Function at 0x1400141f0
Capabilities:
Accept command line arguments
Check if file exists
Get common file path
Get file attributes
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1038]
mov eax, 0x1110
call fcn.14003d0d0
sub rsp, rax
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x1000], rax
xor ebx, ebx
mov r12, rcx
xor edx, edx
mov dword [rsp + 0x3c], ebx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x38], ebx
mov r14d, ebx
mov r15d, ebx
lea r8d, [rbx + 0x50]
mov esi, ebx
mov edi, ebx
call sub.msvcrt.dll_memset
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
cmp dword [r12 + 0x18], ebx
je 0x14001426d
cmp dword [r12 + 0x78], ebx
jne 0x1400142d1
cmp dword [r12 + 0x6c], 5
je 0x1400142d1
mov rcx, qword [0x140050310]
mov r14d, 2
cmp rcx, 0xffffffffffffffff
jne 0x14001429d
mov edx, r14d
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x1400142c7
cmp dword [0x1400516e0], r14d
jl 0x1400142c7
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov r8d, 0x33
mov qword [rsp + 0x20], rbx
lea rdx, str.ERROR:_Installer:_Not_initialized:_shutting_down._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 0x8000ffff
jmp 0x140014a8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Installing_Install_list.__Last_result:_0x_x._r_n
mov ecx, 4
mov r8d, eax
call fcn.1400168a8
lea rcx, str.sfc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
mov r9d, 1
test rax, rax
je 0x140014441
lea rdx, str.SRSetRestorePointA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x14001434b
lea rdx, str.SRSetRestorePoint
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x14001434b
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, rbx
jmp 0x14001443b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
test rax, rax
je 0x140014439
lea rdx, str._NestedRestore
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsstr]
lea rdx, str._Upgrade
mov rcx, rbx
test rax, rax
mov eax, 1
cmovne r14d, eax
mov dword [rsp + 0x3c], r14d
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x1400143a3
mov r9d, 1
xor ebx, ebx
mov edi, r9d
jmp 0x140014441
lea rdx, str._DisallowSystemRestore
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x1400143e6
lea rdx, str._DownloadService
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x1400143e6
lea rdx, str._RunOnce
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
xor ebx, ebx
test rax, rax
je 0x14001443b
jmp 0x1400143e8
xor ebx, ebx
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14001440a
lea edx, [rcx + 5]
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014434
cmp dword [0x1400516e0], 4
jl 0x140014434
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
mov r8d, 0x2d
mov qword [rsp + 0x20], rbx
lea rdx, str.System_restore_turned_off_for_this_install._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15, rbx
jmp 0x14001443b
xor ebx, ebx
mov r9d, 1
mov eax, r14d
mov dword [rsp + 0x54], ebx
neg eax
mov qword [rsp + 0x58], rbx
mov r14d, 2
lea r8, str.Installed__S
sbb ecx, ecx
lea rax, [rbp - 0x60]
and ecx, r14d
add ecx, 0x64
mov dword [rsp + 0x50], ecx
lea edx, [r14 + 0x3e]
lea rcx, [rbp - 0x60]
sub r8, rax
lea rax, [rdx + 0x7fffffbe]
test rax, rax
je 0x140014495
mov al, byte [rcx + r8]
test al, al
je 0x140014495
mov byte [rcx], al
add rcx, r9
sub rdx, r9
jne 0x140014477
test rdx, rdx
lea rax, [rcx - 1]
lea rdx, [rbp - 0x20]
cmovne rax, rcx
mov ecx, 0x105
mov byte [rax], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140014547
call fcn.140026508
test eax, eax
lea rcx, [0x140041aa8]
lea r8, [0x140041a88]
mov edx, 0x105
cmove r8, rcx
lea rcx, [rbp - 0x20]
call fcn.140001584
test eax, eax
js 0x140014547
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400144f7
test al, 0x10
je 0x140014502
test edi, edi
jne 0x140014502
mov edx, 0x81
jmp 0x14001452b
call fcn.14001aaa0
call fcn.14002f2b4
test eax, eax
je 0x140014526
call fcn.140017ba8
mov dword [0x140050554], eax
mov eax, 1
mov dword [0x14005055c], eax
mov edx, 0xd6
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x1f0]
mov r9d, 0x105
call qword [sym.imp.USER32.dll_LoadStringW]
mov esi, eax
lea rax, str.Windows_Media_Player_11
test esi, esi
lea r9, [rbp + 0x1f0]
mov edx, 0x3f
cmovle r9, rax
lea r8, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140013d18
test r15, r15
je 0x140014859
cmp qword [0x1400516d8], rbx
je 0x1400145be
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x400]
mov r9d, 0x100
lea edx, [r9 - 0x4b]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400145be
mov rcx, qword [0x1400516d8]
lea r9, [rbp + 0x400]
xor r8d, r8d
mov edx, 0x5d5
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140050310]
mov edi, 4
cmp rcx, 0xffffffffffffffff
jne 0x1400145e4
mov edx, edi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14001460d
cmp dword [0x1400516e0], edi
jl 0x14001460d
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
mov r8d, 0x35
mov qword [rsp + 0x20], rbx
lea rdx, str.Installer:_Preparing_to_set_system_restore_point..._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rsp + 0x40]
mov rax, r15
lea rcx, [rsp + 0x50]
call qword [0x14003f118]
test eax, eax
jne 0x14001480f
mov eax, dword [rsp + 0x40]
mov r15, rbx
cmp eax, 0x78
jne 0x140014680
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x140014659
mov edx, edi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014859
cmp dword [0x1400516e0], edi
jl 0x140014859
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
mov r8d, 0x31
lea rdx, str.System_restore_is_not_supported_on_this_system._r_n
jmp 0x14001484e
cmp eax, 0x422
je 0x140014749
cmp eax, 0x70
je 0x140014708
cmp eax, 0x50
jne 0x1400146e3
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x1400146bb
mov edx, r14d
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014859
cmp dword [0x1400516e0], r14d
jl 0x140014859
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
mov r8d, 0x3b
lea rdx, str.System_restore_point_could_not_be_set:_reboot_is_pending._r_n
jmp 0x14001484e
movzx r8d, ax
lea rdx, str.ERROR:_Could_not_set_system_restore_point:_error_0x_x._r_n
or r8d, 0x80070000
mov ecx, r14d
test eax, eax
cmovle r8d, eax
call fcn.1400168a8
jmp 0x140014859
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x140014729
mov edx, edi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014793
cmp dword [0x1400516e0], edi
jl 0x140014793
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
mov r8d, 0x42
lea rdx, str.System_restore_is_disabled_on_this_system_due_to_low_disk_space._r_n
jmp 0x140014788
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14001476a
mov edx, edi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014793
cmp dword [0x1400516e0], edi
jl 0x140014793
mov dword [rsp + 0x34], ebx
lea r9, [rsp + 0x34]
mov r8d, 0x2c
lea rdx, str.System_restore_is_disabled_on_this_system._r_n
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [r12 + 0x74], ebx
jne 0x140014859
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x800]
mov r9d, 0x400
mov edx, 0xa1
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140014805
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x400]
mov r9d, 0x200
mov edx, 0x64
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140014805
mov r9d, 0x1011
lea r8, [rbp + 0x400]
lea rdx, [rbp + 0x800]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, r14d
jne 0x140014859
mov eax, 0x80004005
jmp 0x140014a8d
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x140014830
mov edx, edi
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014859
cmp dword [0x1400516e0], edi
jl 0x140014859
mov dword [rsp + 0x34], ebx
lea r9, [rsp + 0x34]
mov r8d, AtlInternalQueryInterface
lea rdx, str.System_restore_point_set._r_n
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [r12 + 0x6c], 5
lea rsi, str.WMPNetworkSvc
je 0x1400148e2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
test rax, rax
je 0x1400148ac
lea rdx, str._DownloadService
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x1400148e0
lea rdx, str._RunOnce
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
xor ebx, ebx
test rax, rax
jne 0x1400148e2
jmp 0x1400148ae
xor ebx, ebx
lea r9, [rsp + 0x34]
mov rdx, rsi
lea r8, [rsp + 0x30]
call fcn.14002d51c
test eax, eax
je 0x1400148e2
cmp dword [rsp + 0x30], 4
jne 0x1400148e2
mov eax, 1
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x38], eax
call fcn.14002c88c
jmp 0x1400148e2
xor ebx, ebx
call fcn.140017c24
mov r9d, dword [0x140050558]
mov rcx, qword [r12]
and r9d, 8
call fcn.1400235d0
mov r8d, eax
lea rdx, str._r_nSetup_complete.__Result:_0x_x._r_n
mov ecx, 4
mov edi, eax
call fcn.1400168a8
cmp dword [rsp + 0x38], ebx
je 0x14001491f
mov rdx, rsi
call fcn.14002cb1c
test edi, edi
js 0x1400149d1
mov rcx, qword [r12 + 0x80]
test rcx, rcx
je 0x1400149d1
mov rbx, qword [rcx]
xor r12d, r12d
test rbx, rbx
jne 0x140014950
call fcn.14002a0c0
mov rbx, rax
test rax, rax
je 0x1400149cf
cmp dword [rbx + 0x124], r12d
je 0x1400149cf
cmp dword [rbx + 0x12c], r12d
je 0x1400149cf
cmp qword [rbx + 0x18], r12
lea rsi, [0x14003f4a0]
mov r8, rsi
lea rdx, str._r_nLaunching__S_Install._r_n
cmovne r8, qword [rbx + 0x18]
mov ecx, 4
call fcn.1400168a8
mov rcx, rbx
call fcn.140027448
mov ecx, 0xd2af9
cmp eax, 0xbc2
je 0x1400149ad
cmp eax, 0x80070bc2
je 0x1400149ad
cmp eax, ecx
je 0x1400149ad
test eax, eax
jns 0x1400149af
mov edi, eax
jmp 0x1400149af
mov edi, ecx
cmp qword [rbx + 0x18], r12
lea rdx, str._r_n_S_Setup_complete.__Result:_0x_x._r_n
mov r9d, eax
mov ecx, 4
cmovne rsi, qword [rbx + 0x18]
mov r8, rsi
call fcn.1400168a8
xor ebx, ebx
neg dword [rsp + 0x3c]
sbb eax, eax
and eax, r14d
add eax, 0x65
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x44]
mov qword [rsp + 0x58], rax
test r15, r15
je 0x140014a7d
lea rdx, [rsp + 0x40]
mov rax, r15
lea rcx, [rsp + 0x50]
call qword [0x14003f118]
test eax, eax
jne 0x140014a31
mov eax, dword [rsp + 0x40]
lea rdx, str.Could_not_set_system_restore_end_point:_error_0x_x._r_n
movzx r8d, ax
mov ecx, r14d
or r8d, 0x80070000
test eax, eax
cmovle r8d, eax
call fcn.1400168a8
jmp 0x140014a7d
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x140014a53
lea edx, [rcx + 5]
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140014a7d
cmp dword [0x1400516e0], 4
jl 0x140014a7d
lea r9, [rsp + 0x34]
mov dword [rsp + 0x34], ebx
mov r8d, AtlInternalQueryInterface
mov qword [rsp + 0x20], rbx
lea rdx, str.System_restore_end_point_set._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r13, r13
je 0x140014a8b
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp + 0x1000]
xor rcx, rsp
call fcn.14003c810
lea r11, [rsp + 0x1110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret