Function at 0x1400076d0
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Get file attributes
Log keystrokes via polling
Parse credit card information
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x340
lea rcx, [0x140005908]
call qword [sym.imp.msvcrt.dll_int____cdecl___unsigned_long_long_unsigned___int64_____cdecl__set_new_handler_int____cdecl___unsigned_long_long_unsigned___int64___]
call fcn.140001e44
lea rcx, [rsp + 0x220]
mov dword [rsp + 0x220], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edi, edi
cmp eax, edi
je 0x140009829
lea esi, [rdi + 2]
cmp dword [rsp + 0x230], esi
jne 0x140009829
cmp dword [rsp + 0x224], 5
jb 0x140009829
or dword [rsp + 0x110], 0xffffffff
or dword [rsp + 0x128], 0xffffffff
lea rax, [0x140021cac]
lea ebx, [rdi + 3]
lea rcx, [rsp + 0x118]
mov r13b, dil
mov edx, ebx
mov byte [str.___InstallEnd__], 0x3b
mov byte [str.___Install__UTF_8_], 0x3b
mov qword [rsp + 0x130], rax
mov byte [rsp + 0x30], dil
mov dword [rsp + 0x38], r13d
mov byte [rsp + 0x32], dil
mov r15b, dil
mov qword [rsp + 0x118], rdi
mov dword [rsp + 0x120], edi
mov dword [rsp + 0x124], edi
call fcn.140001114
lea rcx, [rsp + 0x140]
mov edx, ebx
mov qword [rsp + 0x140], rdi
mov dword [rsp + 0x148], edi
mov dword [rsp + 0x14c], edi
call fcn.140001114
lea rax, [0x140021930]
lea ebx, [rdi + 1]
lea rcx, [rsp + 0x100]
mov edx, ebx
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0xb4], edi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], 8
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x100], rdi
mov dword [rsp + 0x108], edi
mov dword [rsp + 0x10c], edi
call fcn.140001114
mov rax, qword [rsp + 0x100]
mov word [rax], 0x20
mov rax, qword [rsp + 0x100]
mov word [rax + 2], di
mov dword [rsp + 0x108], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x118]
mov rcx, rax
call fcn.140006178
lea rcx, [rsp + 0x100]
mov rdx, rax
call fcn.140002ac0
lea rcx, [rsp + 0x100]
call fcn.1400034d0
mov r14, qword [rsp + 0x100]
lea rdx, str.sfxlang
add r14, rsi
mov rcx, r14
call fcn.14000584c
cmp rax, rdi
je 0x1400078e7
cmp word [rax], 0x3a
jne 0x1400078e7
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll__wtol]
movzx edx, word [0x140026c1c]
lea ecx, [rax - 1]
cmp ecx, 0xfffe
cmovbe dx, ax
mov word [0x140026c1c], dx
jmp 0x1400078cc
add r14, rsi
cmp word [r14], 0x20
ja 0x1400078c9
jmp 0x1400078de
cmp ax, 0x20
ja 0x1400078e7
add r14, rsi
movzx eax, word [r14]
cmp ax, di
jne 0x1400078d5
call fcn.140005f38
lea rdx, str.sfxversion
mov rcx, r14
call fcn.14000584c
cmp rax, rdi
je 0x14000790a
call fcn.1400066c0
jmp 0x140009566
lea rdx, str.sfxwaitall
mov rcx, r14
call fcn.14000584c
cmp rax, rdi
je 0x14000792d
mov rcx, rax
call fcn.140006d50
mov edi, eax
jmp 0x140009566
lea rdx, str.sfxelevation
mov rcx, r14
mov r12b, dil
call fcn.14000584c
cmp rax, rdi
je 0x14000795d
mov r12b, bl
jmp 0x140007952
cmp cx, 0x20
ja 0x14000795a
add rax, rsi
movzx ecx, word [rax]
cmp cx, di
jne 0x140007949
mov r14, rax
mov ebx, 0x208
lea rbp, [0x140026d00]
cmp dword [0x140026d0c], ebx
jg 0x14000797b
mov edx, ebx
mov rcx, rbp
call fcn.140001114
mov rdx, qword [0x140026d00]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, edi
jne 0x1400079a7
mov edx, 6
lea ebx, [rdx - 5]
mov ecx, ebx
call fcn.14000c668
mov edi, ebx
jmp 0x140009566
mov rdx, qword [0x140026d00]
mov ecx, edi
cmp word [rdx], di
je 0x1400079c3
mov rax, rdx
add rax, rsi
add ecx, 1
cmp word [rax], di
jne 0x1400079b8
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140026d08], ecx
lea rdx, str.sfxtest
mov rcx, r14
call fcn.14000584c
cmp rax, rdi
mov rbx, rax
je 0x140007b8f
cmp word [rax], 0x3a
je 0x1400079fb
mov edi, 0x64
jmp 0x140009566
movzx edx, word [rax + 2]
mov ecx, edx
or ecx, 0x20
sub ecx, 0x61
je 0x140007ac2
sub ecx, esi
je 0x140007aaa
mov r14d, 1
sub ecx, r14d
je 0x140007a2f
cmp ecx, 0x12
jne 0x1400079f1
mov edi, 0x4789
jmp 0x140009566
cmp edx, 0x44
jne 0x140007a6c
cmp word [rax + 4], 0x3a
jne 0x1400079f1
add rbx, 6
jmp 0x140007a59
cmp ax, 0x3a
je 0x140007a62
lea rcx, [0x140026d60]
movzx edx, ax
call fcn.14000145c
add rbx, rsi
movzx eax, word [rbx]
cmp ax, 0x20
ja 0x140007a41
cmp dword [0x140026d68], edi
jne 0x140007a70
jmp 0x1400079f1
add rbx, 4
mov dword [0x140026d58], edi
cmp word [rbx], 0x3a
jne 0x140007a97
lea rcx, [rbx + 2]
call qword [sym.imp.msvcrt.dll__wtol]
cmp eax, 0xe10
mov dword [0x140026d58], eax
ja 0x140007a97
cmp eax, edi
jne 0x140007aa1
mov dword [0x140026d58], 0xa
mov dword [0x140026d5c], r14d
jmp 0x140007acd
movzx eax, word [rax + 4]
sub ax, 0x63
neg ax
sbb eax, eax
add eax, 4
mov dword [0x140026d5c], eax
jmp 0x140007acd
mov dword [0x140026d5c], esi
jmp 0x140007acd
add rbx, rsi
cmp word [rbx], 0x20
ja 0x140007aca
jmp 0x140007ade
cmp ax, 0x20
ja 0x140007ae6
add rbx, rsi
movzx eax, word [rbx]
cmp ax, di
jne 0x140007ad5
lea rdx, str.sfxconfig
mov rcx, rbx
mov r14, rbx
call fcn.14000584c
cmp rax, rdi
mov rcx, rax
je 0x140007b8f
cmp word [rax], 0x3a
jne 0x140007b15
jmp 0x140007b12
cmp ax, 0x20
ja 0x140007b1d
add rcx, rsi
movzx eax, word [rcx]
cmp ax, di
jne 0x140007b0c
mov rax, qword [rsp + 0x118]
lea rdx, [rsp + 0x118]
mov dword [rsp + 0x120], edi
mov word [rax], di
call fcn.140006178
cmp dword [0x140026d5c], esi
mov r14, rax
je 0x140007b8f
mov rcx, qword [0x140026d00]
mov ebx, dword [rsp + 0x120]
mov dword [0x140026d08], edi
mov word [rcx], di
mov rcx, rbp
mov edx, ebx
call fcn.140001114
mov r11, qword [rsp + 0x118]
mov rcx, qword [0x140026d00]
movzx eax, word [r11]
add r11, rsi
mov word [rcx], ax
add rcx, rsi
cmp ax, di
jne 0x140007b77
mov dword [0x140026d08], ebx
lea rcx, [0x140026cb0]
cmp rbp, rcx
je 0x140007be2
mov rax, qword [0x140026cb0]
mov dword [0x140026cb8], edi
mov word [rax], di
mov edx, dword [0x140026d08]
call fcn.140001114
mov r11, qword [0x140026d00]
mov rcx, qword [0x140026cb0]
movzx eax, word [r11]
add r11, rsi
mov word [rcx], ax
add rcx, rsi
cmp ax, di
jne 0x140007bc4
mov eax, dword [0x140026d08]
mov dword [0x140026cb8], eax
lea rsi, [0x140026cc0]
cmp rbp, rsi
je 0x140007c3a
mov rax, qword [0x140026cc0]
mov dword [0x140026cc8], edi
mov rcx, rsi
mov word [rax], di
mov edx, dword [0x140026d08]
call fcn.140001114
mov r11, qword [0x140026d00]
mov rcx, qword [0x140026cc0]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140007c1a
mov eax, dword [0x140026d08]
mov dword [0x140026cc8], eax
mov rcx, rbp
call fcn.1400039e0
cmp eax, edi
jl 0x140007d5a
mov rcx, qword [0x140026cb0]
movsxd rbx, eax
mov word [rcx + rbx*2], di
mov dword [0x140026cb8], eax
mov rax, qword [0x140026d00]
lea rdx, [rax + rbx*2 + 2]
mov rcx, rsi
call fcn.140001358
mov r11, qword [0x140026d00]
lea rsi, [0x140026ce0]
lea rdx, [r11 + rbx*2 + 2]
mov rcx, rsi
call fcn.140001358
movsxd r11, dword [0x140026ce8]
cmp r11d, edi
je 0x140007cd1
mov rdx, qword [0x140026ce0]
lea rcx, [rdx + r11*2 - 2]
jmp 0x140007cb4
cmp rcx, rdx
je 0x140007da2
sub rcx, 2
cmp word [rcx], 0x2e
jne 0x140007ca7
sub rcx, rdx
sar rcx, 1
cmp ecx, edi
jle 0x140007cd1
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140026ce8], ecx
lea rbx, [0x140026cd0]
cmp rsi, rbx
je 0x140007d29
mov rax, qword [0x140026cd0]
mov dword [0x140026cd8], edi
mov rcx, rbx
mov word [rax], di
mov edx, dword [0x140026ce8]
call fcn.140001114
mov r11, qword [0x140026ce0]
mov rcx, qword [0x140026cd0]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140007d09
mov eax, dword [0x140026ce8]
mov dword [0x140026cd8], eax
mov ecx, 4
call fcn.1400024cc
mov rcx, rbx
mov rdx, rax
call fcn.140002ac0
mov r11, qword [0x140026ce0]
mov rax, qword [0x140026cd0]
mov qword [0x140026c60], r11
mov qword [0x140026c70], rax
call fcn.140002744
lea rcx, [0x140026cf0]
mov rdx, rax
call fcn.140001358
mov ebp, 0x20
mov rcx, rbp
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
mov rbx, rax
je 0x140007daa
mov dword [rax + 0x10], edi
lea rax, [0x140021c00]
mov qword [rbx], rax
lea rax, [0x140021be0]
mov qword [rbx + 8], rax
or qword [rbx + 0x18], 0xffffffffffffffff
jmp 0x140007dad
or ecx, 0xffffffff
jmp 0x140007cc0
mov rbx, rdi
cmp rbx, rdi
je 0x140007dbb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
mov rdx, qword [0x140026d00]
mov rcx, rbx
call fcn.140014fe0
cmp al, dil
jne 0x140007dfb
mov r8, qword [0x140026d00]
mov edx, 7
lea ecx, [rdx - 6]
call fcn.14000c668
cmp rbx, rdi
je 0x140007df1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 2
jmp 0x140009566
mov esi, 3
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
mov edx, esi
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x7c], edi
call fcn.14000289c
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140004dc0
cmp al, dil
jne 0x140007e54
lea edx, [rsi + 6]
xor ecx, ecx
call fcn.14000c668
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140007e4d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, esi
jmp 0x140009566
cmp dword [0x140026d5c], edi
jne 0x140007f01
lea rdx, str.sfxconfig
mov rcx, r14
call fcn.14000584c
cmp rax, rdi
je 0x140007f01
cmp word [rax], 0x3a
jne 0x140007e82
add rax, 2
movzx ecx, word [rax]
cmp cx, di
je 0x140007ee0
cmp cx, bp
ja 0x140007e9b
add rax, 2
mov cx, word [rax]
cmp cx, di
jne 0x140007e8a
cmp word [rax], di
je 0x140007ee0
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.1400072ec
cmp al, dil
jne 0x140007ee0
mov edx, 0xa
xor ecx, ecx
call fcn.14000c668
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140007ed6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 4
jmp 0x140009566
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140009566
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x140009566
lea rcx, [rsp + 0xa8]
call fcn.140014d44
cmp dword [rsp + 0x78], edi
je 0x140007f2e
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x70]
xor r8d, r8d
call fcn.140003eb4
cmp al, dil
je 0x140007ebe
cmp dword [0x140026d5c], 4
je 0x140007ee0
cmp dword [0x140026060], edi
lea rsi, [0x140026060]
je 0x140008052
mov r8d, dword [rsi]
lea rdx, str.7zSfxString_d
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0xd8]
mov edx, 3
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], edi
mov dword [rsp + 0xe4], edi
call fcn.140001114
lea rcx, [rsp + 0xe8]
mov edx, 3
mov qword [rsp + 0xe8], rdi
mov dword [rsp + 0xf0], edi
mov dword [rsp + 0xf4], edi
call fcn.140001114
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0xd8]
call fcn.140001358
mov ecx, dword [rsi]
call fcn.1400024cc
lea rcx, [rsp + 0xe8]
mov rdx, rax
call fcn.140001358
mov rcx, rbp
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
je 0x140008000
lea rdx, [rsp + 0xd8]
mov rcx, rax
call fcn.140002d34
mov rbp, rax
jmp 0x140008003
mov rbp, rdi
lea rcx, [0x1400266b0]
call fcn.140014d54
movsxd r11, dword [0x1400266bc]
mov rax, qword [0x1400266c0]
mov rcx, qword [rsp + 0xe8]
mov qword [rax + r11*8], rbp
add dword [0x1400266bc], 1
mov ebp, 0x20
add rsi, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp dword [rsi], edi
jne 0x140007f4a
lea rcx, [rsp + 0xa8]
call fcn.140006208
sub r14, 2
jmp 0x140008069
add r14, 2
cmp word [r14], bp
ja 0x140008065
jmp 0x14000807a
cmp ax, bp
ja 0x140008083
add r14, 2
movzx eax, word [r14]
cmp ax, di
jne 0x140008071
cmp word [r14], 0x2f
je 0x140008095
cmp word [r14], 0x2d
jne 0x14000832d
cmp word [r14 + 2], 0x21
jne 0x1400080a8
cmp word [r14 + 4], bp
jbe 0x140008315
lea rdx, [0x140021f08]
lea rcx, [r14 + 2]
call fcn.140005614
cmp rax, rdi
je 0x140008117
lea rax, [r14 + 6]
cmp word [rax], 0x30
jb 0x1400080cd
cmp word [rax], 0x39
jbe 0x1400080e5
cmp word [rax], 0x61
jb 0x1400080d9
cmp word [rax], 0x7a
jbe 0x1400080e5
cmp word [rax], 0x41
jb 0x140008105
cmp word [rax], 0x5a
ja 0x140008105
mov ecx, 1
mov qword [rsp + 0x130], rax
mov r13b, cl
mov al, cl
mov byte [rsp + 0x30], cl
mov dword [rsp + 0x38], r13d
jmp 0x140008069
cmp word [rax], bp
ja 0x14000832d
lea rax, [0x140021cac]
jmp 0x1400080e5
lea rdx, [0x140021f00]
lea rcx, [r14 + 2]
call fcn.140005614
cmp rax, rdi
je 0x14000813c
lea rdx, [r14 + 6]
lea rcx, str.OverwriteMode
jmp 0x140008292
lea rdx, [0x140021ef8]
lea rcx, [r14 + 2]
call fcn.140005614
cmp rax, rdi
je 0x140008180
lea rdx, [r14 + 6]
cmp word [rdx], 0x30
jb 0x14000832d
cmp word [rdx], 0x32
ja 0x14000832d
cmp word [r14 + 8], bp
ja 0x14000832d
lea rcx, str.GUIMode
jmp 0x140008292
lea rdx, [0x140021ef0]
lea rcx, [r14 + 2]
call fcn.140005614
cmp rax, rdi
je 0x1400081a5
lea rdx, [r14 + 6]
lea rcx, str.GUIFlags
jmp 0x140008292
lea rdx, [0x140021ee8]
lea rcx, [r14 + 2]
call fcn.140005614
cmp rax, rdi
je 0x1400081ca
lea rdx, [r14 + 6]
lea rcx, str.MiscFlags
jmp 0x140008292
lea rdx, [0x140021ee0]
lea rcx, [r14 + 2]
call fcn.140005614
cmp rax, rdi
je 0x14000820a
lea rdx, [r14 + 6]
cmp word [rdx], 0x30
je 0x1400081f3
cmp word [rdx], 0x31
jne 0x14000832d
cmp word [r14 + 8], bp
ja 0x14000832d
lea rcx, str.SelfDelete
jmp 0x140008292
lea rdx, [0x140021ed8]
lea rcx, [r14 + 2]
call fcn.140005614
cmp rax, rdi
je 0x140008234
cmp word [r14 + 6], bp
ja 0x14000832d
mov byte [rsp + 0x32], 1
jmp 0x140008069
lea rdx, [0x140021ed0]
lea rcx, [r14 + 2]
call fcn.140005614
cmp rax, rdi
je 0x140008272
lea rcx, [r14 + 6]
cmp word [rcx], 0x30
jb 0x14000832d
cmp word [rcx], 0x39
ja 0x14000832d
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140026654], eax
jmp 0x140008069
lea rdx, [0x140021ec8]
lea rcx, [r14 + 2]
call fcn.140005614
cmp rax, rdi
je 0x1400082a4
lea rdx, [r14 + 8]
lea rcx, str.BeginPromptTimeout
lea r8, [rsp + 0xa8]
call fcn.1400064f8
jmp 0x140008069
cmp word [r14 + 2], 0x79
je 0x1400082b4
cmp word [r14 + 2], 0x59
jne 0x1400082c6
cmp word [r14 + 4], bp
ja 0x1400082c6
mov al, 1
mov byte [rsp + 0x30], al
jmp 0x140008069
cmp word [r14 + 2], 0x3f
je 0x1400082de
cmp word [r14 + 2], 0x68
je 0x1400082de
cmp word [r14 + 2], 0x48
jne 0x1400082ed
cmp word [r14 + 4], bp
ja 0x1400082ed
mov r15b, 1
jmp 0x140008069
lea rdx, [rsp + 0xa8]
lea rcx, [r14 + 2]
call fcn.140005ad0
cmp rax, rdi
je 0x14000832d
cmp rax, 1
je 0x140008480
mov r14, rax
jmp 0x140008069
add r14, 4
jmp 0x140008324
cmp ax, bp
ja 0x14000832d
add r14, 2
movzx eax, word [r14]
cmp ax, di
jne 0x14000831b
lea rcx, [rsp + 0xa8]
call fcn.140006208
cmp r12b, dil
jne 0x14000856b
test byte [0x140026c7c], 4
je 0x14000856b
call fcn.14000277c
cmp eax, edi
jne 0x14000856b
mov esi, 3
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov edx, esi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x5c], edi
call fcn.140001114
lea rcx, [rsp + 0x90]
mov edx, esi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x98], edi
mov dword [rsp + 0x9c], edi
call fcn.140001114
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140006178
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.140002a54
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x130]
mov dx, 0x22
call fcn.140005da8
lea r8, [0x140021d28]
lea rcx, [rsp + 0x150]
mov rdx, rax
call fcn.140005e0c
lea r8, str.sfxelevation
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.140005e0c
lea rcx, [rsp + 0x80]
movzx r8d, bp
mov rdx, rax
call fcn.140005e78
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xc8]
mov rdx, rax
call fcn.1400014e8
mov rsi, rax
lea rax, [rsp + 0x90]
cmp rsi, rax
je 0x14000849f
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x98], edi
mov word [rcx], di
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x90]
call fcn.140001114
mov r11, qword [rsi]
mov rsi, qword [rsp + 0x90]
mov rcx, rsi
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x14000846a
jmp 0x1400084a7
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008498
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, ebp
jmp 0x140009566
mov rsi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x150]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x130]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 2]
call fcn.14000681c
mov rcx, qword [rsp + 0x60]
cmp eax, edi
jne 0x14000854f
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008545
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 0xb
jmp 0x140009566
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140007ee0
lea r8, [rsp + 0xa0]
lea rdx, str.SetEnvironment
lea rcx, [rsp + 0xa8]
mov dword [rsp + 0xa0], edi
call fcn.140003784
cmp rax, rdi
mov r12, rax
je 0x14000874d
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.140002a54
mov rbp, qword [rsp + 0x50]
movzx ecx, word [rbp]
mov rsi, rbp
jmp 0x1400085c5
cmp cx, di
je 0x1400086b4
add rsi, 2
mov cx, word [rsi]
cmp cx, 0x3d
jne 0x1400085b5
sub rsi, rbp
sar rsi, 1
cmp esi, edi
jle 0x140008740
movsxd r13, esi
lea rcx, [rsp + 0xd8]
mov edx, 3
mov dword [rsp + 0x58], esi
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], edi
mov word [rbp + r13*2], di
mov dword [rsp + 0xe4], edi
call fcn.140001114
lea rcx, [rsp + 0xe8]
mov edx, 3
mov qword [rsp + 0xe8], rdi
mov dword [rsp + 0xf0], edi
mov dword [rsp + 0xf4], edi
call fcn.140001114
mov rax, qword [rsp + 0xd8]
lea rcx, [rsp + 0xd8]
mov edx, esi
mov word [rax], di
mov dword [rsp + 0xe0], edi
call fcn.140001114
mov rcx, qword [rsp + 0xd8]
mov r11, rbp
sub rcx, rbp
movzx eax, word [r11]
mov word [r11 + rcx], ax
add r11, 2
cmp ax, di
jne 0x140008665
lea rdx, [r12 + r13*2 + 2]
lea rcx, [rsp + 0xe8]
mov dword [rsp + 0xe0], esi
call fcn.140001358
mov ecx, 0x20
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
je 0x1400086bc
lea rdx, [rsp + 0xd8]
mov rcx, rax
call fcn.140002d34
mov rsi, rax
jmp 0x1400086bf
or esi, 0xffffffff
jmp 0x1400085d1
mov rsi, rdi
lea rcx, [0x1400266b0]
call fcn.140014d54
movsxd r11, dword [0x1400266bc]
mov rax, qword [0x1400266c0]
mov rcx, qword [rsp + 0xe8]
mov qword [rax + r11*8], rsi
mov esi, 1
add dword [0x1400266bc], esi
add dword [rsp + 0xa0], esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r8, [rsp + 0xa0]
lea rdx, str.SetEnvironment
lea rcx, [rsp + 0xa8]
call fcn.140003784
cmp rax, rdi
mov r12, rax
jne 0x14000859a
mov r13d, dword [rsp + 0x38]
jmp 0x140008752
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r13d, dword [rsp + 0x38]
mov esi, 1
call fcn.1400071c8
mov r11d, dword [0x140026648]
cmp r11d, 0xffffffff
cmove r11d, edi
cmp r15b, dil
mov dword [0x140026648], r11d
je 0x1400087fc
lea rdx, str.HelpText
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003784
cmp rax, rdi
mov rsi, rax
jne 0x1400087a2
mov ecx, 0x18
call fcn.1400024cc
mov rsi, rax
lea rcx, [rsp + 0x1a0]
call fcn.14000ad30
mov r8, qword [0x140026c60]
lea r11, [0x140021840]
lea rcx, [rsp + 0x1a0]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x1a0], r11
mov dword [rsp + 0x1f0], 0x7d6
mov qword [rsp + 0x20], rdi
call fcn.14000adc4
lea rcx, [rsp + 0x1a0]
call fcn.14000a9c0
jmp 0x140007ee0
mov bpl, byte [rsp + 0x30]
cmp bpl, dil
je 0x140008812
btr r11d, 8
mov dword [0x140026648], r11d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, str.InstallPath
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003784
lea r15, [0x140026ca0]
cmp rax, rdi
je 0x140008848
mov rdx, rax
mov rcx, r15
call fcn.140001358
mov rcx, r15
call fcn.140007134
lea rdx, str.BeginPromptTimeout
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003784
cmp rax, rdi
je 0x14000887b
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140026c88], eax
cmp dword [0x140026d68], edi
je 0x1400088b3
lea rcx, [rsp + 0xa8]
call fcn.14000c898
mov rcx, qword [rsp + 0x70]
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140007e4d
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + InitCommonControls]
jmp 0x140007e4d
cmp dword [0x140026d5c], 3
jne 0x1400088cb
lea rcx, [rsp + 0xa8]
call fcn.14000c7ac
jmp 0x140008890
lea rdx, str.BeginPrompt
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003784
cmp rax, rdi
je 0x14000892b
cmp bpl, dil
jne 0x14000892b
mov rcx, qword [0x140026c60]
mov rdx, rax
call fcn.14000b848
cmp eax, edi
je 0x140008ae4
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r13d, r13b
bt ax, 0xf
cmovb r13d, esi
cmp dword [0x140026d38], edi
je 0x14000892b
btr dword [0x140026648], 7
lea rcx, [rsp + 0x80]
mov edx, 3
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0x88], edi
mov dword [rsp + 0x8c], edi
call fcn.140001114
cmp r13b, dil
mov r12, qword [rsp + 0x130]
je 0x140008a09
mov rbp, r12
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x80]
call fcn.140001358
movzx edx, word [rbp]
lea rcx, [rsp + 0x80]
call fcn.14000145c
mov rsi, qword [rsp + 0x80]
lea rcx, [rsp + 0xa8]
mov rdx, rsi
xor r8d, r8d
call fcn.140003784
cmp rax, rdi
je 0x140008b06
add rbp, 2
cmp word [rbp], 0x30
jb 0x1400089c2
cmp word [rbp], 0x39
jbe 0x140008967
cmp word [rbp], 0x61
jb 0x1400089d0
cmp word [rbp], 0x7a
jbe 0x140008967
cmp word [rbp], 0x41
jb 0x1400089de
cmp word [rbp], 0x5a
jbe 0x140008967
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x80]
call fcn.140001358
movzx edx, word [r12]
lea rcx, [rsp + 0x80]
call fcn.14000145c
mov bpl, byte [rsp + 0x30]
cmp dword [rsp + 0x88], edi
mov byte [rsp + 0x31], dil
jne 0x140008a85
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003784
cmp rax, rdi
je 0x140008a55
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0x80]
call fcn.140001358
cmp dword [rsp + 0x88], edi
mov byte [rsp + 0x31], 1
jne 0x140008a85
lea rdx, str.RunProgram
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003784
cmp rax, rdi
je 0x140008a85
lea rdx, str.RunProgram
lea rcx, [rsp + 0x80]
call fcn.140001358
cmp r13b, dil
jne 0x140008b46
cmp bpl, dil
jne 0x140008b46
mov eax, dword [0x140026648]
and ax, 0xc0
cmp al, 0x80
jne 0x140008b46
mov rdx, qword [0x140026c48]
mov rcx, qword [0x140026c50]
call fcn.14000b92c
cmp eax, edi
jne 0x140008b46
cmp byte [0x140026c8c], dil
mov rcx, qword [rsp + 0x80]
je 0x140008b3f
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov esi, 1
jmp 0x1400088cb
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008afc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 5
jmp 0x140009566
mov r8, rsi
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000c668
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008b35
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 6
jmp 0x140009566
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140008ae4
mov edx, dword [0x140026ca8]
cmp edx, edi
jne 0x140008bc1
lea rdx, str.7ZipSfx._03x
lea rcx, [rsp + 0x50]
call fcn.140005994
cmp rax, r15
mov rsi, rax
je 0x140008bab
mov rcx, qword [0x140026ca0]
mov dword [0x140026ca8], edi
mov word [rcx], di
mov edx, dword [rax + 8]
mov rcx, r15
call fcn.140001114
mov r11, qword [rsi]
mov rcx, qword [0x140026ca0]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008b8e
mov eax, dword [rsi + 8]
mov dword [0x140026ca8], eax
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov byte [0x140026c28], dil
jmp 0x140008c6d
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x6c], edi
call fcn.140001114
mov r11, qword [0x140026ca0]
mov rcx, qword [rsp + 0x60]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008be4
mov eax, dword [0x140026ca8]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x68], eax
call fcn.140007134
cmp dword [rsp + 0x68], edi
jne 0x140008c58
mov rax, qword [0x140026ca0]
mov dword [0x140026ca8], edi
mov rcx, r15
mov word [rax], di
mov edx, dword [rsp + 0x68]
call fcn.140001114
mov r11, qword [rsp + 0x60]
mov rcx, qword [0x140026ca0]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008c3a
mov eax, dword [rsp + 0x68]
mov dword [0x140026ca8], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov byte [0x140026c28], al
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
movsxd rcx, dword [0x140026ca8]
mov rdx, qword [0x140026ca0]
cmp word [rdx + rcx*2 - 2], 0x5c
je 0x140008c8b
cmp word [rdx + rcx*2 - 2], 0x2f
jne 0x140008c9b
add ecx, 0xffffffff
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140026ca8], ecx
cmp bpl, dil
je 0x140008ca7
or dword [0x140026c7c], 3
cmp dword [0x140026d58], edi
jne 0x140008cbc
mov rdx, r15
mov rcx, rbx
call fcn.140006db8
jmp 0x140008cca
call fcn.14000b9c4
cmp eax, edi
jne 0x140008d12
mov eax, 0x80004005
cmp eax, edi
je 0x140008d12
cmp byte [0x140026c28], dil
jne 0x140008ce3
mov rcx, qword [0x140026ca0]
call fcn.1400038e4
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008d08
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 8
jmp 0x140009566
call fcn.1400071c8
cmp byte [rsp + 0x32], dil
je 0x140008d34
cmp byte [0x140026c28], dil
je 0x140008d34
mov r15, qword [rsp + 0x80]
jmp 0x140009685
lea rcx, [rsp + 0x60]
mov edx, 3
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x6c], edi
call fcn.140001114
cmp r13b, dil
jne 0x140008d6b
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xa8]
call fcn.140007284
mov byte [rsp + 0x33], dil
mov rsi, r12
mov qword [rsp + 0x150], r12
mov r15, qword [rsp + 0x80]
lea rcx, [rsp + 0x40]
mov edx, 3
mov dword [rsp + 0xf8], edi
mov byte [rsp + 0x34], dil
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x4c], edi
call fcn.140001114
lea rcx, [rsp + 0xc8]
mov edx, 3
mov qword [rsp + 0xc8], rdi
mov dword [rsp + 0xd0], edi
mov dword [rsp + 0xd4], edi
call fcn.140001114
cmp dword [rsp + 0x88], edi
mov r13d, edi
jne 0x140008f08
cmp byte [0x140026c28], dil
jne 0x1400094c0
lea r8, [0x140020b7c]
lea rdx, [0x140026ca0]
lea rcx, [rsp + 0x190]
lea rbp, str.setup.exe
call fcn.140005e0c
lea r8, str.setup.exe
lea rcx, [rsp + 0x180]
mov rdx, rax
call fcn.140005e0c
mov rsi, rax
lea rax, [rsp + 0x40]
cmp rsi, rax
je 0x140008e77
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x48], edi
mov word [rcx], di
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x40]
call fcn.140001114
mov r12, qword [rsp + 0x40]
mov r11, qword [rsi]
mov rcx, r12
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008e5a
mov eax, dword [rsi + 8]
mov dword [rsp + 0x48], eax
jmp 0x140008e7c
mov r12, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x180]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x190]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140009456
mov byte [rsp + 0x33], 1
lea rcx, [rsp + 0xc8]
mov rdx, rbp
call fcn.140001358
lea rcx, [rsp + 0xc8]
call fcn.14000719c
mov rsi, qword [rsp + 0xc8]
mov r12d, 1
mov r15w, 0x3a
lea rdx, str.waitall
mov rcx, rsi
call fcn.140005614
cmp rax, rdi
je 0x140008fb6
cmp word [rax], r15w
jne 0x140008fa1
add rax, 2
jmp 0x140008fa4
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0xa8]
mov rdx, r15
call fcn.140003784
cmp rax, rdi
mov rbp, rax
jne 0x140008ead
add rsi, 2
mov qword [rsp + 0x150], rsi
cmp word [rsi], 0x30
jb 0x140008f3d
cmp word [rsi], 0x39
jbe 0x140008f5d
cmp word [rsi], 0x61
jb 0x140008f49
cmp word [rsi], 0x7a
jbe 0x140008f5d
cmp word [rsi], 0x41
jb 0x1400094c0
cmp word [rsi], 0x5a
ja 0x1400094c0
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x80]
call fcn.140001358
movzx edx, word [rsi]
lea rcx, [rsp + 0x80]
call fcn.14000145c
mov rcx, qword [rsp + 0xc8]
mov dword [rsp + 0x38], edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140008d7b
mov rax, rdi
cmp rax, rdi
je 0x140008fb6
mov rsi, rax
mov byte [rsp + 0x34], r12b
jmp 0x140008edd
lea rdx, str.hidcon
mov rcx, rsi
call fcn.140005614
cmp rax, rdi
je 0x140008fe9
cmp word [rax], r15w
jne 0x140008fd6
add rax, 2
jmp 0x140008fd9
mov rax, rdi
cmp rax, rdi
je 0x140008fe9
mov rsi, rax
or r13d, r12d
jmp 0x140008edd
lea rdx, str.nowait
mov rcx, rsi
call fcn.140005614
cmp rax, rdi
je 0x140009023
cmp word [rax], r15w
jne 0x140009009
add rax, 2
jmp 0x14000900c
mov rax, rdi
cmp rax, rdi
je 0x140009023
cmp byte [0x140026c28], dil
mov rsi, rax
je 0x140008edd
jmp 0x14000904e
lea rdx, str.forcenowait
mov rcx, rsi
call fcn.140005614
cmp rax, rdi
je 0x140009058
cmp word [rax], r15w
jne 0x140009043
add rax, 2
jmp 0x140009046
mov rax, rdi
cmp rax, rdi
je 0x140009058
mov rsi, rax
bts r13d, 0x10
jmp 0x140008edd
lea rdx, [0x140021ed0]
mov r8d, 2
mov rcx, rsi
call fcn.140005670
cmp rax, rdi
mov rbp, rax
je 0x140009096
cmp dword [0x140026654], 0xffffffff
jne 0x14000908e
lea rcx, [rsi + 4]
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140026654], eax
mov rsi, rbp
jmp 0x140008edd
lea rdx, [0x140021e40]
mov r8d, 3
mov rcx, rsi
call fcn.140005670
cmp rax, rdi
je 0x1400090c9
movzx r15d, word [rsi + 6]
mov rsi, rax
sub r15d, 0x30
mov dword [rsp + 0x110], r15d
jmp 0x140008ed8
lea rdx, [0x140021e38]
mov r8d, 3
mov rcx, rsi
call fcn.140005670
cmp rax, rdi
je 0x140009102
movzx r12d, word [rsi + 6]
mov rsi, rax
sub r12d, 0x30
mov dword [rsp + 0x128], r12d
mov r12d, 1
jmp 0x140008edd
lea rdx, [0x140020a00]
mov rcx, rsi
call fcn.140005614
cmp rax, rdi
je 0x14000912a
cmp word [rax], r15w
jne 0x140009122
add rax, 2
jmp 0x140009125
mov rax, rdi
cmp rax, rdi
jne 0x140009152
lea rdx, str.i386
mov rcx, rsi
call fcn.140005614
cmp rax, rdi
je 0x140009162
cmp word [rax], r15w
jne 0x14000914a
add rax, 2
jmp 0x14000914d
mov rax, rdi
cmp rax, rdi
je 0x140009162
mov rsi, rax
mov dword [rsp + 0xf8], r12d
jmp 0x140008edd
lea rdx, str.amd64
mov rcx, rsi
call fcn.140005614
cmp rax, rdi
je 0x14000918a
cmp word [rax], r15w
jne 0x140009182
add rax, 2
jmp 0x140009185
mov rax, rdi
cmp rax, rdi
jne 0x1400091b2
lea rdx, [0x1400209f8]
mov rcx, rsi
call fcn.140005614
cmp rax, rdi
je 0x1400091c5
cmp word [rax], r15w
jne 0x1400091aa
add rax, 2
jmp 0x1400091ad
mov rax, rdi
cmp rax, rdi
je 0x1400091c5
mov rsi, rax
mov dword [rsp + 0xf8], 2
jmp 0x140008edd
cmp byte [rsp + 0x31], dil
mov r12, qword [rsp + 0x40]
mov r15, qword [rsp + 0x80]
lea rcx, [rsp + 0x40]
je 0x14000924a
cmp word [rsi], 0x22
je 0x140009210
lea rdx, [0x140021ca0]
call fcn.140001358
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.140002ac0
lea rdx, [0x140021ca0]
lea rcx, [rsp + 0x40]
call fcn.140002ac0
jmp 0x140009218
mov rdx, rsi
call fcn.140001358
lea rdx, str.ExecuteParameters
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003784
cmp rax, rdi
mov rsi, rax
je 0x14000928f
lea rdx, [0x140021e10]
lea rcx, [rsp + 0x40]
call fcn.140002ac0
jmp 0x140009282
mov word [r12], di
mov edx, dword [rsp + 0x68]
mov dword [rsp + 0x48], edi
call fcn.140001114
mov r11, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140009266
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.140002ac0
lea rcx, [rsp + 0x90]
mov edx, 3
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x98], edi
mov dword [rsp + 0x9c], edi
call fcn.140001114
mov rsi, qword [rsp + 0x40]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.140006178
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.140002a54
lea rcx, [rsp + 0x90]
call fcn.14000719c
cmp dword [0x140026d5c], edi
jne 0x1400093f2
mov ecx, dword [rsp + 0xf8]
call fcn.140002768
cmp eax, edi
je 0x1400093f2
cmp word [r14], di
je 0x140009333
lea rcx, [rsp + 0x50]
mov dx, 0x20
call fcn.14000145c
lea rcx, [rsp + 0x50]
mov rdx, r14
call fcn.140002ac0
jmp 0x14000932d
add r14, 2
cmp word [r14], di
jne 0x140009329
lea rcx, [rsp + 0x50]
call fcn.14000719c
mov al, byte [rsp + 0x34]
cmp al, dil
jne 0x1400093d5
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x160]
mov dx, 0x22
call fcn.140005da8
lea r8, [0x140021d04]
lea rcx, [rsp + 0x170]
mov rdx, rax
call fcn.140005e0c
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xd8]
mov rdx, rax
call fcn.1400014e8
mov rcx, qword [rsp + 0x170]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x160]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rbp, qword [rsp + 0xd8]
mov r8, qword [0x140026ca0]
mov rcx, rbp
mov edx, r13d
call fcn.14000681c
mov rcx, rbp
cmp eax, edi
je 0x1400094d7
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400093f2
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
mov r8d, r13d
call fcn.140006978
cmp eax, edi
jne 0x1400094de
cmp byte [rsp + 0x31], dil
jne 0x1400095bd
cmp byte [rsp + 0x33], dil
jne 0x1400095bd
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x68], edi
mov word [rax], di
mov rcx, qword [rsp + 0x50]
mov eax, 1
add dword [rsp + 0x38], eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rsi, qword [rsp + 0x150]
jmp 0x140008d83
cmp byte [0x140026c28], dil
jne 0x14000946b
mov rcx, qword [0x140026ca0]
call fcn.1400038e4
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000c668
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400094b6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 7
jmp 0x140009566
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
jmp 0x1400095e4
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400094e6
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, InitCommonControls
mov r8, rsi
lea ecx, [rdx - 0xf]
call fcn.14000c668
cmp byte [0x140026c28], dil
jne 0x14000950b
mov rcx, qword [0x140026ca0]
call fcn.1400038e4
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140009561
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 9
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x140021930]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.140014d44
lea rcx, [rsp + 0xa8]
call fcn.140014dfc
mov rcx, qword [rsp + 0x140]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x118]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, edi
jmp 0x14000984a
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp dword [0x140026d5c], edi
jne 0x140009676
call fcn.1400071c8
mov eax, dword [rsp + 0x110]
mov r12, qword [rsp + 0x130]
lea r8, str.Shortcut
lea rdx, [rsp + 0xa8]
lea rcx, [0x140007594]
mov r9, r12
mov dword [rsp + 0x20], eax
call fcn.140006574
mov rcx, qword [0x140026cb0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [rsp + 0x128]
lea r8, str.Delete
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0xa8]
lea rcx, [0x14000769c]
mov r9, r12
call fcn.140006574
cmp byte [0x140026c28], dil
jne 0x140009676
mov rcx, qword [0x140026ca0]
call fcn.1400038e4
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov bpl, byte [rsp + 0x30]
mov eax, dword [0x140026654]
cmp eax, 0xffffffff
jne 0x1400096a1
cmp bpl, dil
jne 0x140009733
mov eax, edi
mov dword [0x140026654], eax
cmp eax, edi
jle 0x140009733
lea rdx, str.FinishMessage
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003784
cmp rax, rdi
mov rsi, rax
je 0x140009733
mov ecx, dword [0x140026654]
mov eax, 0x3e7
cmp ecx, eax
cmovg ecx, eax
mov dword [0x140026654], ecx
lea rcx, [rsp + 0x1a0]
call fcn.14000ad30
mov r8, qword [0x140026c60]
lea r11, [0x1400218d0]
lea rcx, [rsp + 0x1a0]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x1a0], r11
mov dword [rsp + 0x1f0], 0x7d5
mov qword [rsp + 0x20], rdi
call fcn.14000adc4
lea rcx, [rsp + 0x1a0]
call fcn.14000a9c0
cmp byte [rsp + 0x32], dil
jne 0x1400097b5
cmp dword [0x140026d5c], edi
jne 0x1400097b5
lea rdx, str.SelfDelete
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003784
cmp rax, rdi
je 0x1400097b5
cmp word [rax], 0x31
jne 0x1400097b5
mov edx, dword [0x140026d08]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x5c], edi
call fcn.140001114
mov r11, qword [0x140026d00]
mov rcx, qword [rsp + 0x50]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x14000978d
mov eax, dword [0x140026d08]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x58], eax
call fcn.140006ef4
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400097d5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x140021930]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.140014d44
lea rcx, [rsp + 0xa8]
call fcn.140014dfc
mov rcx, qword [rsp + 0x140]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x118]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
jmp 0x14000984a
lea r8, str.7_Zip_SFX
lea rdx, str.Sorry__this_program_requires_Microsoft_Windows_2000_or_later.
mov r9d, InitCommonControls
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x14
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret