Function at 0x140035b20
Capabilities:
Accept command line arguments
Check if file exists
Get common file path
Get file attributes
Get startup folder
Identify system language via api
Query environment variable

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2e60
call fcn.1400b9560
sub rsp, rax
movaps xmmword [rsp + 0x2e50], xmm6
movaps xmmword [rsp + 0x2e40], xmm7
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x2e30], rax
mov r13, qword [rsp + 0x2eb0]
mov qword [rsp + 0xd0], r13
xor r14d, r14d
mov edi, r14d
mov dword [rsp + 0x84], r14d
mov dword [rsp + 0x8c], r14d
lea rcx, [rsp + 0x18d0]
call fcn.14000c050
nop
lea rcx, [rsp + 0x1800]
call fcn.14000c050
nop
lea rcx, [rsp + 0x17d0]
call fcn.14000c050
nop
lea rcx, [rsp + 0x1db8]
call fcn.14000c050
nop
lea rcx, [rsp + 0x1c40]
call fcn.14000c050
nop
lea rcx, [rsp + 0x1c60]
call fcn.14000c050
nop
lea rcx, [rsp + 0x18b0]
call fcn.14000c050
nop
lea rcx, [rsp + 0x1850]
call fcn.14003b690
lea rcx, [rsp + 0x1850]
call fcn.14003b3c0
nop
lea rcx, [rsp + 0x17f0]
call fcn.14003b6c0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x17f0], xmm1
lea rax, vtable.SfxProgress.0
mov qword [rsp + 0x1be0], rax
lea rcx, [rsp + 0x1f00]
call fcn.14003b6e0
lea rcx, [rsp + 0x1f00]
call fcn.140028260
nop
mov dword [rsp + 0xf8], 0xffffffff
lea rcx, [rsp + 0x1a00]
call fcn.14000c050
nop
xor sil, sil
mov dword [rsp + 0x94], r14d
lea rcx, [rsp + 0x1948]
call fcn.14000ce30
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1948], xmm1
mov qword [rsp + 0x1958], r14
lea rcx, [rsp + 0x20b0]
call fcn.14003b3f0
nop
movups xmmword [rsp + 0x2380], xmm1
movups xmmword [rsp + 0x2390], xmm1
movups xmmword [rsp + 0x23a0], xmm1
movups xmmword [rsp + 0x23b0], xmm1
movups xmmword [rsp + 0x23c0], xmm1
movups xmmword [rsp + 0x23d0], xmm1
movups xmmword [rsp + 0x23e0], xmm1
movups xmmword [rsp + 0x23f0], xmm1
lea rcx, [rsp + 0x1830]
call fcn.14000c050
nop
lea rcx, [rsp + 0x1908]
call fcn.14000c050
nop
lea rcx, [rsp + 0x19e0]
call fcn.14000c050
nop
mov word [rsp + 0x2610], r14w
xor edx, edx
mov r8d, 0x81e
lea rcx, [rsp + 0x2612]
call fcn.1400fed10
mov r12, 0xffffffffffffffff
mov dword [rsp + 0xb0], r12d
xor al, al
mov dword [rsp + 0x98], eax
mov byte [rsp + 0x89], al
mov byte [rsp + 0x8a], al
lea rcx, [rsp + 0x19c0]
call fcn.14000c050
nop
mov r15d, 1
mov ecx, r15d
call fcn.14007f9f0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r15d
call fcn.1400771a0
call fcn.14008f050
lea ecx, [r14 + 4]
call fcn.14008f320
xor ecx, ecx
call fcn.14007fcf0
call fcn.14008fef0
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0xb8], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0xc0], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xc4], rax
mov dword [rsp + 0xcc], 0x100
lea rcx, [rsp + 0xb8]
call fcn.14003d050
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
movzx r8d, r15b
lea rcx, [rsp + 0x1850]
call fcn.14003c230
lea rdx, str.silent
lea rcx, [rsp + 0x1080]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x8d0], xmm0
lea rdx, [rsp + 0x8d0]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x140035eb1
call fcn.14002f2f0
mov rbx, rax
lea rdx, str.silent
lea rcx, [rsp + 0x1090]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x8e0], xmm0
lea rdx, [rsp + 0x8e0]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov r9, rbx
lea rdx, str.stub_loading
mov rcx, rax
call fcn.14003d130
movzx esi, sil
test al, al
cmove esi, r15d
lea rdx, str.AdminUpgrade
lea rcx, [rsp + 0x10a0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x8f0], xmm0
lea rdx, [rsp + 0x8f0]
lea rcx, [rsp + 0x1850]
call fcn.140031220
movzx ebx, sil
test al, al
cmovne ebx, r15d
mov dword [rsp + 0x9c], ebx
mov byte [rsp + 0x88], bl
lea rdx, [0x140149bb0]
lea rcx, [rsp + 0x10b0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x900], xmm0
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x1850]
call fcn.140031220
mov byte [rsp + 0xa0], al
lea rdx, [0x14014b0f8]
lea rcx, [rsp + 0x10c0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x910], xmm0
lea rdx, [rsp + 0x910]
lea rcx, [rsp + 0x1850]
call fcn.140031220
movzx esi, al
mov byte [rsp + 0x90], sil
xor esi, r15d
add esi, esi
mov ecx, esi
call fcn.140034150
mov dword [rsp + 0xf0], r14d
xor ecx, ecx
call fcn.1400a7d20
test al, al
je 0x14003612b
lea rcx, [rsp + 0xf0]
call fcn.1400359f0
test al, al
je 0x14003612b
cmp dword [rsp + 0xf0], 0x3000
jae 0x14003612b
test bl, bl
jne 0x140035fe0
mov r9d, 0x10
lea r8, str.Installation_failed
lea rdx, str.We_are_sorry_but_the_installer_must_be_run_at_high_integrity_level__n_nTip:_Run_it_under_an_Administrator_account_or_use_a_different_browser_to_download_the_installer.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0xb8], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0xc0], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xc4], rax
mov dword [rsp + 0xcc], 0x116
lea rcx, [rsp + 0xb8]
call fcn.14003d160
nop
lea rcx, [rsp + 0x19c0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x19e0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1908]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1830]
call fcn.14000c080
nop
lea rcx, [rsp + 0x20b0]
call fcn.14003b710
nop
lea rcx, [rsp + 0x1948]
call fcn.14000d9f0
nop
lea rcx, [rsp + 0x1a00]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1f00]
call fcn.1400283f0
nop
lea rcx, [rsp + 0x17f0]
call fcn.14000d280
nop
lea rcx, [rsp + 0x1850]
call fcn.14003b650
nop
lea rcx, [rsp + 0x18b0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1c60]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1c40]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1db8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x17d0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1800]
call fcn.14000c080
nop
lea rcx, [rsp + 0x18d0]
call fcn.14000c080
mov eax, 0x7c
jmp 0x14003b2d5
call fcn.1400a7be0
cmp eax, 5
jne 0x14003617a
call fcn.14002f2f0
mov rbx, rax
mov rdx, r13
lea rcx, [rsp + 0xec0]
call fcn.14000bfe0
nop
mov edi, r15d
mov dword [rsp + 0x84], r15d
mov r9, rbx
lea rdx, str._arm64
lea rcx, [rsp + 0xec0]
call fcn.14003d130
test al, al
jne 0x14003617a
movzx ebx, dil
jmp 0x14003617c
xor bl, bl
test dil, 1
je 0x140036199
and edi, 0xfffffffe
mov dword [rsp + 0x84], edi
lea rcx, [rsp + 0xec0]
call fcn.14000c080
test bl, bl
je 0x140036312
cmp byte [rsp + 0x9c], 0
jne 0x1400361c7
mov r9d, 0x10
lea r8, str.Installation_failed
lea rdx, str.We_are_sorry_but_the_Avast_Antivirus_installer_cannot_run_on_arm64_devices._n_nTip:_Check_our_website_if_there_is_a_supported_version.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0xb8], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0xc0], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xc4], rax
mov dword [rsp + 0xcc], 0x11f
lea rcx, [rsp + 0xb8]
call fcn.14003d240
nop
lea rcx, [rsp + 0x19c0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x19e0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1908]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1830]
call fcn.14000c080
nop
lea rcx, [rsp + 0x20b0]
call fcn.14003b710
nop
lea rcx, [rsp + 0x1948]
call fcn.14000d9f0
nop
lea rcx, [rsp + 0x1a00]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1f00]
call fcn.1400283f0
nop
lea rcx, [rsp + 0x17f0]
call fcn.14000d280
nop
lea rcx, [rsp + 0x1850]
call fcn.14003b650
nop
lea rcx, [rsp + 0x18b0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1c60]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1c40]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1db8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x17d0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1800]
call fcn.14000c080
nop
lea rcx, [rsp + 0x18d0]
call fcn.14000c080
mov eax, 0xc1
jmp 0x14003b2d5
mov ecx, r15d
call fcn.1400a7d20
test al, al
jne 0x1400364a3
mov ecx, r12d
call fcn.140034b10
test al, al
je 0x1400364a3
cmp byte [rsp + 0x9c], 0
jne 0x140036358
mov r9d, 0x10
lea r8, str.Unsupported_system
lea rdx, str.Your_operating_system_is_not_supported_for_Avast_One_installation._Please_upgrade_your_OS_at_least_to_Windows_7_SP1.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0xb8], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0xc0], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xc4], rax
mov dword [rsp + 0xcc], 0x127
lea rcx, [rsp + 0xb8]
call fcn.14003d320
nop
lea rcx, [rsp + 0x19c0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x19e0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1908]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1830]
call fcn.14000c080
nop
lea rcx, [rsp + 0x20b0]
call fcn.14003b710
nop
lea rcx, [rsp + 0x1948]
call fcn.14000d9f0
nop
lea rcx, [rsp + 0x1a00]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1f00]
call fcn.1400283f0
nop
lea rcx, [rsp + 0x17f0]
call fcn.14000d280
nop
lea rcx, [rsp + 0x1850]
call fcn.14003b650
nop
lea rcx, [rsp + 0x18b0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1c60]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1c40]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1db8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x17d0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1800]
call fcn.14000c080
nop
lea rcx, [rsp + 0x18d0]
call fcn.14000c080
mov eax, 2
jmp 0x14003b2d5
call fcn.140035990
test al, al
jne 0x14003653a
mov ecx, r12d
call fcn.140034b10
test al, al
je 0x14003653a
cmp byte [rsp + 0x9c], 0
jne 0x1400364e2
mov r9d, 0x10
lea r8, str.Unsupported_system
lea rdx, str.Your_operating_system_is_not_supported_for_Avast_One_installation._Windows_7_KB3033929_is_required.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0xb8], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0xc0], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xc4], rax
mov dword [rsp + 0xcc], 0x12f
lea rcx, [rsp + 0xb8]
call fcn.14003d400
jmp 0x1400363ac
call fcn.1400a7c70
test al, al
je 0x140036548
call fcn.14006d500
mov qword [rsp + 0x17b0], r14
xor r9d, r9d
lea r8, [rsp + 0x17b0]
mov edx, r15d
lea rcx, str.O:BAG:BAD:P_A_CIOI_FA___SY__A_CIOI_FA___BA__A_CIOI_FRFX___BU_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov dword [rsp + 0x17b8], 0x18
mov rax, qword [rsp + 0x17b0]
mov qword [rsp + 0x17c0], rax
mov dword [rsp + 0x17c8], r14d
lea rdx, str.._
lea rcx, [rsp + 0x2610]
call fcn.14003d4e0
xor r9d, r9d
lea r8d, [r9 + 0x23]
lea rdx, [rsp + 0x2618]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.140068c00
lea rcx, [rax + 0xb0]
call fcn.14000c030
mov rbx, rax
lea rdx, [0x140143394]
lea rcx, [rsp + 0x1300]
call fcn.14000bfe0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x12e0]
call fcn.14000ba70
mov rcx, rax
call fcn.14000c030
mov rdx, rax
lea rcx, [rsp + 0x2610]
call fcn.14003d510
lea rcx, [rsp + 0x12e0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1300]
call fcn.14000c080
lea rbx, [rsp + 0x17b8]
cmp qword [rsp + 0x17b0], 0
cmove rbx, r14
lea rdx, [rsp + 0x2610]
lea rcx, [rsp + 0xee0]
call fcn.14000bfe0
nop
mov rdx, rbx
lea rcx, [rsp + 0xee0]
call fcn.14009dd20
nop
lea rcx, [rsp + 0xee0]
call fcn.14000c080
mov rcx, qword [rsp + 0x17b0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.1400a7e80
test al, al
jne 0x140036695
call fcn.1400a7f20
test al, al
je 0x1400367ec
lea rdx, str.SOFTWARE_
lea rcx, [rsp + 0x2610]
call fcn.14003d4e0
lea rcx, [rsp + 0x2400]
call fcn.14003d540
call fcn.140068c00
lea rcx, [rax + 0xb0]
call fcn.14000c030
mov rdx, rax
lea rcx, [rsp + 0x2610]
call fcn.14003d510
lea rdx, [0x14014a218]
lea rcx, [rsp + 0x2400]
call fcn.14003d570
call fcn.140068c00
lea rcx, [rax + 0xb0]
call fcn.14000c030
mov rdx, rax
lea rcx, [rsp + 0x2400]
call fcn.14003d570
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2610]
call fcn.1400a2c40
test al, al
je 0x14003675f
cmp byte [rsp + 0x80], 0
je 0x14003675f
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2400]
call fcn.1400a2c40
test al, al
je 0x14003675f
cmp byte [rsp + 0x80], 0
je 0x14003675f
lea rcx, [rsp + 0x2610]
call fcn.1400a2aa0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2400]
call fcn.1400a2c40
test al, al
je 0x140036791
cmp byte [rsp + 0x80], 0
je 0x140036791
lea rdx, [rsp + 0x2610]
call fcn.1400a1bf0
jmp 0x1400367ec
lea rdx, [rsp + 0x2610]
call fcn.1400a1e20
test al, al
je 0x1400367d7
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2610]
call fcn.1400a2c40
test al, al
je 0x1400367c5
cmp byte [rsp + 0x80], 0
jne 0x1400367ec
lea rdx, [rsp + 0x2400]
lea rcx, [rsp + 0x2610]
jmp 0x1400367e7
lea rdx, [rsp + 0x2610]
lea rcx, [rsp + 0x2400]
call fcn.1400a26b0
call fcn.1400a7c70
test al, al
je 0x140036800
call fcn.14003d5a0
call qword [case.0x1400a96cf.0]
lea r13, [0x14017fcf0]
mov qword [rsp + 0x2a0], r13
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0x420], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0x428], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x42c], rax
mov dword [rsp + 0x434], 0x173
lea rax, str.Running_SFX_
mov qword [rsp + 0x530], rax
mov qword [rsp + 0x538], 0x10
lea r9, [rsp + 0x2a0]
lea r8, [rsp + 0x530]
lea rdx, [rsp + 0x420]
call fcn.14000ece0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a60], xmm0
movdqa xmm1, xmmword [0x140156bb0]
movdqu xmmword [rsp + 0x1a70], xmm1
mov word [rsp + 0x1a60], r14w
call fcn.1400a7be0
mov dword [rsp + 0xfc], eax
mov dword [rsp + 0x100], eax
lea rdx, str.no_dsa
lea rcx, [rsp + 0x10d0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x920], xmm0
lea rdx, [rsp + 0x920]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
jne 0x140036914
xor ecx, ecx
call fcn.14002f390
mov rcx, rax
call fcn.140068450
test al, al
je 0x14003b308
lea rcx, [rsp + 0xcd0]
call fcn.14003d690
mov rdx, rax
lea rcx, [rsp + 0x17f0]
call fcn.14003bef0
lea rcx, [rsp + 0xcd0]
call fcn.14000d280
xor ecx, ecx
call fcn.14002f390
mov rdx, rax
lea rcx, [rsp + 0xe00]
call fcn.14000bfe0
nop
lea r8, [rsp + 0x1a60]
lea rdx, [rsp + 0xe00]
mov r13, qword [rsp + 0x17f0]
mov rcx, r13
call fcn.140029f20
nop
lea rcx, [rsp + 0xe00]
call fcn.14000c080
nop
lea rdx, str.language
lea rcx, [rsp + 0x10e0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xcc0], xmm0
lea rdx, [rsp + 0xcc0]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x140036a0e
lea rdx, str.language
lea rcx, [rsp + 0x7a0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x270], xmm0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
call fcn.14000c030
mov rcx, rax
call fcn.1400d5138
mov word [rsp + 0xa4], ax
jmp 0x140036aa5
lea rdx, str.langid
lea rcx, [rsp + 0x10f0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x270], xmm0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x140036a94
lea rdx, str.langid
lea rcx, [rsp + 0x1100]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x7a0], xmm0
lea rdx, [rsp + 0x7a0]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
call fcn.14000c030
mov rcx, rax
call fcn.1400d5138
mov word [rsp + 0xa4], ax
jmp 0x140036aa5
call fcn.140035850
movzx ecx, word [rax + 0x44]
mov word [rsp + 0xa4], cx
lea rdx, [0x14014b158]
lea rcx, [rsp + 0x1110]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xcb0], xmm0
lea rdx, [rsp + 0xcb0]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rdx, rax
lea rcx, [rsp + 0x1830]
call fcn.140025b30
lea rdx, str.ga_clientid
lea rcx, [rsp + 0x1120]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xca0], xmm0
lea rdx, [rsp + 0xca0]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x140036b6b
lea rdx, str.ga_clientid
lea rcx, [rsp + 0x1130]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x290], xmm0
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rdx, rax
lea rcx, [rsp + 0x1340]
call fcn.140025cc0
nop
or edi, 2
jmp 0x140036b9b
lea rcx, [rsp + 0x1140]
call fcn.1400a7830
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x290], xmm0
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x1320]
call fcn.140029b20
or edi, 4
mov dword [rsp + 0x84], edi
mov rdx, rax
lea rcx, [rsp + 0x1908]
call fcn.140025ba0
test dil, 4
je 0x140036bd0
and edi, 0xfffffffb
mov dword [rsp + 0x84], edi
lea rcx, [rsp + 0x1320]
call fcn.14000c080
nop
test dil, 2
je 0x140036bed
and edi, 0xfffffffd
mov dword [rsp + 0x84], edi
lea rcx, [rsp + 0x1340]
call fcn.14000c080
lea rdx, str.edat_dir
lea rcx, [rsp + 0x1150]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc90], xmm0
lea rdx, [rsp + 0xc90]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x140036c6f
lea rdx, str.edat_dir
lea rcx, [rsp + 0x1160]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc80], xmm0
lea rdx, [rsp + 0xc80]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rdx, rax
lea rcx, [rsp + 0x1380]
call fcn.140025cc0
nop
or edi, 8
jmp 0x140036c86
lea rdx, [0x1401433a0]
lea rcx, [rsp + 0x1360]
call fcn.14000bfe0
or edi, 0x10
mov dword [rsp + 0x84], edi
mov rdx, rax
lea rcx, [rsp + 0x19e0]
call fcn.140025ba0
test dil, 0x10
je 0x140036cbb
and edi, 0xffffffef
mov dword [rsp + 0x84], edi
lea rcx, [rsp + 0x1360]
call fcn.14000c080
nop
test dil, 8
je 0x140036cd8
and edi, 0xfffffff7
mov dword [rsp + 0x84], edi
lea rcx, [rsp + 0x1380]
call fcn.14000c080
lea rdx, str.sub_edition
lea rcx, [rsp + 0x1170]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc70], xmm0
lea rdx, [rsp + 0xc70]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x140036d46
lea rdx, str.sub_edition
lea rcx, [rsp + 0x1180]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc60], xmm0
lea rdx, [rsp + 0xc60]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
jmp 0x140036d4e
lea rax, [rsp + 0x19c0]
mov rdx, rax
lea rcx, [rsp + 0x19c0]
call fcn.140025b30
lea rdx, str.ifeo
lea rcx, [rsp + 0x1190]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc50], xmm0
lea rdx, [rsp + 0xc50]
lea rcx, [rsp + 0x1850]
call fcn.140031220
mov byte [rsp + 0xa1], al
lea rcx, [rsp + 0x20b0]
call fcn.14004d590
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x18b0]
lea rdx, [rsp + 0x1c60]
lea rcx, [rsp + 0x1c40]
call fcn.14004d3a0
movzx ebx, al
mov byte [rsp + 0xa2], al
test al, al
je 0x140036dfb
lea rcx, [rsp + 0x21b0]
call fcn.14000c030
mov rdx, rax
lea rcx, [rsp + 0x2380]
call fcn.14003d950
cmp word [rsp + 0x2380], 0
jne 0x140036f2a
lea rdx, [0x14014b0a0]
lea rcx, [rsp + 0x11a0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc40], xmm0
lea rdx, [rsp + 0xc40]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x140036ecd
lea rdx, [0x14014b0a0]
lea rcx, [rsp + 0x11b0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc30], xmm0
lea rdx, [rsp + 0xc30]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
cmp qword [rax + 0x10], 0x24
jne 0x140036ecd
lea rdx, [0x14014b0a0]
lea rcx, [rsp + 0x11c0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc20], xmm0
lea rdx, [rsp + 0xc20]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
call fcn.14000c030
mov rdx, rax
lea rcx, [rsp + 0x2380]
call fcn.14003d950
cmp word [rsp + 0x2380], 0
jne 0x140036f2a
lea rcx, [rsp + 0x11d0]
call fcn.1400a7830
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xc10], xmm0
lea rdx, [rsp + 0xc10]
lea rcx, [rsp + 0x13a0]
call fcn.140029b20
mov rcx, rax
call fcn.14000c030
mov rdx, rax
lea rcx, [rsp + 0x2380]
call fcn.14003d950
lea rcx, [rsp + 0x13a0]
call fcn.14000c080
lea rcx, [rsp + 0x13c0]
call fcn.14002f4a0
mov rdx, rax
lea rcx, [rsp + 0x17d0]
call fcn.140025ba0
lea rcx, [rsp + 0x13c0]
call fcn.14000c080
lea rdx, [r13 + 0x28]
lea rcx, [rsp + 0x1c80]
call fcn.140025cc0
nop
lea rcx, [rsp + 0x17d0]
call fcn.14000c030
mov r8, rax
lea rdx, str._TMPPATH_
lea rcx, [rsp + 0x1c80]
call fcn.14002fe00
lea rcx, [rsp + 0x1c80]
call fcn.14000c030
mov rdx, rax
xor r8d, r8d
lea rcx, [rsp + 0x1850]
call fcn.14003c230
lea rdx, [0x140149388]
lea rcx, [rsp + 0x11e0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc00], xmm0
lea rdx, [rsp + 0xc00]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x14003702d
lea rdx, [0x140149388]
lea rcx, [rsp + 0x11f0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xbf0], xmm0
lea rdx, [rsp + 0xbf0]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
call fcn.14000c030
mov rcx, rax
call fcn.1400d5138
mov dword [rsp + 0xb0], eax
lea rdx, str.sub_edition
lea rcx, [rsp + 0x1200]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xb60], xmm0
lea rdx, [rsp + 0xb60]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x1400370b1
lea rdx, str.sub_edition
lea rcx, [rsp + 0x1210]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xb50], xmm0
lea rdx, [rsp + 0xb50]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
call fcn.14000c030
mov rdx, rax
lea rcx, [rsp + 0x19c0]
call fcn.14000bfa0
lea rdx, [0x140149398]
lea rcx, [rsp + 0x1220]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xb40], xmm0
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x14003714a
lea rdx, [0x140149398]
lea rcx, [rsp + 0x1230]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xb20], xmm0
lea rdx, [rsp + 0xb20]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
lea rdx, [0x14014b140]
call fcn.140031aa0
mov ecx, dword [rsp + 0x98]
movzx ecx, cl
test al, al
cmovne ecx, r15d
mov dword [rsp + 0x98], ecx
mov byte [rsp + 0x89], cl
lea rdx, [0x140149398]
lea rcx, [rsp + 0x1240]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xb10], xmm0
lea rdx, [rsp + 0xb10]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x1400371cf
lea rdx, [0x140149398]
lea rcx, [rsp + 0x1250]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xcf0], xmm0
lea rdx, [rsp + 0xcf0]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
cmp qword [rax + 0x10], 0
jne 0x1400371cf
mov byte [rsp + 0x8a], 1
cmp dword [rsp + 0xfc], 1
je 0x140037213
lea rdx, str.stub_mapping_guid
lea rcx, [rsp + 0x1260]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xb00], xmm0
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
lea rdx, [rsp + 0x1a60]
call fcn.140025b30
cmp byte [rsp + 0x98], 0
je 0x14003726e
lea rdx, str.LogsClear.log
lea rcx, [rsp + 0x8b8]
call fcn.14000ca20
movups xmm6, xmmword [rax]
call fcn.14004a130
movaps xmmword [rsp + 0x280], xmm6
lea rdx, [rsp + 0x8a8]
mov rcx, rax
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x260], xmm0
lea r8, [rsp + 0x280]
lea rdx, [rsp + 0x260]
jmp 0x1400372bd
lea rdx, str.LogsSetup.log
lea rcx, [rsp + 0x8a8]
call fcn.14000ca20
movups xmm6, xmmword [rax]
call fcn.14004a130
movaps xmmword [rsp + 0x260], xmm6
lea rdx, [rsp + 0x8b8]
mov rcx, rax
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x280], xmm0
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x1a00]
call fcn.14009e1b0
mov edx, 0x5c
lea rcx, [rsp + 0x1a00]
call fcn.14003c830
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x13e0]
lea rcx, [rsp + 0x1a00]
call fcn.14000f410
nop
xor edx, edx
mov rcx, rax
call fcn.14009dd20
nop
lea rcx, [rsp + 0x13e0]
call fcn.14000c080
lea rcx, [rsp + 0x1a00]
call fcn.14000c030
mov rcx, rax
mov r8d, esi
call fcn.140034200
mov esi, dword [rsp + 0x98]
test sil, sil
jne 0x14003767f
test bl, bl
jne 0x14003767f
cmp byte [rsp + 0x22f8], bl
jne 0x14003767f
lea rcx, [rsp + 0x1ad8]
call fcn.14000c050
nop
call fcn.140068c00
lea rdx, [rax + 0x50]
lea r8, [0x1401431c4]
lea rcx, [rsp + 0x1400]
call fcn.14000b9f0
mov rcx, rax
call fcn.14000c030
mov rcx, rax
call fcn.140030170
movzx ebx, al
lea rcx, [rsp + 0x1400]
call fcn.14000c080
call fcn.140068c00
lea rdx, [rax + 0x50]
test bl, bl
je 0x1400373db
lea r8, [0x1401431c4]
lea rcx, [rsp + 0x1420]
call fcn.14000b9f0
mov rdx, rax
lea rcx, [rsp + 0x1ad8]
call fcn.140025ba0
lea rcx, [rsp + 0x1420]
call fcn.14000c080
jmp 0x14003747d
lea r8, str.FsBlk
lea rcx, [rsp + 0x1440]
call fcn.14000b9f0
mov rcx, rax
call fcn.14000c030
mov rcx, rax
call fcn.140030170
movzx ebx, al
lea rcx, [rsp + 0x1440]
call fcn.14000c080
test bl, bl
je 0x14003744f
call fcn.140068c00
lea rdx, [rax + 0x50]
lea r8, str.FsBlk
lea rcx, [rsp + 0x1460]
call fcn.14000b9f0
mov rdx, rax
lea rcx, [rsp + 0x1ad8]
call fcn.140025ba0
lea rcx, [rsp + 0x1460]
call fcn.14000c080
jmp 0x14003747d
call fcn.140069ac0
mov rcx, rax
call fcn.14000c030
mov rcx, rax
call fcn.140030170
test al, al
je 0x14003747d
call fcn.140069ac0
mov rdx, rax
lea rcx, [rsp + 0x1ad8]
call fcn.140025b30
cmp qword [rsp + 0x1ae8], 0
je 0x140037672
call fcn.1400699b0
mov rdx, rax
lea rcx, [rsp + 0x1e30]
call fcn.140025cc0
nop
mov dword [rsp + 0x8c], 0xa003
cmp byte [rsp + 0x9c], 0
jne 0x1400375af
call fcn.140068c00
lea rdx, str.avgClear.exe
lea rcx, str.avastClear.exe
cmp dword [rax], 2
cmove rcx, rdx
mov qword [rsp + 0x17a0], rcx
lea rax, str.The_installer_has_detected_corrupted__installation_on_this_computer__service__is_running___thus_this_installer_cannot_continue._Use_the__utility_to_fix_the_problem_or_contact_our_support_team.
mov qword [rsp + 0x1820], rax
mov qword [rsp + 0x1828], 0xca
lea rax, [rsp + 0x17a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ad8]
lea r8, [rsp + 0x1e30]
lea rdx, [rsp + 0x1820]
lea rcx, [rsp + 0x1ba0]
call fcn.14003d980
nop
lea rax, str.Corrupted__detected.
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0x16
lea r8, [rsp + 0x1e30]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x1ab8]
call fcn.1400278f0
lea rcx, [rsp + 0x1ab8]
call fcn.14000c030
mov rbx, rax
lea rcx, [rsp + 0x1ba0]
call fcn.14000c030
mov r9d, 0x10
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x1ab8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1ba0]
call fcn.14000c080
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0x18f0], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0x18f8], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x18fc], rax
mov dword [rsp + 0x1904], 0x1d7
lea rax, str._was_not_detected_but_service__is_running._There_is_a_corrupted_installation__thus_this_installer_cannot_continue.
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 0x78
lea r9, [rsp + 0x1ad8]
lea r8, [rsp + 0x1e30]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x18f0]
call fcn.14003da90
nop
lea rcx, [rsp + 0x1e30]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1ad8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1c80]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1a60]
call fcn.14000c080
jmp 0x14003aeb4
lea rcx, [rsp + 0x1ad8]
call fcn.14000c080
mov r15, qword [rsp + 0x1840]
test r15, r15
jne 0x140037714
lea rdx, [0x14014b158]
lea rcx, [rsp + 0x1270]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xb30], xmm0
lea rdx, [rsp + 0xb30]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x140037714
lea rdx, [0x14014b158]
lea rcx, [rsp + 0x1280]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xce0], xmm0
lea rdx, [rsp + 0xce0]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rdx, rax
lea rcx, [rsp + 0x1830]
call fcn.140025b30
mov r15, qword [rsp + 0x1840]
cmp qword [rsp + 0x19d0], 0
je 0x140037763
lea rdx, str.sub_edition
lea rcx, [rsp + 0x1290]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xd00], xmm0
lea rdx, [rsp + 0xd00]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
lea rdx, [rsp + 0x19c0]
call fcn.140025b30
test r15, r15
jne 0x1400377ac
call fcn.14002f2f0
mov rbx, rax
xor ecx, ecx
call fcn.14002f390
mov rdx, rax
lea rcx, [rsp + 0x1480]
call fcn.14000bfe0
nop
or edi, 0x20
mov dword [rsp + 0x84], edi
mov r8, rbx
lea rdx, str._x64.exe
mov rcx, rax
call fcn.14003dbf0
test al, al
jne 0x1400377ac
mov bl, 1
jmp 0x1400377ae
xor bl, bl
test dil, 0x20
je 0x1400377cb
and edi, 0xffffffdf
mov dword [rsp + 0x84], edi
lea rcx, [rsp + 0x1480]
call fcn.14000c080
test bl, bl
je 0x140037a6e
lea rcx, [rsp + 0x1d78]
call fcn.14000ce30
lea rdx, [0x140143394]
lea rcx, [rsp + 0xe40]
call fcn.14000bfe0
nop
xor ecx, ecx
call fcn.14002f390
mov rdx, rax
lea rcx, [rsp + 0xe20]
call fcn.14000bfe0
nop
mov r9b, 1
lea r8, [rsp + 0xe40]
lea rdx, [rsp + 0xe20]
lea rcx, [rsp + 0x1d78]
call fcn.14000e2c0
nop
lea rcx, [rsp + 0xe20]
call fcn.14000c080
nop
lea rcx, [rsp + 0xe40]
call fcn.14000c080
mov rdx, qword [rsp + 0x1d80]
mov rax, rdx
sub rax, qword [rsp + 0x1d78]
sar rax, 5
cmp rax, 2
jb 0x140037a61
add rdx, 0xffffffffffffffe0
lea rcx, [rsp + 0x1dd8]
call fcn.140025cc0
nop
lea rcx, [rsp + 0x1dd8]
call fcn.14003c8a0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140037a53
mov r8, rax
lea rdx, [0x14014a79c]
lea rcx, [rsp + 0x1dd8]
call fcn.14000d350
cmp rax, 0xffffffffffffffff
jne 0x1400378d4
mov r8, rbx
lea rdx, [0x140149a9c]
lea rcx, [rsp + 0x1dd8]
call fcn.14000d350
cmp rax, 0xffffffffffffffff
je 0x140037a53
sub rax, rbx
lea r9, [rax - 1]
lea r8, [rbx + 1]
lea rdx, [rsp + 0x1ca0]
lea rcx, [rsp + 0x1dd8]
call fcn.14000f410
nop
cmp qword [rsp + 0x1cb0], 3
jne 0x140037a45
mov edx, 1
lea rcx, [rsp + 0x1ca0]
call fcn.140025b70
cmp word [rax], 0x30
jb 0x140037a45
mov edx, 1
lea rcx, [rsp + 0x1ca0]
call fcn.140025b70
cmp word [rax], 0x39
ja 0x140037a45
call fcn.140068c00
lea r8, [rsp + 0x1ca0]
cmp dword [rax], 2
jne 0x1400379a2
lea rdx, str.mmm_bav_ppc_999_
lea rcx, [rsp + 0x14c0]
call fcn.140026600
nop
lea r8, [0x14014a7a0]
mov rdx, rax
lea rcx, [rsp + 0x14a0]
call fcn.14000ba70
mov rdx, rax
lea rcx, [rsp + 0x1830]
call fcn.140025ba0
lea rcx, [rsp + 0x14a0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x14c0]
jmp 0x1400379f4
lea rdx, str.mmm_ava_ppc_999_
lea rcx, [rsp + 0x1500]
call fcn.140026600
nop
lea r8, [0x14014a7a0]
mov rdx, rax
lea rcx, [rsp + 0x14e0]
call fcn.14000ba70
mov rdx, rax
lea rcx, [rsp + 0x1830]
call fcn.140025ba0
lea rcx, [rsp + 0x14e0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1500]
call fcn.14000c080
lea rdx, [0x14014b158]
lea rcx, [rsp + 0x12a0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xdb0], xmm0
lea rdx, [rsp + 0xdb0]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
lea rdx, [rsp + 0x1830]
call fcn.140025b30
mov r15, qword [rsp + 0x1840]
lea rcx, [rsp + 0x1ca0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1dd8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1d78]
call fcn.14000d820
mov dword [rsp + 0xf4], r14d
lea rcx, [rsp + 0xf4]
call fcn.140091af0
lea rcx, [rsp + 0x1b58]
call fcn.14000c050
nop
cmp dword [rsp + 0xf4], 2
jl 0x140037ab4
lea rdx, str.Loading
lea rcx, [rsp + 0x1b58]
call fcn.14000bfa0
jmp 0x140037b5d
test sil, sil
je 0x140037aef
call fcn.1400699b0
mov rdx, rax
lea r8, str._Clear
lea rcx, [rsp + 0x1520]
call fcn.14000b9f0
mov rdx, rax
lea rcx, [rsp + 0x1b58]
call fcn.140025ba0
lea rcx, [rsp + 0x1520]
jmp 0x140037b58
mov ebx, dword [rsp + 0xb0]
mov ecx, ebx
call fcn.140034b10
test al, al
je 0x140037b27
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x409
cmp ax, cx
jne 0x140037b27
lea rdx, str.Setting_up_Avast_One_installation...
lea rcx, [rsp + 0x1b58]
call fcn.14000bfa0
jmp 0x140037b5d
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx r9d, ax
mov edx, ebx
lea rcx, [rsp + 0x1540]
call fcn.140034b30
mov rdx, rax
lea rcx, [rsp + 0x1b58]
call fcn.140025ba0
lea rcx, [rsp + 0x1540]
call fcn.14000c080
mov ecx, dword [rsp + 0xb0]
cmp ecx, 0xffffffff
jne 0x140037b86
mov ecx, dword [rsp + 0x22b4]
cmp ecx, 0xffffffff
jne 0x140037b86
call fcn.140068c00
mov r8d, r14d
cmp dword [rax], 2
sete r8b
jmp 0x140037bb2
cmp ecx, 0x13
jne 0x140037b93
mov r8d, 0x3eb
jmp 0x140037bb9
call fcn.140034b10
test al, al
je 0x140037ba4
mov r8d, 0x3ec
jmp 0x140037bb9
call fcn.1400263f0
mov r8d, r14d
test al, al
setne r8b
add r8d, 0x3e9
lea rcx, [rsp + 0x1fc0]
call fcn.14003b810
lea r9, [rsp + 0x1b58]
lea rcx, [rsp + 0x1fc0]
call fcn.140033230
nop
lea rdx, [rsp + 0x1be0]
lea rcx, [rsp + 0x1f00]
call fcn.140028460
lea rdx, [rsp + 0x1fc0]
lea rcx, [rsp + 0x1f00]
call fcn.140028460
cmp byte [rsp + 0x9c], 0
jne 0x140037c1d
lea rcx, [rsp + 0x1fc0]
call fcn.140033c20
test sil, sil
jne 0x1400386f9
call fcn.1400356d0
test al, al
je 0x140037ce9
lea rdx, [0x140149398]
lea rcx, [rsp + 0x12b0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xd20], xmm0
lea rdx, [rsp + 0xd20]
lea rcx, [rsp + 0x1850]
call fcn.140031220
test al, al
je 0x140037ce9
lea rdx, [0x140149398]
lea rcx, [rsp + 0x12c0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xd30], xmm0
lea rdx, [rsp + 0xd30]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
cmp qword [rax + 0x10], 0
jne 0x140037ce9
lea rdx, [0x140149398]
lea rcx, [rsp + 0x12d0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xd40], xmm0
lea rdx, [rsp + 0xd40]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
lea rdx, [0x14014b150]
call fcn.14000bfa0
cmp qword [rsp + 0x19f0], 0
je 0x140038314
lea rcx, [rsp + 0x19e0]
call fcn.14009d7e0
test al, al
je 0x140038295
lea rdx, str..edat
lea rcx, [rsp + 0xe60]
call fcn.14000bfe0
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0xe60]
lea rdx, [rsp + 0x19e0]
lea rcx, [rsp + 0x1e18]
call fcn.14009fad0
nop
lea rcx, [rsp + 0xe60]
call fcn.14000c080
mov rbx, qword [rsp + 0x1e18]
mov rsi, qword [rsp + 0x1e20]
cmp rbx, rsi
je 0x140038286
nop
lea rdx, [rsp + 0x16a0]
mov rcx, rbx
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xd50], xmm0
lea rdx, [rsp + 0xd50]
lea rcx, [rsp + 0x1a20]
call fcn.14009d8f0
nop
lea rdx, [rsp + 0x16b0]
mov rcx, rbx
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xd60], xmm0
lea rdx, [rsp + 0xd60]
lea rcx, [rsp + 0x1b18]
call fcn.14009d820
nop
call fcn.14002f2f0
mov r9, rax
lea rdx, str.elic
lea rcx, [rsp + 0x16c0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xd70], xmm0
lea rdx, [rsp + 0x16d0]
lea rcx, [rsp + 0x1a20]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xd80], xmm0
mov r8, r12
lea rdx, [rsp + 0xd70]
lea rcx, [rsp + 0xd80]
call fcn.14002f350
test eax, eax
jne 0x140037e41
lea rdx, str.license.avastlic
jmp 0x140038064
call fcn.14002f2f0
mov r9, rax
lea rdx, str.ebcf
lea rcx, [rsp + 0x16e0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xdf0], xmm0
lea rdx, [rsp + 0x16f0]
lea rcx, [rsp + 0x1a20]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x930], xmm0
mov r8, r12
lea rdx, [rsp + 0xdf0]
lea rcx, [rsp + 0x930]
call fcn.14002f350
test eax, eax
jne 0x140037eb0
lea rdx, str.bcc.cfg.tmp
jmp 0x140038064
call fcn.14002f2f0
mov r9, rax
lea rdx, str.ebpk
lea rcx, [rsp + 0xf90]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x940], xmm0
lea rdx, [rsp + 0xfa0]
lea rcx, [rsp + 0x1a20]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x950], xmm0
mov r8, r12
lea rdx, [rsp + 0x940]
lea rcx, [rsp + 0x950]
call fcn.14002f350
test eax, eax
jne 0x140037f1f
lea rdx, str.bcpub.key.tmp
jmp 0x140038064
call fcn.14002f2f0
mov r9, rax
lea rdx, str.erid
lea rcx, [rsp + 0xfb0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x960], xmm0
lea rdx, [rsp + 0xfc0]
lea rcx, [rsp + 0x1a20]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x970], xmm0
mov r8, r12
lea rdx, [rsp + 0x960]
lea rcx, [rsp + 0x970]
call fcn.14002f350
test eax, eax
jne 0x140037f8e
lea rdx, str.rid.bin
jmp 0x140038064
call fcn.14002f2f0
mov r9, rax
lea rdx, str.ecoo
lea rcx, [rsp + 0xfd0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x980], xmm0
lea rdx, [rsp + 0xfe0]
lea rcx, [rsp + 0x1a20]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x990], xmm0
mov r8, r12
lea rdx, [rsp + 0x980]
lea rcx, [rsp + 0x990]
call fcn.14002f350
test eax, eax
jne 0x140037ffa
lea rdx, str.cookie.bin
jmp 0x140038064
call fcn.14002f2f0
mov r9, rax
lea rdx, str.eapt
lea rcx, [rsp + 0xff0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x9a0], xmm0
lea rdx, [rsp + 0x1000]
lea rcx, [rsp + 0x1a20]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x9b0], xmm0
mov r8, r12
lea rdx, [rsp + 0x9a0]
lea rcx, [rsp + 0x9b0]
call fcn.14002f350
test eax, eax
jne 0x140038071
lea rdx, str.pairing.bin
lea rcx, [rsp + 0x1b18]
call fcn.14000bfa0
lea rcx, [rsp + 0x1df8]
call fcn.14000c050
nop
lea rdx, [rsp + 0x1010]
lea rcx, [rsp + 0x1b18]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x9c0], xmm0
lea rdx, [rsp + 0x1020]
lea rcx, [rsp + 0x17d0]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x9d0], xmm0
lea r8, [rsp + 0x9c0]
lea rdx, [rsp + 0x9d0]
lea rcx, [rsp + 0x1df8]
call fcn.14009e1b0
lea rdx, [rsp + 0x1df8]
mov rcx, rbx
call fcn.14009f1d0
test al, al
je 0x14003817f
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0x3c0], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0x3c8], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x3cc], rax
mov dword [rsp + 0x3d4], 0x251
lea rax, str.Moved_extra_data_file_.edat_to_.
mov qword [rsp + 0x540], rax
mov qword [rsp + 0x548], 0x28
lea r9, [rsp + 0x1df8]
lea r8, [rsp + 0x1a20]
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0x3c0]
call fcn.14003dd20
jmp 0x140038250
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x1560]
call fcn.140049130
nop
mov rcx, rax
call fcn.14000c030
mov qword [rsp + 0x240], rax
mov dword [rsp + 0x1820], 0x41333635
mov dword [rsp + 0x1824], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0x160], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0x168], eax
mov rax, qword [rsp + 0x1820]
mov qword [rsp + 0x16c], rax
mov dword [rsp + 0x174], 0x253
lea rax, str.Failed_to_move_extra_data_file__to__with_error__
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 0x3a
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1df8]
lea r8, [rsp + 0x1a20]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x160]
call fcn.14003dff0
nop
lea rcx, [rsp + 0x1560]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1df8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1b18]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1a20]
call fcn.14000c080
add rbx, 0x20
cmp rbx, rsi
jne 0x140037d70
lea rcx, [rsp + 0x1e18]
call fcn.14000d820
jmp 0x140038314
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0x160], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0x168], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x16c], rax
mov dword [rsp + 0x174], 0x257
lea rax, str.Unable_to_enumerate_extra_data_directory__
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 0x2e
lea r8, [rsp + 0x19e0]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x160]
call fcn.14003e2c0
nop
lea rdx, [rsp + 0x17d0]
mov rcx, r13
call fcn.14002bd60
nop
jmp 0x14003835b
lea rdx, str.cookie.bin
lea rcx, [rsp + 0x1030]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x9e0], xmm0
lea rdx, [rsp + 0x1040]
lea rcx, [rsp + 0x17d0]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x9f0], xmm0
lea r8, [rsp + 0x9e0]
lea rdx, [rsp + 0x9f0]
lea rcx, [rsp + 0x1800]
call fcn.14009e1b0
test r15, r15
jne 0x1400384ac
lea rcx, [rsp + 0x1800]
call fcn.14009d7a0
test al, al
je 0x1400384ac
lea rcx, [rsp + 0x1d60]
call fcn.14000ce30
lea rdx, [rsp + 0x1800]
lea rcx, [rsp + 0x1d60]
call fcn.14003e410
nop
mov r8, qword [rsp + 0x1d68]
mov rdx, qword [rsp + 0x1d60]
sub r8, rdx
lea rcx, [rsp + 0x15a0]
call fcn.140040f50
nop
mov r8d, 0xfde9
mov rdx, rax
lea rcx, [rsp + 0x1580]
call fcn.140026bb0
mov rdx, rax
lea rcx, [rsp + 0x1830]
call fcn.140025ba0
lea rcx, [rsp + 0x1580]
call fcn.14000c080
nop
lea rcx, [rsp + 0x15a0]
call fcn.140026240
lea rdx, [0x14014b158]
lea rcx, [rsp + 0x1050]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xa00], xmm0
lea rdx, [rsp + 0xa00]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
lea rdx, [rsp + 0x1830]
call fcn.140025b30
nop
lea rcx, [rsp + 0x1d60]
call fcn.14000d9f0
lea rdx, [rsp + 0x1830]
lea rcx, [rsp + 0x15c0]
call fcn.140025cc0
mov rbx, rax
xor ecx, ecx
call fcn.14002f390
mov qword [rsp + 0x20], rbx
mov r9, rax
lea r8, [rsp + 0x1850]
lea rdx, [rsp + 0x2380]
lea rcx, [rsp + 0x15e0]
call fcn.140030230
lea rcx, [rsp + 0x15e0]
call fcn.14000c080
lea r15, str.licfile
mov r13d, 3
nop word [rax + rax]
mov rcx, qword [r15 - 8]
mov qword [rsp + 0x550], rcx
mov rax, r12
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140038520
mov qword [rsp + 0x558], rax
lea rax, [rsp + 0x17d0]
cmp qword [rsp + 0x17e8], 7
cmova rax, qword [rsp + 0x17d0]
mov qword [rsp + 0x560], rax
mov rax, qword [rsp + 0x17e0]
mov qword [rsp + 0x568], rax
movaps xmm0, xmmword [rsp + 0x550]
movdqa xmmword [rsp + 0xa10], xmm0
movaps xmm1, xmmword [rsp + 0x560]
movdqa xmmword [rsp + 0xa20], xmm1
lea r8, [rsp + 0xa10]
lea rdx, [rsp + 0xa20]
lea rcx, [rsp + 0x1800]
call fcn.14009e1b0
lea rcx, [rsp + 0x1800]
cmp qword [rsp + 0x1818], 7
cmova rcx, qword [rsp + 0x1800]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400386db
test al, 0x10
jne 0x1400386db
mov rsi, qword [r15]
mov qword [rsp + 0x570], rsi
mov rbx, r12
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400385e2
mov qword [rsp + 0x578], rbx
movaps xmm0, xmmword [rsp + 0x570]
movdqa xmmword [rsp + 0xa30], xmm0
lea rdx, [rsp + 0xa30]
lea rcx, [rsp + 0x1850]
call fcn.140031460
test rax, rax
jne 0x1400386a4
lea rax, [rsp + 0x490]
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x490], xmm0
mov qword [rsp + 0x4a0], r14
mov qword [rsp + 0x4a8], 7
mov word [rsp + 0x490], r14w
movups xmmword [rsp + 0x7b0], xmm0
mov qword [rsp + 0x7c0], r14
mov qword [rsp + 0x7c8], r14
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x7b0]
call fcn.14000c360
nop
lea r8, [rsp + 0x490]
lea rdx, [rsp + 0x7b0]
lea rcx, [rsp + 0x1850]
call fcn.14003c8e0
lea rcx, [rsp + 0x1800]
cmp rax, rcx
je 0x1400386db
lea rdx, [rsp + 0x1800]
cmp qword [rsp + 0x1818], 7
cmova rdx, qword [rsp + 0x1800]
mov r8, qword [rsp + 0x1810]
mov rcx, rax
call fcn.14000be50
add r15, 0x10
sub r13, 1
jne 0x140038510
mov r15, qword [rsp + 0x1840]
mov r13, qword [rsp + 0x17f0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x7f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x800], xmm1
mov r8d, 0xf
lea rdx, str.servers.def.vpx
lea rcx, [rsp + 0x7f0]
call fcn.14000c360
nop
lea r8, [rsp + 0x7f0]
lea rdx, [rsp + 0x17d0]
mov rcx, r13
call fcn.14002cf40
nop
lea rcx, [rsp + 0x7f0]
call fcn.14000c080
nop
jmp 0x140038788
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1cc0], xmm0
movups xmmword [rsp + 0x1cd0], xmm0
movups xmmword [rsp + 0x1ce0], xmm0
movups xmmword [rsp + 0x1cf0], xmm0
movups xmmword [rsp + 0x1d00], xmm0
movups xmmword [rsp + 0x1d10], xmm0
movups xmmword [rsp + 0x1d20], xmm0
movups xmmword [rsp + 0x1d30], xmm0
movups xmmword [rsp + 0x1d40], xmm0
mov qword [rsp + 0x1d50], rax
movabs r13, 0x7ffffffffffffffe
mov rax, r13
mov rcx, qword [rsp + 0x17e0]
sub rax, rcx
cmp rax, 0xc
jb 0x14003b336
lea r9, [rsp + 0x17d0]
cmp qword [rsp + 0x17e8], 7
cmova r9, qword [rsp + 0x17d0]
mov qword [rsp + 0x30], 0xc
lea rax, str._servers.def
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0xe80]
call fcn.14000bae0
bts edi, 0x13
mov dword [rsp + 0x84], edi
lea rdx, [rsp + 0xe80]
lea rcx, [rsp + 0x1cc0]
call fcn.1400342d0
nop
lea rax, [rsp + 0x178]
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x178], xmm0
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], r14
lea rsi, [rsp + 0x1830]
cmp qword [rsp + 0x1848], 7
cmova rsi, qword [rsp + 0x1830]
cmp r15, r13
ja 0x14003b33c
mov qword [rsp + 0x190], 7
cmp r15, 7
ja 0x1400388d6
mov qword [rsp + 0x188], r15
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x178], xmm0
jmp 0x140038927
mov rbx, r15
or rbx, 7
cmp rbx, r13
jbe 0x140038c3e
mov rbx, r13
movabs rcx, 0x7fffffffffffffff
add rcx, rcx
call fcn.14000c180
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], rbx
lea r8, [r15*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1400fe670
nop
lea rax, [rsp + 0x1600]
mov qword [rsp + 0x17a0], rax
lea rdx, [rsp + 0x1908]
lea rcx, [rsp + 0x1600]
call fcn.140025cc0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x4b0], xmm0
mov qword [rsp + 0x4c0], r14
mov qword [rsp + 0x4c8], r14
lea rax, [rsp + 0x2380]
mov r8, r12
inc r8
cmp word [rax + r8*2], 0
jne 0x140038975
lea rdx, [rsp + 0x2380]
lea rcx, [rsp + 0x4b0]
call fcn.14000c360
nop
lea rax, [rsp + 0x178]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [rsp + 0x4b0]
lea rdx, [rsp + 0x1850]
lea rcx, [rsp + 0x1cc0]
call fcn.140042150
xorps xmm0, xmm0
movups xmmword [rsp + 0x4d0], xmm0
mov qword [rsp + 0x4e0], r14
mov qword [rsp + 0x4e8], r14
mov r8d, 4
lea rdx, str.stub
lea rcx, [rsp + 0x4d0]
call fcn.14000c360
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x1cc0]
call fcn.1400426d0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x1980], xmm0
mov qword [rsp + 0x1990], r14
mov qword [rsp + 0x1998], r14
mov r8, r12
lea rax, [0x14017fcf0]
inc r8
cmp word [rax + r8*2], 0
jne 0x140038a33
mov rdx, rax
lea rcx, [rsp + 0x1980]
call fcn.14000c360
nop
lea rdx, [rsp + 0x1980]
lea rcx, [rsp + 0xa8]
call fcn.14009f450
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c08], xmm0
mov byte [rsp + 0x1c38], 0
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x1bf0], al
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x1c08], eax
lea rax, [rsp + 0x2380]
mov qword [rsp + 0x1bf8], rax
lea rcx, [rsp + 0x2380]
mov rax, r12
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140038ab0
mov qword [rsp + 0x1c00], rax
movzx eax, word [rsp + 0xa4]
mov dword [rsp + 0x1c10], eax
mov rbx, qword [rsp + 0xa8]
movzx edx, word [rsp + 0xaa]
movzx r13d, word [rsp + 0xac]
test bx, bx
jne 0x140038b04
test dx, dx
jne 0x140038b04
test r13w, r13w
jne 0x140038b04
cmp word [rsp + 0xae], bx
je 0x140038b23
movzx eax, bl
shl ax, 8
movzx ecx, ax
movzx eax, dl
or ecx, eax
shl ecx, 0x10
movzx eax, r13w
or ecx, eax
mov dword [rsp + 0x1c0c], ecx
lea rdx, [rsp + 0x1830]
lea rcx, [rsp + 0x1c18]
call fcn.140025cc0
mov byte [rsp + 0x1c38], 1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1b78], xmm0
movups xmmword [rsp + 0x1b88], xmm0
mov qword [rsp + 0x1b98], rax
xor edx, edx
lea rcx, [rsp + 0x1b78]
call fcn.1400ac440
nop
mov edx, 7
lea rcx, [rsp + 0x1750]
call fcn.1400ac440
mov rdx, rax
lea rcx, [rsp + 0x1b78]
call fcn.1400ac8b0
lea rcx, [rsp + 0x1750]
call fcn.1400ac760
nop
lea rdx, [rsp + 0x1908]
cmp qword [rsp + 0x1920], 7
cmova rdx, qword [rsp + 0x1908]
mov dword [rsp + 0x20], 0xfde9
mov r8, qword [rsp + 0x1918]
lea rcx, [rsp + 0x388]
call fcn.14000c4d0
bts edi, 0x10
mov dword [rsp + 0x84], edi
mov rax, qword [rsp + 0x398]
mov esi, 0x12c
lea rdx, [rsp + 0x388]
lea rcx, [rsp + 0x4f0]
cmp rax, rsi
jbe 0x140038c66
xorps xmm0, xmm0
movups xmmword [rsp + 0x4f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x500], xmm1
mov r8d, esi
cmovb r8, rax
cmp qword [rsp + 0x3a0], 0xf
cmova rdx, qword [rsp + 0x388]
call fcn.140025e80
or edi, 0x60000
jmp 0x140038c6f
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14003b342
jmp 0x1400388f3
call fcn.140027c60
bts edi, 0x11
bts edi, 0xf
mov dword [rsp + 0x84], edi
lea rcx, [rsp + 0x388]
call fcn.140026240
nop
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0xf18]
call fcn.1400ac2a0
nop
lea rdx, str.session_id
lea rcx, [rsp + 0x1b78]
call fcn.1400ac9e0
lea rdx, [rsp + 0xf18]
mov rcx, rax
call fcn.1400ac8b0
nop
lea rcx, [rsp + 0xf18]
call fcn.1400ac760
nop
lea rcx, [rsp + 0x4f0]
call fcn.140026240
lea rax, [rsp + 0x1980]
cmp qword [rsp + 0x1998], 7
cmova rax, qword [rsp + 0x1980]
mov qword [rsp + 0x17a0], rax
mov qword [rsp + 0x580], rax
mov r15, qword [rsp + 0x1990]
mov qword [rsp + 0x588], r15
mov qword [rsp + 0x20], 2
lea r9, [0x14014ea0c]
mov rdx, r15
mov rcx, rax
call fcn.140064f00
cmp rax, 0xffffffffffffffff
je 0x140038d72
lea rdx, [rax + 1]
cmp r15, rdx
jb 0x14003b348
sub r15, rdx
mov rcx, r12
cmp r15, 0xffffffffffffffff
cmovb rcx, r15
mov rax, qword [rsp + 0x17a0]
lea rax, [rax + rdx*2]
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], rcx
jmp 0x140038d83
movaps xmm0, xmmword [rsp + 0x580]
movdqa xmmword [rsp + 0x1d0], xmm0
lea rdx, [rsp + 0x1d0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x2e8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2f8], xmm1
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x2e8]
call fcn.14000c360
bts edi, 0xe
mov dword [rsp + 0x84], edi
lea rdx, [rsp + 0x2e8]
cmp qword [rsp + 0x300], 7
cmova rdx, qword [rsp + 0x2e8]
mov dword [rsp + 0x20], 0xfde9
mov r8, qword [rsp + 0x2f8]
lea rcx, [rsp + 0x368]
call fcn.14000c4d0
bts edi, 0xb
mov dword [rsp + 0x84], edi
mov rax, qword [rsp + 0x378]
lea rdx, [rsp + 0x368]
lea rcx, [rsp + 0x510]
cmp rax, rsi
jbe 0x140038e5d
xorps xmm0, xmm0
movups xmmword [rsp + 0x510], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x520], xmm1
mov r8, rsi
cmovb r8, rax
cmp qword [rsp + 0x380], 0xf
cmova rdx, qword [rsp + 0x368]
call fcn.140025e80
or edi, 0x3000
jmp 0x140038e66
call fcn.140027c60
bts edi, 0xc
bts edi, 0xa
mov dword [rsp + 0x84], edi
lea rcx, [rsp + 0x368]
call fcn.140026240
nop
lea rdx, [rsp + 0x510]
lea rcx, [rsp + 0xf40]
call fcn.1400ac2a0
nop
lea rdx, str.sfx_name
lea rcx, [rsp + 0x1b78]
call fcn.1400ac9e0
lea rdx, [rsp + 0xf40]
mov rcx, rax
call fcn.1400ac8b0
nop
lea rcx, [rsp + 0xf40]
call fcn.1400ac760
nop
lea rcx, [rsp + 0x510]
call fcn.140026240
nop
lea rcx, [rsp + 0x2e8]
call fcn.14000c080
movzx ecx, word [rsp + 0xaa]
test bx, bx
jne 0x140038f0a
test cx, cx
jne 0x140038f0a
test r13w, r13w
jne 0x140038f0a
cmp word [rsp + 0xae], r13w
jne 0x140038f0a
xor al, al
jmp 0x140038f0c
mov al, 1
test al, al
je 0x140039177
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a40], xmm0
mov qword [rsp + 0x1a50], r14
mov qword [rsp + 0x1a58], 7
mov word [rsp + 0x1a40], r14w
lea rax, [0x140149600]
mov qword [rsp + 0x1960], rax
mov qword [rsp + 0x1968], 0xb
movzx eax, bx
mov dword [rsp + 0x790], eax
movabs rax, 0x2000000000000000
mov qword [rsp + 0x770], rax
movzx eax, cx
mov dword [rsp + 0x794], eax
movabs rax, 0x2000000000000004
mov qword [rsp + 0x778], rax
movzx eax, r13w
mov dword [rsp + 0x798], eax
movabs rax, 0x2000000000000008
mov qword [rsp + 0x780], rax
movzx eax, word [rsp + 0xae]
mov dword [rsp + 0x79c], eax
movabs rax, 0x200000000000000c
mov qword [rsp + 0x788], rax
mov qword [rsp + 0x590], 4
lea rax, [rsp + 0x770]
mov qword [rsp + 0x598], rax
movaps xmm0, xmmword [rsp + 0x590]
movdqa xmmword [rsp + 0xa40], xmm0
movaps xmm1, xmmword [rsp + 0x1960]
movdqa xmmword [rsp + 0xa50], xmm1
lea r8, [rsp + 0xa40]
lea rdx, [rsp + 0xa50]
lea rcx, [rsp + 0xea0]
call fcn.14000f490
bts edi, 0x19
mov dword [rsp + 0x84], edi
lea rdx, [rsp + 0xea0]
lea rcx, [rsp + 0x1a40]
call fcn.140025ba0
lea rcx, [rsp + 0xea0]
call fcn.14000c080
lea rdx, [rsp + 0x1a40]
cmp qword [rsp + 0x1a58], 7
cmova rdx, qword [rsp + 0x1a40]
mov dword [rsp + 0x20], 0xfde9
mov r8, qword [rsp + 0x1a50]
lea rcx, [rsp + 0x348]
call fcn.14000c4d0
bts edi, 0x16
mov dword [rsp + 0x84], edi
mov rax, qword [rsp + 0x358]
lea rdx, [rsp + 0x348]
lea rcx, [rsp + 0x6d0]
cmp rax, rsi
jbe 0x1400390f1
xorps xmm0, xmm0
movups xmmword [rsp + 0x6d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x6e0], xmm1
cmovb rsi, rax
cmp qword [rsp + 0x360], 0xf
cmova rdx, qword [rsp + 0x348]
mov r8, rsi
call fcn.140025e80
or edi, 0x1800000
jmp 0x1400390fa
call fcn.140027c60
bts edi, 0x17
bts edi, 0x15
mov dword [rsp + 0x84], edi
lea rcx, [rsp + 0x348]
call fcn.140026240
nop
lea rdx, [rsp + 0x6d0]
lea rcx, [rsp + 0xf68]
call fcn.1400ac2a0
nop
lea rdx, str.sfx_version
lea rcx, [rsp + 0x1b78]
call fcn.1400ac9e0
lea rdx, [rsp + 0xf68]
mov rcx, rax
call fcn.1400ac8b0
nop
lea rcx, [rsp + 0xf68]
call fcn.1400ac760
nop
lea rcx, [rsp + 0x6d0]
call fcn.140026240
nop
lea rcx, [rsp + 0x1a40]
call fcn.14000c080
lea rcx, [rsp + 0x1980]
cmp qword [rsp + 0x1998], 7
cmova rcx, qword [rsp + 0x1980]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x1820], rax
cmp rax, 0xffffffffffffffff
je 0x14003922c
mov qword [rsp + 0x17a0], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x17a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x14003922c
mov rcx, qword [rsp + 0x17a0]
call fcn.140034ac0
mov rdx, rax
lea rcx, [rsp + 0x1620]
call fcn.140040db0
nop
mov r8, rax
lea rdx, str.sfx_created
lea rcx, [rsp + 0x1b78]
call fcn.1400350c0
nop
lea rcx, [rsp + 0x1620]
call fcn.14000c080
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1d90], xmm0
movups xmmword [rsp + 0x1da0], xmm0
mov qword [rsp + 0x1db0], rax
xor edx, edx
lea rcx, [rsp + 0x1d90]
call fcn.1400ac440
nop
mov edx, 7
lea rcx, [rsp + 0x1728]
call fcn.1400ac440
mov rdx, rax
lea rcx, [rsp + 0x1d90]
call fcn.1400ac8b0
lea rcx, [rsp + 0x1728]
call fcn.1400ac760
nop
lea rdx, str.instup
lea rcx, [rsp + 0x1d90]
call fcn.1400ac9e0
lea rdx, [rsp + 0x1b78]
mov rcx, rax
call fcn.1400ac8d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1e70], xmm0
movups xmmword [rsp + 0x1e80], xmm0
movups xmmword [rsp + 0x1e90], xmm0
movups xmmword [rsp + 0x1ea0], xmm0
movups xmmword [rsp + 0x1eb0], xmm0
movups xmmword [rsp + 0x1ec0], xmm0
movups xmmword [rsp + 0x1ed0], xmm0
movups xmmword [rsp + 0x1ee0], xmm0
movups xmmword [rsp + 0x1ef0], xmm0
lea rax, [rsp + 0x850]
mov qword [rsp + 0xe0], rax
movzx eax, byte [rsp + 0x1bf0]
mov byte [rsp + 0x850], al
movups xmm0, xmmword [rsp + 0x1bf8]
movups xmmword [rsp + 0x858], xmm0
mov eax, dword [rsp + 0x1c08]
mov dword [rsp + 0x868], eax
mov eax, dword [rsp + 0x1c0c]
mov dword [rsp + 0x86c], eax
mov eax, dword [rsp + 0x1c10]
mov dword [rsp + 0x870], eax
lea rax, [rsp + 0x878]
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x898], 0
cmp byte [rsp + 0x1c38], 0
je 0x14003938d
lea rdx, [rsp + 0x1c18]
lea rcx, [rsp + 0x878]
call fcn.140025cc0
mov byte [rsp + 0x898], 1
call fcn.140068c00
mov eax, dword [rax]
sub eax, 1
je 0x1400393d1
sub eax, 1
je 0x1400393c6
sub eax, 3
je 0x1400393b9
cmp eax, 1
jne 0x14003b34e
mov edx, 0x258
mov r15d, 1
jmp 0x1400393da
mov edx, 0x1f4
mov r15d, 1
jmp 0x1400393da
mov edx, 0x40
lea r15d, [rdx - 0x3f]
jmp 0x1400393da
mov r15d, 1
mov edx, r15d
lea r8, [rsp + 0x850]
lea rcx, [rsp + 0x1e70]
call fcn.1400351f0
nop
lea r8, [rsp + 0x1d90]
lea rcx, [rsp + 0x1e70]
call fcn.140043f20
nop
lea rcx, [rsp + 0x1ee0]
call fcn.14000c080
cmp byte [rsp + 0x1ed8], 0
je 0x14003942a
lea rcx, [rsp + 0x1eb8]
call fcn.14000c080
mov rcx, qword [rsp + 0x1e80]
test rcx, rcx
je 0x140039447
mov rax, qword [rcx]
mov edx, r15d
mov rax, qword [rax]
call qword [case.0x1400a96cf.0]
nop
lea rcx, [rsp + 0x1d90]
call fcn.1400ac760
nop
cmp rbx, 0xffffffffffffffff
je 0x140039465
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1b78]
call fcn.1400ac760
nop
cmp byte [rsp + 0x1c38], 0
je 0x14003948b
lea rcx, [rsp + 0x1c18]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1980]
call fcn.14000c080
nop
mov ebx, dword [rsp + 0x98]
jmp 0x1400394d2
mov eax, 0xfd4
mov ecx, 0xcd4
cmp byte [rsp + 0xa0], 0
cmove eax, ecx
mov r9d, eax
cmp byte [rsp + 0x8a], 0
je 0x140039503
cmp dword [rsp + 0x100], 1
jne 0x140039503
bts r9d, 8
lea r8, [rsp + 0x1f00]
lea rdx, [rsp + 0x17d0]
mov rcx, qword [rsp + 0x17f0]
call fcn.14002cba0
nop
cmp byte [rsp + 0xa1], 0
jne 0x1400396fe
xorps xmm0, xmm0
movups xmmword [rsp + 0x810], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x820], xmm1
mov r8d, 0x4a
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea rcx, [rsp + 0x810]
call fcn.14000c360
nop
lea rsi, str.instup.exe
mov r8, r12
nop dword [rax + rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x140039570
mov rdx, rsi
lea rcx, [rsp + 0x810]
call fcn.14000bdb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2d8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x2c8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x2d8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
bts edi, 0x1a
lea rdx, [rsp + 0x2c8]
cmp qword [rsp + 0x2e0], 7
cmova rdx, qword [rsp + 0x2c8]
mov rcx, 0xffffffff80000002
mov r8d, 0x200
call fcn.1400a1cc0
nop
lea rcx, [rsp + 0x2c8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x810]
call fcn.14000c080
xorps xmm0, xmm0
movups xmmword [rsp + 0x1ba0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1bb0], xmm1
mov r8d, 0x4a
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea rcx, [rsp + 0x1ba0]
call fcn.14000c360
nop
mov r8, r12
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x140039650
mov rdx, rsi
lea rcx, [rsp + 0x1ba0]
call fcn.14000bdb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2a8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2b8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x2a8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x2b8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
bts edi, 0x14
mov dword [rsp + 0x84], edi
lea rdx, [rsp + 0x2a8]
cmp qword [rsp + 0x2c0], 7
cmova rdx, qword [rsp + 0x2a8]
mov rcx, 0xffffffff80000002
mov r8d, 0x100
call fcn.1400a1cc0
nop
lea rcx, [rsp + 0x2a8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1ba0]
call fcn.14000c080
jmp 0x140039705
lea rsi, str.instup.exe
mov qword [rsp + 0x5a0], rsi
mov rax, r12
inc rax
cmp word [rsi + rax*2], 0
jne 0x140039710
mov qword [rsp + 0x5a8], rax
lea rax, [rsp + 0x17d0]
cmp qword [rsp + 0x17e8], 7
cmova rax, qword [rsp + 0x17d0]
mov qword [rsp + 0x5b0], rax
mov rax, qword [rsp + 0x17e0]
mov qword [rsp + 0x5b8], rax
movaps xmm0, xmmword [rsp + 0x5a0]
movdqa xmmword [rsp + 0xa60], xmm0
movaps xmm1, xmmword [rsp + 0x5b0]
movdqa xmmword [rsp + 0xa70], xmm1
lea r8, [rsp + 0xa60]
lea rdx, [rsp + 0xa70]
lea rcx, [rsp + 0x18d0]
call fcn.14009e1b0
cmp byte [rsp + 0xa2], 0
je 0x14003a49e
test bl, bl
jne 0x1400397c9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, dword [rsp + 0xb0]
call fcn.1400263d0
movzx ecx, al
xor ecx, 1
inc ecx
mov r8d, r15d
call fcn.1400348e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1928], xmm0
mov qword [rsp + 0x1938], r14
mov qword [rsp + 0x1940], 7
mov word [rsp + 0x1928], r14w
lea r13, [fcn.14000c0f0]
mov qword [rsp + 0x20], r13
lea r9, [fcn.14000c050]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rsp + 0x2340]
call fcn.1400b8fb8
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a98], xmm0
movdqa xmm1, xmmword [0x140156bb0]
movdqu xmmword [rsp + 0x1aa8], xmm1
mov word [rsp + 0x1a98], r14w
mov qword [rsp + 0x5c0], rsi
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140039850
mov qword [rsp + 0x5c8], rax
lea rax, [rsp + 0x17d0]
cmp qword [rsp + 0x17e8], 7
cmova rax, qword [rsp + 0x17d0]
mov qword [rsp + 0x5d0], rax
mov rax, qword [rsp + 0x17e0]
mov qword [rsp + 0x5d8], rax
movaps xmm0, xmmword [rsp + 0x5c0]
movdqa xmmword [rsp + 0xa80], xmm0
movaps xmm1, xmmword [rsp + 0x5d0]
movdqa xmmword [rsp + 0xa90], xmm1
lea r8, [rsp + 0xa80]
lea rdx, [rsp + 0xa90]
lea rcx, [rsp + 0x2340]
call fcn.14009e1b0
lea rcx, str.Instup.dll
mov qword [rsp + 0x5e0], rcx
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400398e5
mov qword [rsp + 0x5e8], rax
lea rax, [rsp + 0x17d0]
cmp qword [rsp + 0x17e8], 7
cmova rax, qword [rsp + 0x17d0]
mov qword [rsp + 0x5f0], rax
mov rax, qword [rsp + 0x17e0]
mov qword [rsp + 0x5f8], rax
movaps xmm0, xmmword [rsp + 0x5e0]
movdqa xmmword [rsp + 0xaa0], xmm0
movaps xmm1, xmmword [rsp + 0x5f0]
movdqa xmmword [rsp + 0xab0], xmm1
lea r8, [rsp + 0xaa0]
lea rdx, [rsp + 0xab0]
lea rcx, [rsp + 0x2360]
call fcn.14009e1b0
mov qword [rsp + 0x600], rsi
mov rax, r12
inc rax
cmp word [rsi + rax*2], 0
jne 0x140039973
mov qword [rsp + 0x608], rax
lea rax, [rsp + 0x18b0]
cmp qword [rsp + 0x18c8], 7
cmova rax, qword [rsp + 0x18b0]
mov qword [rsp + 0x610], rax
mov rax, qword [rsp + 0x18c0]
mov qword [rsp + 0x618], rax
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0xac0], xmm0
movaps xmm1, xmmword [rsp + 0x610]
movdqa xmmword [rsp + 0xad0], xmm1
lea r8, [rsp + 0xac0]
lea rdx, [rsp + 0xad0]
lea rcx, [rsp + 0x1928]
call fcn.14009e1b0
lea rcx, [rsp + 0x1928]
cmp qword [rsp + 0x1940], 7
cmova rcx, qword [rsp + 0x1928]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140039cc4
test al, 0x10
jne 0x140039cc4
cmp dword [rsp + 0xf8], 0x7cb
jbe 0x140039cc4
mov edi, r14d
nop dword [rax + rax]
cmp dword [rsp + 0x8c], 0
jne 0x140039c72
cmp dword [rsp + 0x94], 0
jne 0x140039c72
lea rcx, [rsp + 0x2050]
call fcn.14003b690
lea rcx, [rsp + 0x2050]
call fcn.14003b3c0
nop
lea rdx, str.copy_sfx
lea rcx, [rsp + 0x1f0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1c0], xmm0
movsxd rax, edi
shl rax, 5
lea rbx, [rsp + 0x2340]
add rbx, rax
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x2050]
call fcn.14003c770
mov rcx, rax
mov rdx, rbx
call fcn.140025b30
lea rdx, str.wait
lea rcx, [rsp + 0x250]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1e0], xmm0
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2050]
call fcn.14003c770
mov rcx, rax
lea rdx, [0x1401433a0]
call fcn.14000bfa0
lea rdx, [rsp + 0x1ab8]
lea rcx, [rsp + 0x2050]
call fcn.14003bf90
nop
mov rcx, rax
call fcn.14000c030
mov rbx, rax
lea rcx, [rsp + 0x1928]
call fcn.14000c030
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rsp + 0x94]
mov rdx, rbx
mov rcx, rax
call fcn.14002f850
mov ebx, eax
mov dword [rsp + 0x8c], eax
lea rcx, [rsp + 0x1ab8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x2050]
call fcn.14003b650
inc edi
cmp edi, 2
jb 0x140039a40
test ebx, ebx
jne 0x140039c72
cmp dword [rsp + 0x94], ebx
jne 0x140039c72
lea rdx, [0x14014b1f0]
lea rcx, [rsp + 0x480]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x230], xmm0
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x18b0]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x220], xmm0
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x1a98]
call fcn.14009e1b0
mov rdx, rsi
lea rcx, [rsp + 0x7e0]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x210], xmm0
lea rdx, [rsp + 0x7d0]
lea rcx, [rsp + 0x1a98]
call fcn.14000d460
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x200], xmm0
lea r8, [rsp + 0x210]
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x1a98]
call fcn.14009e1b0
lea rcx, [rsp + 0x1a98]
call fcn.14009d7a0
test al, al
je 0x140039c72
lea rdx, [rsp + 0x1a98]
lea rcx, [rsp + 0x18d0]
call fcn.140025b30
mov edi, 5
mov esi, 4
lea rcx, [rsp + 0x1a98]
call fcn.14000c080
nop
mov r9, r13
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rsp + 0x2340]
call fcn.1400b9030
nop
lea rcx, [rsp + 0x1928]
call fcn.14000c080
cmp byte [rsp + 0x98], 0
jne 0x14003a610
jmp 0x14003a4f4
lea rax, str.setup.ovr
mov qword [rsp + 0x620], rax
mov qword [rsp + 0x628], 9
lea rax, [rsp + 0x18b0]
cmp qword [rsp + 0x18c8], 7
cmova rax, qword [rsp + 0x18b0]
mov qword [rsp + 0x630], rax
mov rax, qword [rsp + 0x18c0]
mov qword [rsp + 0x638], rax
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0xae0], xmm0
movaps xmm1, xmmword [rsp + 0x630]
movdqa xmmword [rsp + 0xaf0], xmm1
lea r8, [rsp + 0xae0]
lea rdx, [rsp + 0xaf0]
lea rcx, [rsp + 0x1928]
call fcn.14009e1b0
lea rcx, [rsp + 0x1928]
cmp qword [rsp + 0x1940], 7
cmova rcx, qword [rsp + 0x1928]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140039c72
test al, 0x10
jne 0x140039c72
xorps xmm0, xmm0
movups xmmword [rsp + 0x19a0], xmm0
mov qword [rsp + 0x19b0], r14
mov qword [rsp + 0x19b8], 7
mov word [rsp + 0x19a0], r14w
movups xmmword [rsp + 0x710], xmm0
mov qword [rsp + 0x720], r14
mov qword [rsp + 0x728], r14
mov r8d, 8
lea rdx, str._copysfx
lea rcx, [rsp + 0x710]
call fcn.14000c360
nop
mov r8d, 2
lea rdx, [0x14014ab3c]
lea rcx, [rsp + 0x710]
call fcn.14000bdb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x308], xmm0
mov qword [rsp + 0x318], r14
mov qword [rsp + 0x320], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x308], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x318], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
bts edi, 8
lea rdx, [rsp + 0x2340]
cmp qword [rsp + 0x2358], 7
cmova rdx, qword [rsp + 0x2340]
mov r8, qword [rsp + 0x2350]
lea rcx, [rsp + 0x308]
call fcn.14000bdb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x328], xmm0
mov qword [rsp + 0x338], r14
mov qword [rsp + 0x340], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x328], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x338], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
bts edi, 7
mov r8, r15
lea rdx, [0x1401495fc]
lea rcx, [rsp + 0x328]
call fcn.14000bdb0
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x6f0], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rsp + 0x700], xmm7
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or edi, 0x40
mov dword [rsp + 0x84], edi
mov rdx, qword [rsp + 0x19b8]
cmp rdx, 7
jbe 0x140039f41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x19a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039f3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b377
call fcn.1400b8a80
movups xmmword [rsp + 0x19a0], xmm6
movups xmmword [rsp + 0x19b0], xmm7
mov qword [rsp + 0x700], r14
mov qword [rsp + 0x708], 7
mov word [rsp + 0x6f0], r14w
lea rcx, [rsp + 0x6f0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x328]
call fcn.14000c080
nop
lea rcx, [rsp + 0x308]
call fcn.14000c080
nop
lea rcx, [rsp + 0x710]
call fcn.14000c080
lea rdx, [rsp + 0x19a0]
cmp qword [rsp + 0x19b8], 7
cmova rdx, qword [rsp + 0x19a0]
lea rcx, [rsp + 0x1928]
cmp qword [rsp + 0x1940], 7
cmova rcx, qword [rsp + 0x1928]
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rsp + 0x94]
call fcn.14002f850
mov esi, eax
test eax, eax
jne 0x14003a047
mov eax, dword [rsp + 0x94]
cmp eax, 0x2000000a
jne 0x14003a02b
mov dword [rsp + 0x94], 0xa004
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x19a0]
call fcn.14000c080
jmp 0x140039d81
add eax, 0xe0000000
mov ebx, r14d
mov edi, 5
cmp eax, 1
cmova ebx, edi
mov dword [rsp + 0x94], ebx
jmp 0x14003a053
mov edi, 5
mov ebx, dword [rsp + 0x94]
lea rcx, [rsp + 0x19a0]
call fcn.14000c080
test esi, esi
jne 0x140039c77
test ebx, ebx
jne 0x140039c77
lea rax, [0x14014ab60]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], 3
lea rax, [rsp + 0x18b0]
cmp qword [rsp + 0x18c8], 7
cmova rax, qword [rsp + 0x18b0]
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x18c0]
mov qword [rsp + 0x218], rax
movaps xmm0, xmmword [rsp + 0x200]
movdqa xmmword [rsp + 0x7d0], xmm0
movaps xmm1, xmmword [rsp + 0x210]
movdqa xmmword [rsp + 0x7e0], xmm1
lea r8, [rsp + 0x7d0]
lea rdx, [rsp + 0x7e0]
lea rcx, [rsp + 0x1800]
call fcn.14009e1b0
lea rax, str.avast.setup
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], 0xb
lea rax, [rsp + 0x1800]
cmp qword [rsp + 0x1818], 7
cmova rax, qword [rsp + 0x1800]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x1810]
mov qword [rsp + 0x238], rax
movaps xmm0, xmmword [rsp + 0x220]
movdqa xmmword [rsp + 0x470], xmm0
movaps xmm1, xmmword [rsp + 0x230]
movdqa xmmword [rsp + 0x480], xmm1
lea r8, [rsp + 0x470]
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x18d0]
call fcn.14009e1b0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
mov qword [rsp + 0x100], rax
test rax, rax
je 0x140039c77
lea rcx, [rsp + 0x18f0]
call fcn.14000ce30
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x18f0], xmm1
mov qword [rsp + 0x1900], r14
lea r8, [rsp + 0x18f0]
mov rcx, rdx
call fcn.140033cc0
test al, al
je 0x14003a478
mov rbx, qword [rsp + 0x18f0]
cmp rbx, qword [rsp + 0x18f8]
je 0x14003a478
mov esi, 4
mov r15d, esi
mov rax, qword gs:[0x58]
add r15, qword [rax]
lea rax, str.path
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rdi
movaps xmm6, xmmword [rsp + 0x1e0]
nop dword [rax]
nop dword [rax + rax]
mov rdx, rbx
lea rcx, [rsp + 0x1b38]
call fcn.140025cc0
nop
mov eax, dword [r15]
cmp dword [0x14017d528], eax
jle 0x14003a279
lea rcx, [0x14017d528]
call fcn.1400b8cf0
cmp dword [0x14017d528], 0xffffffff
jne 0x14003a279
call fcn.1400b6e8c
mov qword [0x14017d520], rax
lea rcx, [0x14017d528]
call fcn.1400b8c80
lea rax, [rsp + 0x1b38]
cmp qword [rsp + 0x1b50], 7
cmova rax, qword [rsp + 0x1b38]
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1b48]
mov qword [rsp + 0x1c8], rax
movdqa xmmword [rsp + 0x250], xmm6
movaps xmm0, xmmword [rsp + 0x1c0]
movdqa xmmword [rsp + 0x1f0], xmm0
mov r9, qword [0x14017d520]
mov r8, rdi
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x1f0]
call fcn.140031770
test eax, eax
je 0x14003a312
lea rcx, [rsp + 0x1b38]
call fcn.14000c080
add rbx, 0x20
cmp rbx, qword [rsp + 0x18f8]
jne 0x14003a230
mov r15d, 1
jmp 0x14003a47d
mov rdx, qword [rsp + 0x1b48]
dec rdx
lea rcx, [rsp + 0x1b38]
call fcn.140025b70
cmp word [rax], 0x3b
je 0x14003a35f
lea r8, [0x14014ab8c]
mov rdx, rbx
lea rcx, [rsp + 0x1640]
call fcn.14000b9f0
mov rdx, rax
mov rcx, rbx
call fcn.140025ba0
lea rcx, [rsp + 0x1640]
call fcn.14000c080
mov r13, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, r13
cmp rax, qword [rsp + 0x17e0]
jb 0x14003b37d
mov r15, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14003a38b
mov r15, qword [rbx]
lea rcx, [rsp + 0x17d0]
call fcn.14000c030
mov rcx, qword [rsp + 0x17e0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r9, r15
lea rcx, [rsp + 0x1af8]
call fcn.14000bae0
nop
mov r15d, 1
mov r8d, r15d
lea rdx, [0x14014ab8c]
lea rcx, [rsp + 0x1af8]
call fcn.14000bdb0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x1ab8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x1ac8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rsp + 0x1ab8]
mov rcx, rbx
call fcn.140025ba0
lea rcx, [rsp + 0x1ab8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1af8]
call fcn.14000c080
lea rdx, [rsp + 0x18f0]
lea rcx, [rsp + 0xf00]
call fcn.140033e10
mov rdx, rax
lea rcx, [rsp + 0x1948]
call fcn.14002d1f0
lea rcx, [rsp + 0xf00]
call fcn.14000d9f0
nop
lea rcx, [rsp + 0x1b38]
call fcn.14000c080
lea r13, [fcn.14000c0f0]
jmp 0x14003a47d
mov esi, 4
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
nop
lea rcx, [rsp + 0x18f0]
call fcn.14000d820
jmp 0x140039c7c
test bl, bl
jne 0x14003a606
lea rdx, [0x14014b0a0]
lea rcx, [rsp + 0x250]
call fcn.14000ca20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1f0], xmm0
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x1850]
call fcn.14003c770
mov rcx, rax
lea rdx, [rsp + 0x2380]
call fcn.14000bfa0
mov edi, 5
mov esi, 4
lea r13, str.ga_clientid
mov qword [rsp + 0x640], r13
mov rbx, r12
nop word [rax + rax]
inc rbx
cmp word [r13 + rbx*2], 0
jne 0x14003a510
mov qword [rsp + 0x648], rbx
movaps xmm0, xmmword [rsp + 0x640]
movdqa xmmword [rsp + 0x1b0], xmm0
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x1850]
call fcn.140031460
test rax, rax
jne 0x14003a5cd
lea rax, [rsp + 0x730]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x730], xmm0
mov qword [rsp + 0x740], r14
mov qword [rsp + 0x748], 7
mov word [rsp + 0x730], r14w
movups xmmword [rsp + 0x750], xmm0
mov qword [rsp + 0x760], r14
mov qword [rsp + 0x768], r14
mov r8, rbx
mov rdx, r13
lea rcx, [rsp + 0x750]
call fcn.14000c360
nop
lea r8, [rsp + 0x730]
lea rdx, [rsp + 0x750]
lea rcx, [rsp + 0x1850]
call fcn.14003c8e0
lea rcx, [rsp + 0x1908]
cmp rax, rcx
je 0x14003a610
lea rdx, [rsp + 0x1908]
cmp qword [rsp + 0x1920], 7
cmova rdx, qword [rsp + 0x1908]
mov r8, qword [rsp + 0x1918]
mov rcx, rax
call fcn.14000be50
jmp 0x14003a610
mov edi, 5
mov esi, 4
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0x110], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0x118], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x11c], rax
mov dword [rsp + 0x124], 0x372
lea rax, [0x14014ab90]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 0x2a
lea r9, [rsp + 0x18d0]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x110]
mov ecx, 2
call fcn.140026bf0
lea rdx, [rsp + 0x1bc0]
lea rcx, [rsp + 0x1850]
call fcn.14003bf90
nop
mov rbx, qword [rsp + 0xd0]
test rbx, rbx
je 0x14003a70b
mov rax, r12
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14003a6c0
test rax, rax
je 0x14003a70b
mov r8, r15
lea rdx, [0x14014abe8]
lea rcx, [rsp + 0x1bc0]
call fcn.14000bdb0
mov r8, r12
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14003a6f0
mov rdx, rbx
lea rcx, [rsp + 0x1bc0]
call fcn.14000bdb0
cmp byte [rsp + 0x8a], 0
je 0x14003a775
cmp dword [rsp + 0xfc], 1
jne 0x14003a775
mov qword [rsp + 0x17f0], r14
mov rbx, qword [rsp + 0x17f8]
mov qword [rsp + 0x17f8], r14
test rbx, rbx
je 0x14003a775
mov eax, r12d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14003a775
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400a96cf.0]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14003a775
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400a96cf.0]
mov rax, qword [rsp + 0x1948]
cmp rax, qword [rsp + 0x1950]
cmove rax, r14
lea r9, [rsp + 0x1fc0]
cmp qword [rsp + 0x2030], 0
cmove r9, r14
lea rdx, [rsp + 0x1bc0]
cmp qword [rsp + 0x1bd8], 7
cmova rdx, qword [rsp + 0x1bc0]
lea rcx, [rsp + 0x18d0]
cmp qword [rsp + 0x18e8], 7
cmova rcx, qword [rsp + 0x18d0]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x94]
call fcn.14002f850
mov ecx, eax
mov dword [rsp + 0x8c], eax
test eax, eax
je 0x14003abeb
lea r14, str.The_stub_cannot_run_installer_updater_executable___code_0x:08X_
cmp byte [rsp + 0x9c], 0
jne 0x14003a985
mov qword [rsp + 0x1970], r14
mov qword [rsp + 0x1978], 0x45
lea rax, [rsp + 0x18d0]
cmp qword [rsp + 0x18e8], 7
cmova rax, qword [rsp + 0x18d0]
mov qword [rsp + 0x650], rax
mov rax, qword [rsp + 0x18e0]
mov qword [rsp + 0x658], rax
movups xmm0, xmmword [rsp + 0x650]
movups xmmword [rsp + 0xdd0], xmm0
movabs rax, 0xc000000000000000
mov qword [rsp + 0xdc0], rax
mov dword [rsp + 0xde0], ecx
movabs rax, 0x2000000000000010
mov qword [rsp + 0xdc8], rax
mov qword [rsp + 0x660], 2
lea rax, [rsp + 0xdc0]
mov qword [rsp + 0x668], rax
movaps xmm0, xmmword [rsp + 0x660]
movdqa xmmword [rsp + 0xb70], xmm0
movaps xmm1, xmmword [rsp + 0x1970]
movdqa xmmword [rsp + 0xb80], xmm1
lea r8, [rsp + 0xb70]
lea rdx, [rsp + 0xb80]
lea rcx, [rsp + 0x1e50]
call fcn.14000f490
nop
mov edx, esi
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14017fef8], eax
jle 0x14003a942
lea rcx, [0x14017fef8]
call fcn.1400b8cf0
cmp dword [0x14017fef8], 0xffffffff
jne 0x14003a942
call fcn.140068c00
lea rdx, [0x140149ab0]
lea rcx, str.AVG_Antivirus
cmp dword [rax], 1
cmove rcx, rdx
mov qword [0x14017ff00], rcx
lea rcx, [0x14017fef8]
call fcn.1400b8c80
lea rdx, [rsp + 0x1e50]
cmp qword [rsp + 0x1e68], 7
cmova rdx, qword [rsp + 0x1e50]
mov r9d, 0x10
mov r8, qword [0x14017ff00]
mov rcx, qword [rsp + 0x2030]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, [rsp + 0x1e50]
call fcn.14000c080
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0x3a8], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0x3b0], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x3b4], rax
mov dword [rsp + 0x3bc], 0x387
xorps xmm0, xmm0
movups xmmword [rsp + 0x1970], xmm0
lea rcx, [rsp + 0x1970]
call fcn.14000cc90
nop
mov rbx, qword [rsp + 0x1970]
test rbx, rbx
je 0x14003aaba
mov rax, qword [rbx]
mov edx, 7
mov rcx, rbx
mov rax, qword [rax + 0x78]
call qword [case.0x1400a96cf.0]
test al, al
je 0x14003aaba
mov qword [rsp + 0x670], r14
mov qword [rsp + 0x678], 0x45
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x18d0]
lea r8, [rsp + 0x670]
lea rdx, [rsp + 0x1660]
call fcn.1400407b0
nop
mov rcx, qword [rbx]
mov r10, qword [rcx + 0x10]
mov r8, rax
cmp qword [rax + 0x18], 7
jbe 0x14003aa65
mov r8, qword [rax]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x680], r8
mov qword [rsp + 0x688], rcx
movaps xmm0, xmmword [rsp + 0x680]
movdqa xmmword [rsp + 0xb90], xmm0
lea r9, [rsp + 0xb90]
lea r8, [rsp + 0x3a8]
mov edx, 7
mov rcx, rbx
mov rax, r10
call qword [case.0x1400a96cf.0]
nop
lea rcx, [rsp + 0x1660]
call fcn.14000c080
nop
mov rbx, qword [rsp + 0x1978]
test rbx, rbx
je 0x14003ab01
mov eax, r12d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14003ab01
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400a96cf.0]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14003ab01
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400a96cf.0]
nop
lea rcx, [rsp + 0x1bc0]
call fcn.14000c080
nop
mov rbx, qword [rsp + 0x1d40]
mov rsi, qword [rsp + 0x1d48]
cmp rbx, rsi
je 0x14003ab75
cmp dword [rbx + 8], 0
je 0x14003b396
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbx + 8], eax
je 0x14003b38e
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0xba0], xmm0
xor edx, edx
lea rcx, [rsp + 0xba0]
call fcn.1400b792c
test eax, eax
jne 0x14003b383
xorps xmm0, xmm0
movups xmmword [rsp + 0x1060], xmm0
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp rbx, rsi
jne 0x14003ab24
lea rcx, [rsp + 0x1d40]
call fcn.140026470
lea rcx, [rsp + 0x1cf0]
call fcn.1400b66d0
mov r8, qword [rsp + 0x1ce0]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x1ce0]
lea rcx, [rsp + 0x1ce0]
call fcn.140032240
mov edx, 0x60
mov rcx, qword [rsp + 0x1ce0]
call fcn.1400b8a80
lea rcx, [rsp + 0x1cc0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1fc0]
call fcn.1400334d0
nop
lea rcx, [rsp + 0x1b58]
jmp 0x14003764c
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x8c], eax
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0x438], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0x440], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x444], rax
mov dword [rsp + 0x44c], 0x38f
xorps xmm0, xmm0
movups xmmword [rsp + 0x1960], xmm0
lea rcx, [rsp + 0x1960]
call fcn.14000cc90
nop
mov rbx, qword [rsp + 0x1960]
test rbx, rbx
je 0x14003ad35
mov rax, qword [rbx]
mov edx, 2
mov rcx, rbx
mov rax, qword [rax + 0x78]
call qword [case.0x1400a96cf.0]
test al, al
je 0x14003ad35
lea rax, str.Installer_updater_executable__finished__process_return_code_0x:08X_
mov qword [rsp + 0x690], rax
mov qword [rsp + 0x698], 0x49
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x18d0]
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0x1680]
call fcn.1400407b0
nop
mov rcx, qword [rbx]
mov r10, qword [rcx + 0x10]
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x14003ace0
mov rcx, qword [rax]
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rdx
movaps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0xbb0], xmm0
lea r9, [rsp + 0xbb0]
lea r8, [rsp + 0x438]
mov edx, 2
mov rcx, rbx
mov rax, r10
call qword [case.0x1400a96cf.0]
nop
lea rcx, [rsp + 0x1680]
call fcn.14000c080
nop
mov rbx, qword [rsp + 0x1968]
test rbx, rbx
je 0x14003ad7c
mov eax, r12d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14003ad7c
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400a96cf.0]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14003ad7c
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400a96cf.0]
nop
lea rcx, [rsp + 0x1bc0]
call fcn.14000c080
nop
mov rbx, qword [rsp + 0x1d40]
mov rsi, qword [rsp + 0x1d48]
cmp rbx, rsi
je 0x14003adf1
nop
cmp dword [rbx + 8], 0
je 0x14003b3b2
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbx + 8], eax
je 0x14003b3aa
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0xbc0], xmm0
xor edx, edx
lea rcx, [rsp + 0xbc0]
call fcn.1400b792c
test eax, eax
jne 0x14003b39f
xorps xmm0, xmm0
movups xmmword [rsp + 0x1070], xmm0
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp rbx, rsi
jne 0x14003ada0
lea rcx, [rsp + 0x1d40]
call fcn.140026470
lea rcx, [rsp + 0x1cf0]
call fcn.1400b66d0
mov r8, qword [rsp + 0x1ce0]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x1ce0]
lea rcx, [rsp + 0x1ce0]
call fcn.140032240
mov edx, 0x60
mov rcx, qword [rsp + 0x1ce0]
call fcn.1400b8a80
lea rcx, [rsp + 0x1cc0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1fc0]
call fcn.1400334d0
nop
lea rcx, [rsp + 0x1b58]
jmp 0x14003764c
call fcn.140080670
call fcn.14008f470
xor ecx, ecx
call fcn.14008f050
xor ecx, ecx
call fcn.14007f9f0
mov rcx, qword [rsp + 0x17e0]
test rcx, rcx
je 0x14003b0a2
lea rdx, str.Reboot.txt
mov qword [rsp + 0x6a0], rdx
mov rax, r12
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003aef0
mov qword [rsp + 0x6a8], rax
lea rax, [rsp + 0x17d0]
cmp qword [rsp + 0x17e8], 7
cmova rax, qword [rsp + 0x17d0]
mov qword [rsp + 0x6b0], rax
mov qword [rsp + 0x6b8], rcx
movaps xmm0, xmmword [rsp + 0x6a0]
movdqa xmmword [rsp + 0xbd0], xmm0
movaps xmm1, xmmword [rsp + 0x6b0]
movdqa xmmword [rsp + 0xbe0], xmm1
lea r8, [rsp + 0xbd0]
lea rdx, [rsp + 0xbe0]
lea rcx, [rsp + 0x1800]
call fcn.14009e1b0
lea rcx, [rsp + 0x1800]
cmp qword [rsp + 0x1818], 7
cmova rcx, qword [rsp + 0x1800]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003af99
test al, 0x10
jne 0x14003af99
mov dil, 1
jmp 0x14003af9c
xor dil, dil
cmp byte [rsp + 0x90], 0
je 0x14003b08b
cmp qword [rsp + 0x17e0], 0
je 0x14003b098
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1a80], xmm0
mov qword [rsp + 0x1a90], rax
movups xmmword [rsp + 0x830], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x840], xmm1
lea r8d, [rax + 3]
lea rdx, [0x140153578]
lea rcx, [rsp + 0x830]
call fcn.14000c360
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rsp + 0x830]
lea rdx, [rsp + 0x17d0]
lea rcx, [rsp + 0x1a80]
call fcn.14009fad0
nop
lea rcx, [rsp + 0x830]
call fcn.14000c080
mov rbx, qword [rsp + 0x1a88]
cmp rbx, qword [rsp + 0x1a80]
je 0x14003b06c
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
add rbx, 0xffffffffffffffe0
add rcx, 0xffffffffffffffe0
xor edx, edx
call fcn.14009f330
mov rcx, rbx
cmp rbx, qword [rsp + 0x1a80]
jne 0x14003b050
xor edx, edx
lea rcx, [rsp + 0x17d0]
call fcn.14009f330
nop
lea rcx, [rsp + 0x1a80]
call fcn.14000d820
jmp 0x14003b098
lea rcx, [rsp + 0x17d0]
call fcn.14009ded0
test dil, dil
je 0x14003b0a2
call fcn.14002ff60
mov dword [rsp + 0x70], 0x41333635
mov dword [rsp + 0x74], 0x43393641
movsd xmm0, qword [str.sfxinst]
movsd qword [rsp + 0x408], xmm0
mov eax, dword [0x14014aff8]
mov dword [rsp + 0x410], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x414], rax
mov dword [rsp + 0x41c], 0x3ac
lea rax, str.Leaving_SFX_stub_guarded_code_section__return_code_0x:08X_
mov qword [rsp + 0x6c0], rax
mov qword [rsp + 0x6c8], 0x3c
lea r9, [rsp + 0x8c]
lea r8, [rsp + 0x6c0]
lea rdx, [rsp + 0x408]
call fcn.14003f470
nop
lea rcx, [rsp + 0x19c0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x19e0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1908]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1830]
call fcn.14000c080
nop
lea rcx, [rsp + 0x20b0]
call fcn.14003b710
nop
lea rcx, [rsp + 0x1948]
call fcn.14000d9f0
nop
lea rcx, [rsp + 0x1a00]
call fcn.14000c080
nop
lea rax, vtable.ProgressCallback.0
mov qword [rsp + 0x1f00], rax
lea rcx, [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rsp + 0x1f30]
test rcx, rcx
je 0x14003b1b3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1fa8]
call fcn.140029160
lea rcx, [rsp + 0x1f80]
call fcn.14000c080
lea rcx, [rsp + 0x1f60]
call fcn.14000c080
lea rcx, [rsp + 0x1f38]
call fcn.1400291c0
nop
mov rcx, qword [rsp + 0x17f8]
test rcx, rcx
je 0x14003b23b
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003b23b
mov rbx, qword [rsp + 0x17f8]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400a96cf.0]
lock xadd dword [rbx + 0xc], r12d
cmp r12d, 1
jne 0x14003b23b
mov rcx, qword [rsp + 0x17f8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400a96cf.0]
nop
lea rcx, [rsp + 0x1890]
call fcn.14000d820
lea rcx, [rsp + 0x1878]
call fcn.14003cdc0
cmp byte [rsp + 0x1870], 0
je 0x14003b26d
lea rcx, [rsp + 0x1850]
call fcn.14000c080
nop
lea rcx, [rsp + 0x18b0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1c60]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1c40]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1db8]
call fcn.14000c080
nop
lea rcx, [rsp + 0x17d0]
call fcn.14000c080
nop
lea rcx, [rsp + 0x1800]
call fcn.14000c080
nop
lea rcx, [rsp + 0x18d0]
call fcn.14000c080
mov eax, dword [rsp + 0x8c]
mov rcx, qword [rsp + 0x2e30]
xor rcx, rsp
call fcn.1400b89f0
movaps xmm6, xmmword [rsp + 0x2e50]
movaps xmm7, xmmword [rsp + 0x2e40]
add rsp, 0x2e60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea r8, str.Invalid_DSA_signature
mov edx, 2
lea rcx, [rsp + 0x1778]
call fcn.1400aa730
lea rdx, [0x140172368]
lea rcx, [rsp + 0x1778]
call fcn.1400bb9a0
nop
call fcn.14000c110
nop
call fcn.14000c110
int3
call fcn.14000c340
nop
call fcn.140069b80
nop
lea rdx, str.Invalid_brand
lea rcx, [rsp + 0x1700]
call fcn.1400aa550
lea rdx, [0x140172120]
lea rcx, [rsp + 0x1700]
call fcn.1400bb9a0
nop
call fcn.1400c8950
nop
call fcn.14000c110
nop
mov ecx, 2
call fcn.1400b78c0
int3
mov ecx, edi
call fcn.1400b78c0
int3
mov ecx, r15d
call fcn.1400b78c0
nop
mov ecx, 2
call fcn.1400b78c0
int3
mov ecx, edi
call fcn.1400b78c0
int3
mov ecx, r15d
call fcn.1400b78c0
int3