Function at 0x14003f370
Capabilities:
Copy file
Delete registry key
Delete registry value
Enumerate files on windows
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov rax, qword [0x1400c7070]
xor rax, rsp
mov qword [rbp + 0x520], rax
mov r15, rcx
add rcx, 0x48
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x1400405cc
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov rcx, qword [r15 + 0x78]
test rcx, rcx
je 0x14003f3ee
lea rdx, [rsp + 0x50]
call fcn.14005bc00
test al, al
je 0x14003f3ee
mov rcx, qword [r15 + 0x78]
call fcn.140069370
mov rax, qword [rsp + 0x50]
mov qword [r15 + 0x78], rax
mov qword [rsp + 0x50], r14
mov rcx, qword [r15 + 0x80]
test rcx, rcx
je 0x14003f425
lea rdx, [rsp + 0x50]
call fcn.14005bc00
test al, al
je 0x14003f425
mov rcx, qword [r15 + 0x80]
call fcn.140069370
mov rax, qword [rsp + 0x50]
mov qword [r15 + 0x80], rax
mov qword [rsp + 0x50], r14
mov rcx, qword [r15 + 0x88]
test rcx, rcx
je 0x14003f45c
lea rdx, [rsp + 0x50]
call fcn.14005bc00
test al, al
je 0x14003f45c
mov rcx, qword [r15 + 0x88]
call fcn.140069370
mov rax, qword [rsp + 0x50]
mov qword [r15 + 0x88], rax
mov rax, qword [r15 + 0x88]
mov qword [rsp + 0x20], rax
mov r9, qword [r15 + 0x78]
lea r8, str.SaveInstallInfo
mov edx, dword [r15 + 8]
lea rcx, str._i:__s_Begin_execute__saving_info_in_key__s__dir__s._n
call fcn.14005cb30
lea rcx, str.int_x86
call sym.Installer.exe_Get
mov qword [rbp - 0x80], rax
lea rcx, str.int_RestartReason
call sym.Installer.exe_Get
mov dword [rbp - 4], eax
lea rcx, str.int_RestartCount
call sym.Installer.exe_Get
mov dword [rbp], eax
lea rcx, str.int_SilentReboot
call sym.Installer.exe_Get
mov dword [rbp + 8], eax
lea rcx, str.int_RemovedOldVersion
call sym.Installer.exe_Get
mov dword [rbp + 4], eax
lea rcx, str.int_RetryInstallAfterReboot
call sym.Installer.exe_Get
mov dword [rbp - 0x60], eax
lea rcx, str.int_RetryRollbackReboot
call sym.Installer.exe_Get
mov dword [rbp - 8], eax
mov qword [rsp + 0x68], r14
lea rcx, str.String_ProductVersion
call sym.Installer.exe_Get
test rax, rax
je 0x14003f50c
mov rax, qword [rax + 8]
mov qword [rsp + 0x68], rax
lea rcx, str.String_InstallPath
call sym.Installer.exe_Get
mov rcx, qword [rax + 8]
mov qword [rbp - 0x78], rcx
lea rcx, str.String_ApplicationPath
call sym.Installer.exe_Get
mov rax, qword [rax + 8]
mov qword [rsp + 0x78], rax
mov rsi, r14
mov qword [rsp + 0x58], r14
lea rcx, str.String_FeaturesToKeep
call sym.Installer.exe_Get
test rax, rax
je 0x14003f563
lea rcx, str.String_FeaturesToKeep
call sym.Installer.exe_Get
mov rsi, qword [rax + 8]
mov qword [rsp + 0x58], rsi
mov rdi, r14
mov qword [rsp + 0x60], r14
lea rcx, str.String_UpgradeScanType
call sym.Installer.exe_Get
test rax, rax
je 0x14003f591
lea rcx, str.String_UpgradeScanType
call sym.Installer.exe_Get
mov rdi, qword [rax + 8]
mov qword [rsp + 0x60], rdi
mov r13, r14
lea rcx, str.String_UpgradeEnableRemote
call sym.Installer.exe_Get
test rax, rax
je 0x14003f5b5
lea rcx, str.String_UpgradeEnableRemote
call sym.Installer.exe_Get
mov r13, qword [rax + 8]
mov qword [rsp + 0x70], r14
lea rcx, str.String_InstallLink
call sym.Installer.exe_Get
test rax, rax
je 0x14003f5e0
lea rcx, str.String_InstallLink
call sym.Installer.exe_Get
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rax
mov r12, r14
lea rcx, str.String_CurrentDownloadLink
call sym.Installer.exe_Get
test rax, rax
je 0x14003f600
mov rax, qword [rax + 8]
cmp word [rax], r12w
cmovne r12, rax
mov qword [rsp + 0x50], r14
lea rdx, [rsp + 0x50]
mov rcx, qword [r15 + 0x88]
call fcn.14005bc00
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14003f633
mov rcx, qword [r15 + 0x88]
call fcn.140069370
mov qword [r15 + 0x88], rbx
mov rdx, qword [r15 + 0x88]
lea rcx, str.Local_setup_path:__s_n
call fcn.14005cb30
lea rcx, str.String_SetupPath
call sym.Installer.exe_Get
mov r8, rax
test rax, rax
je 0x14003f66f
mov rcx, qword [rax]
mov rax, qword [rcx + 8]
mov edx, 1
mov rcx, r8
call qword [0x1400926f0]
mov ecx, 0x10
call fcn.140062618
mov rbx, rax
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rcx, qword [r15 + 0x88]
lea rax, vtable.CString.0
mov qword [rbx], rax
xor edx, edx
mov qword [rbx + 8], rdx
call fcn.140069798
mov qword [rbx + 8], rax
mov rdx, rbx
lea rcx, str.String_SetupPath
call sym.Installer.exe_Put
mov ebx, 0xffffffff
nop dword [rax + rax]
inc ebx
mov dword [rsp + 0x50], ebx
cmp ebx, 1
jg 0x140040580
jne 0x14003f6df
cmp qword [r15 + 0x80], 0
je 0x140040580
cmp dword [rbp - 0x80], 0
jne 0x14003f715
test ebx, ebx
jne 0x14003f6ef
mov rdx, qword [r15 + 0x78]
jmp 0x14003f6f6
mov rdx, qword [r15 + 0x80]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf013f
jmp 0x14003f743
test ebx, ebx
jne 0x14003f71f
mov rdx, qword [r15 + 0x78]
jmp 0x14003f726
mov rdx, qword [r15 + 0x80]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [r15 + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
test ebx, ebx
jne 0x14003f77c
mov rdx, qword [r15 + 0x80]
test rdx, rdx
je 0x14003f77c
mov rcx, qword [r15 + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Parameters
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Actions
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
lea rcx, str.String_ProductCode
call sym.Installer.exe_Get
test rax, rax
je 0x14003f870
lea rcx, str.String_ProductCode
call sym.Installer.exe_Get
mov rcx, qword [rax + 8]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14003f830
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ProductCode
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14003f8c1
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14003f881
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400aaec0]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x78]
nop dword [rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14003f8d0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.InstallPath
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
mov rcx, qword [r15 + 0x88]
mov rax, 0xffffffffffffffff
nop
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14003f920
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.SetupPath
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
mov dword [rsp + 0x28], 4
lea rax, [rbp - 4]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 4]
xor r8d, r8d
lea rdx, str.RestartReason
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 4]
xor r8d, r8d
lea rdx, str.RestartCount
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x14003f9f9
cmp word [rsi], r14w
je 0x14003f9f9
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rsi + rax*2], 0
jne 0x14003f9c4
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
lea rdx, str.UpgradeFeaturesToKeep
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x14003fa45
cmp word [rdi], 0
je 0x14003fa45
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], 0
jne 0x14003fa10
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.UpgradeScanType
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test r13, r13
je 0x14003fa97
cmp word [r13], 0
je 0x14003fa97
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [r13 + rax*2], 0
jne 0x14003fa60
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9d, 1
xor r8d, r8d
lea rdx, str.UpgradeEnableRemote
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.RemovedOldVersion
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
mov dword [rsp + 0x28], 4
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 4]
xor r8d, r8d
lea rdx, str.SilentReboot
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14003fb52
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14003fb12
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.InstallLink
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
test r12, r12
je 0x14003fba1
mov rax, 0xffffffffffffffff
nop
lea rax, [rax + 1]
cmp word [r12 + rax*2], 0
jne 0x14003fb60
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, 1
xor r8d, r8d
lea rdx, str.CurrentDownloadLink
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
test eax, eax
jne 0x14003f6c0
mov ecx, dword [rbp - 0x60]
cmp ecx, 1
je 0x14003fbb3
cmp dword [rbp - 8], 1
jne 0x14003fcd8
lea rax, [rbp - 0x60]
lea rdx, [rbp - 8]
cmp ecx, 1
cmovne rax, rdx
lea rdx, str.RetryRollbackReboot
lea rcx, str.RetryAfterReboot
cmove rdx, rcx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
cmp dword [rbp - 0x60], 0
je 0x14003fcd8
xor edi, edi
mov ebx, edi
lea rcx, str.String_avUpdateLocation64
call sym.Installer.exe_Get
test rax, rax
je 0x14003fc26
lea rcx, str.String_avUpdateLocation64
call sym.Installer.exe_Get
mov rbx, qword [rax + 8]
lea rcx, str.String_avUpdateLocation32
call sym.Installer.exe_Get
test rax, rax
je 0x14003fc47
lea rcx, str.String_avUpdateLocation32
call sym.Installer.exe_Get
mov rdi, qword [rax + 8]
test rbx, rbx
je 0x14003fc8b
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x14003fc53
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.avUpdateLocation64
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
test rdi, rdi
je 0x14003fcd8
mov rax, 0xffffffffffffffff
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], 0
jne 0x14003fca0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.avUpdateLocation32
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
lea rcx, str.String_ActionIndex
call sym.Installer.exe_Get
test rax, rax
je 0x14003fd38
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14003fd38
cmp word [rcx], 0
je 0x14003fd38
mov rax, 0xffffffffffffffff
nop
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14003fd00
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ActionIndex
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
lea rcx, str.SelfFree_MSIApi
call sym.Installer.exe_Get
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov rdx, qword [rbp - 0x58]
mov rcx, r8
call qword [0x1400926f0]
lea rcx, [0x1400a54b0]
call sym.Installer.exe_Get
mov rdi, rax
test rax, rax
je 0x14003fda3
mov rcx, qword [rax]
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x14003fda3
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
mov rcx, qword [r8]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rbp - 0x50]
mov rcx, r8
call qword [0x1400926f0]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [rdi]
jne 0x14003fd80
mov rax, qword [r15 + 0x88]
lea rdx, [0x1400a2ff8]
test rax, rax
cmovne rdx, rax
xor ebx, ebx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], bx
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], bx
jne 0x14003fdd5
lea rcx, [rbp - 0x28]
call fcn.14001c900
nop
cmp byte [r15 + 0x90], 0
je 0x140040458
cmp byte [r15 + 0x91], 0
je 0x1400402ca
lea r8, [rbp + 0x40]
xor edx, edx
mov rcx, qword [r15 + 0x88]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov esi, eax
mov dil, 1
mov rdx, qword [r15 + 0x88]
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], bx
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x14003fe40
lea rcx, [rbp + 0x10]
call fcn.14001c900
nop
mov r8d, 1
lea rdx, [0x1400a1c18]
lea rcx, [rbp + 0x10]
call fcn.140012f00
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rcx, qword [rbp + 0x10]
lea rdx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003fedc
nop dword [rax]
movzx edx, word [rbp + 0x9c]
movzx ecx, word [rbp + 0x9e]
cmp dx, 0x2e
jne 0x14003fed0
test cx, cx
je 0x14003febd
cmp dx, dx
jne 0x14003fed0
cmp cx, dx
jne 0x14003fed0
cmp word [rbp + 0xa0], 0
jne 0x14003fed0
lea rdx, [rbp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14003fed3
jmp 0x14003fe90
xor dil, dil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 1
jne 0x14004019c
test byte [rbp + 0x40], 0x10
je 0x14004019c
test dil, dil
jne 0x14004019c
mov rax, qword [r15 + 0x88]
mov r8, qword [rsp + 0x78]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14003ff24
add rax, 2
test ecx, ecx
jne 0x14003ff10
test edx, edx
je 0x14004019c
mov r8d, dword [rbp + 0x60]
mov edx, dword [rbp + 0x5c]
lea rcx, str.Generating_temporary_file_name_nFileSizeHigh___i_nFileSizeLow_i_n
call fcn.14005cb30
lea rdx, [rbp + 0x310]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp + 0x30]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2c0], xmm0
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
mov qword [rbp + 0x300], rax
mov word [rbp + 0x308], ax
mov rdx, qword [rbp + 0x38]
mov rcx, rdx
movabs rax, 0xffffffffffff
and rcx, rax
shr rdx, 0x30
movzx eax, word [rbp + 0x36]
movzx r9d, word [rbp + 0x34]
mov r8d, dword [rbp + 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea rdx, str._08llx__04llx__04llx__04llx__012llx
lea rcx, [rbp + 0x2c0]
call fcn.140040d00
lea rax, [rbp + 0x310]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14003ffe0
lea rdx, [rbp + 0x310]
lea rcx, [rbp - 0x28]
call fcn.14001c900
lea rax, [rbp + 0x2c0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140040010
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp - 0x28]
call fcn.140012f00
mov r8d, 1
lea rdx, [0x1400a1b64]
lea rcx, [rbp - 0x28]
call fcn.140012f00
lea rcx, [rbp - 0x28]
mov rax, 0xffffffffffffffff
cmp qword [rbp - 0x10], 8
jb 0x140040070
mov rcx, qword [rbp - 0x28]
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140040060
jmp 0x14004007f
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140040070
lea rcx, [rbp - 0x28]
lea edx, [rax*2 + 2]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DeletePath
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
cmp qword [r15 + 0x98], 0
je 0x140040285
xor edi, edi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], dil
lea r8d, [rdi + 7]
lea rdx, str.String_
lea rcx, [rbp - 0x48]
call fcn.14001d830
nop
mov rdx, qword [r15 + 0x98]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400400f3
lea rcx, [rbp - 0x48]
call fcn.14001d4c0
mov ecx, 0x10
call fcn.140062618
mov rbx, rax
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
lea rax, vtable.CString.0
mov qword [rbx], rax
mov qword [rbx + 8], rdi
call fcn.140069798
mov qword [rbx + 8], rax
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
mov rdx, rbx
call sym.Installer.exe_Put
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140040285
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004027f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004061e
jmp 0x14004027f
cmp qword [r15 + 0x98], 0
je 0x140040285
xor edi, edi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], dil
lea r8d, [rdi + 7]
lea rdx, str.String_
lea rcx, [rbp - 0x48]
call fcn.14001d830
nop
mov rdx, qword [r15 + 0x98]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400401e3
lea rcx, [rbp - 0x48]
call fcn.14001d4c0
mov ecx, 0x10
call fcn.140062618
mov rbx, rax
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
lea rax, vtable.CString.0
mov qword [rbx], rax
mov qword [rbx + 8], rdi
call fcn.140069798
mov qword [rbx + 8], rax
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
mov rdx, rbx
call sym.Installer.exe_Put
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140040285
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004027f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040624
call fcn.140062610
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1400402c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400402c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004062a
call fcn.140062610
mov rsi, qword [rsp + 0x58]
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r8, qword [rbp - 0x28]
mov rdx, qword [rsp + 0x78]
lea rcx, str._SaveInstallInfo__Copying_folder__s_to__s_n
call fcn.14005cb30
lea rcx, str.FilesConditions
call sym.Installer.exe_Get
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r9, rax
mov r8b, 1
mov rcx, qword [rsp + 0x78]
call fcn.14005bd60
mov edi, eax
lea rcx, str.String_ConfigFile
call sym.Installer.exe_Get
mov rbx, rax
test rax, rax
je 0x14004044a
cmp qword [rax + 8], 0
je 0x14004044a
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], ax
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], ax
jne 0x140040363
lea rcx, [rbp - 0x48]
call fcn.14001c900
nop
mov rcx, qword [rbp - 0x38]
lea r8, [rcx - 1]
cmp rcx, r8
jbe 0x140040636
lea rax, [rbp - 0x48]
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
setae r10b
mov r9, qword [rbp - 0x48]
cmovae rax, r9
cmp word [rax + r8*2], 0x5c
je 0x1400403d8
cmp rcx, rdx
jae 0x1400403c9
lea rax, [rcx + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
test r10b, r10b
cmovne rax, r9
mov dword [rax + rcx*2], 0x5c
jmp 0x1400403d8
mov r9d, 0x5c
lea rcx, [rbp - 0x48]
call fcn.1400191c0
mov r8d, 0xd
lea rdx, str.installer.xml
lea rcx, [rbp - 0x48]
call fcn.140012f00
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
xor r8d, r8d
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14004044a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040445
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040630
call fcn.140062610
mov edx, edi
lea rcx, str._SaveInstallInfo__CopyDir:__d_n
call fcn.14005cb30
mov r8, qword [rbp - 0x18]
test r8, r8
je 0x1400404bd
mov rax, qword [r15 + 0x88]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140040470
lea r9, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r9, qword [rbp - 0x28]
cmp r8, rcx
jne 0x1400404ce
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x1400404ce
sub r9, rax
cmp cx, dx
ja 0x1400404ce
cmp r8, 1
je 0x1400404bd
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x14004049f
jmp 0x1400404ce
lea rdx, str.DeletePath
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x10]
test r14d, r14d
je 0x140040544
cmp rdx, 8
mov rdi, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x50]
jb 0x14003f6c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004053a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040618
call fcn.140062610
jmp 0x14003f6c0
cmp rdx, 8
jb 0x140040580
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004057b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040618
call fcn.140062610
mov byte [r15 + 0x10], 1
mov rax, qword [r15]
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [0x1400926f0]
mov r9d, eax
lea r8, str.SaveInstallInfo
mov edx, dword [r15 + 8]
lea rcx, str._i:__s_End_execute._Next_command__i._n
call fcn.14005cb30
mov edx, r14d
lea rcx, str.SaveInstallInfo_retVal___i._n
call fcn.14005cb30
lea rcx, [r15 + 0x48]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x1400405e8
lea r8, str.SaveInstallInfo
mov edx, dword [r15 + 8]
lea rcx, str._i:__s_Error:_Multiple_threads_attempting_execution._n
call fcn.14005cb30
mov eax, 0x54f
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.1400625f0
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400695b8
nop
call fcn.1400695b8
nop
call fcn.1400695b8
nop
call fcn.1400695b8
int3
call fcn.1400695b8
nop
call fcn.140016440
int3