Function at 0x140005940
Capabilities:
Accept command line arguments
Create process on windows
Create shortcut via ishelllink
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400260e0]
xor rax, rsp
mov qword [rbp], rax
xor r13d, r13d
mov dword [rsp + 0x48], r13d
call fcn.140007ca0
call fcn.140002980
lea rcx, [0x140001d80]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov qword [0x140026cc0], rax
mov qword [rsp + 0x60], r13
movdqa xmm0, xmmword [0x14001a9b0]
movdqu xmmword [rsp + 0x70], xmm0
lea r8d, [r13 + 0x12]
lea rdx, str.Updaters_started..
lea rcx, [rsp + 0x60]
call fcn.140002290
lea rcx, [rsp + 0x60]
call fcn.140005350
lea rcx, [rsp + 0x60]
call fcn.140001cb0
xor bl, bl
mov byte [rsp + 0x40], bl
xor dil, dil
mov byte [rsp + 0x41], dil
xor r15b, r15b
mov byte [rsp + 0x44], r15b
mov byte [rsp + 0x43], bl
xor r14b, r14b
mov byte [rsp + 0x45], r14b
mov byte [rsp + 0x42], bl
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
mov qword [rsp + 0x50], rax
lea ecx, [r13 + 0xa]
lea r12, [0x140026068]
test rax, rax
je 0x140006780
mov r14d, 1
cmp dword [rsp + 0x48], r14d
jle 0x14000620f
xor r15d, r15d
nop
movsxd rax, r14d
lea rdi, [rsi + rax*8]
mov rbx, qword [rdi]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov r8, rcx
lea rdx, str.Argument:
lea rcx, [rsp + 0x60]
call fcn.140002290
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140005a80
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140002200
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rcx, [rbp - 0x60]
call fcn.140005350
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140005b00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005afb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000722a
call fcn.140008948
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140005b42
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000722a
call fcn.140008948
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov r8d, 7
lea rdx, str._update
lea rcx, [rsp + 0x60]
call fcn.140002290
mov rdx, qword [rdi]
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140005b90
lea rcx, [rbp - 0x80]
call fcn.140002290
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call fcn.14000f434
test eax, eax
sete bl
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140005c0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007230
call fcn.140008948
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140005c60
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007230
call fcn.140008948
test bl, bl
je 0x140005c6f
mov bl, 1
mov byte [rsp + 0x40], bl
jmp 0x1400061f6
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov r8d, 0xa
lea rdx, str._autostart
lea rcx, [rbp - 0x80]
call fcn.140002290
mov rdx, qword [rdi]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140005cb2
lea rcx, [rsp + 0x60]
call fcn.140002290
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.14000f434
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.140001cb0
lea rcx, [rbp - 0x80]
call fcn.140001cb0
test ebx, ebx
jne 0x140005d16
mov dil, 1
mov byte [rsp + 0x41], dil
movzx ebx, byte [rsp + 0x40]
jmp 0x1400061fb
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov r8d, 6
lea rdx, str._debug
lea rcx, [rbp - 0x80]
call fcn.140002290
mov rdx, qword [rdi]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140005d60
lea rcx, [rsp + 0x60]
call fcn.140002290
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.14000f434
test eax, eax
sete bl
lea rcx, [rsp + 0x60]
call fcn.140001cb0
mov r8, qword [rbp - 0x68]
cmp r8, 8
jb 0x140005dc2
inc r8
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.1400023d0
test bl, bl
je 0x140005ddf
mov byte [0x140026cc8], 1
call fcn.140002980
mov byte [rsp + 0x44], 1
xor r15d, r15d
jmp 0x1400061f1
lea rdx, str._startintray
lea rcx, [rbp - 0x80]
call fcn.140001610
mov rdx, qword [rdi]
lea rcx, [rsp + 0x60]
call fcn.140001610
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400025d0
movzx ebx, al
lea rcx, [rsp + 0x60]
call fcn.140001cb0
lea rcx, [rbp - 0x80]
call fcn.140001cb0
test bl, bl
je 0x140005e2e
mov byte [rsp + 0x45], 1
jmp 0x1400061f1
lea rdx, str._freetype
lea rcx, [rbp - 0x80]
call fcn.140001610
mov rdx, qword [rdi]
lea rcx, [rsp + 0x60]
call fcn.140001610
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400025d0
movzx ebx, al
lea rcx, [rsp + 0x60]
call fcn.140001cb0
lea rcx, [rbp - 0x80]
call fcn.140001cb0
test bl, bl
je 0x140005e7d
mov byte [rsp + 0x42], 1
jmp 0x1400061f1
lea rdx, str._writeprotected
lea rcx, [rbp - 0x80]
call fcn.140001610
or r13d, 1
mov rdx, qword [rdi]
lea rcx, [rsp + 0x60]
call fcn.140001610
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400025d0
test al, al
je 0x140005ebe
inc r14d
cmp r14d, dword [rsp + 0x48]
jge 0x140005ebe
mov bl, 1
jmp 0x140005ec0
xor bl, bl
lea rcx, [rsp + 0x60]
call fcn.140001cb0
and r13d, 0xfffffffc
lea rcx, [rbp - 0x80]
call fcn.140001cb0
movsxd rax, r14d
lea rdi, [rsi + rax*8]
test bl, bl
je 0x140005f85
mov rbx, qword [rdi]
lea rdx, str.Argument:
lea rcx, [rsp + 0x60]
call fcn.140001610
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400010d0
mov rcx, rax
call fcn.140005350
lea rcx, [rbp - 0x20]
call fcn.140001cb0
lea rcx, [rsp + 0x60]
call fcn.140001cb0
mov byte [rsp + 0x43], 1
mov rdx, qword [rdi]
lea rcx, [0x140026048]
call fcn.1400019e0
mov eax, dword [0x140026058]
test eax, eax
jle 0x1400061f1
mov rbx, r15
mov edi, eax
mov esi, 0x5c
mov rdx, rbx
lea rcx, [0x140026048]
call fcn.140001a00
cmp word [rax], 0x2f
jne 0x140005f77
mov rdx, rbx
lea rcx, [0x140026048]
call fcn.140001a00
mov word [rax], si
inc rbx
sub rdi, 1
jne 0x140005f50
jmp 0x1400061ec
lea rdx, str._workdir
lea rcx, [rbp - 0x80]
call fcn.140001610
mov rdx, qword [rdi]
lea rcx, [rsp + 0x60]
call fcn.140001610
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400025d0
test al, al
je 0x140005fc2
inc r14d
cmp r14d, dword [rsp + 0x48]
jge 0x140005fc2
mov bl, 1
jmp 0x140005fc4
xor bl, bl
lea rcx, [rsp + 0x60]
call fcn.140001cb0
and r13d, 0xfffffff3
lea rcx, [rbp - 0x80]
call fcn.140001cb0
movsxd rax, r14d
lea rdi, [rsi + rax*8]
test bl, bl
je 0x140006038
mov rbx, qword [rdi]
lea rdx, str.Argument:
lea rcx, [rsp + 0x60]
call fcn.140001610
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400010d0
mov rcx, rax
call fcn.140005350
lea rcx, [rbp - 0x20]
call fcn.140001cb0
lea rcx, [rsp + 0x60]
call fcn.140001cb0
mov rdx, qword [rdi]
lea rcx, [0x140026088]
call fcn.1400019e0
jmp 0x1400061f1
lea rdx, str._key
lea rcx, [rbp - 0x80]
call fcn.140001610
mov rdx, qword [rdi]
lea rcx, [rsp + 0x60]
call fcn.140001610
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400025d0
test al, al
je 0x140006075
inc r14d
cmp r14d, dword [rsp + 0x48]
jge 0x140006075
mov bl, 1
jmp 0x140006077
xor bl, bl
lea rcx, [rsp + 0x60]
call fcn.140001cb0
and r13d, 0xffffffcf
lea rcx, [rbp - 0x80]
call fcn.140001cb0
movsxd rax, r14d
lea rdi, [rsi + rax*8]
test bl, bl
je 0x1400060eb
mov rbx, qword [rdi]
lea rdx, str.Argument:
lea rcx, [rsp + 0x60]
call fcn.140001610
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400010d0
mov rcx, rax
call fcn.140005350
lea rcx, [rbp - 0x20]
call fcn.140001cb0
lea rcx, [rsp + 0x60]
call fcn.140001cb0
mov rdx, qword [rdi]
lea rcx, [0x1400260a8]
call fcn.1400019e0
jmp 0x1400061f1
lea rdx, str._exename
lea rcx, [rbp - 0x80]
call fcn.140001610
mov rdx, qword [rdi]
lea rcx, [rsp + 0x60]
call fcn.140001610
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400025d0
test al, al
je 0x140006128
inc r14d
cmp r14d, dword [rsp + 0x48]
jge 0x140006128
mov bl, 1
jmp 0x14000612a
xor bl, bl
lea rcx, [rsp + 0x60]
call fcn.140001cb0
and r13d, 0xffffff3f
lea rcx, [rbp - 0x80]
call fcn.140001cb0
test bl, bl
je 0x1400061f1
movsxd rax, r14d
lea rdi, [rsi + rax*8]
mov rbx, qword [rdi]
lea rdx, str.Argument:
lea rcx, [rsp + 0x60]
call fcn.140001610
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400010d0
mov rcx, rax
call fcn.140005350
lea rcx, [rbp - 0x20]
call fcn.140001cb0
lea rcx, [rsp + 0x60]
call fcn.140001cb0
mov rdx, qword [rdi]
mov rcx, r12
call fcn.1400019e0
mov ebx, r15d
mov esi, dword [0x140026078]
test esi, esi
jle 0x1400061ec
nop dword [rax]
movsxd rdi, ebx
mov rdx, rdi
mov rcx, r12
call fcn.140001a00
cmp word [rax], 0x2f
je 0x1400061dd
mov rdx, rdi
mov rcx, r12
call fcn.140001a00
cmp word [rax], 0x5c
je 0x1400061dd
inc ebx
cmp ebx, esi
jl 0x1400061b0
jmp 0x1400061ec
lea rdx, str.Telegram.exe
mov rcx, r12
call fcn.1400019e0
mov rsi, qword [rsp + 0x50]
movzx ebx, byte [rsp + 0x40]
movzx edi, byte [rsp + 0x41]
inc r14d
cmp r14d, dword [rsp + 0x48]
jge 0x14000620f
mov ecx, 0xa
jmp 0x140005a40
cmp qword [0x140026078], 0
jne 0x14000622e
mov r8d, 0xc
lea rdx, str.Telegram.exe
mov rcx, r12
call fcn.140002290
test bl, bl
je 0x140006285
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
lea r8d, [rbx + 0xf]
lea rdx, str.Need_to_update_
lea rcx, [rsp + 0x60]
call fcn.140002290
lea rcx, [rsp + 0x60]
call fcn.140005350
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x140006287
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400023d0
jmp 0x140006287
xor ebx, ebx
test dil, dil
je 0x1400062dd
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov r8d, 0xf
lea rdx, str.From_autostart_
lea rcx, [rsp + 0x60]
call fcn.140002290
lea rcx, [rsp + 0x60]
call fcn.140005350
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x1400062dd
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400023d0
cmp byte [rsp + 0x43], 0
je 0x140006335
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov r8d, 0x17
lea rdx, str.Write_Protected_folder_
lea rcx, [rsp + 0x60]
call fcn.140002290
lea rcx, [rsp + 0x60]
call fcn.140005350
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x140006335
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400023d0
mov rcx, qword [0x140026098]
test rcx, rcx
je 0x1400063b0
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x1e
jb 0x14000724e
lea rax, [0x140026088]
cmp qword [0x1400260a0], 8
cmovae rax, qword [0x140026088]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1e
lea r9, str.Will_pass_custom_working_dir:
lea r8, [0x140026088]
movzx edx, byte [rsp + 0x42]
lea rcx, [rbp - 0x60]
call fcn.140001650
lea rcx, [rbp - 0x60]
call fcn.140005350
lea rcx, [rbp - 0x60]
call fcn.140001cb0
mov rdx, qword [rsi]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400063c0
lea r14, [0x140026008]
mov rcx, r14
call fcn.140002290
mov r15, qword [0x140026018]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r15
cmp rax, 0x11
jb 0x14000724e
mov r12, r14
cmp qword [0x140026020], 8
cmovae r12, qword [0x140026008]
mov qword [rsp + 0x60], rbx
lea rsi, [r15 + 0x11]
mov ebx, 7
lea rdi, [rsp + 0x60]
cmp rsi, rbx
jbe 0x14000645a
mov rbx, rsi
or rbx, 7
cmp rbx, rcx
jbe 0x140006437
mov rbx, rcx
jmp 0x140006444
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x60]
call fcn.140002190
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [str.Updater_name_is:]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x14001a308]
movups xmmword [rdi + 0x10], xmm1
movzx ecx, word [0x14001a318]
mov word [rdi + 0x20], cx
lea rcx, [rdi + 0x22]
lea r8, [r15 + r15]
mov rdx, r12
call fcn.14000aaf0
xor r15d, r15d
mov word [rdi + rsi*2], r15w
lea rcx, [rsp + 0x60]
call fcn.140005350
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400064e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000721e
call fcn.140008948
cmp qword [0x140026018], 0xb
jbe 0x140006722
mov qword [rsp + 0x60], r15
movdqa xmm0, xmmword [0x14001a9b0]
movdqu xmmword [rsp + 0x70], xmm0
mov r8d, 0xb
lea rdx, str.Updater.exe
lea rcx, [rsp + 0x60]
call fcn.140002290
mov rax, qword [0x140026018]
lea rcx, [rax - 0xb]
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
cmp rax, rcx
jb 0x140007236
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rax, r14
cmp qword [0x140026020], 8
cmovae rax, qword [0x140026008]
lea rdx, [rax + rcx*2]
lea rcx, [rbp - 0x80]
call fcn.140002290
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call fcn.14000f434
test eax, eax
sete bl
mov r8, qword [rbp - 0x68]
cmp r8, 8
jb 0x1400065b8
inc r8
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.1400023d0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
lea rcx, [rsp + 0x60]
call fcn.140001cb0
test bl, bl
je 0x140006710
mov rax, qword [0x140026018]
lea r8, [rax - 0xb]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
cmp rax, r8
cmovb r8, rax
cmp qword [0x140026020], 8
cmovae r14, qword [0x140026008]
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140002290
lea rcx, [0x140026028]
call fcn.140001cb0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [0x140026028], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [0x140026038], xmm1
lea r8, [0x140026028]
lea rdx, str.Updater_dir_is:
lea rcx, [rbp - 0x20]
call fcn.140001220
mov rcx, rax
call fcn.140005350
lea rcx, [rbp - 0x20]
call fcn.140001cb0
movzx ebx, byte [rsp + 0x43]
test bl, bl
jne 0x140006685
lea rdx, [0x140026028]
lea rcx, [0x140026048]
call fcn.1400019b0
lea r8, [0x140026048]
lea rdx, str.Update_to:
lea rcx, [rbp - 0x20]
call fcn.140001220
mov rcx, rax
call fcn.140005350
lea rcx, [rbp - 0x20]
call fcn.140001cb0
cmp byte [rsp + 0x40], 0
je 0x1400066c2
call fcn.140002c60
test al, al
je 0x1400066c2
call fcn.140004bd0
test bl, bl
je 0x14000675b
lea rcx, str.tupdates_temp_tdata_version
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400066fe
lea rcx, str.tupdates_ready_tdata_version
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400066fe
lea rdx, str.Error:_could_not_delete_version_file
lea rcx, [rbp - 0x60]
call fcn.140001610
jmp 0x140006749
lea rdx, str.Version_file_deleted_
lea rcx, [rbp - 0x60]
call fcn.140001610
jmp 0x140006749
lea rdx, str.Error:_bad_exe_name_
lea rcx, [rbp - 0x60]
call fcn.140001610
jmp 0x140006749
mov qword [rbp - 0x60], r15
movdqa xmm0, xmmword [0x14001a9b0]
movdqu xmmword [rbp - 0x50], xmm0
mov r8d, 0x16
lea rdx, str.Error:_short_exe_name_
lea rcx, [rbp - 0x60]
call fcn.140002290
lea rcx, [rbp - 0x60]
call fcn.140005350
lea rcx, [rbp - 0x60]
call fcn.140001cb0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r12, [0x140026068]
movzx edi, byte [rsp + 0x41]
movzx r15d, byte [rsp + 0x44]
movzx r14d, byte [rsp + 0x45]
jmp 0x1400067a2
lea rdx, str.Error:_No_command_line_arguments_
lea rcx, [rbp - 0x60]
call fcn.140001610
lea rcx, [rbp - 0x60]
call fcn.140005350
lea rcx, [rbp - 0x60]
call fcn.140001cb0
xor ebx, ebx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 7
test dil, dil
je 0x1400067cd
lea r8d, [rbx + 0xb]
lea rdx, str.__autostart
lea rcx, [rbp - 0x40]
call fcn.140002200
test r15b, r15b
je 0x1400067e8
mov r8d, 7
lea rdx, str.__debug
lea rcx, [rbp - 0x40]
call fcn.140002200
test r14b, r14b
je 0x140006803
mov r8d, 0xd
lea rdx, str.__startintray
lea rcx, [rbp - 0x40]
call fcn.140002200
cmp byte [rsp + 0x42], 0
je 0x140006820
mov r8d, 0xa
lea rdx, str.__freetype
lea rcx, [rbp - 0x40]
call fcn.140002200
mov rcx, qword [0x140026098]
movabs rdi, 0x7ffffffffffffffe
test rcx, rcx
je 0x14000693d
mov rax, rdi
sub rax, rcx
cmp rax, 0xb
jb 0x14000723c
lea rax, [0x140026088]
cmp qword [0x1400260a0], 8
cmovae rax, qword [0x140026088]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xb
lea r9, str.__workdir__
lea r8, [0x140026088]
movzx edx, byte [rsp + 0x42]
lea rcx, [rsp + 0x60]
call fcn.140001650
mov r8d, 1
lea rdx, [0x14001a568]
lea rcx, [rsp + 0x60]
call fcn.140002200
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rbp - 0x60]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 8
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [rbp - 0x40]
call fcn.140002200
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140006933
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000692e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007242
call fcn.140008948
lea rcx, [rsp + 0x60]
call fcn.140001cb0
mov rcx, qword [0x1400260b8]
test rcx, rcx
je 0x140006a3e
mov rax, rdi
sub rax, rcx
cmp rax, 7
jb 0x140007248
lea rax, [0x1400260a8]
cmp qword [0x1400260c0], 8
cmovae rax, qword [0x1400260a8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 7
lea r9, str.__key__
lea r8, [0x1400260a8]
movzx edx, byte [rsp + 0x42]
lea rcx, [rbp - 0x60]
call fcn.140001650
mov r8d, 1
lea rdx, [0x14001a568]
lea rcx, [rbp - 0x60]
call fcn.140002200
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rsp + 0x60]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 8
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [rbp - 0x40]
call fcn.140002200
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x140006a24
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400023d0
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x140006a3e
inc r8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.1400023d0
mov r14, qword [rbp - 0x30]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r14
cmp rax, 0x12
jb 0x14000724e
lea r15, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r15, qword [rbp - 0x40]
mov qword [rsp + 0x60], rbx
lea rsi, [r14 + 0x12]
mov ebx, 7
lea rdi, [rsp + 0x60]
cmp rsi, rbx
jbe 0x140006ac2
mov rbx, rsi
mov eax, 8
cmp rsi, rax
cmovb rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x140006a9f
mov rbx, rcx
jmp 0x140006aac
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x60]
call fcn.140002190
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [str.Result_arguments:]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x14001a5a8]
movups xmmword [rdi + 0x10], xmm1
mov ecx, dword [0x14001a5b8]
mov dword [rdi + 0x20], ecx
lea rcx, [rdi + 0x24]
lea r8, [r14 + r14]
mov rdx, r15
call fcn.14000aaf0
xor r15d, r15d
mov word [rdi + rsi*2], r15w
lea rcx, [rsp + 0x60]
call fcn.140005350
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140006b4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000721e
call fcn.140008948
xor sil, sil
cmp byte [rsp + 0x43], sil
je 0x140006ee4
mov qword [rbp - 0x60], r15
movdqa xmm0, xmmword [0x14001a9b0]
movdqu xmmword [rbp - 0x50], xmm0
mov r8d, 0x25
lea rdx, str.Trying_to_run_un_elevated_by_temp.lnk
lea rcx, [rbp - 0x60]
call fcn.140002290
lea rcx, [rbp - 0x60]
call fcn.140005350
lea rcx, [rbp - 0x60]
call fcn.140001cb0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x140006eab
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x14001ad10]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14001ad40]
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea rcx, [rbp - 0x20]
test eax, eax
js 0x140006e13
mov r8, r12
lea rdx, [0x140026048]
call fcn.140001140
lea rdx, [0x140026048]
lea rcx, [rbp - 0x80]
call fcn.140001570
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x58]
cmp qword [rbp - 0x30], 0
je 0x140006c27
bts r13d, 8
mov r9, 0xffffffffffffffff
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x40]
call fcn.140002c00
jmp 0x140006c39
bts r13d, 9
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.140001570
mov rcx, rax
call fcn.1400023c0
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call rbx
bt r13d, 9
jae 0x140006c60
btr r13d, 9
lea rcx, [rbp - 0x60]
call fcn.140001cb0
bt r13d, 8
jae 0x140006c71
lea rcx, [rsp + 0x60]
call fcn.140001cb0
mov rdi, qword [rsp + 0x50]
mov rax, qword [rdi]
mov rbx, qword [rax + 0xa0]
lea rcx, [rbp - 0x20]
call fcn.1400023c0
mov rdx, rax
mov rcx, rdi
call rbx
mov rdi, qword [rsp + 0x50]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x48]
lea rcx, [rbp - 0x80]
call fcn.1400023c0
mov rdx, rax
mov rcx, rdi
call rbx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [0x14001970c]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
lea rdx, [0x14001ad30]
call qword [rax]
test eax, eax
js 0x140006ddb
lea rdx, str.tupdates_temp_temp.lnk
lea rcx, [rsp + 0x60]
call fcn.140001610
mov rdi, qword [rsp + 0x58]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1400023c0
mov r8d, 1
mov rdx, rax
mov rcx, rdi
call rbx
mov ebx, eax
test eax, eax
jns 0x140006d50
lea rdx, str.tupdates_ready_temp.lnk
lea rcx, [rsp + 0x60]
call fcn.1400019e0
mov rdi, qword [rsp + 0x58]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1400023c0
mov r8d, 1
mov rdx, rax
mov rcx, rdi
call rbx
mov ebx, eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rbp - 0x60]
test ebx, ebx
js 0x140006db6
lea rdx, str.Executing_un_elevated_through_link..
call fcn.140001610
lea rcx, [rbp - 0x60]
call fcn.140005350
lea rcx, [rbp - 0x60]
call fcn.140001cb0
lea rcx, [rsp + 0x60]
call fcn.1400023c0
mov r9, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
lea r8, str.explorer.exe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov sil, 1
lea rcx, [rsp + 0x60]
jmp 0x140006df8
lea rdx, str.Error:_ppf__Save_failed
call fcn.140001610
lea rcx, [rbp - 0x60]
call fcn.140005350
lea rcx, [rbp - 0x60]
call fcn.140001cb0
lea rcx, [rsp + 0x60]
jmp 0x140006df8
lea rdx, str.Error:_Could_not_create_interface_IID_IPersistFile
lea rcx, [rbp - 0x60]
call fcn.140001610
lea rcx, [rbp - 0x60]
call fcn.140005350
lea rcx, [rbp - 0x60]
call fcn.140001cb0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rbp - 0x80]
call fcn.140001cb0
jmp 0x140006e28
lea rdx, str.Error:_could_not_create_instance_of_IID_IShellLink
call fcn.140001610
lea rcx, [rbp - 0x20]
call fcn.140005350
lea rcx, [rbp - 0x20]
call fcn.140001cb0
call qword [sym.imp.ole32.dll_CoUninitialize]
test sil, sil
je 0x140006ee4
movabs r13, 0x7ffffffffffffffe
mov r14, qword [0x140026078]
mov rax, r13
sub rax, r14
cmp rax, 0xa
jb 0x140007254
cmp qword [0x140026080], 8
cmovae r12, qword [0x140026068]
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea rsi, [r14 + 0xa]
mov ebx, 7
lea rdi, [rbp - 0x80]
cmp rsi, rbx
jbe 0x140007053
mov rbx, rsi
or rbx, 7
cmp rbx, r13
jbe 0x140007032
mov rbx, r13
jmp 0x14000703f
mov qword [rbp - 0x60], r15
movdqa xmm0, xmmword [0x14001a9b0]
movdqu xmmword [rbp - 0x50], xmm0
mov r8d, 0x1f
lea rdx, str.Error:_Could_not_initialize_COM
lea rcx, [rbp - 0x60]
call fcn.140002290
lea rcx, [rbp - 0x60]
call fcn.140005350
lea rcx, [rbp - 0x60]
call fcn.140001cb0
movabs r13, 0x7ffffffffffffffe
mov rax, r13
mov rcx, qword [rbp - 0x30]
sub rax, rcx
cmp rax, 9
jb 0x140007224
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rax, qword [rbp - 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str._noupdate
lea r8, [rbp - 0x40]
movzx edx, byte [rsp + 0x42]
lea rcx, [rsp + 0x60]
call fcn.140001650
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rbx, qword [rsp + 0x60]
mov rcx, qword [0x140026058]
mov rdx, qword [0x140026078]
mov rax, r13
sub rax, rcx
cmp rax, rdx
jb 0x140007224
lea r9, [0x140026048]
cmp qword [0x140026060], 8
cmovae r9, qword [0x140026048]
mov rax, r12
cmp qword [0x140026080], 8
cmovae rax, qword [0x140026068]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [0x140026048]
movzx edx, byte [rsp + 0x42]
lea rcx, [rbp - 0x80]
call fcn.140001650
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r8, qword [rbp - 0x68]
cmp r8, 8
jb 0x140006ffb
inc r8
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.1400023d0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x140006e4a
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400023d0
jmp 0x140006e4a
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x80]
call fcn.140002190
mov rdi, rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rbx
movups xmm0, xmmword [str.Executed_]
movups xmmword [rdi], xmm0
mov ecx, dword [0x14001a898]
mov dword [rdi + 0x10], ecx
lea rcx, [rdi + 0x14]
lea r8, [r14 + r14]
mov rdx, r12
call fcn.14000aaf0
mov word [rdi + rsi*2], r15w
mov rdi, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
sub rax, rdi
cmp rax, 0x1d
jb 0x1400070ce
lea rax, [rdi + 0x1d]
mov qword [rbp - 0x70], rax
lea rbx, [rbp - 0x80]
cmp rcx, 8
cmovae rbx, qword [rbp - 0x80]
lea rcx, [rbx + rdi*2]
mov r8d, 0x3a
lea rdx, str.__closing_log_and_quitting..
call fcn.14000aaf0
mov word [rbx + rdi*2 + 0x3a], r15w
lea rax, [rbp - 0x80]
jmp 0x1400070f2
mov qword [rsp + 0x20], 0x1d
lea r9, str.__closing_log_and_quitting..
movzx r8d, byte [rsp + 0x42]
mov edx, 0x1d
lea rcx, [rbp - 0x80]
call fcn.140001290
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rcx, [rbp - 0x60]
call fcn.140005350
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000715a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007155
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000725a
call fcn.140008948
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000719a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007195
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000725a
call fcn.140008948
mov rcx, qword [0x140026cd0]
test rcx, rcx
je 0x1400071b3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140026cd0], r15
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1400071ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000721e
call fcn.140008948
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140008fb0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000f278
int3
call fcn.140001d40
int3
call fcn.14000f278
int3
call fcn.14000f278
int3
call fcn.140001d60
int3
call fcn.140001d40
int3
call fcn.14000f278
int3
call fcn.140001d40
int3
call fcn.140001d40
int3
call fcn.140001d40
int3
call fcn.14000f278
int3