Function at 0x1400fbbb0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d8]
sub rsp, 0x5d8
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov r13, rcx
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x3c0]
call fcn.140249b10
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xa0]
call fcn.140249b10
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x70]
call fcn.140249b10
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x1b0]
call fcn.140249b10
lea r15, vtable.CSABString.0
mov qword [rsp + 0x40], r15
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x54], 1
xor r12d, r12d
test rax, rax
je 0x1400fbc69
mov rcx, rax
call fcn.140247060
mov qword [rsp + 0x48], r12
mov edi, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov dword [rsp + 0x50], edi
lea ecx, [rdi + 1]
call fcn.140247068
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400fbca6
movsd xmm0, qword [str._SSUPDATE__r_n]
movsd qword [rax], xmm0
mov ecx, dword [0x1402b7350]
mov dword [rax + 8], ecx
movzx ecx, byte [0x1402b7354]
mov byte [rax + 0xc], cl
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x80], r12d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp - 0x7c], 1
lea rdx, [rsp + 0x70]
lea rcx, str.SASUpdateURL
call fcn.1400e0790
mov rsi, 0xffffffffffffffff
test eax, eax
je 0x1400fbeb1
cmp dword [rbp - 0x80], 0
je 0x1400fbeb1
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x68], SafeArrayGetDim
lea ecx, [rsi + 0x10]
call fcn.140247068
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400fbd49
movsd xmm0, qword [str._SABUPDATEURL_]
movsd qword [rax], xmm0
mov ecx, dword [0x1402b7370]
mov dword [rax + 8], ecx
movzx ecx, word [0x1402b7374]
mov word [rax + 0xc], cx
movzx ecx, byte [0x1402b7376]
mov byte [rax + 0xe], cl
mov dword [rsp + 0x6c], 1
mov ecx, 0x1b
call fcn.140247068
mov rdi, rax
test rbx, rbx
je 0x1400fbd8d
mov rcx, rbx
mov rdx, rax
sub rdx, rbx
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400fbd70
mov rcx, rbx
call fcn.140247060
mov qword [rsp + 0x48], rdi
jmp 0x1400fbd92
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x1400fbdcd
movsd xmm0, qword [r14]
movsd qword [rdi + 0xc], xmm0
mov ecx, dword [r14 + 8]
mov dword [rdi + 0x14], ecx
movzx ecx, word [r14 + 0xc]
mov word [rdi + 0x18], cx
movzx eax, byte [r14 + 0xe]
mov byte [rdi + 0x1a], al
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400fbdc0
mov dword [rsp + 0x50], eax
test r14, r14
je 0x1400fbdda
mov rcx, r14
call fcn.140247060
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.1400fba30
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x68], reloc.COMCTL32.dll_InitCommonControls
mov ecx, send
call fcn.140247068
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400fbe22
movups xmm0, xmmword [str.__SABUPDATEURL__r_n]
movups xmmword [rax], xmm0
movzx ecx, word [reloc.OLEAUT32.dll_VariantCopyInd]
mov word [rax + 0x10], cx
mov dword [rsp + 0x6c], 1
mov r15, qword [rsp + 0x48]
mov edi, dword [rsp + 0x50]
lea ecx, [rdi + 0x12]
call fcn.140247068
mov rbx, rax
test r15, r15
je 0x1400fbe6e
mov rdx, r15
mov r8, rax
sub r8, r15
nop dword [rax]
movzx eax, byte [rdx]
mov byte [rdx + r8], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400fbe50
mov rcx, r15
call fcn.140247060
mov qword [rsp + 0x48], rbx
jmp 0x1400fbe73
mov qword [rsp + 0x48], rax
test rbx, rbx
je 0x1400fbe9d
mov ecx, edi
movups xmm0, xmmword [r14]
movups xmmword [rcx + rbx], xmm0
movzx eax, word [r14 + 0x10]
mov word [rcx + rbx + 0x10], ax
mov rdi, rsi
nop
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400fbe90
mov dword [rsp + 0x50], edi
test r14, r14
je 0x1400fbeaa
mov rcx, r14
call fcn.140247060
lea r15, vtable.CSABString.0
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x68], reloc.WSOCK32.dll_send
mov ecx, SafeArrayUnaccessData
call fcn.140247068
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400fbee8
movups xmm0, xmmword [str._APPLICATIONMODULE_]
movups xmmword [rax], xmm0
mov ecx, dword [0x1402b73a0]
mov dword [rax + 0x10], ecx
mov dword [rsp + 0x6c], 1
lea ecx, [rdi + 0x14]
call fcn.140247068
mov r14, rax
test rbx, rbx
je 0x1400fbf2d
mov rcx, rbx
mov rdx, rax
sub rdx, rbx
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400fbf10
mov rcx, rbx
call fcn.140247060
mov qword [rsp + 0x48], r14
jmp 0x1400fbf32
mov qword [rsp + 0x48], rax
test r14, r14
je 0x1400fbf5e
mov edx, edi
movups xmm0, xmmword [r15]
movups xmmword [rdx + r14], xmm0
mov ecx, dword [r15 + 0x10]
mov dword [rdx + r14 + 0x10], ecx
mov rax, rsi
nop
inc rax
cmp byte [r14 + rax], 0
jne 0x1400fbf50
mov dword [rsp + 0x50], eax
test r15, r15
je 0x1400fbf6b
mov rcx, r15
call fcn.140247060
lea rdx, [r13 + 8]
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rax, vtable.CSABString.0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x68], reloc.WSOCK32.dll_shutdown
mov ecx, reloc.OLEAUT32.dll_SafeArrayUnaccessData
call fcn.140247068
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400fbfcc
movups xmm0, xmmword [str.__APPLICATIONMODULE__r_n]
movups xmmword [rax], xmm0
mov ecx, dword [0x1402b73b8]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1402b73bc]
mov word [rax + 0x14], cx
movzx ecx, byte [0x1402b73be]
mov byte [rax + 0x16], cl
mov dword [rsp + 0x6c], 1
mov r15, qword [rsp + 0x48]
mov ebx, dword [rsp + 0x50]
lea ecx, [rbx + 0x17]
call fcn.140247068
mov rdi, rax
test r15, r15
je 0x1400fc01e
mov rdx, r15
mov r8, rax
sub r8, r15
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400fc000
mov rcx, r15
call fcn.140247060
mov qword [rsp + 0x48], rdi
jmp 0x1400fc023
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x1400fc05d
mov edx, ebx
add rdx, rdi
movups xmm0, xmmword [r14]
movups xmmword [rdx], xmm0
mov ecx, dword [r14 + 0x10]
mov dword [rdx + 0x10], ecx
movzx eax, word [r14 + 0x14]
mov word [rdx + 0x14], ax
movzx eax, byte [r14 + 0x16]
mov byte [rdx + 0x16], al
mov rbx, rsi
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400fc050
mov dword [rsp + 0x50], ebx
test r14, r14
je 0x1400fc06a
mov rcx, r14
call fcn.140247060
lea rdx, [r13 + 8]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp - 0x70]
call fcn.1400fca30
lea r13, vtable.CSABString.0
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x68], reloc.COMCTL32.dll_InitCommonControls
mov ecx, send
call fcn.140247068
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400fc0c1
movups xmm0, xmmword [str._APPLICATIONPATH_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1402b73d0]
mov word [rax + 0x10], cx
mov dword [rsp + 0x6c], 1
lea ecx, [rbx + 0x12]
call fcn.140247068
mov r15, rax
test rdi, rdi
je 0x1400fc0ff
mov rcx, rdi
mov rdx, rax
sub rdx, rdi
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400fc0e2
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x48], r15
jmp 0x1400fc104
mov qword [rsp + 0x48], rax
test r15, r15
je 0x1400fc130
mov edx, ebx
movups xmm0, xmmword [r14]
movups xmmword [rdx + r15], xmm0
movzx ecx, word [r14 + 0x10]
mov word [rdx + r15 + 0x10], cx
mov rbx, rsi
inc rbx
cmp byte [r15 + rbx], 0
jne 0x1400fc122
mov dword [rsp + 0x50], ebx
test r14, r14
je 0x1400fc13d
mov rcx, r14
call fcn.140247060
mov qword [rsp + 0x58], r13
lea rax, [rbp - 0x70]
mov rdi, rsi
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400fc150
mov dword [rsp + 0x68], edi
lea eax, [rdi + 1]
mov r14d, eax
mov qword [rbp + 0x528], r14
mov ecx, eax
call fcn.140247068
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400fc18d
mov r8d, r14d
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x6c], 1
lea ecx, [rbx + 1]
add ecx, edi
call fcn.140247068
mov r14, rax
test r15, r15
je 0x1400fc1cd
mov rcx, r15
mov rdx, rax
sub rdx, r15
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400fc1b0
mov rcx, r15
call fcn.140247060
mov qword [rsp + 0x48], r14
jmp 0x1400fc1d2
mov qword [rsp + 0x48], rax
test r14, r14
je 0x1400fc1fe
mov ecx, ebx
add rcx, r14
mov r8, qword [rbp + 0x528]
mov rdx, r13
call fcn.1402496a0
mov rbx, rsi
nop
inc rbx
cmp byte [r14 + rbx], 0
jne 0x1400fc1f0
mov dword [rsp + 0x50], ebx
test r13, r13
je 0x1400fc20b
mov rcx, r13
call fcn.140247060
lea r13, vtable.CSABString.0
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x68], SafeArrayUnaccessData
mov ecx, SafeArrayUnaccessData
call fcn.140247068
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400fc253
movups xmm0, xmmword [str.__APPLICATIONPATH__r_n]
movups xmmword [rax], xmm0
mov ecx, dword [0x1402b73e8]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1402b73ec]
mov byte [rax + 0x14], cl
mov dword [rsp + 0x6c], 1
lea ecx, [rbx + 0x15]
call fcn.140247068
mov rdi, rax
test r14, r14
je 0x1400fc29d
mov rcx, r14
mov rdx, rax
sub rdx, r14
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400fc280
mov rcx, r14
call fcn.140247060
mov qword [rsp + 0x48], rdi
jmp 0x1400fc2a2
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x1400fc2d2
mov edx, ebx
movups xmm0, xmmword [r15]
movups xmmword [rdx + rdi], xmm0
mov ecx, dword [r15 + 0x10]
mov dword [rdx + rdi + 0x10], ecx
movzx eax, byte [r15 + 0x14]
mov byte [rdx + rdi + 0x14], al
mov rbx, rsi
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400fc2c5
mov dword [rsp + 0x50], ebx
test r15, r15
je 0x1400fc2df
mov rcx, r15
call fcn.140247060
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x68], reloc.COMCTL32.dll_InitCommonControls
mov ecx, send
call fcn.140247068
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400fc318
movups xmm0, xmmword [str._APPLICATIONNAME_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1402b7400]
mov word [rax + 0x10], cx
mov dword [rsp + 0x6c], 1
lea ecx, [rbx + 0x12]
call fcn.140247068
mov r14, rax
test rdi, rdi
je 0x1400fc35d
mov rcx, rdi
mov rdx, rax
sub rdx, rdi
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400fc340
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x48], r14
jmp 0x1400fc362
mov qword [rsp + 0x48], rax
test r14, r14
je 0x1400fc38e
mov edx, ebx
movups xmm0, xmmword [r15]
movups xmmword [rdx + r14], xmm0
movzx ecx, word [r15 + 0x10]
mov word [rdx + r14 + 0x10], cx
mov rax, rsi
inc rax
cmp byte [r14 + rax], 0
jne 0x1400fc380
mov dword [rsp + 0x50], eax
test r15, r15
je 0x1400fc39b
mov rcx, r15
call fcn.140247060
mov r13, qword [rbp + 0x520]
lea rdx, [r13 + 0x51c]
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rax, vtable.CSABString.0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x68], SafeArrayUnaccessData
mov ecx, SafeArrayUnaccessData
call fcn.140247068
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400fc3fb
movups xmm0, xmmword [str.__APPLICATIONNAME__r_n]
movups xmmword [rax], xmm0
mov ecx, dword [0x1402b7418]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1402b741c]
mov byte [rax + 0x14], cl
mov dword [rsp + 0x6c], 1
mov r15, qword [rsp + 0x48]
mov ebx, dword [rsp + 0x50]
lea ecx, [rbx + 0x15]
call fcn.140247068
mov rdi, rax
test r15, r15
je 0x1400fc44e
mov rdx, r15
mov r8, rax
sub r8, r15
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400fc430
mov rcx, r15
call fcn.140247060
mov qword [rsp + 0x48], rdi
jmp 0x1400fc453
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x1400fc483
mov edx, ebx
movups xmm0, xmmword [r14]
movups xmmword [rdx + rdi], xmm0
mov ecx, dword [r14 + 0x10]
mov dword [rdx + rdi + 0x10], ecx
movzx eax, byte [r14 + 0x14]
mov byte [rdx + rdi + 0x14], al
mov rbx, rsi
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400fc476
mov dword [rsp + 0x50], ebx
test r14, r14
je 0x1400fc490
mov rcx, r14
call fcn.140247060
lea rax, vtable.CSABString.0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x68], SafeArrayGetDim
mov ecx, SafeArrayGetDim
call fcn.140247068
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400fc4db
movsd xmm0, qword [str._COMPANYNAME_]
movsd qword [rax], xmm0
mov ecx, dword [0x1402b7428]
mov dword [rax + 8], ecx
movzx ecx, word [0x1402b742c]
mov word [rax + 0xc], cx
mov dword [rsp + 0x6c], 1
lea ecx, [rbx + 0xe]
call fcn.140247068
mov r14, rax
test rdi, rdi
je 0x1400fc51d
mov rcx, rdi
mov rdx, rax
sub rdx, rdi
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400fc500
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x48], r14
jmp 0x1400fc522
mov qword [rsp + 0x48], rax
test r14, r14
je 0x1400fc55e
mov edx, ebx
movsd xmm0, qword [r15]
movsd qword [rdx + r14], xmm0
mov ecx, dword [r15 + 8]
mov dword [rdx + r14 + 8], ecx
movzx eax, word [r15 + 0xc]
mov word [rdx + r14 + 0xc], ax
nop dword [rax + rax]
inc rsi
cmp byte [r14 + rsi], 0
jne 0x1400fc550
mov dword [rsp + 0x50], esi
test r15, r15
je 0x1400fc56b
mov rcx, r15
call fcn.140247060
lea rdx, [r13 + 0x418]
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str.__COMPANYNAME__r_n
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str._APPLICATIONID_
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, [r13 + 0x210]
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str.__APPLICATIONID__r_n
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str._APPLICATIONCLASS_
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, [r13 + 0x10c]
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str.__APPLICATIONCLASS__r_n
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str._DISPLAYUI_
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdi, [0x1402b3c20]
lea rbx, [0x1402b6c8c]
mov rdx, rbx
cmp dword [r13], 0
cmovne rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str.__DISPLAYUI__r_n
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str._UPDATECHECKONLY_
lea rcx, [rsp + 0x40]
call fcn.1400fba30
cmp dword [r13 + 4], 0
cmovne rbx, rdi
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str.__UPDATECHECKONLY__r_n
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str._PROCESSID_
lea rcx, [rsp + 0x40]
call fcn.1400fba30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x2c0]
call fcn.140249b10
mov r8d, 0xa
lea rdx, [rbp + 0x2c0]
mov ecx, ebx
call fcn.1402526d0
lea rdx, [rbp + 0x2c0]
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str.__PROCESSID__r_n
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str._STARTUPKEY_
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, [r13 + 0x620]
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str.__STARTUPKEY__r_n
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, str.__SSUPDATE_
lea rcx, [rsp + 0x40]
call fcn.1400fba30
lea rdx, [rbp + 0x3c0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rbp + 0xa0]
xor r8d, r8d
lea rdx, [0x1402b753c]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
lea rdx, [rbp + 0xa0]
call qword [rax + 0x88]
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, 0x40000000
lea rdx, [rbp + 0xa0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rbx, rax
mov r15, qword [rsp + 0x48]
cmp rax, 0xffffffffffffffff
je 0x1400fc7f1
mov rcx, qword [0x14037adb0]
mov r10, qword [rcx]
mov qword [rsp + 0x28], r12
lea rax, [rbp + 0x520]
mov qword [rsp + 0x20], rax
mov edi, dword [rsp + 0x50]
mov r9d, edi
mov r8, r15
mov rdx, rbx
call qword [r10 + PathResolve]
test eax, eax
je 0x1400fc903
cmp dword [rbp + 0x520], edi
jne 0x1400fc903
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x38]
lea rdx, [r13 + 0x724]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.SSUPDATE64.EXE
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1b0]
call qword [rax + 0xc0]
test eax, eax
je 0x1400fc9bd
lea r14, [0x140299514]
cmp dword [r13 + 4], 0
jne 0x1400fc995
mov rax, qword [0x14037adb0]
mov rbx, qword [rax + 0x10]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
cmp eax, 0x1000
je 0x1400fc879
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
cmp eax, 0x1001
jne 0x1400fc995
mov esi, r12d
mov ebx, r12d
mov edi, r12d
mov qword [rbp + 0x538], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x538]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400fc973
mov dword [rbp + 0x528], r12d
mov dword [rbp + 0x520], r12d
lea rax, [rbp + 0x520]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x530]
lea edx, [r9 + 0xe]
mov rcx, qword [rbp + 0x538]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400fc962
mov ecx, dword [rbp + 0x530]
sub ecx, 1
je 0x1400fc923
sub ecx, 1
je 0x1400fc918
cmp ecx, 1
jne 0x1400fc962
mov esi, ecx
mov edi, ecx
jmp 0x1400fc962
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x38]
jmp 0x1400fc9df
mov ebx, 1
mov esi, ebx
mov edi, ebx
jmp 0x1400fc962
lea rax, [rbp + 0x520]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x528]
lea edx, [r9 + 0x10]
mov rcx, qword [rbp + 0x538]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400fc962
mov ebx, r12d
cmp dword [rbp + 0x528], ebx
setne bl
mov edi, 1
mov rcx, qword [rbp + 0x538]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1400fc97b
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ebx, eax
test ebx, ebx
jne 0x1400fc995
test esi, esi
je 0x1400fc995
lea rax, str.RunAs
cmp dword [r13], ebx
cmove rax, r14
mov r14, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xa0]
lea r8, [rbp + 0x1b0]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x1400fc9d9
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, str.Cannot_Update
lea rdx, str.SSUPDATE.EXE_Not_Found__Please_reinstall_SUPERAntiSpyware.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r12d, 1
lea rax, vtable.CSABString.0
mov qword [rsp + 0x70], rax
add dword [rbp - 0x7c], 0xffffffff
jne 0x1400fca01
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400fca01
call fcn.140247060
nop
cmp dword [rsp + 0x54], 1
jne 0x1400fca15
test r15, r15
je 0x1400fca15
mov rcx, r15
call fcn.140247060
mov eax, r12d
add rsp, 0x5d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret