Function at 0x140001700
Capabilities:
Check if file exists
Create directory
Get file attributes
Move file
Set file attributes
Shutdown system

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe88]
sub rsp, 0xf88
xor r13d, r13d
lea rax, [0x140003254]
mov qword [rsp + 0x60], rax
lea rdx, [rbp + 0x590]
lea rax, [0x140003264]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x68], rax
mov r8d, 0x104
lea rax, [0x140003254]
mov dword [rbp + 0xee0], r13d
mov qword [rbp - 0x30], rax
xor ecx, ecx
lea rax, [0x140003264]
mov edi, r13d
mov qword [rbp - 0x28], rax
mov r12d, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
cmp eax, 0x103
ja 0x1400022c6
lea rdx, [rbp + 0x590]
lea rcx, [rbp - 0x10]
call fcn.140005ffc
mov esi, eax
test eax, eax
jne 0x1400017cc
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], r13
lea rcx, [rbp - 0x10]
call fcn.140001308
test eax, eax
jne 0x1400017ba
lea rdi, str.Cant_find_7z_archive
mov qword [rsp + 0x58], rdi
jmp 0x1400017cc
xor r8d, r8d
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x10]
call fcn.140005ef0
mov esi, eax
mov eax, esi
mov r14d, 0xb
neg eax
sbb ebx, ebx
and ebx, r14d
test rdi, rdi
je 0x1400017e8
mov ebx, r14d
jmp 0x14000216d
test esi, esi
jne 0x140002237
cmp dword [0x14000e0c8], r13d
lea r15, [0x14000e510]
jne 0x140001819
mov rcx, qword [0x14000e0d0]
lea edx, [rsi + 0x6f]
mov r9d, 0x104
mov r8, r15
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
lea rcx, [rbp - 0x20]
call fcn.140005d60
xor edx, edx
lea rcx, [rbp]
call fcn.1400068c0
mov rcx, r15
mov qword [rbp + 0x38], r13
mov rdx, r15
movzx eax, word [rdx]
lea rdx, [rdx + 2]
cmp ax, 0x22
je 0x140001837
mov word [rcx], ax
add rcx, 2
test ax, ax
jne 0x140001837
movzx edx, word [0x14000e510]
mov r8d, 1
mov ecx, r13d
jmp 0x140001879
cmp dx, 0x20
mov eax, r8d
cmove eax, ecx
mov ecx, eax
mov eax, r8d
inc r8d
movzx edx, word [r15 + rax*2]
test dx, dx
jne 0x140001862
mov word [r15 + rcx*2], r13w
cmp word [0x14000e510], r13w
jne 0x140001899
lea rcx, str.Incorrect_path
jmp 0x1400022bf
mov rcx, r15
call fcn.140002698
call fcn.14000109c
test eax, eax
mov dword [rbp + 0xee8], eax
mov rcx, r15
mov esi, eax
cmovne ebx, r14d
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
mov qword [rbp - 0x48], r15
test ebx, ebx
jne 0x1400018fc
mov edx, 0x40000
lea rcx, [rsp + 0x60]
call qword [rsp + 0x60]
mov qword [rbp + 0x38], rax
test rax, rax
jne 0x1400018e4
lea ebx, [rax + 2]
jmp 0x1400018fc
lea rax, [rbp - 0x20]
mov qword [rbp + 0x40], 0x40000
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x28], r13
lea rcx, [rbp + 0x80]
call fcn.140004498
test ebx, ebx
jne 0x140002146
lea r9, [rbp - 0x30]
lea r8, [rsp + 0x60]
lea rdx, [rbp]
lea rcx, [rbp + 0x80]
call fcn.14000452c
mov ebx, eax
test eax, eax
jne 0x140002146
or dword [rsp + 0x70], 0xffffffff
lea edi, [rax + 5]
cmp dword [0x14000e0c8], r13d
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x40], r13
mov dword [0x14000e0cc], r13d
jne 0x14000198d
mov rcx, qword [0x14000e0e8]
mov edx, edi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14000e0e0]
mov edx, edi
call qword [sym.imp.USER32.dll_ShowWindow]
mov r9d, dword [rbp + 0xe8]
xor r8d, r8d
mov rcx, qword [0x14000e0e8]
mov edx, 0x406
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp + 0xed0], r13d
cmp dword [rbp + 0xe8], r12d
jbe 0x140001f4b
cmp dword [0x14000e0c8], r12d
mov qword [rbp - 0x68], r12
mov qword [rsp + 0x78], r12
je 0x140001b6e
mov ebx, r13d
xor r8d, r8d
lea rcx, [rbp + 0x80]
mov rdx, rbx
call fcn.140004450
cmp rax, 0x104
jae 0x140001f48
lea rax, [0x14000e510]
mov rdx, rbx
lea r13, [rax + r15*2]
mov r8, r13
lea rcx, [rbp + 0x80]
call fcn.140004450
cmp dword [0x14000e0c8], r12d
jne 0x140001a0e
mov rcx, qword [0x14000e0e0]
mov rdx, r13
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r8d, dword [rbp + 0xed0]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x70]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rdx, [rbp]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0x80]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
call fcn.140004178
mov ebx, eax
test eax, eax
jne 0x140001bd9
lea r15d, [rax + 4]
mov edi, r12d
movzx eax, word [r13]
mov dword [rbp + 0xed8], r15d
test ax, ax
je 0x140001ae0
mov r15, r13
lea rsi, [0x14000e510]
xor r14d, r14d
cmp ax, 0x2f
jne 0x140001ab6
xor edx, edx
mov word [r15], r14w
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140001ab0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov word [r15], 0x5c
inc r12
lea r15, [r12*2]
add r15, r13
movzx eax, word [r15]
test ax, ax
jne 0x140001a91
mov esi, dword [rbp + 0xee8]
mov r14d, 0xb
mov r15d, dword [rbp + 0xed8]
mov eax, dword [rbp + 0xed0]
mov edx, 0x80
mov ecx, eax
mov r12d, eax
and ecx, 7
sar edx, cl
mov ecx, eax
mov rax, qword [rbp + 0xf8]
shr rcx, 3
mov dword [rsp + 0x50], edx
mov qword [rbp - 0x50], rcx
test byte [rcx + rax], dl
je 0x140001bac
xor edx, edx
lea rcx, [0x14000e510]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor r12d, r12d
test eax, eax
jne 0x140001f03
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140001f03
mov rcx, qword [0x14000e0d0]
lea rdx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140001b61
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp qword [0x14000e0d0], r12
je 0x1400022c6
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140001b38
mov rcx, qword [0x14000e0e8]
xor r9d, r9d
mov r8d, r13d
mov edx, 0x402
mov ebx, r13d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400019ba
lea rdx, [0x14000e510]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, edi
test edi, edi
je 0x140001be5
mov dword [rbp + 0xed8], r15d
cmp eax, 0x64
jbe 0x140001c85
mov ebx, r14d
mov r13d, dword [rbp + 0xed0]
jmp 0x140001f4b
lea r15, [0x14000e510]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140006004
mov r15d, eax
test eax, eax
je 0x140001dee
test edi, edi
jne 0x140001de0
lea rdx, str.7_zip.dll
mov rcx, r13
call fcn.14000143c
test rax, rax
jne 0x140001c57
lea rdx, str.7_zip32.dll
mov rcx, r13
call fcn.14000143c
xor r9d, r9d
test rax, rax
jne 0x140001c57
cmp dword [0x14000e0c8], r9d
je 0x140001d35
mov r15d, dword [rbp + 0xed8]
jmp 0x140001c80
lea rcx, [0x14000e510]
call fcn.140001588
xor ecx, ecx
add eax, 0xffeffffd
cmp eax, 0x80002
mov r15d, ecx
seta r15b
inc r15d
mov dword [rbp + 0xed8], r15d
mov edi, 1
lea rdx, [rbp + 0x160]
lea rcx, [0x14000e510]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..tmp
lea rcx, [0x14000e510]
call fcn.140001060
cmp edi, 1
jbe 0x140001d18
lea rcx, [0x14000e510]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, edi
lea rax, [0x14000e510]
mov edx, 1
lea r9, [rax + rcx*2]
mov eax, edi
shr rax, 4
xor r10d, r10d
jmp 0x140001ce5
inc edx
shr rax, 4
test rax, rax
jne 0x140001cdf
mov eax, edx
mov word [r9 + rax*2], r10w
dec edx
mov eax, r8d
and eax, 0xf
shr r8d, 4
cmp eax, 0xa
sbb cx, cx
and cx, 0xfff9
add cx, 0x37
add cx, ax
mov word [r9 + rdx*2], cx
test edx, edx
jne 0x140001cf1
lea rcx, [0x14000e510]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001be5
inc edi
jmp 0x140001bc0
lea rdx, str.Cant_open_file_n
lea r8, [rbp + 0x7a0]
movzx ecx, byte [rdx]
inc rdx
mov word [r8], cx
lea r8, [r8 + 2]
test cl, cl
jne 0x140001d43
lea rdx, [0x14000e510]
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14000b758]
lea rcx, [rbp + 0x7a0]
call fcn.140001060
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdx, [rbp + 0x7a0]
lea rdx, [rdx + rcx*2]
mov ecx, r15d
call fcn.14000152c
mov rcx, qword [0x14000e0d0]
lea r8, str.Error
mov r9d, 0x212
lea rdx, [rbp + 0x7a0]
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 3
je 0x140001f26
mov r15d, dword [rbp + 0xed8]
cmp eax, 5
jne 0x140001bc0
mov edi, 1
jmp 0x140001de2
inc edi
mov r15d, dword [rbp + 0xed8]
jmp 0x140001bc0
mov rdx, qword [rbp - 0x68]
lea r8, [rbp - 0x60]
mov rax, qword [rsp + 0x78]
lea rcx, [rbp - 0x80]
add rdx, qword [rbp - 0x78]
mov qword [rbp - 0x60], rax
call fcn.140005f70
mov esi, eax
mov dword [rbp + 0xee8], eax
mov rax, qword [rsp + 0x78]
xor edx, edx
test esi, esi
jne 0x140001e25
cmp qword [rbp - 0x60], rax
je 0x140001e34
lea rcx, str.Cant_write_output_file
mov ebx, r14d
mov qword [rsp + 0x58], rcx
add dword [0x14000e0cc], eax
mov rax, qword [rbp + 0x120]
mov r15d, dword [rsp + 0x50]
mov r13, qword [rbp - 0x50]
test rax, rax
je 0x140001e7c
test byte [rax + r13], r15b
je 0x140001e7c
mov rcx, qword [rbp + 0x128]
lea r9, [rbp - 0x58]
xor r8d, r8d
mov eax, dword [rcx + r12*8]
mov dword [rbp - 0x58], eax
mov eax, dword [rcx + r12*8 + 4]
mov rcx, qword [rbp - 0x80]
mov dword [rbp - 0x54], eax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
lea rcx, [rbp - 0x80]
call fcn.140005dc0
test ebx, ebx
jne 0x140001bd9
test eax, eax
jne 0x140001f41
mov rax, qword [rbp + 0x110]
test rax, rax
je 0x140001ec4
test byte [rax + r13], r15b
lea r15, [0x14000e510]
je 0x140001ecb
mov rdx, qword [rbp + 0x118]
mov rcx, r15
mov edx, dword [rdx + r12*4]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140001ecb
lea r15, [0x14000e510]
xor r12d, r12d
test edi, edi
je 0x140001f03
lea r8d, [r12 + 5]
mov rcx, r15
lea rdx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140001f30
mov r12d, dword [rbp + 0xee0]
or r12d, dword [rbp + 0xed8]
mov dword [rbp + 0xee0], r12d
xor r12d, r12d
mov r13d, dword [rbp + 0xed0]
inc r13d
mov dword [rbp + 0xed0], r13d
cmp r13d, dword [rbp + 0xe8]
jae 0x140001f4b
mov r15, qword [rbp - 0x48]
jmp 0x1400019a1
mov ebx, 0x64
jmp 0x140001bd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, dword [rbp + 0xed0]
mov esi, eax
jmp 0x140001f52
mov esi, eax
jmp 0x140001bd9
mov ebx, r14d
lea r15, [0x14000e510]
mov rdx, qword [rbp - 0x78]
lea rcx, [rsp + 0x60]
call qword [rsp + 0x68]
xor edi, edi
cmp dword [0x14000e0c8], edi
jne 0x140001f81
mov rcx, qword [0x14000e0e8]
xor r9d, r9d
mov r8d, r13d
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rbp - 0x48]
mov word [r15 + rax*2], di
cmp r13d, dword [rbp + 0xe8]
jne 0x140002137
mov rcx, 0xffffffff80000001
call fcn.1400027dc
mov rcx, 0xffffffff80000002
call fcn.1400027dc
mov rdi, 0xffffffff80000000
lea r9, str.7_Zip_Shell_Extension
mov rcx, rdi
lea rdx, str.CLSID23170F69_40C1_278A_1000_000100020000
xor r8d, r8d
call fcn.1400025c4
xor r13d, r13d
lea rax, [rbp + 0xed0]
mov qword [rsp + 0x40], r13
lea rdx, str.CLSID23170F69_40C1_278A_1000_000100020000InprocServer32
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0xf023f
mov rcx, rdi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000206e
mov rdx, r15
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.7_zip32.dll
lea rcx, [rbp + 0x160]
call fcn.140001060
mov rcx, qword [rbp + 0xed0]
lea r8, [rbp + 0x160]
xor edx, edx
call fcn.140002640
mov rcx, qword [rbp + 0xed0]
lea r8, str.Apartment
lea rdx, str.ThreadingModel
call fcn.140002640
mov rcx, qword [rbp + 0xed0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, str.7_Zip_Shell_Extension
xor r8d, r8d
lea rdx, str.CLSID23170F69_40C1_278A_1000_000100020000
mov rcx, rdi
call fcn.140002568
lea r8, [rbp + 0xed0]
mov qword [rbp + 0xed0], r13
lea rdx, str.CLSID23170F69_40C1_278A_1000_000100020000InprocServer32
mov rcx, rdi
call fcn.140002534
test eax, eax
jne 0x140002107
mov rdx, r15
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.7_zip.dll
lea rcx, [rbp + 0x160]
call fcn.140001060
mov rcx, qword [rbp + 0xed0]
lea r8, [rbp + 0x160]
xor edx, edx
call fcn.140002640
mov rcx, qword [rbp + 0xed0]
lea r8, str.Apartment
lea rdx, str.ThreadingModel
call fcn.140002640
mov rcx, qword [rbp + 0xed0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140002ec8
mov rcx, qword [0x14000e0d0]
call fcn.140002844
cmp dword [0x14000e0c8], r13d
jne 0x14000213a
mov rcx, qword [0x14000e0e0]
lea rdx, str.7_Zip_24.05__x64__is_installed
call qword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x14000213a
xor r13d, r13d
mov rdi, qword [rsp + 0x58]
mov r12d, dword [rbp + 0xee0]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140004368
mov rdx, qword [rbp + 0x38]
lea rcx, [rsp + 0x60]
call qword [rsp + 0x68]
lea rcx, [rbp - 0x10]
call fcn.140005dc0
test esi, esi
jne 0x140002237
mov r14d, ebx
test ebx, ebx
jne 0x140002237
cmp dword [0x14000e0c8], r13d
jne 0x140002230
cmp r12d, 1
jle 0x140002230
mov rcx, qword [0x14000e0d0]
lea r8, str.7_Zip_24.05__x64__Setup
mov r9d, 0x104
lea rdx, str.You_must_restart_your_system_to_complete_the_installation._nRestart_now_
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x140002230
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0xed0]
lea edx, [rsi + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002230
lea r8, [rbp - 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp + 0xed0]
lea r8, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], r13
xor edx, edx
mov dword [rbp - 0x40], 1
mov dword [rbp - 0x34], 2
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140002230
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor eax, eax
jmp 0x1400022cb
cmp dword [0x14000e0c8], r13d
jne 0x1400022c6
test esi, esi
je 0x140002269
lea rdx, [rbp + 0x160]
mov word [rbp + 0x160], r13w
mov ecx, esi
call fcn.14000152c
lea rdx, [rbp + 0x160]
xor ecx, ecx
jmp 0x1400022c1
cmp r14d, 0x64
jne 0x140002275
lea eax, [r14 - 0x62]
jmp 0x1400022cb
cmp r14d, 4
jne 0x140002284
lea rcx, str.Decoder_doesnt_support_this_archive
jmp 0x1400022bf
cmp r14d, 2
jne 0x140002293
lea rcx, str.Cant_allocate_required_memory
jmp 0x1400022bf
cmp r14d, 3
jne 0x1400022a2
lea rcx, str.CRC_error
jmp 0x1400022bf
cmp r14d, 1
jne 0x1400022b1
lea rcx, str.Data_error
jmp 0x1400022bf
test rdi, rdi
lea rcx, str.ERROR
cmovne rcx, rdi
xor edx, edx
call fcn.140002730
mov eax, 1
add rsp, 0xf88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret