Function at 0x1400028a0
Capabilities:
Accept command line arguments
Create process on windows
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
xor r13b, r13b
xor r12b, r12b
xor r15b, r15b
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x50]
call section..text
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 1
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov r14b, 1
xor esi, esi
mov dword [rbp + 0xa8], esi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp + 0xa8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
test rax, rax
je 0x140002a70
cmp dword [rbp + 0xa8], esi
jle 0x140002a70
nop dword [rax]
nop word [rax + rax]
lea rdx, str.__verbose
mov rcx, qword [rbx]
call fcn.140009074
test eax, eax
jne 0x14000296b
mov r13b, 1
jmp 0x140002a5c
lea rdx, str.__quiet
mov rcx, qword [rbx]
call fcn.140009074
test eax, eax
jne 0x140002986
mov r12b, 1
jmp 0x140002a5c
lea rdx, str.__install
mov rcx, qword [rbx]
call fcn.140009074
test eax, eax
jne 0x1400029a1
mov r15b, 1
jmp 0x140002a5c
lea rdx, str.__game
mov rcx, qword [rbx]
call fcn.140009074
test eax, eax
jne 0x140002a5c
inc esi
cmp esi, dword [rbp + 0xa8]
jge 0x140002b64
add rbx, 8
mov r14, qword [rbx]
lea rdx, str.valorant
mov rcx, r14
call fcn.140009074
test eax, eax
jne 0x140002a13
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x50]
call section..text
mov dword [rbp + 0xb0], eax
mov dword [rbp + 0xb4], 1
mov rdi, qword [rbp + 0xb0]
mov qword [rsp + 0x58], rdi
mov r14b, 1
jmp 0x140002a5c
lea rdx, str.leagueoflegends
mov rcx, r14
call fcn.140009074
test eax, eax
jne 0x140002a59
mov dword [rsp + 0x50], 2
lea rcx, [rsp + 0x50]
call section..text
mov dword [rbp + 0xa0], eax
mov dword [rbp + 0xa4], 2
mov rdi, qword [rbp + 0xa0]
mov qword [rsp + 0x58], rdi
mov r14b, 1
jmp 0x140002a5c
xor r14b, r14b
inc esi
add rbx, 8
cmp esi, dword [rbp + 0xa8]
jl 0x140002950
xor esi, esi
mov ecx, esi
movzx eax, r13b
test r12b, r12b
cmove ecx, eax
mov dword [rsp + 0x50], ecx
test r15b, r15b
jne 0x140002b5a
mov dword [rbp + 0xb8], esi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], 7
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xb8]
call fcn.140001d90
test al, al
je 0x140002b10
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
lea rdx, str.setup.exe
call fcn.140009074
test eax, eax
je 0x140002b0d
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
lea rdx, str.qa_setup.exe
call fcn.140009074
test eax, eax
jne 0x140002b10
mov r15b, 1
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x140002b56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e55
call fcn.1400047c0
mov ecx, dword [rsp + 0x50]
test r14b, r14b
jne 0x140002b6e
test r15b, r15b
je 0x140002b73
mov eax, 0xe0002710
jmp 0x140003e19
test r15b, r15b
jne 0x140002b81
test r12b, r12b
jne 0x140002bad
lea rdx, str.This_will_completely_uninstall__Riot_Vanguard__from_your_computer._Games_that_depend_on_its_functionality_will_stop_working._n_nDo_you_want_to_continue_
jmp 0x140002b8c
test cl, cl
je 0x140002bad
lea rdx, str.This_will_install__Riot_Vanguard__on_your_computer._n_nDo_you_want_to_continue_
mov r9d, 0x133
lea r8, str.Are_you_sure_you_want_to_continue_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x140002bad
xor eax, eax
jmp 0x140003e19
mov r13b, 1
xor bl, bl
lea rcx, [rbp + 0xa0]
call fcn.140004190
test r15b, r15b
je 0x140002c61
test al, al
je 0x140002c5a
mov r10d, 0xff
movzx r9d, word [rbp + 0xa6]
movzx r8d, word [rbp + 0xa4]
movzx edx, word [rbp + 0xa2]
mov rcx, qword [rbp + 0xa0]
cmp cx, 1
jb 0x140002c29
ja 0x140002c53
cmp dx, 0xc
jb 0x140002c29
ja 0x140002c11
cmp r8w, r10w
jb 0x140002c29
ja 0x140002c11
cmp r9w, r10w
jb 0x140002c29
cmp cx, 1
ja 0x140002c53
cmp dx, 0xc
jne 0x140002c30
cmp r8w, r10w
jne 0x140002c30
cmp r9w, r10w
jne 0x140002c30
movzx ebx, r13b
xor r13b, r13b
cmp cx, 1
jb 0x140002c61
ja 0x140002c53
cmp dx, 0xc
jb 0x140002c61
ja 0x140002c53
cmp r8w, r10w
jb 0x140002c61
ja 0x140002c53
mov ecx, 0x100
cmp r9w, cx
jb 0x140002c61
xor bl, bl
mov r13b, 1
jmp 0x140002c61
movzx ebx, r13b
xor r13b, r13b
lea r8, [rbp + 0xa0]
movzx edx, al
movzx ecx, r15b
call fcn.1400044a0
movzx esi, al
xor eax, eax
mov edx, eax
movzx ecx, bl
test r15b, r15b
cmovne edx, ecx
test sil, sil
jne 0x140002c91
test dl, dl
je 0x140002e26
mov qword [rbp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0xb0]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140003dea
mov dword [rbp + 0xb8], 4
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0xa0]
lea edx, [r9 + 0x10]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140003dea
cmp dword [rbp + 0xa0], 0
setne bl
mov rcx, qword [rbp + 0xb0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140002d19
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test bl, bl
je 0x140003e02
test sil, sil
je 0x140002e26
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
setne r12b
test rax, rax
jne 0x140002d64
test r12b, r12b
je 0x140002eac
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov eax, 0xe0002717
jmp 0x140003e19
mov r8d, 0x24
lea rdx, [0x14001b0e0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
setne r14b
test rax, rax
je 0x140002e8e
lea rdx, [rbp + 0x80]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140002e8e
cmp dword [rbp + 0x84], 4
jne 0x140002e6e
lea r8, [rbp + 0x80]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140002e8e
cmp dword [rbp + 0x84], 1
je 0x140002e08
nop dword [rax + rax]
lea rdx, [rbp + 0x80]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140002e4b
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp + 0x84], 1
jne 0x140002de0
test r14b, r14b
je 0x140002e17
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test r12b, r12b
je 0x140002e26
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov r8d, 0x104
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140002eb6
mov rax, 0xffffffffffffffff
jmp 0x140003e19
test r14b, r14b
je 0x140002e5a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov eax, 0xe0002717
jmp 0x140003e19
test r14b, r14b
je 0x140002e7d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test r12b, r12b
je 0x140002e26
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
jmp 0x140002e26
test r14b, r14b
je 0x140002e9d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test r12b, r12b
je 0x140002eac
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov eax, 0xe0002717
jmp 0x140003e19
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor esi, esi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 7
lea rax, [rbp + 0x1a0]
mov r12, 0xffffffffffffffff
mov r8, r12
nop dword [rax]
inc r8
cmp word [rax + r8*2], si
jne 0x140002ef0
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x60]
call fcn.1400012d0
lea r8, [rsp + 0x60]
lea rdx, [0x14001ae18]
lea rcx, [rbp + 0xc0]
call fcn.1400018e0
lea rdx, [0x14001ae14]
mov rcx, rax
call fcn.140001850
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, str.vgc.exe_
lea rcx, [rbp + 0x80]
call fcn.140001850
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x140002fd3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e5b
call fcn.1400047c0
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], si
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x140003032
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000302d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e5b
call fcn.1400047c0
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000308d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003088
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e5b
call fcn.1400047c0
test r15b, r15b
jne 0x1400031f0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 7
mov r8d, 0xb
lea rdx, str.__uninstall
lea rcx, [rsp + 0x60]
call fcn.1400012d0
lea r8, [rsp + 0x60]
lea rdx, [0x14001ab00]
lea rcx, [rbp + 0xc0]
call fcn.1400018e0
mov r9, rax
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1400030e9
mov r9, qword [rax]
mov rcx, qword [rbp + 0xf0]
mov r8, qword [rbp + 0xf8]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140003136
lea rdi, [rcx + rdx]
mov qword [rbp + 0xf0], rdi
lea rbx, [rbp + 0xe0]
cmp r8, 8
cmovae rbx, qword [rbp + 0xe0]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.140008920
mov word [rbx + rdi*2], si
jmp 0x140003147
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0xe0]
call fcn.140001a30
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x14000318d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003188
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e4f
call fcn.1400047c0
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400035ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e4f
jmp 0x1400035e8
mov edx, edi
lea rcx, [rbp + 0x170]
call fcn.1400040a0
mov rbx, rax
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], 7
mov r8d, 0xd
lea rdx, str.__driver_mode
lea rcx, [rbp + 0x80]
call fcn.1400012d0
lea r8, [rbp + 0x80]
lea rdx, [0x14001ab00]
lea rcx, [rbp + 0xc0]
call fcn.1400018e0
lea rdx, [0x14001ab00]
mov rcx, rax
call fcn.140001850
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov r9, rbx
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140003e90
lea r9, [rsp + 0x60]
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x78]
cmp r14, 8
cmovae r9, rsi
mov rcx, qword [rbp + 0xf0]
mov r8, qword [rbp + 0xf8]
mov rax, r8
sub rax, rcx
mov rdx, qword [rsp + 0x70]
cmp rdx, rax
ja 0x1400032f6
lea rdi, [rdx + rcx]
mov qword [rbp + 0xf0], rdi
lea rbx, [rbp + 0xe0]
cmp r8, 8
cmovae rbx, qword [rbp + 0xe0]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.140008920
xor eax, eax
mov word [rbx + rdi*2], ax
jmp 0x140003311
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0xe0]
call fcn.140001a30
mov r14, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
cmp r14, 8
jb 0x14000334c
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003344
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e61
mov rcx, rsi
call fcn.1400047c0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000338c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003387
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e61
call fcn.1400047c0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x1400033d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e61
call fcn.1400047c0
xor esi, esi
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], si
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x140003433
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000342e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e61
call fcn.1400047c0
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], si
mov rdx, qword [rbp + 0x188]
cmp rdx, 8
jb 0x140003492
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000348d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e61
call fcn.1400047c0
test r13b, r13b
jne 0x1400035ed
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 7
mov r8d, 0x15
lea rdx, str.__use_current_process
lea rcx, [rsp + 0x60]
call fcn.1400012d0
lea r8, [rsp + 0x60]
lea rdx, [0x14001ab00]
lea rcx, [rbp + 0xc0]
call fcn.1400018e0
mov r9, rax
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1400034ee
mov r9, qword [rax]
mov rcx, qword [rbp + 0xf0]
mov r8, qword [rbp + 0xf8]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14000353b
lea rdi, [rdx + rcx]
mov qword [rbp + 0xf0], rdi
lea rbx, [rbp + 0xe0]
cmp r8, 8
cmovae rbx, qword [rbp + 0xe0]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.140008920
mov word [rbx + rdi*2], si
jmp 0x14000354c
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0xe0]
call fcn.140001a30
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x140003592
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000358d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e67
call fcn.1400047c0
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400035ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e67
call fcn.1400047c0
mov dword [rbp + 0x60], 0xfffffffe
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
call fcn.140009490
mov r13, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x104], xmm0
movups xmmword [rbp + 0x114], xmm0
movups xmmword [rbp + 0x124], xmm0
movups xmmword [rbp + 0x134], xmm0
movups xmmword [rbp + 0x144], xmm0
movups xmmword [rbp + 0x154], xmm0
mov dword [rbp + 0x164], eax
mov dword [rbp + 0x100], 0x68
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.vgrl.dll_Ordinal_1337]
mov edi, eax
test eax, eax
je 0x1400036ce
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x1400036ce
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x50], 0
je 0x140003d76
mov edx, dword [rbp + 0x60]
lea rcx, [rbp + 0x40]
call fcn.1400040a0
mov qword [rbp + 0xb0], rax
lea rbx, [rbp + 0x19a]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
nop dword [rax]
sub rbx, 2
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx ecx, dx
shl cx, 2
lea r8d, [rcx + rdx]
add r8w, r8w
sub r9w, r8w
add r9w, 0x30
mov word [rbx], r9w
mov r9d, edx
test edx, edx
jne 0x140003700
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
lea rax, [rbp + 0x19a]
cmp rbx, rax
je 0x140003767
lea r8, [rbp + 0x19a]
sub r8, rbx
sar r8, 1
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1400012d0
mov edx, edi
lea rcx, [rbp - 0x80]
call fcn.1400040a0
mov qword [rsp + 0x58], rax
mov r14, qword [rbp + 0xf0]
movabs rax, 0x7ffffffffffffffe
mov rcx, rax
sub rcx, r14
cmp rcx, 0x33
jb 0x140003e6d
lea r15, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r15, qword [rbp + 0xe0]
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], rsi
lea rsi, [r14 + 0x33]
mov ebx, 7
lea rdi, [rbp + 0x80]
cmp rsi, rbx
jbe 0x140003869
mov rbx, rsi
or rbx, 7
cmp rbx, rax
jbe 0x1400037ee
mov rbx, rax
jmp 0x1400037fa
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rax, rbx
add rax, 1
cmovb rax, r12
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140003e79
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140003851
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003e79
mov rcx, rax
call fcn.1400047f4
test rax, rax
je 0x140003e73
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003862
test rcx, rcx
je 0x14000385d
call fcn.1400047f4
jmp 0x14000385f
xor eax, eax
mov rdi, rax
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], rbx
movaps xmm0, xmmword [str._Riot_Vanguard__install_summary:_n_t__Command_line:__]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x14001af60]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x14001af70]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x14001af80]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x14001af90]
movups xmmword [rdi + 0x40], xmm0
movaps xmm1, xmmword [0x14001afa0]
movups xmmword [rdi + 0x50], xmm1
mov eax, dword [0x14001afb0]
mov dword [rdi + 0x60], eax
movzx eax, word [0x14001afb4]
mov word [rdi + 0x64], ax
lea r8, [r14 + r14]
lea rcx, [rdi + 0x66]
mov rdx, r15
call fcn.140008920
xor ebx, ebx
mov word [rdi + rsi*2], bx
lea rdx, str.__n_t__Process_created:
lea rcx, [rbp + 0x80]
call fcn.140001850
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x180], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov r9, qword [rsp + 0x58]
lea r8, [rbp + 0x170]
lea rcx, [rbp - 0x40]
call fcn.140003e90
lea rdx, [0x14001af14]
lea rcx, [rbp - 0x40]
call fcn.140001850
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.140003e90
lea rdx, str.__n_t__Exit_code:
lea rcx, [rbp - 0x60]
call fcn.140001850
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov r9, qword [rbp + 0xb0]
lea r8, [rbp]
lea rcx, [rsp + 0x60]
call fcn.140003e90
lea rdx, str._n_nDo_you_want_to_navigate_to_the_logs_folder_
lea rcx, [rsp + 0x60]
call fcn.140001850
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140003a27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e73
call fcn.1400047c0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], bx
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x140003a7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e73
call fcn.1400047c0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140003aba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ab5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e73
call fcn.1400047c0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], bx
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x140003b0a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e73
call fcn.1400047c0
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140003b4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e73
call fcn.1400047c0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], bx
mov rdx, qword [rbp + 0x188]
cmp rdx, 8
jb 0x140003ba0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e73
call fcn.1400047c0
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x140003be6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003be1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e73
call fcn.1400047c0
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], bx
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140003c3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e73
call fcn.1400047c0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], bx
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140003c8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e73
call fcn.1400047c0
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x140003ccf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e73
call fcn.1400047c0
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rdx, qword [rbp + 0xc0]
mov r9d, 0x24
lea r8, str.Open_logs_folder_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x140003d26
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, str.explore
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x140003d76
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e7f
call fcn.1400047c0
mov rcx, r13
call fcn.140009514
jmp 0x140003d85
mov rcx, r13
call fcn.140009514
cmp byte [rsp + 0x50], 0
je 0x140003da1
mov r9d, 0x40
lea r8, str.Goodbye.
lea rdx, str.The_installer_is_terminating._n_nMake_sure_youve_saved_any_relevant_logs_before_hitting_the_OK_button.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, dword [rbp + 0x60]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x140003de6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003de1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e49
call fcn.1400047c0
mov eax, ebx
jmp 0x140003e19
mov rcx, qword [rbp + 0xb0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140003e02
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea r9, [rsp + 0x58]
movzx r8d, r15b
movzx edx, byte [rsp + 0x50]
movzx ecx, r12b
call fcn.1400014c0
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1400047a0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140009418
int3
call fcn.140009418
int3
call fcn.140009418
int3
call fcn.140009418
int3
call fcn.140009418
int3
call fcn.140009418
int3
call fcn.140001110
int3
call fcn.140009418
int3
call fcn.1400012b0
int3
call fcn.140009418
int3