Function at 0x1400178d4
Capabilities:
Accept command line arguments
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1028]
mov eax, 0x1100
call fcn.140045d00
sub rsp, rax
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0xff0], rax
mov r14, rcx
xor r13d, r13d
xor esi, esi
lea rcx, [rsp + 0x40]
and dword [rsp + 0x24], esi
xor edx, edx
xor r15d, r15d
xor edi, edi
lea r8d, [r13 + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
cmp dword [r14 + 0x18], eax
je 0x140017949
cmp dword [r14 + 0x78], eax
jne 0x14001796b
cmp dword [r14 + 0x6c], 5
je 0x14001796b
lea rdx, str.ERROR:_Installer:_Not_initialized:_shutting_down._r_n
mov ecx, 2
call fcn.140019ae0
mov eax, 0x8000ffff
jmp 0x140017fe2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea rdx, str.Installing_Install_list.__Last_result:_0x_x._r_n
mov ecx, 4
mov r8d, eax
call fcn.140019b1c
lea rcx, str.sfc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
mov r12, rax
mov r9d, 1
test rax, rax
je 0x140017a08
lea rdx, str.SRSetRestorePointA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x140017ad6
lea rdx, str.SRSetRestorePoint
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x140017ad6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
xor r12d, r12d
mov r9d, 1
mov dword [rsp + 0x40], 0x64
and dword [rsp + 0x44], edi
lea r8, str.Installed__S
and qword [rsp + 0x48], rdi
lea rax, [rbp - 0x70]
sub r8, rax
lea rcx, [rbp - 0x70]
mov edx, 0x40
lea rax, [rdx + 0x7fffffbe]
test rax, rax
je 0x140017a4e
mov al, byte [r8 + rcx]
test al, al
je 0x140017a4e
mov byte [rcx], al
add rcx, r9
sub rdx, r9
jne 0x140017a30
test rdx, rdx
lea rax, [rcx - 1]
mov ebx, 0x105
lea rdx, [rbp - 0x30]
cmovne rax, rcx
mov ecx, ebx
mov byte [rax], dil
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140017bff
call fcn.14002dc10
test eax, eax
lea rcx, [0x14004acd8]
lea r8, [0x14004acb8]
mov edx, ebx
cmove r8, rcx
lea rcx, [rbp - 0x30]
call fcn.140010d0c
test eax, eax
js 0x140017bff
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140017ac4
test al, 0x10
je 0x140017bb7
test esi, esi
jne 0x140017bb7
mov edx, 0x81
jmp 0x140017be0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140017a02
lea rdx, str._NestedRestore
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
lea rdx, str._Upgrade
mov rcx, rbx
test rax, rax
mov eax, 1
cmovne r13d, eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x140017b36
mov r9d, 1
mov esi, r9d
jmp 0x140017ba1
lea rdx, str._DisallowSystemRestore
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x140017b87
lea rdx, str._DownloadService
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x140017b87
lea rdx, str._RunOnce
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x140017b9b
lea rdx, str.System_restore_turned_off_for_this_install._r_n
mov ecx, 4
call fcn.140019ae0
xor r15d, r15d
mov r9d, 1
test r13d, r13d
je 0x140017a08
mov dword [rsp + 0x40], 0x66
jmp 0x140017a10
call fcn.14001d408
call fcn.14003596c
test eax, eax
je 0x140017bdb
call fcn.14001c428
mov dword [0x140059564], eax
mov eax, 1
mov dword [0x14005956c], eax
mov edx, 0xd6
mov rcx, qword [0x140059d90]
lea r8, [rbp + 0x1e0]
mov r9d, ebx
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
mov edi, eax
lea rax, str.Windows_Media_Player_11
test edi, edi
lea r9, [rbp + 0x1e0]
mov edx, 0x3f
cmovle r9, rax
lea r8, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.140018504
mov esi, 2
test r15, r15
je 0x140017dce
cmp qword [0x14005a748], 0
je 0x140017c88
mov rcx, qword [0x140059d90]
lea r8, [rbp + 0x3f0]
mov r9d, pe_nt_image_headers64
lea edx, [r9 - 0x4b]
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
test eax, eax
je 0x140017c88
mov rcx, qword [0x14005a748]
lea r9, [rbp + 0x3f0]
xor r8d, r8d
mov edx, 0x5d5
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
lea rdx, str.Installer:_Preparing_to_set_system_restore_point..._r_n
mov ecx, 4
call fcn.140019ae0
movabs r10, 0xe7fd2e6552d63170
lea rdx, [rsp + 0x30]
mov rax, r15
lea rcx, [rsp + 0x40]
call qword [0x140048188]
test eax, eax
jne 0x140017dbd
mov eax, dword [rsp + 0x30]
xor r15d, r15d
cmp eax, 0x78
jne 0x140017cd6
lea rdx, str.System_restore_is_not_supported_on_this_system._r_n
jmp 0x140017dc4
cmp eax, 0x422
je 0x140017d20
cmp eax, 0x70
je 0x140017d17
cmp eax, 0x50
jne 0x140017cf5
lea rdx, str.System_restore_point_could_not_be_set:_reboot_is_pending._r_n
mov ecx, esi
jmp 0x140017dc9
test eax, eax
jle 0x140017d01
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rdx, str.ERROR:_Could_not_set_system_restore_point:_error_0x_x._r_n
mov ecx, esi
call fcn.140019b1c
jmp 0x140017dce
lea rdx, str.System_restore_is_disabled_on_this_system_due_to_low_disk_space._r_n
jmp 0x140017d27
lea rdx, str.System_restore_is_disabled_on_this_system._r_n
mov ecx, 4
call fcn.140019ae0
cmp dword [r14 + 0x74], r15d
jne 0x140017dce
mov rcx, qword [0x140059d90]
lea r8, [rbp + 0x7f0]
mov r9d, 0x400
mov edx, 0xa1
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
test eax, eax
je 0x140017db3
mov rcx, qword [0x140059d90]
lea r8, [rbp + 0x3f0]
mov r9d, 0x200
mov edx, 0x64
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
test eax, eax
je 0x140017db3
mov r9d, 0x1011
lea r8, [rbp + 0x3f0]
lea rdx, [rbp + 0x7f0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop dword [rax + rax]
cmp eax, esi
jne 0x140017dce
mov eax, 0x80004005
jmp 0x140017fe2
lea rdx, str.System_restore_point_set._r_n
mov ecx, 4
call fcn.140019ae0
cmp dword [r14 + 0x6c], 5
je 0x140017e64
and dword [rsp + 0x20], 0
and dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140017e2d
lea rdx, str._DownloadService
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x140017e64
lea rdx, str._RunOnce
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x140017e64
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x20]
lea rdx, str.WMPNetworkSvc
call fcn.1400349d4
test eax, eax
je 0x140017e64
cmp dword [rsp + 0x20], 4
jne 0x140017e64
lea rdx, str.WMPNetworkSvc
mov dword [rsp + 0x24], 1
xor ecx, ecx
call fcn.14003509c
mov rbx, qword [r14]
call fcn.14001e608
mov r9d, dword [0x140059568]
mov rcx, rbx
and r9d, 8
call fcn.1400290e4
mov r8d, eax
lea rdx, str._r_nSetup_complete.__Result:_0x_x._r_n
mov ecx, 4
mov edi, eax
call fcn.140019b1c
cmp dword [rsp + 0x24], 0
je 0x140017ea8
lea rdx, str.WMPNetworkSvc
call fcn.140034bc4
test edi, edi
js 0x140017f5a
mov rcx, qword [r14 + 0x80]
test rcx, rcx
je 0x140017f5a
mov rbx, qword [rcx]
test rbx, rbx
jne 0x140017ed9
call fcn.14002fff4
mov rbx, rax
test rax, rax
je 0x140017f5a
cmp dword [rbx + 0x124], 0
je 0x140017f5a
cmp dword [rbx + 0x12c], 0
je 0x140017f5a
cmp qword [rbx + 0x18], 0
lea r14, [0x1400486c8]
mov r8, r14
lea rdx, str._r_nLaunching__S_Install._r_n
cmovne r8, qword [rbx + 0x18]
mov ecx, 4
call fcn.140019b1c
mov rcx, rbx
call fcn.140031ac4
mov ecx, 0xd2af9
cmp eax, 0xbc2
je 0x140017f37
cmp eax, 0x80070bc2
je 0x140017f37
cmp eax, ecx
je 0x140017f37
test eax, eax
jns 0x140017f39
mov edi, eax
jmp 0x140017f39
mov edi, ecx
cmp qword [rbx + 0x18], 0
lea rdx, str._r_n_S_Setup_complete.__Result:_0x_x._r_n
mov r9d, eax
mov ecx, 4
cmovne r14, qword [rbx + 0x18]
mov r8, r14
call fcn.140019b1c
neg r13d
sbb eax, eax
and eax, esi
add eax, 0x65
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x34]
mov qword [rsp + 0x48], rax
test r15, r15
je 0x140017fcc
movabs r10, 0xe7fd2e6552d63170
lea rdx, [rsp + 0x30]
mov rax, r15
lea rcx, [rsp + 0x40]
call qword [0x140048188]
test eax, eax
jne 0x140017fbb
mov eax, dword [rsp + 0x30]
test eax, eax
jle 0x140017fa8
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rdx, str.Could_not_set_system_restore_end_point:_error_0x_x._r_n
mov ecx, esi
call fcn.140019b1c
jmp 0x140017fcc
lea rdx, str.System_restore_end_point_set._r_n
mov ecx, 4
call fcn.140019ae0
test r12, r12
je 0x140017fe0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0xff0]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x1100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret