Function at 0x403620
Capabilities:
Check os version
Contain obfuscated stackstrings
Query environment variable
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1de8
call fcn.004395f0
sub rsp, rax
xor r15d, r15d
mov rbp, rcx
mov ebx, 0x1388
mov rcx, rbx
mov qword [0x0046a040], r15
mov qword [rsp + 0xb8], r15
mov byte [rsp + 0x80], r15b
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x228], rax
call fcn.00417210
mov rcx, rbx
mov rsi, rax
mov qword [rsp + 0xf0], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x230], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x200], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x1e8], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0xf8], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x1e0], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0xd8], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x120], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x130], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x220], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x88], rax
mov byte [rsp + 0xb0], r15b
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x128], rax
call fcn.00417210
mov rcx, rbx
mov qword [rsp + 0x100], rax
call fcn.00417210
mov qword [rsp + 0x238], rax
call fcn.00401250
lea r14d, [r15 + 1]
cmp al, r15b
je 0x4037a9
lea rdx, [rsp + 0x208]
lea rcx, [0x0046a020]
xor r8d, r8d
mov dword [rsp + 0x208], r14d
mov qword [rsp + 0x210], r15
mov dword [rsp + 0x218], r15d
mov dword [rsp + 0x21c], r15d
call sub.gdiplus.dll_GdiplusStartup
lea rdx, [0x0044dfa8]
lea rcx, [rsp + 0x240]
mov r8d, 0x40
mov byte [rsp + 0x240], r15b
call fcn.004183b0
call fcn.0040b2f0
mov dil, 0x5c
mov rcx, rbp
mov qword [rsp + 0xe0], rax
mov byte [rsp + 0x162], 9
mov byte [rsp + 0x163], 0x7a
mov byte [rsp + 0x164], 0x3e
mov byte [rsp + 0x165], 0x2f
mov byte [rsp + 0x166], 0x2e
mov byte [rsp + 0x167], 0xfa
mov byte [rsp + 0x168], 0xff
mov byte [rsp + 0x169], 0x1d
mov byte [rsp + 0x16a], 0xf0
mov byte [rsp + 0x16b], 0x9b
mov byte [rsp + 0x16c], 0x19
mov byte [rsp + 0x16d], 0x7c
mov byte [rsp + 0x16e], 0x15
mov byte [rsp + 0x16f], 0xb8
mov byte [rsp + 0x170], 0x1e
mov byte [rsp + 0x171], 0x6d
mov byte [rsp + 0x172], 0xc6
mov byte [rsp + 0x173], 0x10
mov byte [rsp + 0x174], 0x41
mov byte [rsp + 0x175], 0x7e
mov byte [rsp + 0x176], dil
mov byte [rsp + 0x177], 0xed
mov byte [rsp + 0x178], 0x51
mov byte [rsp + 0x179], 0xb1
mov byte [rsp + 0x17a], 0x19
mov byte [rsp + 0x17b], 0x1c
mov byte [rsp + 0x17c], 0x3c
mov byte [rsp + 0x17d], 0xe2
mov byte [rsp + 0x17e], 0x94
mov byte [rsp + 0x17f], 0xd8
mov byte [rsp + 0x140], 0x59
mov byte [rsp + 0x141], 0xbd
mov byte [rsp + 0x142], 0xc9
mov byte [rsp + 0x143], 0x52
mov byte [rsp + 0x144], 0xaa
mov byte [rsp + 0x145], 0x35
mov byte [rsp + 0x146], 0xad
mov byte [rsp + 0x147], 0xbb
mov byte [rsp + 0x148], 0x10
mov byte [rsp + 0x149], 0xef
mov byte [rsp + 0x14a], 0xde
mov byte [rsp + 0x14b], 0x67
mov byte [rsp + 0x14c], 0x2c
mov byte [rsp + 0x14d], 0x47
mov byte [rsp + 0x14e], 0xe0
mov byte [rsp + 0x14f], 0xb5
mov byte [rsp + 0x150], 0xd4
mov byte [rsp + 0x151], 0x82
mov byte [rsp + 0x152], 0x1f
mov byte [rsp + 0x153], 0x81
mov byte [rsp + 0x154], 0x52
mov byte [rsp + 0x155], 0xa1
mov byte [rsp + 0x156], 2
mov byte [rsp + 0x157], 0x44
mov byte [rsp + 0x158], 0x2a
mov byte [rsp + 0x159], 0xeb
mov byte [rsp + 0x15a], 0xaa
mov byte [rsp + 0x15b], 0x7b
mov byte [rsp + 0x15c], 0x79
mov byte [rsp + 0x15d], 0x3b
mov byte [rsp + 0x15e], 0x93
mov byte [rsp + 0x15f], 0x45
mov byte [rsp + 0x160], 0xae
mov byte [rsp + 0x161], 0xd2
call fcn.00417420
mov ebx, 0x400
cmp rax, 3
jb 0x403a13
cmp byte [rbp], dil
jne 0x4039fa
cmp byte [rbp + 1], dil
je 0x403a06
cmp byte [rbp + 1], 0x3a
jne 0x403a13
cmp byte [rbp + 2], dil
jne 0x403a13
mov rdi, rbp
mov qword [rsp + 0x110], rbp
jmp 0x403a3b
mov rcx, rbx
call fcn.00417210
mov edx, ebx
mov rcx, rax
mov rdi, rax
mov qword [rsp + 0x110], rax
call fcn.0041b020
mov rdx, rbp
mov rcx, rdi
call fcn.0040bf34
lea rcx, str._Extractor__The_absolute_wrapper_path_is__s_n
mov rdx, rdi
call fcn.0040bfd4
lea rcx, str._Extractor__The_executable_name_is__s_n
mov rdx, rbp
call fcn.0040bfd4
mov ecx, 0x800
call fcn.00417210
mov rdx, rdi
mov rcx, rax
mov rbx, rax
mov byte [rax], r15b
call fcn.004174e0
mov rcx, rbx
mov edi, r15d
mov r12d, r15d
call fcn.00417420
cmp eax, r15d
jle 0x403aa6
mov r13, rbx
cmp byte [r13], 0x5c
mov rcx, rbx
cmove edi, r12d
add r12d, r14d
add r13, r14
call fcn.00417420
cmp r12d, eax
jl 0x403a8a
movsxd rax, edi
lea rdx, [0x0044c898]
mov rcx, rbp
mov byte [rax + rbx], r15b
call fcn.00418fe0
cmp rax, r15
mov rbx, rax
jne 0x403adc
lea rcx, str._Extractor___Failed_to_extract_wrapper_params___couldnt_open_file__s_n
mov rdx, rbp
call fcn.0040bfd4
mov ecx, r14d
call fcn.00418900
int3
lea r9, str.Params
lea rdx, [rsp + 0x140]
mov r8d, 0x40
mov rcx, rax
call fcn.0040be6c
cmp eax, 0xffffffff
jne 0x403b07
mov ecx, r14d
call fcn.00418900
int3
mov rcx, rbx
call fcn.00409d98
lea rcx, str._Extractor__Found_Params_marker._Extracting_now..._n
mov rbx, rax
mov qword [rsp + 0xc0], rax
call fcn.0040bfd4
mov edi, 0x30d40
mov rcx, rdi
call fcn.00417210
mov r8, rdi
xor edx, edx
mov rcx, rax
mov qword [rsp + 0xd0], rax
call fcn.004191f0
xor r9d, r9d
lea rdx, str.Params_Count
lea r8d, [r9 + 0x28]
mov r12b, r15b
mov r13b, r15b
mov rcx, rbx
mov byte [rsp + 0x84], r15b
mov dword [rsp + 0xa0], r12d
mov dword [rsp + 0x98], r13d
call fcn.0040a230
cmp rax, r15
jne 0x403b89
mov r14d, 0xffffffff
jmp 0x403b94
mov rcx, rax
call fcn.00418e40
mov r14d, eax
lea rcx, [0x0044e050]
mov dword [rsp + 0x90], r14d
call fcn.0040bfd4
lea rcx, [0x0044e058]
call fcn.0040bfd4
lea rcx, str._Processing__d_dynamic_properties_n
mov edx, r14d
call fcn.0040bfd4
lea rcx, [0x0044e058]
call fcn.0040bfd4
test r14d, r14d
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0xc8], rax
jle 0x4041a9
mov rsi, qword [rsp + 0x88]
mov ebp, dword [rsp + 0x98]
lea rdx, str.Param_Name
xor r9d, r9d
mov r8d, 0x400
mov rcx, rbx
call fcn.0040a230
lea rdx, str.Param_Value
xor r9d, r9d
mov r8d, 0x30d40
mov rcx, rbx
mov rdi, rax
call fcn.0040a230
mov rcx, rax
mov rbx, rax
call fcn.00417420
cmp rax, 0x64
jbe 0x403c6f
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x140]
mov r8d, 0x63
call fcn.00419070
mov byte [rsp + 0x1a3], 0
lea r9, [rsp + 0x140]
lea rcx, str._DynProps__Dynamic_Param__d:__s__s...__n
jmp 0x403c79
mov r9, rbx
lea rcx, str._DynProps__Dynamic_Param__d:__s__s__n
mov r8, rdi
mov edx, r15d
call fcn.0040bfd4
mov r13, qword [rsp + 0xd0]
lea rdx, str.jwdyna_
mov rcx, r13
call fcn.0040a064
mov rdx, rdi
mov rcx, r13
call fcn.0040a0f4
mov rdx, rbx
mov rcx, r13
call fcn.0040a064
lea rdx, str.update_url
mov rcx, rdi
call fcn.004196f0
test eax, eax
jne 0x403cdb
lea rcx, str._DynProps__Dynamic_Update_URL:__s_n
mov rdx, rbx
mov qword [rsp + 0xc8], rbx
call fcn.0040bfd4
lea rdx, str.match_versions
mov rcx, rdi
call fcn.004196f0
test eax, eax
jne 0x403d07
lea rdx, str.true
mov rcx, rbx
call fcn.004196f0
test eax, eax
sete byte [rsp + 0x80]
lea rdx, str.wrapper_autotest
mov rcx, rdi
call fcn.004196f0
mov ecx, dword [rsp + 0xb0]
mov r13d, 1
movzx ecx, cl
test eax, eax
lea rdx, str.show_no_ui
cmove ecx, r13d
mov dword [rsp + 0xb0], ecx
mov rcx, rdi
call fcn.004196f0
test eax, eax
jne 0x403d6c
lea rdx, str.true
mov rcx, rbx
call fcn.004196f0
mov ecx, dword [rsp + 0x84]
movzx ecx, cl
test eax, eax
cmove ecx, r13d
mov dword [rsp + 0x84], ecx
lea rdx, str.repair
mov rcx, rdi
call fcn.004196f0
test eax, eax
jne 0x403da0
lea rdx, str.true
mov rcx, rbx
call fcn.004196f0
movzx r12d, r12b
test eax, eax
cmove r12d, r13d
mov dword [rsp + 0xa0], r12d
lea rdx, str.reinstall
mov rcx, rdi
call fcn.004196f0
test eax, eax
jne 0x403dcc
lea rdx, str.true
mov rcx, rbx
call fcn.004196f0
movzx ebp, bpl
test eax, eax
cmove ebp, r13d
lea rdx, str.force_spawn
mov rcx, rdi
call fcn.004196f0
test eax, eax
jne 0x403dfb
lea rdx, str.true
mov rcx, rbx
call fcn.004196f0
xor ecx, ecx
test eax, eax
sete cl
mov dword [0x0046a050], ecx
lea rdx, str.splash_buffer
mov rcx, rdi
call fcn.004196f0
test eax, eax
jne 0x403e29
mov rcx, rbx
call fcn.00417420
test rax, rax
je 0x403e29
mov rcx, rbx
call fcn.00418e40
mov dword [0x0046a168], eax
lea rdx, str.splash_image
mov rcx, rdi
call fcn.004196f0
test eax, eax
jne 0x40406b
mov rcx, rbx
call fcn.00417420
mov rdx, rbx
cmp rax, 0x64
jae 0x403e5a
lea rcx, str._DynProps__Splash_Image_is__s_n
jmp 0x403e84
lea rcx, [rsp + 0x140]
mov r8d, 0x63
call fcn.00419070
mov byte [rsp + 0x1a3], 0
lea rdx, [rsp + 0x140]
lea rcx, str._DynProps__Splash_Image_is__s..._n
call fcn.0040bfd4
lea rcx, str._DynProps__Base64_decoding_image..._n
call fcn.0040bfd4
mov rcx, rbx
call fcn.00417420
mov r12, qword [0x0046a058]
test r12, r12
mov r13, rax
jne 0x403ee2
mov ecx, 0x100
call fcn.00417210
xor edx, edx
mov r12, rax
mov qword [0x0046a058], rax
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea r8d, [rdx + 1]
movsx rcx, byte [rax]
add rax, r8
mov byte [rcx + r12], dl
add edx, r8d
cmp edx, 0x40
jl 0x403ecd
jmp 0x403ee8
mov r8d, 1
test r13b, 3
je 0x403f0b
lea rcx, str._Extractor__Base64_deconding_failed_as_input_length_is_not_aligned_n
call fcn.0040bfd4
mov qword [rsp + 0xb8], 0
jmp 0x404057
mov rax, r13
shr rax, 2
lea rcx, [rax + rax*2]
mov qword [rsp + 0xa8], rcx
cmp byte [r13 + rbx - 1], 0x3d
jne 0x403f31
sub rcx, r8
mov qword [rsp + 0xa8], rcx
cmp byte [r13 + rbx - 2], 0x3d
jne 0x403f44
sub rcx, r8
mov qword [rsp + 0xa8], rcx
call fcn.00417210
test rax, rax
mov qword [rsp + 0xb8], rax
jne 0x403f6c
lea rdx, [rsp + 0xa8]
lea rcx, str._Extractor__Base64_deconding_failed_as_malloc_failed_to_init__d_n
call fcn.0040bfd4
jmp 0x403efa
xor ecx, ecx
xor r8d, r8d
test r13, r13
je 0x404057
mov r9, rax
lea esi, [rcx + 1]
mov r10b, 0x3d
cmp byte [rcx + rbx], r10b
jne 0x403f8d
xor edx, edx
jmp 0x403f97
movsx rax, byte [rcx + rbx]
movsx edx, byte [rax + r12]
add ecx, esi
cmp byte [rcx + rbx], r10b
jne 0x403fa4
xor r14d, r14d
jmp 0x403fae
movsx rax, byte [rcx + rbx]
movsx r14d, byte [rax + r12]
add ecx, esi
cmp byte [rcx + rbx], r10b
jne 0x403fbb
xor r11d, r11d
jmp 0x403fc5
movsx rax, byte [rcx + rbx]
movsx r11d, byte [rax + r12]
add ecx, esi
cmp byte [rcx + rbx], r10b
jne 0x403fd2
xor r10d, r10d
jmp 0x403fdc
movsx rax, byte [rcx + rbx]
movsx r10d, byte [rax + r12]
shl edx, 6
mov eax, r8d
add ecx, esi
add edx, r14d
shl edx, 6
add edx, r11d
shl edx, 6
add edx, r10d
cmp rax, qword [rsp + 0xa8]
jae 0x40400b
mov eax, edx
add r8d, esi
shr eax, 0x10
mov byte [r9], al
add r9, rsi
mov eax, r8d
cmp rax, qword [rsp + 0xa8]
jae 0x404026
mov eax, edx
add r8d, esi
shr eax, 8
mov byte [r9], al
add r9, rsi
mov eax, r8d
cmp rax, qword [rsp + 0xa8]
jae 0x40403c
mov byte [r9], dl
add r8d, esi
add r9, rsi
mov eax, ecx
cmp rax, r13
jb 0x403f80
mov r14d, dword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0xa8]
lea rcx, str._DynProps__Decode_complete__image_size_is__d__n
call fcn.0040bfd4
lea rdx, str.jre_name
mov rcx, rdi
call fcn.004196f0
test eax, eax
jne 0x40409a
mov rdx, rbx
mov rcx, rsi
mov byte [rsi], al
call fcn.004174e0
lea rcx, str._DynProps__JRE_name_from_dynamic_launch_properties_is__s_n
mov rdx, rsi
call fcn.0040bfd4
lea rdx, str.windows_app_id
mov rcx, rdi
call fcn.004196f0
test eax, eax
jne 0x40416d
lea rcx, str._DynProps__Windows_APP_ID_is__s_n
mov rdx, rbx
call fcn.0040bfd4
lea rcx, str._Extractor__Asked_to_set_the_Windows_APP_ID_to__s_n
mov rdx, rbx
call fcn.0040bfd4
lea rcx, str._Extractor__Loading_shell32_n
call fcn.0040bfd4
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov r12, rax
je 0x40416d
lea rcx, str._Extractor__Finding_procedure_address_for_SetCurrentProcessExplicitAppUserModelID_n
call fcn.0040bfd4
lea rdx, str.SetCurrentProcessExplicitAppUserModelID
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r13, rax
je 0x404164
mov rcx, rbx
call fcn.00409fb4
lea rcx, str._Extractor__Setting_app_ID_to__S___s__n
mov r8, rbx
mov rdx, rax
mov rdi, rax
call fcn.0040bfd4
mov rcx, rdi
call r13
test eax, eax
jne 0x404149
lea rcx, str._Extractor__Set_App_ID_OK_n
call fcn.0040bfd4
jmp 0x40415c
lea rdx, str.SetCurrentProcessExplicitAppUserModelID
lea rcx, str.Extractor
call fcn.0040af24
mov rcx, rdi
call fcn.004171d0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0xc0]
mov r12d, dword [rsp + 0xa0]
add r15d, 1
cmp r15d, r14d
jl 0x403bf7
mov rsi, qword [rsp + 0xf0]
mov dword [rsp + 0x98], ebp
mov rbp, qword [rsp + 0x1e30]
mov r13d, dword [rsp + 0x98]
mov rcx, rbx
call fcn.00407e74
lea rcx, str.Processing_dynamic_properties
call fcn.0040c1d8
cmp byte [rsp + 0x1e58], 0
je 0x4041d3
lea rcx, str._Extractor__This_is_an_elevated_run_purely_to_prepare_an_installation._Will_not_show_UI_or_launch_an_app_n
call fcn.0040bfd4
lea rcx, [0x0044e050]
call fcn.0040bfd4
lea rcx, str.Extracting_wrapper_tail
call fcn.0040c1a0
lea rdx, [0x0044c898]
mov rcx, rbp
call fcn.00418fe0
test rax, rax
mov rbx, rax
jne 0x40421a
lea rcx, str._Extractor___Failed_to_extract_wrapper_tail___couldnt_open_file__s_n
mov rdx, rbp
call fcn.0040bfd4
lea ecx, [rbx + 1]
call fcn.00418900
int3
mov rdx, qword [rsp + 0xe0]
lea r9, str.Tail
mov r8d, 0x80
mov rcx, rax
call fcn.0040be6c
cmp eax, 0xffffffff
jne 0x404245
lea ecx, [rax + 2]
call fcn.00418900
int3
lea rcx, str._Extractor__Found_tail_marker_n
call fcn.0040bfd4
mov rcx, rbx
call fcn.00409d98
mov r15d, 0x400
lea rdx, str.App_Name
xor r9d, r9d
mov r8d, r15d
mov rcx, rax
mov r12, rax
mov qword [rsp + 0x98], rax
call fcn.0040a230
lea rdx, str.App_Version
xor r9d, r9d
mov r8d, r15d
mov rcx, r12
mov qword [rsp + 0x118], rax
call fcn.0040a230
lea rdx, str.JRE_Version
xor r9d, r9d
mov r8d, r15d
mov rcx, r12
mov qword [rsp + 0x90], rax
call fcn.0040a230
lea rdx, str.GU_Version
xor r9d, r9d
mov r8d, r15d
mov rcx, r12
mov qword [rsp + 0x1f8], rax
call fcn.0040a230
lea rdx, str.Min_Splash_MS
xor r9d, r9d
mov r8d, r15d
mov rcx, r12
mov qword [rsp + 0x1f0], rax
call fcn.0040a230
lea rdx, str.Signature_Public_Key
xor r9d, r9d
mov r8d, 0x2000
mov rcx, r12
mov qword [rsp + 0xc0], rax
call fcn.0040a230
lea rdx, str.Can_Override_Splash
xor r9d, r9d
mov r8d, r15d
mov rcx, r12
mov rbp, rax
call fcn.0040a230
lea rdx, str.Install_Type
xor r9d, r9d
mov r8d, r15d
mov rcx, r12
mov qword [rsp + 0xf0], rax
call fcn.0040a230
lea rdx, str.Silent_Parameter
xor r9d, r9d
mov r8d, r15d
mov rcx, r12
mov r14, rax
call fcn.0040a230
lea rdx, str.Required_Java_Version
xor r9d, r9d
mov r8d, r15d
mov rcx, r12
mov rbx, rax
call fcn.0040a230
lea rdx, str.Update_URL
xor r9d, r9d
mov r8d, 0x1388
mov rcx, r12
mov qword [rsp + 0x108], rax
call fcn.0040a230
xor r9d, r9d
lea rdx, str.Skip_System_JRE
lea r8d, [r9 + 2]
mov rcx, r12
mov r15, rax
mov qword [rsp + 0xe8], rax
call fcn.0040a230
xor r9d, r9d
mov qword [rsp + 0xe0], rax
lea r8d, [r9 + 0x14]
lea rdx, str.Repair_Parameter
mov rcx, r12
call fcn.0040a230
xor r9d, r9d
lea rdx, str.Reinstall_Parameter
lea r8d, [r9 + 0x14]
mov rcx, r12
mov rdi, rax
call fcn.0040a230
mov r12, rax
mov rax, qword [rsp + 0x108]
test rax, rax
je 0x404421
mov rcx, rax
call fcn.00417420
test rax, rax
je 0x404421
mov rdx, qword [rsp + 0x108]
lea rcx, str._Extractor__Required_Java_version__s_n
call fcn.0040bfd4
mov rax, qword [rsp + 0xe0]
test rax, rax
je 0x404447
mov rcx, rax
call fcn.00417420
test rax, rax
je 0x404447
lea rcx, str._Extractor__Skipping_System_JRE_n
call fcn.0040bfd4
lea rdx, [0x0044ce2c]
mov rcx, r15
call fcn.004196f0
test eax, eax
jne 0x40446b
mov r15, qword [rsp + 0xc8]
lea rcx, str._Extractor__Will_use_Dynamic_Update_URL:__s_n
jmp 0x404472
lea rcx, str._Extractor__Will_use_Static_Update_URL:__s_n
mov rdx, r15
call fcn.0040bfd4
cmp byte [rsp + 0x84], 0
jne 0x4044a2
mov r8, qword [rsp + 0x1e40]
mov edx, dword [rsp + 0x1e38]
mov rcx, rbx
call fcn.00402e70
mov byte [rsp + 0x84], al
cmp byte [rsp + 0xa0], 0
jne 0x4044cf
mov r8, qword [rsp + 0x1e40]
mov edx, dword [rsp + 0x1e38]
mov rcx, rdi
call fcn.00402e70
mov dil, al
mov dword [rsp + 0xa0], edi
jmp 0x4044d6
mov edi, dword [rsp + 0xa0]
test r13b, r13b
jne 0x4044f5
mov r8, qword [rsp + 0x1e40]
mov edx, dword [rsp + 0x1e38]
mov rcx, r12
call fcn.00402e70
mov r13b, al
movzx edx, byte [rsp + 0x84]
lea rcx, str._Extractor__Silent_install_is__d_n
call fcn.0040bfd4
lea rcx, str._Extractor__Repair_install_is__d_n
movzx edx, dil
call fcn.0040bfd4
lea rcx, str._Extractor__Reinstall_is__d_n
movzx edx, r13b
call fcn.0040bfd4
lea rcx, str.Extracting_tail
call fcn.0040c1d8
lea rcx, str._Extractor__Setting_up_static_properties_n
call fcn.0040bfd4
mov rdi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe8]
lea rdx, str.update_url
mov rcx, rdi
call fcn.0040a160
lea rdx, str.install_type
mov r8, r14
mov rcx, rdi
call fcn.0040a160
mov r8, qword [rsp + 0xc0]
lea rdx, str.min_splash_ms
mov rcx, rdi
call fcn.0040a160
lea rdx, str.jwsig_public_key
mov r8, rbp
mov rcx, rdi
call fcn.0040a160
mov r8, qword [rsp + 0xf0]
lea rdx, str.can_override_splash
mov rcx, rdi
call fcn.0040a160
mov r8, qword [rsp + 0x118]
lea rdx, str.app_name
mov rcx, rdi
call fcn.0040a160
mov r8, qword [rsp + 0x90]
lea rdx, str.wrapper_app_version
mov rcx, rdi
call fcn.0040a160
mov r12, qword [rsp + 0x1f0]
lea rdx, str.wrapper_gu_version
mov r8, r12
mov rcx, rdi
call fcn.0040a160
lea rdx, str.silent_parameter
mov r8, rbx
mov rcx, rdi
call fcn.0040a160
mov r8, qword [rsp + 0x108]
lea rdx, str.java_version
mov rcx, rdi
call fcn.0040a160
mov r8, qword [rsp + 0xe0]
lea rdx, str.skip_system_jre
mov rcx, rdi
call fcn.0040a160
cmp byte [rsp + 0x84], 0
je 0x40465a
lea r8, str.true
lea rdx, str.show_no_ui
mov rcx, rdi
call fcn.0040a160
test rbp, rbp
je 0x404704
mov rcx, rbp
call fcn.00417420
mov rcx, rbp
test rax, rax
je 0x4046e8
call fcn.00417420
mov rbx, rax
shr rbx, 1
add rbx, 2
mov rcx, rbx
call fcn.00417210
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.004191f0
mov r8, rbp
mov edx, ebx
mov rcx, rdi
call fcn.0040b504
lea rcx, str._Extractor__Processed_public_key_of_length__d_n
mov edx, eax
mov ebx, eax
call fcn.0040bfd4
lea rcx, str._Extractor__Hex:__s_n
mov rdx, rbp
call fcn.0040bfd4
mov edx, ebx
mov rcx, rdi
call fcn.00401048
lea rcx, str._Extractor__Public_Key:__08X_n
mov rdx, rax
mov qword [0x0046a040], rax
call fcn.0040bfd4
jmp 0x404710
call fcn.00417420
xor ebp, ebp
cmp rax, rbp
ja 0x404712
lea rcx, str._Extractor__Public_key_length__d__no_public_key__n
xor edx, edx
call fcn.0040bfd4
jmp 0x404712
lea rcx, str._Extractor__Public_key_empty__no_public_key__n
call fcn.0040bfd4
xor ebp, ebp
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
cmp eax, ebp
jne 0x4047ad
lea rcx, str.Permanent_install_for_all_users_n
call fcn.0040bfd4
lea rcx, [rsp + 0x140]
mov dword [rsp + 0x140], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, ebp
je 0x40476a
cmp dword [rsp + 0x144], 5
jbe 0x40476a
lea rcx, str.PROGRAMDATA
call fcn.0041b740
jmp 0x4047d8
lea rcx, str.ALLUSERSPROFILE
call fcn.0041b740
mov ecx, 0x1388
mov rbx, rax
call fcn.00417210
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], bpl
call fcn.004174e0
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.0040bf34
mov rcx, rdi
call fcn.0040beec
jmp 0x4047db
lea rdx, str.perm_user
mov rcx, r14
call fcn.004196f0
lea rcx, str.Permanent_install_for_current_user_n
cmp eax, ebp
je 0x4047ce
lea rcx, str.Temporary_install_n
call fcn.0040bfd4
call fcn.0040bc68
mov rdi, rax
cmp rdi, rbp
jne 0x4047f7
lea rcx, str.ERROR:_Unable_to_get_shared_dir_
call fcn.0040bfd4
mov ecx, 1
call fcn.00418900
int3
lea rcx, str._Extractor__Shared_dir_is__s_n
mov rdx, rdi
call fcn.0040bfd4
lea rcx, str._Extractor__Update_URL_is_currently__s_n
mov rdx, r15
call fcn.0040bfd4
mov rcx, r15
call fcn.00417420
cmp eax, ebp
jle 0x404835
cdqe
cmp byte [rax + r15 - 1], 0x2f
je 0x404835
mov byte [rax + r15], 0x2f
mov byte [rax + r15 + 1], bpl
lea rcx, str._Extractor__Update_URL_is_now__s_n
mov rdx, r15
call fcn.0040bfd4
mov rdx, rdi
mov rcx, rsi
mov byte [rsi], bpl
call fcn.004174e0
lea rdx, str.JWrapper_
mov rcx, rsi
call fcn.0040bf34
mov rdx, qword [rsp + 0x118]
mov rcx, rsi
call fcn.004174e0
lea rcx, str._Extractor__Master_folder_is__s_n
mov rdx, rsi
call fcn.0040bfd4
cmp r13b, bpl
jne 0x404893
cmp byte [rsp + 0xa0], bpl
je 0x404955
mov rcx, rsi
call fcn.0040b710
cmp eax, ebp
je 0x404955
cmp r13b, bpl
je 0x4048c1
lea rcx, str._Extractor__Performing_reinstall...
call fcn.0040bfd4
mov rcx, rsi
call fcn.0040b58c
jmp 0x404955
mov rcx, rsi
call fcn.004010b0
cmp rax, rbp
mov rdi, rax
je 0x404955
lea rcx, str._Extractor__Performing_repair...
call fcn.0040bfd4
jmp 0x40493d
mov rcx, qword [rbx]
call fcn.00417420
cmp rax, 2
jbe 0x40493d
mov rdx, qword [rbx]
lea rcx, str.JWrapper_
call fcn.0040c520
cmp al, bpl
je 0x40493d
mov rbx, qword [rbx]
lea rcx, [rsp + 0x250]
mov rdx, rsi
mov byte [rsp + 0x250], bpl
call fcn.004174e0
lea rcx, [rsp + 0x250]
mov rdx, rbx
call fcn.0040bf34
lea rcx, [rsp + 0x250]
call fcn.0040b58c
mov rcx, rdi
call fcn.004011f4
cmp rax, rbp
mov rbx, rax
jne 0x4048e3
mov rcx, rdi
call fcn.004011a4
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
lea rcx, [rsp + 0xa0]
mov edi, ebp
cmp eax, ebp
sete dil
call fcn.0041bb20
lea rcx, [rsp + 0xa0]
call fcn.0041b410
mov r13d, 0x400
lea rcx, [rsp + 0x250]
mov r8, r13
xor edx, edx
mov rbx, rax
call fcn.004191f0
lea r8, str._Y__m__d__H__M__S
lea rcx, [rsp + 0x250]
mov r9, rbx
mov rdx, r13
call fcn.0041abd0
lea rcx, [rsp + 0x208]
call fcn.0041b470
movzx r9d, word [rsp + 0x210]
cmp eax, ebp
je 0x4049d8
mov r9d, ebp
lea r8, [rsp + 0x250]
lea rdx, str._s__03d.log
lea rcx, [rsp + 0x250]
call fcn.004183b0
mov rcx, rsi
call fcn.0040beec
mov rdx, rsi
mov ecx, edi
call fcn.004012d0
lea rcx, [rsp + 0x650]
mov rdx, rsi
mov byte [rsp + 0x650], bpl
call fcn.004174e0
lea rdx, str.logs
lea rcx, [rsp + 0x650]
call fcn.0040bf34
lea rdx, str.Wrapper_
lea rcx, [rsp + 0x650]
call fcn.0040bf34
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x650]
call fcn.004174e0
lea rdx, [rsp + 0x650]
lea rcx, str._Extractor__Logging_to__s_n
call fcn.0040bfd4
lea r8, [0x0044c554]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x208]
call fcn.00418ff0
lea rcx, str._Extractor__Opening_the_file_for_writing_returned__d_n
mov edx, eax
call fcn.0040bfd4
mov rbx, qword [rsp + 0x230]
mov r11, qword [rsp + 0x208]
mov rcx, rbx
mov rdx, rsi
mov qword [0x0046a170], r11
mov byte [rbx], bpl
call fcn.004174e0
lea rdx, str.JWApps
mov rcx, rbx
call fcn.0040bf34
mov rdi, qword [rsp + 0x200]
mov rdx, rbx
mov rcx, rdi
mov byte [rdi], bpl
call fcn.004174e0
lea rdx, str.JreNameOverride
mov rcx, rdi
call fcn.0040bf34
lea rdx, [0x0044d630]
mov rcx, rdi
call fcn.00418fe0
cmp rax, rbp
mov rdi, rax
je 0x404b90
lea rcx, str._JREOverride__Processing_JRE_Override_file__JreNameOverride__n
call fcn.0040bfd4
lea rdx, str.JRE_Override_App_Name
mov r8d, 0x1f4
mov rcx, rdi
call fcn.0040a19c
cmp rax, rbp
mov rbx, rax
je 0x404b68
mov rcx, rax
call fcn.00417420
cmp rax, 1
jne 0x404b52
cmp byte [rbx], 0x2d
jne 0x404b52
lea rcx, str._JREOverride__Ignoring_JRE_name____keeping__s_n
jmp 0x404b97
mov rcx, rbx
call fcn.00417420
cmp rax, rbp
jne 0x404b68
lea rcx, str._JREOverride__Ignoring_empty_JRE_name__keeping__s_n
jmp 0x404b97
mov rbp, qword [rsp + 0x88]
mov rdx, rbx
mov rcx, rbp
mov byte [rbp], 0
call fcn.004174e0
mov rcx, rdi
call fcn.0041b8c0
lea rcx, str._JREOverride__JRE_name_overriden_to__s_n
jmp 0x404b9f
lea rcx, str._JREOverride__No_JRE_name_override__will_continue_to_use__s_n
mov rbp, qword [rsp + 0x88]
mov rdx, rbp
call fcn.0040bfd4
mov rcx, r12
mov r13b, 1
call fcn.00417420
test rax, rax
jne 0x404bc8
lea rcx, str._Extractor__No_GenericUpdater_embedded__we_are_just_a_launcher_n
call fcn.0040bfd4
xor r13b, r13b
jmp 0x404bd7
lea rcx, str._Extractor__GenericUpdater_version_is__s_n
mov rdx, r12
call fcn.0040bfd4
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
call fcn.00417420
test rax, rax
jne 0x404bfa
lea rcx, str._Extractor__ONLINE_wrapper:_No_App_embedded__GU_will_download_and_run_n
call fcn.0040bfd4
jmp 0x404c09
lea rcx, str._Extractor__OFFLINE_wrapper:_App_version_is__s_n
mov rdx, rbx
call fcn.0040bfd4
lea rcx, str._Extractor__Checking_for_a_latest_valid_GU_n
call fcn.0040bfd4
lea rdx, str.JWrapper
mov rcx, rsi
call fcn.0040c34c
mov rdx, rbp
mov rcx, rsi
mov r12, rax
call fcn.0040c34c
test r12, r12
mov rbp, rax
je 0x404cfe
test r13b, r13b
je 0x404cfe
mov rdx, r12
mov rcx, rsi
call fcn.0040139c
test eax, eax
jne 0x404cfe
mov ebx, 0x800
mov rcx, rbx
call fcn.00417210
mov rdx, rsi
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.004174e0
mov rdx, r12
mov rcx, rdi
call fcn.0040bf34
mov rcx, rbx
call fcn.00417210
mov rdx, rsi
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call fcn.004174e0
lea rdx, str.Damaged
mov rcx, rbx
call fcn.0040bf34
mov rcx, rbx
call fcn.0040b6c0
test eax, eax
jne 0x404cbf
mov rcx, rbx
call fcn.0040beec
lea r8, str.Damaged
mov r9, r12
mov rdx, rsi
mov rcx, rbx
call fcn.0040bf9c
mov rdx, rbx
mov rcx, rdi
call fcn.00401530
lea rcx, str._Extractor__The_existing_JWrapper_install_is_broken._Instructing_the_wrapper_to_update._n
call fcn.0040bfd4
mov rcx, rdi
xor r12d, r12d
call fcn.004171d0
mov rcx, rbx
call fcn.004171d0
test rbp, rbp
je 0x404ee3
test r13b, r13b
je 0x404ee3
mov ecx, 0x800
call fcn.00417210
lea r9, [0x0044c494]
mov r8, rbp
mov rcx, rax
mov rdx, rsi
mov rdi, rax
call fcn.0040bf9c
lea rdx, str.java.exe
mov rcx, rdi
call fcn.0040bf34
mov rcx, rdi
call fcn.0040b6c0
xor ebx, ebx
lea r9, [0x0044c494]
test eax, eax
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
setne bl
call fcn.0040bf9c
lea rdx, str.javaw.exe
mov rcx, rdi
call fcn.0040bf34
test ebx, ebx
je 0x404d8b
mov rcx, rdi
call fcn.0040b6c0
test eax, eax
je 0x404d8b
mov ebx, 1
jmp 0x404d8d
xor ebx, ebx
lea r9, [0x0044c36c]
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.0040bf9c
lea rdx, str.rt.jar
mov rcx, rdi
call fcn.0040bf34
mov rcx, rdi
call fcn.0040b6c0
test eax, eax
jne 0x404e02
lea r9, [0x0044c368]
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.0040bf9c
lea rdx, [0x0044c36c]
mov rcx, rdi
call fcn.0040bf34
lea rdx, str.rt.jar
mov rcx, rdi
call fcn.0040bf34
test ebx, ebx
je 0x404e00
mov rcx, rdi
call fcn.0040b6c0
test eax, eax
jne 0x404e06
xor ebx, ebx
test ebx, ebx
je 0x404e4e
lea rcx, [rsp + 0xa50]
mov rdx, rsi
mov byte [rsp + 0xa50], 0
call fcn.004174e0
lea rcx, [rsp + 0xa50]
mov rdx, rbp
call fcn.0040bf34
lea rcx, [rsp + 0xa50]
call fcn.0040afe0
test rax, rax
je 0x404e4e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x404edb
mov rdx, rsi
mov rcx, rdi
mov byte [rdi], 0
call fcn.004174e0
mov rdx, rbp
mov rcx, rdi
call fcn.0040bf34
mov ecx, 0x800
call fcn.00417210
mov rdx, rsi
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call fcn.004174e0
lea rdx, str.Damaged
mov rcx, rbx
call fcn.0040bf34
mov rcx, rbx
call fcn.0040b6c0
test eax, eax
jne 0x404ea5
mov rcx, rbx
call fcn.0040beec
lea r8, str.Damaged
mov r9, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.0040bf9c
mov rdx, rbx
mov rcx, rdi
call fcn.00401530
lea rcx, str._Extractor__The_existing_JRE_is_broken._Instructing_the_wrapper_to_update._n
call fcn.0040bfd4
mov rcx, rbx
xor ebp, ebp
call fcn.004171d0
mov rcx, rdi
call fcn.004171d0
test r12, r12
je 0x405084
test rbp, rbp
je 0x405084
lea rcx, str._Extractor__Latest_GU_version_exists:__s_n
mov rdx, r12
call fcn.0040bfd4
lea rcx, str._Extractor__Existing_JRE_exists:__s_n
mov rdx, rbp
call fcn.0040bfd4
mov rcx, r12
call fcn.0040c5b8
mov rdi, qword [rsp + 0x1f0]
mov rcx, rdi
mov ebx, eax
call fcn.00418e40
test r13b, r13b
je 0x404f47
cmp eax, ebx
jle 0x404f47
lea rcx, str._Extractor__Our_GU_version_is_newer_than_existing_latest_version_so_will_extract_and_run_n
call fcn.0040bfd4
jmp 0x405098
lea rcx, str._Extractor__Latest_GUversion_is_newer_or_same_as_our_version_so_will_just_run_n
call fcn.0040bfd4
test r13b, r13b
je 0x404fb6
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
call fcn.00417420
test rax, rax
je 0x404fb6
mov rdx, qword [rsp + 0x118]
mov rcx, rsi
call fcn.0040c34c
test rax, rax
je 0x405076
mov rcx, rax
call fcn.0040c5b8
mov rcx, qword [rsp + 0x90]
mov ebx, eax
call fcn.00418e40
cmp eax, ebx
jle 0x404faa
lea rcx, str._Extractor__Our_App_version_is_newer_than_existing_latest_version_so_will_extract_and_run_n
jmp 0x404f3d
lea rcx, str._Extractor__Latest_App_version_is_newer_or_same_as_our_version_so_will_just_run_n
call fcn.0040bfd4
lea rcx, str._Extractor__Running_without_extraction_now_n
call fcn.0040bfd4
call fcn.00406df8
mov rcx, qword [rsp + 0x98]
call fcn.00407e74
xor edx, edx
cmp byte [rsp + 0x1e58], dl
jne 0x40506e
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x128]
mov r9, qword [rsp + 0x1e40]
mov r8d, dword [rsp + 0x1e38]
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x68], dl
mov qword [rsp + 0x60], rax
mov al, byte [rsp + 0x80]
mov qword [rsp + 0x58], r14
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0xc0]
mov rcx, rsi
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov dword [rsp + 0x40], edx
mov rdx, qword [rsp + 0xd0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call fcn.00401ce4
xor ecx, ecx
call fcn.00418900
int3
lea rcx, str._Extractor__No_app_version_found_and_we_are_offline_so_will_extract_n
call fcn.0040bfd4
jmp 0x4050a0
lea rcx, str._Extractor__No_latest_GU_or_JRE_version_exists__will_check_tail_for_online_offline_info_n
call fcn.0040bfd4
mov rdi, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x90]
test rbp, rbp
lea rcx, str._Extractor__Note:_No_latest_JRE_version_exists_n
je 0x4050b3
lea rcx, str._Extractor__Note:_Latest_JRE_version_does_exist_n
call fcn.0040bfd4
test r12, r12
lea rcx, str._Extractor__Note:_No_latest_GU_version_exists_n
je 0x4050cb
lea rcx, str._Extractor__Note:_Latest_GU_version_does_exist_n
call fcn.0040bfd4
test r13b, r13b
jne 0x4050ec
lea rcx, str._Extractor__Unable_to_run__we_are_just_a_launcher__n
call fcn.0040bfd4
mov ecx, 1
call fcn.00418900
int3
mov rcx, rsi
call fcn.0040beec
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
test eax, eax
jne 0x405161
lea rdx, [rsp + 0x200]
lea rcx, str.S_1_5_32_545
call sub.ADVAPI32.dll_ConvertStringSidToSidA
lea rcx, str._Utils__Converted_SID_n
test eax, eax
jne 0x40512d
lea rcx, str._Utils__Unable_to_convert_SID_n
call fcn.0040bfd4
mov r8, qword [rsp + 0x200]
xor r9d, r9d
mov dword [rsp + 0x30], 3
lea edx, [r9 + 1]
mov rcx, rsi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x1200a9
call fcn.0040b948
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
xor ecx, ecx
mov rdx, rsi
test eax, eax
sete cl
call fcn.004012d0
mov r9, rdi
mov rdi, qword [rsp + 0xf8]
lea r8, str.JWrapper
mov rdx, rsi
mov rcx, rdi
call fcn.004019a0
mov r13, qword [rsp + 0xd8]
mov rdx, rsi
mov rcx, r13
call fcn.00401a08
mov r8, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x1e8]
mov r9, rbx
mov rdx, rsi
call fcn.004019a0
mov rcx, qword [rsp + 0x1e0]
mov rdx, rsi
call fcn.00401a08
lea rcx, str._Extractor__GU_folder_is__s_n
mov rdx, rdi
call fcn.0040bfd4
lea rcx, str._Extractor__GU_temp_is__s_n
mov rdx, r13
call fcn.0040bfd4
mov rcx, r13
call fcn.0040beec
test eax, eax
je 0x40521b
lea rcx, str._Extractor__Unable_to_create_GU_Temp_folder___assuming_elevation_required_n
call fcn.0040bfd4
mov ecx, 1
call fcn.00418900
int3
mov rbx, qword [rsp + 0x98]
mov rdx, r13
mov rcx, rbx
call fcn.0040a41c
mov ecx, 0x7d0
call fcn.00417210
mov rdx, r13
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.004174e0
lea rdx, str.nativesplash.png
mov rcx, rdi
call fcn.0040bf34
mov r11, rdi
movsx eax, byte [r11]
cmp eax, 0x2f
jne 0x405268
mov byte [r11], 0x5c
add r11, 1
test eax, eax
jne 0x40525b
mov rax, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xa8]
test rax, rax
je 0x405321
lea rdx, [0x0044da20]
mov rcx, rax
call fcn.004196f0
test eax, eax
jne 0x405321
lea rcx, str._Extractor__Authorised_to_override_the_splash_image._n
call fcn.0040bfd4
xor edx, edx
lea rcx, str._Extractor__DynamicSplash_is__d__size_is__d_n
cmp qword [rsp + 0xb8], rdx
mov r8, r13
setne dl
call fcn.0040bfd4
cmp qword [rsp + 0xb8], 0
je 0x405321
test r13, r13
je 0x405321
lea rcx, str._Extractor__Overwriting_splash_image_at__s_n
mov rdx, rdi
call fcn.0040bfd4
lea rdx, [0x0044c8f0]
mov rcx, rdi
call fcn.00418fe0
mov rcx, qword [rsp + 0xb8]
mov r8, r13
mov r9, rax
mov edx, 1
mov rbx, rax
call fcn.0041ad70
mov rcx, rbx
call fcn.0041b8c0
mov rbx, qword [rsp + 0x98]
mov rcx, rdi
call fcn.004171d0
mov rdi, qword [rsp + 0xd8]
mov rcx, rbx
mov rdx, rdi
call fcn.0040a41c
mov rdx, rdi
mov rcx, rbx
call fcn.0040a41c
mov rdx, rdi
mov rcx, rbx
call fcn.0040a41c
lea rcx, str._Extractor__Extracted_GU_and_GU_Version_n
call fcn.0040bfd4
mov r13, qword [rsp + 0xf8]
lea rcx, str._Extractor__Renaming_GU_folder_to__s_n
mov rdx, r13
call fcn.0040bfd4
mov rdx, r13
mov rcx, rdi
call fcn.00401530
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
xor ecx, ecx
mov rdx, r13
test eax, eax
sete cl
call fcn.00401280
lea rcx, str._Extractor__Recreating_GU_location_n
call fcn.0040bfd4
mov rdx, r13
mov rcx, rdi
mov byte [rdi], 0
call fcn.004174e0
mov rax, qword [rsp + 0x100]
mov rcx, rax
mov rdx, r13
mov byte [rax], 0
call fcn.004174e0
mov rcx, qword [rsp + 0x100]
lea rdx, str.cacerts
call fcn.0040bf34
mov rdx, qword [rsp + 0x100]
lea rcx, str._Extractor__CACerts_override_path_is__s_n
call fcn.0040bfd4
mov rax, qword [rsp + 0x128]
mov rdx, rdi
mov rcx, rax
mov byte [rax], 0
call fcn.004174e0
mov rcx, qword [rsp + 0x128]
lea rdx, str.verpatch.exe
call fcn.0040bf34
mov rdi, qword [rsp + 0x238]
mov rdx, r13
mov rcx, rdi
mov byte [rdi], 0
call fcn.004174e0
lea rdx, str.nativesplash.png
mov rcx, rdi
call fcn.0040bf34
lea rcx, str._Extractor__Native_Splash_PNG_path_is__s_n
mov rdx, rdi
call fcn.0040bfd4
lea rcx, str._Extractor__Configuring_splash_n
call fcn.0040bfd4
mov rcx, rdi
call fcn.00406e48
lea rcx, str._Extractor__Showing_splash_n
call fcn.0040bfd4
cmp byte [rsp + 0x84], 0
mov r13b, byte [rsp + 0x1e58]
jne 0x405490
test r13b, r13b
jne 0x405490
call fcn.00406efc
mov ecx, 0xffffffff
call fcn.00407000
test rbp, rbp
je 0x405554
mov rcx, qword [rsp + 0x1f8]
call fcn.00417420
mov rcx, rbp
test rax, rax
je 0x405536
call fcn.0040c5b8
mov rcx, qword [rsp + 0x1f8]
mov edi, eax
call fcn.00418e40
lea rcx, str._Extractor__Existing_JRE_is__ld_vs_bundled__ld_n
mov r8d, eax
mov edx, edi
mov ebx, eax
call fcn.0040bfd4
cmp edi, ebx
jge 0x4054f1
lea rcx, str._Extractor___Offline__Clearing_existing_JRE_so_that_it_will_be_extracted_n
call fcn.0040bfd4
xor ebp, ebp
mov rbx, qword [rsp + 0x98]
test rbp, rbp
je 0x405554
mov rdi, qword [rsp + 0x130]
xor r13d, r13d
mov rdx, rsi
mov rcx, rdi
mov byte [rdi], r13b
call fcn.004174e0
mov rdx, rbp
mov rcx, rdi
call fcn.0040bf34
lea rcx, str._Extractor__Using_existing_JRE_of__s_n
mov rdx, rdi
call fcn.0040bfd4
jmp 0x405c25
call fcn.0040c5b8
cmp eax, 0x327f4a9
jg 0x4054f9
lea rcx, str._Extractor___Online__Clearing_existing_JRE_so_that_it_will_be_extracted___ld__n
mov edx, eax
call fcn.0040bfd4
xor ebp, ebp
jmp 0x4054f9
lea rcx, str._Extractor__Setting_up_a_JRE__switched:_d__n
xor edx, edx
call fcn.0040bfd4
mov rdi, qword [rsp + 0x1f8]
mov rcx, rdi
call fcn.00417420
test rax, rax
je 0x4056cb
lea rcx, str.Extracting_Offline_JRE
call fcn.0040c1a0
lea rcx, str._Extractor__We_want_to_query_the_JRE_version_to_enable_proxy_detection._n
call fcn.0040bfd4
mov rbp, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xd8]
mov r8, rbp
mov rdx, r15
call fcn.00402f1c
mov r12, qword [rsp + 0x120]
mov rdx, rsi
mov rcx, r12
call fcn.00401a08
mov rcx, r12
call fcn.0040beec
mov rcx, qword [rsp + 0x130]
mov r9, rdi
mov r8, rbp
mov rdx, rsi
call fcn.004019a0
lea rcx, str._Extractor__Offline_installer___no_need_to_download_JRE__will_extract_n
call fcn.0040bfd4
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
xor r13d, r13d
mov rdx, r12
cmp eax, r13d
sete cl
call fcn.004014c4
lea rcx, str._Extractor__UP200_path_is__s_n
mov rdx, rax
mov qword [0x0046a048], rax
call fcn.0040bfd4
lea rcx, str._Extractor__Extracting_JRE_archive..._n
call fcn.0040bfd4
mov rdx, r12
mov rcx, rbx
call fcn.0040a41c
lea rcx, str._Extractor__Extracted_JRE__s_n
mov rdx, rbp
call fcn.0040bfd4
lea rcx, str._Extractor__Regenerating_jsa..._n
call fcn.0040bfd4
mov rcx, r12
call fcn.00401450
mov rbx, rax
call fcn.004087a4
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.00408814
lea rdx, str._Xshare:dump
mov rcx, rdi
call fcn.004087dc
xor edx, edx
mov rcx, rdi
call fcn.0040884c
mov rcx, rdi
call fcn.004171d0
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
mov ecx, r13d
mov rdx, r12
cmp eax, r13d
sete cl
call fcn.00401280
lea rcx, str.Extracting_Offline_JRE
call fcn.0040c1d8
mov rdi, qword [rsp + 0x130]
jmp 0x405bef
lea rcx, str.Setting_up_online_JRE
call fcn.0040c1a0
mov rax, qword [rsp + 0xe0]
mov byte [rsp + 0x140], 0
test rax, rax
je 0x40570a
mov rcx, rax
call fcn.00417420
test rax, rax
je 0x40570a
lea rcx, str._Extractor__Online_installer___no_stored_JRE._Skipping_system_JRE._n
call fcn.0040bfd4
jmp 0x4057ab
lea rcx, str._Extractor__Online_installer___no_stored_JRE__will_check_for_compatible_system_JRE_n
call fcn.0040bfd4
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
mov r8, qword [rsp + 0x108]
mov dl, byte [rsp + 0xb0]
test eax, eax
lea rcx, [rsp + 0x140]
mov r9, rsi
sete al
mov byte [rsp + 0x60], al
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x1e40]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x1e38]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call fcn.004031ec
lea rcx, [rsp + 0x140]
call fcn.00417420
test rax, rax
je 0x4057f4
lea rcx, str._Extractor__We_are_copying_the_JRE._We_want_to_query_the_JRE_version_to_enable_proxy_detection._n
call fcn.0040bfd4
mov rbp, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xd8]
mov r8, rbp
mov rdx, r15
call fcn.00402f1c
mov r12, qword [rsp + 0x120]
xor r13d, r13d
jmp 0x405b88
lea rcx, str._JREDownload__Failed_to_pick_up_any_existing_system_JRE__will_download_n
call fcn.0040bfd4
call fcn.00402ec4
mov r12, qword [rsp + 0x220]
mov rdx, qword [rsp + 0xd8]
mov rcx, r12
mov rbx, rax
mov byte [r12], 0
call fcn.004174e0
lea rdx, str.JWrapper_
mov rcx, r12
call fcn.0040bf34
mov rbp, qword [rsp + 0x88]
mov rcx, r12
mov rdx, rbp
call fcn.004174e0
lea rdx, str._version.txt
mov rcx, r12
call fcn.004174e0
mov ecx, 0x1388
call fcn.00417210
mov rdx, r15
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.004174e0
lea rdx, str.JWrapper_
mov rcx, rdi
call fcn.004174e0
mov rdx, rbp
mov rcx, rdi
call fcn.004174e0
lea rdx, str._version.txt
mov rcx, rdi
call fcn.004174e0
lea rdx, str._time
mov rcx, rdi
call fcn.004174e0
mov rdx, rbx
mov rcx, rdi
call fcn.004174e0
mov rcx, rbx
call fcn.004171d0
mov ebx, dword [rsp + 0x84]
test bl, bl
jne 0x4058d1
test r13b, r13b
jne 0x4058d1
call fcn.00406efc
lea rcx, str._JREDownload__Fetching_JRE_Version_from__s_n
mov rdx, rdi
call fcn.0040bfd4
lea rcx, str._JREDownload__Saving_into__s_n
mov rdx, r12
call fcn.0040bfd4
mov rdx, r12
mov rcx, rdi
call fcn.00409c90
test eax, eax
je 0x405e8a
mov ecx, 0xffffffff
call fcn.00407000
lea rcx, str._JREDownload__JRE_version_downloaded_OK___s__n
mov rdx, r12
call fcn.0040bfd4
lea rdx, [0x0044d630]
mov rcx, r12
call fcn.00418fe0
test rax, rax
mov rbp, rax
jne 0x405945
call fcn.004176c0
lea rcx, str._JREDownload___Unable_to_open_version_file____d__n
mov edx, dword [rax]
call fcn.0040bfd4
lea rcx, str._JREDownload__Extracting_version:
xor r13d, r13d
call fcn.0040bfd4
mov rcx, rbp
call fcn.0041b970
xor r12d, r12d
jmp 0x40599c
lea rcx, [0x0044f5c4]
mov edx, ebx
call fcn.0040bfd4
cmp ebx, 0xd
je 0x4059bc
cmp ebx, 0xa
je 0x4059bc
cmp ebx, 0x20
je 0x4059bc
cmp r12, 0x32
mov byte [rsp + r12 + 0x140], bl
jge 0x4059a5
mov rcx, rbp
add r13d, 1
add r12, 1
call fcn.0041b970
cmp eax, 0xffffffff
mov ebx, eax
jne 0x405961
jmp 0x4059c8
lea rcx, str._n_JREDownload__Version_invalid__too_long__n
call fcn.0040bfd4
mov ecx, 1
call fcn.00418900
int3
lea rcx, str._n_JREDownload__Spaces_in_version_file__assuming_EOF_n
call fcn.0040bfd4
lea rcx, [0x0044e050]
call fcn.0040bfd4
test rbp, rbp
je 0x4059e1
mov rcx, rbp
call fcn.0041b8c0
movsxd rax, r13d
lea rdx, [rsp + 0x140]
lea rcx, str._JREDownload__JRE_Version_is__s_n
xor r13d, r13d
mov byte [rsp + rax + 0x140], r13b
call fcn.0040bfd4
mov rcx, rdi
call fcn.004171d0
mov r12, qword [rsp + 0x120]
mov rdx, rsi
mov rcx, r12
call fcn.00401a08
mov rcx, r12
call fcn.0040beec
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
mov ecx, r13d
mov rdx, r12
cmp eax, r13d
sete cl
call fcn.00401280
mov ecx, 0x1388
call fcn.00417210
mov rdx, r15
mov rcx, rax
mov rbp, rax
mov byte [rax], r13b
call fcn.004174e0
lea rdx, str.JWrapper_
mov rcx, rbp
call fcn.004174e0
mov rdx, qword [rsp + 0x88]
mov rcx, rbp
call fcn.004174e0
lea rdx, [0x0044cb48]
mov rcx, rbp
call fcn.004174e0
lea rdx, [rsp + 0x140]
mov rcx, rbp
call fcn.004174e0
lea rdx, str._archive.p2.l2
mov rcx, rbp
call fcn.004174e0
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
mov rdx, r12
cmp eax, r13d
sete cl
call fcn.004014c4
cmp byte [rsp + 0x84], r13b
mov qword [0x0046a048], rax
jne 0x405aeb
cmp byte [rsp + 0x1e58], r13b
jne 0x405aeb
call fcn.00406efc
lea rcx, str._JREDownload__Extracting_JRE_archive_to__s_n
mov rdx, r12
call fcn.0040bfd4
mov rdx, r12
mov rcx, rbp
call fcn.00409df8
cmp eax, r13d
jne 0x405b21
lea rcx, str._JREDownload__Failed_to_download_and_extract_JRE_archive._n
call fcn.0040bfd4
mov ecx, 1
call fcn.00418900
int3
lea rcx, str._JREDownload__Regenerating_jsa..._n
call fcn.0040bfd4
mov rcx, r12
call fcn.00401450
mov rbx, rax
call fcn.004087a4
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.00408814
lea rdx, str._Xshare:dump
mov rcx, rdi
call fcn.004087dc
xor edx, edx
mov rcx, rdi
call fcn.0040884c
mov rcx, rdi
call fcn.004171d0
lea rcx, str._JREDownload__Downloaded_JRE_is_now_ready._n
call fcn.0040bfd4
mov rcx, rbp
call fcn.004171d0
mov rbp, qword [rsp + 0x88]
lea rcx, [rsp + 0x140]
call fcn.00417420
cmp rax, r13
jne 0x405bb1
lea rcx, str._JREDownload__Failed_to_detect_or_download_a_JRE__no_jre_version__n
call fcn.0040c0a0
mov ecx, 1
call fcn.00418900
int3
lea rdx, [rsp + 0x140]
lea rcx, str._JREDownload__Finalising_setup_of_new_JRE__s_n
call fcn.0040bfd4
mov rdi, qword [rsp + 0x130]
lea r9, [rsp + 0x140]
mov rcx, rdi
mov r8, rbp
mov rdx, rsi
call fcn.004019a0
lea rcx, str.Setting_up_online_JRE
call fcn.0040c1d8
mov rdx, rdi
mov rcx, r12
call fcn.00401530
lea rcx, str._Extractor__Renamed_JRE_folder_to__s_n
mov rdx, rdi
call fcn.0040bfd4
lea rcx, str._Extractor__JRE_setup._Overriding_cacerts._n
call fcn.0040bfd4
mov rcx, qword [rsp + 0x100]
mov rdx, rdi
call fcn.00403524
mov ecx, 0x1388
call fcn.00417210
mov rdx, qword [rsp + 0x228]
mov rcx, rax
mov rbx, rax
mov byte [rax], r13b
call fcn.004174e0
lea rdx, str.DetectedProxy
mov rcx, rbx
call fcn.0040bf34
lea rcx, str._Extractor__Saving_proxy_configuration_n
call fcn.0040bfd4
mov rcx, rbx
call fcn.00407adc
mov rcx, rbx
call fcn.004171d0
lea rdx, str.perm_all
mov rcx, r14
call fcn.004196f0
mov rdx, rdi
cmp eax, r13d
sete cl
call fcn.004014c4
lea rcx, str._Extractor__UP200_path_is__s_n
mov rdx, rax
mov qword [0x0046a048], rax
call fcn.0040bfd4
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
call fcn.00417420
cmp rax, r13
jbe 0x405d52
lea rcx, str._Extractor__Offline_installer___app_to_extract._n
call fcn.0040bfd4
mov r12, qword [rsp + 0x1e8]
lea rcx, str._Extractor__APP_folder_is__s_n
mov rdx, r12
call fcn.0040bfd4
mov rbp, qword [rsp + 0x1e0]
lea rcx, str._Extractor__APP_temp_is__s_n
mov rdx, rbp
call fcn.0040bfd4
mov rcx, rbp
call fcn.0040beec
cmp eax, r13d
je 0x405d1a
lea rcx, str.Unable_to_create_App_Temp_folder_n
call fcn.0040c0a0
mov ecx, 1
call fcn.00418900
int3
lea rcx, str._Extractor__Extracting_App..._n
call fcn.0040bfd4
mov rdi, qword [rsp + 0x98]
mov rdx, rbp
mov rcx, rdi
call fcn.0040a41c
mov rdx, rbp
mov rcx, rdi
call fcn.0040a41c
lea rcx, str._Extractor__Setting_permissions..._n
call fcn.0040bfd4
jmp 0x405d76
lea rcx, str._Extractor__Online_installer___no_app_to_extract_n
call fcn.0040bfd4
mov rdi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x1e0]
mov r12, qword [rsp + 0x1e8]
mov rcx, rbx
call fcn.00417420
cmp rax, r13
jbe 0x405d9d
mov rdx, r12
mov rcx, rbp
call fcn.00401530
lea rcx, str._Extractor__Renaming_App_folder_to__s_n
mov rdx, r12
call fcn.0040bfd4
lea rdx, str.JWrapper
mov rcx, rsi
call fcn.0040c34c
cmp rax, r13
mov rbx, rax
jne 0x405dcb
lea rcx, str.No_latest_App_version_even_after_download__n
call fcn.0040c0a0
mov ecx, 1
call fcn.00418900
int3
call fcn.00406df8
lea rcx, str._Extractor__Will_now_run_latest_GU__s_n
mov rdx, rbx
call fcn.0040bfd4
mov rcx, rdi
call fcn.00407e74
cmp byte [rsp + 0x1e58], r13b
jne 0x405e82
mov rax, qword [rsp + 0x128]
mov r9, qword [rsp + 0x1e40]
mov r8d, dword [rsp + 0x1e38]
mov rdx, qword [rsp + 0xd0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x110]
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x60], rax
mov al, byte [rsp + 0x80]
mov qword [rsp + 0x58], r14
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xc8]
mov rcx, rsi
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.00401ce4
xor ecx, ecx
call fcn.00418900
int3
test bl, bl
jne 0x405e98
test r13b, r13b
jne 0x405e98
call fcn.00406df8
lea rcx, str._JREDownload__Failed_to_download_JRE_version_file_n
call fcn.0040c0a0
mov ecx, 1
call fcn.00418900
int3