Function at 0x140055080
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe60]
sub rsp, 0xf60
mov rax, qword [0x1400c7070]
xor rax, rsp
mov qword [rbp + 0xe50], rax
mov rax, r8
xor r15d, r15d
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], r15b
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x1400550e0
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.14001d830
nop
lea r12, [0x1400cb898]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r14, [0x1400cb860]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400cb888], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
mov ecx, 0x10
call fcn.140062618
mov rbx, rax
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], r15
mov qword [rax + 8], r15
mov ecx, 0x48
call fcn.140062618
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [0x1400cb890], rbx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x1a
lea rdx, str.CRITICAL_SECTION_ItemsLock
lea rcx, [rsp + 0x30]
call fcn.14001d830
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
lea rcx, [rbp + 0x158]
mov qword [rax], rcx
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140055218
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055213
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400566db
call fcn.140062610
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x1e
lea rdx, str.CRITICAL_SECTION_InterfaceLock
lea rcx, [rsp + 0x30]
call fcn.14001d830
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], r14
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140055299
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400566e1
call fcn.140062610
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x12
lea rdx, str.HANDLE_HardRefresh
lea rcx, [rsp + 0x30]
call fcn.14001d830
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rsi
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14005531a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055315
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400566e7
call fcn.140062610
mov rbx, qword [0x1400cb888]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0xe
lea rdx, str.HANDLE_Refresh
lea rcx, [rsp + 0x30]
call fcn.14001d830
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rbx
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400553a2
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005539d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400566ed
call fcn.140062610
xor ecx, ecx
call fcn.14006fa68
mov rbx, rax
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x980]
call fcn.1400659a0
mov r9, rbx
lea r8, str._lld
mov edx, 0x64
lea rcx, [rbp + 0x980]
call fcn.14002b970
lea rdx, [rbp + 0x980]
lea rcx, str.Current_time_as_string:__s_n
call fcn.14005cb30
mov ecx, 0x10
call fcn.140062618
mov rbx, rax
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea r14, vtable.CString.0
mov qword [rax], r14
mov qword [rax + 8], r15
lea rcx, [rbp + 0x980]
call fcn.140069798
mov qword [rbx + 8], rax
mov rdx, rbx
lea rcx, str.String_ApplicationStartTime
call sym.Installer.exe_Put
mov rcx, qword [0x1400cb890]
call fcn.140052ab0
call fcn.140054c90
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xc50]
call fcn.1400659a0
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xa50]
call fcn.1400659a0
mov dword [rbp + 8], r15d
mov dword [rbp + 0x10], r15d
lea r9, [rbp + 8]
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0xa50]
lea rcx, [rbp + 0xc50]
call fcn.14005cbe0
test eax, eax
je 0x140055650
mov ecx, 0x10
call fcn.140062618
mov rbx, rax
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], r14
mov qword [rax + 8], r15
lea rcx, [rbp + 0xc50]
call fcn.140069798
mov qword [rbx + 8], rax
mov rdx, rbx
lea rcx, str.String_OsName
call sym.Installer.exe_Put
mov ecx, 0x10
call fcn.140062618
mov rbx, rax
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], r14
mov qword [rax + 8], r15
lea rcx, [rbp + 0xa50]
call fcn.140069798
mov qword [rbx + 8], rax
mov rdx, rbx
lea rcx, str.String_OsServicePack
call sym.Installer.exe_Put
mov rdx, r15
cmp dword [rbp + 0x10], r15d
setne dl
lea rcx, str.int_OsIsServer
call sym.Installer.exe_Put
mov rdx, r15
cmp dword [rbp + 8], 1
sete dl
lea rcx, str.int_OsIsX64
call sym.Installer.exe_Put
mov rdx, r15
cmp dword [rbp + 8], 2
sete dl
lea rcx, str.int_OsIsARM64
call sym.Installer.exe_Put
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x180]
call fcn.1400659a0
lea r8, [rbp + 0xc50]
mov edx, 0x400
lea rcx, [rbp + 0x180]
call fcn.14006e308
lea rcx, [rbp + 0xa50]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140055590
test rax, rax
je 0x1400555cf
lea r8, [0x1400a4958]
mov edx, 0x400
lea rcx, [rbp + 0x180]
call fcn.14006e308
lea r8, [rbp + 0xa50]
mov edx, 0x400
lea rcx, [rbp + 0x180]
call fcn.14006e308
mov ecx, dword [rbp + 8]
test ecx, ecx
je 0x1400555fb
sub ecx, 1
je 0x1400555f2
cmp ecx, 1
je 0x1400555e9
lea r8, [0x1400a2ff8]
jmp 0x140055602
lea r8, str._ARM64
jmp 0x140055602
lea r8, str._x64
jmp 0x140055602
lea r8, str._x86
mov edx, 0x400
lea rcx, [rbp + 0x180]
call fcn.14006e308
mov ecx, 0x10
call fcn.140062618
mov rbx, rax
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], r14
mov qword [rax + 8], r15
lea rcx, [rbp + 0x180]
call fcn.140069798
mov qword [rbx + 8], rax
mov rdx, rbx
lea rcx, str.String_FullOsName
call sym.Installer.exe_Put
mov ecx, 8
call fcn.140062618
mov qword [rbp + 0x18], rax
lea rcx, vtable.CDllResourceManager.0
mov qword [rax], rcx
mov rdx, rax
lea rcx, str.SelfFree_ResourceManager
call sym.Installer.exe_Put
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rax, qword [rbp + 0x38]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140055685
inc edi
movsxd rcx, edi
mov edx, 2
call fcn.140069790
mov rsi, rax
lea r8, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae r8, qword [rbp + 0x38]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0x10
call fcn.140062618
mov rbx, rax
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], r14
mov qword [rax + 8], r15
mov rcx, rsi
call fcn.140069798
mov qword [rbx + 8], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x12
lea rdx, str.String_CommandLine
lea rcx, [rsp + 0x30]
call fcn.14001d830
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rbx
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140055772
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005576d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400566f3
call fcn.140062610
mov rcx, rsi
call fcn.140069370
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rdx, r15
test eax, eax
setne dl
lea rcx, str.int_SafeMode
call sym.Installer.exe_Put
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rdx, r15
cmp eax, 2
sete dl
lea rcx, str.int_SafeModeNetwork
call sym.Installer.exe_Put
lea rcx, [rbp + 0x120]
call fcn.140020ab0
nop
cmp byte [rbp + 0x150], 0
jne 0x140055862
movzx eax, word [rbp + 0x122]
cmp eax, 0x14c
je 0x140055801
cmp eax, 0x8664
je 0x1400557f8
cmp eax, 0xaa64
jne 0x140055812
lea rcx, str.int_ARM64
jmp 0x140055808
lea rcx, str.int_x64
jmp 0x140055808
lea rcx, str.int_x86
mov edx, 1
call sym.Installer.exe_Put
movsx rax, byte [rbp + 0x150]
test rax, rax
jne 0x1400566f9
movzx eax, word [rbp + 0x120]
cmp eax, 0x14c
je 0x140055851
cmp eax, 0x8664
je 0x140055848
cmp eax, 0xaa64
jne 0x140055862
lea rcx, str.int_ARM64App
jmp 0x140055858
lea rcx, str.int_x64App
jmp 0x140055858
lea rcx, str.int_x86App
mov edx, 1
call sym.Installer.exe_Put
mov ecx, 8
call fcn.140062618
mov rbx, rax
mov qword [rbp + 0x18], rax
lea rax, vtable.CMessageBoxProvider.0
mov qword [rbx], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0xa
lea rdx, str.MessageBox
lea rcx, [rsp + 0x30]
call fcn.14001d830
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rbx
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400558fe
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400558f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056720
call fcn.140062610
mov ecx, 0x98
call fcn.140062618
mov rdi, rax
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x80], xmm0
mov qword [rdi + 0x90], rax
lea rax, vtable.CMSIApi.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov qword [rsp + 0x58], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov ecx, 0x60
call fcn.140062618
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi + 0x48], r15
mov dword [rdi + 0x50], r15d
mov qword [rdi + 0x80], r15
lea rcx, [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rdi + 8], r15
lea rcx, [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r9, str.pidspsync
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x88], rax
lea r9, str.msiprogress
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x90], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0xf
lea rdx, str.SelfFree_MSIApi
lea rcx, [rsp + 0x30]
call fcn.14001d830
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rdi
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140055a57
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055a52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056726
call fcn.140062610
mov ecx, 8
call fcn.140062618
mov rbx, rax
mov qword [rbp + 0x18], rax
lea rax, vtable.CMultiStringApi.0
mov qword [rbx], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x17
lea rdx, str.SelfFree_MultiStringApi
lea rcx, [rsp + 0x30]
call fcn.14001d830
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rbx
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140055af3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055aee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005672c
call fcn.140062610
mov ecx, 0xa50
call fcn.140062618
mov rdi, rax
mov qword [rbp + 0x18], rax
xor edx, edx
mov r8d, 0xa50
mov rcx, rax
call fcn.1400659a0
nop
lea rax, vtable.CSimpleDecrypter.0
mov qword [rdi], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi + 8], xmm0
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x20], eax
mov qword [rdi + 0x28], r15
lea r14, [rdi + 0x30]
mov qword [r14], r15
mov byte [rdi + 0x38], al
lea rcx, [rdi + 0x3a]
xor edx, edx
mov r8d, 0xa00
call fcn.1400659a0
mov ecx, 8
call fcn.140062618
mov qword [rbp + 0x18], rax
lea rcx, vtable.CWinapiInterface.0
mov qword [rax], rcx
mov qword [rdi + 0xa40], rax
mov byte [rdi + 0xa48], 1
mov byte [rdi + 0x38], 0
mov qword [rdi + 0x28], r15
mov qword [r14], r15
lea rdx, [rbp + 0x18]
lea rcx, str.2BB077E4_C9C8_4500_BE8C_2EFB56A81D4E
call qword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x140055c4c
mov dword [rdi + 8], 0x208
mov dword [rdi + 0xc], 0x660e
mov dword [rdi + 0x10], 0x10
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rdi + 0x14], xmm0
mov dword [rsp + 0x20], 0xf0000008
lea r9d, [rax + 0x18]
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
xor edx, edx
lea rcx, [rdi + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140055c1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rbp + 0x180]
call fcn.140012900
nop
lea rdx, str.crypt_init_error
lea rcx, [rbp + 0x190]
call fcn.14001ad90
mov edx, ebx
lea rcx, [rbp + 0x190]
call fcn.140012a90
nop
lea rcx, [rbp + 0x180]
call fcn.140022370
jmp 0x140055c4c
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rdi + 8]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x140055c48
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140055c4c
mov byte [rdi + 0x38], 1
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x12
lea rdx, str.SelfFree_Decrypter
lea rcx, [rsp + 0x30]
call fcn.14001d830
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rdi
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140055ccd
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055cc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400566d5
call fcn.140062610
mov dword [rbp + 0xc], r15d
lea rdx, [rbp + 0xc]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x140055d33
mov ecx, dword [rbp + 0xc]
lea edx, [rax + 2]
call fcn.140069790
mov rbx, rax
lea rdx, [rbp + 0xc]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp eax, 1
jne 0x140055d33
mov rcx, r15
lea rdx, str.SYSTEM
nop dword [rax + rax]
movzx eax, word [rbx + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x140055d33
cmp rcx, 7
jne 0x140055d10
lea edx, [rcx - 6]
lea rcx, str.int_UserIsSystem
call sym.Installer.exe_Put
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rbp + 0x18], r15
lea rcx, str._b1_n_
mov qword [rbp + 0x20], rcx
lea r8, [rbp + 0x18]
mov edx, eax
lea rcx, [rbp + 0x100]
call fcn.1400599f0
nop
cmp qword [rbp + 0x110], 0
jne 0x140055d6f
mov esi, 0x1f
jmp 0x140056680
call fcn.1400527c0
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.140013070
nop
mov r8d, 0xe
lea rdx, str.additional.dll
lea rcx, [rbp + 0x78]
call fcn.140012f00
lea rcx, [rbp + 0x180]
call fcn.140012900
nop
lea rdx, str.check_file:_
lea rcx, [rbp + 0x190]
call fcn.14001ad90
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 8
cmovae rdx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x88]
lea rcx, [rbp + 0x190]
call fcn.14001bb90
lea rdx, [0x1400b00bc]
lea rcx, [rbp + 0x190]
call fcn.14001ad90
nop
lea rcx, [rbp + 0x180]
call fcn.140022370
call fcn.1400527c0
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.140013070
nop
mov r8d, 0xe
lea rdx, str.langen_us.dll
lea rcx, [rbp + 0x58]
call fcn.140012f00
lea rcx, [rbp + 0x180]
call fcn.140012900
nop
lea rdx, str.check_file:_
lea rcx, [rbp + 0x190]
call fcn.14001ad90
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
lea rcx, [rbp + 0x190]
call fcn.14001bb90
lea rdx, [0x1400b00bc]
lea rcx, [rbp + 0x190]
call fcn.14001ad90
nop
lea rcx, [rbp + 0x180]
call fcn.140022370
mov qword [rbp + 0x180], r15
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x198], 7
mov qword [rbp + 0x1a0], r15
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], 7
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1d0], r15
mov qword [rbp + 0x1d8], 7
mov qword [rbp + 0x1e0], r15
mov qword [rbp + 0x1f0], r15
mov qword [rbp + 0x1f8], 7
mov qword [rbp + 0x200], r15
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x218], 7
mov qword [rbp + 0x220], r15
mov qword [rbp + 0x230], r15
mov qword [rbp + 0x238], 7
xorps xmm0, xmm0
movaps xmmword [rbp + 0x240], xmm0
lea rcx, [rbp + 0x100]
call fcn.140012d60
lea rdx, [rbp + 0x180]
mov rcx, rax
call fcn.14005b210
mov rdi, rax
lea rcx, [rbp + 0x180]
call fcn.140003520
call fcn.14005aca0
mov rbx, rax
lea rcx, [rbp + 0x78]
call fcn.140012d60
mov rdx, rbx
mov rcx, rax
call fcn.14005b210
mov rsi, rax
call fcn.14005aca0
mov rbx, rax
lea rcx, [rbp + 0x58]
call fcn.140012d60
mov rdx, rbx
mov rcx, rax
call fcn.14005b210
mov rbx, rax
lea rdx, str.HMODULE_CurrentDll
lea rcx, [rsp + 0x30]
call fcn.14001d7f0
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rdi
lea rcx, [rsp + 0x30]
call fcn.14000cb60
lea rdx, str.HMODULE_AdditionalDll
lea rcx, [rsp + 0x30]
call fcn.14001d7f0
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rsi
lea rcx, [rsp + 0x30]
call fcn.14000cb60
lea rdx, str.HMODULE_LangDll
lea rcx, [rsp + 0x30]
call fcn.14001d7f0
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rbx
lea rcx, [rsp + 0x30]
call fcn.14000cb60
mov byte [rsp + 0x50], 0
mov edx, 1
lea rcx, str.int_CustomCrashHandler
call sym.Installer.exe_Put
lea rcx, [rbp + 0x180]
call fcn.140012900
nop
lea rdx, str.Crash_Handler_loaded:
lea rcx, [rbp + 0x180]
call fcn.140027150
mov rcx, rax
call fcn.1400232c0
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.140046eb0
nop
lea rcx, [rbp + 0x180]
call fcn.140022370
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r15w
test rsi, rsi
je 0x140056109
mov rdx, rsi
lea rcx, [rbp + 0x98]
call fcn.14005b8a0
nop
cmp byte [rbp + 0xb8], 0
je 0x1400560cd
lea rcx, [rbp + 0x98]
call fcn.140026e90
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140012fa0
jmp 0x1400560fb
lea rcx, [rbp + 0x180]
call fcn.140012900
nop
lea rdx, str._installer__main__not_a_valid_xml_in_resources
lea rcx, [rbp + 0x180]
call fcn.140027150
nop
lea rcx, [rbp + 0x180]
call fcn.140022370
nop
lea rcx, [rbp + 0x98]
call fcn.140011a10
jmp 0x140056147
lea rcx, [rbp + 0x180]
call fcn.140012900
nop
lea rdx, str._installer__main__additional.dll_handle_is_null
lea rcx, [rbp + 0x180]
call fcn.140027150
nop
lea rcx, [rbp + 0x180]
call fcn.140022370
mov edx, 0x490
lea rcx, str.int_ReturnCode
call sym.Installer.exe_Put
lea rcx, [rbp + 0xe0]
call fcn.140012d60
mov rcx, rax
call fcn.1400567f0
test eax, eax
jne 0x140056196
mov dword [rsp + 0x30], 1
lea rax, str._Main_Thread_
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r12
lea rcx, [rbp + 0x18]
call fcn.140001c20
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x18]
call fcn.1400495b0
call fcn.140049a10
jmp 0x1400561c3
lea rcx, [rbp + 0x180]
call fcn.140012900
nop
lea rdx, str._installer__main__error_parsing_install_xml
lea rcx, [rbp + 0x180]
call fcn.140027150
nop
lea rcx, [rbp + 0x180]
call fcn.140022370
lea rdx, str.MessageBox
lea rcx, [rsp + 0x30]
call fcn.14001d7f0
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov rbx, qword [rax]
lea rcx, [rsp + 0x30]
call fcn.14000cb60
lea rdx, str.MessageBox
lea rcx, [rbp + 0x18]
call fcn.14001d7f0
nop
lea rdx, [rbp + 0x18]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], r15
lea rcx, [rbp + 0x18]
call fcn.14000cb60
test rbx, rbx
je 0x14005623a
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [0x1400926f0]
lea rdx, str.CRITICAL_SECTION_ItemsLock
lea rcx, [rsp + 0x30]
call fcn.14001d7f0
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], r15
lea rcx, [rsp + 0x30]
call fcn.14000cb60
lea rdx, str.CRITICAL_SECTION_InterfaceLock
lea rcx, [rsp + 0x30]
call fcn.14001d7f0
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], r15
lea rcx, [rsp + 0x30]
call fcn.14000cb60
lea rdx, [0x1400a54b0]
lea rcx, [rsp + 0x30]
call fcn.14001d7f0
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov rdi, qword [rax]
lea rcx, [rsp + 0x30]
call fcn.14000cb60
lea rdx, [0x1400a54b0]
lea rcx, [rbp + 0x18]
call fcn.14001d7f0
nop
lea rdx, [rbp + 0x18]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], r15
lea rcx, [rbp + 0x18]
call fcn.14000cb60
test rdi, rdi
je 0x140056337
lea rcx, [rbp + 0x18]
call fcn.1400286c0
mov rcx, qword [rdi]
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x14005632f
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x1400926f0]
mov qword [rbx + 0x10], r15
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [rdi]
jne 0x140056310
mov rcx, rdi
call fcn.140056740
lea rcx, str.int_PerformRestartOnClose
call sym.Installer.exe_Get
mov qword [rsp + 0x60], rax
lea rcx, str.int_ReturnCode
call sym.Installer.exe_Get
mov rsi, rax
lea rcx, str.int_Silent
call sym.Installer.exe_Get
mov qword [rsp + 0x58], rax
lea rcx, str.int_RebootCountDown
call sym.Installer.exe_Get
mov qword [rbp + 0x18], rax
lea rcx, str.int_EndpointInstaller
call sym.Installer.exe_Get
mov r13, rax
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r15w
lea rcx, str.String_RebootCountDownMessage
call sym.Installer.exe_Get
test rax, rax
je 0x1400563d5
lea rcx, str.String_RebootCountDownMessage
call sym.Installer.exe_Get
mov rdx, qword [rax + 8]
lea rcx, [rbp + 0xc0]
call fcn.140012f80
lea rdx, str.HMODULE_CurrentDll
lea rcx, [rsp + 0x30]
call fcn.14001d7f0
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov r12, qword [rax]
lea rcx, [rsp + 0x30]
call fcn.14000cb60
lea rdx, str.HMODULE_AdditionalDll
lea rcx, [rbp - 0x78]
call fcn.14001d7f0
nop
lea rdx, [rbp - 0x78]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov r15, qword [rax]
lea rcx, [rbp - 0x78]
call fcn.14000cb60
lea rdx, str.HMODULE_LangDll
lea rcx, [rbp - 0x58]
call fcn.14001d7f0
nop
lea rdx, [rbp - 0x58]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov r14, qword [rax]
lea rcx, [rbp - 0x58]
call fcn.14000cb60
lea rdx, str.HMODULE_CurrentDll
lea rcx, [rbp - 0x38]
call fcn.14001d7f0
nop
lea rdx, [rbp - 0x38]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
xor ebx, ebx
mov qword [rax], rbx
lea rcx, [rbp - 0x38]
call fcn.14000cb60
lea rdx, str.HMODULE_AdditionalDll
lea rcx, [rbp - 0x18]
call fcn.14001d7f0
nop
lea rdx, [rbp - 0x18]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rbx
lea rcx, [rbp - 0x18]
call fcn.14000cb60
lea rdx, str.HMODULE_LangDll
lea rcx, [rsp + 0x68]
call fcn.14001d7f0
nop
lea rdx, [rsp + 0x68]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], rbx
lea rcx, [rsp + 0x68]
call fcn.14000cb60
mov edx, esi
lea rcx, str.WinMain_return__i__n
call fcn.14005cb30
mov edi, ebx
lea rdx, str.SelfFree_LoggerApi
lea rcx, [rbp + 0x98]
call fcn.14001d7f0
nop
lea rdx, [rbp + 0x98]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov rbx, qword [rax]
lea rcx, [rbp + 0x98]
call fcn.14000cb60
test rbx, rbx
je 0x1400565a0
lea rdx, str.SelfFree_LoggerApi
lea rcx, [rbp + 0x98]
call fcn.14001d7f0
nop
lea rdx, [rbp + 0x98]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov rdi, qword [rax]
lea rcx, [rbp + 0x98]
call fcn.14000cb60
lea rdx, str.SelfFree_LoggerApi
lea rcx, [rsp + 0x68]
call fcn.14001d7f0
nop
lea rdx, [rsp + 0x68]
mov rcx, qword [0x1400cb890]
call fcn.140049c00
mov qword [rax], 0
lea rcx, [rsp + 0x68]
call fcn.14000cb60
call fcn.140057070
call fcn.1400572a0
test rdi, rdi
je 0x1400565be
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [0x1400926f0]
mov rcx, qword [0x1400cb890]
test rcx, rcx
je 0x1400565cf
call fcn.1400567b0
lea rcx, [0x1400cb898]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x1400cb860]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test r12, r12
je 0x140056604
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x140056612
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x140056620
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x60], 0
je 0x140056652
cmp dword [rsp + 0x58], 0
je 0x14005664c
test r13d, r13d
je 0x14005664c
lea rcx, [rbp + 0xc0]
call fcn.140012d60
mov rdx, rax
mov ecx, dword [rbp + 0x18]
call fcn.14005b670
jmp 0x140056652
call fcn.14005b5a0
nop
lea rcx, [rbp + 0xc0]
call fcn.140004890
nop
lea rcx, [rbp + 0xe0]
call fcn.140004890
nop
lea rcx, [rbp + 0x58]
call fcn.140004890
nop
lea rcx, [rbp + 0x78]
call fcn.140004890
nop
lea rcx, [rbp + 0x100]
call fcn.140004890
nop
lea rcx, [rbp + 0x120]
call fcn.1400216c0
nop
lea rcx, [rbp + 0x38]
call fcn.14000cb60
mov eax, esi
mov rcx, qword [rbp + 0xe50]
xor rcx, rsp
call fcn.1400625f0
lea r11, [rsp + 0xf60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400695b8
nop
call fcn.1400695b8
int3
call fcn.1400695b8
int3
call fcn.1400695b8
int3
call fcn.1400695b8
int3
call fcn.1400695b8
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0x18]
call fcn.140013500
lea rdx, [0x1400c34b0]
lea rcx, [rbp + 0x18]
call fcn.14006517c
int3
call fcn.1400695b8
int3
call fcn.1400695b8
int3
call fcn.1400695b8
int3