Function at 0x140004e60
Capabilities:
Check if file exists
Create process on windows
Enumerate processes
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x308]
sub rsp, 0x408
mov rax, qword [0x140067040]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov qword [rsp + 0x78], r9
mov qword [rbp + 0x30], r8
mov rsi, rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rcx
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], ax
lea rcx, [rbp + 0x58]
call fcn.140003390
nop
mov r13, qword [rsi + 0x10]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
mov rcx, qword [rbp + 0x68]
sub rax, rcx
mov qword [rsp + 0x68], rax
cmp rax, r13
jb 0x140005a71
lea r12, [rbp + 0x58]
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x48], rax
mov rdx, qword [rbp + 0x70]
mov qword [rsp + 0x40], rdx
cmp rdx, 7
cmova r12, rax
mov qword [rsp + 0x60], rsi
cmp qword [rsi + 0x18], 7
jbe 0x140004f1e
mov rax, qword [rsi]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r15, [rcx + r13]
mov ebx, 7
lea r14, [rsp + 0x20]
lea eax, [rbx + 3]
cmp r15, rbx
jbe 0x140004f83
mov rbx, r15
or rbx, 7
cmp rbx, rdi
jbe 0x140004f56
mov rbx, rdi
jmp 0x140004f5d
cmp rbx, rax
cmovb rbx, rax
inc rbx
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x20]
call fcn.14001b6c0
mov r14, rax
dec rbx
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x68]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbx
lea rbx, [rcx + rcx]
mov qword [rsp + 0x58], rbx
mov r8, rbx
mov rdx, r12
mov rcx, r14
call fcn.14004bcc0
lea rcx, [rbx + r14]
lea r8, [r13*2]
mov rdx, qword [rsp + 0x60]
call fcn.14004bcc0
xor r13d, r13d
mov word [r14 + r15*2], r13w
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004fe6
test al, 0x10
jne 0x140004fe6
mov bl, 1
jmp 0x140004fe8
xor bl, bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000502a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005025
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a77
call fcn.140028848
test bl, bl
je 0x140005140
mov r12, qword [rsi + 0x10]
cmp qword [rsp + 0x68], r12
jb 0x140005a7d
lea r13, [rbp + 0x58]
cmp qword [rsp + 0x40], 7
cmova r13, qword [rsp + 0x48]
cmp qword [rsi + 0x18], 7
jbe 0x14000505b
mov rsi, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov r15, qword [rbp + 0x68]
add r15, r12
mov ebx, 7
lea r14, [rsp + 0x20]
cmp r15, rbx
jbe 0x1400050b9
mov rbx, r15
or rbx, 7
cmp rbx, rdi
jbe 0x14000508a
mov rbx, rdi
jmp 0x140005097
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
inc rbx
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14001b6c0
mov r14, rax
dec rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbx
mov rbx, qword [rsp + 0x58]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.14004bcc0
lea rcx, [rbx + r14]
lea r8, [r12 + r12]
mov rdx, rsi
call fcn.14004bcc0
xor r13d, r13d
mov word [r14 + r15*2], r13w
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000512e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005129
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005aa1
call fcn.140028848
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbp + 0x20], xmm1
cmp qword [rbp + 0x20], 0
jne 0x14000525a
mov r13, qword [rbp + 0x30]
mov r15, qword [r13 + 0x10]
cmp qword [rsp + 0x68], r15
jb 0x140005a7d
lea r12, [rbp + 0x58]
cmp qword [rsp + 0x40], 7
cmova r12, qword [rsp + 0x48]
cmp qword [r13 + 0x18], 7
jbe 0x140005179
mov r13, qword [r13]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov r14, qword [rbp + 0x68]
add r14, r15
mov ebx, 7
lea rsi, [rsp + 0x20]
cmp r14, rbx
jbe 0x1400051d3
mov rax, r14
or rax, rbx
cmp rax, rdi
ja 0x1400051b2
mov rdi, rax
cmp rax, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rbx, [rdi + 1]
mov qword [rbp + 0x30], rbx
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14001b6c0
mov rsi, rax
dec rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
mov rbx, qword [rsp + 0x58]
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call fcn.14004bcc0
lea rcx, [rsi + rbx]
lea r8, [r15 + r15]
mov rdx, r13
call fcn.14004bcc0
xor r13d, r13d
mov word [rsi + r14*2], r13w
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140005248
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005243
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005aa1
call fcn.140028848
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbp + 0x20], xmm1
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400059ca
test al, 0x10
jne 0x1400059ca
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rdx, [0x14005a920]
lea rcx, [rbp + 0x38]
call fcn.14000bbc0
nop
mov qword [rbp - 0x60], 0x70
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rax, qword [rbp + 0x38]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], r13
mov dword [rbp - 0x30], r13d
mov qword [rbp - 0x28], r13
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rbx, qword [rbp + 8]
mov qword [rbp + 0x30], rbx
cmp rbx, 0xffffffffffffffff
jne 0x140005558
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
test eax, eax
je 0x140005558
lea r9, [rbp + 0x2ea]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140005311
lea r8, [rbp + 0x2ea]
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140015a80
nop
lea r8, [rsp + 0x20]
lea rdx, str.Error_while_launching_installer._Got_error:
lea rcx, [rbp - 0x80]
call fcn.14000e6c0
xorps xmm0, xmm0
mov rcx, qword [rsp + 0x50]
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], r13
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov byte [rcx + 0x20], 1
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1400053e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a83
call fcn.140028848
movdqa xmm0, xmmword [0x14005d240]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r13w
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140005434
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000542f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a89
call fcn.140028848
movdqa xmm0, xmmword [0x14005d240]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r13w
cmp rbx, 0xffffffffffffffff
je 0x140005458
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x140005498
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005493
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a8f
call fcn.140028848
movdqa xmm0, xmmword [0x14005d240]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r13w
mov rax, qword [rsp + 0x40]
cmp rax, 7
jbe 0x1400054ed
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a95
call fcn.140028848
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000552d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005528
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a9b
call fcn.140028848
mov rbx, qword [rsp + 0x50]
mov rax, rbx
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.1400284c0
add rsp, 0x408
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r15d, 0xea60
xor r12b, r12b
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r14
mov qword [rbp + 0x30], rbx
cmp r14, 0xffffffffffffffff
jne 0x140005631
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140005631
mov rax, qword [0x14006a060]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
lea r8d, [r14 + 0x17]
lea rdx, str.Error_getting_snapshot
lea rcx, [rsp + 0x20]
call fcn.140010660
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [0x14006a060]
call rdi
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000583d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005627
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005aa7
call fcn.140028848
jmp 0x14000583d
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x84]
call fcn.14004c440
mov dword [rbp + 0x80], 0x238
lea rdx, [rbp + 0x80]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400057b4
mov r8d, 0xffffffff
mov r13, qword [rsp + 0x78]
mov rdx, r13
lea rcx, [rbp + 0x80]
call fcn.140003f90
movzx edi, al
mov esi, 0xffffffff
test al, al
cmovne esi, dword [rbp + 0x88]
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x84]
call fcn.14004c440
mov dword [rbp + 0x80], 0x238
lea rdx, [rbp + 0x80]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400056e9
mov r8d, esi
mov rdx, r13
lea rcx, [rbp + 0x80]
call fcn.140003f90
or dil, al
jmp 0x1400056a0
or r12b, dil
test dil, dil
jne 0x14000583a
test r12b, r12b
jne 0x14000593e
mov eax, 0xd1b71759
mul r15d
shr edx, 0xc
imul ecx, edx, 0x1388
xor r13d, r13d
cmp r15d, ecx
jne 0x14000579d
mov rax, qword [0x14006a060]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
lea r8d, [r13 + 0x13]
lea rdx, str.Giving_it_more_time
lea rcx, [rsp + 0x20]
call fcn.140010660
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [0x14006a060]
call rdi
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000579d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005798
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005aad
call fcn.140028848
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
sub r15d, 0xc8
jmp 0x14000583d
mov rax, qword [0x14006a060]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov r8d, 0x19
lea rdx, str.Error_getting_first_entry
lea rcx, [rsp + 0x20]
call fcn.140010660
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [0x14006a060]
call rdi
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000583d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005833
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005ab9
call fcn.140028848
jmp 0x14000583d
xor r13d, r13d
test r15d, r15d
jg 0x140005570
mov rbx, qword [rsp + 0x50]
mov byte [rbx + 0x20], 0
cmp r14, 0xffffffffffffffff
je 0x14000585f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000589f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000589a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005aa1
call fcn.140028848
movdqa xmm0, xmmword [0x14005d240]
movdqu xmmword [rbp + 0x48], xmm0
xor eax, eax
mov word [rbp + 0x38], ax
mov rax, qword [rsp + 0x40]
cmp rax, 7
jbe 0x1400058f5
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400058ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a65
call fcn.140028848
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140005532
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005934
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a6b
call fcn.140028848
jmp 0x140005532
mov rax, qword [0x14006a060]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x3b
lea rdx, str.Waited_and_no_more_processes_to_wait__it_seems._Bailing_out
lea rcx, [rsp + 0x20]
call fcn.140010660
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [0x14006a060]
call rbx
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140005846
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005ab3
call fcn.140028848
jmp 0x140005846
lea rdx, str.Installer_not_found_
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.14000bbc0
mov byte [rbx + 0x20], 1
mov rax, qword [rsp + 0x40]
cmp rax, 7
jbe 0x140005a21
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a65
call fcn.140028848
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140005532
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005934
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a6b
jmp 0x140005934
call fcn.140035764
nop
call fcn.140035764
nop
call fcn.140001340
int3
call fcn.140035764
int3
call fcn.140001340
nop
call fcn.140035764
nop
call fcn.140035764
nop
call fcn.140035764
nop
call fcn.140035764
nop
call fcn.140035764
nop
call fcn.140035764
nop
call fcn.140035764
int3
call fcn.140035764
int3
call fcn.140035764
int3
call fcn.140035764
int3