Function at 0x14000a230
Capabilities:
Check mutex on windows
Get system information on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xfa8]
mov eax, 0x1080
call fcn.14003d0d0
sub rsp, rax
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0xf70], rax
xor r13d, r13d
mov r14, rcx
cmp dword [0x1400502e0], 3
mov ebx, r13d
jne 0x14000a5de
call fcn.140017a28
test eax, eax
jne 0x14000a352
mov rcx, qword [0x140050310]
lea esi, [rax + 2]
cmp rcx, 0xffffffffffffffff
jne 0x14000a2b4
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a2de
cmp dword [0x1400516e0], esi
jl 0x14000a2de
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x27
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_user_is_not_an_admin._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x44a
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x14000a2fc
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
test r14, r14
je 0x14000a707
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r15d, 0x400
mov edx, 0x9d
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae7b
lea edx, [r15 - 0x18]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x125
jmp 0x14000a6ce
call fcn.14001737c
mov rcx, rax
movabs rax, 0x624dd2f1a9fbe77
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
and rcx, 0xfffffffffffffc00
cmp rcx, 0xc800
ja 0x14000a44c
mov rcx, qword [0x140050310]
mov esi, 2
cmp rcx, 0xffffffffffffffff
jne 0x14000a3ae
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a3d8
cmp dword [0x1400516e0], esi
jl 0x14000a3d8
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x38
mov qword [rsp + 0x20], r13
lea rdx, str.Uninstall_denied:_User_does_not_have_enough_diskspace._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x44a
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x14000a3f6
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
test r14, r14
je 0x14000a707
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r15d, 0x400
mov edx, 0x99
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae7b
lea edx, [r15 - 0x18]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x14b
jmp 0x14000a6ce
cmp dword [0x140051658], r13d
lea rcx, [rsp + 0x38]
mov edx, r13d
mov qword [rsp + 0x38], r13
sete dl
xor r8d, r8d
call fcn.1400035c8
mov r12, qword [rsp + 0x38]
movsxd r13, eax
test r13d, r13d
jle 0x14000a5c8
mov rcx, qword [0x140050310]
mov esi, 2
cmp rcx, 0xffffffffffffffff
jne 0x14000a4a2
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a4cd
cmp dword [0x1400516e0], esi
jl 0x14000a4cd
xor esi, esi
lea r9, [rsp + 0x30]
lea rdx, str.UnInstall_denied:_Blocking_dependencies_found._r_n
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14000a4cf
xor esi, esi
mov edi, 1
test r14, r14
je 0x14000a563
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r15d, 0x400
mov edx, 0x115
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000a565
lea edx, [r15 - 0x18]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [0x140051658], esi
lea r8, [rsp + 0x70]
mov rcx, qword [0x140050d10]
mov r9d, r15d
mov edx, 0x116
jne 0x14000a53d
mov edx, 0xbb
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x14000a565
mov edx, 0x3eb
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, edi
mov edx, 0x44a
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r14, r13
xor r13d, r13d
mov r15, rax
test rax, rax
je 0x14000a5a6
test r14, r14
jle 0x14000a5c8
mov esi, r13d
mov r9, qword [r12 + rsi*8]
xor r8d, r8d
mov edx, 0x180
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
add rsi, rdi
cmp rsi, r14
jl 0x14000a589
test r14, r14
jle 0x14000a5c8
mov rsi, r13
mov rcx, qword [r12 + rsi*8]
test rcx, rcx
je 0x14000a5c0
call fcn.14003c408
mov qword [r12 + rsi*8], r13
add rsi, rdi
cmp rsi, r14
jl 0x14000a5ae
test r12, r12
je 0x14000ae7b
mov rcx, r12
call fcn.14003c408
jmp 0x14000ae7b
lea rax, section..data
cmp rax, qword [str.6ij]
jne 0x14000a711
cmp qword [0x140051660], r13
je 0x14000ae7b
call fcn.140013fc4
test rax, rax
je 0x14000ae7b
call fcn.140013fc4
mov rcx, rax
call fcn.140026cf0
test eax, eax
jne 0x14000ae7b
call fcn.140017a28
test eax, eax
jne 0x14000ae7b
mov rcx, qword [0x140050310]
lea esi, [rax + 2]
cmp rcx, 0xffffffffffffffff
jne 0x14000a653
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a67d
cmp dword [0x1400516e0], esi
jl 0x14000a67d
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x2f
mov qword [rsp + 0x20], r13
lea rdx, str.Service_Install_denied:_user_is_not_an_admin._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000a707
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r15d, 0x400
mov edx, 0x9d
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae7b
lea edx, [r15 - 0x18]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x159
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae7b
mov edx, 0x3eb
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 1
jmp 0x14000ae7b
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, 6
mov r15d, 0x400
lea edi, [rax - 5]
lea esi, [rax - 4]
cmp ax, word [rsp + 0x40]
jne 0x14000a7e4
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000a759
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a783
cmp dword [0x1400516e0], esi
jl 0x14000a783
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x2d
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_the_OS_Arch_does_not_match._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.140026508
neg eax
sbb r12d, r12d
neg r12d
test r14, r14
je 0x14000a8b5
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x138
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000a8b7
mov edx, 0x3e8
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea edx, [r12 + 0x139]
jmp 0x14000a880
call fcn.140002268
test eax, eax
je 0x14000a8b7
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000a812
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a83c
cmp dword [0x1400516e0], esi
jl 0x14000a83c
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x30
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_Loc_version_already_installed._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000a8b5
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x14e
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000a8b7
mov edx, 0x3e8
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x14f
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000a8b7
mov edx, 0x3eb
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, edi
call fcn.140009ce4
test eax, eax
jne 0x14000a9b4
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000a8e5
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a90f
cmp dword [0x1400516e0], esi
jl 0x14000a90f
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x3d
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_OS_version_is_greater_than_package_version._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ae79
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9b
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae7b
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x770]
mov r9d, 0x208
mov edx, 0x9c
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000a990
lea r8, [rbp + 0x770]
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.140002480
jmp 0x14000a993
mov eax, r13d
test eax, eax
je 0x14000ae7b
lea edx, [rbx + 0x3eb]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x70]
jmp 0x14000ae70
call fcn.140003d68
test eax, eax
jne 0x14000aacd
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000a9e2
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000aa0c
cmp dword [0x1400516e0], esi
jl 0x14000aa0c
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x3b
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_a_newer_version_is_already_on_the_system._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ae79
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9b
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae7b
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x770]
mov r9d, 0x208
mov edx, 0x9c
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000aa8d
lea r8, [rbp + 0x770]
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.140002480
jmp 0x14000aa90
mov eax, r13d
test eax, eax
je 0x14000ae7b
lea edx, [rbx + 0x3eb]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea r8, [rsp + 0x70]
mov ecx, esi
lea rdx, str._S._r_n
call fcn.1400168a8
jmp 0x14000ae79
lea rdx, [rsp + 0x30]
mov word [rsp + 0x30], r13w
lea rcx, [0x140043308]
call fcn.14001a9e8
test eax, eax
je 0x14000abbd
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x409
cmp cx, word [rsp + 0x30]
je 0x14000abbd
cmp cx, ax
jne 0x14000abbd
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000ab2c
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000ab56
cmp dword [0x1400516e0], esi
jl 0x14000ab56
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x58
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_this_is_a_MUI_system_for_which_a_localized_package_should_not_be_used._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ae79
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9f
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae7b
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0xa0
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
jmp 0x14000a993
lea r8, str.GlobalServicePackOrHotfix
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
cmove r13d, edi
test r12, r12
je 0x14000abf7
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
test r13d, r13d
je 0x14000aca0
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000ac24
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000ac4e
cmp dword [0x1400516e0], esi
jl 0x14000ac4e
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r12d
mov r8d, 0x34
mov qword [rsp + 0x20], r12
lea rdx, str.Another_Update.exe_package_is_running_on_the_box.__r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ae79
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x143
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae7b
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x142
jmp 0x14000aba3
call fcn.140017a28
test eax, eax
jne 0x14000ad72
cmp qword [0x140050310], 0xffffffffffffffff
jne 0x14000acbe
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000acf5
cmp dword [0x1400516e0], esi
jl 0x14000acf5
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r12d
mov r8d, 0x27
mov qword [rsp + 0x20], r12
lea rdx, str.Install_denied:_user_is_not_an_admin._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ad70
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ad72
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9e
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ad72
lea edx, [rbx + 0x3eb]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
add ebx, edi
movsd xmm0, qword [0x140050cd0]
comisd xmm0, xmmword [0x140049d48]
jbe 0x14000ae7b
cmp qword [0x140050310], 0xffffffffffffffff
jne 0x14000ad99
mov edx, esi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000add0
cmp dword [0x1400516e0], esi
jl 0x14000add0
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], r12d
mov r8d, 0x3b
mov qword [rsp + 0x20], r12
lea rdx, str.Install_denied:_user_does_not_have_sufficient_disk_space._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ae79
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x99
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae7b
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9a
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae7b
cvttsd2si r9, qword [0x140050cd0]
lea r8, [rsp + 0x70]
mov rdx, r15
lea rcx, [rbp + 0x770]
add r9d, edi
call fcn.140001734
test eax, eax
js 0x14000ae7b
lea edx, [rbx + 0x3eb]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rbp + 0x770]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
add ebx, edi
mov eax, ebx
mov rcx, qword [rbp + 0xf70]
xor rcx, rsp
call fcn.14003c810
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret