Function at 0x140007f94
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Encode data using xor
Get file attributes
Log keystrokes via polling
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3c0
lea rcx, [0x14000629c]
call qword [sym.imp.msvcrt.dll_int____cdecl___unsigned_long_long_unsigned___int64_____cdecl__set_new_handler_int____cdecl___unsigned_long_long_unsigned___int64___]
call fcn.140002530
lea rcx, [rsp + 0x2a0]
mov dword [rsp + 0x2a0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edi, edi
cmp eax, edi
je 0x14000a2f7
cmp dword [rsp + 0x2b0], 2
jne 0x14000a2f7
cmp dword [rsp + 0x2a4], 5
jb 0x14000a2f7
or dword [rsp + 0xe8], 0xffffffff
or dword [rsp + 0xec], 0xffffffff
lea rax, [0x140021f34]
lea ebx, [rdi + 3]
lea rcx, [rsp + 0x58]
mov byte [str.___InstallEnd__], 0x3b
mov edx, ebx
mov byte [str.___Install__UTF_8_], 0x3b
mov rbp, rax
mov qword [rsp + 0x100], rax
mov byte [rsp + 0x31], dil
mov byte [rsp + 0x30], dil
mov byte [rsp + 0x33], dil
mov r14b, dil
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x64], edi
call fcn.1400011b8
lea rcx, [rsp + 0x110]
mov edx, ebx
mov qword [rsp + 0x110], rdi
mov dword [rsp + 0x118], edi
mov dword [rsp + 0x11c], edi
call fcn.1400011b8
lea rax, [0x140021be0]
lea ebx, [rdi + 1]
lea rcx, [rsp + 0xf0]
mov edx, ebx
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0xb4], edi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], 8
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xfc], edi
call fcn.1400011b8
mov rax, qword [rsp + 0xf0]
mov word [rax], 0x20
mov rax, qword [rsp + 0xf0]
mov word [rax + 2], di
mov dword [rsp + 0xf8], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.140006bc0
lea rcx, [rsp + 0xf0]
mov rdx, rax
call fcn.1400031ac
lea rcx, [rsp + 0xf0]
call fcn.140003bbc
mov r15, qword [rsp + 0xf0]
add r15, 2
mov rcx, r15
mov r12, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x140020bb8]
mov r8d, ebx
movsxd rcx, eax
lea r13, [r15 + rcx*2]
lea rcx, str.SfxVarModulePlatform
call fcn.1400044d8
call fcn.140002e30
lea rcx, str.SfxVarSystemPlatform
mov rdx, rax
mov r8d, ebx
call fcn.1400044d8
lea rcx, str.SfxVarCmdLine0
mov r8d, ebx
mov rdx, r15
call fcn.1400044d8
call fcn.140005e28
cmp dword [rsp + 0x64], 0x20
jg 0x1400081a7
lea edx, [rdi + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400011b8
mov rsi, qword [rsp + 0x58]
movzx r8d, word [0x140026d38]
lea rdx, [0x1400222bc]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
cmp word [rsi], di
mov r11d, edi
je 0x1400081db
mov rax, rsi
add rax, 2
add r11d, ebx
cmp word [rax], di
jne 0x1400081cf
movsxd rax, r11d
lea rcx, str.SfxVarSystemLanguage
mov r8d, ebx
mov rdx, rsi
mov dword [rsp + 0x60], r11d
mov word [rsi + rax*2], di
call fcn.1400044d8
lea rdx, str.sfxlang
mov rcx, r15
call fcn.140006210
cmp rax, rdi
je 0x14000825a
cmp word [rax], 0x3a
jne 0x14000825a
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll__wtol]
movzx edx, word [0x140026d38]
lea ecx, [rax - 1]
cmp ecx, 0xfffe
cmovbe dx, ax
mov word [0x140026d38], dx
jmp 0x14000823e
add r15, 2
cmp word [r15], 0x20
ja 0x14000823a
jmp 0x140008251
cmp ax, 0x20
ja 0x14000825a
add r15, 2
movzx eax, word [r15]
cmp ax, di
jne 0x140008247
lea rdx, str.sfxversion
mov rcx, r15
call fcn.140006210
cmp rax, rdi
je 0x140008278
call fcn.140007154
jmp 0x14000a034
lea rdx, str.sfxwaitall
mov rcx, r15
call fcn.140006210
cmp rax, rdi
je 0x14000829b
mov rcx, rax
call fcn.1400077bc
mov edi, eax
jmp 0x14000a034
lea rdx, str.sfxelevation
mov rcx, r15
mov bpl, dil
call fcn.140006210
cmp rax, rdi
je 0x1400082cc
mov bpl, bl
jmp 0x1400082c1
cmp cx, 0x20
ja 0x1400082c9
add rax, 2
movzx ecx, word [rax]
cmp cx, di
jne 0x1400082b7
mov r15, rax
mov ebx, 0x208
lea rax, [0x140026e28]
cmp dword [0x140026e34], ebx
jg 0x1400082ea
mov edx, ebx
mov rcx, rax
call fcn.1400011b8
mov rdx, qword [0x140026e28]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, edi
jne 0x140008317
mov edx, 6
lea ecx, [rdx - 5]
call fcn.14000d318
mov edi, 1
jmp 0x14000a034
mov rdx, qword [0x140026e28]
mov ecx, edi
cmp word [rdx], di
je 0x140008334
mov rax, rdx
add rax, 2
add ecx, 1
cmp word [rax], di
jne 0x140008328
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140026e30], ecx
lea rdx, str.sfxtest
mov rcx, r15
call fcn.140006210
cmp rax, rdi
mov rbx, rax
je 0x140008563
cmp word [rax], 0x3a
je 0x14000836c
mov edi, 0x64
jmp 0x14000a034
movzx edx, word [rax + 2]
mov ecx, edx
or ecx, 0x20
sub ecx, 0x61
je 0x14000849d
sub ecx, 2
je 0x140008485
mov r15d, 1
sub ecx, r15d
je 0x140008402
sub ecx, 0xb
je 0x1400083a6
cmp ecx, 7
jne 0x140008362
mov edi, 0x4a98
jmp 0x14000a034
cmp word [rax + 4], 0x3a
jne 0x14000a034
movzx ecx, word [rax + 6]
sub ecx, 0x31
je 0x1400083fa
sub ecx, r15d
je 0x1400083f0
sub ecx, r15d
je 0x1400083e6
sub ecx, r15d
je 0x1400083dc
cmp ecx, r15d
jne 0x14000a034
mov edi, 7
jmp 0x14000a034
mov edi, 0x2ff
jmp 0x14000a034
mov edi, 0x1f
jmp 0x14000a034
mov edi, 0xb7
jmp 0x14000a034
mov edi, r15d
jmp 0x14000a034
cmp edx, 0x44
jne 0x140008447
cmp word [rax + 4], 0x3a
jne 0x140008362
add rbx, 6
jmp 0x140008431
cmp ax, 0x3a
je 0x14000843a
lea rcx, [0x140026e88]
movzx edx, ax
call fcn.1400018ec
add rbx, 2
movzx eax, word [rbx]
cmp ax, 0x20
ja 0x140008418
cmp dword [0x140026e90], edi
jne 0x14000844b
jmp 0x140008362
add rbx, 4
mov dword [0x140026e80], edi
cmp word [rbx], 0x3a
jne 0x140008472
lea rcx, [rbx + 2]
call qword [sym.imp.msvcrt.dll__wtol]
cmp eax, 0xe10
mov dword [0x140026e80], eax
ja 0x140008472
cmp eax, edi
jne 0x14000847c
mov dword [0x140026e80], 0xa
mov dword [0x140026e84], r15d
jmp 0x1400084ad
movzx eax, word [rax + 4]
sub ax, 0x63
neg ax
sbb eax, eax
add eax, 4
mov dword [0x140026e84], eax
jmp 0x1400084ad
mov dword [0x140026e84], 2
jmp 0x1400084ad
add rbx, 2
cmp word [rbx], 0x20
ja 0x1400084a9
jmp 0x1400084bf
cmp ax, 0x20
ja 0x1400084c7
add rbx, 2
movzx eax, word [rbx]
cmp ax, di
jne 0x1400084b5
lea rdx, str.sfxconfig
mov rcx, rbx
mov r15, rbx
call fcn.140006210
cmp rax, rdi
je 0x140008563
cmp word [rax], 0x3a
jne 0x1400084f4
jmp 0x1400084f0
cmp cx, 0x20
ja 0x1400084fc
add rax, 2
movzx ecx, word [rax]
cmp cx, di
jne 0x1400084ea
lea rdx, [rsp + 0x58]
mov rcx, rax
mov dword [rsp + 0x60], edi
mov word [rsi], di
call fcn.140006bc0
cmp dword [0x140026e84], 2
mov r15, rax
je 0x140008563
mov rcx, qword [0x140026e28]
mov ebx, dword [rsp + 0x60]
mov dword [0x140026e30], edi
mov word [rcx], di
lea rcx, [0x140026e28]
mov edx, ebx
call fcn.1400011b8
mov rcx, qword [rsp + 0x58]
mov rdx, qword [0x140026e28]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx], ax
add rdx, 2
cmp ax, di
jne 0x14000854a
mov dword [0x140026e30], ebx
lea rcx, [0x140026dd8]
lea rbx, [0x140026e28]
cmp rbx, rcx
je 0x1400085bf
mov rax, qword [0x140026dd8]
mov dword [0x140026de0], edi
mov word [rax], di
mov edx, dword [0x140026e30]
call fcn.1400011b8
mov r11, qword [0x140026e28]
mov rcx, qword [0x140026dd8]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x14000859f
mov eax, dword [0x140026e30]
mov dword [0x140026de0], eax
lea rsi, [0x140026de8]
cmp rbx, rsi
je 0x140008617
mov rax, qword [0x140026de8]
mov dword [0x140026df0], edi
mov rcx, rsi
mov word [rax], di
mov edx, dword [0x140026e30]
call fcn.1400011b8
mov r11, qword [0x140026e28]
mov rcx, qword [0x140026de8]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x1400085f7
mov eax, dword [0x140026e30]
mov dword [0x140026df0], eax
mov rcx, rbx
call fcn.1400040cc
cmp eax, edi
jl 0x14000873e
mov rcx, qword [0x140026dd8]
movsxd rbx, eax
mov word [rcx + rbx*2], di
mov dword [0x140026de0], eax
mov rax, qword [0x140026e28]
lea rdx, [rax + rbx*2 + 2]
mov rcx, rsi
call fcn.140001424
mov r11, qword [0x140026e28]
lea rsi, [0x140026e08]
lea rdx, [r11 + rbx*2 + 2]
mov rcx, rsi
call fcn.140001424
movsxd r11, dword [0x140026e10]
cmp r11d, edi
je 0x1400086ae
mov rdx, qword [0x140026e08]
lea rcx, [rdx + r11*2 - 2]
jmp 0x140008691
cmp rcx, rdx
je 0x140008783
sub rcx, 2
cmp word [rcx], 0x2e
jne 0x140008684
sub rcx, rdx
sar rcx, 1
cmp ecx, edi
jle 0x1400086ae
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140026e10], ecx
lea rbx, [0x140026df8]
cmp rsi, rbx
je 0x140008706
mov rax, qword [0x140026df8]
mov dword [0x140026e00], edi
mov rcx, rbx
mov word [rax], di
mov edx, dword [0x140026e10]
call fcn.1400011b8
mov r11, qword [0x140026e08]
mov rcx, qword [0x140026df8]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x1400086e6
mov eax, dword [0x140026e10]
mov dword [0x140026e00], eax
mov ecx, 4
call fcn.140002bb8
mov rcx, rbx
mov rdx, rax
call fcn.1400031ac
mov r11, qword [0x140026e08]
mov rax, qword [0x140026df8]
mov qword [0x140026d78], r11
mov qword [0x140026d88], rax
mov qword [0x140026d90], r11
call fcn.140002e30
lea rcx, [0x140026e18]
mov rdx, rax
call fcn.140001424
mov ecx, 0x20
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
mov rbx, rax
je 0x14000878b
mov dword [rax + 0x10], edi
lea rax, [0x140021ef0]
mov qword [rbx], rax
lea rax, [0x140021ed0]
mov qword [rbx + 8], rax
or qword [rbx + 0x18], 0xffffffffffffffff
jmp 0x14000878e
or ecx, 0xffffffff
jmp 0x14000869d
mov rbx, rdi
cmp rbx, rdi
je 0x14000879c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
mov rdx, qword [0x140026e28]
lea rcx, [rbx + 0x18]
call fcn.1400144e0
cmp al, dil
jne 0x1400087dd
mov r8, qword [0x140026e28]
mov edx, 7
lea ecx, [rdx - 6]
call fcn.14000d318
cmp rbx, rdi
je 0x1400087d3
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 2
jmp 0x14000a034
mov esi, 3
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rdi
mov edx, esi
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x84], edi
call fcn.140002f88
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.1400055a4
cmp al, dil
jne 0x14000883c
lea edx, [rsi + 6]
xor ecx, ecx
call fcn.14000d318
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008835
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, esi
jmp 0x14000a034
cmp dword [0x140026e84], edi
jne 0x1400088ea
lea rdx, str.sfxconfig
mov rcx, r15
call fcn.140006210
cmp rax, rdi
je 0x1400088ea
cmp word [rax], 0x3a
jne 0x14000886a
add rax, 2
movzx ecx, word [rax]
cmp cx, di
je 0x1400088c9
cmp cx, 0x20
ja 0x140008884
add rax, 2
mov cx, word [rax]
cmp cx, di
jne 0x140008872
cmp word [rax], di
je 0x1400088c9
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.140007bd0
cmp al, dil
jne 0x1400088c9
mov edx, 0xa
xor ecx, ecx
call fcn.14000d318
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400088bf
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 4
jmp 0x14000a034
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000a034
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x14000a034
lea rcx, [rsp + 0xa8]
call fcn.1400149d8
cmp dword [rsp + 0x80], edi
je 0x14000891a
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x78]
xor r8d, r8d
call fcn.1400046b8
cmp al, dil
je 0x1400088a7
cmp dword [0x140026e84], 4
je 0x1400088c9
mov eax, dword [0x140026060]
lea rsi, [0x140026060]
jmp 0x14000896a
lea rdx, str.SfxString_d
lea rcx, [rsp + 0x240]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsi]
call fcn.140002bb8
lea rcx, [rsp + 0x240]
xor r8d, r8d
mov rdx, rax
call fcn.1400044d8
add rsi, 0x20
mov eax, dword [rsi]
cmp eax, edi
jne 0x140008932
lea rcx, [rsp + 0xa8]
call fcn.140006c50
lea rdx, [0x140020b00]
lea rcx, str.SfxVarCmdLine2
mov r8d, 1
sub r15, 2
call fcn.1400044d8
jmp 0x14000899e
add r15, 2
cmp word [r15], 0x20
ja 0x14000899a
jmp 0x1400089b1
cmp ax, 0x20
ja 0x1400089ba
add r15, 2
movzx eax, word [r15]
cmp ax, di
jne 0x1400089a7
cmp word [r15], 0x2f
je 0x1400089cc
cmp word [r15], 0x2d
jne 0x140008cd6
cmp word [r15 + 2], 0x21
je 0x140008cca
lea rdx, [0x1400221f8]
lea rcx, [r15 + 2]
call fcn.140005fd8
cmp rax, rdi
je 0x140008a40
lea rax, [r15 + 6]
cmp word [rax], 0x30
jb 0x1400089fd
cmp word [rax], 0x39
jbe 0x140008a15
cmp word [rax], 0x61
jb 0x140008a09
cmp word [rax], 0x7a
jbe 0x140008a15
cmp word [rax], 0x41
jb 0x140008a2d
cmp word [rax], 0x5a
ja 0x140008a2d
mov qword [rsp + 0x100], rax
mov al, 1
mov byte [rsp + 0x31], 1
mov byte [rsp + 0x30], al
jmp 0x14000899e
cmp word [rax], 0x20
ja 0x140008cd6
lea rax, [0x140021f34]
jmp 0x140008a15
lea rdx, [0x1400221f0]
lea rcx, [r15 + 2]
call fcn.140005fd8
cmp rax, rdi
je 0x140008a65
lea rdx, [r15 + 6]
lea rcx, str.OverwriteMode
jmp 0x140008bbe
lea rdx, [0x1400221e8]
lea rcx, [r15 + 2]
call fcn.140005fd8
cmp rax, rdi
je 0x140008aaa
lea rdx, [r15 + 6]
cmp word [rdx], 0x30
jb 0x140008cd6
cmp word [rdx], 0x32
ja 0x140008cd6
cmp word [r15 + 8], 0x20
ja 0x140008cd6
lea rcx, str.GUIMode
jmp 0x140008bbe
lea rdx, [0x1400221e0]
lea rcx, [r15 + 2]
call fcn.140005fd8
cmp rax, rdi
je 0x140008acf
lea rdx, [r15 + 6]
lea rcx, str.GUIFlags
jmp 0x140008bbe
lea rdx, [0x1400221d8]
lea rcx, [r15 + 2]
call fcn.140005fd8
cmp rax, rdi
je 0x140008af4
lea rdx, [r15 + 6]
lea rcx, str.MiscFlags
jmp 0x140008bbe
lea rdx, [0x1400221d0]
lea rcx, [r15 + 2]
call fcn.140005fd8
cmp rax, rdi
je 0x140008b35
lea rdx, [r15 + 6]
cmp word [rdx], 0x30
je 0x140008b1d
cmp word [rdx], 0x31
jne 0x140008cd6
cmp word [r15 + 8], 0x20
ja 0x140008cd6
lea rcx, str.SelfDelete
jmp 0x140008bbe
lea rdx, [0x1400221c8]
lea rcx, [r15 + 2]
call fcn.140005fd8
cmp rax, rdi
je 0x140008b60
cmp word [r15 + 6], 0x20
ja 0x140008cd6
mov byte [rsp + 0x33], 1
jmp 0x14000899e
lea rdx, [0x1400221c0]
lea rcx, [r15 + 2]
call fcn.140005fd8
cmp rax, rdi
je 0x140008b9e
lea rcx, [r15 + 6]
cmp word [rcx], 0x30
jb 0x140008cd6
cmp word [rcx], 0x39
ja 0x140008cd6
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140026634], eax
jmp 0x14000899e
lea rdx, [0x1400221b8]
lea rcx, [r15 + 2]
call fcn.140005fd8
cmp rax, rdi
je 0x140008bd0
lea rdx, [r15 + 8]
lea rcx, str.BeginPromptTimeout
lea r8, [rsp + 0xa8]
call fcn.140006f8c
jmp 0x14000899e
cmp word [r15 + 2], 0x70
je 0x140008c53
cmp word [r15 + 2], 0x50
je 0x140008c53
cmp word [r15 + 2], 0x79
je 0x140008bf0
cmp word [r15 + 2], 0x59
jne 0x140008c03
cmp word [r15 + 4], 0x20
ja 0x140008c03
mov al, 1
mov byte [rsp + 0x31], al
jmp 0x14000899e
cmp word [r15 + 2], 0x3f
je 0x140008c1b
cmp word [r15 + 2], 0x68
je 0x140008c1b
cmp word [r15 + 2], 0x48
jne 0x140008c2b
cmp word [r15 + 4], 0x20
ja 0x140008c2b
mov r14b, 1
jmp 0x14000899e
lea rdx, [rsp + 0xa8]
lea rcx, [r15 + 2]
call fcn.140006670
cmp rax, rdi
je 0x140008cd6
cmp rax, 1
je 0x140008ca8
mov r15, rax
jmp 0x14000899e
lea rcx, [rsp + 0x38]
mov edx, 3
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], edi
call fcn.1400011b8
lea rcx, [r15 + 4]
lea rdx, [rsp + 0x38]
call fcn.140006bc0
mov rdx, qword [rsp + 0x38]
lea rcx, [0x140026d28]
lea r15, [rax - 2]
call fcn.140001424
mov rcx, qword [rsp + 0x38]
mov byte [0x140026d24], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x14000899e
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008cc0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 0x20
jmp 0x14000a034
mov rsi, r15
add r15, 4
cmp rsi, rdi
jne 0x140008cd9
mov rsi, r15
cmp r12, rsi
je 0x140008d79
lea rcx, [rsp + 0x98]
mov rdx, r12
call fcn.140003140
sub rsi, r12
lea rdx, [rsp + 0x38]
sar rsi, 1
xor r8d, r8d
mov rcx, rax
mov r9d, esi
call fcn.1400068e8
mov rax, qword [rsp + 0x58]
mov esi, dword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov edx, esi
mov dword [rsp + 0x60], edi
mov word [rax], di
call fcn.1400011b8
mov rcx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x58]
mov rdx, rcx
sub r8, rcx
movzx eax, word [rdx]
mov word [rdx + r8], ax
add rdx, 2
cmp ax, di
jne 0x140008d37
mov dword [rsp + 0x60], esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x58]
call fcn.140007b64
lea rcx, [rsp + 0x58]
call fcn.140007af8
mov rdx, qword [rsp + 0x58]
jmp 0x140008d80
lea rdx, [0x140020b00]
lea rcx, str.SfxVarCmdLine1
mov r8d, 1
call fcn.1400044d8
lea rcx, [rsp + 0x98]
mov rdx, r15
call fcn.140003140
sub r13, r15
lea rdx, [rsp + 0x38]
sar r13, 1
xor r8d, r8d
mov rcx, rax
mov r9d, r13d
call fcn.1400068e8
mov rax, qword [rsp + 0x58]
mov esi, dword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov edx, esi
mov dword [rsp + 0x60], edi
mov word [rax], di
call fcn.1400011b8
mov rcx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x58]
mov rdx, rcx
mov r13d, 2
sub r8, rcx
movzx eax, word [rdx]
mov word [rdx + r8], ax
add rdx, r13
cmp ax, di
jne 0x140008ded
mov dword [rsp + 0x60], esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x58]
call fcn.140007b64
lea rcx, [rsp + 0x58]
call fcn.140007af8
mov rdx, qword [rsp + 0x58]
lea rcx, str.SfxVarCmdLine2
mov r8d, 1
call fcn.1400044d8
lea rcx, [rsp + 0xa8]
call fcn.140006c50
cmp bpl, dil
jne 0x14000905b
test byte [0x140026da4], 4
je 0x14000905b
call fcn.140002e68
cmp eax, edi
jne 0x14000905b
mov esi, 3
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov edx, esi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], edi
call fcn.1400011b8
lea rcx, [rsp + 0x98]
mov edx, esi
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0xa0], edi
mov dword [rsp + 0xa4], edi
call fcn.1400011b8
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.140006bc0
lea rcx, [rsp + 0x38]
mov rdx, rax
call fcn.140003140
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x100]
mov dx, 0x22
call fcn.140006a1c
lea r8, [0x140021fc0]
lea rcx, [rsp + 0x120]
mov rdx, rax
call fcn.140006a80
lea r8, str.sfxelevation
lea rcx, [rsp + 0x68]
mov rdx, rax
call fcn.140006a80
lea rcx, [rsp + 0x88]
mov r8w, 0x20
mov rdx, rax
call fcn.140006aec
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0xd8]
mov rdx, rax
call fcn.140001978
mov rsi, rax
lea rax, [rsp + 0x98]
cmp rsi, rax
je 0x140008f90
mov rcx, qword [rsp + 0x98]
mov dword [rsp + 0xa0], edi
mov word [rcx], di
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x98]
call fcn.1400011b8
mov r11, qword [rsi]
mov rsi, qword [rsp + 0x98]
mov rcx, rsi
movzx eax, word [r11]
add r11, r13
mov word [rcx], ax
add rcx, r13
cmp ax, di
jne 0x140008f7c
jmp 0x140008f98
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x88]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x120]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r8d, r8d
mov edx, r13d
mov rcx, rsi
call fcn.140007280
mov rcx, qword [rsp + 0x38]
cmp eax, edi
jne 0x14000903f
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140009035
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 0xb
jmp 0x14000a034
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400088c9
mov dword [rsp + 0xcc], edi
jmp 0x1400090b1
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.140003140
mov rsi, qword [rsp + 0x38]
mov dx, 0x3d
mov rcx, rsi
call fcn.140014844
mov rcx, rsi
cmp eax, edi
jle 0x1400090d7
movsxd rdx, eax
xor r8d, r8d
mov dword [rsp + 0x40], eax
mov word [rsi + rdx*2], di
lea rdx, [rbp + rdx*2 + 2]
call fcn.1400044d8
add dword [rsp + 0xcc], 1
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r8, [rsp + 0xcc]
lea rdx, str.SetEnvironment
lea rcx, [rsp + 0xa8]
call fcn.140003e70
cmp rax, rdi
mov rbp, rax
jne 0x140009064
jmp 0x1400090dc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
call fcn.1400065b4
mov r11d, dword [0x140026628]
cmp r11d, 0xffffffff
cmove r11d, edi
cmp r14b, dil
mov dword [0x140026628], r11d
je 0x140009186
lea rdx, str.HelpText
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e70
cmp rax, rdi
mov rsi, rax
jne 0x14000912c
mov ecx, 0x18
call fcn.140002bb8
mov rsi, rax
lea rcx, [rsp + 0x190]
call fcn.14000b800
mov r8, qword [0x140026d78]
lea r11, [0x140021ac0]
lea rcx, [rsp + 0x190]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x190], r11
mov dword [rsp + 0x1e0], 0x7d6
mov qword [rsp + 0x20], rdi
call fcn.14000b894
lea rcx, [rsp + 0x190]
call fcn.14000b490
jmp 0x1400088c9
mov r12b, byte [rsp + 0x31]
cmp r12b, dil
je 0x14000919c
btr r11d, 8
mov dword [0x140026628], r11d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, str.InstallPath
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e70
lea r14, [0x140026dc8]
cmp rax, rdi
je 0x1400091d2
mov rdx, rax
mov rcx, r14
call fcn.140001424
mov rcx, r14
call fcn.140005f68
lea rdx, str.SfxAuthor
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e70
cmp rax, rdi
mov rsi, rax
je 0x14000931d
lea rcx, [rsp + 0x190]
call fcn.14000e8f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x190]
mov rdx, rsi
movsxd r8, eax
add r8, r8
call fcn.14000eb50
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x190]
call fcn.14000eca0
lea rcx, [rsp + 0x210]
lea rdx, str.123456789ABCDEFGHJKMNPQRSTUVWXYZ
mov r8d, 0x21
call sub.msvcrt.dll_memcpy
mov r11, rdi
mov eax, dword [rsp + r11*4 + 0x140]
add r11, 1
xor dword [rsp + r11*4 + 0x12c], eax
cmp r11, 4
jl 0x14000925b
mov r10d, edi
mov r9d, edi
lea r8, [rsp + 0x240]
mov eax, r9d
cdq
and edx, 7
add eax, edx
mov ecx, eax
and eax, 7
sar ecx, 3
sub eax, edx
movsxd rcx, ecx
movzx r11d, byte [rsp + rcx + 0x130]
mov cl, al
shr r11d, cl
and r11d, 0x1f
cmp r9d, edi
je 0x1400092d7
mov eax, 0x51eb851f
imul r9d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x19
cmp r9d, edx
jne 0x1400092d7
mov word [r8], 0x2d
add r10d, 1
add r8, r13
movsxd rax, r11d
add r9d, 5
add r10d, 1
movsx edx, byte [rsp + rax + 0x210]
mov word [r8], dx
add r8, r13
cmp r9d, 0x7d
jl 0x140009283
movsxd rax, r10d
lea rdx, [rsp + 0x240]
lea rcx, [0x140026d28]
mov word [rsp + rax*2 + 0x240], di
call fcn.140001424
mov byte [0x140026d24], 1
lea rdx, str.BeginPromptTimeout
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e70
cmp rax, rdi
je 0x140009348
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140026db0], eax
cmp dword [0x140026e90], edi
je 0x140009380
lea rcx, [rsp + 0xa8]
call fcn.14000d580
mov rcx, qword [rsp + 0x78]
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008835
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + InitCommonControls]
jmp 0x140008835
cmp dword [0x140026e84], 3
jne 0x140009398
lea rcx, [rsp + 0xa8]
call fcn.14000d45c
jmp 0x14000935d
test byte [0x140026da4], 8
jne 0x1400093cf
mov rcx, rbx
call fcn.140001678
cmp eax, edi
jne 0x1400093cf
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400093c5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 5
jmp 0x14000a034
mov sil, byte [rsp + 0x30]
lea rdx, str.BeginPrompt
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e70
cmp rax, rdi
je 0x14000943a
cmp r12b, dil
jne 0x14000943a
mov rcx, qword [0x140026d78]
mov rdx, rax
call fcn.14000c3b8
cmp eax, edi
je 0x1400093ad
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14000942a
mov r12b, 1
mov byte [rsp + 0x31], r12b
mov sil, r12b
mov byte [rsp + 0x30], r12b
cmp dword [0x140026e60], edi
je 0x14000943a
btr dword [0x140026628], 7
lea rcx, [rsp + 0x88]
mov edx, 3
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x90], edi
mov dword [rsp + 0x94], edi
call fcn.1400011b8
cmp sil, dil
mov rbp, qword [rsp + 0x100]
je 0x14000951b
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x88]
call fcn.140001424
movzx edx, word [rbp]
lea rcx, [rsp + 0x88]
call fcn.1400018ec
mov rsi, qword [rsp + 0x88]
lea rcx, [rsp + 0xa8]
mov rdx, rsi
xor r8d, r8d
call fcn.140003e70
cmp rax, rdi
je 0x1400095e9
add rbp, r13
cmp word [rbp], 0x30
jb 0x1400094cd
cmp word [rbp], 0x39
jbe 0x140009473
cmp word [rbp], 0x61
jb 0x1400094db
cmp word [rbp], 0x7a
jbe 0x140009473
cmp word [rbp], 0x41
jb 0x1400094e9
cmp word [rbp], 0x5a
jbe 0x140009473
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x88]
call fcn.140001424
mov rbp, qword [rsp + 0x100]
lea rcx, [rsp + 0x88]
movzx edx, word [rbp]
call fcn.1400018ec
mov sil, byte [rsp + 0x30]
cmp dword [rsp + 0x90], edi
mov byte [rsp + 0x32], dil
jne 0x140009597
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e70
cmp rax, rdi
je 0x140009567
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0x88]
call fcn.140001424
cmp dword [rsp + 0x90], edi
mov byte [rsp + 0x32], 1
jne 0x140009597
lea rdx, str.RunProgram
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e70
cmp rax, rdi
je 0x140009597
lea rdx, str.RunProgram
lea rcx, [rsp + 0x88]
call fcn.140001424
cmp sil, dil
jne 0x14000962c
cmp r12b, dil
jne 0x14000962c
mov eax, dword [0x140026628]
and ax, 0xc0
cmp al, 0x80
jne 0x14000962c
mov rdx, qword [0x140026d60]
mov rcx, qword [0x140026d68]
call fcn.14000c49c
cmp eax, edi
jne 0x14000962c
cmp byte [0x140026db4], dil
mov rcx, qword [rsp + 0x88]
je 0x140009622
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400093d4
mov r8, rsi
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000d318
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140009618
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 6
jmp 0x14000a034
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400093ad
mov edx, dword [0x140026dd0]
cmp edx, edi
jne 0x1400096aa
lea rdx, str.7ZipSfx._03x
lea rcx, [rsp + 0x38]
call fcn.140006478
cmp rax, r14
mov rsi, rax
je 0x14000968f
mov rcx, qword [0x140026dc8]
mov dword [0x140026dd0], edi
mov word [rcx], di
mov edx, dword [rax + 8]
mov rcx, r14
call fcn.1400011b8
mov r11, qword [rsi]
mov rcx, qword [0x140026dc8]
movzx eax, word [r11]
add r11, r13
mov word [rcx], ax
add rcx, r13
cmp ax, di
jne 0x140009674
mov eax, dword [rsi + 8]
mov dword [0x140026dd0], eax
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov sil, byte [rsp + 0x30]
mov byte [0x140026d40], dil
jmp 0x14000974e
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], edi
call fcn.1400011b8
mov r11, qword [0x140026dc8]
mov rcx, qword [rsp + 0x48]
movzx eax, word [r11]
add r11, r13
mov word [rcx], ax
add rcx, r13
cmp ax, di
jne 0x1400096cd
mov eax, dword [0x140026dd0]
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x50], eax
call fcn.140005f68
cmp dword [rsp + 0x50], edi
jne 0x14000973d
mov rax, qword [0x140026dc8]
mov dword [0x140026dd0], edi
mov rcx, r14
mov word [rax], di
mov edx, dword [rsp + 0x50]
call fcn.1400011b8
mov r11, qword [rsp + 0x48]
mov rcx, qword [0x140026dc8]
movzx eax, word [r11]
add r11, r13
mov word [rcx], ax
add rcx, r13
cmp ax, di
jne 0x140009721
mov eax, dword [rsp + 0x50]
mov dword [0x140026dd0], eax
mov rcx, qword [rsp + 0x48]
mov byte [0x140026d40], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
movsxd rcx, dword [0x140026dd0]
mov rdx, qword [0x140026dc8]
cmp word [rdx + rcx*2 - 2], 0x5c
je 0x14000976c
cmp word [rdx + rcx*2 - 2], 0x2f
jne 0x14000977c
add ecx, 0xffffffff
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140026dd0], ecx
cmp r12b, dil
je 0x140009788
or dword [0x140026da4], 3
cmp dword [0x140026e80], edi
jne 0x14000979d
mov rdx, r14
mov rcx, rbx
call fcn.140001cf4
jmp 0x1400097ab
call fcn.14000c534
cmp eax, edi
jne 0x1400097f3
mov eax, 0x80004005
cmp eax, edi
je 0x1400097f3
cmp byte [0x140026d40], dil
jne 0x1400097c4
mov rcx, qword [0x140026dc8]
call fcn.140003fd0
mov rcx, qword [rsp + 0x88]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400097e9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 8
jmp 0x14000a034
call fcn.1400065b4
mov r13b, byte [rsp + 0x33]
cmp r13b, dil
je 0x140009818
cmp byte [0x140026d40], dil
je 0x140009818
mov r14, qword [rsp + 0x88]
jmp 0x14000a155
lea rcx, [rsp + 0x48]
mov edx, 3
mov dword [rsp + 0xc8], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], edi
call fcn.1400011b8
cmp sil, dil
jne 0x140009852
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xa8]
call fcn.140006b58
mov byte [rsp + 0x34], dil
mov rsi, rbp
mov qword [rsp + 0x120], rbp
mov r14, qword [rsp + 0x88]
lea rcx, [rsp + 0x68]
mov edx, 3
mov dword [rsp + 0xd0], edi
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x74], edi
call fcn.1400011b8
lea rcx, [rsp + 0xd8]
mov edx, 3
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], edi
mov dword [rsp + 0xe4], edi
call fcn.1400011b8
cmp dword [rsp + 0x90], edi
mov r13d, edi
jne 0x140009999
cmp byte [0x140026d40], dil
jne 0x140009f8e
lea r8, [0x140020d44]
lea rdx, [0x140026dc8]
lea rcx, [rsp + 0x150]
lea rbp, str.setup.exe
call fcn.140006a80
lea r8, str.setup.exe
lea rcx, [rsp + 0x160]
mov rdx, rax
call fcn.140006a80
mov rsi, rax
lea rax, [rsp + 0x68]
cmp rsi, rax
je 0x14000995e
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x70], edi
mov word [rcx], di
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x68]
call fcn.1400011b8
mov r12, qword [rsp + 0x68]
mov r11, qword [rsi]
mov rcx, r12
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140009941
mov eax, dword [rsi + 8]
mov dword [rsp + 0x70], eax
jmp 0x140009963
mov r12, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x160]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x150]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140009f25
mov byte [rsp + 0x34], 1
jmp 0x140009a3d
lea r8, [rsp + 0xc8]
lea rcx, [rsp + 0xa8]
mov rdx, r14
call fcn.140003e70
cmp rax, rdi
mov rbp, rax
jne 0x140009a38
add rsi, 2
mov qword [rsp + 0x120], rsi
cmp word [rsi], 0x30
jb 0x1400099d1
cmp word [rsi], 0x39
jbe 0x1400099f1
cmp word [rsi], 0x61
jb 0x1400099dd
cmp word [rsi], 0x7a
jbe 0x1400099f1
cmp word [rsi], 0x41
jb 0x140009f8e
cmp word [rsi], 0x5a
ja 0x140009f8e
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x88]
call fcn.140001424
movzx edx, word [rsi]
lea rcx, [rsp + 0x88]
call fcn.1400018ec
mov rcx, qword [rsp + 0xd8]
mov dword [rsp + 0xc8], edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140009862
mov r12, qword [rsp + 0x68]
lea rcx, [rsp + 0xd8]
mov rdx, rbp
call fcn.140001424
lea rcx, [rsp + 0xd8]
call fcn.140005fac
mov rsi, qword [rsp + 0xd8]
mov r12w, 0x3a
lea rdx, str.waitall
mov rcx, rsi
call fcn.140005fd8
cmp rax, rdi
je 0x140009a99
cmp word [rax], r12w
jne 0x140009a87
add rax, 2
jmp 0x140009a8a
mov rax, rdi
cmp rax, rdi
je 0x140009a99
mov rsi, rax
mov byte [rsp + 0x30], 1
jmp 0x140009a67
lea rdx, str.hidcon
mov rcx, rsi
call fcn.140005fd8
cmp rax, rdi
je 0x140009aca
cmp word [rax], r12w
jne 0x140009ab9
add rax, 2
jmp 0x140009abc
mov rax, rdi
cmp rax, rdi
je 0x140009aca
mov rsi, rax
or r13d, 1
jmp 0x140009a67
lea rdx, str.nowait
mov rcx, rsi
call fcn.140005fd8
cmp rax, rdi
je 0x140009b04
cmp word [rax], r12w
jne 0x140009aea
add rax, 2
jmp 0x140009aed
mov rax, rdi
cmp rax, rdi
je 0x140009b04
cmp byte [0x140026d40], dil
mov rsi, rax
je 0x140009a67
jmp 0x140009b2f
lea rdx, str.forcenowait
mov rcx, rsi
call fcn.140005fd8
cmp rax, rdi
je 0x140009b39
cmp word [rax], r12w
jne 0x140009b24
add rax, 2
jmp 0x140009b27
mov rax, rdi
cmp rax, rdi
je 0x140009b39
mov rsi, rax
bts r13d, 0x10
jmp 0x140009a67
lea rdx, [0x1400221c0]
mov r8d, 2
mov rcx, rsi
call fcn.140006034
cmp rax, rdi
mov rbp, rax
je 0x140009b77
cmp dword [0x140026634], 0xffffffff
jne 0x140009b6f
lea rcx, [rsi + 4]
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140026634], eax
mov rsi, rbp
jmp 0x140009a67
lea rdx, [0x1400220d0]
mov r8d, 3
mov rcx, rsi
call fcn.140006034
cmp rax, rdi
je 0x140009baa
movzx r14d, word [rsi + 6]
mov rsi, rax
sub r14d, 0x30
mov dword [rsp + 0xe8], r14d
jmp 0x140009a67
lea rdx, [0x1400220c8]
mov r8d, 3
mov rcx, rsi
call fcn.140006034
cmp rax, rdi
je 0x140009bdd
movzx r12d, word [rsi + 6]
mov rsi, rax
sub r12d, 0x30
mov dword [rsp + 0xec], r12d
jmp 0x140009a62
lea rdx, [0x140020bc0]
mov rcx, rsi
call fcn.140005fd8
cmp rax, rdi
je 0x140009c05
cmp word [rax], r12w
jne 0x140009bfd
add rax, 2
jmp 0x140009c00
mov rax, rdi
cmp rax, rdi
jne 0x140009c2d
lea rdx, str.i386
mov rcx, rsi
call fcn.140005fd8
cmp rax, rdi
je 0x140009c40
cmp word [rax], r12w
jne 0x140009c25
add rax, 2
jmp 0x140009c28
mov rax, rdi
cmp rax, rdi
je 0x140009c40
mov rsi, rax
mov dword [rsp + 0xd0], 1
jmp 0x140009a67
lea rdx, str.amd64
mov rcx, rsi
call fcn.140005fd8
cmp rax, rdi
je 0x140009c68
cmp word [rax], r12w
jne 0x140009c60
add rax, 2
jmp 0x140009c63
mov rax, rdi
cmp rax, rdi
jne 0x140009c90
lea rdx, [0x140020bb8]
mov rcx, rsi
call fcn.140005fd8
cmp rax, rdi
je 0x140009ca3
cmp word [rax], r12w
jne 0x140009c88
add rax, 2
jmp 0x140009c8b
mov rax, rdi
cmp rax, rdi
je 0x140009ca3
mov rsi, rax
mov dword [rsp + 0xd0], 2
jmp 0x140009a67
cmp byte [rsp + 0x32], dil
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x88]
lea rcx, [rsp + 0x68]
je 0x140009d28
cmp word [rsi], 0x22
je 0x140009cee
lea rdx, [0x140021f28]
call fcn.140001424
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.1400031ac
lea rdx, [0x140021f28]
lea rcx, [rsp + 0x68]
call fcn.1400031ac
jmp 0x140009cf6
mov rdx, rsi
call fcn.140001424
lea rdx, str.ExecuteParameters
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e70
cmp rax, rdi
mov rsi, rax
je 0x140009d6d
lea rdx, [0x1400220a0]
lea rcx, [rsp + 0x68]
call fcn.1400031ac
jmp 0x140009d60
mov word [r12], di
mov edx, dword [rsp + 0x50]
mov dword [rsp + 0x70], edi
call fcn.1400011b8
mov r11, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140009d44
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.1400031ac
lea rcx, [rsp + 0x98]
mov edx, 3
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0xa0], edi
mov dword [rsp + 0xa4], edi
call fcn.1400011b8
mov rsi, qword [rsp + 0x68]
lea rdx, [rsp + 0x98]
mov rcx, rsi
call fcn.140006bc0
lea rcx, [rsp + 0x38]
mov rdx, rax
call fcn.140003140
lea rcx, [rsp + 0x98]
call fcn.140005fac
cmp dword [0x140026e84], edi
jne 0x140009ec2
mov ecx, dword [rsp + 0xd0]
call fcn.140002e54
cmp eax, edi
je 0x140009ec2
cmp word [r15], di
je 0x140009e03
lea rcx, [rsp + 0x38]
mov rdx, r15
call fcn.1400031ac
jmp 0x140009dfd
add r15, 2
cmp word [r15], di
jne 0x140009df9
lea rcx, [rsp + 0x38]
call fcn.140005fac
mov al, byte [rsp + 0x30]
cmp al, dil
jne 0x140009ea5
lea r8, [rsp + 0x98]
lea rcx, [rsp + 0x180]
mov dx, 0x22
call fcn.140006a1c
lea r8, [0x140021f9c]
lea rcx, [rsp + 0x170]
mov rdx, rax
call fcn.140006a80
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x130]
mov rdx, rax
call fcn.140001978
mov rcx, qword [rsp + 0x170]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x180]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rbp, qword [rsp + 0x130]
mov r8, qword [0x140026dc8]
mov rcx, rbp
mov edx, r13d
call fcn.140007280
mov rcx, rbp
cmp eax, edi
je 0x140009fa5
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140009ec2
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x98]
mov r8d, r13d
call fcn.1400073dc
cmp eax, edi
jne 0x140009fac
cmp byte [rsp + 0x32], dil
jne 0x14000a088
cmp byte [rsp + 0x34], dil
jne 0x14000a088
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x50], edi
mov word [rax], di
mov rcx, qword [rsp + 0x38]
add dword [rsp + 0xc8], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rsi, qword [rsp + 0x120]
jmp 0x14000986a
cmp byte [0x140026d40], dil
jne 0x140009f3a
mov rcx, qword [0x140026dc8]
call fcn.140003fd0
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000d318
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400083d2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x1400083d2
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
jmp 0x14000a0af
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140009fb4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, InitCommonControls
mov r8, rsi
lea ecx, [rdx - 0xf]
call fcn.14000d318
cmp byte [0x140026d40], dil
jne 0x140009fd9
mov rcx, qword [0x140026dc8]
call fcn.140003fd0
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000a02f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 9
mov rcx, qword [rsp + 0xf0]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x140021be0]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.1400149d8
lea rcx, [rsp + 0xa8]
call fcn.140014ac4
mov rcx, qword [rsp + 0x110]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, edi
jmp 0x14000a318
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp dword [0x140026e84], edi
jne 0x14000a141
call fcn.1400065b4
mov eax, dword [rsp + 0xe8]
mov rbp, qword [rsp + 0x100]
lea r8, str.Shortcut
lea rdx, [rsp + 0xa8]
lea rcx, [0x140007e78]
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.140007008
mov rcx, qword [0x140026dd8]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [rsp + 0xec]
lea r8, str.Delete
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0xa8]
lea rcx, [0x1400067a8]
mov r9, rbp
call fcn.140007008
cmp byte [0x140026d40], dil
jne 0x14000a141
mov rcx, qword [0x140026dc8]
call fcn.140003fd0
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r12b, byte [rsp + 0x31]
mov r13b, byte [rsp + 0x33]
mov eax, dword [0x140026634]
cmp eax, 0xffffffff
jne 0x14000a174
cmp r12b, dil
jne 0x14000a206
mov eax, 1
mov dword [0x140026634], eax
cmp eax, edi
jle 0x14000a206
lea rdx, str.FinishMessage
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e70
cmp rax, rdi
mov rsi, rax
je 0x14000a206
mov ecx, dword [0x140026634]
mov eax, 0x3e7
cmp ecx, eax
cmovg ecx, eax
mov dword [0x140026634], ecx
lea rcx, [rsp + 0x190]
call fcn.14000b800
mov r8, qword [0x140026d78]
lea r11, [0x140021b80]
lea rcx, [rsp + 0x190]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x190], r11
mov dword [rsp + 0x1e0], 0x7d5
mov qword [rsp + 0x20], rdi
call fcn.14000b894
lea rcx, [rsp + 0x190]
call fcn.14000b490
cmp r13b, dil
jne 0x14000a286
cmp dword [0x140026e84], edi
jne 0x14000a286
lea rdx, str.SelfDelete
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e70
cmp rax, rdi
je 0x14000a286
cmp word [rax], 0x31
jne 0x14000a286
mov edx, dword [0x140026e30]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], edi
call fcn.1400011b8
mov r11, qword [0x140026e28]
mov rcx, qword [rsp + 0x38]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x14000a25e
mov eax, dword [0x140026e30]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x40], eax
call fcn.140007824
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000a2a6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov rcx, qword [rsp + 0xf0]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x140021be0]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.1400149d8
lea rcx, [rsp + 0xa8]
call fcn.140014ac4
mov rcx, qword [rsp + 0x110]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
jmp 0x14000a318
lea r8, [0x140021b40]
lea rdx, str.Sorry__this_program_requires_Microsoft_Windows_2000_or_later.
mov r9d, InitCommonControls
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x14
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret