Function at 0x140004b30
Capabilities:
Accept command line arguments
Create process on windows
Create shortcut via ishelllink
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor eax, eax
mov r12d, eax
mov dword [rsp + 0x48], eax
call fcn.140008e10
call fcn.140001320
lea rcx, [0x140006fe0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xorps xmm0, xmm0
lea rdx, str.Updaters_started..
lea rcx, [rbp - 0x60]
mov qword [0x140029028], rax
xorps xmm1, xmm1
mov r8d, 0x12
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140004bfd
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bf8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
xor bl, bl
mov byte [rsp + 0x40], bl
mov byte [rsp + 0x42], bl
mov byte [rsp + 0x43], bl
mov byte [rsp + 0x41], bl
mov byte [rsp + 0x44], bl
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov r15, 0xffffffffffffffff
lea r14, [0x140027a40]
mov rdi, rax
lea r13, [0x140027a60]
movabs rsi, 0x7ffffffffffffffe
test rax, rax
je 0x140005de2
mov esi, 1
cmp dword [rsp + 0x48], esi
jle 0x140005669
nop word [rax + rax]
movsxd rax, esi
mov rbx, qword [rdi + rax*8]
lea rdi, [rdi + rax*8]
xor eax, eax
mov qword [rbp - 0x78], rax
lea edx, [rax + 0x10]
call fcn.140008160
movups xmm0, xmmword [str.Argument:]
mov qword [rbp - 0x80], rax
mov rdx, rbx
mov qword [rbp - 0x70], 0xa
mov qword [rbp - 0x68], 0xf
movups xmmword [rax], xmm0
mov ecx, dword [0x140022ae0]
mov dword [rax + 0x10], ecx
xor ecx, ecx
mov word [rax + 0x14], cx
lea rcx, [rbp - 0x80]
call fcn.140007670
xor ebx, ebx
lea rcx, [rbp - 0x40]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
call fcn.1400014f0
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140004d2b
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d26
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006be7
call fcn.140009ae0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140004d6b
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d66
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006be7
call fcn.140009ae0
movsd xmm0, qword [str._update]
mov r8, r15
mov eax, dword [0x140022af0]
mov rdx, qword [rdi]
movsd qword [rbp - 0x80], xmm0
xorps xmm0, xmm0
mov dword [rbp - 0x78], eax
movzx eax, word [0x140022af4]
movups xmmword [rsp + 0x60], xmm0
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x68], 7
mov word [rbp - 0x74], ax
mov word [rbp - 0x72], bx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], bx
jne 0x140004dc0
lea rcx, [rsp + 0x60]
call fcn.140007a10
cmp qword [rbp - 0x68], 8
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmovae rdx, qword [rbp - 0x80]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.14000f94c
mov rdx, qword [rsp + 0x78]
mov ebx, eax
cmp rdx, 8
jb 0x140004e3c
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e37
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bed
call fcn.140009ae0
mov rdx, qword [rbp - 0x68]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], ax
cmp rdx, 8
jb 0x140004e93
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e8c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bed
call fcn.140009ae0
xor eax, eax
test ebx, ebx
jne 0x140004ea2
mov bl, 1
mov byte [rsp + 0x40], bl
jmp 0x140005658
xorps xmm0, xmm0
mov qword [rbp - 0x70], rax
mov r8d, 0xa
mov qword [rbp - 0x68], rax
lea rdx, str._autostart
lea rcx, [rbp - 0x80]
movups xmmword [rbp - 0x80], xmm0
call fcn.140007a10
mov rdx, qword [rdi]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], rax
mov r8, r15
inc r8
cmp word [rdx + r8*2], ax
jne 0x140004ee1
lea rcx, [rsp + 0x60]
call fcn.140007a10
cmp qword [rbp - 0x68], 8
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmovae rdx, qword [rbp - 0x80]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.14000f94c
mov rdx, qword [rsp + 0x78]
mov ebx, eax
cmp rdx, 8
jb 0x140004f5d
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f58
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bf3
call fcn.140009ae0
mov rdx, qword [rbp - 0x68]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], ax
cmp rdx, 8
jb 0x140004fb4
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fad
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bf3
call fcn.140009ae0
xor eax, eax
test ebx, ebx
jne 0x140004fc2
mov byte [rsp + 0x42], 1
jmp 0x140005653
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
mov r8d, 6
mov qword [rsp + 0x78], rax
lea rdx, str._debug
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.140007a10
mov rdx, qword [rdi]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x70], rax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x68], rax
mov r8, r15
inc r8
cmp word [rdx + r8*2], ax
jne 0x140005002
lea rcx, [rbp - 0x80]
call fcn.140007a10
cmp qword [rsp + 0x78], 8
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
cmovae rdx, qword [rsp + 0x60]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call fcn.14000f94c
lea rcx, [rbp - 0x80]
mov ebx, eax
call fcn.140007310
lea rcx, [rsp + 0x60]
call fcn.140007310
test ebx, ebx
jne 0x140005068
mov byte [0x140028fc0], 1
call fcn.140001320
mov byte [rsp + 0x43], 1
jmp 0x140005653
xor ebx, ebx
lea rdx, str._startintray
xorps xmm0, xmm0
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], rbx
movups xmmword [rsp + 0x60], xmm0
lea r8d, [rbx + 0xc]
call fcn.140007a10
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
mov r8, r15
mov qword [rbp - 0x68], rbx
inc r8
cmp word [rdx + r8*2], bx
jne 0x1400050a6
lea rcx, [rbp - 0x80]
call fcn.140007a10
cmp qword [rsp + 0x78], 8
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
cmovae rdx, qword [rsp + 0x60]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call fcn.14000f94c
lea rcx, [rbp - 0x80]
mov ebx, eax
call fcn.140007310
lea rcx, [rsp + 0x60]
call fcn.140007310
test ebx, ebx
jne 0x140005100
mov byte [rsp + 0x44], 1
jmp 0x140005653
xor ebx, ebx
lea rdx, str._writeprotected
xorps xmm0, xmm0
mov qword [rbp - 0x70], rbx
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], rbx
movups xmmword [rbp - 0x80], xmm0
lea r8d, [rbx + 0xf]
call fcn.140007a10
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
or r12d, 1
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8, r15
inc r8
cmp word [rdx + r8*2], bx
jne 0x140005141
lea rcx, [rsp + 0x60]
call fcn.140007a10
cmp qword [rbp - 0x68], 8
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmovae rdx, qword [rbp - 0x80]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.14000f94c
test eax, eax
jne 0x140005187
inc esi
cmp esi, dword [rsp + 0x48]
jge 0x140005187
mov bl, 1
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x14000519f
mov rdx, qword [rsp + 0x60]
inc r8
call fcn.1400077b0
mov r8, qword [rbp - 0x68]
xor edx, edx
and r12d, 0xfffffffc
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], dx
cmp r8, 8
jb 0x1400051d0
mov rdx, qword [rbp - 0x80]
inc r8
call fcn.1400077b0
xor edx, edx
mov rcx, qword [rsp + 0x50]
xorps xmm0, xmm0
movsxd rax, esi
lea rdi, [rcx + rax*8]
test bl, bl
je 0x1400052e5
mov rbx, qword [rdi]
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x30], rdx
mov r8d, 0xa
mov qword [rbp + 0x38], rdx
lea rdx, str.Argument:
movups xmmword [rbp + 0x20], xmm0
call fcn.140007a10
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140007670
xor ebx, ebx
lea rcx, [rbp - 0x40]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
call fcn.1400014f0
lea rcx, [rbp - 0x40]
call fcn.140007310
mov r8, qword [rbp + 0x38]
cmp r8, 8
jb 0x140005260
mov rdx, qword [rbp + 0x20]
inc r8
call fcn.1400077b0
mov rdx, qword [rdi]
mov rcx, r14
mov byte [rsp + 0x41], 1
call fcn.140007290
movsxd r9, dword [0x140027a50]
mov rcx, rbx
test r9, r9
jle 0x140005653
mov rdx, qword [0x140027a58]
mov r8, qword [0x140027a40]
nop dword [rax]
nop word [rax + rax]
cmp rdx, 8
mov rax, r14
cmovae rax, r8
cmp word [rax + rcx*2], 0x2f
jne 0x1400052d1
cmp rdx, 8
mov rax, r14
cmovae rax, r8
mov word [rax + rcx*2], 0x5c
mov rdx, qword [0x140027a58]
mov r8, qword [0x140027a40]
inc rcx
cmp rcx, r9
jl 0x1400052a0
lea r13, [0x140027a60]
jmp 0x140005653
mov qword [rbp - 0x70], rdx
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], rdx
mov r8d, 8
lea rdx, str._workdir
movups xmmword [rbp - 0x80], xmm0
call fcn.140007a10
mov rdx, qword [rdi]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], rax
mov r8, r15
inc r8
cmp word [rdx + r8*2], ax
jne 0x140005321
lea rcx, [rsp + 0x60]
call fcn.140007a10
cmp qword [rbp - 0x68], 8
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmovae rdx, qword [rbp - 0x80]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.14000f94c
test eax, eax
jne 0x140005369
inc esi
cmp esi, dword [rsp + 0x48]
jge 0x140005369
mov bl, 1
jmp 0x14000536b
xor bl, bl
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x140005383
mov rdx, qword [rsp + 0x60]
inc r8
call fcn.1400077b0
mov r8, qword [rbp - 0x68]
xor edx, edx
and r12d, 0xfffffff3
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], dx
cmp r8, 8
jb 0x1400053b4
mov rdx, qword [rbp - 0x80]
inc r8
call fcn.1400077b0
xor edx, edx
mov rcx, qword [rsp + 0x50]
xorps xmm0, xmm0
movsxd rax, esi
lea rdi, [rcx + rax*8]
test bl, bl
je 0x140005453
mov rbx, qword [rdi]
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x50], rdx
mov r8d, 0xa
mov qword [rbp - 0x48], rdx
lea rdx, str.Argument:
movups xmmword [rbp - 0x60], xmm0
call fcn.140007a10
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.140007670
xor ecx, ecx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
lea rcx, [rbp - 0x40]
call fcn.1400014f0
lea rcx, [rbp - 0x40]
call fcn.140007310
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x140005444
mov rdx, qword [rbp - 0x60]
inc r8
call fcn.1400077b0
mov rdx, qword [rdi]
lea rcx, [0x140027a20]
jmp 0x14000564e
mov qword [rbp - 0x70], rdx
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], rdx
mov r8d, 4
lea rdx, str._key
movups xmmword [rbp - 0x80], xmm0
call fcn.140007a10
mov rdx, qword [rdi]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x50], rax
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x48], rax
mov r8, r15
nop dword [rax]
inc r8
cmp word [rdx + r8*2], ax
jne 0x140005490
lea rcx, [rbp - 0x60]
call fcn.140007a10
cmp qword [rbp - 0x68], 8
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
cmovae rdx, qword [rbp - 0x80]
call fcn.140007260
mov rcx, rax
call fcn.14000f94c
test eax, eax
jne 0x1400054d2
inc esi
cmp esi, dword [rsp + 0x48]
jge 0x1400054d2
mov bl, 1
jmp 0x1400054d4
xor bl, bl
lea rcx, [rbp - 0x60]
call fcn.140007310
lea rcx, [rbp - 0x80]
and r12d, 0xffffffcf
call fcn.140007310
mov rcx, qword [rsp + 0x50]
movsxd rax, esi
lea rdi, [rcx + rax*8]
lea rcx, [rbp + 0x40]
test bl, bl
je 0x140005545
mov rbx, qword [rdi]
lea rdx, str.Argument:
call fcn.140007380
mov r8, rbx
lea rcx, [rbp]
mov rdx, rax
call fcn.1400078d0
mov rcx, rax
call fcn.1400014f0
lea rcx, [rbp]
call fcn.140007310
lea rcx, [rbp + 0x40]
call fcn.140007310
mov rdx, qword [rdi]
lea rcx, [0x140027a00]
jmp 0x14000564e
lea rdx, str._exename
call fcn.140007380
mov rdx, qword [rdi]
lea rcx, [rbp]
call fcn.140007380
lea rdx, [rbp + 0x40]
lea rcx, [rbp]
call fcn.140001220
test al, al
je 0x14000557a
inc esi
cmp esi, dword [rsp + 0x48]
jge 0x14000557a
mov bl, 1
jmp 0x14000557c
xor bl, bl
lea rcx, [rbp]
call fcn.140007310
lea rcx, [rbp + 0x40]
and r12d, 0xffffff3f
call fcn.140007310
test bl, bl
je 0x140005653
mov rcx, qword [rsp + 0x50]
lea rdx, str.Argument:
movsxd rax, esi
mov rbx, qword [rcx + rax*8]
lea rdi, [rcx + rax*8]
lea rcx, [rbp + 0x40]
call fcn.140007380
mov r8, rbx
lea rcx, [rbp]
mov rdx, rax
call fcn.1400078d0
mov rcx, rax
call fcn.1400014f0
lea rcx, [rbp]
call fcn.140007310
lea rcx, [rbp + 0x40]
call fcn.140007310
mov rdx, qword [rdi]
mov rcx, r13
call fcn.140007290
movsxd r10, dword [0x140027a70]
xor eax, eax
mov r9d, eax
mov r8d, eax
test r10, r10
jle 0x140005653
mov r11, qword [0x140027a78]
mov rbx, qword [0x140027a60]
cmp r11, 8
mov rax, r13
cmovae rax, rbx
cmp word [rax + r8*2], 0x2f
je 0x140005644
movsxd rdx, r9d
mov rcx, r13
call fcn.140007270
cmp word [rax], 0x5c
je 0x140005644
inc r9d
inc r8
cmp r8, r10
jl 0x140005613
jmp 0x140005653
lea rdx, str.Telegram.exe
mov rcx, r13
call fcn.140007290
movzx ebx, byte [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
inc esi
cmp esi, dword [rsp + 0x48]
jl 0x140004c70
cmp qword [0x140027a70], 0
jne 0x140005682
lea rdx, str.Telegram.exe
mov rcx, r13
call fcn.140007290
test bl, bl
je 0x1400056f4
xorps xmm0, xmm0
lea rdx, str.Need_to_update_
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 0xf
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400056f4
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056ef
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
cmp byte [rsp + 0x42], 0
je 0x140005769
xorps xmm0, xmm0
lea rdx, str.From_autostart_
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 0xf
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140005769
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005764
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
cmp byte [rsp + 0x41], 0
je 0x1400057de
xorps xmm0, xmm0
lea rdx, str.Write_Protected_folder_
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 0x17
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400057de
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057d9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
mov rcx, qword [0x140027a30]
test rcx, rcx
je 0x140005888
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x1e
jb 0x140006c1d
cmp qword [0x140027a38], 8
lea rax, [0x140027a20]
mov qword [rsp + 0x30], rcx
lea r9, str.Will_pass_custom_working_dir:
cmovae rax, qword [0x140027a20]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1e
call fcn.140008010
lea rcx, [rbp - 0x40]
call fcn.1400014f0
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140005888
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005883
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
mov r9, qword [rdi]
mov rdx, r15
nop
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140005890
mov rax, qword [0x140027a98]
lea rsi, [0x140027a80]
cmp rdx, rax
ja 0x1400058e3
lea rbx, [rdx + rdx]
mov qword [0x140027a90], rdx
cmp rax, 8
mov rdi, rsi
mov r8, rbx
mov rdx, r9
cmovae rdi, qword [0x140027a80]
mov rcx, rdi
call fcn.14000f200
xor eax, eax
mov word [rdi + rbx], ax
mov rdi, qword [rsp + 0x50]
jmp 0x1400058eb
mov rcx, rsi
call fcn.140007ae0
mov rcx, qword [0x140027a90]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x11
jb 0x140006c1d
cmp qword [0x140027a98], 8
lea r9, str.Updater_name_is:
mov qword [rsp + 0x30], rcx
mov rax, rsi
cmovae rax, qword [0x140027a80]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x11
call fcn.140008010
lea rcx, [rbp - 0x40]
call fcn.1400014f0
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140005988
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005983
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
cmp qword [0x140027a90], 0xb
xorps xmm0, xmm0
xorps xmm1, xmm1
jbe 0x140005d65
mov r8d, 0xb
lea rdx, str.Updater.exe
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.140007a10
mov rax, qword [0x140027a90]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x80], xmm0
lea rcx, [rax - 0xb]
movdqu xmmword [rbp - 0x70], xmm1
cmp rax, rcx
jb 0x140006bf9
sub rax, rcx
mov r8, r15
cmp rax, r15
cmovb r8, rax
cmp qword [0x140027a98], 8
mov rax, rsi
cmovae rax, qword [0x140027a80]
lea rdx, [rax + rcx*2]
lea rcx, [rbp - 0x80]
call fcn.140007a10
cmp qword [rsp + 0x78], 8
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
cmovae rdx, qword [rsp + 0x60]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call fcn.14000f94c
mov rdx, qword [rbp - 0x68]
mov ebx, eax
cmp rdx, 8
jb 0x140005a74
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a6f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bff
call fcn.140009ae0
mov rdx, qword [rsp + 0x78]
xor eax, eax
movdqa xmm0, xmmword [0x140023670]
mov word [rbp - 0x80], ax
movdqu xmmword [rbp - 0x70], xmm0
cmp rdx, 8
jb 0x140005ac9
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ac4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bff
call fcn.140009ae0
lea rcx, [rbp - 0x40]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
test ebx, ebx
jne 0x140005d3f
mov rax, qword [0x140027a90]
lea r8, [rax - 0xb]
cmp rax, r8
cmovb r8, rax
cmp qword [0x140027a98], 8
cmovae rsi, qword [0x140027a80]
mov rdx, rsi
call fcn.140007a10
lea rbx, [0x140027aa0]
mov rcx, rbx
call fcn.140007310
movups xmm1, xmmword [rbp - 0x30]
movabs rsi, 0x7ffffffffffffffe
movups xmm0, xmmword [rbp - 0x40]
mov rax, rsi
movq rcx, xmm1
movaps xmmword [0x140027ab0], xmm1
sub rax, rcx
movaps xmmword [0x140027aa0], xmm0
cmp rax, 0x10
jb 0x140006c1d
cmp qword [0x140027ab8], 8
lea r9, str.Updater_dir_is:
mov qword [rsp + 0x30], rcx
mov rax, rbx
cmovae rax, qword [0x140027aa0]
lea rcx, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x10
call fcn.140008010
lea rcx, [rbp]
call fcn.1400014f0
lea rcx, [rbp]
call fcn.140007310
movzx r15d, byte [rsp + 0x41]
test r15b, r15b
jne 0x140005bcc
cmp r14, rbx
je 0x140005bcc
cmp qword [0x140027ab8], 8
mov rcx, r14
mov r8, qword [0x140027ab0]
cmovae rbx, qword [0x140027aa0]
mov rdx, rbx
call fcn.140007600
mov rcx, qword [0x140027a50]
mov rax, rsi
sub rax, rcx
cmp rax, 0xb
jb 0x140006c1d
cmp qword [0x140027a58], 8
lea r9, str.Update_to:
mov qword [rsp + 0x30], rcx
mov rax, r14
cmovae rax, qword [0x140027a40]
lea rcx, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xb
call fcn.140008010
lea rcx, [rbp]
call fcn.1400014f0
lea rcx, [rbp]
call fcn.140007310
cmp byte [rsp + 0x40], 0
je 0x140005c40
call fcn.140001eb0
test al, al
je 0x140005c40
call fcn.1400041f0
test r15b, r15b
je 0x140005dd7
lea rcx, str.tupdates_temp_tdata_version
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005cbf
lea rcx, str.tupdates_ready_tdata_version
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005cbf
xorps xmm0, xmm0
lea r8d, [rax + 0x24]
xorps xmm1, xmm1
lea rdx, str.Error:_could_not_delete_version_file
lea rcx, [rbp - 0x60]
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x140005dd7
mov rdx, qword [rbp - 0x60]
inc r8
call fcn.1400077b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140005e19
xorps xmm0, xmm0
lea rdx, str.Version_file_deleted_
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 0x15
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140005dd7
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d2c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140005e19
mov r8d, 0x14
lea rdx, str.Error:_bad_exe_name_
call fcn.140007a10
lea rcx, [rbp - 0x40]
call fcn.1400014f0
lea rcx, [rbp - 0x40]
call fcn.140007310
jmp 0x140005dcd
mov r8d, 0x16
lea rdx, str.Error:_short_exe_name_
lea rcx, [rbp - 0x60]
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140005dcd
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005dc8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
movabs rsi, 0x7ffffffffffffffe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140005e19
xorps xmm0, xmm0
lea rdx, str.Error:_No_command_line_arguments_
xorps xmm1, xmm1
lea rcx, [rbp - 0x40]
mov r8d, 0x21
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x40]
call fcn.1400014f0
lea rcx, [rbp - 0x40]
call fcn.140007310
xor r14d, r14d
mov qword [rbp - 8], 7
xorps xmm0, xmm0
mov qword [rbp - 0x10], r14
movups xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x20], r14w
cmp byte [rsp + 0x42], r14b
je 0x140005e58
lea r9, str.__autostart
mov qword [rsp + 0x20], 0xb
lea edx, [r14 + 0xb]
lea rcx, [rbp - 0x20]
call fcn.140007c60
cmp byte [rsp + 0x43], r14b
je 0x140005ec4
mov rcx, qword [rbp - 8]
mov rdi, qword [rbp - 0x10]
mov rax, rcx
sub rax, rdi
cmp rax, 7
jb 0x140005ea6
cmp rcx, 8
lea rax, [rdi + 7]
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
cmovae rbx, qword [rbp - 0x20]
lea rdx, str.__debug
mov r8d, 0xe
lea rcx, [rbx + rdi*2]
call fcn.14000f200
mov word [rbx + rdi*2 + 0xe], r14w
jmp 0x140005ec4
lea r9, str.__debug
mov qword [rsp + 0x20], 7
mov edx, 7
lea rcx, [rbp - 0x20]
call fcn.140007c60
cmp byte [rsp + 0x44], r14b
je 0x140005edb
lea rdx, str.__startintray
lea rcx, [rbp - 0x20]
call fcn.140007670
mov rcx, qword [0x140027a30]
test rcx, rcx
je 0x140006063
mov rax, rsi
sub rax, rcx
cmp rax, 0xb
jb 0x140006c05
cmp qword [0x140027a38], 8
lea rax, [0x140027a20]
mov qword [rsp + 0x30], rcx
lea r9, [0x140022ed0]
cmovae rax, qword [0x140027a20]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xb
call fcn.140008010
lea rdx, [0x140022ecc]
lea rcx, [rbp + 0x40]
call fcn.140007670
lea r9, [rbp - 0x40]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm0
movq rdi, xmm0
movq rsi, xmm1
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
movdqa xmm0, xmm1
mov word [rax], r14w
mov rcx, qword [rbp - 8]
mov r15, qword [rbp - 0x10]
mov rax, rcx
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 8
cmovae r9, rdi
sub rax, r15
cmp rsi, rax
ja 0x140005fcc
cmp rcx, 8
lea rax, [r15 + rsi]
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
cmovae rbx, qword [rbp - 0x20]
lea r8, [rsi + rsi]
mov rdx, r9
lea rcx, [rbx + r15*2]
call fcn.14000f200
lea rax, [r15 + rsi]
xor ecx, ecx
mov word [rbx + rax*2], cx
jmp 0x140005fe5
mov rdx, rsi
mov qword [rsp + 0x20], rsi
lea rcx, [rbp - 0x20]
call fcn.140007c60
mov r14, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x40]
cmp r14, 8
jb 0x140006020
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140006018
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c0b
mov rcx, rdi
call fcn.140009ae0
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x140006060
mov rcx, qword [rbp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000605b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c0b
call fcn.140009ae0
xor r14d, r14d
mov rcx, qword [0x140027a10]
test rcx, rcx
je 0x1400061ef
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 7
jb 0x140006c11
cmp qword [0x140027a18], 8
lea rax, [0x140027a00]
mov qword [rsp + 0x30], rcx
lea r9, str.__key__
cmovae rax, qword [0x140027a00]
lea rcx, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 7
call fcn.140008010
lea rdx, [0x140022ecc]
lea rcx, [rbp]
call fcn.140007670
lea r9, [rbp - 0x40]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm0
movq rdi, xmm0
movq rsi, xmm1
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
movdqa xmm0, xmm1
mov word [rax], r14w
mov rcx, qword [rbp - 8]
mov r15, qword [rbp - 0x10]
mov rax, rcx
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 8
cmovae r9, rdi
sub rax, r15
cmp rsi, rax
ja 0x14000615b
cmp rcx, 8
lea rax, [r15 + rsi]
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
cmovae rbx, qword [rbp - 0x20]
lea r8, [rsi + rsi]
mov rdx, r9
lea rcx, [rbx + r15*2]
call fcn.14000f200
lea rax, [r15 + rsi]
xor ecx, ecx
mov word [rbx + rax*2], cx
jmp 0x140006174
mov rdx, rsi
mov qword [rsp + 0x20], rsi
lea rcx, [rbp - 0x20]
call fcn.140007c60
mov r14, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x40]
cmp r14, 8
jb 0x1400061af
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400061a7
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c17
mov rcx, rdi
call fcn.140009ae0
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x1400061ef
mov rcx, qword [rbp]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061ea
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c17
call fcn.140009ae0
mov r14, qword [rbp - 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r14
cmp rax, 0x12
jb 0x140006c1d
cmp qword [rbp - 8], 8
lea r15, [rbp - 0x20]
lea rsi, [r14 + 0x12]
mov edi, 7
cmovae r15, qword [rbp - 0x20]
lea rbx, [rbp - 0x80]
xorps xmm0, xmm0
movabs rax, 0x7fffffffffffffff
movups xmmword [rbp - 0x80], xmm0
cmp rsi, rdi
jbe 0x1400062ba
mov rdi, rsi
or rdi, 7
cmp rdi, rcx
jbe 0x140006253
mov rdi, rcx
lea rcx, [rax + rax]
jmp 0x140006279
cmp rdi, 0xa
mov ecx, 0xa
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, rax
ja 0x140006c29
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400062a5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006c29
mov rcx, rax
call fcn.14000984c
test rax, rax
je 0x140006bdb
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400062b6
test rcx, rcx
je 0x1400062b1
call fcn.14000984c
jmp 0x1400062b3
xor eax, eax
mov rbx, rax
mov qword [rbp - 0x80], rbx
movaps xmm0, xmmword [str.Result_arguments:]
lea rcx, [rbx + 0x24]
mov qword [rbp - 0x70], rsi
lea r8, [r14 + r14]
mov qword [rbp - 0x68], rdi
mov rdx, r15
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x140022f10]
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [0x140022f20]
mov dword [rbx + 0x20], eax
call fcn.14000f200
xor r14d, r14d
lea rcx, [rbp - 0x80]
mov word [rbx + rsi*2], r14w
call fcn.1400014f0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140006341
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000633c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
xor dil, dil
cmp byte [rsp + 0x41], dil
je 0x140006829
xorps xmm0, xmm0
lea rdx, str.Trying_to_run_un_elevated_by_temp.lnk
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 0x25
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400063bd
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063b8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x1400067bb
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x14001a430]
mov qword [rsp + 0x20], rax
lea rcx, [0x14001a460]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400066ca
lea rcx, [rbp - 0x80]
call fcn.140007930
lea rdx, [0x140027a40]
lea rcx, [rbp + 0x20]
call fcn.1400073c0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x10]
mov rbx, qword [rcx + 0x58]
test rax, rax
je 0x140006478
bts r12d, 8
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x60], xmm0
movdqu xmmword [rbp + 0x70], xmm1
cmp rax, 1
jb 0x140006c23
dec rax
lea rdx, [rbp - 0x20]
cmp rax, 0xffffffffffffffff
lea rcx, [rbp + 0x60]
mov r8, 0xffffffffffffffff
cmovb r8, rax
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
add rdx, 2
call fcn.140007a10
lea rax, [rbp + 0x60]
jmp 0x14000648a
bts r12d, 9
lea rdx, [rbp - 0x20]
lea rcx, [rbp]
call fcn.1400073c0
cmp qword [rax + 0x18], 8
jb 0x140006494
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50]
mov rdx, rax
call rbx
bt r12d, 9
jae 0x1400064ae
lea rcx, [rbp]
call fcn.140007310
bt r12d, 8
jae 0x1400064be
lea rcx, [rbp + 0x60]
call fcn.140007310
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x14002207c]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [0x14001a450]
mov rax, qword [rcx]
call qword [rax]
xorps xmm0, xmm0
xorps xmm1, xmm1
test eax, eax
js 0x140006672
mov r8d, 0x16
lea rdx, str.tupdates_temp_temp.lnk
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.140007a10
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
mov r8d, 1
cmovae rdx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov ebx, eax
test eax, eax
jns 0x1400065a8
lea rdx, str.tupdates_ready_temp.lnk
lea rcx, [rsp + 0x60]
call fcn.140007290
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
mov r8d, 1
cmovae rdx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
xorps xmm0, xmm0
xorps xmm1, xmm1
test ebx, ebx
js 0x14000662f
mov r8d, 0x24
lea rdx, str.Executing_un_elevated_through_link..
lea rcx, [rbp - 0x60]
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x1400065fb
mov rdx, qword [rbp - 0x60]
inc r8
call fcn.1400077b0
cmp qword [rsp + 0x78], 8
lea r9, [rsp + 0x60]
mov dword [rsp + 0x28], 1
lea r8, str.explorer.exe
cmovae r9, qword [rsp + 0x60]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dil, 1
jmp 0x140006660
mov r8d, 0x17
lea rdx, str.Error:_ppf__Save_failed
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x40]
call fcn.1400014f0
lea rcx, [rbp - 0x40]
call fcn.140007310
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x1400066b0
mov rdx, qword [rsp + 0x60]
jmp 0x1400066a8
mov r8d, 0x32
lea rdx, str.Error:_Could_not_create_interface_IID_IPersistFile
lea rcx, [rbp - 0x60]
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x1400066b0
mov rdx, qword [rbp - 0x60]
inc r8
call fcn.1400077b0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rbp + 0x20]
call fcn.140007310
lea rcx, [rbp - 0x80]
jmp 0x1400066fc
xorps xmm0, xmm0
lea rdx, str.Error:_could_not_create_instance_of_IID_IShellLink
xorps xmm1, xmm1
lea rcx, [rbp - 0x40]
mov r8d, 0x32
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x30], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x40]
call fcn.1400014f0
lea rcx, [rbp - 0x40]
call fcn.140007310
call qword [sym.imp.ole32.dll_CoUninitialize]
test dil, dil
je 0x140006829
movabs r12, 0x7ffffffffffffffe
mov rax, qword [0x140027a70]
sub r12, rax
cmp r12, 0xa
jb 0x140006c2f
cmp qword [0x140027a78], 8
lea r9, str.Executed_
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
cmovae r13, qword [0x140027a60]
mov eax, 0xa
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.140008010
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov rax, rcx
sub rax, rdi
cmp rax, 0x1d
jb 0x140006a77
cmp rcx, 8
lea rax, [rdi + 0x1d]
lea rbx, [rsp + 0x60]
mov qword [rsp + 0x70], rax
cmovae rbx, qword [rsp + 0x60]
lea rdx, str.__closing_log_and_quitting..
mov r8d, 0x3a
lea rcx, [rbx + rdi*2]
call fcn.14000f200
lea rax, [rsp + 0x60]
mov word [rbx + rdi*2 + 0x3a], r14w
jmp 0x140006a96
xorps xmm0, xmm0
lea rdx, str.Error:_Could_not_initialize_COM
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 0x1f
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.140007a10
lea rcx, [rbp - 0x60]
call fcn.1400014f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140006829
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006824
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
mov r14, qword [rbp - 0x10]
movabs r12, 0x7ffffffffffffffe
mov rax, r12
sub rax, r14
cmp rax, 9
jb 0x140006be1
cmp qword [rbp - 8], 8
lea r15, [rbp - 0x20]
lea rsi, [r14 + 9]
mov edi, 7
cmovae r15, qword [rbp - 0x20]
lea rbx, [rbp - 0x80]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x80], xmm0
movdqu xmmword [rbp - 0x70], xmm1
cmp rsi, rdi
jbe 0x14000690a
mov rdi, rsi
or rdi, 7
cmp rdi, r12
jbe 0x140006899
movabs rax, 0x7fffffffffffffff
mov rdi, r12
lea rcx, [rax + rax]
jmp 0x1400068c9
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rdi + 1]
cmp rcx, rax
ja 0x140006c3b
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400068f5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006c3b
mov rcx, rax
call fcn.14000984c
test rax, rax
je 0x140006c35
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140006906
test rcx, rcx
je 0x140006901
call fcn.14000984c
jmp 0x140006903
xor eax, eax
mov rbx, rax
mov qword [rbp - 0x80], rbx
movaps xmm0, xmmword [str._noupdate]
lea rcx, [rbx + 0x12]
mov qword [rbp - 0x70], rsi
lea r8, [r14 + r14]
mov qword [rbp - 0x68], rdi
mov rdx, r15
movups xmmword [rbx], xmm0
movzx eax, word [0x1400231b0]
mov word [rbx + 0x10], ax
call fcn.14000f200
xor r14d, r14d
mov rax, r12
mov word [rbx + rsi*2], r14w
lea rbx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
mov rcx, qword [0x140027a50]
cmovae rbx, qword [rbp - 0x80]
sub rax, rcx
mov rdx, qword [0x140027a70]
cmp rax, rdx
jb 0x140006be1
cmp qword [0x140027a58], 8
lea r9, [0x140027a40]
mov qword [rsp + 0x30], rdx
mov rax, r13
cmovae r9, qword [0x140027a40]
cmp qword [0x140027a78], 8
cmovae rax, qword [0x140027a60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.140008010
cmp qword [rsp + 0x78], 8
lea r8, [rsp + 0x60]
mov dword [rsp + 0x28], 1
mov r9, rbx
cmovae r8, qword [rsp + 0x60]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140006a1a
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a15
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c35
call fcn.140009ae0
mov rdx, qword [rbp - 0x68]
movdqa xmm0, xmmword [0x140023670]
mov word [rsp + 0x60], r14w
movdqu xmmword [rsp + 0x70], xmm0
cmp rdx, 8
jb 0x14000671a
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a6d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c35
call fcn.140009ae0
jmp 0x14000671a
lea r9, str.__closing_log_and_quitting..
mov qword [rsp + 0x20], 0x1d
mov edx, 0x1d
lea rcx, [rsp + 0x60]
call fcn.140007c60
movups xmm0, xmmword [rax]
lea rcx, [rbp - 0x40]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
call fcn.1400014f0
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140006afe
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006af9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c41
call fcn.140009ae0
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140006b40
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b3b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c41
call fcn.140009ae0
mov rcx, qword [0x140028fc8]
movdqa xmm0, xmmword [0x140023670]
mov word [rsp + 0x60], r14w
movdqu xmmword [rsp + 0x70], xmm0
test rcx, rcx
je 0x140006b6d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140028fc8], r14
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140006ba9
mov rcx, qword [rbp - 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ba4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006bdb
call fcn.140009ae0
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140009590
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000ff34
int3
call fcn.140001200
int3
call fcn.14000ff34
int3
call fcn.14000ff34
int3
call fcn.14000ff34
int3
call fcn.140007790
int3
call fcn.14000ff34
int3
call fcn.140001200
int3
call fcn.14000ff34
int3
call fcn.140001200
int3
call fcn.14000ff34
int3
call fcn.140001200
int3
call fcn.140007790
int3
call fcn.140001160
int3
call fcn.140001200
int3
call fcn.14000ff34
int3
call fcn.140001160
int3
call fcn.14000ff34
int3