Function at 0x140007fa4
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Encode data using xor
Get file attributes
Log keystrokes via polling
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3c0
lea rcx, [0x140006298]
call qword [sym.imp.msvcrt.dll_int____cdecl___unsigned_long_long_unsigned___int64_____cdecl__set_new_handler_int____cdecl___unsigned_long_long_unsigned___int64___]
call fcn.14000252c
lea rcx, [rsp + 0x2a0]
mov dword [rsp + 0x2a0], 0x114
call qword [sym.imp.KERNEL32.DLL_GetVersionExW]
xor edi, edi
cmp eax, edi
je 0x14000a307
cmp dword [rsp + 0x2b0], 2
jne 0x14000a307
cmp dword [rsp + 0x2a4], 5
jb 0x14000a307
or dword [rsp + 0xe8], 0xffffffff
or dword [rsp + 0xec], 0xffffffff
lea rax, [0x140025f24]
lea ebx, [rdi + 3]
lea rcx, [rsp + 0x58]
mov byte [str.___InstallEnd__], 0x3b
mov edx, ebx
mov byte [str.___Install__UTF_8_], 0x3b
mov rbp, rax
mov qword [rsp + 0x100], rax
mov byte [rsp + 0x31], dil
mov byte [rsp + 0x30], dil
mov byte [rsp + 0x33], dil
mov r14b, dil
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x64], edi
call fcn.1400011b4
lea rcx, [rsp + 0x110]
mov edx, ebx
mov qword [rsp + 0x110], rdi
mov dword [rsp + 0x118], edi
mov dword [rsp + 0x11c], edi
call fcn.1400011b4
lea rax, [0x140025bd0]
lea ebx, [rdi + 1]
lea rcx, [rsp + 0xf0]
mov edx, ebx
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0xb4], edi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], 8
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xfc], edi
call fcn.1400011b4
mov rax, qword [rsp + 0xf0]
mov word [rax], 0x20
mov rax, qword [rsp + 0xf0]
mov word [rax + 2], di
mov dword [rsp + 0xf8], ebx
call qword [sym.imp.KERNEL32.DLL_GetCommandLineW]
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.140006bd0
lea rcx, [rsp + 0xf0]
mov rdx, rax
call fcn.1400031a8
lea rcx, [rsp + 0xf0]
call fcn.140003bb8
mov r15, qword [rsp + 0xf0]
add r15, 2
mov rcx, r15
mov r12, r15
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
lea rdx, [0x140024bd8]
mov r8d, ebx
movsxd rcx, eax
lea r13, [r15 + rcx*2]
lea rcx, str.SfxVarModulePlatform
call fcn.1400044d4
call fcn.140002e2c
lea rcx, str.SfxVarSystemPlatform
mov rdx, rax
mov r8d, ebx
call fcn.1400044d4
lea rcx, str.SfxVarCmdLine0
mov r8d, ebx
mov rdx, r15
call fcn.1400044d4
call fcn.140005e24
cmp dword [rsp + 0x64], 0x20
jg 0x1400081b7
lea edx, [rdi + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400011b4
mov rsi, qword [rsp + 0x58]
movzx r8d, word [0x14002bd98]
lea rdx, [0x1400262ac]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
cmp word [rsi], di
mov r11d, edi
je 0x1400081eb
mov rax, rsi
add rax, 2
add r11d, ebx
cmp word [rax], di
jne 0x1400081df
movsxd rax, r11d
lea rcx, str.SfxVarSystemLanguage
mov r8d, ebx
mov rdx, rsi
mov dword [rsp + 0x60], r11d
mov word [rsi + rax*2], di
call fcn.1400044d4
lea rdx, str.sfxlang
mov rcx, r15
call fcn.14000620c
cmp rax, rdi
je 0x14000826a
cmp word [rax], 0x3a
jne 0x14000826a
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll__wtol]
movzx edx, word [0x14002bd98]
lea ecx, [rax - 1]
cmp ecx, 0xfffe
cmovbe dx, ax
mov word [0x14002bd98], dx
jmp 0x14000824e
add r15, 2
cmp word [r15], 0x20
ja 0x14000824a
jmp 0x140008261
cmp ax, 0x20
ja 0x14000826a
add r15, 2
movzx eax, word [r15]
cmp ax, di
jne 0x140008257
lea rdx, str.sfxversion
mov rcx, r15
call fcn.14000620c
cmp rax, rdi
je 0x140008288
call fcn.140007164
jmp 0x14000a044
lea rdx, str.sfxwaitall
mov rcx, r15
call fcn.14000620c
cmp rax, rdi
je 0x1400082ab
mov rcx, rax
call fcn.1400077cc
mov edi, eax
jmp 0x14000a044
lea rdx, str.sfxelevation
mov rcx, r15
mov bpl, dil
call fcn.14000620c
cmp rax, rdi
je 0x1400082dc
mov bpl, bl
jmp 0x1400082d1
cmp cx, 0x20
ja 0x1400082d9
add rax, 2
movzx ecx, word [rax]
cmp cx, di
jne 0x1400082c7
mov r15, rax
mov ebx, 0x208
lea rax, [0x14002be88]
cmp dword [0x14002be94], ebx
jg 0x1400082fa
mov edx, ebx
mov rcx, rax
call fcn.1400011b4
mov rdx, qword [0x14002be88]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
cmp eax, edi
jne 0x140008327
mov edx, 6
lea ecx, [rdx - 5]
call fcn.14000d328
mov edi, 1
jmp 0x14000a044
mov rdx, qword [0x14002be88]
mov ecx, edi
cmp word [rdx], di
je 0x140008344
mov rax, rdx
add rax, 2
add ecx, 1
cmp word [rax], di
jne 0x140008338
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x14002be90], ecx
lea rdx, str.sfxtest
mov rcx, r15
call fcn.14000620c
cmp rax, rdi
mov rbx, rax
je 0x140008573
cmp word [rax], 0x3a
je 0x14000837c
mov edi, 0x64
jmp 0x14000a044
movzx edx, word [rax + 2]
mov ecx, edx
or ecx, 0x20
sub ecx, 0x61
je 0x1400084ad
sub ecx, 2
je 0x140008495
mov r15d, 1
sub ecx, r15d
je 0x140008412
sub ecx, 0xb
je 0x1400083b6
cmp ecx, 7
jne 0x140008372
mov edi, 0x4a98
jmp 0x14000a044
cmp word [rax + 4], 0x3a
jne 0x14000a044
movzx ecx, word [rax + 6]
sub ecx, 0x31
je 0x14000840a
sub ecx, r15d
je 0x140008400
sub ecx, r15d
je 0x1400083f6
sub ecx, r15d
je 0x1400083ec
cmp ecx, r15d
jne 0x14000a044
mov edi, 7
jmp 0x14000a044
mov edi, 0x2ff
jmp 0x14000a044
mov edi, 0x1f
jmp 0x14000a044
mov edi, 0xff
jmp 0x14000a044
mov edi, r15d
jmp 0x14000a044
cmp edx, 0x44
jne 0x140008457
cmp word [rax + 4], 0x3a
jne 0x140008372
add rbx, 6
jmp 0x140008441
cmp ax, 0x3a
je 0x14000844a
lea rcx, [0x14002bee8]
movzx edx, ax
call fcn.1400018e8
add rbx, 2
movzx eax, word [rbx]
cmp ax, 0x20
ja 0x140008428
cmp dword [0x14002bef0], edi
jne 0x14000845b
jmp 0x140008372
add rbx, 4
mov dword [0x14002bee0], edi
cmp word [rbx], 0x3a
jne 0x140008482
lea rcx, [rbx + 2]
call qword [sym.imp.msvcrt.dll__wtol]
cmp eax, 0xe10
mov dword [0x14002bee0], eax
ja 0x140008482
cmp eax, edi
jne 0x14000848c
mov dword [0x14002bee0], 0xa
mov dword [0x14002bee4], r15d
jmp 0x1400084bd
movzx eax, word [rax + 4]
sub ax, 0x63
neg ax
sbb eax, eax
add eax, 4
mov dword [0x14002bee4], eax
jmp 0x1400084bd
mov dword [0x14002bee4], 2
jmp 0x1400084bd
add rbx, 2
cmp word [rbx], 0x20
ja 0x1400084b9
jmp 0x1400084cf
cmp ax, 0x20
ja 0x1400084d7
add rbx, 2
movzx eax, word [rbx]
cmp ax, di
jne 0x1400084c5
lea rdx, str.sfxconfig
mov rcx, rbx
mov r15, rbx
call fcn.14000620c
cmp rax, rdi
je 0x140008573
cmp word [rax], 0x3a
jne 0x140008504
jmp 0x140008500
cmp cx, 0x20
ja 0x14000850c
add rax, 2
movzx ecx, word [rax]
cmp cx, di
jne 0x1400084fa
lea rdx, [rsp + 0x58]
mov rcx, rax
mov dword [rsp + 0x60], edi
mov word [rsi], di
call fcn.140006bd0
cmp dword [0x14002bee4], 2
mov r15, rax
je 0x140008573
mov rcx, qword [0x14002be88]
mov ebx, dword [rsp + 0x60]
mov dword [0x14002be90], edi
mov word [rcx], di
lea rcx, [0x14002be88]
mov edx, ebx
call fcn.1400011b4
mov rcx, qword [rsp + 0x58]
mov rdx, qword [0x14002be88]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx], ax
add rdx, 2
cmp ax, di
jne 0x14000855a
mov dword [0x14002be90], ebx
lea rcx, [0x14002be38]
lea rbx, [0x14002be88]
cmp rbx, rcx
je 0x1400085cf
mov rax, qword [0x14002be38]
mov dword [0x14002be40], edi
mov word [rax], di
mov edx, dword [0x14002be90]
call fcn.1400011b4
mov r11, qword [0x14002be88]
mov rcx, qword [0x14002be38]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x1400085af
mov eax, dword [0x14002be90]
mov dword [0x14002be40], eax
lea rsi, [0x14002be48]
cmp rbx, rsi
je 0x140008627
mov rax, qword [0x14002be48]
mov dword [0x14002be50], edi
mov rcx, rsi
mov word [rax], di
mov edx, dword [0x14002be90]
call fcn.1400011b4
mov r11, qword [0x14002be88]
mov rcx, qword [0x14002be48]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008607
mov eax, dword [0x14002be90]
mov dword [0x14002be50], eax
mov rcx, rbx
call fcn.1400040c8
cmp eax, edi
jl 0x14000874e
mov rcx, qword [0x14002be38]
movsxd rbx, eax
mov word [rcx + rbx*2], di
mov dword [0x14002be40], eax
mov rax, qword [0x14002be88]
lea rdx, [rax + rbx*2 + 2]
mov rcx, rsi
call fcn.1400014a0
mov r11, qword [0x14002be88]
lea rsi, [0x14002be68]
lea rdx, [r11 + rbx*2 + 2]
mov rcx, rsi
call fcn.1400014a0
movsxd r11, dword [0x14002be70]
cmp r11d, edi
je 0x1400086be
mov rdx, qword [0x14002be68]
lea rcx, [rdx + r11*2 - 2]
jmp 0x1400086a1
cmp rcx, rdx
je 0x140008793
sub rcx, 2
cmp word [rcx], 0x2e
jne 0x140008694
sub rcx, rdx
sar rcx, 1
cmp ecx, edi
jle 0x1400086be
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x14002be70], ecx
lea rbx, [0x14002be58]
cmp rsi, rbx
je 0x140008716
mov rax, qword [0x14002be58]
mov dword [0x14002be60], edi
mov rcx, rbx
mov word [rax], di
mov edx, dword [0x14002be70]
call fcn.1400011b4
mov r11, qword [0x14002be68]
mov rcx, qword [0x14002be58]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x1400086f6
mov eax, dword [0x14002be70]
mov dword [0x14002be60], eax
mov ecx, 4
call fcn.140002bb4
mov rcx, rbx
mov rdx, rax
call fcn.1400031a8
mov r11, qword [0x14002be68]
mov rax, qword [0x14002be58]
mov qword [0x14002bdd8], r11
mov qword [0x14002bde8], rax
mov qword [0x14002bdf0], r11
call fcn.140002e2c
lea rcx, [0x14002be78]
mov rdx, rax
call fcn.1400014a0
mov ecx, 0x20
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
mov rbx, rax
je 0x14000879b
mov dword [rax + 0x10], edi
lea rax, [0x140025ee0]
mov qword [rbx], rax
lea rax, [0x140025ec0]
mov qword [rbx + 8], rax
or qword [rbx + 0x18], 0xffffffffffffffff
jmp 0x14000879e
or ecx, 0xffffffff
jmp 0x1400086ad
mov rbx, rdi
cmp rbx, rdi
je 0x1400087ac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
mov rdx, qword [0x14002be88]
lea rcx, [rbx + 0x18]
call fcn.1400181b0
cmp al, dil
jne 0x1400087ed
mov r8, qword [0x14002be88]
mov edx, 7
lea ecx, [rdx - 6]
call fcn.14000d328
cmp rbx, rdi
je 0x1400087e3
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 2
jmp 0x14000a044
mov esi, 3
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rdi
mov edx, esi
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x84], edi
call fcn.140002f84
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.1400055a0
cmp al, dil
jne 0x14000884c
lea edx, [rsi + 6]
xor ecx, ecx
call fcn.14000d328
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008845
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, esi
jmp 0x14000a044
cmp dword [0x14002bee4], edi
jne 0x1400088fa
lea rdx, str.sfxconfig
mov rcx, r15
call fcn.14000620c
cmp rax, rdi
je 0x1400088fa
cmp word [rax], 0x3a
jne 0x14000887a
add rax, 2
movzx ecx, word [rax]
cmp cx, di
je 0x1400088d9
cmp cx, 0x20
ja 0x140008894
add rax, 2
mov cx, word [rax]
cmp cx, di
jne 0x140008882
cmp word [rax], di
je 0x1400088d9
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.140007be0
cmp al, dil
jne 0x1400088d9
mov edx, 0xa
xor ecx, ecx
call fcn.14000d328
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400088cf
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 4
jmp 0x14000a044
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000a044
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x14000a044
lea rcx, [rsp + 0xa8]
call fcn.1400186a8
cmp dword [rsp + 0x80], edi
je 0x14000892a
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x78]
xor r8d, r8d
call fcn.1400046b4
cmp al, dil
je 0x1400088b7
cmp dword [0x14002bee4], 4
je 0x1400088d9
mov eax, dword [0x14002b060]
lea rsi, [0x14002b060]
jmp 0x14000897a
lea rdx, str.SfxString_d
lea rcx, [rsp + 0x240]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsi]
call fcn.140002bb4
lea rcx, [rsp + 0x240]
xor r8d, r8d
mov rdx, rax
call fcn.1400044d4
add rsi, 0x20
mov eax, dword [rsi]
cmp eax, edi
jne 0x140008942
lea rcx, [rsp + 0xa8]
call fcn.140006c60
lea rdx, [0x140024b20]
lea rcx, str.SfxVarCmdLine2
mov r8d, 1
sub r15, 2
call fcn.1400044d4
jmp 0x1400089ae
add r15, 2
cmp word [r15], 0x20
ja 0x1400089aa
jmp 0x1400089c1
cmp ax, 0x20
ja 0x1400089ca
add r15, 2
movzx eax, word [r15]
cmp ax, di
jne 0x1400089b7
cmp word [r15], 0x2f
je 0x1400089dc
cmp word [r15], 0x2d
jne 0x140008ce6
cmp word [r15 + 2], 0x21
je 0x140008cda
lea rdx, [0x1400261e8]
lea rcx, [r15 + 2]
call fcn.140005fd4
cmp rax, rdi
je 0x140008a50
lea rax, [r15 + 6]
cmp word [rax], 0x30
jb 0x140008a0d
cmp word [rax], 0x39
jbe 0x140008a25
cmp word [rax], 0x61
jb 0x140008a19
cmp word [rax], 0x7a
jbe 0x140008a25
cmp word [rax], 0x41
jb 0x140008a3d
cmp word [rax], 0x5a
ja 0x140008a3d
mov qword [rsp + 0x100], rax
mov al, 1
mov byte [rsp + 0x31], 1
mov byte [rsp + 0x30], al
jmp 0x1400089ae
cmp word [rax], 0x20
ja 0x140008ce6
lea rax, [0x140025f24]
jmp 0x140008a25
lea rdx, [0x1400261e0]
lea rcx, [r15 + 2]
call fcn.140005fd4
cmp rax, rdi
je 0x140008a75
lea rdx, [r15 + 6]
lea rcx, str.OverwriteMode
jmp 0x140008bce
lea rdx, [0x1400261d8]
lea rcx, [r15 + 2]
call fcn.140005fd4
cmp rax, rdi
je 0x140008aba
lea rdx, [r15 + 6]
cmp word [rdx], 0x30
jb 0x140008ce6
cmp word [rdx], 0x32
ja 0x140008ce6
cmp word [r15 + 8], 0x20
ja 0x140008ce6
lea rcx, str.GUIMode
jmp 0x140008bce
lea rdx, [0x1400261d0]
lea rcx, [r15 + 2]
call fcn.140005fd4
cmp rax, rdi
je 0x140008adf
lea rdx, [r15 + 6]
lea rcx, str.GUIFlags
jmp 0x140008bce
lea rdx, [0x1400261c8]
lea rcx, [r15 + 2]
call fcn.140005fd4
cmp rax, rdi
je 0x140008b04
lea rdx, [r15 + 6]
lea rcx, str.MiscFlags
jmp 0x140008bce
lea rdx, [0x1400261c0]
lea rcx, [r15 + 2]
call fcn.140005fd4
cmp rax, rdi
je 0x140008b45
lea rdx, [r15 + 6]
cmp word [rdx], 0x30
je 0x140008b2d
cmp word [rdx], 0x31
jne 0x140008ce6
cmp word [r15 + 8], 0x20
ja 0x140008ce6
lea rcx, str.SelfDelete
jmp 0x140008bce
lea rdx, [0x1400261b8]
lea rcx, [r15 + 2]
call fcn.140005fd4
cmp rax, rdi
je 0x140008b70
cmp word [r15 + 6], 0x20
ja 0x140008ce6
mov byte [rsp + 0x33], 1
jmp 0x1400089ae
lea rdx, [0x1400261b0]
lea rcx, [r15 + 2]
call fcn.140005fd4
cmp rax, rdi
je 0x140008bae
lea rcx, [r15 + 6]
cmp word [rcx], 0x30
jb 0x140008ce6
cmp word [rcx], 0x39
ja 0x140008ce6
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x14002b634], eax
jmp 0x1400089ae
lea rdx, [0x1400261a8]
lea rcx, [r15 + 2]
call fcn.140005fd4
cmp rax, rdi
je 0x140008be0
lea rdx, [r15 + 8]
lea rcx, str.BeginPromptTimeout
lea r8, [rsp + 0xa8]
call fcn.140006f9c
jmp 0x1400089ae
cmp word [r15 + 2], 0x70
je 0x140008c63
cmp word [r15 + 2], 0x50
je 0x140008c63
cmp word [r15 + 2], 0x79
je 0x140008c00
cmp word [r15 + 2], 0x59
jne 0x140008c13
cmp word [r15 + 4], 0x20
ja 0x140008c13
mov al, 1
mov byte [rsp + 0x31], al
jmp 0x1400089ae
cmp word [r15 + 2], 0x3f
je 0x140008c2b
cmp word [r15 + 2], 0x68
je 0x140008c2b
cmp word [r15 + 2], 0x48
jne 0x140008c3b
cmp word [r15 + 4], 0x20
ja 0x140008c3b
mov r14b, 1
jmp 0x1400089ae
lea rdx, [rsp + 0xa8]
lea rcx, [r15 + 2]
call fcn.14000666c
cmp rax, rdi
je 0x140008ce6
cmp rax, 1
je 0x140008cb8
mov r15, rax
jmp 0x1400089ae
lea rcx, [rsp + 0x38]
mov edx, 3
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], edi
call fcn.1400011b4
lea rcx, [r15 + 4]
lea rdx, [rsp + 0x38]
call fcn.140006bd0
mov rdx, qword [rsp + 0x38]
lea rcx, [0x14002bd88]
lea r15, [rax - 2]
call fcn.1400014a0
mov rcx, qword [rsp + 0x38]
mov byte [0x14002bd84], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400089ae
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008cd0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 0x20
jmp 0x14000a044
mov rsi, r15
add r15, 4
cmp rsi, rdi
jne 0x140008ce9
mov rsi, r15
cmp r12, rsi
je 0x140008d89
lea rcx, [rsp + 0x98]
mov rdx, r12
call fcn.14000313c
sub rsi, r12
lea rdx, [rsp + 0x38]
sar rsi, 1
xor r8d, r8d
mov rcx, rax
mov r9d, esi
call fcn.1400068f8
mov rax, qword [rsp + 0x58]
mov esi, dword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov edx, esi
mov dword [rsp + 0x60], edi
mov word [rax], di
call fcn.1400011b4
mov rcx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x58]
mov rdx, rcx
sub r8, rcx
movzx eax, word [rdx]
mov word [rdx + r8], ax
add rdx, 2
cmp ax, di
jne 0x140008d47
mov dword [rsp + 0x60], esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x58]
call fcn.140007b74
lea rcx, [rsp + 0x58]
call fcn.140007b08
mov rdx, qword [rsp + 0x58]
jmp 0x140008d90
lea rdx, [0x140024b20]
lea rcx, str.SfxVarCmdLine1
mov r8d, 1
call fcn.1400044d4
lea rcx, [rsp + 0x98]
mov rdx, r15
call fcn.14000313c
sub r13, r15
lea rdx, [rsp + 0x38]
sar r13, 1
xor r8d, r8d
mov rcx, rax
mov r9d, r13d
call fcn.1400068f8
mov rax, qword [rsp + 0x58]
mov esi, dword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov edx, esi
mov dword [rsp + 0x60], edi
mov word [rax], di
call fcn.1400011b4
mov rcx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x58]
mov rdx, rcx
mov r13d, 2
sub r8, rcx
movzx eax, word [rdx]
mov word [rdx + r8], ax
add rdx, r13
cmp ax, di
jne 0x140008dfd
mov dword [rsp + 0x60], esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x58]
call fcn.140007b74
lea rcx, [rsp + 0x58]
call fcn.140007b08
mov rdx, qword [rsp + 0x58]
lea rcx, str.SfxVarCmdLine2
mov r8d, 1
call fcn.1400044d4
lea rcx, [rsp + 0xa8]
call fcn.140006c60
cmp bpl, dil
jne 0x14000906b
test byte [0x14002be04], 4
je 0x14000906b
call fcn.140002e64
cmp eax, edi
jne 0x14000906b
mov esi, 3
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov edx, esi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], edi
call fcn.1400011b4
lea rcx, [rsp + 0x98]
mov edx, esi
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0xa0], edi
mov dword [rsp + 0xa4], edi
call fcn.1400011b4
call qword [sym.imp.KERNEL32.DLL_GetCommandLineW]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.140006bd0
lea rcx, [rsp + 0x38]
mov rdx, rax
call fcn.14000313c
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x100]
mov dx, 0x22
call fcn.140006a2c
lea r8, [0x140025fb0]
lea rcx, [rsp + 0x120]
mov rdx, rax
call fcn.140006a90
lea r8, str.sfxelevation
lea rcx, [rsp + 0x68]
mov rdx, rax
call fcn.140006a90
lea rcx, [rsp + 0x88]
mov r8w, 0x20
mov rdx, rax
call fcn.140006afc
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0xd8]
mov rdx, rax
call fcn.140001974
mov rsi, rax
lea rax, [rsp + 0x98]
cmp rsi, rax
je 0x140008fa0
mov rcx, qword [rsp + 0x98]
mov dword [rsp + 0xa0], edi
mov word [rcx], di
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x98]
call fcn.1400011b4
mov r11, qword [rsi]
mov rsi, qword [rsp + 0x98]
mov rcx, rsi
movzx eax, word [r11]
add r11, r13
mov word [rcx], ax
add rcx, r13
cmp ax, di
jne 0x140008f8c
jmp 0x140008fa8
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x88]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x120]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_SetProcessWorkingSetSize]
xor r8d, r8d
mov edx, r13d
mov rcx, rsi
call fcn.140007290
mov rcx, qword [rsp + 0x38]
cmp eax, edi
jne 0x14000904f
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140009045
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 0xb
jmp 0x14000a044
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400088d9
mov dword [rsp + 0xcc], edi
jmp 0x1400090c1
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.14000313c
mov rsi, qword [rsp + 0x38]
mov dx, 0x3d
mov rcx, rsi
call fcn.140018514
mov rcx, rsi
cmp eax, edi
jle 0x1400090e7
movsxd rdx, eax
xor r8d, r8d
mov dword [rsp + 0x40], eax
mov word [rsi + rdx*2], di
lea rdx, [rbp + rdx*2 + 2]
call fcn.1400044d4
add dword [rsp + 0xcc], 1
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r8, [rsp + 0xcc]
lea rdx, str.SetEnvironment
lea rcx, [rsp + 0xa8]
call fcn.140003e6c
cmp rax, rdi
mov rbp, rax
jne 0x140009074
jmp 0x1400090ec
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
call fcn.1400065b0
mov r11d, dword [0x14002b628]
cmp r11d, 0xffffffff
cmove r11d, edi
cmp r14b, dil
mov dword [0x14002b628], r11d
je 0x140009196
lea rdx, str.HelpText
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e6c
cmp rax, rdi
mov rsi, rax
jne 0x14000913c
mov ecx, 0x18
call fcn.140002bb4
mov rsi, rax
lea rcx, [rsp + 0x190]
call fcn.14000b810
mov r8, qword [0x14002bdd8]
lea r11, [0x140025ae0]
lea rcx, [rsp + 0x190]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x190], r11
mov dword [rsp + 0x1e0], 0x7d6
mov qword [rsp + 0x20], rdi
call fcn.14000b8a4
lea rcx, [rsp + 0x190]
call fcn.14000b4a0
jmp 0x1400088d9
mov r12b, byte [rsp + 0x31]
cmp r12b, dil
je 0x1400091ac
btr r11d, 8
mov dword [0x14002b628], r11d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, str.InstallPath
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e6c
lea r14, [0x14002be28]
cmp rax, rdi
je 0x1400091e2
mov rdx, rax
mov rcx, r14
call fcn.1400014a0
mov rcx, r14
call fcn.140005f64
lea rdx, str.SfxAuthor
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e6c
cmp rax, rdi
mov rsi, rax
je 0x14000932d
lea rcx, [rsp + 0x190]
call fcn.14000e900
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
lea rcx, [rsp + 0x190]
mov rdx, rsi
movsxd r8, eax
add r8, r8
call fcn.14000eb60
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x190]
call fcn.14000ecb0
lea rcx, [rsp + 0x210]
lea rdx, str.123456789ABCDEFGHJKMNPQRSTUVWXYZ
mov r8d, 0x21
call sub.msvcrt.dll_memcpy
mov r11, rdi
mov eax, dword [rsp + r11*4 + 0x140]
add r11, 1
xor dword [rsp + r11*4 + 0x12c], eax
cmp r11, 4
jl 0x14000926b
mov r10d, edi
mov r9d, edi
lea r8, [rsp + 0x240]
mov eax, r9d
cdq
and edx, 7
add eax, edx
mov ecx, eax
and eax, 7
sar ecx, 3
sub eax, edx
movsxd rcx, ecx
movzx r11d, byte [rsp + rcx + 0x130]
mov cl, al
shr r11d, cl
and r11d, 0x1f
cmp r9d, edi
je 0x1400092e7
mov eax, 0x51eb851f
imul r9d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x19
cmp r9d, edx
jne 0x1400092e7
mov word [r8], 0x2d
add r10d, 1
add r8, r13
movsxd rax, r11d
add r9d, 5
add r10d, 1
movsx edx, byte [rsp + rax + 0x210]
mov word [r8], dx
add r8, r13
cmp r9d, 0x7d
jl 0x140009293
movsxd rax, r10d
lea rdx, [rsp + 0x240]
lea rcx, [0x14002bd88]
mov word [rsp + rax*2 + 0x240], di
call fcn.1400014a0
mov byte [0x14002bd84], 1
lea rdx, str.BeginPromptTimeout
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e6c
cmp rax, rdi
je 0x140009358
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x14002be10], eax
cmp dword [0x14002bef0], edi
je 0x140009390
lea rcx, [rsp + 0xa8]
call fcn.14000d590
mov rcx, qword [rsp + 0x78]
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008845
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + InitCommonControls]
jmp 0x140008845
cmp dword [0x14002bee4], 3
jne 0x1400093a8
lea rcx, [rsp + 0xa8]
call fcn.14000d46c
jmp 0x14000936d
test byte [0x14002be04], 8
jne 0x1400093df
mov rcx, rbx
call fcn.140001700
cmp eax, edi
jne 0x1400093df
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400093d5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 5
jmp 0x14000a044
mov sil, byte [rsp + 0x30]
lea rdx, str.BeginPrompt
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e6c
cmp rax, rdi
je 0x14000944a
cmp r12b, dil
jne 0x14000944a
mov rcx, qword [0x14002bdd8]
mov rdx, rax
call fcn.14000c3c8
cmp eax, edi
je 0x1400093bd
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14000943a
mov r12b, 1
mov byte [rsp + 0x31], r12b
mov sil, r12b
mov byte [rsp + 0x30], r12b
cmp dword [0x14002bec0], edi
je 0x14000944a
btr dword [0x14002b628], 7
lea rcx, [rsp + 0x88]
mov edx, 3
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x90], edi
mov dword [rsp + 0x94], edi
call fcn.1400011b4
cmp sil, dil
mov rbp, qword [rsp + 0x100]
je 0x14000952b
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x88]
call fcn.1400014a0
movzx edx, word [rbp]
lea rcx, [rsp + 0x88]
call fcn.1400018e8
mov rsi, qword [rsp + 0x88]
lea rcx, [rsp + 0xa8]
mov rdx, rsi
xor r8d, r8d
call fcn.140003e6c
cmp rax, rdi
je 0x1400095f9
add rbp, r13
cmp word [rbp], 0x30
jb 0x1400094dd
cmp word [rbp], 0x39
jbe 0x140009483
cmp word [rbp], 0x61
jb 0x1400094eb
cmp word [rbp], 0x7a
jbe 0x140009483
cmp word [rbp], 0x41
jb 0x1400094f9
cmp word [rbp], 0x5a
jbe 0x140009483
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x88]
call fcn.1400014a0
mov rbp, qword [rsp + 0x100]
lea rcx, [rsp + 0x88]
movzx edx, word [rbp]
call fcn.1400018e8
mov sil, byte [rsp + 0x30]
cmp dword [rsp + 0x90], edi
mov byte [rsp + 0x32], dil
jne 0x1400095a7
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e6c
cmp rax, rdi
je 0x140009577
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0x88]
call fcn.1400014a0
cmp dword [rsp + 0x90], edi
mov byte [rsp + 0x32], 1
jne 0x1400095a7
lea rdx, str.RunProgram
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e6c
cmp rax, rdi
je 0x1400095a7
lea rdx, str.RunProgram
lea rcx, [rsp + 0x88]
call fcn.1400014a0
cmp sil, dil
jne 0x14000963c
cmp r12b, dil
jne 0x14000963c
mov eax, dword [0x14002b628]
and ax, 0xc0
cmp al, 0x80
jne 0x14000963c
mov rdx, qword [0x14002bdc0]
mov rcx, qword [0x14002bdc8]
call fcn.14000c4ac
cmp eax, edi
jne 0x14000963c
cmp byte [0x14002be14], dil
mov rcx, qword [rsp + 0x88]
je 0x140009632
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400093e4
mov r8, rsi
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000d328
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140009628
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 6
jmp 0x14000a044
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400093bd
mov edx, dword [0x14002be30]
cmp edx, edi
jne 0x1400096ba
lea rdx, str.7ZipSfx._03x
lea rcx, [rsp + 0x38]
call fcn.140006474
cmp rax, r14
mov rsi, rax
je 0x14000969f
mov rcx, qword [0x14002be28]
mov dword [0x14002be30], edi
mov word [rcx], di
mov edx, dword [rax + 8]
mov rcx, r14
call fcn.1400011b4
mov r11, qword [rsi]
mov rcx, qword [0x14002be28]
movzx eax, word [r11]
add r11, r13
mov word [rcx], ax
add rcx, r13
cmp ax, di
jne 0x140009684
mov eax, dword [rsi + 8]
mov dword [0x14002be30], eax
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov sil, byte [rsp + 0x30]
mov byte [0x14002bda0], dil
jmp 0x14000975e
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], edi
call fcn.1400011b4
mov r11, qword [0x14002be28]
mov rcx, qword [rsp + 0x48]
movzx eax, word [r11]
add r11, r13
mov word [rcx], ax
add rcx, r13
cmp ax, di
jne 0x1400096dd
mov eax, dword [0x14002be30]
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x50], eax
call fcn.140005f64
cmp dword [rsp + 0x50], edi
jne 0x14000974d
mov rax, qword [0x14002be28]
mov dword [0x14002be30], edi
mov rcx, r14
mov word [rax], di
mov edx, dword [rsp + 0x50]
call fcn.1400011b4
mov r11, qword [rsp + 0x48]
mov rcx, qword [0x14002be28]
movzx eax, word [r11]
add r11, r13
mov word [rcx], ax
add rcx, r13
cmp ax, di
jne 0x140009731
mov eax, dword [rsp + 0x50]
mov dword [0x14002be30], eax
mov rcx, qword [rsp + 0x48]
mov byte [0x14002bda0], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
movsxd rcx, dword [0x14002be30]
mov rdx, qword [0x14002be28]
cmp word [rdx + rcx*2 - 2], 0x5c
je 0x14000977c
cmp word [rdx + rcx*2 - 2], 0x2f
jne 0x14000978c
add ecx, 0xffffffff
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x14002be30], ecx
cmp r12b, dil
je 0x140009798
or dword [0x14002be04], 3
cmp dword [0x14002bee0], edi
jne 0x1400097ad
mov rdx, r14
mov rcx, rbx
call fcn.140001cf0
jmp 0x1400097bb
call fcn.14000c544
cmp eax, edi
jne 0x140009803
mov eax, 0x80004005
cmp eax, edi
je 0x140009803
cmp byte [0x14002bda0], dil
jne 0x1400097d4
mov rcx, qword [0x14002be28]
call fcn.140003fcc
mov rcx, qword [rsp + 0x88]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400097f9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 8
jmp 0x14000a044
call fcn.1400065b0
mov r13b, byte [rsp + 0x33]
cmp r13b, dil
je 0x140009828
cmp byte [0x14002bda0], dil
je 0x140009828
mov r14, qword [rsp + 0x88]
jmp 0x14000a165
lea rcx, [rsp + 0x48]
mov edx, 3
mov dword [rsp + 0xc8], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], edi
call fcn.1400011b4
cmp sil, dil
jne 0x140009862
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xa8]
call fcn.140006b68
mov byte [rsp + 0x34], dil
mov rsi, rbp
mov qword [rsp + 0x120], rbp
mov r14, qword [rsp + 0x88]
lea rcx, [rsp + 0x68]
mov edx, 3
mov dword [rsp + 0xd0], edi
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x74], edi
call fcn.1400011b4
lea rcx, [rsp + 0xd8]
mov edx, 3
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], edi
mov dword [rsp + 0xe4], edi
call fcn.1400011b4
cmp dword [rsp + 0x90], edi
mov r13d, edi
jne 0x1400099a9
cmp byte [0x14002bda0], dil
jne 0x140009f9e
lea r8, [0x140024d64]
lea rdx, [0x14002be28]
lea rcx, [rsp + 0x150]
lea rbp, str.setup.exe
call fcn.140006a90
lea r8, str.setup.exe
lea rcx, [rsp + 0x160]
mov rdx, rax
call fcn.140006a90
mov rsi, rax
lea rax, [rsp + 0x68]
cmp rsi, rax
je 0x14000996e
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x70], edi
mov word [rcx], di
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x68]
call fcn.1400011b4
mov r12, qword [rsp + 0x68]
mov r11, qword [rsi]
mov rcx, r12
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140009951
mov eax, dword [rsi + 8]
mov dword [rsp + 0x70], eax
jmp 0x140009973
mov r12, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x160]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x150]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140009f35
mov byte [rsp + 0x34], 1
jmp 0x140009a4d
lea r8, [rsp + 0xc8]
lea rcx, [rsp + 0xa8]
mov rdx, r14
call fcn.140003e6c
cmp rax, rdi
mov rbp, rax
jne 0x140009a48
add rsi, 2
mov qword [rsp + 0x120], rsi
cmp word [rsi], 0x30
jb 0x1400099e1
cmp word [rsi], 0x39
jbe 0x140009a01
cmp word [rsi], 0x61
jb 0x1400099ed
cmp word [rsi], 0x7a
jbe 0x140009a01
cmp word [rsi], 0x41
jb 0x140009f9e
cmp word [rsi], 0x5a
ja 0x140009f9e
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x88]
call fcn.1400014a0
movzx edx, word [rsi]
lea rcx, [rsp + 0x88]
call fcn.1400018e8
mov rcx, qword [rsp + 0xd8]
mov dword [rsp + 0xc8], edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140009872
mov r12, qword [rsp + 0x68]
lea rcx, [rsp + 0xd8]
mov rdx, rbp
call fcn.1400014a0
lea rcx, [rsp + 0xd8]
call fcn.140005fa8
mov rsi, qword [rsp + 0xd8]
mov r12w, 0x3a
lea rdx, str.waitall
mov rcx, rsi
call fcn.140005fd4
cmp rax, rdi
je 0x140009aa9
cmp word [rax], r12w
jne 0x140009a97
add rax, 2
jmp 0x140009a9a
mov rax, rdi
cmp rax, rdi
je 0x140009aa9
mov rsi, rax
mov byte [rsp + 0x30], 1
jmp 0x140009a77
lea rdx, str.hidcon
mov rcx, rsi
call fcn.140005fd4
cmp rax, rdi
je 0x140009ada
cmp word [rax], r12w
jne 0x140009ac9
add rax, 2
jmp 0x140009acc
mov rax, rdi
cmp rax, rdi
je 0x140009ada
mov rsi, rax
or r13d, 1
jmp 0x140009a77
lea rdx, str.nowait
mov rcx, rsi
call fcn.140005fd4
cmp rax, rdi
je 0x140009b14
cmp word [rax], r12w
jne 0x140009afa
add rax, 2
jmp 0x140009afd
mov rax, rdi
cmp rax, rdi
je 0x140009b14
cmp byte [0x14002bda0], dil
mov rsi, rax
je 0x140009a77
jmp 0x140009b3f
lea rdx, str.forcenowait
mov rcx, rsi
call fcn.140005fd4
cmp rax, rdi
je 0x140009b49
cmp word [rax], r12w
jne 0x140009b34
add rax, 2
jmp 0x140009b37
mov rax, rdi
cmp rax, rdi
je 0x140009b49
mov rsi, rax
bts r13d, 0x10
jmp 0x140009a77
lea rdx, [0x1400261b0]
mov r8d, 2
mov rcx, rsi
call fcn.140006030
cmp rax, rdi
mov rbp, rax
je 0x140009b87
cmp dword [0x14002b634], 0xffffffff
jne 0x140009b7f
lea rcx, [rsi + 4]
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x14002b634], eax
mov rsi, rbp
jmp 0x140009a77
lea rdx, [0x1400260c0]
mov r8d, 3
mov rcx, rsi
call fcn.140006030
cmp rax, rdi
je 0x140009bba
movzx r14d, word [rsi + 6]
mov rsi, rax
sub r14d, 0x30
mov dword [rsp + 0xe8], r14d
jmp 0x140009a77
lea rdx, [0x1400260b8]
mov r8d, 3
mov rcx, rsi
call fcn.140006030
cmp rax, rdi
je 0x140009bed
movzx r12d, word [rsi + 6]
mov rsi, rax
sub r12d, 0x30
mov dword [rsp + 0xec], r12d
jmp 0x140009a72
lea rdx, [0x140024be0]
mov rcx, rsi
call fcn.140005fd4
cmp rax, rdi
je 0x140009c15
cmp word [rax], r12w
jne 0x140009c0d
add rax, 2
jmp 0x140009c10
mov rax, rdi
cmp rax, rdi
jne 0x140009c3d
lea rdx, str.i386
mov rcx, rsi
call fcn.140005fd4
cmp rax, rdi
je 0x140009c50
cmp word [rax], r12w
jne 0x140009c35
add rax, 2
jmp 0x140009c38
mov rax, rdi
cmp rax, rdi
je 0x140009c50
mov rsi, rax
mov dword [rsp + 0xd0], 1
jmp 0x140009a77
lea rdx, str.amd64
mov rcx, rsi
call fcn.140005fd4
cmp rax, rdi
je 0x140009c78
cmp word [rax], r12w
jne 0x140009c70
add rax, 2
jmp 0x140009c73
mov rax, rdi
cmp rax, rdi
jne 0x140009ca0
lea rdx, [0x140024bd8]
mov rcx, rsi
call fcn.140005fd4
cmp rax, rdi
je 0x140009cb3
cmp word [rax], r12w
jne 0x140009c98
add rax, 2
jmp 0x140009c9b
mov rax, rdi
cmp rax, rdi
je 0x140009cb3
mov rsi, rax
mov dword [rsp + 0xd0], 2
jmp 0x140009a77
cmp byte [rsp + 0x32], dil
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x88]
lea rcx, [rsp + 0x68]
je 0x140009d38
cmp word [rsi], 0x22
je 0x140009cfe
lea rdx, [0x140025f18]
call fcn.1400014a0
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.1400031a8
lea rdx, [0x140025f18]
lea rcx, [rsp + 0x68]
call fcn.1400031a8
jmp 0x140009d06
mov rdx, rsi
call fcn.1400014a0
lea rdx, str.ExecuteParameters
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e6c
cmp rax, rdi
mov rsi, rax
je 0x140009d7d
lea rdx, [0x140026090]
lea rcx, [rsp + 0x68]
call fcn.1400031a8
jmp 0x140009d70
mov word [r12], di
mov edx, dword [rsp + 0x50]
mov dword [rsp + 0x70], edi
call fcn.1400011b4
mov r11, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140009d54
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.1400031a8
lea rcx, [rsp + 0x98]
mov edx, 3
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0xa0], edi
mov dword [rsp + 0xa4], edi
call fcn.1400011b4
mov rsi, qword [rsp + 0x68]
lea rdx, [rsp + 0x98]
mov rcx, rsi
call fcn.140006bd0
lea rcx, [rsp + 0x38]
mov rdx, rax
call fcn.14000313c
lea rcx, [rsp + 0x98]
call fcn.140005fa8
cmp dword [0x14002bee4], edi
jne 0x140009ed2
mov ecx, dword [rsp + 0xd0]
call fcn.140002e50
cmp eax, edi
je 0x140009ed2
cmp word [r15], di
je 0x140009e13
lea rcx, [rsp + 0x38]
mov rdx, r15
call fcn.1400031a8
jmp 0x140009e0d
add r15, 2
cmp word [r15], di
jne 0x140009e09
lea rcx, [rsp + 0x38]
call fcn.140005fa8
mov al, byte [rsp + 0x30]
cmp al, dil
jne 0x140009eb5
lea r8, [rsp + 0x98]
lea rcx, [rsp + 0x180]
mov dx, 0x22
call fcn.140006a2c
lea r8, [0x140025f8c]
lea rcx, [rsp + 0x170]
mov rdx, rax
call fcn.140006a90
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x130]
mov rdx, rax
call fcn.140001974
mov rcx, qword [rsp + 0x170]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x180]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rbp, qword [rsp + 0x130]
mov r8, qword [0x14002be28]
mov rcx, rbp
mov edx, r13d
call fcn.140007290
mov rcx, rbp
cmp eax, edi
je 0x140009fb5
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140009ed2
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x98]
mov r8d, r13d
call fcn.1400073ec
cmp eax, edi
jne 0x140009fbc
cmp byte [rsp + 0x32], dil
jne 0x14000a098
cmp byte [rsp + 0x34], dil
jne 0x14000a098
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x50], edi
mov word [rax], di
mov rcx, qword [rsp + 0x38]
add dword [rsp + 0xc8], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rsi, qword [rsp + 0x120]
jmp 0x14000987a
cmp byte [0x14002bda0], dil
jne 0x140009f4a
mov rcx, qword [0x14002be28]
call fcn.140003fcc
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000d328
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400083e2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x1400083e2
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x68]
jmp 0x14000a0bf
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140009fc4
mov ecx, eax
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov edx, InitCommonControls
mov r8, rsi
lea ecx, [rdx - 0xf]
call fcn.14000d328
cmp byte [0x14002bda0], dil
jne 0x140009fe9
mov rcx, qword [0x14002be28]
call fcn.140003fcc
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000a03f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 9
mov rcx, qword [rsp + 0xf0]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x140025bd0]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.1400186a8
lea rcx, [rsp + 0xa8]
call fcn.140018794
mov rcx, qword [rsp + 0x110]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, edi
jmp 0x14000a328
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp dword [0x14002bee4], edi
jne 0x14000a151
call fcn.1400065b0
mov eax, dword [rsp + 0xe8]
mov rbp, qword [rsp + 0x100]
lea r8, str.Shortcut
lea rdx, [rsp + 0xa8]
lea rcx, [0x140007e88]
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.140007018
mov rcx, qword [0x14002be38]
call qword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov ecx, dword [rsp + 0xec]
lea r8, str.Delete
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0xa8]
lea rcx, [0x1400067a4]
mov r9, rbp
call fcn.140007018
cmp byte [0x14002bda0], dil
jne 0x14000a151
mov rcx, qword [0x14002be28]
call fcn.140003fcc
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r12b, byte [rsp + 0x31]
mov r13b, byte [rsp + 0x33]
mov eax, dword [0x14002b634]
cmp eax, 0xffffffff
jne 0x14000a184
cmp r12b, dil
jne 0x14000a216
mov eax, 1
mov dword [0x14002b634], eax
cmp eax, edi
jle 0x14000a216
lea rdx, str.FinishMessage
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e6c
cmp rax, rdi
mov rsi, rax
je 0x14000a216
mov ecx, dword [0x14002b634]
mov eax, 0x3e7
cmp ecx, eax
cmovg ecx, eax
mov dword [0x14002b634], ecx
lea rcx, [rsp + 0x190]
call fcn.14000b810
mov r8, qword [0x14002bdd8]
lea r11, [0x140025b70]
lea rcx, [rsp + 0x190]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x190], r11
mov dword [rsp + 0x1e0], 0x7d5
mov qword [rsp + 0x20], rdi
call fcn.14000b8a4
lea rcx, [rsp + 0x190]
call fcn.14000b4a0
cmp r13b, dil
jne 0x14000a296
cmp dword [0x14002bee4], edi
jne 0x14000a296
lea rdx, str.SelfDelete
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003e6c
cmp rax, rdi
je 0x14000a296
cmp word [rax], 0x31
jne 0x14000a296
mov edx, dword [0x14002be90]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], edi
call fcn.1400011b4
mov r11, qword [0x14002be88]
mov rcx, qword [rsp + 0x38]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x14000a26e
mov eax, dword [0x14002be90]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x40], eax
call fcn.140007834
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000a2b6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov rcx, qword [rsp + 0xf0]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x140025bd0]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.1400186a8
lea rcx, [rsp + 0xa8]
call fcn.140018794
mov rcx, qword [rsp + 0x110]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
jmp 0x14000a328
lea r8, [0x140025b60]
lea rdx, str.Sorry__this_program_requires_Microsoft_Windows_2000_or_later.
mov r9d, InitCommonControls
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x14
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret