Function at 0x1400141bc
Capabilities:
Accept command line arguments
Check if file exists
Get common file path
Get file attributes
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1038]
mov eax, 0x1110
call fcn.14003cf80
sub rsp, rax
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x1000], rax
xor ebx, ebx
mov r12, rcx
xor edx, edx
mov dword [rsp + 0x3c], ebx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x38], ebx
mov r14d, ebx
mov r15d, ebx
lea r8d, [rbx + 0x50]
mov esi, ebx
mov edi, ebx
call sub.msvcrt.dll_memset
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
cmp dword [r12 + 0x18], ebx
je 0x140014239
cmp dword [r12 + 0x78], ebx
jne 0x14001429d
cmp dword [r12 + 0x6c], 5
je 0x14001429d
mov rcx, qword [0x140050310]
mov r14d, 2
cmp rcx, 0xffffffffffffffff
jne 0x140014269
mov edx, r14d
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014293
cmp dword [0x1400516e0], r14d
jl 0x140014293
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov r8d, 0x33
mov qword [rsp + 0x20], rbx
lea rdx, str.ERROR:_Installer:_Not_initialized:_shutting_down._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 0x8000ffff
jmp 0x140014a59
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Installing_Install_list.__Last_result:_0x_x._r_n
mov ecx, 4
mov r8d, eax
call fcn.140016868
lea rcx, str.sfc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
mov r9d, 1
test rax, rax
je 0x14001440d
lea rdx, str.SRSetRestorePointA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x140014317
lea rdx, str.SRSetRestorePoint
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x140014317
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, rbx
jmp 0x140014407
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
test rax, rax
je 0x140014405
lea rdx, str._NestedRestore
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsstr]
lea rdx, str._Upgrade
mov rcx, rbx
test rax, rax
mov eax, 1
cmovne r14d, eax
mov dword [rsp + 0x3c], r14d
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14001436f
mov r9d, 1
xor ebx, ebx
mov edi, r9d
jmp 0x14001440d
lea rdx, str._DisallowSystemRestore
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x1400143b2
lea rdx, str._DownloadService
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x1400143b2
lea rdx, str._RunOnce
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
xor ebx, ebx
test rax, rax
je 0x140014407
jmp 0x1400143b4
xor ebx, ebx
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x1400143d6
lea edx, [rcx + 5]
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014400
cmp dword [0x1400516e0], 4
jl 0x140014400
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
mov r8d, 0x2d
mov qword [rsp + 0x20], rbx
lea rdx, str.System_restore_turned_off_for_this_install._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15, rbx
jmp 0x140014407
xor ebx, ebx
mov r9d, 1
mov eax, r14d
mov dword [rsp + 0x54], ebx
neg eax
mov qword [rsp + 0x58], rbx
mov r14d, 2
lea r8, str.Installed__S
sbb ecx, ecx
lea rax, [rbp - 0x60]
and ecx, r14d
add ecx, 0x64
mov dword [rsp + 0x50], ecx
lea edx, [r14 + 0x3e]
lea rcx, [rbp - 0x60]
sub r8, rax
lea rax, [rdx + 0x7fffffbe]
test rax, rax
je 0x140014461
mov al, byte [rcx + r8]
test al, al
je 0x140014461
mov byte [rcx], al
add rcx, r9
sub rdx, r9
jne 0x140014443
test rdx, rdx
lea rax, [rcx - 1]
lea rdx, [rbp - 0x20]
cmovne rax, rcx
mov ecx, 0x105
mov byte [rax], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140014513
call fcn.1400264a0
test eax, eax
lea rcx, [0x140041aa8]
lea r8, [0x140041a88]
mov edx, 0x105
cmove r8, rcx
lea rcx, [rbp - 0x20]
call fcn.140001584
test eax, eax
js 0x140014513
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400144c3
test al, 0x10
je 0x1400144ce
test edi, edi
jne 0x1400144ce
mov edx, 0x81
jmp 0x1400144f7
call fcn.14001aa4c
call fcn.14002f1c4
test eax, eax
je 0x1400144f2
call fcn.140017b60
mov dword [0x140050554], eax
mov eax, 1
mov dword [0x14005055c], eax
mov edx, 0xd6
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x1f0]
mov r9d, 0x105
call qword [sym.imp.USER32.dll_LoadStringW]
mov esi, eax
lea rax, str.Windows_Media_Player_11
test esi, esi
lea r9, [rbp + 0x1f0]
mov edx, 0x3f
cmovle r9, rax
lea r8, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140013ce8
test r15, r15
je 0x140014825
cmp qword [0x1400516d8], rbx
je 0x14001458a
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x400]
mov r9d, 0x100
lea edx, [r9 - 0x4b]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14001458a
mov rcx, qword [0x1400516d8]
lea r9, [rbp + 0x400]
xor r8d, r8d
mov edx, 0x5d5
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140050310]
mov edi, 4
cmp rcx, 0xffffffffffffffff
jne 0x1400145b0
mov edx, edi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x1400145d9
cmp dword [0x1400516e0], edi
jl 0x1400145d9
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
mov r8d, 0x35
mov qword [rsp + 0x20], rbx
lea rdx, str.Installer:_Preparing_to_set_system_restore_point..._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rsp + 0x40]
mov rax, r15
lea rcx, [rsp + 0x50]
call qword [0x14003f118]
test eax, eax
jne 0x1400147db
mov eax, dword [rsp + 0x40]
mov r15, rbx
cmp eax, 0x78
jne 0x14001464c
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x140014625
mov edx, edi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014825
cmp dword [0x1400516e0], edi
jl 0x140014825
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
mov r8d, 0x31
lea rdx, str.System_restore_is_not_supported_on_this_system._r_n
jmp 0x14001481a
cmp eax, 0x422
je 0x140014715
cmp eax, 0x70
je 0x1400146d4
cmp eax, 0x50
jne 0x1400146af
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x140014687
mov edx, r14d
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014825
cmp dword [0x1400516e0], r14d
jl 0x140014825
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
mov r8d, 0x3b
lea rdx, str.System_restore_point_could_not_be_set:_reboot_is_pending._r_n
jmp 0x14001481a
movzx r8d, ax
lea rdx, str.ERROR:_Could_not_set_system_restore_point:_error_0x_x._r_n
or r8d, 0x80070000
mov ecx, r14d
test eax, eax
cmovle r8d, eax
call fcn.140016868
jmp 0x140014825
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x1400146f5
mov edx, edi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14001475f
cmp dword [0x1400516e0], edi
jl 0x14001475f
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
mov r8d, 0x42
lea rdx, str.System_restore_is_disabled_on_this_system_due_to_low_disk_space._r_n
jmp 0x140014754
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x140014736
mov edx, edi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14001475f
cmp dword [0x1400516e0], edi
jl 0x14001475f
mov dword [rsp + 0x34], ebx
lea r9, [rsp + 0x34]
mov r8d, 0x2c
lea rdx, str.System_restore_is_disabled_on_this_system._r_n
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [r12 + 0x74], ebx
jne 0x140014825
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x800]
mov r9d, 0x400
mov edx, 0xa1
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400147d1
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x400]
mov r9d, 0x200
mov edx, 0x64
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400147d1
mov r9d, 0x1011
lea r8, [rbp + 0x400]
lea rdx, [rbp + 0x800]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, r14d
jne 0x140014825
mov eax, 0x80004005
jmp 0x140014a59
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x1400147fc
mov edx, edi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014825
cmp dword [0x1400516e0], edi
jl 0x140014825
mov dword [rsp + 0x34], ebx
lea r9, [rsp + 0x34]
mov r8d, AtlInternalQueryInterface
lea rdx, str.System_restore_point_set._r_n
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [r12 + 0x6c], 5
lea rsi, str.WMPNetworkSvc
je 0x1400148ae
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
test rax, rax
je 0x140014878
lea rdx, str._DownloadService
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x1400148ac
lea rdx, str._RunOnce
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
xor ebx, ebx
test rax, rax
jne 0x1400148ae
jmp 0x14001487a
xor ebx, ebx
lea r9, [rsp + 0x34]
mov rdx, rsi
lea r8, [rsp + 0x30]
call fcn.14002d42c
test eax, eax
je 0x1400148ae
cmp dword [rsp + 0x30], 4
jne 0x1400148ae
mov eax, 1
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x38], eax
call fcn.14002c79c
jmp 0x1400148ae
xor ebx, ebx
call fcn.140017bdc
mov r9d, dword [0x140050558]
mov rcx, qword [r12]
and r9d, 8
call fcn.14002356c
mov r8d, eax
lea rdx, str._r_nSetup_complete.__Result:_0x_x._r_n
mov ecx, 4
mov edi, eax
call fcn.140016868
cmp dword [rsp + 0x38], ebx
je 0x1400148eb
mov rdx, rsi
call fcn.14002ca2c
test edi, edi
js 0x14001499d
mov rcx, qword [r12 + 0x80]
test rcx, rcx
je 0x14001499d
mov rbx, qword [rcx]
xor r12d, r12d
test rbx, rbx
jne 0x14001491c
call fcn.140029fd0
mov rbx, rax
test rax, rax
je 0x14001499b
cmp dword [rbx + 0x124], r12d
je 0x14001499b
cmp dword [rbx + 0x12c], r12d
je 0x14001499b
cmp qword [rbx + 0x18], r12
lea rsi, [0x14003f4a0]
mov r8, rsi
lea rdx, str._r_nLaunching__S_Install._r_n
cmovne r8, qword [rbx + 0x18]
mov ecx, 4
call fcn.140016868
mov rcx, rbx
call fcn.1400273e8
mov ecx, 0xd2af9
cmp eax, 0xbc2
je 0x140014979
cmp eax, 0x80070bc2
je 0x140014979
cmp eax, ecx
je 0x140014979
test eax, eax
jns 0x14001497b
mov edi, eax
jmp 0x14001497b
mov edi, ecx
cmp qword [rbx + 0x18], r12
lea rdx, str._r_n_S_Setup_complete.__Result:_0x_x._r_n
mov r9d, eax
mov ecx, 4
cmovne rsi, qword [rbx + 0x18]
mov r8, rsi
call fcn.140016868
xor ebx, ebx
neg dword [rsp + 0x3c]
sbb eax, eax
and eax, r14d
add eax, 0x65
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x44]
mov qword [rsp + 0x58], rax
test r15, r15
je 0x140014a49
lea rdx, [rsp + 0x40]
mov rax, r15
lea rcx, [rsp + 0x50]
call qword [0x14003f118]
test eax, eax
jne 0x1400149fd
mov eax, dword [rsp + 0x40]
lea rdx, str.Could_not_set_system_restore_end_point:_error_0x_x._r_n
movzx r8d, ax
mov ecx, r14d
or r8d, 0x80070000
test eax, eax
cmovle r8d, eax
call fcn.140016868
jmp 0x140014a49
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x140014a1f
lea edx, [rcx + 5]
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014a49
cmp dword [0x1400516e0], 4
jl 0x140014a49
lea r9, [rsp + 0x34]
mov dword [rsp + 0x34], ebx
mov r8d, AtlInternalQueryInterface
mov qword [rsp + 0x20], rbx
lea rdx, str.System_restore_end_point_set._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r13, r13
je 0x140014a57
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp + 0x1000]
xor rcx, rsp
call fcn.14003c6c0
lea r11, [rsp + 0x1110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret