Function at 0x4032f0
Capabilities:
Check os version
Contain obfuscated stackstrings
Delete file
Query environment variable
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x15e78
call fcn.004389e0
sub rsp, rax
mov rdi, rcx
mov qword [0x00468040], 0
mov qword [rsp + 0xb8], 0
mov byte [rsp + 0x80], 0
mov byte [rsp + 0x98], 0
call fcn.00401250
test al, al
mov r12d, 1
je 0x403391
lea rdx, [rsp + 0x1b0]
lea rcx, [0x00468020]
xor r8d, r8d
mov dword [rsp + 0x1b0], r12d
mov qword [rsp + 0x1b8], 0
mov dword [rsp + 0x1c0], 0
mov dword [rsp + 0x1c4], 0
call sub.gdiplus.dll_GdiplusStartup
mov r13d, 0x40
lea rdx, [0x0044ce78]
lea rcx, [rsp + 0x1d0]
mov r8d, r13d
mov byte [rsp + 0x1d0], 0
call fcn.004175f0
call fcn.0040ac20
mov r14b, 0x5c
mov rcx, rdi
mov byte [rsp + 0x122], 9
mov byte [rsp + 0x123], 0x7a
mov qword [rsp + 0xe8], rax
mov byte [rsp + 0x124], 0x3e
mov byte [rsp + 0x125], 0x2f
mov byte [rsp + 0x126], 0x2e
mov byte [rsp + 0x127], 0xfa
mov byte [rsp + 0x128], 0xff
mov byte [rsp + 0x129], 0x1d
mov byte [rsp + 0x12a], pe_nt_image_headers64
mov byte [rsp + 0x12b], 0x9b
mov byte [rsp + 0x12c], 0x19
mov byte [rsp + 0x12d], 0x7c
mov byte [rsp + 0x12e], 0x15
mov byte [rsp + 0x12f], 0xb8
mov byte [rsp + 0x130], 0x1e
mov byte [rsp + 0x131], 0x6d
mov byte [rsp + 0x132], 0xc6
mov byte [rsp + 0x133], 0x10
mov byte [rsp + 0x134], 0x41
mov byte [rsp + 0x135], 0x7e
mov byte [rsp + 0x136], r14b
mov byte [rsp + 0x137], 0xed
mov byte [rsp + 0x138], 0x51
mov byte [rsp + 0x139], 0xb1
mov byte [rsp + 0x13a], 0x19
mov byte [rsp + 0x13b], 0x1c
mov byte [rsp + 0x13c], 0x3c
mov byte [rsp + 0x13d], 0xe2
mov byte [rsp + 0x13e], 0x94
mov byte [rsp + 0x13f], 0xd8
mov byte [rsp + 0x100], 0x59
mov byte [rsp + 0x101], 0xbd
mov byte [rsp + 0x102], 0xc9
mov byte [rsp + 0x103], 0x52
mov byte [rsp + 0x104], 0xaa
mov byte [rsp + 0x105], 0x35
mov byte [rsp + 0x106], 0xad
mov byte [rsp + 0x107], 0xbb
mov byte [rsp + 0x108], 0x10
mov byte [rsp + 0x109], 0xef
mov byte [rsp + 0x10a], 0xde
mov byte [rsp + 0x10b], 0x67
mov byte [rsp + 0x10c], 0x2c
mov byte [rsp + 0x10d], 0x47
mov byte [rsp + 0x10e], 0xe0
mov byte [rsp + 0x10f], 0xb5
mov byte [rsp + 0x110], 0xd4
mov byte [rsp + 0x111], 0x82
mov byte [rsp + 0x112], 0x1f
mov byte [rsp + 0x113], 0x81
mov byte [rsp + 0x114], 0x52
mov byte [rsp + 0x115], 0xa1
mov byte [rsp + 0x116], 2
mov byte [rsp + 0x117], 0x44
mov byte [rsp + 0x118], 0x2a
mov byte [rsp + 0x119], 0xeb
mov byte [rsp + 0x11a], 0xaa
mov byte [rsp + 0x11b], 0x7b
mov byte [rsp + 0x11c], 0x79
mov byte [rsp + 0x11d], 0x3b
mov byte [rsp + 0x11e], 0x93
mov byte [rsp + 0x11f], 0x45
mov byte [rsp + 0x120], 0xae
mov byte [rsp + 0x121], 0xd2
call fcn.00416930
mov ebx, 0x400
cmp rax, 3
jb 0x4035fd
cmp byte [rdi], r14b
jne 0x4035e4
cmp byte [rdi + 1], r14b
je 0x4035f0
cmp byte [rdi + 1], 0x3a
jne 0x4035fd
cmp byte [rdi + 2], r14b
jne 0x4035fd
mov rsi, rdi
mov qword [rsp + 0xf0], rdi
jmp 0x403625
mov rcx, rbx
call fcn.00416720
mov edx, ebx
mov rcx, rax
mov rsi, rax
mov qword [rsp + 0xf0], rax
call fcn.0041a1f0
mov rdx, rdi
mov rcx, rsi
call fcn.0040b480
lea rcx, str._Extractor__The_absolute_wrapper_path_is__s_n
mov rdx, rsi
call fcn.0040b520
lea rcx, str._Extractor__The_executable_name_is__s_n
mov rdx, rdi
call fcn.0040b520
mov ecx, 0x800
call fcn.00416720
mov rdx, rsi
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call fcn.004169f0
mov rcx, rbx
xor esi, esi
xor ebp, ebp
call fcn.00416930
test eax, eax
jle 0x40369a
mov r12, rbx
lea edi, [rsi + 1]
cmp byte [r12], r14b
mov rcx, rbx
cmove esi, ebp
add ebp, edi
add r12, rdi
call fcn.00416930
cmp ebp, eax
jl 0x403674
mov rdi, qword [rsp + 0x15ec0]
mov r12d, 1
movsxd rax, esi
lea rdx, [0x0044b7b8]
mov rcx, rdi
mov byte [rax + rbx], 0
call fcn.004181b0
test rax, rax
mov rbx, rax
jne 0x4036d0
lea rcx, str._Extractor___Failed_to_extract_wrapper_params___couldnt_open_file__s_n
mov rdx, rdi
call fcn.0040b520
mov ecx, r12d
call fcn.00417b40
int3
lea r9, str.Params
lea rdx, [rsp + 0x100]
mov r8d, r13d
mov rcx, rax
call fcn.0040b3bc
cmp eax, 0xffffffff
jne 0x4036f8
mov ecx, r12d
call fcn.00417b40
int3
mov rcx, rbx
call fcn.00409808
lea rcx, str._Extractor__Found_Params_marker._Extracting_now..._n
mov r13, rax
mov qword [rsp + 0xa8], rax
call fcn.0040b520
mov ecx, 0x30d40
call fcn.00416720
xor edx, edx
mov r8d, 0x30d40
mov rcx, rax
mov rbp, rax
mov qword [rsp + 0xc0], rax
call fcn.004183c0
xor r9d, r9d
lea rdx, str.Params_Count
lea r8d, [r9 + 0x28]
mov rcx, r13
mov byte [rsp + 0xb0], 0
call fcn.00409ca0
test rax, rax
jne 0x403765
lea r15d, [rax - 1]
jmp 0x403770
mov rcx, rax
call fcn.00418010
mov r15d, eax
lea rcx, [0x0044cf20]
call fcn.0040b520
lea rcx, [0x0044cf28]
call fcn.0040b520
lea rcx, str._Processing__d_dynamic_properties_n
mov edx, r15d
call fcn.0040b520
lea rcx, [0x0044cf28]
call fcn.0040b520
xor r14d, r14d
test r15d, r15d
jle 0x403d06
mov r12, qword [rsp + 0xa8]
mov edi, dword [rsp + 0xb0]
mov qword [rsp + 0xa0], r12
lea r12d, [r14 + 1]
lea rdx, str.Param_Name
xor r9d, r9d
mov r8d, 0x400
mov rcx, r13
call fcn.00409ca0
lea rdx, str.Param_Value
xor r9d, r9d
mov r8d, 0x30d40
mov rcx, r13
mov rsi, rax
call fcn.00409ca0
mov rcx, rax
mov rbx, rax
call fcn.00416930
cmp rax, 0x64
jbe 0x403842
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x100]
mov r8d, 0x63
call fcn.00418240
mov byte [rsp + 0x163], 0
lea r9, [rsp + 0x100]
lea rcx, str._DynProps__Dynamic_Param__d:__s__s...__n
jmp 0x40384c
mov r9, rbx
lea rcx, str._DynProps__Dynamic_Param__d:__s__s__n
mov r8, rsi
mov edx, r14d
call fcn.0040b520
lea rdx, str.jwdyna_
mov rcx, rbp
call fcn.00409ad4
mov rdx, rsi
mov rcx, rbp
call fcn.00409b64
mov rdx, rbx
mov rcx, rbp
call fcn.00409ad4
lea rdx, str.update_url
mov rcx, rsi
call fcn.004188c0
test eax, eax
jne 0x4038a6
lea rcx, str._DynProps__Dynamic_Update_URL:__s_n
mov rdx, rbx
mov qword [rsp + 0xa0], rbx
call fcn.0040b520
lea rdx, str.match_versions
mov rcx, rsi
call fcn.004188c0
test eax, eax
jne 0x4038d2
lea rdx, str.true
mov rcx, rbx
call fcn.004188c0
test eax, eax
sete byte [rsp + 0x80]
lea rdx, str.wrapper_autotest
mov rcx, rsi
call fcn.004188c0
mov ecx, dword [rsp + 0x98]
lea rdx, str.show_no_ui
movzx ecx, cl
test eax, eax
cmove ecx, r12d
mov dword [rsp + 0x98], ecx
mov rcx, rsi
call fcn.004188c0
test eax, eax
jne 0x40392b
lea rdx, str.true
mov rcx, rbx
call fcn.004188c0
movzx edi, dil
test eax, eax
cmove edi, r12d
mov dword [rsp + 0xb0], edi
lea rdx, str.force_spawn
mov rcx, rsi
call fcn.004188c0
test eax, eax
jne 0x40395a
lea rdx, str.true
mov rcx, rbx
call fcn.004188c0
xor ecx, ecx
test eax, eax
sete cl
mov dword [0x00468050], ecx
lea rdx, str.splash_buffer
mov rcx, rsi
call fcn.004188c0
test eax, eax
jne 0x403988
mov rcx, rbx
call fcn.00416930
test rax, rax
je 0x403988
mov rcx, rbx
call fcn.00418010
mov dword [0x00468168], eax
lea rdx, str.splash_image
mov rcx, rsi
call fcn.004188c0
test eax, eax
jne 0x403bcd
mov rcx, rbx
call fcn.00416930
mov rdx, rbx
cmp rax, 0x64
jae 0x4039b9
lea rcx, str._DynProps__Splash_Image_is__s_n
jmp 0x4039e3
lea rcx, [rsp + 0x100]
mov r8d, 0x63
call fcn.00418240
mov byte [rsp + 0x163], 0
lea rdx, [rsp + 0x100]
lea rcx, str._DynProps__Splash_Image_is__s..._n
call fcn.0040b520
lea rcx, str._DynProps__Base64_decoding_image..._n
call fcn.0040b520
mov rcx, rbx
call fcn.00416930
mov rbp, qword [0x00468058]
test rbp, rbp
mov r12, rax
jne 0x403a40
mov ecx, 0x100
call fcn.00416720
xor edx, edx
mov rbp, rax
mov qword [0x00468058], rax
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea r8d, [rdx + 1]
movsx rcx, byte [rax]
add rax, r8
mov byte [rcx + rbp], dl
add edx, r8d
cmp edx, 0x40
jl 0x403a2c
jmp 0x403a46
mov r8d, 1
test r12b, 3
je 0x403a69
lea rcx, str._Extractor__Base64_deconding_failed_as_input_length_is_not_aligned_n
call fcn.0040b520
mov qword [rsp + 0xb8], 0
jmp 0x403bb3
mov rax, r12
shr rax, 2
lea rcx, [rax + rax*2]
mov qword [rsp + 0x90], rcx
cmp byte [r12 + rbx - 1], 0x3d
jne 0x403a8f
sub rcx, r8
mov qword [rsp + 0x90], rcx
cmp byte [r12 + rbx - 2], 0x3d
jne 0x403aa2
sub rcx, r8
mov qword [rsp + 0x90], rcx
call fcn.00416720
test rax, rax
mov qword [rsp + 0xb8], rax
jne 0x403aca
lea rdx, [rsp + 0x90]
lea rcx, str._Extractor__Base64_deconding_failed_as_malloc_failed_to_init__d_n
call fcn.0040b520
jmp 0x403a58
xor ecx, ecx
xor r8d, r8d
test r12, r12
je 0x403bb3
mov r9, rax
lea edi, [rcx + 1]
mov r10b, 0x3d
cmp byte [rcx + rbx], r10b
jne 0x403aeb
xor edx, edx
jmp 0x403af4
movsx rax, byte [rcx + rbx]
movsx edx, byte [rax + rbp]
add ecx, edi
cmp byte [rcx + rbx], r10b
jne 0x403b01
xor r13d, r13d
jmp 0x403b0b
movsx rax, byte [rcx + rbx]
movsx r13d, byte [rax + rbp]
add ecx, edi
cmp byte [rcx + rbx], r10b
jne 0x403b18
xor r11d, r11d
jmp 0x403b22
movsx rax, byte [rcx + rbx]
movsx r11d, byte [rax + rbp]
add ecx, edi
cmp byte [rcx + rbx], r10b
jne 0x403b2f
xor r10d, r10d
jmp 0x403b39
movsx rax, byte [rcx + rbx]
movsx r10d, byte [rax + rbp]
shl edx, 6
mov eax, r8d
add ecx, edi
add edx, r13d
shl edx, 6
add edx, r11d
shl edx, 6
add edx, r10d
cmp rax, qword [rsp + 0x90]
jae 0x403b68
mov eax, edx
add r8d, edi
shr eax, 0x10
mov byte [r9], al
add r9, rdi
mov eax, r8d
cmp rax, qword [rsp + 0x90]
jae 0x403b83
mov eax, edx
add r8d, edi
shr eax, 8
mov byte [r9], al
add r9, rdi
mov eax, r8d
cmp rax, qword [rsp + 0x90]
jae 0x403b99
mov byte [r9], dl
add r8d, edi
add r9, rdi
mov eax, ecx
cmp rax, r12
jb 0x403ade
mov r13, qword [rsp + 0xa8]
mov edi, dword [rsp + 0xb0]
mov rdx, qword [rsp + 0x90]
lea rcx, str._DynProps__Decode_complete__image_size_is__d__n
call fcn.0040b520
mov r12d, 1
lea rdx, str.jre_name
mov rcx, rsi
call fcn.004188c0
test eax, eax
jne 0x403c0b
lea rcx, [rsp + 0x2570]
mov rdx, rbx
mov byte [rsp + 0x2570], al
call fcn.004169f0
lea rdx, [rsp + 0x2570]
lea rcx, str._DynProps__JRE_name_from_dynamic_launch_properties_is__s_n
call fcn.0040b520
lea rdx, str.windows_app_id
mov rcx, rsi
call fcn.004188c0
test eax, eax
jne 0x403ce8
lea rcx, str._DynProps__Windows_APP_ID_is__s_n
mov rdx, rbx
call fcn.0040b520
lea rcx, str._Extractor__Asked_to_set_the_Windows_APP_ID_to__s_n
mov rdx, rbx
call fcn.0040b520
lea rcx, str._Extractor__Loading_shell32_n
call fcn.0040b520
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x403ce8
lea rcx, str._Extractor__Finding_procedure_address_for_SetCurrentProcessExplicitAppUserModelID_n
call fcn.0040b520
lea rdx, str.SetCurrentProcessExplicitAppUserModelID
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r12, rax
je 0x403cd9
mov rcx, rbx
call fcn.00409a24
lea rcx, str._Extractor__Setting_app_ID_to__S___s__n
mov r8, rbx
mov rdx, rax
mov rbp, rax
call fcn.0040b520
mov rcx, rbp
call r12
test eax, eax
jne 0x403cbe
lea rcx, str._Extractor__Set_App_ID_OK_n
call fcn.0040b520
jmp 0x403cd1
lea rdx, str.SetCurrentProcessExplicitAppUserModelID
lea rcx, str.Extractor
call fcn.0040a970
mov rcx, rbp
call fcn.004166e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r12d, 1
mov rbp, qword [rsp + 0xc0]
add r14d, r12d
cmp r14d, r15d
jl 0x4037ca
mov rdi, qword [rsp + 0x15ec0]
jmp 0x403d16
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xa0], rax
mov rcx, r13
call fcn.00407938
lea rcx, str.Processing_dynamic_properties
call fcn.0040b724
mov r13b, byte [rsp + 0x15ee8]
test r13b, r13b
je 0x403d43
lea rcx, str._Extractor__This_is_an_elevated_run_purely_to_prepare_an_installation._Will_not_show_UI_or_launch_an_app_n
call fcn.0040b520
lea rcx, [0x0044cf20]
call fcn.0040b520
lea rcx, str.Extracting_wrapper_tail
call fcn.0040b6ec
lea rdx, [0x0044b7b8]
mov rcx, rdi
call fcn.004181b0
test rax, rax
mov rbx, rax
jne 0x403d8a
lea rcx, str._Extractor___Failed_to_extract_wrapper_tail___couldnt_open_file__s_n
mov rdx, rdi
call fcn.0040b520
mov ecx, r12d
call fcn.00417b40
int3
mov rdx, qword [rsp + 0xe8]
lea r9, str.Tail
mov r8d, 0x80
mov rcx, rax
call fcn.0040b3bc
cmp eax, 0xffffffff
jne 0x403db5
mov ecx, r12d
call fcn.00417b40
int3
lea rcx, str._Extractor__Found_tail_marker_n
call fcn.0040b520
mov rcx, rbx
call fcn.00409808
mov ebx, 0x400
lea rdx, str.App_Name
xor r9d, r9d
mov r8d, ebx
mov rcx, rax
mov r15, rax
call fcn.00409ca0
lea rdx, str.App_Version
xor r9d, r9d
mov r8d, ebx
mov rcx, r15
mov qword [rsp + 0xc8], rax
call fcn.00409ca0
lea rdx, str.JRE_Version
xor r9d, r9d
mov r8d, ebx
mov rcx, r15
mov qword [rsp + 0x88], rax
call fcn.00409ca0
lea rdx, str.GU_Version
xor r9d, r9d
mov r8d, ebx
mov rcx, r15
mov qword [rsp + 0x1c8], rax
call fcn.00409ca0
lea rdx, str.Min_Splash_MS
xor r9d, r9d
mov r8d, ebx
mov rcx, r15
mov qword [rsp + 0xd8], rax
call fcn.00409ca0
lea rdx, str.Signature_Public_Key
xor r9d, r9d
mov r8d, 0x2000
mov rcx, r15
mov qword [rsp + 0x1a0], rax
call fcn.00409ca0
lea rdx, str.Can_Override_Splash
xor r9d, r9d
mov r8d, ebx
mov rcx, r15
mov rsi, rax
call fcn.00409ca0
lea rdx, str.Install_Type
xor r9d, r9d
mov r8d, ebx
mov rcx, r15
mov qword [rsp + 0x1a8], rax
call fcn.00409ca0
lea rdx, str.Silent_Parameter
xor r9d, r9d
mov r8d, ebx
mov rcx, r15
mov qword [rsp + 0xe0], rax
call fcn.00409ca0
lea rdx, str.Required_Java_Version
xor r9d, r9d
mov r8d, ebx
mov rcx, r15
mov rbp, rax
call fcn.00409ca0
lea rdx, str.Update_URL
xor r9d, r9d
mov r8d, 0x1388
mov rcx, r15
mov r14, rax
mov qword [rsp + 0xa8], rax
call fcn.00409ca0
xor r9d, r9d
lea rdx, str.Skip_System_JRE
mov rcx, r15
lea r8d, [r9 + 2]
mov r12, rax
mov qword [rsp + 0xd0], rax
call fcn.00409ca0
mov rbx, rax
mov qword [rsp + 0xe8], rax
test r14, r14
je 0x403f54
mov rcx, r14
call fcn.00416930
test rax, rax
je 0x403f54
lea rcx, str._Extractor__Required_Java_version__s_n
mov rdx, r14
call fcn.0040b520
test rbx, rbx
je 0x403f72
mov rcx, rbx
call fcn.00416930
test rax, rax
je 0x403f72
lea rcx, str._Extractor__Skipping_System_JRE_n
call fcn.0040b520
lea rdx, [0x0044bd4c]
mov rcx, r12
call fcn.004188c0
test eax, eax
jne 0x403fa1
mov rbx, qword [rsp + 0xa0]
lea rcx, str._Extractor__Will_use_Dynamic_Update_URL:__s_n
mov rdx, rbx
call fcn.0040b520
mov r12, rbx
jmp 0x403fb0
lea rcx, str._Extractor__Will_use_Static_Update_URL:__s_n
mov rdx, r12
call fcn.0040b520
mov r14d, dword [rsp + 0xb0]
test r14b, r14b
jne 0x404006
test rbp, rbp
je 0x404003
mov rcx, rbp
call fcn.00416930
test rax, rax
je 0x404003
movsxd rdi, dword [rsp + 0x15ec8]
xor ebx, ebx
test rdi, rdi
jle 0x404003
mov r14, qword [rsp + 0x15ed0]
mov rdx, qword [r14 + rbx*8]
mov rcx, rbp
call fcn.004188c0
test eax, eax
je 0x4041d4
add rbx, 1
cmp rbx, rdi
jl 0x403fe6
xor r14b, r14b
lea rcx, str._Extractor__Is_silent_install_is__d_n
movzx edx, r14b
call fcn.0040b520
lea rcx, str.Extracting_tail
call fcn.0040b724
lea rcx, str._Extractor__Setting_up_static_properties_n
call fcn.0040b520
mov rbx, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xd0]
lea rdx, str.update_url
mov rcx, rbx
call fcn.00409bd0
mov r8, qword [rsp + 0xe0]
lea rdx, str.install_type
mov rcx, rbx
call fcn.00409bd0
mov r8, qword [rsp + 0x1a0]
lea rdx, str.min_splash_ms
mov rcx, rbx
call fcn.00409bd0
lea rdx, str.jwsig_public_key
mov r8, rsi
mov rcx, rbx
call fcn.00409bd0
mov r8, qword [rsp + 0x1a8]
lea rdx, str.can_override_splash
mov rcx, rbx
call fcn.00409bd0
mov r8, qword [rsp + 0xc8]
lea rdx, str.app_name
mov rcx, rbx
call fcn.00409bd0
mov r8, qword [rsp + 0x88]
lea rdx, str.wrapper_app_version
mov rcx, rbx
call fcn.00409bd0
mov r8, qword [rsp + 0xd8]
lea rdx, str.wrapper_gu_version
mov rcx, rbx
call fcn.00409bd0
lea rdx, str.silent_parameter
mov r8, rbp
mov rcx, rbx
call fcn.00409bd0
mov r8, qword [rsp + 0xa8]
lea rdx, str.java_version
mov rcx, rbx
call fcn.00409bd0
mov r8, qword [rsp + 0xe8]
lea rdx, str.skip_system_jre
mov rcx, rbx
call fcn.00409bd0
xor ebp, ebp
cmp r14b, bpl
je 0x404146
lea r8, str.true
lea rdx, str.show_no_ui
mov rcx, rbx
call fcn.00409bd0
cmp rsi, rbp
je 0x4041f6
mov rcx, rsi
call fcn.00416930
mov rcx, rsi
cmp rax, rbp
jbe 0x4041dc
call fcn.00416930
mov rbx, rax
shr rbx, 1
add rbx, 2
mov rcx, rbx
call fcn.00416720
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.004183c0
mov r8, rsi
mov edx, ebx
mov rcx, rdi
call fcn.0040ae34
lea rcx, str._Extractor__Processed_public_key_of_length__d_n
mov edx, eax
mov ebx, eax
call fcn.0040b520
lea rcx, str._Extractor__Hex:__s_n
mov rdx, rsi
call fcn.0040b520
mov edx, ebx
mov rcx, rdi
call fcn.00401048
lea rcx, str._Extractor__Public_Key:__08X_n
mov rdx, rax
mov qword [0x00468040], rax
call fcn.0040b520
jmp 0x404202
mov r14b, 1
jmp 0x404006
call fcn.00416930
cmp rax, rbp
ja 0x404202
lea rcx, str._Extractor__Public_key_length__d__no_public_key__n
xor edx, edx
call fcn.0040b520
jmp 0x404202
lea rcx, str._Extractor__Public_key_empty__no_public_key__n
call fcn.0040b520
mov rbx, qword [rsp + 0xe0]
lea rdx, str.perm_all
mov rcx, rbx
call fcn.004188c0
cmp eax, ebp
jne 0x4042a5
lea rcx, str.Permanent_install_for_all_users_n
call fcn.0040b520
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x100], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, ebp
je 0x404262
cmp dword [rsp + 0x104], 5
jbe 0x404262
lea rcx, str.PROGRAMDATA
call fcn.0041a910
jmp 0x4042d0
lea rcx, str.ALLUSERSPROFILE
call fcn.0041a910
mov ecx, 0x1388
mov rbx, rax
call fcn.00416720
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], bpl
call fcn.004169f0
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.0040b480
mov rcx, rdi
call fcn.0040b43c
jmp 0x4042d3
lea rdx, str.perm_user
mov rcx, rbx
call fcn.004188c0
lea rcx, str.Permanent_install_for_current_user_n
cmp eax, ebp
je 0x4042c6
lea rcx, str.Temporary_install_n
call fcn.0040b520
call fcn.0040b18c
mov rdi, rax
cmp rdi, rbp
jne 0x4042ef
lea rcx, str.ERROR:_Unable_to_get_shared_dir_
call fcn.0040b520
mov ecx, 1
call fcn.00417b40
int3
lea rcx, str._Extractor__Shared_dir_is__s_n
mov rdx, rdi
call fcn.0040b520
lea rcx, str._Extractor__Update_URL_is_currently__s_n
mov rdx, r12
call fcn.0040b520
mov rcx, r12
call fcn.00416930
cmp eax, ebp
jle 0x40432d
cdqe
cmp byte [rax + r12 - 1], 0x2f
je 0x40432d
mov byte [rax + r12], 0x2f
mov byte [rax + r12 + 1], bpl
lea rcx, str._Extractor__Update_URL_is_now__s_n
mov rdx, r12
call fcn.0040b520
lea rcx, [rsp + 0x11e0]
mov rdx, rdi
mov byte [rsp + 0x11e0], bpl
call fcn.004169f0
lea rdx, str.JWrapper_
lea rcx, [rsp + 0x11e0]
call fcn.0040b480
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x11e0]
call fcn.004169f0
lea rdx, [rsp + 0x11e0]
lea rcx, str._Extractor__Master_folder_is__s_n
call fcn.0040b520
lea rcx, [rsp + 0xb0]
call fcn.0041acf0
lea rcx, [rsp + 0xb0]
call fcn.0041a5e0
mov edi, 0x400
lea rcx, [rsp + 0x1e0]
mov r8, rdi
xor edx, edx
mov rbx, rax
call fcn.004183c0
lea r8, str._Y__m__d__H__M__S
lea rcx, [rsp + 0x1e0]
mov r9, rbx
mov rdx, rdi
call fcn.00419da0
lea rcx, [rsp + 0x1b0]
call fcn.0041a640
movzx r9d, word [rsp + 0x1b8]
cmp eax, ebp
je 0x4043fc
mov r9d, ebp
lea r8, [rsp + 0x1e0]
lea rdx, str._s__03d.log
lea rcx, [rsp + 0x1e0]
call fcn.004175f0
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x9e0]
mov byte [rsp + 0x9e0], bpl
call fcn.004169f0
lea rdx, str.logs
lea rcx, [rsp + 0x9e0]
call fcn.0040b480
lea rcx, [rsp + 0x11e0]
call fcn.0040b43c
lea rcx, [rsp + 0x9e0]
call fcn.0040b43c
lea rdx, str.Wrapper_
lea rcx, [rsp + 0x9e0]
call fcn.0040b480
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x9e0]
call fcn.004169f0
lea rdx, [rsp + 0x9e0]
lea rcx, str._Extractor__Logging_to__s_n
call fcn.0040b520
lea r8, [0x0044b47c]
lea rdx, [rsp + 0x9e0]
lea rcx, [rsp + 0x1b0]
call fcn.004181c0
lea rcx, str._Extractor__Opening_the_file_for_writing_returned__d_n
mov edx, eax
call fcn.0040b520
mov r11, qword [rsp + 0x1b0]
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x11030]
mov qword [0x00468170], r11
mov byte [rsp + 0x11030], bpl
call fcn.004169f0
lea rdx, str.JWApps
lea rcx, [rsp + 0x11030]
call fcn.0040b480
lea rdx, [rsp + 0x11030]
lea rcx, [rsp + 0x13750]
mov byte [rsp + 0x13750], bpl
call fcn.004169f0
lea rdx, str.JreNameOverride
lea rcx, [rsp + 0x13750]
call fcn.0040b480
lea rdx, [0x0044c500]
lea rcx, [rsp + 0x13750]
call fcn.004181b0
cmp rax, rbp
mov rdi, rax
je 0x4045df
lea rcx, str._JREOverride__Processing_JRE_Override_file__JreNameOverride__n
call fcn.0040b520
lea rdx, str.JRE_Override_App_Name
mov r8d, 0x1f4
mov rcx, rdi
call fcn.00409c0c
cmp rax, rbp
mov rbx, rax
je 0x4045b6
mov rcx, rax
call fcn.00416930
cmp rax, 1
jne 0x4045a0
cmp byte [rbx], 0x2d
jne 0x4045a0
lea rcx, str._JREOverride__Ignoring_JRE_name____keeping__s_n
jmp 0x4045e6
mov rcx, rbx
call fcn.00416930
cmp rax, rbp
jne 0x4045b6
lea rcx, str._JREOverride__Ignoring_empty_JRE_name__keeping__s_n
jmp 0x4045e6
lea rcx, [rsp + 0x2570]
mov rdx, rbx
mov byte [rsp + 0x2570], bpl
call fcn.004169f0
mov rcx, rdi
call fcn.0041aa90
lea rcx, str._JREOverride__JRE_name_overriden_to__s_n
jmp 0x4045e6
lea rcx, str._JREOverride__No_JRE_name_override__will_continue_to_use__s_n
lea rdx, [rsp + 0x2570]
call fcn.0040b520
mov rbx, qword [rsp + 0xd8]
mov bpl, 1
mov rcx, rbx
call fcn.00416930
test rax, rax
jne 0x40461c
lea rcx, str._Extractor__No_GenericUpdater_embedded__we_are_just_a_launcher_n
call fcn.0040b520
xor bpl, bpl
jmp 0x40462b
lea rcx, str._Extractor__GenericUpdater_version_is__s_n
mov rdx, rbx
call fcn.0040b520
mov rbx, qword [rsp + 0x88]
mov rcx, rbx
call fcn.00416930
test rax, rax
jne 0x40464e
lea rcx, str._Extractor__ONLINE_wrapper:_No_App_embedded__GU_will_download_and_run_n
call fcn.0040b520
jmp 0x40465d
lea rcx, str._Extractor__OFFLINE_wrapper:_App_version_is__s_n
mov rdx, rbx
call fcn.0040b520
lea rcx, str._Extractor__Checking_for_a_latest_valid_GU_n
call fcn.0040b520
lea rdx, str.JWrapper
lea rcx, [rsp + 0x11e0]
call fcn.0040b898
lea rdx, [rsp + 0x2570]
lea rcx, [rsp + 0x11e0]
mov rsi, rax
call fcn.0040b898
test rsi, rsi
mov rdi, rax
je 0x40477f
test bpl, bpl
je 0x40477f
lea rcx, [rsp + 0x11e0]
mov rdx, rsi
call fcn.00401280
test eax, eax
jne 0x40477f
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x9e0]
mov byte [rsp + 0x9e0], al
call fcn.004169f0
lea rcx, [rsp + 0x9e0]
mov rdx, rsi
call fcn.0040b480
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x1e0]
mov byte [rsp + 0x1e0], 0
call fcn.004169f0
lea rdx, str.Damaged
lea rcx, [rsp + 0x1e0]
call fcn.0040b480
lea rcx, [rsp + 0x1e0]
call fcn.0040afe8
test eax, eax
jne 0x40473d
lea rcx, [rsp + 0x1e0]
call fcn.0040b43c
lea r8, str.Damaged
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x1e0]
mov r9, rsi
call fcn.0040b4e8
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x9e0]
call fcn.00401424
lea rcx, str._Extractor__The_existing_JWrapper_install_is_broken._Instructing_the_wrapper_to_update._n
call fcn.0040b520
xor esi, esi
test rdi, rdi
je 0x4049da
test bpl, bpl
je 0x4049da
lea r9, [0x0044b3bc]
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x1e0]
mov r8, rdi
call fcn.0040b4e8
lea rdx, str.java.exe
lea rcx, [rsp + 0x1e0]
call fcn.0040b480
lea rcx, [rsp + 0x1e0]
call fcn.0040afe8
xor ebx, ebx
lea r9, [0x0044b3bc]
test eax, eax
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x1e0]
mov r8, rdi
setne bl
call fcn.0040b4e8
lea rdx, str.javaw.exe
lea rcx, [rsp + 0x1e0]
call fcn.0040b480
test ebx, ebx
je 0x404827
lea rcx, [rsp + 0x1e0]
call fcn.0040afe8
test eax, eax
je 0x404827
mov ebx, 1
jmp 0x404829
xor ebx, ebx
lea r9, [0x0044b290]
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x1e0]
mov r8, rdi
call fcn.0040b4e8
lea rdx, str.rt.jar
lea rcx, [rsp + 0x1e0]
call fcn.0040b480
lea rcx, [rsp + 0x1e0]
call fcn.0040afe8
test eax, eax
jne 0x4048cb
lea r9, [0x0044b28c]
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x1e0]
mov r8, rdi
call fcn.0040b4e8
lea rdx, [0x0044b290]
lea rcx, [rsp + 0x1e0]
call fcn.0040b480
lea rdx, str.rt.jar
lea rcx, [rsp + 0x1e0]
call fcn.0040b480
test ebx, ebx
je 0x4048c9
lea rcx, [rsp + 0x1e0]
call fcn.0040afe8
test eax, eax
jne 0x4048cf
xor ebx, ebx
test ebx, ebx
je 0x40491c
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x3900]
mov byte [rsp + 0x3900], 0
call fcn.004169f0
lea rcx, [rsp + 0x3900]
mov rdx, rdi
call fcn.0040b480
lea rcx, [rsp + 0x3900]
call fcn.0040aa2c
test rax, rax
je 0x40491c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4049da
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x1e0]
mov byte [rsp + 0x1e0], 0
call fcn.004169f0
lea rcx, [rsp + 0x1e0]
mov rdx, rdi
call fcn.0040b480
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x9e0]
mov byte [rsp + 0x9e0], 0
call fcn.004169f0
lea rdx, str.Damaged
lea rcx, [rsp + 0x9e0]
call fcn.0040b480
lea rcx, [rsp + 0x9e0]
call fcn.0040afe8
test eax, eax
jne 0x404998
lea rcx, [rsp + 0x9e0]
call fcn.0040b43c
lea r8, str.Damaged
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x9e0]
mov r9, rdi
call fcn.0040b4e8
lea rdx, [rsp + 0x9e0]
lea rcx, [rsp + 0x1e0]
call fcn.00401424
lea rcx, str._Extractor__The_existing_JRE_is_broken._Instructing_the_wrapper_to_update._n
call fcn.0040b520
xor edi, edi
test rsi, rsi
je 0x404b82
test rdi, rdi
je 0x404b82
lea rcx, str._Extractor__Latest_GU_version_exists:__s_n
mov rdx, rsi
call fcn.0040b520
lea rcx, str._Extractor__Existing_JRE_exists:__s_n
mov rdx, rdi
call fcn.0040b520
mov rcx, rsi
call fcn.0040babc
mov rcx, qword [rsp + 0xd8]
mov ebx, eax
call fcn.00418010
test bpl, bpl
je 0x404a36
cmp eax, ebx
jle 0x404a36
lea rcx, str._Extractor__Our_GU_version_is_newer_than_existing_latest_version_so_will_extract_and_run_n
jmp 0x404b89
lea rcx, str._Extractor__Latest_GUversion_is_newer_or_same_as_our_version_so_will_just_run_n
call fcn.0040b520
test bpl, bpl
je 0x404aad
mov rbx, qword [rsp + 0x88]
mov rcx, rbx
call fcn.00416930
test rax, rax
je 0x404aad
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x11e0]
call fcn.0040b898
test rax, rax
je 0x404b74
mov rcx, rax
call fcn.0040babc
mov rcx, qword [rsp + 0x88]
mov ebx, eax
call fcn.00418010
cmp eax, ebx
jle 0x404aa1
lea rcx, str._Extractor__Our_App_version_is_newer_than_existing_latest_version_so_will_extract_and_run_n
jmp 0x404b89
lea rcx, str._Extractor__Latest_App_version_is_newer_or_same_as_our_version_so_will_just_run_n
call fcn.0040b520
lea rcx, str._Extractor__Running_without_extraction_now_n
call fcn.0040b520
call fcn.004069b4
mov rcx, r15
call fcn.00407938
test r13b, r13b
jne 0x404b6c
mov r11, qword [rsp + 0xe0]
mov r9, qword [rsp + 0x15ed0]
mov r8d, dword [rsp + 0x15ec8]
mov rdx, qword [rsp + 0xc0]
lea rax, [rsp + 0xae60]
lea rcx, [rsp + 0x11e0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf0]
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x60], rax
mov al, byte [rsp + 0x80]
mov qword [rsp + 0x58], r11
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x2570]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call fcn.00401bb8
xor ecx, ecx
call fcn.00417b40
int3
lea rcx, str._Extractor__No_app_version_found_and_we_are_offline_so_will_extract_n
call fcn.0040b520
jmp 0x404b96
lea rcx, str._Extractor__No_latest_GU_or_JRE_version_exists__will_check_tail_for_online_offline_info_n
call fcn.0040b520
mov rbx, qword [rsp + 0x88]
test rdi, rdi
lea rcx, str._Extractor__Note:_No_latest_JRE_version_exists_n
je 0x404ba9
lea rcx, str._Extractor__Note:_Latest_JRE_version_does_exist_n
call fcn.0040b520
test rsi, rsi
lea rcx, str._Extractor__Note:_No_latest_GU_version_exists_n
je 0x404bc1
lea rcx, str._Extractor__Note:_Latest_GU_version_does_exist_n
call fcn.0040b520
test bpl, bpl
jne 0x404be2
lea rcx, str._Extractor__Unable_to_run__we_are_just_a_launcher__n
call fcn.0040b520
mov ecx, 1
call fcn.00417b40
int3
lea rcx, [rsp + 0x11e0]
call fcn.0040b43c
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x1e0]
mov byte [rsp + 0x1e0], 0
call fcn.004169f0
lea rdx, str.logs
lea rcx, [rsp + 0x1e0]
call fcn.0040b480
lea rcx, [rsp + 0x1e0]
call fcn.0040b43c
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x1e0]
mov byte [rsp + 0x1e0], 0
call fcn.004169f0
lea rdx, str.JWApps
lea rcx, [rsp + 0x1e0]
call fcn.0040b480
lea rcx, [rsp + 0x1e0]
call fcn.0040b43c
mov r9, qword [rsp + 0xd8]
lea r8, str.JWrapper
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0xd580]
call fcn.00401894
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x4c90]
call fcn.004018fc
mov r8, qword [rsp + 0xc8]
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x123c0]
mov r9, rbx
call fcn.00401894
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0xfca0]
call fcn.004018fc
lea rdx, [rsp + 0xd580]
lea rcx, str._Extractor__GU_folder_is__s_n
call fcn.0040b520
lea rdx, [rsp + 0x4c90]
lea rcx, str._Extractor__GU_temp_is__s_n
call fcn.0040b520
lea rcx, [rsp + 0x4c90]
call fcn.0040b43c
test eax, eax
je 0x404d29
lea rcx, str._Extractor__Unable_to_create_GU_Temp_folder___assuming_elevation_required_n
call fcn.0040b520
mov ecx, 1
call fcn.00417b40
int3
lea rdx, [rsp + 0x4c90]
mov rcx, r15
call fcn.00409e8c
lea rdx, [rsp + 0x4c90]
lea rcx, [rsp + 0x1e0]
mov byte [rsp + 0x1e0], 0
call fcn.004169f0
lea rdx, str.nativesplash.png
lea rcx, [rsp + 0x1e0]
call fcn.0040b480
lea r11, [rsp + 0x1e0]
movsx eax, byte [r11]
cmp eax, 0x2f
jne 0x404d7f
mov byte [r11], 0x5c
add r11, 1
test eax, eax
jne 0x404d72
mov rax, qword [rsp + 0x1a8]
mov rbp, qword [rsp + 0x90]
test rax, rax
je 0x404e37
lea rdx, [0x0044c8f0]
mov rcx, rax
call fcn.004188c0
test eax, eax
jne 0x404e37
lea rcx, str._Extractor__Authorised_to_override_the_splash_image._n
call fcn.0040b520
mov rbx, qword [rsp + 0xb8]
xor edx, edx
test rbx, rbx
lea rcx, str._Extractor__DynamicSplash_is__d__size_is__d_n
mov r8, rbp
setne dl
call fcn.0040b520
test rbx, rbx
je 0x404e37
test rbp, rbp
je 0x404e37
lea rdx, [rsp + 0x1e0]
lea rcx, str._Extractor__Overwriting_splash_image_at__s_n
call fcn.0040b520
lea rdx, [0x0044b810]
lea rcx, [rsp + 0x1e0]
call fcn.004181b0
mov rcx, qword [rsp + 0xb8]
mov r8, rbp
mov r9, rax
mov edx, 1
mov rbx, rax
call fcn.00419f40
mov rcx, rbx
call fcn.0041aa90
lea rdx, [rsp + 0x4c90]
mov rcx, r15
call fcn.00409e8c
lea rdx, [rsp + 0x4c90]
mov rcx, r15
call fcn.00409e8c
lea rdx, [rsp + 0x4c90]
mov rcx, r15
call fcn.00409e8c
lea rcx, str._Extractor__Extracted_GU_and_GU_Version_n
call fcn.0040b520
lea rdx, [rsp + 0xd580]
lea rcx, str._Extractor__Renaming_GU_folder_to__s_n
call fcn.0040b520
lea rdx, [rsp + 0xd580]
lea rcx, [rsp + 0x4c90]
call fcn.00401424
lea rdx, [rsp + 0xd580]
lea rcx, str._Extractor__Creating_unrestricted_directory_under__s_n
call fcn.0040b520
lea rdx, [rsp + 0xd580]
lea rcx, [rsp + 0x1e0]
xor ebp, ebp
mov byte [rsp + 0x1e0], bpl
call fcn.004169f0
lea rdx, str.unrestricted
lea rcx, [rsp + 0x1e0]
call fcn.0040b480
lea rcx, [rsp + 0x1e0]
call fcn.0040b43c
lea rcx, str._Extractor__Recreating_GU_location_n
call fcn.0040b520
lea rdx, [rsp + 0xd580]
lea rcx, [rsp + 0x4c90]
mov byte [rsp + 0x4c90], bpl
call fcn.004169f0
lea rdx, [rsp + 0xd580]
lea rcx, [rsp + 0xc1f0]
mov byte [rsp + 0xc1f0], bpl
call fcn.004169f0
lea rdx, str.cacerts
lea rcx, [rsp + 0xc1f0]
call fcn.0040b480
lea rdx, [rsp + 0xc1f0]
lea rcx, str._Extractor__CACerts_override_path_is__s_n
call fcn.0040b520
lea rdx, [rsp + 0x4c90]
lea rcx, [rsp + 0xae60]
mov byte [rsp + 0xae60], bpl
call fcn.004169f0
lea rdx, str.verpatch.exe
lea rcx, [rsp + 0xae60]
call fcn.0040b480
lea rdx, [rsp + 0xd580]
lea rcx, [rsp + 0xe910]
mov byte [rsp + 0xe910], bpl
call fcn.004169f0
lea rdx, str.nativesplash.png
lea rcx, [rsp + 0xe910]
call fcn.0040b480
lea rdx, [rsp + 0xe910]
lea rcx, str._Extractor__Native_Splash_PNG_path_is__s_n
call fcn.0040b520
lea rcx, str._Extractor__Configuring_splash_n
call fcn.0040b520
lea rcx, [rsp + 0xe910]
call fcn.00406a04
lea rcx, str._Extractor__Showing_splash_n
call fcn.0040b520
cmp r14b, bpl
jne 0x405008
cmp r13b, bpl
jne 0x405008
call fcn.00406ab8
mov ecx, 0xffffffff
call fcn.00406bbc
cmp rdi, rbp
jne 0x405752
lea rcx, str._Extractor__Setting_up_a_JRE_n
call fcn.0040b520
mov rbx, qword [rsp + 0x1c8]
mov rcx, rbx
call fcn.00416930
cmp rax, rbp
jbe 0x40519e
lea rcx, str.Extracting_Offline_JRE
call fcn.0040b6ec
lea rcx, str._Extractor__We_want_to_query_the_JRE_version_to_enable_proxy_detection._n
call fcn.0040b520
lea r8, [rsp + 0x2570]
lea rcx, [rsp + 0x4c90]
mov rdx, r12
call fcn.00402c14
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x6020]
call fcn.004018fc
lea rcx, [rsp + 0x6020]
call fcn.0040b43c
lea r8, [rsp + 0x2570]
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x73b0]
mov r9, rbx
call fcn.00401894
lea rcx, str._Extractor__Offline_installer___no_need_to_download_JRE__will_extract_n
call fcn.0040b520
lea rdx, [rsp + 0x6020]
lea rcx, [rsp + 0x3900]
mov byte [rsp + 0x3900], bpl
call fcn.004169f0
lea rdx, str.JRE.p2
lea rcx, [rsp + 0x3900]
call fcn.0040b480
lea rcx, [rsp + 0x6020]
call fcn.004013a8
lea rcx, str._Extractor__UP200_path_is__s_n
mov rdx, rax
mov qword [0x00468048], rax
call fcn.0040b520
lea rcx, str._Extractor__Extracting_JRE_archive..._n
call fcn.0040b520
lea rdx, [rsp + 0x6020]
mov rcx, r15
call fcn.00409e8c
lea rdx, [rsp + 0x2570]
lea rcx, str._Extractor__Extracted_JRE__s_n
call fcn.0040b520
lea rcx, str._Extractor__Regenerating_jsa..._n
call fcn.0040b520
lea rcx, [rsp + 0x6020]
call fcn.00401334
mov rbx, rax
call fcn.00408214
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.00408284
lea rdx, str._Xshare:dump
mov rcx, rdi
call fcn.0040824c
xor edx, edx
mov rcx, rdi
call fcn.004082bc
mov rcx, rdi
call fcn.004166e0
lea rcx, str.Extracting_Offline_JRE
jmp 0x4056bc
lea rcx, str.Setting_up_online_JRE
call fcn.0040b6ec
mov rax, qword [rsp + 0xe8]
mov byte [rsp + 0x100], bpl
cmp rax, rbp
je 0x4051dd
mov rcx, rax
call fcn.00416930
cmp rax, rbp
jbe 0x4051dd
lea rcx, str._Extractor__Online_installer___no_stored_JRE._Skipping_system_JRE._n
call fcn.0040b520
jmp 0x40526b
lea rcx, str._Extractor__Online_installer___no_stored_JRE__will_check_for_compatible_system_JRE_n
call fcn.0040b520
mov rax, qword [rsp + 0xf0]
mov r8, qword [rsp + 0xa8]
mov dl, byte [rsp + 0x98]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
lea r9, [rsp + 0x11e0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x15ed0]
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x15ec8]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x6020]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call fcn.00402ee4
lea rcx, [rsp + 0x100]
call fcn.00416930
cmp rax, rbp
jbe 0x4052a6
lea rcx, str._Extractor__We_are_copying_the_JRE._We_want_to_query_the_JRE_version_to_enable_proxy_detection._n
call fcn.0040b520
lea r8, [rsp + 0x2570]
lea rcx, [rsp + 0x4c90]
mov rdx, r12
call fcn.00402c14
jmp 0x405653
lea rcx, str._JREDownload__Failed_to_pick_up_any_existing_system_JRE__will_download_n
call fcn.0040b520
call fcn.00402bbc
lea rdx, [rsp + 0x4c90]
lea rcx, [rsp + 0x9ad0]
mov rbx, rax
mov byte [rsp + 0x9ad0], bpl
call fcn.004169f0
lea rdx, str.JWrapper_
lea rcx, [rsp + 0x9ad0]
call fcn.0040b480
lea rdx, [rsp + 0x2570]
lea rcx, [rsp + 0x9ad0]
call fcn.004169f0
lea rdx, str._version.txt
lea rcx, [rsp + 0x9ad0]
call fcn.004169f0
lea rcx, [rsp + 0x3900]
mov rdx, r12
mov byte [rsp + 0x3900], bpl
call fcn.004169f0
lea rdx, str.JWrapper_
lea rcx, [rsp + 0x3900]
call fcn.004169f0
lea rdx, [rsp + 0x2570]
lea rcx, [rsp + 0x3900]
call fcn.004169f0
lea rdx, str._version.txt
lea rcx, [rsp + 0x3900]
call fcn.004169f0
lea rdx, str._time
lea rcx, [rsp + 0x3900]
call fcn.004169f0
lea rcx, [rsp + 0x3900]
mov rdx, rbx
call fcn.004169f0
mov rcx, rbx
call fcn.004166e0
cmp r14b, bpl
jne 0x4053a4
cmp r13b, bpl
jne 0x4053a4
call fcn.00406ab8
lea rdx, [rsp + 0x3900]
lea rcx, str._JREDownload__Fetching_JRE_Version_from__s_n
call fcn.0040b520
lea rdx, [rsp + 0x9ad0]
lea rcx, str._JREDownload__Saving_into__s_n
call fcn.0040b520
lea rdx, [rsp + 0x9ad0]
lea rcx, [rsp + 0x3900]
call fcn.00409700
cmp eax, ebp
je 0x40572c
mov ecx, 0xffffffff
call fcn.00406bbc
lea rdx, [rsp + 0x9ad0]
lea rcx, str._JREDownload__JRE_version_downloaded_OK___s__n
call fcn.0040b520
lea rdx, [0x0044c500]
lea rcx, [rsp + 0x9ad0]
call fcn.004181b0
cmp rax, rbp
mov rdi, rax
jne 0x405436
call fcn.00416bd0
lea rcx, str._JREDownload___Unable_to_open_version_file____d__n
mov edx, dword [rax]
call fcn.0040b520
lea rcx, str._JREDownload__Extracting_version:
call fcn.0040b520
mov rcx, rdi
call fcn.0041ab40
xor esi, esi
jmp 0x40548a
lea rcx, [0x0044e314]
mov edx, ebx
call fcn.0040b520
cmp ebx, 0xd
je 0x4054aa
cmp ebx, 0xa
je 0x4054aa
cmp ebx, 0x20
je 0x4054aa
cmp rsi, 0x32
mov byte [rsp + rsi + 0x100], bl
jge 0x405493
mov eax, 1
mov rcx, rdi
add ebp, eax
add rsi, rax
call fcn.0041ab40
cmp eax, 0xffffffff
mov ebx, eax
jne 0x40544e
jmp 0x4054b6
lea rcx, str._n_JREDownload__Version_invalid__too_long__n
call fcn.0040b520
mov ecx, 1
call fcn.00417b40
int3
lea rcx, str._n_JREDownload__Spaces_in_version_file__assuming_EOF_n
call fcn.0040b520
lea rcx, [0x0044cf20]
call fcn.0040b520
test rdi, rdi
je 0x4054cf
mov rcx, rdi
call fcn.0041aa90
movsxd rax, ebp
lea rdx, [rsp + 0x100]
lea rcx, str._JREDownload__JRE_Version_is__s_n
xor ebp, ebp
mov byte [rsp + rax + 0x100], bpl
call fcn.0040b520
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x6020]
call fcn.004018fc
lea rcx, [rsp + 0x6020]
call fcn.0040b43c
lea rcx, [rsp + 0x3900]
mov rdx, r12
mov byte [rsp + 0x3900], bpl
call fcn.004169f0
lea rdx, str.JWrapper_
lea rcx, [rsp + 0x3900]
call fcn.004169f0
lea rdx, [rsp + 0x2570]
lea rcx, [rsp + 0x3900]
call fcn.004169f0
lea rdx, [0x0044ba74]
lea rcx, [rsp + 0x3900]
call fcn.004169f0
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x3900]
call fcn.004169f0
lea rdx, str._archive.p2.l2
lea rcx, [rsp + 0x3900]
call fcn.004169f0
lea rcx, [rsp + 0x6020]
call fcn.004013a8
cmp r14b, bpl
mov qword [0x00468048], rax
jne 0x4055b3
cmp r13b, bpl
jne 0x4055b3
call fcn.00406ab8
lea rdx, [rsp + 0x6020]
lea rcx, str._JREDownload__Extracting_JRE_archive_to__s_n
call fcn.0040b520
lea rdx, [rsp + 0x6020]
lea rcx, [rsp + 0x3900]
call fcn.00409868
cmp eax, ebp
jne 0x4055f7
lea rcx, str._JREDownload__Failed_to_download_and_extract_JRE_archive._n
call fcn.0040b520
mov ecx, 1
call fcn.00417b40
int3
lea rcx, str._JREDownload__Regenerating_jsa..._n
call fcn.0040b520
lea rcx, [rsp + 0x6020]
call fcn.00401334
mov rbx, rax
call fcn.00408214
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.00408284
lea rdx, str._Xshare:dump
mov rcx, rdi
call fcn.0040824c
xor edx, edx
mov rcx, rdi
call fcn.004082bc
mov rcx, rdi
call fcn.004166e0
lea rcx, str._JREDownload__Downloaded_JRE_is_now_ready._n
call fcn.0040b520
lea rcx, [rsp + 0x100]
call fcn.00416930
cmp rax, rbp
jne 0x40567c
lea rcx, str._JREDownload__Failed_to_detect_or_download_a_JRE__no_jre_version__n
call fcn.0040b5ec
mov ecx, 1
call fcn.00417b40
int3
lea rdx, [rsp + 0x100]
lea rcx, str._JREDownload__Finalising_setup_of_new_JRE__s_n
call fcn.0040b520
lea r9, [rsp + 0x100]
lea r8, [rsp + 0x2570]
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x73b0]
call fcn.00401894
lea rcx, str.Setting_up_online_JRE
call fcn.0040b724
lea rdx, [rsp + 0x73b0]
lea rcx, [rsp + 0x6020]
call fcn.00401424
lea rdx, [rsp + 0x73b0]
lea rcx, str._Extractor__Renamed_JRE_folder_to__s_n
call fcn.0040b520
lea rcx, str._Extractor__JRE_setup._Overriding_cacerts._n
call fcn.0040b520
lea rcx, [rsp + 0xc1f0]
call fcn.0040afe8
cmp eax, ebp
je 0x40571e
lea rdx, [rsp + 0x73b0]
lea rcx, [rsp + 0xc1f0]
call fcn.00403214
jmp 0x40577f
lea rcx, str._Extractor__Override_CACerts_does_not_exist._n
call fcn.0040b520
jmp 0x40577f
cmp r14b, bpl
jne 0x40573b
cmp r13b, bpl
jne 0x40573b
call fcn.004069b4
lea rcx, str._JREDownload__Failed_to_download_JRE_version_file_n
call fcn.0040b5ec
mov ecx, 1
call fcn.00417b40
int3
lea rdx, [rsp + 0x11e0]
lea rcx, [rsp + 0x73b0]
mov byte [rsp + 0x73b0], bpl
call fcn.004169f0
lea rcx, [rsp + 0x73b0]
mov rdx, rdi
call fcn.0040b480
lea rdx, [rsp + 0x14ae0]
lea rcx, [rsp + 0x8740]
mov byte [rsp + 0x8740], bpl
call fcn.004169f0
lea rdx, str.DetectedProxy
lea rcx, [rsp + 0x8740]
call fcn.0040b480
lea rcx, str._Extractor__Saving_proxy_configuration_n
call fcn.0040b520
cmp qword [0x00468028], rbp
je 0x405858
lea rcx, str._Proxy__Saving_proxy_settings_now._n
call fcn.0040b520
mov rbx, qword [0x00468028]
lea rcx, [rsp + 0x8740]
cmp qword [rbx], rbp
jne 0x4057f1
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x405864
lea rdx, [0x0044b810]
call fcn.004181b0
cmp rax, rbp
mov rdi, rax
je 0x405864
cmp qword [rbx], rbp
je 0x40584e
lea rcx, str._Proxy__Saved_proxy_list_n
call fcn.0040b520
mov rcx, qword [rbx]
mov rdx, rdi
call fcn.0041b840
cmp qword [rbx + 8], rbp
je 0x40584e
lea rcx, str._Proxy__Saved_proxy_bypass_list_n
call fcn.0040b520
lea rcx, [0x0044f9a4]
mov rdx, rdi
call fcn.0041b840
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.0041b840
mov rcx, rdi
call fcn.0041aa90
jmp 0x405864
lea rcx, str._Proxy__No_working_proxy_was_found__so_no_proxy_to_be_saved._n
call fcn.0040b520
lea rcx, [rsp + 0x73b0]
call fcn.004013a8
lea rcx, str._Extractor__UP200_path_is__s_n
mov rdx, rax
mov qword [0x00468048], rax
call fcn.0040b520
mov rbx, qword [rsp + 0x88]
mov rcx, rbx
call fcn.00416930
cmp rax, rbp
jbe 0x405931
lea rcx, str._Extractor__Offline_installer___app_to_extract._n
call fcn.0040b520
lea rdx, [rsp + 0x123c0]
lea rcx, str._Extractor__APP_folder_is__s_n
call fcn.0040b520
lea rdx, [rsp + 0xfca0]
lea rcx, str._Extractor__APP_temp_is__s_n
call fcn.0040b520
lea rcx, [rsp + 0xfca0]
call fcn.0040b43c
cmp eax, ebp
je 0x4058fc
lea rcx, str.Unable_to_create_App_Temp_folder_n
call fcn.0040b5ec
mov ecx, 1
call fcn.00417b40
int3
lea rcx, str._Extractor__Extracting_App..._n
call fcn.0040b520
lea rdx, [rsp + 0xfca0]
mov rcx, r15
call fcn.00409e8c
lea rdx, [rsp + 0xfca0]
mov rcx, r15
call fcn.00409e8c
lea rcx, str._Extractor__Setting_permissions..._n
jmp 0x405938
lea rcx, str._Extractor__Online_installer___no_app_to_extract_n
call fcn.0040b520
mov rcx, rbx
call fcn.00416930
cmp rax, rbp
jbe 0x405973
lea rdx, [rsp + 0x123c0]
lea rcx, [rsp + 0xfca0]
call fcn.00401424
lea rdx, [rsp + 0x123c0]
lea rcx, str._Extractor__Renaming_App_folder_to__s_n
call fcn.0040b520
lea rdx, str.JWrapper
lea rcx, [rsp + 0x11e0]
call fcn.0040b898
cmp rax, rbp
mov rbx, rax
jne 0x4059a6
lea rcx, str.No_latest_App_version_even_after_download__n
call fcn.0040b5ec
mov ecx, 1
call fcn.00417b40
int3
call fcn.004069b4
lea rcx, str._Extractor__Will_now_run_latest_GU__s_n
mov rdx, rbx
call fcn.0040b520
mov rcx, r15
call fcn.00407938
cmp r13b, bpl
jne 0x405a64
mov r11, qword [rsp + 0xe0]
mov r9, qword [rsp + 0x15ed0]
mov r8d, dword [rsp + 0x15ec8]
mov rdx, qword [rsp + 0xc0]
lea rax, [rsp + 0xae60]
lea rcx, [rsp + 0x11e0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf0]
mov byte [rsp + 0x68], bpl
mov qword [rsp + 0x60], rax
mov al, byte [rsp + 0x80]
mov qword [rsp + 0x58], r11
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], ebp
lea rax, [rsp + 0x2570]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.00401bb8
xor ecx, ecx
call fcn.00417b40
int3