Function at 0x1400d6730
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1750]
mov eax, 0x1850
call fcn.1401e33b0
sub rsp, rax
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x1740], rax
mov rsi, rcx
xor r12d, r12d
mov qword [0x1402bbd80], r12
mov qword [0x1402bbd70], r12
mov qword [0x1402bbd88], 1
lea rax, [0x140246f90]
mov qword [0x1402bbda0], rax
lea rbx, [0x1402bbd70]
mov qword [0x1402a8360], rbx
lea rdi, [0x1402bbda0]
mov r8, qword [rdi]
lea rdi, [rdi + 8]
mov qword [rbp], r8
mov qword [rbp + 8], r12
mov qword [rbx + 0x20], r8
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov rdx, rbx
lea rcx, [0x1400d6030]
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400d67b0
mov edi, r12d
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
mov rcx, rsi
call fcn.1401cf4e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
xor r8d, r8d
lea rdx, [0x140251dfc]
lea rcx, [rbp + 0x10]
call fcn.140005520
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x6c0]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1110]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xf00]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x400]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1530]
call fcn.1401e7e40
lea rcx, [rbp - 0x28]
call fcn.1401c8bf0
nop
lea rcx, [rbp - 0x50]
call fcn.1401c8bf0
nop
lea rcx, [rbp + 0x70]
call fcn.1400b49a0
nop
lea rdx, [rbp + 0x70]
mov rcx, rsi
call fcn.1401cf754
cmp byte [rbp + 0x108], bl
jne 0x1400d68d8
mov edi, 0x8001006d
mov dword [0x1402bbd98], 0x6d
jmp 0x1400d6936
movzx eax, byte [rbp + 0x109]
mov dword [rsi + 0x1a0], eax
movzx eax, byte [rbp + 0x10f]
mov dword [rsi + 0x204], eax
call fcn.14018d2c0
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov edx, eax
lea rcx, [rbp + 0x118]
call fcn.14019f7e0
mov qword [rsi + 0x1e8], rax
movzx eax, byte [rbp + 0x110]
mov dword [rsi + 0x208], eax
movzx eax, byte [rbp + 0x2e0]
mov dword [rsi + 0x200], eax
call fcn.14018d2c0
mov rcx, rax
call fcn.14018bd10
test eax, eax
je 0x1400d69c3
cmp dword [rsi + 0x1a0], 1
jne 0x1400d69b4
mov r14d, r12d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x1400d69a3
mov r8d, 4
lea rdx, str.SPOOLER
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x1400d6995
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14d, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r14d, r14d
jne 0x1400d69c3
mov edi, 0x8001006a
mov dword [0x1402bbd98], 0x6a
jmp 0x1400d69c3
mov edi, 0x80010069
mov dword [0x1402bbd98], 0x69
mov rax, qword [rsi]
mov r9d, 0x104
lea r8, [rbp + 0x400]
lea rdx, str.setup.ini
mov rcx, rsi
mov rax, qword [rax + 0x250]
call qword [case.0x1400136d6.0]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xcf0]
call fcn.1401e7e40
mov rax, qword [rsi]
mov r9d, 0x104
lea r8, [rbp + 0xcf0]
lea rdx, str.MISC
mov rcx, rsi
mov rax, qword [rax + 0x250]
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0xcf0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, str.InsDrv.ini
lea rcx, [rbp + 0xcf0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r15, 0xffffffffffffffff
movabs r13, 0x7ffffffffffffffe
test edi, edi
jne 0x1400d6cf2
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x330]
call qword [case.0x1400136d6.0]
mov edi, eax
test eax, eax
jne 0x1400d6cf2
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x320]
call qword [case.0x1400136d6.0]
mov edi, eax
cmp ax, 0x64
jne 0x1400d6b04
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x328]
call qword [case.0x1400136d6.0]
mov ebx, eax
test eax, eax
jns 0x1400d6b04
lea rax, [rbp + 0x400]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp + 0x1530]
lea r8, [0x140254ca8]
lea rdx, str.CheckiWEMC_DRM
lea rcx, str.ModuleInfo
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [0x140255230]
lea rcx, [rbp + 0x1530]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400d6b87
mov edi, ebx
test edi, edi
jne 0x1400d6cf2
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xae0]
call fcn.1401e7e40
mov r8d, 0x104
lea rdx, [rbp + 0xae0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsi]
mov r9d, 0x104
lea r8, [rbp + 0xae0]
lea rdx, [rbp + 0xae0]
mov rcx, rsi
mov rax, qword [rax + 0x2d0]
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0xae0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xdc
jl 0x1400d6b8c
mov edi, 0x80010065
mov dword [0x1402bbd98], 0x65
mov r12d, edi
jmp 0x1400d6cfd
mov edi, r12d
jmp 0x1400d6b0c
call fcn.14018d2c0
mov dword [rsp + 0x58], r12d
lea rcx, str.Kernel32.dll
call fcn.140006be0
mov r14, rax
test rax, rax
je 0x1400d6c8a
lea rdx, str.IsWow64Process2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400d6c8a
mov word [rsp + 0x54], r12w
mov word [rsp + 0x50], r12w
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x54]
mov rax, rbx
call qword [case.0x1400136d6.0]
test eax, eax
je 0x1400d6ca3
mov ecx, 0x14c
movzx eax, word [rsp + 0x54]
cmp cx, ax
jne 0x1400d6c24
mov ecx, 0x8664
movzx edx, word [rsp + 0x50]
cmp cx, dx
je 0x1400d6c80
mov eax, 0xaa64
cmp ax, dx
je 0x1400d6c80
jmp 0x1400d6ca3
cmp r12w, ax
jne 0x1400d6ca3
mov eax, 0xaa64
cmp ax, word [rsp + 0x50]
jne 0x1400d6ca3
lea rdx, str.GetProcessInformation
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r9d, 8
lea r8, [rbp - 0x58]
lea edx, [r9 + 1]
mov rax, rbx
call qword [case.0x1400136d6.0]
test eax, eax
je 0x1400d6ca3
mov rax, qword [rbp - 0x58]
mov word [rsp + 0x54], ax
mov ecx, 0x8664
cmp cx, ax
jne 0x1400d6ca3
mov dword [rsp + 0x58], 1
jmp 0x1400d6ca3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test r14, r14
je 0x1400d6cac
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x58], 0
je 0x1400d6cc7
mov edi, 0x80010008
mov dword [0x1402bbd98], 8
mov r12d, edi
jmp 0x1400d6cfd
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x290]
call qword [case.0x1400136d6.0]
test eax, eax
jne 0x1400d6cf2
mov edi, 0x80010035
mov dword [0x1402bbd98], 0x35
mov r12d, edi
jmp 0x1400d6cfd
mov r12d, edi
test edi, edi
jns 0x1400d71c5
mov dword [rsp + 0x68], edi
lea rcx, [rbp + 0x400]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400d7184
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x8d0]
call fcn.1401e7e40
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xor r14d, r14d
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
lea rax, [rbp + 0x400]
mov rbx, r15
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x1400d6d50
cmp rbx, r13
ja 0x1400d7cdc
mov qword [rbp + 0x48], 7
cmp rbx, 8
jae 0x1400d6d8b
mov qword [rbp + 0x40], rbx
lea r8, [rbx + rbx]
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x30]
call fcn.1401e7770
jmp 0x1400d6ddf
mov r14, rbx
or r14, 7
cmp r14, r13
jbe 0x1400d6f36
mov r14, r13
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.140006010
mov rdi, rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], r14
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x400]
mov rcx, rax
call fcn.1401e7770
xor r14d, r14d
mov word [rdi + rbx], r14w
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x28]
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x30]
mov rcx, rsi
call fcn.1400d7dd0
mov edi, eax
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x1400d6e3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d6e39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d7ce2
call fcn.1400079c0
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r14w
test edi, edi
jne 0x1400d717e
mov rax, qword [rsi]
mov r9d, 0x104
lea r8, [rbp + 0x8d0]
lea rdx, str.MISC
mov rcx, rsi
mov rax, qword [rax + 0x250]
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0x8d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jle 0x1400d713e
mov rax, qword [rbp - 0x40]
cmp rcx, rax
jne 0x1400d713e
lea rdx, vtable.CBaseInfoLocale.0
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x80], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r14
mov edi, r14d
test rcx, rcx
jle 0x1400d6f5f
xor ebx, ebx
test rbx, rbx
js 0x1400d7ce8
cmp rbx, rax
jge 0x1400d7ce8
mov rax, qword [rbp - 0x48]
lea r8, [rax + rbx*8]
cmp rbx, rcx
jge 0x1400d7ce8
lfence
mov rax, qword [rsp + 0x78]
mov r8, qword [r8]
mov rdx, qword [rbp - 0x20]
mov rdx, qword [rdx + rbx*8]
lea rcx, [rsp + 0x78]
mov rax, qword [rax + 0x60]
call qword [case.0x1400136d6.0]
mov edi, eax
test eax, eax
js 0x1400d6f5f
inc r14d
inc rbx
movsxd rax, r14d
mov rcx, qword [rbp - 0x18]
cmp rax, rcx
jge 0x1400d6f5f
mov rax, qword [rbp - 0x40]
jmp 0x1400d6ed3
cmp r14, 0xa
mov eax, 0xa
cmovb r14, rax
lea rcx, [r14 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400d7cd0
jmp 0x1400d6da8
test edi, edi
jne 0x1400d712c
xor edx, edx
mov r8d, 0xaa
lea rcx, [rbp + 0x610]
call fcn.1401e7e40
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400d7cee
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x70], rax
xor r14d, r14d
mov edi, r14d
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x78]
mov rax, qword [rax + 0x58]
call qword [case.0x1400136d6.0]
mov ebx, eax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx + 0x28]
mov edx, ebx
lea rcx, [rsp + 0x78]
call qword [case.0x1400136d6.0]
cmp qword [rbp + 0x1c8], rdi
je 0x1400d700e
lea rdx, [rbp + 0x1b8]
cmp qword [rbp + 0x1d0], 8
cmovae rdx, qword [rbp + 0x1b8]
mov rax, qword [rsp + 0x78]
lea r8d, [r14 + 1]
lea rcx, [rsp + 0x78]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov edi, eax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx + 0x18]
mov edx, edi
lea rcx, [rsp + 0x78]
call qword [case.0x1400136d6.0]
test edi, edi
cmove edi, ebx
mov rdx, qword [rbp - 0x70]
mov rcx, rdx
mov rax, qword [rbp - 0x78]
sub rcx, rax
sar rcx, 3
test rcx, rcx
je 0x1400d7072
cmp rax, rdx
je 0x1400d7072
mov rbx, qword [rax]
test rbx, rbx
je 0x1400d7051
cmp dword [rbx], edi
je 0x1400d7057
add rax, 8
jmp 0x1400d7040
lea rcx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rbx + 4]
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
jb 0x1400d708b
mov rdx, qword [rbp + 0x10]
test rdx, rdx
jne 0x1400d708b
mov eax, r14d
jmp 0x1400d709a
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], r14w
jne 0x1400d7090
mov r8d, eax
lea rcx, [rsp + 0x70]
call fcn.140004e60
lea r8, [rbp + 0x610]
lea rdx, [0x14025367c]
lea rcx, [rsp + 0x70]
call fcn.140063ef0
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rbx
lea r9, str.Resource_
lea r8, [rbp + 0x8d0]
lea rdx, [0x14025b2e0]
lea rcx, [rbp + 0x6c0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [rsi]
lea rdx, [rbp + 0x6c0]
mov rcx, rsi
mov rax, qword [rax + 0x2d8]
call qword [case.0x1400136d6.0]
mov edi, eax
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d712c
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rcx, [rsp + 0x78]
call fcn.140047230
test edi, edi
cmovns edi, r12d
jmp 0x1400d71a7
lea r8, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r8, qword [rbp + 0x10]
mov r9, r15
mov edx, 0x104
lea rcx, [rbp + 0x8d0]
call fcn.1401fe824
mov rax, qword [rsi]
lea rdx, [rbp + 0x8d0]
mov rcx, rsi
mov rax, qword [rax + 0x2d8]
call qword [case.0x1400136d6.0]
mov edi, eax
test eax, eax
cmovns edi, r12d
jmp 0x1400d71a7
mov edi, 0x8001000c
mov dword [0x1402bbd98], 0xc
lea rdx, str.setup.ini
lea rcx, [rbp + 0xf00]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [rsp + 0x68], 0x69
jne 0x1400d71c3
mov edi, 0x80010069
mov dword [0x1402bbd98], 0x69
jmp 0x1400d78f6
test edi, edi
jne 0x1400d77fd
mov rax, qword [rsi]
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov r9d, 0x104
lea r8, [rbp + 0x1110]
lea rdx, str.setup.ini
mov rcx, rsi
mov rax, qword [rax + 0x348]
call qword [case.0x1400136d6.0]
mov edi, eax
test eax, eax
jns 0x1400d7216
lea rdx, str.setup.ini
lea rcx, [rbp + 0xf00]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1400d723d
lea rax, [rbp + 0x1110]
mov r8, r15
inc r8
cmp word [rax + r8*2], r14w
jne 0x1400d7220
lea rcx, [rsi + 0x1c0]
lea rdx, [rbp + 0x1110]
call fcn.140004b70
test edi, edi
jne 0x1400d77fd
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], r14
lea rax, [rbp + 0x400]
mov rbx, r15
nop
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x1400d7260
cmp rbx, r13
ja 0x1400d7cf9
mov qword [rbp + 0x68], 7
cmp rbx, 8
jae 0x1400d729b
mov qword [rbp + 0x60], rbx
lea r8, [rbx + rbx]
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x50]
call fcn.1401e7770
jmp 0x1400d72e9
mov rax, rbx
or rax, 7
cmp rax, r13
jbe 0x1400d7390
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.140006010
mov rdi, rax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], r13
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x400]
mov rcx, rax
call fcn.1401e7770
mov word [rdi + rbx], r14w
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x28]
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x50]
mov rcx, rsi
call fcn.1400d7dd0
mov edi, eax
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x1400d7348
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d7343
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d7cff
call fcn.1400079c0
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r14w
test edi, edi
jne 0x1400d77fd
cmp dword [rsi + 0x20c], edi
je 0x1400d73bc
mov rax, qword [rbp - 0x18]
test rax, rax
jle 0x1400d737c
cmp rax, qword [rbp - 0x40]
je 0x1400d7457
mov edi, 0x80010060
mov dword [0x1402bbd98], 0x60
jmp 0x1400d7807
mov r13, rax
cmp rax, 0xa
mov eax, 0xa
cmovb r13, rax
lea rcx, [r13 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400d7cd6
jmp 0x1400d72b5
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rdx, qword [rbp + 0x10]
mov rax, qword [rsi]
mov dword [rsp + 0x20], 1
mov r9d, 0x104
lea r8, [rbp + 0x6c0]
mov rcx, rsi
mov rax, qword [rax + 0x348]
call qword [case.0x1400136d6.0]
test eax, eax
jns 0x1400d7425
mov edi, 0x80010060
mov dword [0x1402bbd98], 0x60
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0xf00]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1400d7807
mov rax, qword [rsi]
lea rdx, [rbp + 0x6c0]
mov rcx, rsi
mov rax, qword [rax + 0x2d8]
call qword [case.0x1400136d6.0]
mov edi, eax
mov rax, qword [rsi + 0x1b0]
mov qword [rsi + 0x1b8], rax
test edi, edi
jne 0x1400d77fd
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x220]
call qword [case.0x1400136d6.0]
mov edi, eax
test eax, eax
jne 0x1400d77fd
cmp dword [rsi + 0x20c], eax
je 0x1400d7768
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x238]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x80]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x38]
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x28]
mov rcx, r9
call qword [case.0x1400136d6.0]
mov edi, eax
test eax, eax
jne 0x1400d77fd
cmp dword [rsi + 0x20c], eax
je 0x1400d7768
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x238]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x88]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x28]
mov rcx, r9
call qword [case.0x1400136d6.0]
mov edi, eax
test eax, eax
jne 0x1400d77fd
cmp dword [rsi + 0x20c], eax
je 0x1400d7768
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1320]
call fcn.1401e7e40
mov rax, qword [rsi]
mov r9d, 0x104
lea r8, [rbp + 0x1320]
lea rdx, str.MISC
mov rcx, rsi
mov rax, qword [rax + 0x250]
call qword [case.0x1400136d6.0]
lea rcx, [rbp + 0x1320]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rbx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rbx, qword [rbp + 0x10]
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400d7d05
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
test rbx, rbx
je 0x1400d75dd
cmp rbx, 0x10000
jae 0x1400d75ce
movzx edx, bx
lea rcx, [rsp + 0x60]
call fcn.1400041d0
jmp 0x1400d75f1
mov rax, r15
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400d75d1
jmp 0x1400d75e0
mov eax, r14d
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140004e60
nop
lea r8, str.neutral
lea rdx, [0x14025367c]
lea rcx, [rsp + 0x60]
call fcn.140063ef0
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rbx
lea r9, str.Resource_
lea r8, [rbp + 0x1320]
lea rdx, [0x14025b2e0]
lea rcx, [rbp + 0x6c0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x6c0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400d7677
xor edx, edx
lea r8d, [rax + 7]
lea rcx, [rbp + 0x6c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsi + 0x1b8], rax
test rax, rax
jne 0x1400d7686
mov edi, 0x80010047
mov dword [0x1402bbd98], 0x47
jmp 0x1400d7686
mov edi, 0x80010060
mov dword [0x1402bbd98], 0x60
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d76aa
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
test edi, edi
jne 0x1400d77fd
cmp dword [rsi + 0x20c], edi
je 0x1400d7768
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x238]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x80]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov r8, rax
lea rdx, [rbp + 0x70]
call fcn.1400d8860
mov ebx, eax
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x238]
mov rcx, rsi
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x88]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x28]
mov edx, ebx
mov rcx, r8
call qword [case.0x1400136d6.0]
test rax, rax
je 0x1400d737c
mov rcx, qword [rsi]
lea rdx, [rax + 0x104]
mov rax, qword [rcx + 0x2d8]
mov rcx, rsi
call qword [case.0x1400136d6.0]
mov edi, eax
test eax, eax
jne 0x1400d77fd
cmp dword [rsi + 0x20c], eax
jne 0x1400d77af
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x238]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x48]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
lea r8, [0x140254ca8]
lea rdx, str.DWEL
mov rcx, r9
call qword [case.0x1400136d6.0]
mov dword [rsi + 0x1f0], 1
mov rax, qword [rsi]
lea rdx, [rbp + 0x70]
mov rcx, rsi
mov rax, qword [rax + 0x360]
call qword [case.0x1400136d6.0]
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x230]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 8]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov edi, eax
jmp 0x1400d78f6
cmp di, 0x69
je 0x1400d78f6
mov rax, qword [rsi]
lea r8, [rbp + 0x70]
mov edx, edi
mov rcx, rsi
mov rax, qword [rax + 0x368]
call qword [case.0x1400136d6.0]
mov edi, eax
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x248]
call qword [case.0x1400136d6.0]
test rax, rax
je 0x1400d78f6
xorps xmm0, xmm0
movups xmmword [rbp + 0x380], xmm0
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
movups xmmword [rbp + 0x3b0], xmm0
movups xmmword [rbp + 0x3c0], xmm0
movups xmmword [rbp + 0x3d0], xmm0
movups xmmword [rbp + 0x3e0], xmm0
movups xmmword [rbp + 0x3f0], xmm0
lea rax, [rbp + 0xcf0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
lea r9, [rbp + 0x380]
lea r8, [0x140251dfc]
lea rdx, str.PDL_TYPE
lea rcx, str.Installer_Info
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x238]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x48]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
lea r8, [rbp + 0x380]
lea rdx, str.PDL_TYPE
mov rcx, r9
call qword [case.0x1400136d6.0]
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400d7d10
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400d7d1b
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
movzx eax, di
add eax, 0xfffffffe
cmp eax, 0x6b
ja case.0x1400d796e.14
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0xd7d5c]
mov ecx, dword [r8 + rax*4 + 0xd7d28]
add rcx, r8
jmp rcx
mov rbx, qword [rsi + 0x1b0]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400041d0
mov edx, 0x19
mov eax, 0x9c8
test rbx, rbx
cmove edx, eax
lea r8, [rbp + 0xf00]
lea rcx, [rsp + 0x40]
call fcn.14001ce30
mov rdx, qword [rsp + 0x40]
cmp dword [rsi + 0x1a0], 0
jne 0x1400d7b7c
mov r9d, 0x30
mov r8, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x1400d796e.14
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400041d0
mov edx, 0x9ca
lea rcx, [rsp + 0x40]
call fcn.1400041d0
jmp 0x1400d79a7
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400041d0
mov edx, 0x9cb
lea rcx, [rsp + 0x40]
call fcn.1400041d0
jmp 0x1400d79a7
mov edx, 0x9cc
lea rcx, [rsp + 0x48]
call fcn.1400041d0
mov edx, 0x9c6
lea rcx, [rsp + 0x40]
call fcn.1400041d0
mov rdx, qword [rsp + 0x40]
cmp dword [rsi + 0x1a0], 0
jne 0x1400d7b7c
mov r9d, reloc.WSOCK32.dll_recv
mov r8, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x1400d796e.14
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400041d0
mov edx, 0x9cd
lea rcx, [rsp + 0x40]
call fcn.14001ce30
jmp 0x1400d79a7
lfence
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400041d0
mov edx, 0xa39
lea rcx, [rsp + 0x40]
call fcn.1400041d0
mov rdx, qword [rsp + 0x40]
cmp dword [rsi + 0x1a0], 0
jne 0x1400d7ac0
mov r9d, 0x30
mov r8, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400d7ad8
mov rax, qword [0x1402bc0b8]
lea rcx, [0x1402bc0b8]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x2c8]
call qword [case.0x1400136d6.0]
jmp case.0x1400d796e.14
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400041d0
mov edx, 0xa2e
lea rcx, [rsp + 0x40]
call fcn.1400041d0
jmp 0x1400d79a7
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400041d0
mov edx, 0x23
lea rcx, [rsp + 0x40]
call fcn.1400041d0
jmp 0x1400d79a7
mov edx, 0x9cc
lea rcx, [rsp + 0x48]
call fcn.1400041d0
mov edx, 0xa8c
lea rcx, [rsp + 0x40]
call fcn.1400041d0
mov r9d, reloc.WSOCK32.dll_recv
jmp 0x1400d7cb3
mov edx, 0xa8d
lea rcx, [rsp + 0x40]
call fcn.1400041d0
cmp dword [rsi + 0x1a0], 0
je case.0x1400d796e.14
mov rdx, qword [rsp + 0x40]
mov rax, qword [0x1402bc0b8]
lea rcx, [0x1402bc0b8]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d7bbf
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x1400d7be8
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rcx, [rbp + 0x70]
call fcn.1400b4dd0
nop
lea rcx, [rbp - 0x50]
call fcn.1401c8c10
nop
lea rcx, [rbp - 0x28]
call fcn.1401c8c10
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1400d7c46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d7c41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d7cca
call fcn.1400079c0
xor eax, eax
mov rcx, qword [rbp + 0x1740]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x1850]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, 0xa8f
jmp 0x1400d7b64
mov edx, reloc.COMCTL32.dll_InitCommonControls
lea rcx, [rsp + 0x40]
call fcn.1400041d0
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400041d0
cmp dword [rsi + 0x1a0], 0
jne 0x1400d7b77
mov r9d, 0x30
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x1400d796e.14
call fcn.1401ec41c
nop
call fcn.1400019f0
int3
call fcn.1400019f0
int3
call fcn.140001a90
int3
call fcn.1401ec41c
nop
call fcn.1401bb848
int3
mov ecx, 0x80004005
call fcn.140001470
nop
call fcn.140001a90
int3
call fcn.1401ec41c
int3
mov ecx, 0x80004005
call fcn.140001470
int3
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
int3