Function at 0x14001f920
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x510
mov qword [rsp + 0x420], 0xfffffffffffffffe
mov rax, qword [0x1400311e8]
xor rax, rsp
mov qword [rsp + 0x508], rax
lea rcx, [rsp + 0x38]
call fcn.140004760
nop
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x1e0], rax
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x210], rax
mov rdx, qword [rsp + 0x538]
mov rcx, qword [rsp + 0x1e0]
call fcn.140004810
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x430], rax
mov rdx, qword [rsp + 0x530]
mov rcx, qword [rsp + 0x210]
call fcn.140004810
mov qword [rsp + 0x438], rax
mov r9, qword [rsp + 0x430]
mov r8, qword [rsp + 0x438]
lea rdx, [rsp + 0x218]
mov rcx, qword [rsp + 0x520]
call fcn.14001e7d0
mov qword [rsp + 0x440], rax
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x448], rax
mov rdx, qword [rsp + 0x448]
lea rcx, [rsp + 0x38]
call fcn.140004880
nop
lea rcx, [rsp + 0x218]
call fcn.140004860
lea rax, [rsp + 0x240]
mov qword [rsp + 0x268], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x298], rax
mov rdx, qword [rsp + 0x528]
mov rcx, qword [rsp + 0x268]
call fcn.140004810
mov qword [rsp + 0x450], rax
mov rax, qword [rsp + 0x450]
mov qword [rsp + 0x458], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x298]
call fcn.140004810
mov qword [rsp + 0x460], rax
mov r8, qword [rsp + 0x458]
mov rdx, qword [rsp + 0x460]
mov rcx, qword [rsp + 0x520]
call fcn.14001e1b0
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jne 0x14001fb1b
mov edx, dword [rsp + 0x60]
lea rcx, str.DLL:_installType:__d._Hi_Suite_need_not_update
call fcn.14001a560
mov dword [rsp + 0x2a0], 1
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x2a0]
jmp 0x140020909
cmp dword [rsp + 0x60], 1
jne 0x1400201ed
mov rdx, qword [rsp + 0x520]
add rdx, 0x60
lea r8, [0x140027bb0]
lea rcx, [rsp + 0x90]
call fcn.140008880
nop
lea rcx, [rsp + 0x90]
call fcn.140004a40
mov rdx, rax
mov rcx, qword [rsp + 0x520]
call fcn.14001f260
mov rax, qword [rsp + 0x520]
cmp dword [rax + 0x1a4], 0
jne 0x1400200bc
mov rax, qword [rsp + 0x520]
mov edx, dword [rax + 0x1a4]
lea rcx, [0x140027bc8]
call fcn.14001a560
mov dword [rsp + 0xe4], 0
mov dword [rsp + 0xe0], 0
mov rdx, qword [rsp + 0x520]
add rdx, 0x1f8
lea r8, [0x140027584]
lea rcx, [rsp + 0x2a8]
call fcn.140008880
mov qword [rsp + 0x468], rax
mov rax, qword [rsp + 0x468]
mov qword [rsp + 0x470], rax
mov r8, qword [rsp + 0x520]
add r8, 0x1d0
mov rdx, qword [rsp + 0x470]
lea rcx, [rsp + 0x2d0]
call fcn.140008ac0
mov qword [rsp + 0x478], rax
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0x480], rax
lea r8, [0x140027be0]
mov rdx, qword [rsp + 0x480]
lea rcx, [rsp + 0x2f8]
call fcn.140008880
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x490], rax
mov r8, qword [rsp + 0x520]
add r8, 0x220
mov rdx, qword [rsp + 0x490]
lea rcx, [rsp + 0xb8]
call fcn.140008ac0
nop
lea rcx, [rsp + 0x2f8]
call fcn.140004860
nop
lea rcx, [rsp + 0x2d0]
call fcn.140004860
nop
lea rcx, [rsp + 0x2a8]
call fcn.140004860
mov rcx, qword [rsp + 0x520]
call fcn.14001eed0
test eax, eax
je 0x14001fcfb
mov rcx, qword [rsp + 0x520]
add rcx, 0x298
call fcn.140004a40
mov rbx, rax
lea rcx, [rsp + 0xb8]
call fcn.140004a40
mov word [rsp + 0x20], 0
mov r9d, 0x100033
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExA]
mov dword [rsp + 0xe4], eax
jmp 0x14001fd41
mov rcx, qword [rsp + 0x520]
add rcx, 0x298
call fcn.140004a40
mov rbx, rax
lea rcx, [rsp + 0xb8]
call fcn.140004a40
mov word [rsp + 0x20], 0
mov r9d, 0x33
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExA]
mov dword [rsp + 0xe4], eax
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x498], eax
cmp dword [rsp + 0x498], 2
je 0x14002003c
cmp dword [rsp + 0x498], 6
je 0x14001fd7a
cmp dword [rsp + 0x498], 7
je 0x14001fe45
jmp 0x1400200af
mov rcx, qword [rsp + 0x520]
add rcx, 0x1d0
call fcn.140004a40
mov r8, rax
mov dword [rsp + 0x28], 1
lea rax, [0x140027502]
mov qword [rsp + 0x20], rax
lea r9, [0x140027503]
lea rdx, [0x140027be8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [rsp + 0x520]
add rcx, 0x1d0
call fcn.140004a40
mov rdx, rax
lea rcx, [0x140027bf0]
call fcn.14001a560
mov dword [rsp + 0x320], 0
lea rcx, [rsp + 0xb8]
call fcn.140004860
nop
lea rcx, [rsp + 0x90]
call fcn.140004860
nop
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x320]
jmp 0x140020909
mov rcx, qword [rsp + 0x520]
add rcx, 0x1d0
call fcn.140004a40
mov rdx, rax
lea rcx, [0x140027c20]
call fcn.14001a560
mov rdx, qword [rsp + 0x520]
add rdx, 0x248
lea r8, [0x1400275b4]
lea rcx, [rsp + 0x328]
call fcn.140008880
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
mov r8, qword [rsp + 0x520]
add r8, 0x270
mov rdx, qword [rsp + 0x4a8]
lea rcx, [rsp + 0xe8]
call fcn.140008ac0
nop
lea rcx, [rsp + 0x328]
call fcn.140004860
mov rcx, qword [rsp + 0x520]
call fcn.14001eed0
test eax, eax
je 0x14001ff2e
mov rcx, qword [rsp + 0x520]
add rcx, 0x298
call fcn.140004a40
mov rbx, rax
lea rcx, [rsp + 0xe8]
call fcn.140004a40
mov word [rsp + 0x20], 0
mov r9d, 0x100034
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExA]
mov dword [rsp + 0xe0], eax
jmp 0x14001ff74
mov rcx, qword [rsp + 0x520]
add rcx, 0x298
call fcn.140004a40
mov rbx, rax
lea rcx, [rsp + 0xe8]
call fcn.140004a40
mov word [rsp + 0x20], 0
mov r9d, 0x34
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExA]
mov dword [rsp + 0xe0], eax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x4b0], eax
cmp dword [rsp + 0x4b0], 6
je 0x14001ff9b
cmp dword [rsp + 0x4b0], 7
je 0x14001ffac
jmp 0x14002002d
lea rcx, [0x140027c58]
call fcn.14001a560
jmp 0x14002002d
lea rcx, [0x140027c78]
call fcn.14001a560
mov dword [rsp + 0x350], 0
lea rcx, [rsp + 0xe8]
call fcn.140004860
nop
lea rcx, [rsp + 0xb8]
call fcn.140004860
nop
lea rcx, [rsp + 0x90]
call fcn.140004860
nop
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x350]
jmp 0x140020909
lea rcx, [rsp + 0xe8]
call fcn.140004860
jmp 0x1400200af
lea rcx, [0x140027ca0]
call fcn.14001a560
mov dword [rsp + 0x354], 0
lea rcx, [rsp + 0xb8]
call fcn.140004860
nop
lea rcx, [rsp + 0x90]
call fcn.140004860
nop
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x354]
jmp 0x140020909
lea rcx, [rsp + 0xb8]
call fcn.140004860
mov r8, qword [rsp + 0x520]
add r8, 0xd8
mov rdx, qword [rsp + 0x520]
add rdx, 0x60
lea rcx, [rsp + 0x68]
call fcn.140008ac0
nop
lea rcx, [rsp + 0x68]
call fcn.140004a40
mov rdx, rax
mov rcx, qword [rsp + 0x520]
call fcn.14001f870
test eax, eax
jne 0x140020174
mov edx, dword [rsp + 0x60]
lea rcx, str.DLL:_installType:__d.InstallingHi_Suite_programm_failed
call fcn.14001a560
mov dword [rsp + 0x358], 0
lea rcx, [rsp + 0x68]
call fcn.140004860
nop
lea rcx, [rsp + 0x90]
call fcn.140004860
nop
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x358]
jmp 0x140020909
mov edx, dword [rsp + 0x60]
lea rcx, [0x140027d10]
call fcn.14001a560
mov dword [rsp + 0x35c], 1
lea rcx, [rsp + 0x68]
call fcn.140004860
nop
lea rcx, [rsp + 0x90]
call fcn.140004860
nop
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x35c]
jmp 0x140020909
cmp dword [rsp + 0x60], 2
jne 0x1400208c3
mov rdx, qword [rsp + 0x520]
add rdx, 0x60
lea r8, [0x140027d50]
lea rcx, [rsp + 0x138]
call fcn.140008880
nop
lea rcx, [rsp + 0x138]
call fcn.140004a40
mov rdx, rax
mov rcx, qword [rsp + 0x520]
call fcn.14001f260
mov rax, qword [rsp + 0x520]
cmp dword [rax + 0x1a4], 0
jne 0x14002078e
mov rax, qword [rsp + 0x520]
mov edx, dword [rax + 0x1a4]
lea rcx, str.g_bWMP11Installed___d.
call fcn.14001a560
mov dword [rsp + 0x18c], 0
mov dword [rsp + 0x188], 0
mov rdx, qword [rsp + 0x520]
add rdx, 0x1f8
lea r8, [0x1400275cc]
lea rcx, [rsp + 0x360]
call fcn.140008880
mov qword [rsp + 0x4b8], rax
mov rax, qword [rsp + 0x4b8]
mov qword [rsp + 0x4c0], rax
mov r8, qword [rsp + 0x520]
add r8, 0x1d0
mov rdx, qword [rsp + 0x4c0]
lea rcx, [rsp + 0x388]
call fcn.140008ac0
mov qword [rsp + 0x4c8], rax
mov rax, qword [rsp + 0x4c8]
mov qword [rsp + 0x4d0], rax
lea r8, str.___n_n
mov rdx, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x3b0]
call fcn.140008880
mov qword [rsp + 0x4d8], rax
mov rax, qword [rsp + 0x4d8]
mov qword [rsp + 0x4e0], rax
mov r8, qword [rsp + 0x520]
add r8, 0x220
mov rdx, qword [rsp + 0x4e0]
lea rcx, [rsp + 0x160]
call fcn.140008ac0
nop
lea rcx, [rsp + 0x3b0]
call fcn.140004860
nop
lea rcx, [rsp + 0x388]
call fcn.140004860
nop
lea rcx, [rsp + 0x360]
call fcn.140004860
mov rcx, qword [rsp + 0x520]
call fcn.14001eed0
test eax, eax
je 0x1400203cd
mov rcx, qword [rsp + 0x520]
add rcx, 0x298
call fcn.140004a40
mov rbx, rax
lea rcx, [rsp + 0x160]
call fcn.140004a40
mov word [rsp + 0x20], 0
mov r9d, 0x100033
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExA]
mov dword [rsp + 0x18c], eax
jmp 0x140020413
mov rcx, qword [rsp + 0x520]
add rcx, 0x298
call fcn.140004a40
mov rbx, rax
lea rcx, [rsp + 0x160]
call fcn.140004a40
mov word [rsp + 0x20], 0
mov r9d, 0x33
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExA]
mov dword [rsp + 0x18c], eax
mov eax, dword [rsp + 0x18c]
mov dword [rsp + 0x4e8], eax
cmp dword [rsp + 0x4e8], 2
je 0x14002070e
cmp dword [rsp + 0x4e8], 6
je 0x14002044c
cmp dword [rsp + 0x4e8], 7
je 0x140020517
jmp 0x140020781
mov rcx, qword [rsp + 0x520]
add rcx, 0x1d0
call fcn.140004a40
mov r8, rax
mov dword [rsp + 0x28], 1
lea rax, [0x140027506]
mov qword [rsp + 0x20], rax
lea r9, [0x140027507]
lea rdx, [0x140027d88]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [rsp + 0x520]
add rcx, 0x1d0
call fcn.140004a40
mov rdx, rax
lea rcx, str.User_choose__Yes__to_download_WMP11_from__s.
call fcn.14001a560
mov dword [rsp + 0x3d8], 0
lea rcx, [rsp + 0x160]
call fcn.140004860
nop
lea rcx, [rsp + 0x138]
call fcn.140004860
nop
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x3d8]
jmp 0x140020909
mov rcx, qword [rsp + 0x520]
add rcx, 0x1d0
call fcn.140004a40
mov rdx, rax
lea rcx, str.User_choose__No__to_skip_downloading_WMP11_from__s.
call fcn.14001a560
mov rdx, qword [rsp + 0x520]
add rdx, 0x248
lea r8, [0x1400275fc]
lea rcx, [rsp + 0x3e0]
call fcn.140008880
mov qword [rsp + 0x4f0], rax
mov rax, qword [rsp + 0x4f0]
mov qword [rsp + 0x4f8], rax
mov r8, qword [rsp + 0x520]
add r8, 0x270
mov rdx, qword [rsp + 0x4f8]
lea rcx, [rsp + 0x190]
call fcn.140008ac0
nop
lea rcx, [rsp + 0x3e0]
call fcn.140004860
mov rcx, qword [rsp + 0x520]
call fcn.14001eed0
test eax, eax
je 0x140020600
mov rcx, qword [rsp + 0x520]
add rcx, 0x298
call fcn.140004a40
mov rbx, rax
lea rcx, [rsp + 0x190]
call fcn.140004a40
mov word [rsp + 0x20], 0
mov r9d, 0x100034
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExA]
mov dword [rsp + 0x188], eax
jmp 0x140020646
mov rcx, qword [rsp + 0x520]
add rcx, 0x298
call fcn.140004a40
mov rbx, rax
lea rcx, [rsp + 0x190]
call fcn.140004a40
mov word [rsp + 0x20], 0
mov r9d, 0x34
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExA]
mov dword [rsp + 0x188], eax
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x500], eax
cmp dword [rsp + 0x500], 6
je 0x14002066d
cmp dword [rsp + 0x500], 7
je 0x14002067e
jmp 0x1400206ff
lea rcx, str.User_choose__Yes__to_continue.
call fcn.14001a560
jmp 0x1400206ff
lea rcx, str.User_choose__No__to_exit_the_program.
call fcn.14001a560
mov dword [rsp + 0x408], 0
lea rcx, [rsp + 0x190]
call fcn.140004860
nop
lea rcx, [rsp + 0x160]
call fcn.140004860
nop
lea rcx, [rsp + 0x138]
call fcn.140004860
nop
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x408]
jmp 0x140020909
lea rcx, [rsp + 0x190]
call fcn.140004860
jmp 0x140020781
lea rcx, str.User_choose__Cancel__to_exit_the_program.
call fcn.14001a560
mov dword [rsp + 0x40c], 0
lea rcx, [rsp + 0x160]
call fcn.140004860
nop
lea rcx, [rsp + 0x138]
call fcn.140004860
nop
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x40c]
jmp 0x140020909
lea rcx, [rsp + 0x160]
call fcn.140004860
mov r8, qword [rsp + 0x520]
add r8, 0xd8
mov rdx, qword [rsp + 0x520]
add rdx, 0x60
lea rcx, [rsp + 0x110]
call fcn.140008ac0
nop
lea rcx, [rsp + 0x110]
call fcn.140004a40
mov rdx, rax
mov rcx, qword [rsp + 0x520]
call fcn.14001f870
test eax, eax
jne 0x14002084f
mov edx, dword [rsp + 0x60]
lea rcx, str.DLL:_installType:__d.Installing_Hi_Suite_programm_failed
call fcn.14001a560
mov dword [rsp + 0x410], 0
lea rcx, [rsp + 0x110]
call fcn.140004860
nop
lea rcx, [rsp + 0x138]
call fcn.140004860
nop
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x410]
jmp 0x140020909
mov edx, dword [rsp + 0x60]
lea rcx, str.DLL:_installType:__d_.Installing_Hi_Suite_programm_successed
call fcn.14001a560
mov dword [rsp + 0x414], 1
lea rcx, [rsp + 0x110]
call fcn.140004860
nop
lea rcx, [rsp + 0x138]
call fcn.140004860
nop
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x414]
jmp 0x140020909
mov dword [rsp + 0x418], 1
lea rcx, [rsp + 0x38]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x528]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x530]
call fcn.140004860
nop
mov rcx, qword [rsp + 0x538]
call fcn.140004860
mov eax, dword [rsp + 0x418]
mov rcx, qword [rsp + 0x508]
xor rcx, rsp
call fcn.140009950
add rsp, 0x510
pop rbx
ret