca8]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, edi
jne 0x140007af3
mov edx, 6
lea ebx, [rdx - 5]
mov ecx, ebx
call fcn.14000c800
mov edi, ebx
jmp 0x1400096dc
mov rdx, qword [0x140023ca8]
mov ecx, edi
cmp word [rdx], di
je 0x140007b10
mov rax, rdx
add rax, 2
add ecx, 1
cmp word [rax], di
jne 0x140007b04
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140023cb0], ecx
lea rdx, str.sfxtest
mov rcx, r14
call fcn.140005ae0
cmp rax, rdi
mov rbx, rax
je 0x140007d4b
cmp word [rax], 0x3a
je 0x140007b48
mov edi, 0x64
jmp 0x1400096dc
movzx edx, word [rax + 2]
mov ecx, edx
or ecx, ebp
sub ecx, 0x61
je 0x140007c77
sub ecx, 2
je 0x140007c5f
mov r14d, 1
sub ecx, r14d
je 0x140007bdd
sub ecx, 0xb
je 0x140007b81
cmp ecx, 7
jne 0x140007b3e
mov edi, 0x47ba
jmp 0x1400096dc
cmp word [rax + 4], 0x3a
jne 0x1400096dc
movzx ecx, word [rax + 6]
sub ecx, 0x31
je 0x140007bd5
sub ecx, r14d
je 0x140007bcb
sub ecx, r14d
je 0x140007bc1
sub ecx, r14d
je 0x140007bb7
cmp ecx, r14d
jne 0x1400096dc
mov edi, 7
jmp 0x1400096dc
mov edi, 0x7f
jmp 0x1400096dc
mov edi, 0x1f
jmp 0x1400096dc
mov edi, 0x37
jmp 0x1400096dc
mov edi, r14d
jmp 0x1400096dc
cmp edx, 0x44
jne 0x140007c21
cmp word [rax + 4], 0x3a
jne 0x140007b3e
add rbx, 6
jmp 0x140007c0c
cmp ax, 0x3a
je 0x140007c14
lea rcx, [0x140023d08]
movzx edx, ax
call fcn.1400014f8
add rbx, 2
movzx eax, word [rbx]
cmp ax, bp
ja 0x140007bf3
cmp dword [0x140023d10], edi
jne 0x140007c25
jmp 0x140007b3e
add rbx, 4
mov dword [0x140023d00], edi
cmp word [rbx], 0x3a
jne 0x140007c4c
lea rcx, [rbx + 2]
call qword [sym.imp.msvcrt.dll__wtol]
cmp eax, 0xe10
mov dword [0x140023d00], eax
ja 0x140007c4c
cmp eax, edi
jne 0x140007c56
mov dword [0x140023d00], 0xa
mov dword [0x140023d04], r14d
jmp 0x140007c87
movzx eax, word [rax + 4]
sub ax, 0x63
neg ax
sbb eax, eax
add eax, 4
mov dword [0x140023d04], eax
jmp 0x140007c87
mov dword [0x140023d04], 2
jmp 0x140007c87
add rbx, 2
cmp word [rbx], bp
ja 0x140007c83
jmp 0x140007c97
cmp ax, bp
ja 0x140007c9f
add rbx, 2
movzx eax, word [rbx]
cmp ax, di
jne 0x140007c8e
lea rdx, str.sfxconfig
mov rcx, rbx
mov r14, rbx
call fcn.140005ae0
cmp rax, rdi
mov rcx, rax
je 0x140007d4b
cmp word [rax], 0x3a
jne 0x140007cce
jmp 0x140007cca
cmp ax, bp
ja 0x140007cd6
add rcx, 2
movzx eax, word [rcx]
cmp ax, di
jne 0x140007cc5
mov rax, qword [rsp + 0x118]
lea rdx, [rsp + 0x118]
mov dword [rsp + 0x120], edi
mov word [rax], di
call fcn.1400063f0
cmp dword [0x140023d04], 2
mov r14, rax
je 0x140007d4b
mov rcx, qword [0x140023ca8]
mov ebx, dword [rsp + 0x120]
mov dword [0x140023cb0], edi
mov word [rcx], di
mov rcx, rsi
mov edx, ebx
call fcn.140001140
mov r11, qword [rsp + 0x118]
mov rcx, qword [0x140023ca8]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140007d31
mov dword [0x140023cb0], ebx
lea rcx, [0x140023c58]
cmp rsi, rcx
je 0x140007da0
mov rax, qword [0x140023c58]
mov dword [0x140023c60], edi
mov word [rax], di
mov edx, dword [0x140023cb0]
call fcn.140001140
mov r11, qword [0x140023ca8]
mov rcx, qword [0x140023c58]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140007d80
mov eax, dword [0x140023cb0]
mov dword [0x140023c60], eax
lea rsi, [0x140023c68]
lea rbx, [0x140023ca8]
cmp rbx, rsi
je 0x140007dff
mov rax, qword [0x140023c68]
mov dword [0x140023c70], edi
mov rcx, rsi
mov word [rax], di
mov edx, dword [0x140023cb0]
call fcn.140001140
mov r11, qword [0x140023ca8]
mov rcx, qword [0x140023c68]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140007ddf
mov eax, dword [0x140023cb0]
mov dword [0x140023c70], eax
mov rcx, rbx
call fcn.140003c74
cmp eax, edi
jl 0x140007f1f
mov rcx, qword [0x140023c58]
movsxd rbx, eax
mov word [rcx + rbx*2], di
mov dword [0x140023c60], eax
mov rax, qword [0x140023ca8]
lea rdx, [rax + rbx*2 + 2]
mov rcx, rsi
call fcn.140001384
mov r11, qword [0x140023ca8]
lea rsi, [0x140023c88]
lea rdx, [r11 + rbx*2 + 2]
mov rcx, rsi
call fcn.140001384
movsxd r11, dword [0x140023c90]
cmp r11d, edi
je 0x140007e96
mov rdx, qword [0x140023c88]
lea rcx, [rdx + r11*2 - 2]
jmp 0x140007e79
cmp rcx, rdx
je 0x140007f62
sub rcx, 2
cmp word [rcx], 0x2e
jne 0x140007e6c
sub rcx, rdx
sar rcx, 1
cmp ecx, edi
jle 0x140007e96
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140023c90], ecx
lea rbx, [0x140023c78]
cmp rsi, rbx
je 0x140007eee
mov rax, qword [0x140023c78]
mov dword [0x140023c80], edi
mov rcx, rbx
mov word [rax], di
mov edx, dword [0x140023c90]
call fcn.140001140
mov r11, qword [0x140023c88]
mov rcx, qword [0x140023c78]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140007ece
mov eax, dword [0x140023c90]
mov dword [0x140023c80], eax
mov ecx, 4
call fcn.140002760
mov rcx, rbx
mov rdx, rax
call fcn.140002d54
mov r11, qword [0x140023c88]
mov rax, qword [0x140023c78]
mov qword [0x140023c08], r11
mov qword [0x140023c18], rax
call fcn.1400029d8
lea rcx, [0x140023c98]
mov rdx, rax
call fcn.140001384
mov rcx, rbp
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
mov rbx, rax
je 0x140007f6a
mov dword [rax + 0x10], edi
lea rax, [0x14001ec50]
mov qword [rbx], rax
lea rax, [0x14001ec30]
mov qword [rbx + 8], rax
or qword [rbx + 0x18], 0xffffffffffffffff
jmp 0x140007f6d
or ecx, 0xffffffff
jmp 0x140007e85
mov rbx, rdi
cmp rbx, rdi
je 0x140007f7b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
mov rdx, qword [0x140023ca8]
mov rcx, rbx
call fcn.1400114b0
cmp al, dil
jne 0x140007fbb
mov r8, qword [0x140023ca8]
mov edx, 7
lea ecx, [rdx - 6]
call fcn.14000c800
cmp rbx, rdi
je 0x140007fb1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 2
jmp 0x1400096dc
mov esi, 3
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, esi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x6c], edi
call fcn.140002b30
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140005054
cmp al, dil
jne 0x140008014
lea edx, [rsi + 6]
xor ecx, ecx
call fcn.14000c800
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000800d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, esi
jmp 0x1400096dc
cmp dword [0x140023d04], edi
jne 0x1400080c1
lea rdx, str.sfxconfig
mov rcx, r14
call fcn.140005ae0
cmp rax, rdi
je 0x1400080c1
cmp word [rax], 0x3a
jne 0x140008042
add rax, 2
movzx ecx, word [rax]
cmp cx, di
je 0x1400080a0
cmp cx, bp
ja 0x14000805b
add rax, 2
mov cx, word [rax]
cmp cx, di
jne 0x14000804a
cmp word [rax], di
je 0x1400080a0
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140007438
cmp al, dil
jne 0x1400080a0
mov edx, 0xa
xor ecx, ecx
call fcn.14000c800
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008096
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 4
jmp 0x1400096dc
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400096dc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x1400096dc
lea rcx, [rsp + 0xa8]
call fcn.140011214
cmp dword [rsp + 0x68], edi
je 0x1400080ee
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x60]
xor r8d, r8d
call fcn.140004148
cmp al, dil
je 0x14000807e
cmp dword [0x140023d04], 4
je 0x1400080a0
cmp dword [0x140023060], edi
lea rsi, [0x140023060]
je 0x140008212
mov r8d, dword [rsi]
lea rdx, str.7zSfxString_d
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0xe0]
mov edx, 3
mov qword [rsp + 0xe0], rdi
mov dword [rsp + 0xe8], edi
mov dword [rsp + 0xec], edi
call fcn.140001140
lea rcx, [rsp + 0xf0]
mov edx, 3
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xfc], edi
call fcn.140001140
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0xe0]
call fcn.140001384
mov ecx, dword [rsi]
call fcn.140002760
lea rcx, [rsp + 0xf0]
mov rdx, rax
call fcn.140001384
mov rcx, rbp
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
je 0x1400081c0
lea rdx, [rsp + 0xe0]
mov rcx, rax
call fcn.140002fc8
mov rbp, rax
jmp 0x1400081c3
mov rbp, rdi
lea rcx, [0x1400236b0]
call fcn.140011224
movsxd r11, dword [0x1400236bc]
mov rax, qword [0x1400236c0]
mov rcx, qword [rsp + 0xf0]
mov qword [rax + r11*8], rbp
add dword [0x1400236bc], 1
mov ebp, 0x20
add rsi, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xe0]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp dword [rsi], edi
jne 0x14000810a
lea rcx, [rsp + 0xa8]
call fcn.140006480
sub r14, 2
jmp 0x140008229
add r14, 2
cmp word [r14], bp
ja 0x140008225
jmp 0x14000823a
cmp ax, bp
ja 0x140008243
add r14, 2
movzx eax, word [r14]
cmp ax, di
jne 0x140008231
cmp word [r14], 0x2f
je 0x140008255
cmp word [r14], 0x2d
jne 0x1400084ed
cmp word [r14 + 2], 0x21
je 0x1400084e9
lea rdx, [0x14001ef28]
lea rcx, [r14 + 2]
call fcn.1400058a8
cmp rax, rdi
je 0x1400082d0
lea rax, [r14 + 6]
cmp word [rax], 0x30
jb 0x140008286
cmp word [rax], 0x39
jbe 0x14000829e
cmp word [rax], 0x61
jb 0x140008292
cmp word [rax], 0x7a
jbe 0x14000829e
cmp word [rax], 0x41
jb 0x1400082be
cmp word [rax], 0x5a
ja 0x1400082be
mov ecx, 1
mov qword [rsp + 0x130], rax
mov r13b, cl
mov al, cl
mov byte [rsp + 0x30], cl
mov dword [rsp + 0x38], r13d
jmp 0x140008229
cmp word [rax], bp
ja 0x1400084ed
lea rax, [0x14001ecb4]
jmp 0x14000829e
lea rdx, [0x14001ef20]
lea rcx, [r14 + 2]
call fcn.1400058a8
cmp rax, rdi
je 0x1400082f5
lea rdx, [r14 + 6]
lea rcx, str.OverwriteMode
jmp 0x14000844b
lea rdx, [0x14001ef18]
lea rcx, [r14 + 2]
call fcn.1400058a8
cmp rax, rdi
je 0x140008339
lea rdx, [r14 + 6]
cmp word [rdx], 0x30
jb 0x1400084ed
cmp word [rdx], 0x32
ja 0x1400084ed
cmp word [r14 + 8], bp
ja 0x1400084ed
lea rcx, str.GUIMode
jmp 0x14000844b
lea rdx, [0x14001ef10]
lea rcx, [r14 + 2]
call fcn.1400058a8
cmp rax, rdi
je 0x14000835e
lea rdx, [r14 + 6]
lea rcx, str.GUIFlags
jmp 0x14000844b
lea rdx, [0x14001ef08]
lea rcx, [r14 + 2]
call fcn.1400058a8
cmp rax, rdi
je 0x140008383
lea rdx, [r14 + 6]
lea rcx, str.MiscFlags
jmp 0x14000844b
lea rdx, [0x14001ef00]
lea rcx, [r14 + 2]
call fcn.1400058a8
cmp rax, rdi
je 0x1400083c3
lea rdx, [r14 + 6]
cmp word [rdx], 0x30
je 0x1400083ac
cmp word [rdx], 0x31
jne 0x1400084ed
cmp word [r14 + 8], bp
ja 0x1400084ed
lea rcx, str.SelfDelete
jmp 0x14000844b
lea rdx, [0x14001eef8]
lea rcx, [r14 + 2]
call fcn.1400058a8
cmp rax, rdi
je 0x1400083ed
cmp word [r14 + 6], bp
ja 0x1400084ed
mov byte [rsp + 0x32], 1
jmp 0x140008229
lea rdx, [0x14001eef0]
lea rcx, [r14 + 2]
call fcn.1400058a8
cmp rax, rdi
je 0x14000842b
lea rcx, [r14 + 6]
cmp word [rcx], 0x30
jb 0x1400084ed
cmp word [rcx], 0x39
ja 0x1400084ed
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140023654], eax
jmp 0x140008229
lea rdx, [0x14001eee8]
lea rcx, [r14 + 2]
call fcn.1400058a8
cmp rax, rdi
je 0x14000845d
lea rdx, [r14 + 8]
lea rcx, str.BeginPromptTimeout
lea r8, [rsp + 0xa8]
call fcn.140006770
jmp 0x140008229
cmp word [r14 + 2], 0x79
je 0x14000846d
cmp word [r14 + 2], 0x59
jne 0x14000847f
cmp word [r14 + 4], bp
ja 0x14000847f
mov al, 1
mov byte [rsp + 0x30], al
jmp 0x140008229
cmp word [r14 + 2], 0x3f
je 0x140008497
cmp word [r14 + 2], 0x68
je 0x140008497
cmp word [r14 + 2], 0x48
jne 0x1400084a6
cmp word [r14 + 4], bp
ja 0x1400084a6
mov r15b, 1
jmp 0x140008229
lea rdx, [rsp + 0xa8]
lea rcx, [r14 + 2]
call fcn.140005d94
cmp rax, rdi
je 0x1400084ed
cmp rax, 1
je 0x1400084ca
mov r14, rax
jmp 0x140008229
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400084e2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, ebp
jmp 0x1400096dc
add r14, 4
lea rcx, [rsp + 0xa8]
call fcn.140006480
cmp r12b, dil
jne 0x14000870f
test byte [0x140023c24], 4
je 0x14000870f
call fcn.140002a10
cmp eax, edi
jne 0x14000870f
mov esi, 3
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov edx, esi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x4c], edi
call fcn.140001140
lea rcx, [rsp + 0x90]
mov edx, esi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x98], edi
mov dword [rsp + 0x9c], edi
call fcn.140001140
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400063f0
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140002ce8
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x130]
mov dx, 0x22
call fcn.14000606c
lea r8, [0x14001ed48]
lea rcx, [rsp + 0x150]
mov rdx, rax
call fcn.1400060d0
lea r8, str.sfxelevation
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.1400060d0
lea rcx, [rsp + 0x70]
movzx r8d, bp
mov rdx, rax
call fcn.14000613c
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xc8]
mov rdx, rax
call fcn.140001584
mov rsi, rax
lea rax, [rsp + 0x90]
cmp rsi, rax
je 0x140008643
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x98], edi
mov word [rcx], di
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x90]
call fcn.140001140
mov r11, qword [rsi]
mov rsi, qword [rsp + 0x90]
mov rcx, rsi
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x14000862d
jmp 0x14000864b
mov rsi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x150]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x130]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 2]
call fcn.140006aa4
mov rcx, qword [rsp + 0x80]
cmp eax, edi
jne 0x1400086f3
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400086e9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 0xb
jmp 0x1400096dc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400080a0
lea r8, [rsp + 0xa0]
lea rdx, str.SetEnvironment
lea rcx, [rsp + 0xa8]
mov dword [rsp + 0xa0], edi
call fcn.140003a18
cmp rax, rdi
mov r12, rax
je 0x1400088fa
lea rcx, [rsp + 0x80]
mov rdx, r12
call fcn.140002ce8
mov rbp, qword [rsp + 0x80]
movzx ecx, word [rbp]
mov rsi, rbp
jmp 0x14000876f
cmp cx, di
je 0x140008861
add rsi, 2
mov cx, word [rsi]
cmp cx, 0x3d
jne 0x14000875f
sub rsi, rbp
sar rsi, 1
cmp esi, edi
jle 0x1400088ed
movsxd r13, esi
lea rcx, [rsp + 0xe0]
mov edx, 3
mov dword [rsp + 0x88], esi
mov qword [rsp + 0xe0], rdi
mov dword [rsp + 0xe8], edi
mov word [rbp + r13*2], di
mov dword [rsp + 0xec], edi
call fcn.140001140
lea rcx, [rsp + 0xf0]
mov edx, 3
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xfc], edi
call fcn.140001140
mov rax, qword [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
mov edx, esi
mov word [rax], di
mov dword [rsp + 0xe8], edi
call fcn.140001140
mov rcx, qword [rsp + 0xe0]
mov r11, rbp
sub rcx, rbp
movzx eax, word [r11]
mov word [r11 + rcx], ax
add r11, 2
cmp ax, di
jne 0x140008812
lea rdx, [r12 + r13*2 + 2]
lea rcx, [rsp + 0xf0]
mov dword [rsp + 0xe8], esi
call fcn.140001384
mov ecx, 0x20
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
je 0x140008869
lea rdx, [rsp + 0xe0]
mov rcx, rax
call fcn.140002fc8
mov rsi, rax
jmp 0x14000886c
or esi, 0xffffffff
jmp 0x14000877b
mov rsi, rdi
lea rcx, [0x1400236b0]
call fcn.140011224
movsxd r11, dword [0x1400236bc]
mov rax, qword [0x1400236c0]
mov rcx, qword [rsp + 0xf0]
mov qword [rax + r11*8], rsi
mov esi, 1
add dword [0x1400236bc], esi
add dword [rsp + 0xa0], esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xe0]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r8, [rsp + 0xa0]
lea rdx, str.SetEnvironment
lea rcx, [rsp + 0xa8]
call fcn.140003a18
cmp rax, rdi
mov r12, rax
jne 0x14000873e
mov r13d, dword [rsp + 0x38]
jmp 0x1400088ff
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r13d, dword [rsp + 0x38]
mov esi, 1
call fcn.140007314
mov r11d, dword [0x140023648]
cmp r11d, 0xffffffff
cmove r11d, edi
cmp r15b, dil
mov dword [0x140023648], r11d
je 0x1400089a9
lea rdx, str.HelpText
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a18
cmp rax, rdi
mov rsi, rax
jne 0x14000894f
mov ecx, 0x18
call fcn.140002760
mov rsi, rax
lea rcx, [rsp + 0x1a0]
call fcn.14000aec8
mov r8, qword [0x140023c08]
lea r11, [0x14001e890]
lea rcx, [rsp + 0x1a0]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x1a0], r11
mov dword [rsp + 0x1f0], 0x7d6
mov qword [rsp + 0x20], rdi
call fcn.14000af5c
lea rcx, [rsp + 0x1a0]
call fcn.14000ab58
jmp 0x1400080a0
mov bpl, byte [rsp + 0x30]
cmp bpl, dil
je 0x1400089bf
btr r11d, 8
mov dword [0x140023648], r11d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, str.InstallPath
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a18
lea r15, [0x140023c48]
cmp rax, rdi
je 0x1400089f5
mov rdx, rax
mov rcx, r15
call fcn.140001384
mov rcx, r15
call fcn.140007280
lea rdx, str.BeginPromptTimeout
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a18
cmp rax, rdi
je 0x140008a28
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140023c30], eax
cmp dword [0x140023d10], edi
je 0x140008a60
lea rcx, [rsp + 0xa8]
call fcn.14000ca30
mov rcx, qword [rsp + 0x60]
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000800d
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + InitCommonControls]
jmp 0x14000800d
cmp dword [0x140023d04], 3
jne 0x140008a78
lea rcx, [rsp + 0xa8]
call fcn.14000c944
jmp 0x140008a3d
lea rdx, str.BeginPrompt
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a18
cmp rax, rdi
je 0x140008ad8
cmp bpl, dil
jne 0x140008ad8
mov rcx, qword [0x140023c08]
mov rdx, rax
call fcn.14000b9e0
cmp eax, edi
je 0x140008c63
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r13d, r13b
bt ax, 0xf
cmovb r13d, esi
cmp dword [0x140023ce0], edi
je 0x140008ad8
btr dword [0x140023648], 7
lea rcx, [rsp + 0x70]
mov edx, 3
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x7c], edi
call fcn.140001140
cmp r13b, dil
mov r12, qword [rsp + 0x130]
je 0x140008b9b
mov rbp, r12
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x70]
call fcn.140001384
movzx edx, word [rbp]
lea rcx, [rsp + 0x70]
call fcn.1400014f8
mov rsi, qword [rsp + 0x70]
lea rcx, [rsp + 0xa8]
mov rdx, rsi
xor r8d, r8d
call fcn.140003a18
cmp rax, rdi
je 0x140008c85
add rbp, 2
cmp word [rbp], 0x30
jb 0x140008b5a
cmp word [rbp], 0x39
jbe 0x140008b08
cmp word [rbp], 0x61
jb 0x140008b68
cmp word [rbp], 0x7a
jbe 0x140008b08
cmp word [rbp], 0x41
jb 0x140008b76
cmp word [rbp], 0x5a
jbe 0x140008b08
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x70]
call fcn.140001384
movzx edx, word [r12]
lea rcx, [rsp + 0x70]
call fcn.1400014f8
mov bpl, byte [rsp + 0x30]
cmp dword [rsp + 0x78], edi
mov byte [rsp + 0x31], dil
jne 0x140008c0b
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a18
cmp rax, rdi
je 0x140008bde
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0x70]
call fcn.140001384
cmp dword [rsp + 0x78], edi
mov byte [rsp + 0x31], 1
jne 0x140008c0b
lea rdx, str.RunProgram
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a18
cmp rax, rdi
je 0x140008c0b
lea rdx, str.RunProgram
lea rcx, [rsp + 0x70]
call fcn.140001384
cmp r13b, dil
jne 0x140008cc5
cmp bpl, dil
jne 0x140008cc5
mov eax, dword [0x140023648]
and ax, 0xc0
cmp al, 0x80
jne 0x140008cc5
mov rdx, qword [0x140023bf0]
mov rcx, qword [0x140023bf8]
call fcn.14000bac4
cmp eax, edi
jne 0x140008cc5
cmp byte [0x140023c34], dil
mov rcx, qword [rsp + 0x70]
je 0x140008cbe
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov esi, 1
jmp 0x140008a78
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008c7b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 5
jmp 0x1400096dc
mov r8, rsi
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000c800
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008cb4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 6
jmp 0x1400096dc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140008c63
mov edx, dword [0x140023c50]
cmp edx, edi
jne 0x140008d46
lea rdx, str.7ZipSfx._03x
lea rcx, [rsp + 0x80]
call fcn.140005c58
cmp rax, r15
mov rsi, rax
je 0x140008d2d
mov rcx, qword [0x140023c48]
mov dword [0x140023c50], edi
mov word [rcx], di
mov edx, dword [rax + 8]
mov rcx, r15
call fcn.140001140
mov r11, qword [rsi]
mov rcx, qword [0x140023c48]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008d10
mov eax, dword [rsi + 8]
mov dword [0x140023c50], eax
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov byte [0x140023bd0], dil
jmp 0x140008df2
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x4c], edi
call fcn.140001140
mov r11, qword [0x140023c48]
mov rcx, qword [rsp + 0x40]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008d69
mov eax, dword [0x140023c50]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], eax
call fcn.140007280
cmp dword [rsp + 0x48], edi
jne 0x140008ddd
mov rax, qword [0x140023c48]
mov dword [0x140023c50], edi
mov rcx, r15
mov word [rax], di
mov edx, dword [rsp + 0x48]
call fcn.140001140
mov r11, qword [rsp + 0x40]
mov rcx, qword [0x140023c48]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008dbf
mov eax, dword [rsp + 0x48]
mov dword [0x140023c50], eax
mov rcx, qword [rsp + 0x40]
mov eax, 1
mov byte [0x140023bd0], al
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
movsxd rcx, dword [0x140023c50]
mov rdx, qword [0x140023c48]
cmp word [rdx + rcx*2 - 2], 0x5c
je 0x140008e10
cmp word [rdx + rcx*2 - 2], 0x2f
jne 0x140008e20
add ecx, 0xffffffff
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140023c50], ecx
cmp bpl, dil
je 0x140008e2c
or dword [0x140023c24], 3
cmp dword [0x140023d00], edi
jne 0x140008e41
mov rdx, r15
mov rcx, rbx
call fcn.1400018a4
jmp 0x140008e4f
call fcn.14000bb5c
cmp eax, edi
jne 0x140008e94
mov eax, 0x80004005
cmp eax, edi
je 0x140008e94
cmp byte [0x140023bd0], dil
jne 0x140008e68
mov rcx, qword [0x140023c48]
call fcn.140003b78
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008e8a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 8
jmp 0x1400096dc
call fcn.140007314
cmp byte [rsp + 0x32], dil
je 0x140008eb3
cmp byte [0x140023bd0], dil
je 0x140008eb3
mov r15, qword [rsp + 0x70]
jmp 0x1400097fe
lea rcx, [rsp + 0x40]
mov edx, 3
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x4c], edi
call fcn.140001140
cmp r13b, dil
jne 0x140008eea
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xa8]
call fcn.1400073d0
mov byte [rsp + 0x33], dil
mov rsi, r12
mov qword [rsp + 0x150], r12
mov r15, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov edx, 3
mov dword [rsp + 0xd8], edi
mov byte [rsp + 0x34], dil
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x5c], edi
call fcn.140001140
lea rcx, [rsp + 0xc8]
mov edx, 3
mov qword [rsp + 0xc8], rdi
mov dword [rsp + 0xd0], edi
mov dword [rsp + 0xd4], edi
call fcn.140001140
cmp dword [rsp + 0x78], edi
mov r13d, edi
jne 0x140009081
cmp byte [0x140023bd0], dil
jne 0x140009633
lea r8, [0x14001dbc4]
lea rdx, [0x140023c48]
lea rcx, [rsp + 0x170]
lea rbp, str.setup.exe
call fcn.1400060d0
lea r8, str.setup.exe
lea rcx, [rsp + 0x160]
mov rdx, rax
call fcn.1400060d0
mov rsi, rax
lea rax, [rsp + 0x50]
cmp rsi, rax
je 0x140008ff0
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x58], edi
mov word [rcx], di
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x50]
call fcn.140001140
mov r12, qword [rsp + 0x50]
mov r11, qword [rsi]
mov rcx, r12
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008fd3
mov eax, dword [rsi + 8]
mov dword [rsp + 0x58], eax
jmp 0x140008ff5
mov r12, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x160]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x170]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400095ca
mov byte [rsp + 0x33], 1
lea rcx, [rsp + 0xc8]
mov rdx, rbp
call fcn.140001384
lea rcx, [rsp + 0xc8]
call fcn.1400072e8
mov rsi, qword [rsp + 0xc8]
mov r12d, 1
mov r15w, 0x3a
lea rdx, str.waitall
mov rcx, rsi
call fcn.1400058a8
cmp rax, rdi
je 0x140009129
cmp word [rax], r15w
jne 0x140009114
add rax, 2
jmp 0x140009117
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0xa8]
mov rdx, r15
call fcn.140003a18
cmp rax, rdi
mov rbp, rax
jne 0x140009026
add rsi, 2
mov qword [rsp + 0x150], rsi
cmp word [rsi], 0x30
jb 0x1400090b6
cmp word [rsi], 0x39
jbe 0x1400090d6
cmp word [rsi], 0x61
jb 0x1400090c2
cmp word [rsi], 0x7a
jbe 0x1400090d6
cmp word [rsi], 0x41
jb 0x140009633
cmp word [rsi], 0x5a
ja 0x140009633
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x70]
call fcn.140001384
movzx edx, word [rsi]
lea rcx, [rsp + 0x70]
call fcn.1400014f8
mov rcx, qword [rsp + 0xc8]
mov dword [rsp + 0x38], edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140008efa
mov rax, rdi
cmp rax, rdi
je 0x140009129
mov rsi, rax
mov byte [rsp + 0x34], r12b
jmp 0x140009056
lea rdx, str.hidcon
mov rcx, rsi
call fcn.1400058a8
cmp rax, rdi
je 0x14000915c
cmp word [rax], r15w
jne 0x140009149
add rax, 2
jmp 0x14000914c
mov rax, rdi
cmp rax, rdi
je 0x14000915c
mov rsi, rax
or r13d, r12d
jmp 0x140009056
lea rdx, str.nowait
mov rcx, rsi
call fcn.1400058a8
cmp rax, rdi
je 0x140009196
cmp word [rax], r15w
jne 0x14000917c
add rax, 2
jmp 0x14000917f
mov rax, rdi
cmp rax, rdi
je 0x140009196
cmp byte [0x140023bd0], dil
mov rsi, rax
je 0x140009056
jmp 0x1400091c1
lea rdx, str.forcenowait
mov rcx, rsi
call fcn.1400058a8
cmp rax, rdi
je 0x1400091cb
cmp word [rax], r15w
jne 0x1400091b6
add rax, 2
jmp 0x1400091b9
mov rax, rdi
cmp rax, rdi
je 0x1400091cb
mov rsi, rax
bts r13d, 0x10
jmp 0x140009056
lea rdx, [0x14001eef0]
mov r8d, 2
mov rcx, rsi
call fcn.140005904
cmp rax, rdi
mov rbp, rax
je 0x140009209
cmp dword [0x140023654], 0xffffffff
jne 0x140009201
lea rcx, [rsi + 4]
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140023654], eax
mov rsi, rbp
jmp 0x140009056
lea rdx, [0x14001ee60]
mov r8d, 3
mov rcx, rsi
call fcn.140005904
cmp rax, rdi
je 0x14000923c
movzx r15d, word [rsi + 6]
mov rsi, rax
sub r15d, 0x30
mov dword [rsp + 0x128], r15d
jmp 0x140009051
lea rdx, [0x14001ee58]
mov r8d, 3
mov rcx, rsi
call fcn.140005904
cmp rax, rdi
je 0x140009275
movzx r12d, word [rsi + 6]
mov rsi, rax
sub r12d, 0x30
mov dword [rsp + 0x110], r12d
mov r12d, 1
jmp 0x140009056
lea rdx, [0x14001da48]
mov rcx, rsi
call fcn.1400058a8
cmp rax, rdi
je 0x14000929d
cmp word [rax], r15w
jne 0x140009295
add rax, 2
jmp 0x140009298
mov rax, rdi
cmp rax, rdi
jne 0x1400092c5
lea rdx, str.i386
mov rcx, rsi
call fcn.1400058a8
cmp rax, rdi
je 0x1400092d5
cmp word [rax], r15w
jne 0x1400092bd
add rax, 2
jmp 0x1400092c0
mov rax, rdi
cmp rax, rdi
je 0x1400092d5
mov rsi, rax
mov dword [rsp + 0xd8], r12d
jmp 0x140009056
lea rdx, str.amd64
mov rcx, rsi
call fcn.1400058a8
cmp rax, rdi
je 0x1400092fd
cmp word [rax], r15w
jne 0x1400092f5
add rax, 2
jmp 0x1400092f8
mov rax, rdi
cmp rax, rdi
jne 0x140009325
lea rdx, [0x14001da40]
mov rcx, rsi
call fcn.1400058a8
cmp rax, rdi
je 0x140009338
cmp word [rax], r15w
jne 0x14000931d
add rax, 2
jmp 0x140009320
mov rax, rdi
cmp rax, rdi
je 0x140009338
mov rsi, rax
mov dword [rsp + 0xd8], 2
jmp 0x140009056
cmp byte [rsp + 0x31], dil
mov r12, qword [rsp + 0x50]
mov r15, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
je 0x1400093ba
cmp word [rsi], 0x22
je 0x140009380
lea rdx, [0x14001eca8]
call fcn.140001384
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.140002d54
lea rdx, [0x14001eca8]
lea rcx, [rsp + 0x50]
call fcn.140002d54
jmp 0x140009388
mov rdx, rsi
call fcn.140001384
lea rdx, str.ExecuteParameters
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a18
cmp rax, rdi
mov rsi, rax
je 0x1400093ff
lea rdx, [0x14001ee30]
lea rcx, [rsp + 0x50]
call fcn.140002d54
jmp 0x1400093f2
mov word [r12], di
mov edx, dword [rsp + 0x48]
mov dword [rsp + 0x58], edi
call fcn.140001140
mov r11, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x1400093d6
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.140002d54
lea rcx, [rsp + 0x90]
mov edx, 3
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x98], edi
mov dword [rsp + 0x9c], edi
call fcn.140001140
mov rsi, qword [rsp + 0x50]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.1400063f0
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140002ce8
lea rcx, [rsp + 0x90]
call fcn.1400072e8
cmp dword [0x140023d04], edi
jne 0x140009563
mov ecx, dword [rsp + 0xd8]
call fcn.1400029fc
cmp eax, edi
je 0x140009563
cmp word [r14], di
je 0x14000949b
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140002d54
jmp 0x140009495
add r14, 2
cmp word [r14], di
jne 0x140009491
lea rcx, [rsp + 0x80]
call fcn.1400072e8
mov al, byte [rsp + 0x34]
cmp al, dil
jne 0x140009543
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x180]
mov dx, 0x22
call fcn.14000606c
lea r8, [0x14001ed24]
lea rcx, [rsp + 0x190]
mov rdx, rax
call fcn.1400060d0
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xe0]
mov rdx, rax
call fcn.140001584
mov rcx, qword [rsp + 0x190]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x180]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rbp, qword [rsp + 0xe0]
mov r8, qword [0x140023c48]
mov rcx, rbp
mov edx, r13d
call fcn.140006aa4
mov rcx, rbp
cmp eax, edi
je 0x14000964a
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140009563
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x90]
mov r8d, r13d
call fcn.140006c00
cmp eax, edi
jne 0x140009651
cmp byte [rsp + 0x31], dil
jne 0x140009733
cmp byte [rsp + 0x33], dil
jne 0x140009733
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x48], edi
mov word [rax], di
mov rcx, qword [rsp + 0x80]
mov eax, 1
add dword [rsp + 0x38], eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rsi, qword [rsp + 0x150]
jmp 0x140008eff
cmp byte [0x140023bd0], dil
jne 0x1400095df
mov rcx, qword [0x140023c48]
call fcn.140003b78
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000c800
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140007bad
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x140007bad
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x50]
jmp 0x14000975d
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140009659
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, InitCommonControls
mov r8, rsi
lea ecx, [rdx - 0xf]
call fcn.14000c800
cmp byte [0x140023bd0], dil
jne 0x14000967e
mov rcx, qword [0x140023c48]
call fcn.140003b78
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400096d7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 9
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x14001e980]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.140011214
lea rcx, [rsp + 0xa8]
call fcn.1400112cc
mov rcx, qword [rsp + 0x140]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x118]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, edi
jmp 0x1400099e0
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp dword [0x140023d04], edi
jne 0x1400097ef
call fcn.140007314
mov eax, dword [rsp + 0x128]
mov r12, qword [rsp + 0x130]
lea r8, str.Shortcut
lea rdx, [rsp + 0xa8]
lea rcx, [0x1400076e0]
mov r9, r12
mov dword [rsp + 0x20], eax
call fcn.1400067ec
mov rcx, qword [0x140023c58]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [rsp + 0x110]
lea r8, str.Delete
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0xa8]
lea rcx, [0x1400077e8]
mov r9, r12
call fcn.1400067ec
cmp byte [0x140023bd0], dil
jne 0x1400097ef
mov rcx, qword [0x140023c48]
call fcn.140003b78
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov bpl, byte [rsp + 0x30]
mov eax, dword [0x140023654]
cmp eax, 0xffffffff
jne 0x14000981a
cmp bpl, dil
jne 0x1400098ac
mov eax, edi
mov dword [0x140023654], eax
cmp eax, edi
jl 0x1400098ac
lea rdx, str.FinishMessage
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a18
cmp rax, rdi
mov rsi, rax
je 0x1400098ac
mov ecx, dword [0x140023654]
mov eax, 0x3e7
cmp ecx, eax
cmovg ecx, eax
mov dword [0x140023654], ecx
lea rcx, [rsp + 0x1a0]
call fcn.14000aec8
mov r8, qword [0x140023c08]
lea r11, [0x14001e920]
lea rcx, [rsp + 0x1a0]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x1a0], r11
mov dword [rsp + 0x1f0], 0x7d5
mov qword [rsp + 0x20], rdi
call fcn.14000af5c
lea rcx, [rsp + 0x1a0]
call fcn.14000ab58
cmp byte [rsp + 0x32], dil
jne 0x14000994b
cmp dword [0x140023d04], edi
jne 0x14000994b
lea rdx, str.SelfDelete
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a18
cmp rax, rdi
je 0x14000994b
cmp word [rax], 0x31
jne 0x14000994b
mov edx, dword [0x140023cb0]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0x88], edi
mov dword [rsp + 0x8c], edi
call fcn.140001140
mov r11, qword [0x140023ca8]
mov rcx, qword [rsp + 0x80]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x14000991d
mov eax, dword [0x140023cb0]
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x88], eax
call fcn.140007040
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000996b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x14001e980]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.140011214
lea rcx, [rsp + 0xa8]
call fcn.1400112cc
mov rcx, qword [rsp + 0x140]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x118]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
jmp 0x1400099e0
lea r8, str.7_Zip_SFX
lea rdx, str.Sorry__this_program_requires_Microsoft_Windows_2000_or_later.
mov r9d, InitCommonControls
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x14
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret