Function at 0x14000f0a0
Capabilities:
Accept command line arguments
Check if file exists
Create thread
Delete directory
Delete file
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6c0]
sub rsp, 0x7c0
mov rax, qword [0x14036a3c8]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
mov r13, r8
mov qword [rbp - 0x78], r8
mov qword [rbp - 0x18], rcx
xor edi, edi
mov dword [rbp - 0x70], edi
mov dword [rsp + 0x54], edi
lea rdx, [rsp + 0x54]
mov rcx, r8
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x53], dil
mov byte [rsp + 0x52], dil
lea r12, [rdi - 1]
test rax, rax
je 0x14000f478
mov r14d, edi
cmp dword [rsp + 0x54], edi
jle 0x14000f478
mov r13d, dword [0x140373148]
mov r15, rax
mov esi, 4
lea r11, str.__enable_extend_screen
lea r10, str.__enable_upgrade_improve
lea r9, str.__enable_improve_user_agent
lea r8, str.__enable_xcdn
mov rdx, qword gs:[0x58]
mov rbx, qword [r15]
test rbx, rbx
je 0x14000f45d
mov rcx, rdi
nop word [rax + rax]
movzx eax, word [rbx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x14000f19c
movzx eax, word [rbx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x14000f19c
add rcx, 2
cmp rcx, 0xe
jne 0x14000f170
mov byte [rsp + 0x51], 1
jmp 0x14000f45d
mov rcx, rdi
nop
movzx eax, word [rbx + rcx*2]
cmp ax, word [r9 + rcx*2]
jne 0x14000f1cc
movzx eax, word [rbx + rcx*2 + 2]
cmp ax, word [r9 + rcx*2 + 2]
jne 0x14000f1cc
add rcx, 2
cmp rcx, 0x1c
jne 0x14000f1a0
mov byte [rsp + 0x53], 1
jmp 0x14000f45d
mov rcx, r12
nop
movzx eax, word [rbx + rcx*2 + 2]
cmp ax, word [r10 + rcx*2 + 2]
jne 0x14000f1f6
add rcx, 2
cmp rcx, 0x19
je 0x14000f335
movzx eax, word [rbx + rcx*2]
cmp ax, word [r10 + rcx*2]
je 0x14000f1d0
mov rcx, r12
nop dword [rax]
movzx eax, word [rbx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x14000f226
add rcx, 2
cmp rcx, 0x17
je 0x14000f33f
movzx eax, word [rbx + rcx*2]
cmp ax, word [r11 + rcx*2]
je 0x14000f200
mov edi, esi
mov rsi, qword [rdx + r13*8]
mov eax, dword [rdi + rsi]
cmp dword [0x14036e8c8], eax
jg 0x140011e5e
mov eax, dword [rdi + rsi]
cmp dword [0x14036e8cc], eax
jg 0x140011ead
mov rdi, r12
nop dword [rax]
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x14000f250
lea r9, [0x1403642a0]
cmp qword [reloc.WS2_32.dll_getsockopt], 8
cmovae r9, qword [0x1403642a0]
mov rsi, qword [0x1403642b0]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.14000bc50
test rax, rax
jne 0x14000f385
lea rdx, [rbx + rsi*2]
xor edi, edi
mov qword [rbp + 0x3d8], rdi
mov qword [rbp + 0x3e8], rdi
mov qword [rbp + 0x3f0], 7
mov r8, r12
inc r8
cmp word [rdx + r8*2], di
jne 0x14000f2b6
lea rcx, [rbp + 0x3d8]
call fcn.14000a410
lea rdx, [rbp + 0x3d8]
lea rcx, [rbp + 0x258]
call fcn.1400366a0
mov rcx, rax
call fcn.1400354a0
mov rdx, qword [rbp + 0x3f0]
cmp rdx, 8
jb 0x14000f458
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f453
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e47
jmp 0x14000f453
mov byte [rsp + 0x52], 1
jmp 0x14000f45d
mov rax, qword [0x14036e8e0]
test rax, rax
jne 0x14000f37c
mov ecx, 0xb0
call fcn.1402407f4
test rax, rax
je 0x14000f372
mov rcx, rax
call fcn.1400160a0
mov qword [0x14036e8e0], rax
mov byte [rax + 0x6c], 1
jmp 0x14000f45d
mov rax, rdi
mov qword [0x14036e8e0], rax
mov byte [rax + 0x6c], 1
jmp 0x14000f45d
lea r9, [0x1403642c0]
cmp qword [reloc.WS2_32.dll_getsockopt], 8
cmovae r9, qword [0x1403642c0]
mov rsi, qword [0x1403642d0]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.14000bc50
xor edi, edi
test rax, rax
jne 0x14000f458
lea rdx, [rbx + rsi*2]
mov qword [rbp + 0x3f8], rdi
mov qword [rbp + 0x408], rdi
mov qword [rbp + 0x410], 7
mov r8, r12
inc r8
cmp word [rdx + r8*2], di
jne 0x14000f3e1
lea rcx, [rbp + 0x3f8]
call fcn.14000a410
lea rdx, [rbp + 0x3f8]
lea rcx, [rbp + 0x278]
call fcn.1400366a0
mov rcx, rax
call fcn.140035ae0
mov rdx, qword [rbp + 0x410]
cmp rdx, 8
jb 0x14000f458
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f453
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011efc
call fcn.140240d18
mov esi, 4
inc r14d
add r15, 8
cmp r14d, dword [rsp + 0x54]
jl 0x14000f132
mov r13, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x60]
xor ecx, ecx
call fcn.14006a2d0
mov qword [rbp + 0x298], rdi
mov qword [rbp + 0x2a8], rdi
mov qword [rbp + 0x2b0], 7
mov r8, r12
nop dword [rax + rax]
inc r8
cmp word [r13 + r8*2], 0
jne 0x14000f4a0
mov rdx, r13
lea rcx, [rbp + 0x298]
call fcn.14000a410
lea r11, [rbp + 0x298]
mov r15, qword [rbp + 0x298]
mov r14, qword [rbp + 0x2b0]
cmp r14, 8
cmovae r11, r15
mov rdi, qword [rbp + 0x2a8]
cmp rdi, 0x11
jb 0x14000f5e9
lea rbx, [rdi - 0x10]
lea rbx, [r11 + rbx*2]
mov rax, r11
lea r8, str.clean_update_data
mov qword [rbp - 0x78], r8
nop
mov rcx, rbx
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x14000f52c
cmp word [rax], 0x63
je 0x14000f529
cmp rcx, 1
je 0x14000f52c
dec rcx
add rax, 2
cmp word [rax], 0x63
jne 0x14000f516
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000f5e9
mov r9d, reloc.COMCTL32.dll_InitCommonControls
mov rcx, r8
movzx edx, word [rdx]
mov r8d, 0x63
cmp dx, r8w
jb 0x14000f579
mov r10, rax
sub r10, qword [rbp - 0x78]
cmp dx, r8w
ja 0x14000f579
cmp r9, 1
je 0x14000f589
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x14000f55b
add rax, 2
lea r8, str.clean_update_data
jmp 0x14000f500
sub rax, r11
sar rax, 1
cmp rax, r12
je 0x14000f5e9
mov rax, qword [0x14036e8e0]
test rax, rax
jne 0x14000f5be
mov ecx, 0xb0
call fcn.1402407f4
test rax, rax
je 0x14000f5b7
mov rcx, rax
call fcn.1400160a0
mov qword [0x14036e8e0], rax
mov rcx, rax
call fcn.140019480
lea r8, [0x140281a50]
lea rdx, str.clean_update_data
lea rcx, str._______quit_____
call fcn.140036e10
xor eax, eax
mov edi, eax
jmp 0x140011dfc
call fcn.140004c80
mov rcx, rax
test rax, rax
je 0x140011e53
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rdx, [0x140282098]
cmp rdx, 0x10000
jae 0x14000f626
movzx edx, dx
lea rcx, [rbp - 0x80]
call fcn.140005650
jmp 0x14000f646
mov rax, r12
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14000f630
mov r8d, eax
lea rcx, [rbp - 0x80]
call fcn.14000ae10
lea rcx, [rbp - 0x80]
call fcn.140012090
lea r11, [rbp + 0x298]
cmp r14, 8
cmovae r11, r15
mov r10d, Ordinal_46
cmp rdi, 0x18
jb 0x14000ff57
lea rbx, [rdi - 0x17]
lea rbx, [r11 + rbx*2]
mov rax, r11
lea r8, str._check_dingding_packages
mov qword [rbp - 0x78], r8
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x14000f6bc
cmp word [rax], 0x2d
je 0x14000f6b9
cmp rcx, 1
je 0x14000f6bc
dec rcx
add rax, 2
cmp word [rax], 0x2d
jne 0x14000f6a6
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000ff57
mov r9d, Ordinal_27
mov rcx, r8
movzx edx, word [rdx]
mov r8d, r10d
cmp dx, 0x2d
jb 0x14000f70c
mov r10, rax
sub r10, qword [rbp - 0x78]
cmp dx, r8w
ja 0x14000f706
cmp r9, 1
je 0x14000f71c
dec r9
add rcx, 2
movzx edx, word [rcx + r10]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x14000f6e8
mov r10d, Ordinal_46
add rax, 2
lea r8, str._check_dingding_packages
jmp 0x14000f690
sub rax, r11
sar rax, 1
jne 0x14000ff51
lea rcx, [rbp + 0xe0]
call fcn.140031f00
mov r8, r13
mov rdx, qword [rax]
lea rcx, [0x1402820e0]
call fcn.140036e10
mov rdx, qword [rbp + 0xe0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000f767
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
cmp dword [rsp + 0x54], 2
jge 0x14000f795
lea rcx, str.Quit_with_args_2
lea rdx, str.check_dingding_packages
lea rsi, [0x140281a50]
mov r8, rsi
call fcn.140036e10
mov edi, 2
jmp 0x140011dd1
mov rdi, qword [rsi + 0x10]
lea rcx, [rbp + 0x118]
call fcn.1400341d0
nop
test rdi, rdi
je 0x140011f02
mov rax, qword [rax]
sub rdi, rax
movzx ebx, word [rax]
movzx ecx, word [rax + rdi]
sub ebx, ecx
jne 0x14000f7c8
add rax, 2
test ecx, ecx
jne 0x14000f7b5
mov rdx, qword [rbp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000f7e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test ebx, ebx
jne 0x14000f812
lea rcx, str.Quit_with_same_as_GetUsingDir
lea rdx, str.No_need_Check_again
lea rsi, str.finish
mov r8, rsi
call fcn.140036e10
lea edi, [rbx + 2]
jmp 0x140011dd1
lea rcx, [rbp - 0x50]
call fcn.140031f00
lea rdx, str.main_
mov rax, r12
inc rax
cmp word [rdx + rax*2], 0
jne 0x14000f825
mov r8d, eax
lea rcx, [rbp - 0x50]
call fcn.14000cce0
mov rdx, qword [rsi + 0x10]
test rdx, rdx
jne 0x14000f84c
xor r15d, r15d
mov eax, r15d
jmp 0x14000f85d
mov rax, r12
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14000f850
xor r15d, r15d
mov r8d, eax
lea rcx, [rbp - 0x50]
call fcn.14000cce0
lea rsi, [0x140281a50]
mov r8, rsi
lea rdx, str.CheckFilesIsOk
lea rcx, str.Start_CheckFiles
call fcn.140036e10
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140018990
test al, al
je 0x14000fbe5
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rdx + 0x10]
call fcn.140004c80
mov rcx, rax
test rax, rax
je 0x140011f0d
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x58], rax
test rbx, rbx
je 0x14000f8ec
cmp rbx, 0x10000
jae 0x14000f8dd
movzx edx, bx
lea rcx, [rbp - 0x58]
call fcn.140005650
jmp 0x14000f8fe
mov rax, r12
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000f8e0
jmp 0x14000f8ef
mov eax, r15d
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.14000ae10
lea rcx, [rbp - 0x58]
call fcn.1400355a0
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000f925
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea r8, [0x140282240]
lea rdx, str.CheckFilesIsOk
lea rcx, [0x1402820e0]
call fcn.140036e10
lea rbx, [rbp + 0x298]
cmp qword [rbp + 0x2b0], 8
cmovae rbx, qword [rbp + 0x298]
mov rax, qword [rbp + 0x2a8]
cmp rax, 0xb
jb 0x14000fbd9
add rax, 0xfffffffffffffff6
lea rdi, [rbx + rax*2]
mov rax, rbx
lea r11, str._isrollback
mov r14d, Ordinal_46
nop
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, r15
je 0x14000f9aa
cmp word [rax], r14w
je 0x14000f9a7
cmp rcx, 1
je 0x14000f9aa
dec rcx
add rax, 2
cmp word [rax], r14w
jne 0x14000f994
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000fbd9
mov r9d, listen
mov rcx, r11
movzx edx, word [rdx]
mov r8d, r14d
cmp dx, r8w
jb 0x14000f9f3
mov r10, rax
sub r10, r11
cmp dx, r8w
ja 0x14000f9f3
cmp r9, 1
je 0x14000f9f9
dec r9
add rcx, 2
movzx edx, word [rcx + r10]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x14000f9d5
add rax, 2
jmp 0x14000f980
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14000fbd9
mov r8, rsi
lea rdx, str.CheckFilesIsOk
lea rcx, str.WriteCheckRes_true
call fcn.140036e10
mov qword [rbp + 0x418], r15
mov qword [rbp + 0x428], r15
mov qword [rbp + 0x430], 7
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.rollfail_flag
lea rcx, [rbp + 0x418]
call fcn.14000a410
xor r8d, r8d
lea rdx, [rbp + 0x418]
lea rcx, [0x140364030]
call fcn.140009be0
mov rdx, qword [rbp + 0x430]
cmp rdx, 8
jb 0x14000faad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x418]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000faa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f18
call fcn.140240d18
mov qword [rbp + 0x438], r15
mov qword [rbp + 0x448], r15
mov qword [rbp + 0x450], 7
mov r8d, 1
lea rdx, [0x1402822a4]
lea rcx, [rbp + 0x438]
call fcn.14000a410
mov qword [rbp + 0x2b8], r15
mov qword [rbp + 0x2c8], r15
mov qword [rbp + 0x2d0], 7
mov r8d, reloc.WS2_32.dll_listen
lea rdx, [0x1402822a8]
lea rcx, [rbp + 0x2b8]
call fcn.14000a410
lea r8, [rbp + 0x438]
lea rdx, [rbp + 0x2b8]
lea rcx, [0x140364030]
call fcn.140009ec0
mov rdx, qword [rbp + 0x2d0]
cmp rdx, 8
jb 0x14000fb71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fb6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e4d
call fcn.140240d18
mov qword [rbp + 0x2c8], r15
mov qword [rbp + 0x2d0], 7
mov word [rbp + 0x2b8], r15w
mov rdx, qword [rbp + 0x450]
cmp rdx, 8
jb 0x14000ff32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x438]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e4d
jmp 0x14000ff15
lea rcx, str.No_WriteCheckRes_true
jmp 0x14000ff23
lea r8, str.failed
lea rdx, str.CheckFilesIsOk
lea rcx, [0x1402820e0]
call fcn.140036e10
lea rbx, [rbp + 0x298]
cmp qword [rbp + 0x2b0], 8
cmovae rbx, qword [rbp + 0x298]
mov rax, qword [rbp + 0x2a8]
cmp rax, 0xb
jb 0x14000ff1c
add rax, 0xfffffffffffffff6
lea rdi, [rbx + rax*2]
mov rax, rbx
lea r11, str._isrollback
mov r14d, Ordinal_46
nop
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, r15
je 0x14000fc6a
cmp word [rax], r14w
je 0x14000fc67
cmp rcx, 1
je 0x14000fc6a
dec rcx
add rax, 2
cmp word [rax], r14w
jne 0x14000fc54
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000ff1c
mov r9d, listen
mov rcx, r11
movzx edx, word [rdx]
mov r8d, r14d
cmp dx, r8w
jb 0x14000fcb3
mov r10, rax
sub r10, r11
cmp dx, r8w
ja 0x14000fcb3
cmp r9, 1
je 0x14000fcb9
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x14000fc95
add rax, 2
jmp 0x14000fc40
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14000ff1c
mov r8, rsi
lea rdx, str.CheckFilesIsOk
lea rcx, str.WriteCheckRes_false
call fcn.140036e10
xor ecx, ecx
call fcn.140254140
mov r8, rax
lea r9, [rbp + 0x6aa]
movabs r10, 0xcccccccccccccccd
test rax, rax
jns 0x14000fd40
neg r8
sub r9, 2
mov rax, r10
mul r8
shr rdx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8, rdx
test rdx, rdx
jne 0x14000fd02
add r9, 0xfffffffffffffffe
mov word [r9], r14w
jmp 0x14000fd70
sub r9, 2
mov rax, r10
mul r8
shr rdx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8, rdx
test rdx, rdx
jne 0x14000fd40
mov qword [rbp + 0x3b8], r15
mov qword [rbp + 0x3c8], r15
mov qword [rbp + 0x3d0], 7
lea rax, [rbp + 0x6aa]
cmp r9, rax
je 0x14000fdb1
lea r8, [rbp + 0x6aa]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp + 0x3b8]
call fcn.14000a410
mov qword [rbp + 0x458], r15
mov qword [rbp + 0x468], r15
mov qword [rbp + 0x470], 7
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.rollfail_flag
lea rcx, [rbp + 0x458]
call fcn.14000a410
mov r8d, 1
lea rdx, [rbp + 0x458]
lea rcx, [0x140364030]
call fcn.140009be0
mov rdx, qword [rbp + 0x470]
cmp rdx, 8
jb 0x14000fe42
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x458]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fe3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f1e
call fcn.140240d18
mov qword [rbp + 0x478], r15
mov qword [rbp + 0x488], r15
mov qword [rbp + 0x490], 7
mov r8d, reloc.WS2_32.dll_listen
lea rdx, [0x1402822a8]
lea rcx, [rbp + 0x478]
call fcn.14000a410
lea r8, [rbp + 0x3b8]
lea rdx, [rbp + 0x478]
lea rcx, [0x140364030]
call fcn.140009ec0
mov rdx, qword [rbp + 0x490]
cmp rdx, 8
jb 0x14000fed4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x478]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fecf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f24
call fcn.140240d18
mov rdx, qword [rbp + 0x3d0]
cmp rdx, 8
jb 0x14000ff32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f2a
call fcn.140240d18
jmp 0x14000ff32
lea rcx, str.No_WriteCheckRes_false
mov r8, rsi
lea rdx, str.CheckFilesIsOk
call fcn.140036e10
mov r8, rsi
lea rdx, str.check_dingding_packages
lea rcx, str._______quit_____
call fcn.140036e10
mov rdx, qword [rbp - 0x50]
jmp 0x140010c62
mov r10d, Ordinal_46
lea r11, [rbp + 0x298]
cmp r14, 8
cmovae r11, r15
cmp rdi, 0x14
jb 0x14001022e
add rdi, 0xffffffffffffffed
lea rbx, [r11 + rdi*2]
mov rax, r11
lea rdi, str._check_self_packages
xor r15d, r15d
nop word [rax + rax]
mov rcx, rbx
sub rcx, rax
sar rcx, 1
mov rdx, r15
je 0x14000ffba
cmp word [rax], 0x2d
je 0x14000ffb7
cmp rcx, 1
je 0x14000ffba
dec rcx
add rax, 2
cmp word [rax], 0x2d
jne 0x14000ffa4
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140010231
mov r9d, reloc.WS2_32.dll_sendto
mov rcx, rdi
movzx edx, word [rdx]
mov r8d, r10d
cmp dx, 0x2d
jb 0x140010009
mov r10, rax
sub r10, rdi
cmp dx, r8w
ja 0x140010003
cmp r9, 1
je 0x14001000f
dec r9
add rcx, 2
movzx edx, word [rcx + r10]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x14000ffe5
mov r10d, Ordinal_46
add rax, 2
jmp 0x14000ff90
sub rax, r11
sar rax, 1
jne 0x140010231
lea rcx, [rbp + 0x20]
call fcn.140031f00
mov r8, r13
mov rdx, qword [rax]
lea rcx, [0x140282390]
call fcn.140036e10
mov rdx, qword [rbp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010054
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea rcx, [rsp + 0x70]
call fcn.140031f00
lea rdx, str.main_
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140010070
mov r8d, eax
lea rcx, [rsp + 0x70]
call fcn.14000cce0
lea rcx, [rbp + 0x28]
call fcn.1400341d0
mov rbx, qword [rax]
movsxd rcx, dword [rbx - 0x10]
mov r14, rbx
mov rax, qword [rsp + 0x70]
sub r14, rax
sar r14, 1
mov r12d, dword [rax - 0x10]
test ecx, ecx
js 0x140011f30
test rbx, rbx
je 0x1400100c9
mov rdx, rcx
mov rcx, rbx
call fcn.140253bac
mov r15, rax
mov rax, qword [rsp + 0x70]
mov ecx, 0x7fffffff
sub ecx, r15d
cmp ecx, r12d
jl 0x140011f30
lea esi, [r15 + r12]
test esi, esi
js 0x140011f30
mov edi, 1
sub edi, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, esi
or edi, ecx
jge 0x140010108
mov edx, esi
lea rcx, [rsp + 0x70]
call fcn.140005960
mov rax, qword [rsp + 0x70]
cmp r14, r12
ja 0x140010111
lea rbx, [rax + r14*2]
lea rcx, [rax + r12*2]
movsxd r8, r15d
add r8, r8
je 0x14001014d
test rcx, rcx
je 0x140010138
test rbx, rbx
je 0x140010131
mov rdx, rbx
call fcn.1402430d0
jmp 0x140010148
xor edx, edx
call fcn.140243780
call fcn.14025224c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14024809c
mov rax, qword [rsp + 0x70]
cmp esi, dword [rax - 0xc]
jg 0x140011f30
mov dword [rax - 0x10], esi
movsxd rcx, esi
mov rax, qword [rsp + 0x70]
xor ebx, ebx
mov word [rax + rcx*2], bx
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
mov r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001018c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea rsi, [0x140281a50]
mov r8, rsi
lea rdx, str.CheckFilesIsOk
lea rcx, str.check_self_packages_start
call fcn.140036e10
mov dl, 1
lea rcx, [rsp + 0x70]
call fcn.140018990
lea r8, [0x140282240]
lea rcx, str.failed
test al, al
cmove r8, rcx
lea rdx, str.CheckFilesIsOk
lea rcx, [0x140282390]
call fcn.140036e10
mov r8, rsi
lea rdx, str.CheckFilesIsOk
lea rcx, str.check_self_packages_end
call fcn.140036e10
mov r8, rsi
lea rdx, str.check_self_packages
lea rcx, str._______quit_____
call fcn.140036e10
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010227
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov edi, ebx
jmp 0x140011dd1
xor r15d, r15d
mov rax, qword [0x14036e8e0]
test rax, rax
jne 0x140010260
mov ecx, 0xb0
call fcn.1402407f4
test rax, rax
je 0x140010256
mov rcx, rax
call fcn.1400160a0
jmp 0x140010259
mov rax, r15
mov qword [0x14036e8e0], rax
mov rcx, rax
call fcn.14001d170
test eax, eax
je 0x140010375
cmp dword [rsp + 0x54], 4
jle 0x140010321
mov rdi, qword [rsi + 0x20]
call fcn.140004c80
mov rcx, rax
test rax, rax
je 0x140011e53
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r9, str.true
cmp r9, 0x10000
jae 0x1400102bd
movzx edx, r9w
lea rcx, [rbp - 0x30]
call fcn.140005650
jmp 0x1400102db
mov rax, r12
inc rax
cmp word [r9 + rax*2], 0
jne 0x1400102c0
mov r8d, eax
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.14000ae10
nop
test rdi, rdi
je 0x140011f3b
mov rax, qword [rbp - 0x30]
mov rcx, rax
sub rdi, rax
nop
movzx ebx, word [rcx]
movzx edx, word [rcx + rdi]
sub ebx, edx
jne 0x140010303
add rcx, 2
test edx, edx
jne 0x1400102f0
lea rdx, [rax - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001031d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test ebx, ebx
je 0x14001032e
call fcn.14000f010
mov rcx, rax
call fcn.14001efa0
mov rbx, qword [0x14036e8e0]
test rbx, rbx
je 0x140010351
mov rcx, rbx
call fcn.140016f50
mov rcx, rbx
call fcn.1400bfa70
mov qword [0x14036e8e0], r15
lea r8, [0x140281a50]
lea rdx, str.IsAnotherInstanceRunning
lea rcx, str._______quit_____
call fcn.140036e10
mov edi, 1
jmp 0x140011dd1
lea rcx, [rbp + 0x30]
call fcn.140031f00
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400103a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea rcx, [rbp + 0x38]
call fcn.140031f00
mov r8, r13
mov rdx, qword [rax]
lea rcx, [0x140282498]
call fcn.140036e10
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400103de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea rsi, [0x140281a50]
mov rdx, rsi
mov rcx, r13
call fcn.140253dc4
test eax, eax
jne 0x140010c88
lea rcx, [rsp + 0x58]
call fcn.140031f00
lea rcx, [rbp + 8]
call fcn.140031ad0
mov r8, rsi
lea rdx, [0x1402824c8]
mov rcx, qword [rbp + 8]
call fcn.140036e10
mov r8, rsi
lea rdx, [0x1402824d0]
mov rcx, qword [rsp + 0x58]
call fcn.140036e10
mov r8, rsi
lea rdx, str.Updater_Start:
lea rcx, str.Empty_cmdline
call fcn.140036e10
mov r8d, 9
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14000e290
mov edi, 1
lea rdx, str.updater_
mov rcx, qword [rax]
call fcn.140253dc4
test eax, eax
jne 0x1400104be
lea rcx, [rbp + 0x50]
call fcn.1400318e0
mov rbx, rax
lea r8, [0x140282538]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x48]
call fcn.14000c820
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14000c770
mov r14d, reloc.WS2_32.dll_ntohs
mov edi, r14d
mov rcx, qword [rax]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400104be
mov bl, 1
jmp 0x1400104c9
xor bl, bl
mov r14d, edi
test dil, 8
je 0x1400104eb
and r14d, 0xfffffff7
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400104eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test r14b, 4
je 0x140010513
and r14d, 0xfffffffb
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010513
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test r14b, 2
je 0x140010537
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010537
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010555
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test bl, bl
je 0x140010c17
mov rax, qword [rsp + 0x58]
mov r8d, dword [rax - 0x10]
sub r8d, 9
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.14000de60
mov edx, 0x5c
mov rbx, qword [rbp - 0x68]
mov rcx, rbx
call fcn.140243910
mov r14, rax
test rax, rax
jne 0x140010596
mov r14d, r12d
jmp 0x14001060a
sub r14, rbx
sar r14, 1
test r14d, r14d
js 0x14001060a
mov r8d, dword [rbx - 0x10]
sub r8d, r14d
dec r8d
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x68]
call fcn.14000e290
mov rcx, rax
call fcn.140030f20
mov r8d, dword [rbx - 0x10]
sub r8d, r14d
dec r8d
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.14000e290
mov r8, rsi
lea rdx, str.CorrectDir
mov rcx, qword [rax]
call fcn.140036e10
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001060a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov r8, rsi
lea rdx, str.Updater:
lea rcx, str.Start_Copyfiles
call fcn.140036e10
mov r8, rsi
lea rdx, str.Updater:
lea rcx, str.Before_killProcessByNameExceptMe
call fcn.140036e10
lea rcx, str.DingTalkUpdater.exe
call fcn.14002a880
mov r8, rsi
lea rdx, str.Updater:
lea rcx, str.After_killProcessByNameExceptMe
call fcn.140036e10
call fcn.14000f010
mov rdi, rax
lea r8, str.......
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x68]
call fcn.14000c820
mov rbx, qword [rax]
mov rcx, qword [rsp + 0x58]
mov r8d, dword [rcx - 0x10]
dec r8d
lea rdx, [rbp + 0xb8]
lea rcx, [rsp + 0x58]
call fcn.14000de60
xor r9d, r9d
mov r8, rbx
mov rdx, qword [rax]
mov rcx, rdi
call fcn.1400257f0
test eax, eax
sete bl
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400106cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400106ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test bl, bl
je 0x140010898
mov r8, rsi
lea rdx, str.Updater:
lea rcx, str.Start_Copyfiles_second
call fcn.140036e10
mov rax, qword [rsp + 0x58]
mov r8d, dword [rax - 0x10]
dec r8d
lea rdx, [rbp + 0x88]
lea rcx, [rsp + 0x58]
call fcn.14000de60
mov rdx, rax
lea r8, [0x1402826b0]
lea rcx, [rbp + 0x80]
call fcn.14000c820
mov rdx, rax
lea r8, [rsp + 0x58]
lea rcx, [rbp + 0x78]
call fcn.14000c770
mov rdx, rax
lea r8, str.......
lea rcx, [rbp + 0x70]
call fcn.14000c820
mov r8, rsi
lea rdx, str.copyFiles_again.
mov rcx, qword [rax]
call fcn.140036e10
mov rdx, qword [rbp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001078f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400107ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400107ce
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400107ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
call fcn.14000f010
mov rdi, rax
lea r8, str.......
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x98]
call fcn.14000c820
mov rbx, qword [rax]
mov rcx, qword [rsp + 0x58]
mov r8d, dword [rcx - 0x10]
dec r8d
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.14000de60
xor r9d, r9d
mov r8, rbx
mov rdx, qword [rax]
mov rcx, rdi
call fcn.1400257f0
mov rdx, qword [rbp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010861
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010882
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov r8, rsi
lea rdx, str.Updater:
lea rcx, str.End_Copyfiles_second
call fcn.140036e10
mov rax, qword [rsp + 0x58]
mov r8d, dword [rax - 0x10]
dec r8d
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x58]
call fcn.14000de60
mov rdx, rax
lea r8, [0x1402826b0]
lea rcx, [rbp + 0xb0]
call fcn.14000c820
mov rdx, rax
lea r8, [rsp + 0x58]
lea rcx, [rbp + 0xa8]
call fcn.14000c770
mov rdx, rax
lea r8, str.......
lea rcx, [rbp + 0xa0]
call fcn.14000c820
mov r8, rsi
lea rdx, str.copyFiles
mov rcx, qword [rax]
call fcn.140036e10
mov rdx, qword [rbp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010928
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010949
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001096a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001098b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov r8, rsi
lea rdx, str.Updater:
lea rcx, str.End_Copyfiles
call fcn.140036e10
mov r8d, r14d
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.14000de60
mov edx, 0x5c
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.140243910
test rax, rax
jne 0x1400109ce
mov eax, r12d
jmp 0x1400109d4
sub rax, rbx
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.14000de60
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140010a42
cmp dword [rbx + 0x10], 0
jl 0x140010a34
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140010a34
call fcn.14000ce00
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140010a29
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rioctlsocket + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x140010a42
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.14000ae10
mov rdx, qword [rbp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010a63
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea r8, str.DingtalkScheme.exe
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x140]
call fcn.14000c820
mov rcx, rax
call fcn.140034bd0
lea r8, str.DingtalkScheme.exe
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x148]
call fcn.14000c820
mov rcx, rax
call fcn.140034840
mov r8, rsi
lea rdx, str.Updater:
lea rcx, str.Start_CopyAndRegisterShellExtension
call fcn.140036e10
call fcn.140019660
mov r8, rsi
lea rdx, str.Updater:
lea rcx, str.End_CopyAndRegisterShellExtension
call fcn.140036e10
lea r8, str.DingtalkScheme.exe
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc8]
call fcn.14000c820
mov r8, rsi
lea rdx, str.RegisterWebStartScheme
mov rcx, qword [rax]
call fcn.140036e10
mov rdx, qword [rbp + 0xc8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010b1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov r8, rsi
lea rdx, str.Updater_end_
lea rcx, str.___________11___________
call fcn.140036e10
call fcn.14000f010
mov rbx, rax
lea r8, str.......DingTalkUpdater.exe
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xd0]
call fcn.14000c820
lea r8, str.66FC3B8D_4FEE_4914_85D4_837DC44F26FF
mov rdx, qword [rax]
mov rcx, rbx
call fcn.14001f6e0
mov rdx, qword [rbp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010b88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
call fcn.14000cfc0
lea r8, str.......DingTalkUpdater.exe
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xd8]
call fcn.14000c820
mov r8, rsi
lea rdx, str.RunMainUpdater_REMOVE_LOCALUPDATER_PARAM
mov rcx, qword [rax]
call fcn.140036e10
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010bd8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010bf7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010c3f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
jmp 0x140010c3f
mov r8, rsi
lea rdx, str.Updater_end_
lea rcx, str.___________1___________
call fcn.140036e10
call fcn.14000f010
mov rcx, rax
call fcn.140020260
call fcn.14000cfc0
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010c5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010fc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov edi, r15d
jmp 0x140011dd1
cmp dword [rsp + 0x54], 4
jge 0x140010fc8
mov qword [rbp + 0x398], r15
mov qword [rbp + 0x3a8], r15
mov qword [rbp + 0x3b0], 7
mov r8, r12
nop
inc r8
cmp word [r13 + r8*2], 0
jne 0x140010cb0
mov rdx, r13
lea rcx, [rbp + 0x398]
call fcn.14000a410
lea r9, [rbp + 0x398]
mov r10, qword [rbp + 0x398]
mov r11, qword [rbp + 0x3b0]
cmp r11, 8
cmovae r9, r10
cmp qword [rbp + 0x3a8], 0x26
jne 0x140010d37
mov edx, Ordinal_41
lea rcx, str.66FC3B8D_4FEE_4914_85D4_837DC44F26FF
movzx eax, word [r9]
mov r8d, Ordinal_127
cmp ax, r8w
jb 0x140010d37
sub r9, rcx
cmp ax, r8w
ja 0x140010d37
cmp rdx, 1
je 0x140010f94
dec rdx
add rcx, 2
movzx eax, word [rcx + r9]
movzx r8d, word [rcx]
cmp ax, r8w
jae 0x140010d15
xor bl, bl
cmp r11, 8
jb 0x140010d74
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x140010d6c
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e41
mov rcx, r10
call fcn.140240d18
mov r8, rsi
test bl, bl
je 0x140010f9b
lea rdx, str.REMOVE_LOCALUPDATER_PARAM
mov rcx, rsi
call fcn.140036e10
lea rcx, str.DingTalkUpdater.exe
call fcn.14002a880
lea rcx, [rsp + 0x78]
call fcn.140031f00
mov r8, rsi
lea rdx, str.localUpdaterPath
mov rcx, qword [rsp + 0x78]
call fcn.140036e10
lea rdx, str.main_
mov rax, r12
inc rax
cmp word [rdx + rax*2], 0
jne 0x140010dc2
mov r8d, eax
lea rcx, [rsp + 0x78]
call fcn.14000cce0
lea rcx, [rbp - 0x18]
call fcn.1400341d0
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.14000cce0
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010e11
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea rdx, [0x1402829e8]
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140010e20
mov r8d, eax
lea rcx, [rsp + 0x78]
call fcn.14000cce0
mov rcx, qword [rsp + 0x78]
call fcn.14001a690
mov r8, rsi
lea rdx, str.EmptyDirectory_localUpdaterPath_
mov rcx, qword [rsp + 0x78]
call fcn.140036e10
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov r8, rsi
lea rdx, str.RemoveDirectory_localUpdaterPath_
mov rcx, qword [rsp + 0x78]
call fcn.140036e10
lea rcx, [rbp - 0x40]
call fcn.140031f00
lea rdx, str.DingDingUpdater.exe
mov rax, r12
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140010e90
mov r8d, eax
lea rcx, [rbp - 0x40]
call fcn.14000cce0
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rsi
lea rdx, str.DeleteFile_oldUpdaterExe_
mov rcx, qword [rbp - 0x40]
call fcn.140036e10
lea rcx, [rbp - 0x48]
call fcn.140031f00
lea rdx, str.elevate.exe
mov rax, r12
inc rax
cmp word [rdx + rax*2], 0
jne 0x140010ed6
mov r8d, eax
lea rcx, [rbp - 0x48]
call fcn.14000cce0
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rsi
lea rdx, str.DeleteFile_oldElevateExe_
mov rcx, qword [rbp - 0x48]
call fcn.140036e10
mov r8, rsi
lea rdx, str.Updater_end_
lea rcx, str.___________21___________
call fcn.140036e10
call fcn.14000f010
mov rcx, rax
call fcn.14001f540
call fcn.14000cfc0
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010f4f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010f6d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010fc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov edi, r15d
jmp 0x140011dd1
mov bl, 1
jmp 0x140010d39
lea rdx, str.Updater_end_
lea rcx, str.___________2___________
call fcn.140036e10
call fcn.14000f010
mov rcx, rax
call fcn.140020260
call fcn.14000cfc0
mov edi, r15d
jmp 0x140011dd1
mov rbx, qword [rsp + 0x60]
mov r15, qword [rbx]
mov qword [rbp - 0x20], r15
mov r8, qword [rbx + 8]
mov qword [rbp - 0x78], r8
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x108], rax
mov r14, qword [rbx + 0x18]
call fcn.140004c80
mov rcx, rax
test rax, rax
je 0x140011f46
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x28], rax
mov r8d, dword [rsp + 0x54]
cmp r8d, 4
jle 0x140011044
mov rdx, qword [rbx + 0x20]
test rdx, rdx
jne 0x140011022
xor eax, eax
jmp 0x14001102f
mov rax, r12
inc rax
cmp word [rdx + rax*2], 0
jne 0x140011025
mov r8d, eax
lea rcx, [rbp - 0x28]
call fcn.14000ae10
mov r8d, dword [rsp + 0x54]
mov rax, qword [rbp - 0x28]
xor ecx, ecx
mov edx, ecx
lea r9, str.true
nop
movzx r12d, word [rax + rdx*2]
inc rdx
movzx ecx, word [r9 + rdx*2 - 2]
sub r12d, ecx
jne 0x140011069
cmp rdx, 5
jne 0x140011050
test r12d, r12d
sete byte [rsp + 0x68]
mov byte [rsp + 0x50], 0
xor r13b, r13b
mov edi, 1
test r12d, r12d
jne 0x140011384
cmp r8d, 5
jle 0x140011384
call fcn.140004c80
mov rcx, rax
test rax, rax
je 0x140011f51
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x60], rax
mov rdx, qword [rbx + 0x28]
test rdx, rdx
jne 0x1400110bd
xor eax, eax
jmp 0x1400110ce
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400110c4
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.14000ae10
lea rcx, [rbp + 0xe8]
call fcn.140034020
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x140011f5c
mov rax, qword [rbp - 0x60]
sub rdx, rax
nop word [rax + rax]
movzx ebx, word [rax]
movzx ecx, word [rax + rdx]
sub ebx, ecx
jne 0x140011113
add rax, 2
test ecx, ecx
jne 0x140011100
mov rdx, qword [rbp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011136
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test ebx, ebx
jne 0x1400111e3
call fcn.140004c80
mov rcx, rax
test rax, rax
je 0x140011f67
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp + 0x10], rax
mov r8, qword [rbp - 0x60]
lea rdx, str.bSilent__true__sFromExeDir__GetUpdateDir_____s
lea rcx, [rbp + 0x10]
call fcn.14000d000
mov r8, rsi
lea rdx, str.Auto_abort_update_process
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140036e10
mov r8, rsi
lea rdx, str.Updater_end_
lea rcx, str.___________3___________
call fcn.140036e10
lea rdx, [rbx - 0x18]
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400111bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011da8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
jmp 0x140011da8
cmp dword [rsp + 0x54], 7
jle 0x1400112b1
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx + 0x38]
lea rcx, [rbp + 0xf0]
call fcn.14000c3b0
nop
mov rax, qword [rbp + 0xf0]
lea r10, str.check_last
mov r9, 0xffffffffffffffff
mov rdx, r9
nop dword [rax]
movzx r8d, word [rax + rdx*2 + 2]
movzx ecx, word [r10 + rdx*2 + 2]
sub r8d, ecx
jne 0x14001124a
add rdx, 2
cmp rdx, 0xb
je 0x14001124a
movzx r8d, word [rax + rdx*2]
movzx ecx, word [r10 + rdx*2]
sub r8d, ecx
je 0x140011220
test r8d, r8d
sete bl
mov byte [rsp + 0x50], bl
mov rdx, r9
lea r10, str.incre_update
nop
movzx r8d, word [rax + rdx*2 + 2]
movzx ecx, word [r10 + rdx*2 + 2]
sub r8d, ecx
jne 0x14001128a
add rdx, 2
cmp rdx, 0xd
je 0x14001128a
movzx r8d, word [rax + rdx*2]
movzx ecx, word [r10 + rdx*2]
sub r8d, ecx
je 0x140011260
test r8d, r8d
sete r13b
lea rdx, [rax - 0x18]
mov eax, r9d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400112b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov byte [rsp + 0x50], bl
jmp 0x1400112b3
xor bl, bl
cmp dword [rsp + 0x54], 8
jle 0x14001133f
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x40]
lea rcx, [rbp + 0xf8]
call fcn.14000c3b0
nop
mov rax, qword [rbp + 0xf8]
mov r9, 0xffffffffffffffff
mov rdx, r9
lea r10, str.incre_update
nop dword [rax]
movzx r8d, word [rax + rdx*2 + 2]
movzx ecx, word [r10 + rdx*2 + 2]
sub r8d, ecx
jne 0x14001131a
add rdx, 2
cmp rdx, 0xd
je 0x14001131a
movzx r8d, word [rax + rdx*2]
movzx ecx, word [r10 + rdx*2]
sub r8d, ecx
je 0x1400112f0
movzx r13d, r13b
test r8d, r8d
cmove r13d, edi
lea rdx, [rax - 0x18]
mov eax, r9d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001133f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea rdx, str.Updater_going:
lea rcx, str.___________3___________
test bl, bl
lea r8, str.need_block
jne 0x14001135f
lea r8, str.disalbe_block
call fcn.140036e10
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011384
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
xor eax, eax
mov qword [rbp + 0x378], rax
mov qword [rbp + 0x388], rax
mov qword [rbp + 0x390], 7
mov r8, 0xffffffffffffffff
inc r8
cmp word [r14 + r8*2], ax
jne 0x1400113a6
mov rdx, r14
lea rcx, [rbp + 0x378]
call fcn.14000a410
lea r9, [rbp + 0x378]
mov r11, qword [rbp + 0x378]
mov r10, qword [rbp + 0x390]
cmp r10, 8
cmovae r9, r11
cmp qword [rbp + 0x388], 1
jne 0x140011424
mov r8, rdi
lea rax, [0x140281efc]
movzx ecx, word [r9]
mov edx, 0x31
cmp cx, dx
jb 0x140011424
sub r9, rax
cmp cx, dx
ja 0x140011424
cmp r8, 1
je 0x1400114bd
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140011404
xor bl, bl
cmp r10, 8
jb 0x14001143f
lea r8, [r10 + 1]
mov rdx, r11
lea rcx, [rbp + 0x378]
call fcn.14000efd0
test bl, bl
je 0x140011452
call fcn.14000f010
mov dl, 1
mov rcx, rax
call fcn.1400209b0
mov rdx, r15
lea rcx, [rbp + 0x18]
call fcn.14000c3b0
lea rcx, [rbp + 0x18]
call fcn.140034730
test al, al
sete bl
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011491
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test bl, bl
je 0x1400114c4
mov r8, rsi
lea rdx, str.Updater_end_
lea rcx, str.___________4___________
call fcn.140036e10
call fcn.14000f010
mov rcx, rax
call fcn.140020260
jmp 0x140011da3
mov bl, 1
jmp 0x140011426
mov rcx, qword [rbp - 0x18]
call fcn.140072cb0
lea rcx, [rbp + 0x5f0]
call fcn.14006d6c0
lea r8, str.updaterres
lea rdx, [rbp + 0x560]
mov rcx, rax
call fcn.140068800
mov rcx, rax
call fcn.1400687f0
mov rcx, rax
call fcn.140072ef0
lea rcx, [rbp + 0x560]
call fcn.140003e80
lea rcx, [rbp + 0x5f0]
call fcn.140003e80
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x140011da8
cmp dword [rsp + 0x54], 6
jle 0x1400115fb
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x30]
test rdx, rdx
jne 0x140011544
xor eax, eax
jmp 0x14001155a
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140011550
mov r8d, eax
lea rcx, [rbp - 0x80]
call fcn.14000ae10
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14001157e
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14001158c
call fcn.140004c80
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r8, rax
lea rdx, [0x140282d60]
lea rcx, [rbp + 0x100]
call fcn.14000c240
nop
mov rax, qword [rbp + 0x100]
test rax, rax
je 0x140011f72
mov rcx, qword [rbp - 0x80]
mov r8, rax
sub r8, rcx
nop dword [rax]
movzx ebx, word [rcx]
movzx edx, word [rcx + r8]
sub ebx, edx
jne 0x1400115d4
add rcx, 2
test edx, edx
jne 0x1400115c0
lea rdx, [rax - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400115ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test ebx, ebx
je 0x1400115fb
lea rcx, [rbp - 0x80]
call fcn.140012090
mov ecx, 0x5e0
call fcn.1402407f4
mov r15, rax
test rax, rax
je 0x140011d71
mov rcx, rax
call fcn.140074190
lea rax, vtable.CFrameWindowWnd.0
mov qword [r15], rax
lea rax, vtable.CFrameWindowWnd.1.0
mov qword [r15 + 0x28], rax
mov rcx, qword [rbp - 0x80]
add rcx, 0xffffffffffffffe8
call fcn.14000ce00
add rax, 0x18
mov qword [r15 + 0x38], rax
lea rcx, [r15 + 0x40]
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
lea r8d, [r14 + 0x2a]
lea rdx, str.http:__www.dingtalk.com__gotoDownloadtrue
call fcn.14000a410
lea rcx, [r15 + 0x68]
call fcn.14006abe0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
lea r8, [rbp - 0x10]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
call fcn.14000d1c0
mov r8d, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp + 0x540]
call fcn.14000d5a0
cmp byte [rsp + 0x52], r14b
je 0x1400116ba
call fcn.14000f010
mov rcx, rax
call fcn.14001a820
call fcn.140063940
mov rcx, rax
call fcn.140063a20
cmp byte [rsp + 0x51], r14b
je 0x1400116db
call fcn.140066a10
mov rcx, rax
call fcn.140066aa0
mov r8, rsi
lea rdx, str.create_window:
lea rcx, str.start
call fcn.140036e10
mov qword [rbp + 0x358], r14
mov qword [rbp + 0x368], r14
mov r14d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x370], r14
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x14001175d
mov rdx, rax
lea rcx, [rbp + 0x520]
call fcn.140036790
lea rcx, [rbp + 0x358]
cmp rcx, rax
je 0x140011751
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x358], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x368], xmm1
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], r14
mov byte [rax], cl
lea rcx, [rbp + 0x520]
call fcn.140003fe0
call fcn.140063940
mov rbx, rax
mov dword [rbp - 0x38], 0
lea r8, [rsp + 0x52]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x198]
call fcn.14000c440
xor eax, eax
mov qword [rbp + 0x4e0], rax
movdqa xmm0, xmmword [0x140282f00]
movdqa xmmword [rbp + 0x4f0], xmm0
lea r8d, [rax + 3]
lea rdx, [0x140282e04]
lea rcx, [rbp + 0x4e0]
call fcn.1400079a0
lea rdx, [rbp + 0x358]
lea rcx, [rbp + 0x500]
call fcn.140003500
lea rax, [rbp + 0x4e0]
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x520]
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x158]
call fcn.14000c4c0
xor eax, eax
mov qword [rbp + 0x2f8], rax
mov qword [rbp + 0x308], rax
mov qword [rbp + 0x310], r14
lea r8d, [rax + 5]
lea rdx, str.enter
lea rcx, [rbp + 0x2f8]
call fcn.1400079a0
xor eax, eax
mov qword [rbp + 0x2d8], rax
mov qword [rbp + 0x2e8], rax
mov qword [rbp + 0x2f0], r14
mov r8, r14
lea rdx, str.windows_updater
lea rcx, [rbp + 0x2d8]
call fcn.1400079a0
lea rax, [rbp + 0x198]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x158]
lea r8, [rbp + 0x2f8]
lea rdx, [rbp + 0x2d8]
mov rcx, rbx
call fcn.140064940
mov rdx, qword [rbp + 0x2f0]
cmp rdx, 0x10
jb 0x1400118b8
inc rdx
mov rcx, qword [rbp + 0x2d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400118b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f7d
call fcn.140240d18
xor ebx, ebx
mov qword [rbp + 0x2e8], rbx
mov qword [rbp + 0x2f0], r14
mov byte [rbp + 0x2d8], bl
mov rdx, qword [rbp + 0x310]
cmp rdx, 0x10
jb 0x14001190f
inc rdx
mov rcx, qword [rbp + 0x2f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001190a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f7d
call fcn.140240d18
mov qword [rbp + 0x308], rbx
mov qword [rbp + 0x310], r14
mov byte [rbp + 0x2f8], bl
lea rcx, [rbp + 0x158]
call fcn.14000c540
lea r9, [fcn.14000c6b0]
mov r8, rdi
mov edx, 0x40
lea rcx, [rbp + 0x4e0]
call fcn.140240ee0
lea rcx, [rbp + 0x198]
call fcn.14000c540
lea r8, [0x140364388]
cmp qword [reloc.WS2_32.dll_getsockopt], 8
cmovae r8, qword [0x140364388]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x80000000
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x100
xor edx, edx
mov r9d, 0x10cf0000
mov rcx, r15
call fcn.140074400
mov rax, qword [r15]
mov rcx, r15
call qword [rax]
mov r8b, 1
xor edx, edx
mov rcx, r15
call fcn.140074730
cmp byte [rsp + 0x53], bl
je 0x1400119d2
call fcn.14000f010
mov rcx, rax
call fcn.14001bd10
call fcn.14000f010
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x40], rcx
mov byte [rsp + 0x38], r13b
movzx ecx, byte [rsp + 0x50]
mov byte [rsp + 0x30], cl
movzx ebx, byte [rsp + 0x68]
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x20], r15
mov r9, qword [rbp + 0x108]
mov r8, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x20]
mov rcx, rax
call fcn.14002a1c0
mov r8, rsi
lea rdx, str.create_window:
lea rcx, [0x140282e20]
call fcn.140036e10
call fcn.14000f010
movzx edx, bl
mov rcx, rax
call fcn.14001d180
test al, al
je 0x140011a60
call fcn.14000cfc0
mov r8, rsi
lea rdx, str.Updater
lea rcx, str.Quit_with_IsDiskFull
call fcn.140036e10
xor r15d, r15d
jmp 0x140011cd8
test r12d, r12d
setne dl
mov r8b, 1
mov rcx, r15
call fcn.140074730
lea rax, [r15 + 0x60]
mov qword [rsp + 0x28], rax
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x14000f050]
xor edx, edx
xor ecx, ecx
call fcn.140254060
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140070f30
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.140063940
mov rbx, rax
mov dword [rbp - 0x70], r15d
lea r8, [rsp + 0x53]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x218]
call fcn.14000c440
mov qword [rbp + 0x4a0], r15
movdqa xmm0, xmmword [0x140282f00]
movdqa xmmword [rbp + 0x4b0], xmm0
lea r8d, [r15 + 3]
lea rdx, [0x140282e04]
lea rcx, [rbp + 0x4a0]
call fcn.1400079a0
lea rdx, [rbp + 0x358]
lea rcx, [rbp + 0x4c0]
call fcn.140003500
lea rax, [rbp + 0x4a0]
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x4e0]
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x1d8]
call fcn.14000c4c0
mov qword [rbp + 0x338], r15
mov qword [rbp + 0x348], r15
mov qword [rbp + 0x350], r14
lea r8d, [r15 + 4]
lea rdx, str.exit
lea rcx, [rbp + 0x338]
call fcn.1400079a0
mov qword [rbp + 0x318], r15
mov qword [rbp + 0x328], r15
mov qword [rbp + 0x330], r14
mov r8, r14
lea rdx, str.windows_updater
lea rcx, [rbp + 0x318]
call fcn.1400079a0
lea rax, [rbp + 0x218]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1d8]
lea r8, [rbp + 0x338]
lea rdx, [rbp + 0x318]
mov rcx, rbx
call fcn.140064940
mov rdx, qword [rbp + 0x330]
cmp rdx, 0x10
jb 0x140011bfb
inc rdx
mov rcx, qword [rbp + 0x318]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011bf6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f83
call fcn.140240d18
mov qword [rbp + 0x328], r15
mov qword [rbp + 0x330], r14
mov byte [rbp + 0x318], r15b
mov rdx, qword [rbp + 0x350]
cmp rdx, 0x10
jb 0x140011c51
inc rdx
mov rcx, qword [rbp + 0x338]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011c4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f83
call fcn.140240d18
mov qword [rbp + 0x348], r15
mov qword [rbp + 0x350], r14
mov byte [rbp + 0x338], r15b
lea rcx, [rbp + 0x1d8]
call fcn.14000c540
lea r9, [fcn.14000c6b0]
mov r8, rdi
mov edx, 0x40
lea rcx, [rbp + 0x4a0]
call fcn.140240ee0
lea rcx, [rbp + 0x218]
call fcn.14000c540
call fcn.140063940
mov rcx, rax
call fcn.140063830
mov r8, rsi
lea rdx, str.Updater_end_
lea rcx, str.___________6___________
call fcn.140036e10
call fcn.14000cfc0
cmp byte [rsp + 0x51], r15b
je 0x140011cd5
call fcn.140066a10
mov rcx, rax
call fcn.1400679b0
mov edi, r15d
mov rdx, qword [rbp + 0x370]
cmp rdx, 0x10
jb 0x140011d19
inc rdx
mov rcx, qword [rbp + 0x358]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011d14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e41
call fcn.140240d18
lea rcx, [rbp + 0x540]
call fcn.140009750
mov rbx, qword [rbp - 0x10]
test rbx, rbx
je 0x140011dac
mov rsi, qword [rbp - 8]
cmp rbx, rsi
je 0x140011d4c
mov rcx, rbx
call fcn.140009750
add rbx, 0x20
cmp rbx, rsi
jne 0x140011d37
mov rbx, qword [rbp - 0x10]
mov r8, qword [rbp]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.14000ef80
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp], r15
jmp 0x140011dac
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r8, rsi
lea rdx, str.create_window_failed
lea rcx, str.error
call fcn.140036e10
mov r8, rsi
lea rdx, str.Updater_end_
lea rcx, str.___________5___________
call fcn.140036e10
call fcn.14000cfc0
xor eax, eax
mov edi, eax
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011dd1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x140011dee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov r15, qword [rbp + 0x298]
mov r14, qword [rbp + 0x2b0]
cmp r14, 8
jb 0x140011e15
lea r8, [r14 + 1]
mov rdx, r15
lea rcx, [rbp + 0x298]
call fcn.14000efd0
mov eax, edi
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.140240e30
mov rbx, qword [rsp + 0x808]
add rsp, 0x7c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1402480bc
int3
call fcn.1402480bc
int3
call fcn.1402480bc
int3
mov ecx, 0x80004005
call fcn.140004b00
int3
lea rcx, [0x14036e8c8]
call fcn.140240c08
cmp dword [0x14036e8c8], r12d
jne 0x14000f23b
mov r8d, reloc.COMCTL32.dll_InitCommonControls
lea rdx, str.__client_version
lea rcx, [0x1403642a0]
call fcn.14000a410
lea rcx, [0x14027dbe0]
call fcn.140240a68
lea rcx, [0x14036e8c8]
call fcn.140240ba8
jmp 0x14000f23b
lea rcx, [0x14036e8cc]
call fcn.140240c08
cmp dword [0x14036e8cc], r12d
jne 0x14000f24a
mov r8d, 6
lea rdx, str.__uid
lea rcx, [0x1403642c0]
call fcn.14000a410
lea rcx, [0x14027dc60]
call fcn.140240a68
lea rcx, [0x14036e8cc]
call fcn.140240ba8
jmp 0x14000f24a
call fcn.1402480bc
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
int3
call fcn.1402480bc
int3
call fcn.1402480bc
int3
call fcn.1402480bc
int3
call fcn.1402480bc
int3
mov ecx, 0x80070057
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
call fcn.1402480bc
int3
call fcn.1402480bc
int3