Function at 0x1400109e0
Capabilities:
Accept command line arguments
Check if file exists
Check mutex on windows
Connect to wmi namespace via wbemlocator
Create mailslot
Create thread
Delete file
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get file system object information
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x15b0]
mov eax, 0x16b0
call fcn.140013430
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x15a0], rax
mov rbx, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
mov r14d, esi
mov r15d, esi
mov dword [rsp + 0x78], esi
xor edx, edx
mov r8d, 0x460
lea rcx, [rbp + 0x480]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x460
lea rcx, [rbp + 0x8e0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x460
lea rcx, [rbp + 0x1140]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xf40]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xd40]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetACP]
test eax, eax
je 0x140010ab0
mov ecx, esi
cmp eax, 0x3a4
sete cl
mov dword [0x140022928], ecx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call section..text
mov qword [0x14001bd00], rbx
mov r8d, 0x118
lea rdx, [0x14001c070]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x78]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea r8, str.GlobalHttpEventMultexSW
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140022858], rax
mov ebx, 0x10
test rax, rax
jne 0x140010b26
mov r14d, 0x270e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
jmp 0x140012066
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140010b41
mov r14d, 0x270d
mov r13d, esi
jmp 0x140012066
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x68]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140014a00]
mov qword [rbp - 0x70], rax
mov dword [rbp + 0x1a4], esi
mov qword [rbp + reloc.OLEAUT32.dll_VarUI4FromI8], rsi
mov qword [rbp + 0x1b0], rsi
mov r12d, 1
mov edi, esi
lea edx, [r12 + 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0x1a0], eax
cmp eax, r12d
jbe 0x140010ce9
lea rax, str._CoInitializeEx_Call_Error
mov qword [rbp - 0x70], rax
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14d, 0x3e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea r9, str.ErrorInfo.log
lea r8, [0x14001c070]
lea rdx, str._s_s
lea rcx, [rbp + 0x1140]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, dword [rbp + 0x1a0]
mov r8, qword [rbp - 0x70]
lea rdx, str._s_:_ErrorCode____08X_
lea rcx, [rbp - 0x68]
call qword [sym.imp.USER32.dll_wsprintfW]
movzx eax, word [rbp - 0x74]
movzx ecx, word [rbp - 0x76]
movzx edx, word [rbp - 0x78]
movzx r10d, word [rbp - 0x7a]
movzx r9d, word [rbp - 0x7e]
movzx r8d, word [rbp - 0x80]
mov dword [rsp + 0x48], r13d
lea r11, [rbp - 0x68]
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._d__02d__02d__02d:_02d:_02d__s_Step___d__r_n
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x118
lea rax, [rbp + 0x8e0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsp + 0x60], eax
mov edi, esi
mov dword [rsp + 0x58], esi
test eax, eax
jle 0x140012016
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x1140]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140011fb7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140012016
mov r13d, 3
cmp dword [rbp + 0x1a4], esi
jne 0x140010d52
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 - 4]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rbp + 0x1a0], eax
test eax, eax
je 0x140010d4b
cmp eax, 0x80010119
je 0x140010d4b
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rax, str._CoInitializeSecurity_Call_Error
mov qword [rbp - 0x70], rax
lea ecx, [r13 - 1]
jmp 0x140010ba3
mov dword [rbp + 0x1a4], r12d
cmp qword [rbp + reloc.OLEAUT32.dll_VarUI4FromI8], rsi
jne 0x140010d9e
lea rax, [rbp + reloc.OLEAUT32.dll_VarUI4FromI8]
mov qword [rsp + 0x20], rax
lea r9, [0x1400147b8]
xor edx, edx
lea r8d, [rdx + 7]
lea rcx, [0x1400147c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rbp + 0x1a0], eax
test eax, eax
je 0x140010d9e
lea rax, str._CoCreateInstance_Call_Error
mov qword [rbp - 0x70], rax
mov ecx, r13d
jmp 0x140010ba3
cmp qword [rbp + 0x1b0], rsi
jne 0x140010e24
lea rcx, str.RootCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r12, rax
mov rcx, qword [rbp + reloc.OLEAUT32.dll_VarUI4FromI8]
mov r10, qword [rcx]
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
call qword [r10 + 0x18]
mov edi, eax
mov dword [rbp + 0x1a0], eax
test eax, eax
je 0x140010e0b
lea rax, str._ConnectServer_Call_Error
mov qword [rbp - 0x70], rax
mov qword [rbp + 0x1b0], rsi
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov r12d, esi
test edi, edi
sete r12b
neg edi
sbb edi, edi
and edi, 4
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r12d, r12d
je 0x140010ba9
lea rcx, [rbp - 0x70]
call fcn.140005300
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x140010e50
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + reloc.OLEAUT32.dll_VarUI4FromI8]
test rcx, rcx
je 0x140010e62
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp dword [rbp + 0x1a4], 1
jne 0x140010e72
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + reloc.OLEAUT32.dll_VarUI4FromI8], rsi
mov dword [rbp + 0x1a4], esi
mov r8, rsi
mov ecx, esi
movzx eax, word [0x14001c070]
lea r12, [0x14001c070]
test ax, ax
je 0x140010ecc
mov rdx, rsi
cmp ax, 0x5c
je 0x140010ead
cmp ax, 0x2f
jne 0x140010eb4
movsxd rax, ecx
lea r8, [r12 + rax*2]
inc ecx
inc rdx
movzx eax, word [r12 + rdx*2]
test ax, ax
jne 0x140010ea1
test r8, r8
je 0x140010ecc
mov word [r8], si
lea r9, str.parser_manifest.xml
mov r8, r12
lea rdx, str._s_s
lea rcx, [rbp + 0xf40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, str.regist.txt
mov r8, r12
lea rdx, str._s_s
lea rcx, [rbp + 0xd40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0xf40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp edi, 0xffffffff
jne 0x140010f30
mov r14d, 0x3e0
jmp 0x140012066
lea rcx, [rbp + 0xd40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
xor r9d, r9d
lea rdx, [rbp + 0xd40]
lea rcx, [rbp + 0xf40]
cmp edi, 0xffffffff
jne 0x140010f79
lea r8d, [r9 + 9]
call fcn.14000e3e0
mov r15d, eax
test eax, eax
je 0x140010f96
mov r14d, 0x3e9
jmp 0x140012066
mov r8d, 1
call fcn.14000e3e0
mov r15d, eax
test eax, eax
je 0x140010f96
mov r14d, 0x3ea
jmp 0x140012066
lea r9, str.parserchk.txt
mov r8, r12
lea rdx, str._s_s
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xffffffff
je 0x14001101a
mov dword [0x14001b938], 1
lea r9, str.parsernot.txt
mov r8, r12
lea rdx, str._s_s
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xffffffff
je 0x14001101a
mov dword [0x14001b938], 2
lea rdi, [0x14001c070]
mov r8, rdi
lea rdx, str._sHTTP_Parser.chm
lea rcx, [0x14001c2b0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r12, rsi
lea r8, str.BINTYPE
mov edx, 0x12d
mov rcx, qword [0x14001bd00]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14001116e
xor edx, edx
mov r8d, 0x460
lea rcx, [rbp + 0x480]
call sub.VCRUNTIME140.dll_memset
mov rdx, r15
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
mov rdx, r15
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r15d, eax
test rdi, rdi
je 0x1400110a7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
xor edx, edx
mov r8d, 0x230
lea rcx, [rbp + 0x1c0]
call sub.VCRUNTIME140.dll_memset
test r15d, r15d
jle 0x140011110
lea rdx, [rbp + 0x1c0]
mov ecx, 0x118
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, str.logo.gif
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r8, r12
mov edx, r15d
lea rcx, [rbp + 0x1c0]
call fcn.140002790
test eax, eax
jne 0x140011110
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [0x1400146f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x480]
call qword [sym.imp.OLEAUT32.dll_VarUI4FromI8]
test eax, eax
mov rax, rsi
js 0x140011152
mov rax, qword [rsp + 0x58]
mov qword [0x14001c050], rax
test rdi, rdi
je 0x140011167
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rdi, [0x14001c070]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x878
lea rcx, str..mailslotparser_manage
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov qword [0x14001d088], rax
cmp rax, 0xffffffffffffffff
jne 0x140011328
mov r14d, 0x3e1
lea r15d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
mov qword [0x14001d088], rsi
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea r9, str.ErrorInfo.log
mov r8, rdi
lea rdx, str._s_s
lea rcx, [rbp + 0x1140]
call qword [sym.imp.USER32.dll_wsprintfW]
movzx eax, word [rbp - 0x74]
movzx ecx, word [rbp - 0x76]
movzx edx, word [rbp - 0x78]
movzx r10d, word [rbp - 0x7a]
movzx r9d, word [rbp - 0x7e]
movzx r8d, word [rbp - 0x80]
mov dword [rsp + 0x48], r13d
lea r11, str.Mail_Handle_Create_Error
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._d__02d__02d__02d:_02d:_02d__s___d__r_n
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x118
lea rax, [rbp + 0x8e0]
mov qword [rsp + 0x20], rax
lea r9d, [r15 - 3]
lea r8, [rbp + 0x480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r12d, eax
mov dword [rsp + 0x54], esi
test eax, eax
jle 0x14001131b
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x1140]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400112c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140012066
mov r9d, r15d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14001130a
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x54]
mov r8d, r12d
lea rdx, [rbp + 0x8e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140011303
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp r12d, dword [rsp + 0x54]
je 0x140011312
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140012066
lea rax, str.PARSER_SHARED_MAPMEMORY
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x900000
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [0x140022860], rax
test rax, rax
jne 0x1400114d5
mov r14d, 0x3e1
lea r15d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea r9, str.ErrorInfo.log
mov r8, rdi
lea rdx, str._s_s
lea rcx, [rbp + 0x1140]
call qword [sym.imp.USER32.dll_wsprintfW]
movzx eax, word [rbp - 0x74]
movzx ecx, word [rbp - 0x76]
movzx edx, word [rbp - 0x78]
movzx r10d, word [rbp - 0x7a]
movzx r9d, word [rbp - 0x7e]
movzx r8d, word [rbp - 0x80]
mov dword [rsp + 0x48], r13d
lea r11, str.Map_Handle_Create_Error
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._d__02d__02d__02d:_02d:_02d__s___d__r_n
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x118
lea rax, [rbp + 0x8e0]
mov qword [rsp + 0x20], rax
lea r9d, [r15 - 4]
lea r8, [rbp + 0x480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r12d, eax
mov dword [rsp + 0x68], esi
test eax, eax
jle 0x14001131b
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x1140]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140011485
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140012066
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14001130a
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x68]
mov r8d, r12d
lea rdx, [rbp + 0x8e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400114cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp r12d, dword [rsp + 0x68]
jmp 0x140011308
mov qword [rsp + 0x20], 0x900000
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x14001b910], rax
test rax, rax
jne 0x140011674
mov r14d, 0x3e1
lea r15d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea r9, str.ErrorInfo.log
mov r8, rdi
lea rdx, str._s_s
lea rcx, [rbp + 0x1140]
call qword [sym.imp.USER32.dll_wsprintfW]
movzx eax, word [rbp - 0x74]
movzx ecx, word [rbp - 0x76]
movzx edx, word [rbp - 0x78]
movzx r10d, word [rbp - 0x7a]
movzx r9d, word [rbp - 0x7e]
movzx r8d, word [rbp - 0x80]
mov dword [rsp + 0x48], r13d
lea r11, str.Map_Handle_Create_Error
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._d__02d__02d__02d:_02d:_02d__s___d__r_n
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x118
lea rax, [rbp + 0x8e0]
mov qword [rsp + 0x20], rax
lea r9d, [r15 - 5]
lea r8, [rbp + 0x480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r12d, eax
mov dword [rsp + 0x70], esi
test eax, eax
jle 0x14001131b
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x1140]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140011624
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140012066
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14001130a
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, r12d
lea rdx, [rbp + 0x8e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14001166a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp r12d, dword [rsp + 0x70]
jmp 0x140011308
add rax, 0x100000
mov qword [0x14001c040], rax
mov dword [rsp + 0x58], 8
mov dword [rsp + 0x5c], 0x3ff
lea rcx, [rsp + 0x58]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x1400043e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140011842
mov r14d, 0x3e1
lea r15d, [rax + 5]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea r9, str.ErrorInfo.log
mov r8, rdi
lea rdx, str._s_s
lea rcx, [rbp + 0x1140]
call qword [sym.imp.USER32.dll_wsprintfW]
movzx eax, word [rbp - 0x74]
movzx ecx, word [rbp - 0x76]
movzx edx, word [rbp - 0x78]
movzx r10d, word [rbp - 0x7a]
movzx r9d, word [rbp - 0x7e]
movzx r8d, word [rbp - 0x80]
mov dword [rsp + 0x48], r13d
lea r11, str.sessionSearchThread_Call_Error
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._d__02d__02d__02d:_02d:_02d__s___d__r_n
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x118
lea rax, [rbp + 0x8e0]
mov qword [rsp + 0x20], rax
lea r9d, [r15 - 6]
lea r8, [rbp + 0x480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r12d, eax
mov dword [rsp + 0x50], esi
test eax, eax
jle 0x14001131b
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x1140]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400117f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140012066
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14001130a
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, r12d
lea rdx, [rbp + 0x8e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140011838
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp r12d, dword [rsp + 0x50]
jmp 0x140011308
call fcn.140002260
mov r15, rsi
xor edx, edx
mov r8d, 0x208
lea rdi, [0x14001bdd0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov ecx, esi
mov rdx, rsi
mov eax, 0x5c
lea r12, str._test.html
cmp ax, 0x2e
jne 0x14001187f
movsxd rax, ecx
lea r15, [r12 + rax*2]
inc ecx
inc rdx
movzx eax, word [r12 + rdx*2]
test ax, ax
jne 0x140011872
test r15, r15
je 0x1400118db
mov dword [rsp + 0x50], 0x208
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str.open
mov r8, r15
mov edx, 2
lea ecx, [rdx + 0x1e]
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x1400118cd
cmp dword [rsp + 0x50], 0
jne 0x1400118db
mov r8, rdi
xor edx, edx
mov rcx, r12
call qword [sym.imp.SHELL32.dll_FindExecutableW]
cmp word [0x14001bdd0], 0
cmove rdi, rsi
test rdi, rdi
je 0x140011a82
movzx eax, word [rdi]
test ax, ax
je 0x14001192d
mov rdx, rsi
mov ecx, 1
mov rbx, rsi
cmp ax, 0x5c
jne 0x140011910
movsxd rax, ecx
lea rbx, [rdi + rax*2]
inc ecx
inc rdx
movzx eax, word [rdi + rdx*2]
test ax, ax
jne 0x140011903
mov qword [rsp + 0x58], rbx
test rbx, rbx
mov ebx, 0x10
jne 0x140011936
lea r13, str.msedge.exe
jmp 0x14001193b
mov r13, qword [rsp + 0x58]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x14001bd20], 0xffffffff
mov edi, esi
lea rdx, [0x14001b690]
cmp word [0x14001b690], si
je 0x1400119b4
movsxd r12, eax
mov r15, rdx
nop word [rax + rax]
movsxd rcx, edi
shl rcx, 7
add rcx, rdx
mov r8, r12
mov rdx, r13
call fcn.140002860
test eax, eax
je 0x1400119a5
inc edi
sub r15, 0xffffffffffffff80
cmp word [r15], 0
lea rdx, [0x14001b690]
jne 0x140011970
mov edi, dword [0x14001bd20]
jmp 0x1400119ab
mov dword [0x14001bd20], edi
cmp edi, 0xffffffff
jne 0x140011a82
lea rcx, str.msedge.exe
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x14001bd20], 0xffffffff
mov edi, esi
lea r13, [0x14001b690]
cmp word [0x14001b690], si
je 0x140011a20
movsxd r12, eax
mov r15, r13
movsxd rcx, edi
shl rcx, 7
add rcx, r13
mov r8, r12
lea rdx, str.msedge.exe
call fcn.140002860
test eax, eax
je 0x140011a15
inc edi
sub r15, 0xffffffffffffff80
cmp word [r15], 0
jne 0x1400119e3
mov edi, dword [0x14001bd20]
jmp 0x140011a1b
mov dword [0x14001bd20], edi
cmp edi, 0xffffffff
jne 0x140011a82
lea rcx, str.iexplore.exe
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x14001bd20], 0xffffffff
mov edi, esi
cmp word [0x14001b690], si
je 0x140011a82
movsxd r12, eax
mov r15, r13
nop dword [rax + rax]
movsxd rcx, edi
shl rcx, 7
add rcx, r13
mov r8, r12
lea rdx, str.iexplore.exe
call fcn.140002860
test eax, eax
je 0x140011a7c
inc edi
sub r15, 0xffffffffffffff80
cmp word [r15], 0
jne 0x140011a50
jmp 0x140011a82
mov dword [0x14001bd20], edi
lea r9, str.parsercommon.data
lea r8, [0x14001c070]
lea rdx, str._s_s
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp edi, 0xffffffff
je 0x140011bb3
mov r15d, esi
mov dword [rsp + 0x54], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
mov r8d, 0x310
lea rcx, [0x14001d0e0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000080
mov r8d, 3
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, 0x80000000
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140011b31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140011bc0
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x54]
mov r8d, 0x310
lea rdx, [0x14001d0e0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140011b60
lea edi, [rax - 2]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140011b76
mov edi, dword [rsp + 0x54]
cmp edi, 0x310
je 0x140011b79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [rsp + 0x54]
mov r15d, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
js 0x140011bc0
mov eax, dword [0x14001d0e8]
mov dword [0x14001bd20], eax
mov eax, dword [0x14001d0ec]
mov dword [0x14001a080], eax
mov eax, dword [0x14001d0e4]
mov dword [0x14001b958], eax
cmp byte [0x14001d0e0], 0
jne 0x140011c93
mov dword [0x14001d0e0], 0x3030909
mov eax, dword [0x14001b958]
mov dword [0x14001d0e4], eax
mov eax, dword [0x14001bd20]
mov dword [0x14001d0e8], eax
mov eax, dword [0x14001a080]
mov dword [0x14001d0ec], eax
mov word [0x14001d0f0], 0
mov byte [0x14001d0f2], 0
mov byte [0x14001d0f4], 0
mov edi, esi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140011c4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140011c8b
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0x310
lea rdx, [0x14001d0e0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140011c7a
cmp dword [rsp + 0x50], 0x310
je 0x140011c82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rbp + 0x1c0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8d, [r9 + 0x21]
mov edx, ebx
mov ecx, ebx
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov qword [0x14001bd10], rax
test rax, rax
je 0x140011d10
mov edi, 0x99
nop dword [rax]
movzx edx, di
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov r8d, 1
mov rcx, qword [0x14001bd00]
call qword [sym.imp.USER32.dll_LoadImageW]
mov r8, rax
mov edx, 0xffffffff
mov rcx, qword [0x14001bd10]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
inc edi
cmp edi, 0xb5
jle 0x140011cd0
mov dword [rsp + 0x30], 0x1000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0xff000000
xor r9d, r9d
mov edx, 0x14c
lea r8d, [r9 + 0xf]
mov rcx, qword [0x14001bd00]
call qword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov qword [0x14001c4f0], rax
mov dword [rsp + 0x20], 0x4000
mov r9d, 0x2b8
lea r8, [rbp + 0x1c0]
xor edx, edx
lea rcx, [0x140016998]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [rsp + 0x20], 0x4001
mov r9d, 0x2b8
lea r8, [rbp + 0x1c0]
xor edx, edx
lea rcx, [0x140016998]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rcx, str.RICHED20.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.HHCTRL.OCX
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140011dbb
lea rdx, str.HtmlHelpW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.imm32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140011ddd
lea rdx, str.ImmAssociateContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x8d
mov rcx, qword [0x14001bd00]
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov qword [rsp + 0x20], rsi
lea r9, [0x14000cf20]
xor r8d, r8d
mov edx, 0x259
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov qword [0x14001c6a0], rsi
mov dword [0x14001bd30], esi
lea r8, [0x14001c070]
lea rdx, str._slist.txt
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x7530
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14001d018]
test rcx, rcx
je 0x140011e82
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14001d018]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x14001a08c]
cmp dword [0x14001a090], 5
jne 0x140011eb8
cmp eax, 0xa
jle 0x140011ea7
mov dword [0x14001a07c], 0xa
mov eax, 3
jmp 0x140011ed8
test eax, eax
jle 0x140011eb1
mov dword [0x14001a07c], eax
mov eax, 3
jmp 0x140011ed8
cmp eax, 0xa
jle 0x140011ec9
mov dword [0x14001a07c], 0xa
jmp 0x140011ed3
test eax, eax
jle 0x140011ed3
mov dword [0x14001a07c], eax
mov eax, 2
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp + 0xd40]
lea rcx, [rbp + 0xf40]
call fcn.14000e3e0
xor ecx, ecx
call fcn.140004c60
lea r9, str.sitelink.txt
lea r8, [0x14001c070]
lea rdx, str._s_s
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140011f6d
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140012066
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
mov r8d, 0x5460
lea rdx, [0x14001d3f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140011f9a
lea r15d, [rax - 3]
jmp 0x14001130a
cmp dword [rsp + 0x60], 0x5460
je 0x140011faf
mov r15d, 1
jmp 0x14001130a
mov r15d, esi
jmp 0x140011312
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140012005
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x60]
lea rdx, [rbp + 0x8e0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140011ffb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [rsp + 0x60]
cmp eax, dword [rsp + 0x58]
je 0x14001200d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x140012031
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + reloc.OLEAUT32.dll_VarUI4FromI8]
test rcx, rcx
je 0x140012043
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp dword [rbp + 0x1a4], 1
jne 0x140012052
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + reloc.OLEAUT32.dll_VarUI4FromI8], rsi
mov dword [rbp + 0x1a4], esi
mov rcx, qword [0x14001bd28]
test rcx, rcx
je 0x140012078
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, qword [0x14001c4f0]
test rcx, rcx
je 0x14001208a
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, qword [0x14001bd10]
test rcx, rcx
je 0x14001209c
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, qword [0x14001b910]
test rcx, rcx
je 0x1400120ae
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [0x140022860]
test rcx, rcx
je 0x1400120c0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14001d088]
test rcx, rcx
je 0x1400120d2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140022858]
test rcx, rcx
je 0x1400120e4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14d, 0x3df
jbe 0x1400122dd
cmp r14d, 0x3eb
ja 0x140012217
sub r14d, 0x3e0
je 0x1400121e3
sub r14d, 1
je 0x1400121af
sub r14d, 1
je 0x140012181
sub r14d, 7
je 0x140012156
cmp r14d, 1
jne 0x1400122dd
mov r8d, r15d
lea rcx, [rbp + 0x480]
cmp dword [0x140022928], 0
je 0x14001214a
lea rdx, [0x140016f00]
jmp 0x1400122ad
lea rdx, str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__2_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
jmp 0x1400122ad
mov r8d, r15d
lea rcx, [rbp + 0x480]
cmp dword [0x140022928], 0
je 0x140012175
lea rdx, [0x140016d00]
jmp 0x1400122ad
lea rdx, str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__1_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
jmp 0x1400122ad
lea rcx, [rbp + 0x480]
cmp dword [0x140022928], 0
lea rdx, [0x140016c10]
jne 0x14001219f
lea rdx, str.The_operating_environment_of_the_PC_is_unknown._nAbort_program_execution.
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 0x30
jmp 0x1400122b3
mov r9d, r13d
mov r8d, r15d
lea rcx, [rbp + 0x480]
cmp dword [0x140022928], 0
lea rdx, [0x140016b40]
jne 0x1400121d3
lea rdx, str.OS_state_is_unstable___d_:__d_
call qword [sym.imp.USER32.dll_wsprintfW]
mov ebx, 0x30
jmp 0x1400122b3
lea rcx, [rbp + 0x480]
cmp dword [0x140022928], 0
je 0x140012205
lea rdx, [0x140016a40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1400122b3
lea rdx, str.I_have_a_problem_with_my_module_configuration._n__2___I_cannot_run_the_program.
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1400122b3
sub r14d, 0x3ec
je 0x14001228c
sub r14d, 1
je 0x140012267
sub r14d, 0x2320
je 0x140012239
cmp r14d, 1
jne 0x1400122dd
mov r8d, r13d
lea rcx, [rbp + 0x480]
cmp dword [0x140022928], 0
lea rdx, [0x140017500]
jne 0x14001225a
lea rdx, str.Multiple_Programs_cannot_be_started.___d_
call qword [sym.imp.USER32.dll_wsprintfW]
mov ebx, 0x30
jmp 0x1400122b3
mov r8d, r15d
lea rcx, [rbp + 0x480]
cmp dword [0x140022928], 0
je 0x140012283
lea rdx, [0x140017300]
jmp 0x1400122ad
lea rdx, str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__5_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
jmp 0x1400122ad
mov r8d, r15d
lea rcx, [rbp + 0x480]
cmp dword [0x140022928], 0
lea rdx, [0x140017100]
jne 0x1400122ad
lea rdx, str.There_is_a_defect_in_the_registered_contents_of_the_operating_environment._nI_cannot_run_the_program._n__4_:__d___If_you_want_to_continue_using_it__please_contact_the_developer.
call qword [sym.imp.USER32.dll_wsprintfW]
cmp word [rbp + 0x480], 0
je 0x1400122dd
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov r9d, ebx
lea r8, str._notification_BOX
lea rdx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
mov rcx, qword [rbp + 0x15a0]
xor rcx, rsp
call fcn.140012330
lea r11, [rsp + 0x16b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret