Function at 0x140004970
Capabilities:
Accept command line arguments
Create process on windows
Create shortcut via ishelllink
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
xor eax, eax
mov r12d, eax
mov dword [rsp + 0x48], eax
call fcn.140008a80
call fcn.1400012f0
lea rcx, [0x140006dc0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xorps xmm0, xmm0
lea rdx, str.Updaters_started..
lea rcx, [rbp]
mov qword [0x14002a098], rax
xorps xmm1, xmm1
mov r8d, 0x12
movups xmmword [rbp], xmm0
movdqu xmmword [rbp + 0x10], xmm1
call fcn.1400077c0
lea rcx, [rbp]
call fcn.1400014a0
mov r8, qword [rbp + 0x18]
cmp r8, 7
jbe 0x140004a10
mov rdx, qword [rbp]
call fcn.1400074c0
xor bl, bl
mov byte [rsp + 0x40], bl
mov byte [rsp + 0x42], bl
mov byte [rsp + 0x43], bl
mov byte [rsp + 0x41], bl
mov byte [rsp + 0x44], bl
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, 0xa
mov qword [rsp + 0x50], rax
lea r14, [0x140028ab0]
mov rdi, rax
lea r13, [0x140028ad0]
movabs rsi, 0x7ffffffffffffffe
lea r15, [rcx - 0xb]
test rax, rax
je 0x140005bf0
mov esi, 1
cmp dword [rsp + 0x48], esi
jle 0x140005519
nop dword [rax + rax]
movsxd rax, esi
lea rdx, str.Argument:
mov rbx, qword [rdi + rax*8]
lea rdi, [rdi + rax*8]
xor eax, eax
xorps xmm0, xmm0
mov r8, rcx
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], rax
movups xmmword [rbp - 0x80], xmm0
call fcn.1400077c0
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.1400073a0
xor ebx, ebx
lea rcx, [rbp - 0x60]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
call fcn.1400014a0
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140004b24
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b1f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069cd
call fcn.140009910
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140004b64
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b5f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069cd
call fcn.140009910
xorps xmm0, xmm0
mov qword [rbp - 0x70], rbx
mov r8d, 7
mov qword [rbp - 0x68], rbx
lea rdx, str._update
lea rcx, [rbp - 0x80]
movups xmmword [rbp - 0x80], xmm0
call fcn.1400077c0
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov r8, r15
mov qword [rsp + 0x78], rbx
inc r8
cmp word [rdx + r8*2], bx
jne 0x140004ba1
lea rcx, [rsp + 0x60]
call fcn.1400077c0
cmp qword [rbp - 0x68], 7
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmova rdx, qword [rbp - 0x80]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
call fcn.14000fdac
mov rdx, qword [rsp + 0x78]
mov ebx, eax
cmp rdx, 7
jbe 0x140004c1d
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c18
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069d3
call fcn.140009910
mov rdx, qword [rbp - 0x68]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], ax
cmp rdx, 7
jbe 0x140004c74
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c6d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069d3
call fcn.140009910
xor eax, eax
test ebx, ebx
jne 0x140004c83
mov bl, 1
mov byte [rsp + 0x40], bl
jmp 0x140005502
xorps xmm0, xmm0
mov qword [rbp - 0x70], rax
mov r8d, 0xa
mov qword [rbp - 0x68], rax
lea rdx, str._autostart
lea rcx, [rbp - 0x80]
movups xmmword [rbp - 0x80], xmm0
call fcn.1400077c0
mov rdx, qword [rdi]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], rax
mov r8, r15
inc r8
cmp word [rdx + r8*2], ax
jne 0x140004cc2
lea rcx, [rsp + 0x60]
call fcn.1400077c0
cmp qword [rbp - 0x68], 7
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmova rdx, qword [rbp - 0x80]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
call fcn.14000fdac
mov rdx, qword [rsp + 0x78]
mov ebx, eax
cmp rdx, 7
jbe 0x140004d3e
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d39
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069d9
call fcn.140009910
mov rdx, qword [rbp - 0x68]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], ax
cmp rdx, 7
jbe 0x140004d95
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d8e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069d9
call fcn.140009910
xor eax, eax
test ebx, ebx
jne 0x140004da3
mov byte [rsp + 0x42], 1
jmp 0x1400054fd
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
mov r8d, 6
mov qword [rsp + 0x78], rax
lea rdx, str._debug
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.1400077c0
mov rdx, qword [rdi]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x70], rax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x68], rax
mov r8, r15
inc r8
cmp word [rdx + r8*2], ax
jne 0x140004de3
lea rcx, [rbp - 0x80]
call fcn.1400077c0
cmp qword [rsp + 0x78], 7
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
cmova rdx, qword [rsp + 0x60]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
call fcn.14000fdac
lea rcx, [rbp - 0x80]
mov ebx, eax
call fcn.140007020
lea rcx, [rsp + 0x60]
call fcn.140007020
test ebx, ebx
jne 0x140004e49
mov byte [0x14002a030], 1
call fcn.1400012f0
mov byte [rsp + 0x43], 1
jmp 0x1400054fd
xor ebx, ebx
lea rdx, str._startintray
xorps xmm0, xmm0
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], rbx
movups xmmword [rsp + 0x60], xmm0
lea r8d, [rbx + 0xc]
call fcn.1400077c0
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
mov r8, r15
mov qword [rbp - 0x68], rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], bx
jne 0x140004e90
lea rcx, [rbp - 0x80]
call fcn.1400077c0
cmp qword [rsp + 0x78], 7
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
cmova rdx, qword [rsp + 0x60]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
call fcn.14000fdac
lea rcx, [rbp - 0x80]
mov ebx, eax
call fcn.140007020
lea rcx, [rsp + 0x60]
call fcn.140007020
test ebx, ebx
jne 0x140004eea
mov byte [rsp + 0x44], 1
jmp 0x1400054fd
xor ebx, ebx
lea rdx, str._writeprotected
xorps xmm0, xmm0
mov qword [rbp - 0x70], rbx
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], rbx
movups xmmword [rbp - 0x80], xmm0
lea r8d, [rbx + 0xf]
call fcn.1400077c0
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
or r12d, 1
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], bx
jne 0x140004f30
lea rcx, [rsp + 0x60]
call fcn.1400077c0
cmp qword [rbp - 0x68], 7
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmova rdx, qword [rbp - 0x80]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
call fcn.14000fdac
test eax, eax
jne 0x140004f76
inc esi
cmp esi, dword [rsp + 0x48]
jge 0x140004f76
mov bl, 1
mov r8, qword [rsp + 0x78]
cmp r8, 7
jbe 0x140004f8b
mov rdx, qword [rsp + 0x60]
call fcn.1400074c0
mov r8, qword [rbp - 0x68]
xor edx, edx
and r12d, 0xfffffffc
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], dx
cmp r8, 7
jbe 0x140004fb9
mov rdx, qword [rbp - 0x80]
call fcn.1400074c0
xor edx, edx
mov rcx, qword [rsp + 0x50]
xorps xmm0, xmm0
movsxd rax, esi
lea rdi, [rcx + rax*8]
test bl, bl
je 0x1400050c5
mov rbx, qword [rdi]
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x30], rdx
mov r8d, 0xa
mov qword [rbp + 0x38], rdx
lea rdx, str.Argument:
movups xmmword [rbp + 0x20], xmm0
call fcn.1400077c0
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.1400073a0
xor ebx, ebx
lea rcx, [rbp - 0x60]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
call fcn.1400014a0
lea rcx, [rbp - 0x60]
call fcn.140007020
mov r8, qword [rbp + 0x38]
cmp r8, 7
jbe 0x140005046
mov rdx, qword [rbp + 0x20]
call fcn.1400074c0
mov rdx, qword [rdi]
mov rcx, r14
mov byte [rsp + 0x41], 1
call fcn.140006fa0
movsxd r9, dword [0x140028ac0]
mov rcx, rbx
test r9, r9
jle 0x1400054fd
mov rdx, qword [0x140028ac8]
mov r8, qword [0x140028ab0]
nop word [rax + rax]
cmp rdx, 7
mov rax, r14
cmova rax, r8
cmp word [rax + rcx*2], 0x2f
jne 0x1400050b1
cmp rdx, 7
mov rax, r14
cmova rax, r8
mov word [rax + rcx*2], 0x5c
mov rdx, qword [0x140028ac8]
mov r8, qword [0x140028ab0]
inc rcx
cmp rcx, r9
jl 0x140005080
lea r13, [0x140028ad0]
jmp 0x1400054fd
mov qword [rbp - 0x70], rdx
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], rdx
mov r8d, 8
lea rdx, str._workdir
movups xmmword [rbp - 0x80], xmm0
call fcn.1400077c0
mov rdx, qword [rdi]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], rax
mov r8, r15
inc r8
cmp word [rdx + r8*2], ax
jne 0x140005101
lea rcx, [rsp + 0x60]
call fcn.1400077c0
cmp qword [rbp - 0x68], 7
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmova rdx, qword [rbp - 0x80]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
call fcn.14000fdac
test eax, eax
jne 0x140005149
inc esi
cmp esi, dword [rsp + 0x48]
jge 0x140005149
mov bl, 1
jmp 0x14000514b
xor bl, bl
mov r8, qword [rsp + 0x78]
cmp r8, 7
jbe 0x140005160
mov rdx, qword [rsp + 0x60]
call fcn.1400074c0
mov r8, qword [rbp - 0x68]
xor edx, edx
and r12d, 0xfffffff3
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], dx
cmp r8, 7
jbe 0x14000518e
mov rdx, qword [rbp - 0x80]
call fcn.1400074c0
xor edx, edx
mov rcx, qword [rsp + 0x50]
xorps xmm0, xmm0
movsxd rax, esi
lea rdi, [rcx + rax*8]
test bl, bl
je 0x14000522a
mov rbx, qword [rdi]
lea rcx, [rbp]
mov qword [rbp + 0x10], rdx
mov r8d, 0xa
mov qword [rbp + 0x18], rdx
lea rdx, str.Argument:
movups xmmword [rbp], xmm0
call fcn.1400077c0
mov rdx, rbx
lea rcx, [rbp]
call fcn.1400073a0
xor ecx, ecx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
lea rcx, [rbp - 0x60]
call fcn.1400014a0
lea rcx, [rbp - 0x60]
call fcn.140007020
mov r8, qword [rbp + 0x18]
cmp r8, 7
jbe 0x14000521b
mov rdx, qword [rbp]
call fcn.1400074c0
mov rdx, qword [rdi]
lea rcx, [0x140028a90]
jmp 0x1400054f8
mov qword [rbp - 0x70], rdx
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], rdx
mov r8d, 4
lea rdx, str._key
movups xmmword [rbp - 0x80], xmm0
call fcn.1400077c0
mov rdx, qword [rdi]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], rax
mov r8, r15
inc r8
cmp word [rdx + r8*2], ax
jne 0x140005266
lea rcx, [rsp + 0x60]
call fcn.1400077c0
cmp qword [rbp - 0x68], 7
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmova rdx, qword [rbp - 0x80]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
call fcn.14000fdac
test eax, eax
jne 0x1400052ae
inc esi
cmp esi, dword [rsp + 0x48]
jge 0x1400052ae
mov bl, 1
jmp 0x1400052b0
xor bl, bl
mov r8, qword [rsp + 0x78]
cmp r8, 7
jbe 0x1400052c5
mov rdx, qword [rsp + 0x60]
call fcn.1400074c0
mov r8, qword [rbp - 0x68]
xor edx, edx
and r12d, 0xffffffcf
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], dx
cmp r8, 7
jbe 0x1400052f3
mov rdx, qword [rbp - 0x80]
call fcn.1400074c0
xor edx, edx
mov rcx, qword [rsp + 0x50]
xorps xmm0, xmm0
movsxd rax, esi
lea rdi, [rcx + rax*8]
test bl, bl
je 0x140005381
mov rbx, qword [rdi]
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x30], rdx
mov r8d, 0xa
mov qword [rbp - 0x28], rdx
lea rdx, str.Argument:
movups xmmword [rbp - 0x40], xmm0
call fcn.1400077c0
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.1400073a0
xor ecx, ecx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
lea rcx, [rbp - 0x60]
call fcn.1400014a0
lea rcx, [rbp - 0x60]
call fcn.140007020
lea rcx, [rbp - 0x40]
call fcn.140007020
mov rdx, qword [rdi]
lea rcx, [0x140028a70]
jmp 0x1400054f8
mov qword [rsp + 0x70], rdx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], rdx
mov r8d, 8
lea rdx, str._exename
movups xmmword [rsp + 0x60], xmm0
call fcn.1400077c0
mov rdx, qword [rdi]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x70], rax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x68], rax
mov r8, r15
nop
inc r8
cmp word [rdx + r8*2], ax
jne 0x1400053c0
lea rcx, [rbp - 0x80]
call fcn.1400077c0
cmp qword [rsp + 0x78], 7
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
cmova rdx, qword [rsp + 0x60]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
call fcn.14000fdac
test eax, eax
jne 0x140005407
inc esi
cmp esi, dword [rsp + 0x48]
jge 0x140005407
mov bl, 1
jmp 0x140005409
xor bl, bl
lea rcx, [rbp - 0x80]
call fcn.140007020
lea rcx, [rsp + 0x60]
and r12d, 0xffffff3f
call fcn.140007020
test bl, bl
je 0x1400054fd
mov rcx, qword [rsp + 0x50]
lea rdx, str.Argument:
movsxd rax, esi
mov rbx, qword [rcx + rax*8]
lea rdi, [rcx + rax*8]
lea rcx, [rbp + 0xa0]
call fcn.140007090
mov rdx, rbx
mov rcx, rax
call fcn.1400073a0
xor ebx, ebx
lea rcx, [rbp - 0x60]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
call fcn.1400014a0
lea rcx, [rbp - 0x60]
call fcn.140007020
lea rcx, [rbp + 0xa0]
call fcn.140007020
mov rdx, qword [rdi]
mov rcx, r13
call fcn.140006fa0
movsxd r9, dword [0x140028ae0]
mov ecx, ebx
test r9, r9
jle 0x1400054fd
mov rdx, qword [0x140028ae8]
mov r8, qword [0x140028ad0]
nop
cmp rdx, 7
mov rax, r13
cmova rax, r8
cmp word [rax + rcx*2], 0x2f
je 0x1400054ee
cmp rdx, 7
mov rax, r13
cmova rax, r8
cmp word [rax + rcx*2], 0x5c
je 0x1400054ee
inc rcx
cmp rcx, r9
jl 0x1400054c0
jmp 0x1400054fd
lea rdx, str.Telegram.exe
mov rcx, r13
call fcn.140006fa0
movzx ebx, byte [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
inc esi
cmp esi, dword [rsp + 0x48]
jge 0x140005519
mov ecx, 0xa
jmp 0x140004a80
cmp qword [0x140028ae0], 0
jne 0x140005532
lea rdx, str.Telegram.exe
mov rcx, r13
call fcn.140006fa0
test bl, bl
je 0x1400055a4
xorps xmm0, xmm0
lea rdx, str.Need_to_update_
xorps xmm1, xmm1
lea rcx, [rbp - 0x40]
mov r8d, 0xf
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x40]
call fcn.1400014a0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1400055a4
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000559f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069c1
call fcn.140009910
cmp byte [rsp + 0x42], 0
je 0x140005619
xorps xmm0, xmm0
lea rdx, str.From_autostart_
xorps xmm1, xmm1
lea rcx, [rbp - 0x40]
mov r8d, 0xf
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x40]
call fcn.1400014a0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140005619
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005614
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069c1
call fcn.140009910
cmp byte [rsp + 0x41], 0
je 0x14000568e
xorps xmm0, xmm0
lea rdx, str.Write_Protected_folder_
xorps xmm1, xmm1
lea rcx, [rbp - 0x40]
mov r8d, 0x17
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x40]
call fcn.1400014a0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14000568e
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005689
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069c1
call fcn.140009910
mov rcx, qword [0x140028aa0]
test rcx, rcx
je 0x140005707
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x1e
jb 0x140006a03
cmp qword [0x140028aa8], 7
lea rax, [0x140028a90]
mov qword [rsp + 0x30], rcx
lea r9, str.Will_pass_custom_working_dir:
cmova rax, qword [0x140028a90]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1e
call fcn.140007e50
lea rcx, [rbp - 0x60]
call fcn.1400014a0
mov r8, qword [rbp - 0x48]
cmp r8, 7
jbe 0x140005707
mov rdx, qword [rbp - 0x60]
call fcn.1400074c0
mov r9, qword [rdi]
mov rdx, r15
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140005710
mov rax, qword [0x140028b08]
lea rsi, [0x140028af0]
cmp rdx, rax
ja 0x140005763
lea rbx, [rdx + rdx]
mov qword [0x140028b00], rdx
cmp rax, 7
mov rdi, rsi
mov r8, rbx
mov rdx, r9
cmova rdi, qword [0x140028af0]
mov rcx, rdi
call fcn.140019750
xor ecx, ecx
mov word [rdi + rbx], cx
mov rdi, qword [rsp + 0x50]
jmp 0x14000576b
mov rcx, rsi
call fcn.1400078f0
mov rcx, qword [0x140028b00]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x11
jb 0x140006a03
cmp qword [0x140028b08], 7
lea r9, str.Updater_name_is:
mov qword [rsp + 0x30], rcx
mov rax, rsi
cmova rax, qword [0x140028af0]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x11
call fcn.140007e50
lea rcx, [rbp - 0x60]
call fcn.1400014a0
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140005808
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005803
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069c1
call fcn.140009910
cmp qword [0x140028b00], 0xb
xorps xmm0, xmm0
xorps xmm1, xmm1
jbe 0x140005b73
mov r8d, 0xb
lea rdx, str.Updater.exe
lea rcx, [rbp - 0x80]
movups xmmword [rbp - 0x80], xmm0
movdqu xmmword [rbp - 0x70], xmm1
call fcn.1400077c0
mov rax, qword [0x140028b00]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x60], xmm0
lea rcx, [rax - 0xb]
movdqu xmmword [rsp + 0x70], xmm1
cmp rax, rcx
jb 0x1400069df
sub rax, rcx
mov r8, r15
cmp rax, r15
cmovb r8, rax
cmp qword [0x140028b08], 7
mov rax, rsi
cmova rax, qword [0x140028af0]
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x60]
call fcn.1400077c0
cmp qword [rbp - 0x68], 7
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmova rdx, qword [rbp - 0x80]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
call fcn.14000fdac
mov rdx, qword [rsp + 0x78]
mov ebx, eax
cmp rdx, 7
jbe 0x1400058f6
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400058f1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069e5
call fcn.140009910
mov rdx, qword [rbp - 0x68]
xor eax, eax
movdqa xmm0, xmmword [0x140024670]
mov word [rsp + 0x60], ax
movdqu xmmword [rsp + 0x70], xmm0
cmp rdx, 7
jbe 0x14000594b
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005946
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069e5
call fcn.140009910
lea rcx, [rbp - 0x60]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
test ebx, ebx
jne 0x140005b4d
mov rax, qword [0x140028b00]
lea r8, [rax - 0xb]
cmp rax, r8
cmovb r8, rax
cmp qword [0x140028b08], 7
cmova rsi, qword [0x140028af0]
mov rdx, rsi
call fcn.1400077c0
lea rbx, [0x140028b10]
mov rcx, rbx
call fcn.140007020
movups xmm1, xmmword [rbp - 0x50]
movabs rsi, 0x7ffffffffffffffe
movups xmm0, xmmword [rbp - 0x60]
mov rax, rsi
movq rcx, xmm1
movaps xmmword [0x140028b20], xmm1
sub rax, rcx
movaps xmmword [0x140028b10], xmm0
cmp rax, 0x10
jb 0x140006a03
cmp qword [0x140028b28], 7
lea r9, str.Updater_dir_is:
mov qword [rsp + 0x30], rcx
mov rax, rbx
cmova rax, qword [0x140028b10]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x10
call fcn.140007e50
lea rcx, [rbp + 0x40]
call fcn.1400014a0
lea rcx, [rbp + 0x40]
call fcn.140007020
movzx r15d, byte [rsp + 0x41]
test r15b, r15b
jne 0x140005a4e
cmp r14, rbx
je 0x140005a4e
cmp qword [0x140028b28], 7
mov rcx, r14
mov r8, qword [0x140028b20]
cmova rbx, qword [0x140028b10]
mov rdx, rbx
call fcn.140007330
mov rcx, qword [0x140028ac0]
mov rax, rsi
sub rax, rcx
cmp rax, 0xb
jb 0x140006a03
cmp qword [0x140028ac8], 7
lea r9, str.Update_to:
mov qword [rsp + 0x30], rcx
mov rax, r14
cmova rax, qword [0x140028ab0]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xb
call fcn.140007e50
lea rcx, [rbp + 0x40]
call fcn.1400014a0
lea rcx, [rbp + 0x40]
call fcn.140007020
cmp byte [rsp + 0x40], 0
je 0x140005ac2
call fcn.140001dc0
test al, al
je 0x140005ac2
call fcn.1400041c0
test r15b, r15b
je 0x140005be5
lea rcx, str.tupdates_temp_tdata_version
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005b3e
lea rcx, str.tupdates_ready_tdata_version
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005b3e
lea r8d, [rax + 0x24]
lea rdx, str.Error:_could_not_delete_version_file
xorps xmm1, xmm1
lea rcx, [rbp - 0x40]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x40], xmm0
call fcn.1400077c0
lea rcx, [rbp - 0x40]
call fcn.1400014a0
mov r8, qword [rbp - 0x28]
cmp r8, 7
jbe 0x140005be5
mov rdx, qword [rbp - 0x40]
call fcn.1400074c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140005c27
mov r8d, 0x15
lea rdx, str.Version_file_deleted_
jmp 0x140005af8
mov r8d, 0x14
lea rdx, str.Error:_bad_exe_name_
call fcn.1400077c0
lea rcx, [rbp - 0x60]
call fcn.1400014a0
lea rcx, [rbp - 0x60]
call fcn.140007020
jmp 0x140005bdb
mov r8d, 0x16
lea rdx, str.Error:_short_exe_name_
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x40]
call fcn.1400014a0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140005bdb
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bd6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069c1
call fcn.140009910
movabs rsi, 0x7ffffffffffffffe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140005c27
xorps xmm0, xmm0
lea rdx, str.Error:_No_command_line_arguments_
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 0x21
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x60]
call fcn.1400014a0
lea rcx, [rbp - 0x60]
call fcn.140007020
xor r14d, r14d
mov qword [rbp - 8], 7
xorps xmm0, xmm0
mov qword [rbp - 0x10], r14
movups xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x20], r14w
cmp byte [rsp + 0x42], r14b
je 0x140005c66
lea r9, str.__autostart
mov qword [rsp + 0x20], 0xb
lea edx, [r14 + 0xb]
lea rcx, [rbp - 0x20]
call fcn.140007a70
cmp byte [rsp + 0x43], r14b
je 0x140005cd2
mov rcx, qword [rbp - 8]
mov rdi, qword [rbp - 0x10]
mov rax, rcx
sub rax, rdi
cmp rax, 7
jb 0x140005cb4
cmp rcx, 7
lea rax, [rdi + 7]
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
cmova rbx, qword [rbp - 0x20]
lea rdx, str.__debug
mov r8d, 0xe
lea rcx, [rbx + rdi*2]
call fcn.140019750
mov word [rbx + rdi*2 + 0xe], r14w
jmp 0x140005cd2
lea r9, str.__debug
mov qword [rsp + 0x20], 7
mov edx, 7
lea rcx, [rbp - 0x20]
call fcn.140007a70
cmp byte [rsp + 0x44], r14b
je 0x140005ce9
lea rdx, str.__startintray
lea rcx, [rbp - 0x20]
call fcn.1400073a0
mov rcx, qword [0x140028aa0]
test rcx, rcx
je 0x140005e7d
mov rax, rsi
sub rax, rcx
cmp rax, 0xb
jb 0x1400069eb
cmp qword [0x140028aa8], 7
lea rax, [0x140028a90]
mov qword [rsp + 0x30], rcx
lea r9, [0x140023ed0]
cmova rax, qword [0x140028a90]
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xb
call fcn.140007e50
lea rdx, [0x140023ecc]
lea rcx, [rbp + 0x80]
call fcn.1400073a0
lea r9, [rbp - 0x60]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm0
movq rdi, xmm0
movq rsi, xmm1
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
movdqa xmm0, xmm1
mov word [rax], r14w
mov rcx, qword [rbp - 8]
mov r15, qword [rbp - 0x10]
mov rax, rcx
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 7
cmova r9, rdi
sub rax, r15
cmp rsi, rax
ja 0x140005de0
cmp rcx, 7
lea rax, [r15 + rsi]
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
cmova rbx, qword [rbp - 0x20]
lea r8, [rsi + rsi]
mov rdx, r9
lea rcx, [rbx + r15*2]
call fcn.140019750
lea rax, [r15 + rsi]
xor ecx, ecx
mov word [rbx + rax*2], cx
jmp 0x140005df9
mov rdx, rsi
mov qword [rsp + 0x20], rsi
lea rcx, [rbp - 0x20]
call fcn.140007a70
mov r14, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x60]
cmp r14, 7
jbe 0x140005e34
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140005e2c
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069f1
mov rcx, rdi
call fcn.140009910
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x140005e7a
mov rcx, qword [rbp + 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e75
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069f1
call fcn.140009910
xor r14d, r14d
mov rcx, qword [0x140028a80]
test rcx, rcx
je 0x140006009
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 7
jb 0x1400069f7
cmp qword [0x140028a88], 7
lea rax, [0x140028a70]
mov qword [rsp + 0x30], rcx
lea r9, str.__key__
cmova rax, qword [0x140028a70]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 7
call fcn.140007e50
lea rdx, [0x140023ecc]
lea rcx, [rbp + 0x40]
call fcn.1400073a0
lea r9, [rbp - 0x60]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm0
movq rdi, xmm0
movq rsi, xmm1
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
movdqa xmm0, xmm1
mov word [rax], r14w
mov rcx, qword [rbp - 8]
mov r15, qword [rbp - 0x10]
mov rax, rcx
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 7
cmova r9, rdi
sub rax, r15
cmp rsi, rax
ja 0x140005f75
cmp rcx, 7
lea rax, [r15 + rsi]
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
cmova rbx, qword [rbp - 0x20]
lea r8, [rsi + rsi]
mov rdx, r9
lea rcx, [rbx + r15*2]
call fcn.140019750
lea rax, [r15 + rsi]
xor ecx, ecx
mov word [rbx + rax*2], cx
jmp 0x140005f8e
mov rdx, rsi
mov qword [rsp + 0x20], rsi
lea rcx, [rbp - 0x20]
call fcn.140007a70
mov r14, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x60]
cmp r14, 7
jbe 0x140005fc9
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140005fc1
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069fd
mov rcx, rdi
call fcn.140009910
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140006009
mov rcx, qword [rbp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006004
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069fd
call fcn.140009910
mov r14, qword [rbp - 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r14
cmp rax, 0x12
jb 0x140006a03
cmp qword [rbp - 8], 7
lea r15, [rbp - 0x20]
lea rsi, [r14 + 0x12]
mov edi, 7
cmova r15, qword [rbp - 0x20]
lea rbx, [rbp - 0x80]
xorps xmm0, xmm0
movabs rax, 0x7fffffffffffffff
movups xmmword [rbp - 0x80], xmm0
cmp rsi, rdi
jbe 0x1400060d4
mov rdi, rsi
or rdi, 7
cmp rdi, rcx
jbe 0x14000606d
mov rdi, rcx
lea rcx, [rax + rax]
jmp 0x140006093
cmp rdi, 0xa
mov ecx, 0xa
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, rax
ja 0x140006a0f
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400060bf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006a0f
mov rcx, rax
call fcn.14000968c
test rax, rax
je 0x1400069c1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400060d0
test rcx, rcx
je 0x1400060cb
call fcn.14000968c
jmp 0x1400060cd
xor eax, eax
mov rbx, rax
mov qword [rbp - 0x80], rbx
movaps xmm0, xmmword [str.Result_arguments:]
lea rcx, [rbx + 0x24]
mov qword [rbp - 0x70], rsi
lea r8, [r14 + r14]
mov qword [rbp - 0x68], rdi
mov rdx, r15
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x140023f10]
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [0x140023f20]
mov dword [rbx + 0x20], eax
call fcn.140019750
xor r14d, r14d
lea rcx, [rbp - 0x80]
mov word [rbx + rsi*2], r14w
call fcn.1400014a0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000615b
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006156
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069c1
call fcn.140009910
xor dil, dil
cmp byte [rsp + 0x41], dil
je 0x14000660c
xorps xmm0, xmm0
lea rdx, str.Trying_to_run_un_elevated_by_temp.lnk
xorps xmm1, xmm1
lea rcx, [rbp - 0x40]
mov r8d, 0x25
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x40]
call fcn.1400014a0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1400061d7
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061d2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069c1
call fcn.140009910
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x1400065d5
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x14001b430]
mov qword [rsp + 0x20], rax
lea rcx, [0x14001b460]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400064e4
lea rcx, [rbp + 0x20]
call fcn.140007670
lea rdx, [0x140028ab0]
lea rcx, [rbp]
call fcn.1400070d0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x10]
mov rbx, qword [rcx + 0x58]
test rax, rax
je 0x140006292
bts r12d, 8
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x60], xmm0
movdqu xmmword [rbp + 0x70], xmm1
cmp rax, 1
jb 0x140006a09
dec rax
lea rdx, [rbp - 0x20]
cmp rax, 0xffffffffffffffff
lea rcx, [rbp + 0x60]
mov r8, 0xffffffffffffffff
cmovb r8, rax
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
add rdx, 2
call fcn.1400077c0
lea rax, [rbp + 0x60]
jmp 0x1400062a7
bts r12d, 9
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xa0]
call fcn.1400070d0
cmp qword [rax + 0x18], 7
jbe 0x1400062b1
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50]
mov rdx, rax
call rbx
bt r12d, 9
jae 0x1400062ce
lea rcx, [rbp + 0xa0]
call fcn.140007020
bt r12d, 8
jae 0x1400062de
lea rcx, [rbp + 0x60]
call fcn.140007020
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rdx, qword [rbp]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x14002307c]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [0x14001b450]
mov rax, qword [rcx]
call qword [rax]
xorps xmm0, xmm0
xorps xmm1, xmm1
test eax, eax
js 0x14000648f
mov r8d, 0x16
lea rdx, str.tupdates_temp_temp.lnk
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.1400077c0
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
mov r8d, 1
cmova rdx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov ebx, eax
test eax, eax
jns 0x1400063c8
lea rdx, str.tupdates_ready_temp.lnk
lea rcx, [rsp + 0x60]
call fcn.140006fa0
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
mov r8d, 1
cmova rdx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
xorps xmm0, xmm0
xorps xmm1, xmm1
test ebx, ebx
js 0x14000644c
mov r8d, 0x24
lea rdx, str.Executing_un_elevated_through_link..
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x40]
call fcn.1400014a0
mov r8, qword [rbp - 0x28]
cmp r8, 7
jbe 0x140006418
mov rdx, qword [rbp - 0x40]
call fcn.1400074c0
cmp qword [rsp + 0x78], 7
lea r9, [rsp + 0x60]
mov dword [rsp + 0x28], 1
lea r8, str.explorer.exe
cmova r9, qword [rsp + 0x60]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dil, 1
jmp 0x14000647d
mov r8d, 0x17
lea rdx, str.Error:_ppf__Save_failed
lea rcx, [rbp - 0x60]
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x60]
call fcn.1400014a0
lea rcx, [rbp - 0x60]
call fcn.140007020
mov r8, qword [rsp + 0x78]
cmp r8, 7
jbe 0x1400064ca
mov rdx, qword [rsp + 0x60]
jmp 0x1400064c5
mov r8d, 0x32
lea rdx, str.Error:_Could_not_create_interface_IID_IPersistFile
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x40]
call fcn.1400014a0
mov r8, qword [rbp - 0x28]
cmp r8, 7
jbe 0x1400064ca
mov rdx, qword [rbp - 0x40]
call fcn.1400074c0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rbp]
call fcn.140007020
lea rcx, [rbp + 0x20]
jmp 0x140006516
xorps xmm0, xmm0
lea rdx, str.Error:_could_not_create_instance_of_IID_IShellLink
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 0x32
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x60]
call fcn.1400014a0
lea rcx, [rbp - 0x60]
call fcn.140007020
call qword [sym.imp.ole32.dll_CoUninitialize]
test dil, dil
je 0x14000660c
movabs r12, 0x7ffffffffffffffe
mov rax, qword [0x140028ae0]
sub r12, rax
cmp r12, 0xa
jb 0x140006a15
cmp qword [0x140028ae8], 7
lea r9, str.Executed_
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
cmova r13, qword [0x140028ad0]
mov eax, 0xa
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.140007e50
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov rax, rcx
sub rax, rdi
cmp rax, 0x1d
jb 0x14000685d
cmp rcx, 7
lea rax, [rdi + 0x1d]
lea rbx, [rsp + 0x60]
mov qword [rsp + 0x70], rax
cmova rbx, qword [rsp + 0x60]
lea rdx, str.__closing_log_and_quitting..
mov r8d, 0x3a
lea rcx, [rbx + rdi*2]
call fcn.140019750
lea rax, [rsp + 0x60]
mov word [rbx + rdi*2 + 0x3a], r14w
jmp 0x14000687c
xorps xmm0, xmm0
lea rdx, str.Error:_Could_not_initialize_COM
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 0x1f
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1400077c0
lea rcx, [rbp - 0x60]
call fcn.1400014a0
lea rcx, [rbp - 0x60]
call fcn.140007020
mov r14, qword [rbp - 0x10]
movabs r12, 0x7ffffffffffffffe
mov rax, r12
sub rax, r14
cmp rax, 9
jb 0x1400069c7
cmp qword [rbp - 8], 7
lea r15, [rbp - 0x20]
lea rsi, [r14 + 9]
mov edi, 7
cmova r15, qword [rbp - 0x20]
lea rbx, [rsp + 0x60]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
cmp rsi, rdi
jbe 0x1400066f1
mov rdi, rsi
or rdi, 7
cmp rdi, r12
jbe 0x14000667f
movabs rax, 0x7fffffffffffffff
mov rdi, r12
lea rcx, [rax + rax]
jmp 0x1400066af
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rdi + 1]
cmp rcx, rax
ja 0x140006a21
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400066db
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006a21
mov rcx, rax
call fcn.14000968c
test rax, rax
je 0x140006a1b
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400066ec
test rcx, rcx
je 0x1400066e7
call fcn.14000968c
jmp 0x1400066e9
xor eax, eax
mov rbx, rax
mov qword [rsp + 0x60], rbx
movaps xmm0, xmmword [str._noupdate]
lea rcx, [rbx + 0x12]
mov qword [rsp + 0x70], rsi
lea r8, [r14 + r14]
mov qword [rsp + 0x78], rdi
mov rdx, r15
movups xmmword [rbx], xmm0
movzx eax, word [0x1400241b0]
mov word [rbx + 0x10], ax
call fcn.140019750
xor r14d, r14d
mov rax, r12
mov word [rbx + rsi*2], r14w
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
mov rcx, qword [0x140028ac0]
cmova rbx, qword [rsp + 0x60]
sub rax, rcx
mov rdx, qword [0x140028ae0]
cmp rax, rdx
jb 0x1400069c7
cmp qword [0x140028ac8], 7
lea r9, [0x140028ab0]
mov qword [rsp + 0x30], rdx
mov rax, r13
cmova r9, qword [0x140028ab0]
cmp qword [0x140028ae8], 7
cmova rax, qword [0x140028ad0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x80]
call fcn.140007e50
cmp qword [rbp - 0x68], 7
lea r8, [rbp - 0x80]
mov dword [rsp + 0x28], 1
mov r9, rbx
cmova r8, qword [rbp - 0x80]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140006800
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067fb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a1b
call fcn.140009910
mov rdx, qword [rsp + 0x78]
movdqa xmm0, xmmword [0x140024670]
mov word [rbp - 0x80], r14w
movdqu xmmword [rbp - 0x70], xmm0
cmp rdx, 7
jbe 0x140006534
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006853
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a1b
call fcn.140009910
jmp 0x140006534
lea r9, str.__closing_log_and_quitting..
mov qword [rsp + 0x20], 0x1d
mov edx, 0x1d
lea rcx, [rsp + 0x60]
call fcn.140007a70
movups xmm0, xmmword [rax]
lea rcx, [rbp - 0x60]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
call fcn.1400014a0
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x1400068e4
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068df
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a27
call fcn.140009910
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140006926
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006921
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a27
call fcn.140009910
mov rcx, qword [0x14002a038]
movdqa xmm0, xmmword [0x140024670]
mov word [rsp + 0x60], r14w
movdqu xmmword [rsp + 0x70], xmm0
test rcx, rcx
je 0x140006953
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14002a038], r14
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000698f
mov rcx, qword [rbp - 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000698a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400069c1
call fcn.140009910
xor eax, eax
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400093d0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140010394
int3
call fcn.140001200
int3
call fcn.140010394
int3
call fcn.140010394
int3
call fcn.140010394
int3
call fcn.140007510
int3
call fcn.140010394
int3
call fcn.140001200
int3
call fcn.140010394
int3
call fcn.140001200
int3
call fcn.140010394
int3
call fcn.140001200
int3
call fcn.140007510
int3
call fcn.140001160
int3
call fcn.140001200
int3
call fcn.140010394
int3
call fcn.140001160
int3
call fcn.140010394
int3