Function at 0x4043c0
Capabilities:
Check os version
Query environment variable
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x548
mov rdi, rcx
mov ebx, 0x104
mov r15d, edx
mov rcx, rbx
call fcn.004171e0
mov rcx, rbx
mov rsi, rax
call fcn.004171e0
mov rcx, rbx
mov qword [rsp + 0x98], rax
call fcn.004171e0
mov rcx, rbx
mov qword [rsp + 0x80], rax
call fcn.004171e0
mov rcx, rbx
mov qword [rsp + 0x50], rax
call fcn.004171e0
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [0x0045cc80]
mov qword [rsp + 0x90], rax
call fcn.00419040
xor edx, edx
lea rcx, [0x0045ccf0]
lea r8d, [rdx + 0x78]
call fcn.00419040
xor edx, edx
lea rcx, [0x0045ccb0]
lea r8d, [rdx + 0x38]
call fcn.00419040
mov rcx, rbx
call fcn.004171e0
mov qword [0x0045ccd8], rax
call fcn.00401250
xor r13d, r13d
cmp al, r13b
je 0x4044ac
lea rdx, [rsp + 0x68]
lea rcx, [0x0045cce8]
xor r8d, r8d
mov dword [rsp + 0x68], 1
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x78], r13d
mov dword [rsp + 0x7c], r13d
call sub.gdiplus.dll_GdiplusStartup
call fcn.0040b0e8
mov rcx, rdi
mov r14, rax
call fcn.004173f0
cmp rax, 3
jb 0x4044e3
cmp byte [rdi], 0x5c
jne 0x4044cd
cmp byte [rdi + 1], 0x5c
je 0x4044d9
cmp byte [rdi + 1], 0x3a
jne 0x4044e3
cmp byte [rdi + 2], 0x5c
jne 0x4044e3
mov rbp, rdi
mov qword [rsp + 0x48], rdi
jmp 0x404508
mov rcx, rbx
call fcn.004171e0
mov edx, ebx
mov rcx, rax
mov rbp, rax
mov qword [rsp + 0x48], rax
call fcn.0041ae70
mov rdx, rdi
mov rcx, rbp
call fcn.0040bc6c
lea rcx, str._Extractor__The_absolute_wrapper_path_is__s_n
mov rdx, rbp
call fcn.0040bd0c
lea rcx, str._Extractor__The_executable_name_is__s_n
mov rdx, rdi
call fcn.0040bd0c
call fcn.0040ac6c
lea rcx, str._Extractor__Platform_is__s_n
mov rdx, rax
call fcn.0040bd0c
call fcn.0040ac34
lea rcx, str._Extractor__OS_is__s_n
mov rdx, rax
call fcn.0040bd0c
mov rcx, rbx
call fcn.004171e0
mov rdx, rbp
mov rcx, rax
mov rbx, rax
mov byte [rax], r13b
call fcn.004174b0
mov rcx, rbx
mov ebp, r13d
mov r12d, r13d
call fcn.004173f0
cmp eax, r13d
jle 0x40459e
mov r13, rbx
cmp byte [r13], 0x5c
mov rcx, rbx
cmove ebp, r12d
add r12d, 1
add r13, 1
call fcn.004173f0
cmp r12d, eax
jl 0x40457d
xor r13d, r13d
movsxd rax, ebp
mov r12d, 0x40
mov rcx, r12
mov byte [rax + rbx], r13b
call fcn.004171e0
lea rdx, [0x0044c8d8]
mov rcx, rdi
mov byte [rax + 0x22], 9
mov byte [rax + 0x23], 0x7a
mov byte [rax + 0x24], 0x3e
mov byte [rax + 0x25], 0x2f
mov byte [rax + 0x26], 0x2e
mov byte [rax + 0x27], 0xfa
mov byte [rax + 0x28], 0xff
mov byte [rax + 0x29], 0x1d
mov byte [rax + 0x2a], 0xf0
mov byte [rax + 0x2b], 0x9b
mov byte [rax + 0x2c], 0x19
mov byte [rax + 0x2d], 0x7c
mov byte [rax + 0x2e], 0x15
mov byte [rax + 0x2f], 0xb8
mov byte [rax + 0x30], 0x1e
mov byte [rax + 0x31], 0x6d
mov byte [rax + 0x32], 0xc6
mov byte [rax + 0x33], 0x10
mov byte [rax + 0x34], 0x41
mov byte [rax + 0x35], 0x7e
mov byte [rax + 0x36], 0x5c
mov byte [rax + 0x37], 0xed
mov byte [rax + 0x38], 0x51
mov byte [rax + 0x39], 0xb1
mov byte [rax + 0x3a], 0x19
mov byte [rax + 0x3b], 0x1c
mov byte [rax + 0x3c], 0x3c
mov byte [rax + 0x3d], 0xe2
mov byte [rax + 0x3e], 0x94
mov byte [rax + 0x3f], 0xd8
mov byte [rax], 0x59
mov byte [rax + 1], 0xbd
mov byte [rax + 2], 0xc9
mov byte [rax + 3], 0x52
mov byte [rax + 4], 0xaa
mov byte [rax + 5], 0x35
mov byte [rax + 6], 0xad
mov byte [rax + 7], 0xbb
mov byte [rax + 8], 0x10
mov byte [rax + 9], 0xef
mov byte [rax + 0xa], 0xde
mov byte [rax + 0xb], 0x67
mov byte [rax + 0xc], 0x2c
mov byte [rax + 0xd], 0x47
mov byte [rax + 0xe], 0xe0
mov byte [rax + 0xf], 0xb5
mov byte [rax + 0x10], 0xd4
mov byte [rax + 0x11], 0x82
mov byte [rax + 0x12], 0x1f
mov byte [rax + 0x13], 0x81
mov byte [rax + 0x14], 0x52
mov byte [rax + 0x15], 0xa1
mov byte [rax + 0x16], 2
mov byte [rax + 0x17], 0x44
mov byte [rax + 0x18], 0x2a
mov byte [rax + 0x19], 0xeb
mov byte [rax + 0x1a], 0xaa
mov byte [rax + 0x1b], 0x7b
mov byte [rax + 0x1c], 0x79
mov byte [rax + 0x1d], 0x3b
mov byte [rax + 0x1e], 0x93
mov byte [rax + 0x1f], 0x45
mov byte [rax + 0x20], 0xae
mov byte [rax + 0x21], 0xd2
mov rbx, rax
call fcn.00419020
cmp rax, r13
mov rbp, rax
jne 0x4046e6
lea rcx, str._Extractor___Failed_to_extract_wrapper_params___couldnt_open_file__s_n
mov rdx, rdi
call fcn.0040bd0c
lea ecx, [r12 - 0x3f]
call fcn.004187f0
int3
lea r9, str.Params
mov r8d, r12d
mov rdx, rbx
mov rcx, rax
call fcn.0040bba4
cmp eax, 0xffffffff
jne 0x404709
lea ecx, [rax + 2]
call fcn.004187f0
int3
mov rcx, rbp
call fcn.00409900
lea rcx, str._Extractor__Found_Params_marker._Extracting_now..._n
mov rbx, rax
call fcn.0040bd0c
mov r12d, 0x30d40
mov rcx, r12
call fcn.004171e0
mov r8, r12
xor edx, edx
mov rcx, rax
mov rbp, rax
mov qword [rsp + 0x60], rax
call fcn.00419040
mov r12, qword [rsp + 0x5a0]
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
mov r9, r12
call fcn.004036c4
mov rcx, rbx
call fcn.00407b44
lea rcx, str.Processing_dynamic_properties
call fcn.0040bf10
cmp byte [rsp + 0x5b8], r13b
je 0x404786
lea rcx, str._Extractor__This_is_an_elevated_run_purely_to_prepare_an_installation._Will_not_show_UI_or_launch_an_app_n
call fcn.0040bd0c
lea rcx, [0x0044dcf0]
call fcn.0040bd0c
lea rcx, str.Extracting_wrapper_tail
call fcn.0040bed8
lea rdx, [0x0044c8d8]
mov rcx, rdi
call fcn.00419020
cmp rax, r13
mov rbx, rax
jne 0x4047cf
lea rcx, str._Extractor___Failed_to_extract_wrapper_tail___couldnt_open_file__s_n
mov rdx, rdi
call fcn.0040bd0c
mov ecx, 1
call fcn.004187f0
int3
lea r9, str.Tail
mov r8d, 0x80
mov rdx, r14
mov rcx, rax
call fcn.0040bba4
cmp eax, 0xffffffff
jne 0x4047f5
lea ecx, [rax + 2]
call fcn.004187f0
int3
lea rcx, str._Extractor__Found_tail_marker_n
call fcn.0040bd0c
mov rcx, rbx
call fcn.00409900
mov rcx, rax
mov r13, rax
call fcn.00403290
mov rcx, qword [0x0045cd40]
lea rdx, [0x0044cdb4]
call fcn.00419540
test eax, eax
jne 0x404847
mov rdx, qword [0x0045ccb0]
lea rcx, str._Extractor__Will_use_Dynamic_Update_URL:__s_n
call fcn.0040bd0c
mov r15, qword [0x0045ccb0]
jmp 0x404861
mov rdx, qword [0x0045cd40]
lea rcx, str._Extractor__Will_use_Static_Update_URL:__s_n
call fcn.0040bd0c
mov r15, qword [0x0045cd40]
mov al, byte [0x0045ccba]
mov ebx, dword [rsp + 0x598]
test al, al
jne 0x404889
mov rcx, qword [0x0045cd30]
mov r8, r12
mov edx, ebx
call fcn.00403120
mov byte [0x0045ccba], al
mov dl, byte [0x0045ccbb]
test dl, dl
jne 0x4048b2
mov rcx, qword [0x0045cd50]
mov r8, r12
mov edx, ebx
call fcn.00403120
mov dl, al
mov byte [0x0045ccbb], al
mov al, byte [0x0045ccba]
mov cl, byte [0x0045ccbc]
test cl, cl
jne 0x4048e1
mov rcx, qword [0x0045cd58]
mov r8, r12
mov edx, ebx
call fcn.00403120
mov dl, byte [0x0045ccbb]
mov cl, al
mov byte [0x0045ccbc], al
mov al, byte [0x0045ccba]
xor r12d, r12d
cmp al, r12b
je 0x404904
lea rcx, str._Extractor__Silent_install_is__d_n
movzx edx, al
call fcn.0040bd0c
mov cl, byte [0x0045ccbc]
mov dl, byte [0x0045ccbb]
cmp dl, r12b
je 0x40491e
lea rcx, str._Extractor__Repair_install_is__d_n
movzx edx, dl
call fcn.0040bd0c
mov cl, byte [0x0045ccbc]
cmp cl, r12b
je 0x404932
movzx edx, cl
lea rcx, str._Extractor__Reinstall_is__d_n
call fcn.0040bd0c
lea rcx, str.Extracting_tail
call fcn.0040bf10
lea rcx, str._Extractor__Setting_up_static_properties_n
call fcn.0040bd0c
mov r8, qword [0x0045cd40]
lea rdx, str.update_url
mov rcx, rbp
call fcn.00409cc8
mov r8, qword [0x0045cd28]
lea rdx, str.install_type
mov rcx, rbp
call fcn.00409cc8
mov r8, qword [0x0045cd10]
lea rdx, str.min_splash_ms
mov rcx, rbp
call fcn.00409cc8
mov r8, qword [0x0045cd18]
lea rdx, str.jwsig_public_key
mov rcx, rbp
call fcn.00409cc8
mov r8, qword [0x0045cd20]
lea rdx, str.can_override_splash
mov rcx, rbp
call fcn.00409cc8
mov r8, qword [0x0045ccf0]
lea rdx, str.app_name
mov rcx, rbp
call fcn.00409cc8
mov r8, qword [0x0045ccf8]
lea rdx, str.wrapper_app_version
mov rcx, rbp
call fcn.00409cc8
mov r8, qword [0x0045cd08]
lea rdx, str.wrapper_gu_version
mov rcx, rbp
call fcn.00409cc8
mov r8, qword [0x0045cd30]
lea rdx, str.silent_parameter
mov rcx, rbp
call fcn.00409cc8
mov r8, qword [0x0045cd38]
lea rdx, str.java_version
mov rcx, rbp
call fcn.00409cc8
mov r8, qword [0x0045cd48]
lea rdx, str.skip_system_jre
mov rcx, rbp
call fcn.00409cc8
cmp byte [0x0045ccba], r12b
je 0x404a5b
lea r8, str.true
lea rdx, str.show_no_ui
mov rcx, rbp
call fcn.00409cc8
mov rcx, qword [0x0045cd18]
mov qword [0x004690d0], r12
cmp rcx, r12
jne 0x404a77
lea rcx, str._Extractor__Public_key_empty__no_public_key__n
jmp 0x404a88
call fcn.004173f0
cmp rax, r12
ja 0x404a92
lea rcx, str._Extractor__Public_key_length___0__no_public_key__n
call fcn.0040bd0c
jmp 0x404b14
mov rcx, qword [0x0045cd18]
call fcn.004173f0
mov rbx, rax
shr rbx, 1
add rbx, 2
mov rcx, rbx
call fcn.004171e0
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.00419040
mov r8, qword [0x0045cd18]
mov edx, ebx
mov rcx, rdi
call fcn.0040b2fc
lea rcx, str._Extractor__Processed_public_key_of_length__d_n
mov edx, eax
mov ebx, eax
call fcn.0040bd0c
mov rdx, qword [0x0045cd18]
lea rcx, str._Extractor__Hex:__s_n
call fcn.0040bd0c
mov edx, ebx
mov rcx, rdi
call fcn.00401048
lea rcx, str._Extractor__Public_Key:__08X_n
mov rdx, rax
mov qword [0x004690d0], rax
call fcn.0040bd0c
mov rbx, qword [0x0045cd28]
lea rdx, str.perm_all
mov rcx, rbx
call fcn.00419540
cmp eax, r12d
jne 0x404bb8
lea rcx, str.Permanent_install_for_all_users_n
call fcn.0040bd0c
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, r12d
je 0x404b75
cmp dword [rsp + 0xa4], 5
jbe 0x404b75
lea rcx, str.PROGRAMDATA
call fcn.0041c560
jmp 0x404be4
lea rcx, str.ALLUSERSPROFILE
call fcn.0041c560
mov ecx, 0x104
mov rbx, rax
call fcn.004171e0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], r12b
call fcn.004174b0
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.0040bc6c
mov rcx, rdi
call fcn.0040bc24
jmp 0x404be7
lea rdx, str.perm_user
mov rcx, rbx
call fcn.00419540
lea rcx, str.Permanent_install_for_current_user_n
cmp eax, r12d
je 0x404bda
lea rcx, str.Temporary_install_n
call fcn.0040bd0c
call fcn.0040b994
mov rdi, rax
cmp rdi, r12
jne 0x404c03
lea rcx, str.ERROR:_Unable_to_get_shared_dir_
call fcn.0040bd0c
mov ecx, 1
call fcn.004187f0
int3
lea rcx, str._Extractor__Shared_dir_is__s_n
mov rdx, rdi
call fcn.0040bd0c
lea rcx, str._Extractor__Update_URL_is_currently__s_n
mov rdx, r15
call fcn.0040bd0c
mov rcx, r15
call fcn.004173f0
cmp eax, r12d
jle 0x404c42
cdqe
cmp byte [rax + r15 - 1], 0x2f
je 0x404c42
mov byte [rax + r15], 0x2f
mov byte [rax + r15 + 1], r12b
lea rcx, str._Extractor__Update_URL_is_now__s_n
mov rdx, r15
call fcn.0040bd0c
mov rdx, rdi
mov rcx, rsi
mov byte [rsi], r12b
call fcn.004174b0
lea rdx, str.JWrapper_
mov rcx, rsi
call fcn.0040bc6c
mov rdx, qword [0x0045ccf0]
mov rcx, rsi
call fcn.004174b0
lea rcx, str._Extractor__Master_folder_is__s_n
mov rdx, rsi
call fcn.0040bd0c
mov dl, byte [0x0045ccbc]
cmp dl, r12b
jne 0x404ca0
cmp byte [0x0045ccbb], r12b
je 0x404ca8
mov rcx, rsi
call fcn.00401280
mov rcx, qword [0x0045cd28]
lea rdx, str.perm_all
call fcn.00419540
lea rcx, [rsp + 0x88]
cmp eax, r12d
sete r14b
mov byte [rsp + 0x40], r14b
call fcn.0041b7b0
lea rcx, [rsp + 0x88]
call fcn.0041b260
mov edi, 0x400
lea rcx, [rsp + 0x140]
mov r8, rdi
xor edx, edx
mov rbx, rax
call fcn.00419040
lea r8, str._Y__m__d__H__M__S
lea rcx, [rsp + 0x140]
mov r9, rbx
mov rdx, rdi
call fcn.0041aa20
lea rcx, [rsp + 0x68]
call fcn.0041b2c0
movzx r9d, word [rsp + 0x70]
cmp eax, r12d
je 0x404d2d
mov r9d, r12d
lea r8, [rsp + 0x140]
lea rdx, str._s__03d.log
lea rcx, [rsp + 0x140]
call fcn.00418380
mov rcx, rsi
call fcn.0040bc24
movzx eax, r14b
mov rdx, rsi
mov ecx, eax
mov dword [rsp + 0x58], eax
call fcn.004013c8
mov rcx, rdi
call fcn.004171e0
mov rdx, rsi
mov rcx, rax
mov rbx, rax
mov byte [rax], r12b
call fcn.004174b0
lea rdx, str.logs
mov rcx, rbx
call fcn.0040bc6c
lea rdx, str.Wrapper_
mov rcx, rbx
call fcn.0040bc6c
lea rdx, [rsp + 0x140]
mov rcx, rbx
call fcn.004174b0
lea rcx, str._Extractor__Logging_to__s_n
mov rdx, rbx
call fcn.0040bd0c
mov qword [0x004691f8], rbx
call fcn.0040bf48
mov rbx, qword [rsp + 0x80]
mov rdx, rsi
mov rcx, rbx
mov byte [rbx], r12b
call fcn.004174b0
lea rdx, str.JWApps
mov rcx, rbx
call fcn.0040bc6c
mov rdi, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
mov byte [rdi], r12b
call fcn.004174b0
lea rdx, str.JreNameOverride
mov rcx, rdi
call fcn.0040bc6c
lea rdx, [0x0044d5c0]
mov rcx, rdi
call fcn.00419020
cmp rax, r12
mov rdi, rax
je 0x404eb3
lea rcx, str._JREOverride__Processing_JRE_Override_file__JreNameOverride__n
call fcn.0040bd0c
lea rdx, str.JRE_Override_App_Name
mov r8d, 0x1f4
mov rcx, rdi
call fcn.00409d04
mov rcx, rdi
mov rbx, rax
call fcn.0041b550
cmp rbx, r12
je 0x404e8a
mov rcx, rbx
call fcn.004173f0
cmp rax, 1
jne 0x404e74
cmp byte [rbx], 0x2d
jne 0x404e74
lea rcx, str._JREOverride__Ignoring_JRE_name____keeping__s_n
jmp 0x404eba
mov rcx, rbx
call fcn.004173f0
cmp rax, r12
jne 0x404e8a
lea rcx, str._JREOverride__Ignoring_empty_JRE_name__keeping__s_n
jmp 0x404eba
mov rax, qword [0x0045ccd8]
mov rdx, rbx
mov byte [rax], r12b
mov rcx, qword [0x0045ccd8]
call fcn.004174b0
mov byte [0x0045cce0], r12b
lea rcx, str._JREOverride__JRE_name_overriden_to__s_n
jmp 0x404eba
lea rcx, str._JREOverride__No_JRE_name_override__will_continue_to_use__s_n
mov rdx, qword [0x0045ccd8]
call fcn.0040bd0c
mov rcx, qword [0x0045cd08]
mov bpl, 1
call fcn.004173f0
cmp rax, r12
jne 0x404eeb
lea rcx, str._Extractor__No_GenericUpdater_embedded__we_are_just_a_launcher_n
call fcn.0040bd0c
mov bpl, r12b
jmp 0x404efe
mov rdx, qword [0x0045cd08]
lea rcx, str._Extractor__Embedded_GenericUpdater_version_is__s_n
call fcn.0040bd0c
mov rcx, qword [0x0045ccf8]
call fcn.004173f0
cmp rax, r12
jne 0x404f1d
lea rcx, str._Extractor__ONLINE_wrapper:_No_App_embedded_n
call fcn.0040bd0c
jmp 0x404f30
mov rdx, qword [0x0045ccf8]
lea rcx, str._Extractor__OFFLINE_wrapper:_App_version_is__s_n
call fcn.0040bd0c
lea rcx, str._Extractor__Checking_for_a_latest_valid_GU_n
call fcn.0040bd0c
mov rbx, qword [0x0045ccf0]
mov ecx, 0x104
call fcn.004171e0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], r12b
call fcn.004174b0
lea rdx, str._Bundle
mov rcx, rdi
call fcn.004174b0
mov rdx, qword [0x0045ccf8]
mov rcx, qword [0x0045ccf0]
mov r8d, 1
mov qword [0x0045cc80], rdi
call fcn.00404344
mov rdx, qword [0x0045cc80]
lea rcx, str._Extractor__Bundle_name_is__s_n
mov qword [0x0045cc88], rax
call fcn.0040bd0c
mov rdx, qword [0x0045cc88]
lea rcx, str._Extractor__Versioned_name_is__s_n
call fcn.0040bd0c
mov rdi, qword [0x0045ccf8]
mov r12, qword [0x0045ccf0]
test rdi, rdi
je 0x40502f
mov rcx, rdi
call fcn.004173f0
test rax, rax
je 0x40502f
mov ecx, 0x104
call fcn.004171e0
mov qword [rsp + 0x30], rdi
lea r8, str._s_cJWrapper__s_Bundle__s
mov r9, rsi
mov edx, 0x104
mov rcx, rax
mov qword [rsp + 0x28], r12
mov rbx, rax
mov dword [rsp + 0x20], 0x5c
call fcn.00418430
mov edx, 6
mov rcx, rbx
call fcn.0041d800
xor r12d, r12d
cmp eax, r12d
je 0x405035
mov rcx, rbx
call fcn.004171a0
jmp 0x405032
xor r12d, r12d
mov rbx, r12
mov r8, qword [0x0045cd08]
lea rdx, str.JWrapper
mov rcx, rbx
mov qword [0x0045cc90], rbx
call fcn.0040c118
mov r8, qword [0x0045ccf8]
mov rdx, qword [0x0045ccf0]
mov rcx, qword [0x0045cc90]
mov qword [0x0045cca8], rax
call fcn.0040c118
mov r8, qword [0x0045cd00]
mov rdx, qword [0x0045ccd8]
mov rcx, qword [0x0045cc90]
mov qword [0x0045cca0], rax
call fcn.0040c118
cmp bpl, r12b
mov qword [0x0045cc98], rax
jne 0x405113
lea rcx, str._Extractor__Launcher___using_latest_versions_n
call fcn.0040bd0c
mov rdx, qword [0x0045cc80]
mov rcx, rsi
call fcn.0040c3fc
lea rdx, str.JWrapper
mov rcx, rax
mov qword [0x0045cc90], rax
call fcn.0040c3fc
mov rdx, qword [0x0045ccd8]
mov rcx, qword [0x0045cc90]
mov qword [0x0045cca8], rax
call fcn.0040c3fc
mov rdx, qword [0x0045ccf0]
mov rcx, qword [0x0045cc90]
mov qword [0x0045cc98], rax
call fcn.0040c3fc
mov qword [0x0045cca0], rax
mov rax, qword [0x0045cc98]
mov rdx, qword [0x0045cca8]
cmp rdx, r12
je 0x405139
mov rcx, qword [0x0045cc90]
call fcn.004039d0
mov qword [0x0045cca8], rax
mov rax, qword [0x0045cc98]
cmp rax, r12
je 0x405154
mov rcx, qword [0x0045cc90]
mov rdx, rax
call fcn.0040389c
mov qword [0x0045cc98], rax
mov rax, qword [0x0045cc90]
lea rbx, [0x0044cab4]
lea rcx, str._Extractor__Bdl_exists:__s_n
cmp rax, r12
mov rdx, rbx
cmovne rdx, rax
call fcn.0040bd0c
mov r11, qword [0x0045cca0]
mov rdx, rbx
cmp r11, r12
lea rcx, str._Extractor__App_exists:__s_n
cmovne rdx, r11
call fcn.0040bd0c
mov r11, qword [0x0045cca8]
mov rdx, rbx
cmp r11, r12
lea rcx, str._Extractor___GU_exists:__s_n
cmovne rdx, r11
call fcn.0040bd0c
mov r11, qword [0x0045cc98]
lea rcx, str._Extractor__JRE_exists:__s_n
cmp r11, r12
cmovne rbx, r11
mov rdx, rbx
call fcn.0040bd0c
cmp qword [0x0045cca8], r12
je 0x405246
cmp qword [0x0045cc98], r12
je 0x405246
cmp qword [0x0045cca0], r12
je 0x405246
lea rcx, str._Extractor__Running_without_extraction_now_n
call fcn.0040bd0c
call fcn.004068e8
mov rcx, r13
call fcn.00407b44
cmp byte [rsp + 0x5b8], r12b
jne 0x40523e
mov rax, qword [rsp + 0x48]
mov r9, qword [rsp + 0x5a0]
mov r8d, dword [rsp + 0x598]
mov rdx, qword [rsp + 0x60]
mov byte [rsp + 0x30], r12b
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call fcn.00401f28
xor ecx, ecx
call fcn.004187f0
int3
cmp bpl, r12b
jne 0x405262
lea rcx, str._Extractor__Unable_to_run__we_are_just_a_launcher__n
call fcn.0040bd0c
mov ecx, 1
call fcn.004187f0
int3
lea rcx, str._Extractor__Creating_master_folder..._n
call fcn.0040bd0c
mov rcx, rsi
call fcn.0040bc24
cmp r14b, r12b
je 0x4052c9
lea rdx, [rsp + 0x50]
lea rcx, str.S_1_5_32_545
call sub.ADVAPI32.dll_ConvertStringSidToSidA
cmp eax, r12d
jne 0x40529d
lea rcx, str._Utils__Unable_to_convert_SID_n
call fcn.0040bd0c
mov r8, qword [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x30], 3
lea edx, [r9 + 1]
mov rcx, rsi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x1200a9
call fcn.0040b674
movzx ebp, r14b
mov rdx, rsi
mov ecx, ebp
call fcn.004013c8
cmp qword [0x0045cc90], r12
jne 0x40530e
mov rdx, qword [0x0045cc88]
mov rcx, rsi
call fcn.0040c0d8
lea rcx, str._Extractor__Creating_bundle_path..._n
mov qword [0x0045cc90], rax
call fcn.0040bd0c
mov rcx, qword [0x0045cc90]
call fcn.0040bc24
cmp qword [0x0045cca8], r12
mov rdi, r12
jne 0x405369
mov ecx, 0x104
call fcn.004171e0
mov rdx, qword [0x0045cc90]
mov rcx, rax
mov rdi, rax
call fcn.00401c4c
lea rcx, str._Extractor__GU_temp_is__s_n
mov rdx, rdi
call fcn.0040bd0c
mov rcx, rdi
call fcn.0040bc24
cmp eax, r12d
je 0x405369
lea rcx, str._Extractor__Unable_to_create_GU_Temp_folder___assuming_elevation_required_n
call fcn.0040bd0c
mov ecx, 1
call fcn.004187f0
int3
mov rdx, rdi
mov rcx, r13
call fcn.0040a0f4
cmp rdi, r12
je 0x405467
mov ecx, 0x7d0
call fcn.004171e0
mov rdx, rdi
mov rcx, rax
mov rbp, rax
mov byte [rax], r12b
call fcn.004174b0
lea rdx, str.nativesplash.png
mov rcx, rbp
call fcn.0040bc6c
mov r11, rbp
movsx eax, byte [r11]
cmp eax, 0x2f
jne 0x4053b7
mov byte [r11], 0x5c
add r11, 1
cmp eax, r12d
jne 0x4053aa
mov rcx, qword [0x0045cd20]
mov r12, qword [0x0045ccd0]
mov r14, qword [0x0045ccc8]
test rcx, rcx
je 0x405453
lea rdx, [0x0044d778]
call fcn.00419540
test eax, eax
jne 0x405453
lea rcx, str._Extractor__Authorised_to_override_the_splash_image._n
call fcn.0040bd0c
xor edx, edx
test r14, r14
lea rcx, str._Extractor__DynamicSplash_is__d__size_is__d_n
mov r8, r12
setne dl
call fcn.0040bd0c
test r14, r14
je 0x405453
test r12, r12
je 0x405453
lea rcx, str._Extractor__Overwriting_splash_image_at__s_n
mov rdx, rbp
call fcn.0040bd0c
lea rdx, [0x0044c930]
mov rcx, rbp
call fcn.00419020
mov r8, r12
mov edx, 1
mov r9, rax
mov rcx, r14
mov rbx, rax
call fcn.0041abc0
mov rcx, rbx
call fcn.0041b550
mov rcx, rbp
call fcn.004171a0
mov r14b, byte [rsp + 0x40]
mov ebp, dword [rsp + 0x58]
xor r12d, r12d
mov rdx, rdi
mov rcx, r13
call fcn.0040a0f4
mov rdx, rdi
mov rcx, r13
call fcn.0040a0f4
mov rdx, rdi
mov rcx, r13
call fcn.0040a0f4
cmp rdi, r12
je 0x405516
mov ecx, 0x7d0
call fcn.004171e0
mov r9, qword [0x0045cd08]
mov rdx, qword [0x0045cc90]
lea r8, str.JWrapper
mov rcx, rax
mov qword [0x0045cca8], rax
call fcn.00401be4
mov rdx, qword [0x0045cca8]
lea rcx, str._Extractor__GU_folder_is__s_n
call fcn.0040bd0c
mov rdx, qword [0x0045cca8]
lea rcx, str._Extractor__Renaming_temporary_GU_folder_to__s_n
call fcn.0040bd0c
mov rdx, qword [0x0045cca8]
mov rcx, rdi
call fcn.004017c8
mov rdx, qword [0x0045cca8]
mov ecx, ebp
call fcn.00401378
lea rcx, str._Extractor__Recreating_GU_location_n
call fcn.0040bd0c
mov rcx, rdi
call fcn.004171a0
mov rbx, qword [rsp + 0x90]
mov rdx, qword [0x0045cca8]
mov rcx, rbx
mov byte [rbx], r12b
call fcn.004174b0
lea rdx, str.nativesplash.png
mov rcx, rbx
call fcn.0040bc6c
lea rcx, str._Extractor__Native_Splash_PNG_path_is__s_n
mov rdx, rbx
call fcn.0040bd0c
lea rcx, str._Extractor__Configuring_splash_n
call fcn.0040bd0c
mov rcx, rbx
call fcn.00406938
lea rcx, str._Extractor__Showing_splash_n
call fcn.0040bd0c
cmp byte [0x0045ccba], r12b
jne 0x405586
cmp byte [rsp + 0x5b8], r12b
jne 0x405586
call fcn.004069ec
mov ecx, 0xffffffff
call fcn.00406af0
cmp qword [0x0045cc98], r12
jne 0x405723
movzx edx, byte [0x0045cce0]
lea rcx, str._Extractor__Setting_up_a_JRE__switched:_d__n
call fcn.0040bd0c
mov ecx, 0x104
call fcn.004171e0
mov qword [0x0045cc98], rax
mov byte [rax], r12b
mov rcx, qword [0x0045cd00]
call fcn.004173f0
cmp rax, r12
jbe 0x4055f8
cmp byte [0x0045cce0], r12b
jne 0x4055f8
mov rcx, qword [0x0045cc90]
mov r9, r15
mov r8b, r14b
mov rdx, r13
call fcn.00403f6c
mov rbx, rax
jmp 0x40563c
mov r9b, byte [rsp + 0x5b8]
mov rcx, qword [0x0045cc90]
mov r8, r15
mov dl, r14b
call fcn.00403a84
mov rcx, qword [0x0045cd00]
mov rbx, rax
call fcn.004173f0
cmp rax, r12
jbe 0x40563c
lea rcx, str._JREDownload__Chosen_to_setup_an_online_JRE__so_reading_JRE_off_tail_and_discarding..._n
call fcn.0040bdd8
xor edx, edx
mov rcx, r13
call fcn.0040a0f4
cmp rbx, r12
jne 0x4056bb
lea rcx, str._JREDownload__Failed_to_detect_or_download_a_JRE__no_jre_version__n
call fcn.0040bdd8
mov rcx, qword [0x0045cc98]
call fcn.004171a0
mov qword [0x0045cc98], r12
lea rcx, str._Extractor__Setting_up_our_JRE_failed._We_will_try_to_use_one_already_there..._n
call fcn.0040bd0c
mov rdx, qword [0x0045ccd8]
mov rcx, qword [0x0045cc90]
call fcn.0040c19c
cmp rax, r12
jne 0x4056fc
lea rcx, str._Extractor__No_JRE_found_in_bundle._Checking_master..._n
call fcn.0040bd0c
mov rdx, qword [0x0045ccd8]
mov rcx, rsi
call fcn.0040c19c
cmp rax, r12
jne 0x4056f7
lea rcx, str._Extractor__No_JRE_found._Failing_now..._n
call fcn.0040bd0c
mov ecx, 1
call fcn.004187f0
int3
mov rdx, qword [0x0045cc98]
lea rcx, str._JREDownload__Finalising_setup_of_new_JRE__s_n
call fcn.0040bd0c
mov rdx, qword [0x0045cc98]
cmp rdx, r12
je 0x405660
cmp rbx, rdx
je 0x40574a
mov rcx, rbx
call fcn.004017c8
mov rdx, qword [0x0045cc98]
lea rcx, str._Extractor__Renamed_JRE_folder_to__s_n
jmp 0x40571c
mov rcx, rsi
jmp 0x405703
mov rcx, qword [0x0045cc90]
mov rdx, rax
call fcn.0040c0d8
lea rcx, str._Extractor__Found_latest_JRE:__s_n
mov qword [0x0045cc98], rax
mov rdx, rax
call fcn.0040bd0c
jmp 0x40574a
mov rcx, qword [0x0045cd00]
call fcn.004173f0
cmp rax, r12
jbe 0x40574a
lea rcx, str._Extractor__Discarding_runtime..._n
call fcn.0040bd0c
xor edx, edx
mov rcx, r13
call fcn.0040a0f4
mov r15d, 0x104
mov rcx, r15
call fcn.004171e0
mov rdx, qword [rsp + 0x98]
mov rcx, rax
mov rbx, rax
mov byte [rax], r12b
call fcn.004174b0
lea rdx, str.DetectedProxy
mov rcx, rbx
call fcn.0040bc6c
lea rcx, str._Extractor__Saving_proxy_configuration_n
call fcn.0040bd0c
mov rcx, rbx
call fcn.004077ac
mov rcx, rbx
call fcn.004171a0
mov rdx, qword [0x0045cc98]
mov cl, r14b
call fcn.004015c0
cmp qword [0x0045cca0], r12
mov qword [0x004690d8], rax
jne 0x4058df
mov rcx, qword [0x0045ccf8]
call fcn.004173f0
cmp rax, r12
jbe 0x4058d3
mov rcx, r15
call fcn.004171e0
mov rcx, r15
mov qword [0x0045cca0], rax
call fcn.004171e0
mov r9, qword [0x0045ccf8]
mov r8, qword [0x0045ccf0]
mov rdx, qword [0x0045cc90]
mov rcx, qword [0x0045cca0]
mov rbx, rax
call fcn.00401be4
mov rdx, qword [0x0045cc90]
mov rcx, rbx
call fcn.00401c4c
lea rcx, str._Extractor__Offline_installer___app_to_extract._n
call fcn.0040bd0c
mov rdx, qword [0x0045cca0]
lea rcx, str._Extractor__APP_folder_is__s_n
call fcn.0040bd0c
lea rcx, str._Extractor__APP_temp_is__s_n
mov rdx, rbx
call fcn.0040bd0c
mov rcx, rbx
call fcn.0040bc24
cmp eax, r12d
je 0x40586d
lea rcx, str.Unable_to_create_App_Temp_folder_n
call fcn.0040bdd8
mov ecx, 1
call fcn.004187f0
int3
lea rcx, str._Extractor__Extracting_App..._n
call fcn.0040bd0c
mov rdx, rbx
mov rcx, r13
call fcn.0040a0f4
lea rcx, str._Extractor__Extracting_App_Version..._n
call fcn.0040bd0c
mov rdx, rbx
mov rcx, r13
call fcn.0040a0f4
lea rcx, str._Extractor__Setting_permissions..._n
call fcn.0040bd0c
mov rdx, qword [0x0045cca0]
lea rcx, str._Extractor__Renaming_App_folder_to__s_n
call fcn.0040bd0c
mov rdx, qword [0x0045cca0]
mov rcx, rbx
call fcn.004017c8
mov rcx, rbx
call fcn.004171a0
jmp 0x4058df
lea rcx, str._Extractor__Online_installer___no_app_to_extract_n
call fcn.0040bd0c
mov rcx, r15
call fcn.004171e0
mov r9, qword [0x0045cd60]
lea r8, str.JWrapper
mov rcx, rax
mov rdx, rsi
mov rdi, rax
call fcn.00401be4
mov edx, 6
mov rcx, rdi
call fcn.0041d800
cmp eax, r12d
jne 0x405929
lea rcx, str._Extractor__The_GU_shim_folder___s__already_exists_n
mov rdx, rdi
call fcn.0040bd0c
jmp 0x4059ac
mov rcx, r15
call fcn.004171e0
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.00401c4c
mov rcx, rbx
call fcn.0040bc24
cmp eax, r12d
je 0x40595a
lea rcx, str.Unable_to_create_App_Temp_folder_for_shim_n
call fcn.0040bdd8
jmp 0x4059a4
lea rcx, str._Extractor__Extracting_jwstandaone_upgrader..._n
call fcn.0040bd0c
mov rdx, rbx
mov rcx, r13
call fcn.0040a0f4
mov rcx, qword [0x0045cca8]
mov rdx, rbx
call fcn.004041f0
mov rdx, rbx
mov ecx, ebp
call fcn.00401378
lea rcx, str._Extractor__Renaming_GU_shim_folder_to__s_n
mov rdx, rdi
call fcn.0040bd0c
mov rdx, rdi
mov rcx, rbx
call fcn.004017c8
mov rcx, rbx
call fcn.004171a0
mov rcx, rdi
call fcn.004171a0
mov rcx, qword [0x0045cc90]
lea rdx, str.JWrapper
call fcn.0040c19c
cmp rax, r12
jne 0x4059e3
lea rcx, str.No_GU_version_even_after_download__n
call fcn.0040bdd8
mov ecx, 1
call fcn.004187f0
int3
lea rcx, str._Extractor__Will_now_run_GU..._n
call fcn.0040bd0c
call fcn.004068e8
mov rcx, r13
call fcn.00407b44
cmp byte [rsp + 0x5b8], r12b
jne 0x405a37
mov rax, qword [rsp + 0x48]
mov r9, qword [rsp + 0x5a0]
mov r8d, dword [rsp + 0x598]
mov rdx, qword [rsp + 0x60]
mov byte [rsp + 0x30], r12b
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call fcn.00401f28
xor ecx, ecx
call fcn.004187f0
int3