Function at 0x140027728
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Delete registry value
Get common file path
Get file attributes
Persist via run registry key
Query or enumerate registry value
Set current directory
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc70]
sub rsp, 0xd70
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0xc60], rax
mov r15, qword [rcx + 0x30]
xor ebx, ebx
mov qword [rsp + 0x70], rcx
mov esi, r9d
mov r13d, edx
mov r12, rcx
mov edi, ebx
cmp edx, 3
je 0x140027797
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x140027797
call fcn.14001ab20
test eax, eax
je 0x140027797
mov rcx, r12
call fcn.1400255e4
mov edi, eax
test eax, eax
js 0x1400290b0
test r15, r15
jne 0x1400277a6
mov eax, 0x80004003
jmp 0x1400290b0
mov rcx, r15
call fcn.14001ab20
test eax, eax
jne 0x1400277bc
mov eax, 0x80070002
jmp 0x1400290b0
mov eax, dword [r12 + 0x58]
mov r14d, 1
cmp eax, r14d
je 0x140028711
jle 0x140028707
cmp eax, 4
jle 0x140028659
cmp eax, 5
je 0x140027f4d
cmp eax, 6
jne 0x140028707
mov r14d, 0x104
lea rcx, [rbp + 0x20]
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
or edi, 0xffffffff
test eax, eax
je 0x140027840
lea r8, str._rundll32.exe
mov edx, r14d
lea rcx, [rbp + 0x20]
call fcn.140010d0c
test eax, eax
js 0x140027840
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, edi
je 0x140027840
test al, 0x10
je 0x140027898
mov edx, 0x103
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140027f32
lea r8, str._rundll32.exe
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.140010d0c
test eax, eax
js 0x140027f32
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, edi
je 0x140027f32
test al, 0x10
jne 0x140027f32
neg esi
lea rax, [0x1400486c8]
lea r9, [rbp + 0x20]
mov edx, 0x208
sbb ecx, ecx
lea r8, str._s_advpack.dll_LaunchINFSectionEx__s__s___lu_N
and ecx, 0x200
add ecx, 0x2c
cmp qword [r12 + 0x28], rbx
mov dword [rsp + 0x30], ecx
lea rcx, [rbp + 0x850]
cmovne rax, qword [r12 + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call fcn.140010e44
lea rdx, [rbp + 0x230]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
lea rax, [rbp + 0x640]
mov esi, 2
sub r15, rax
lea rcx, [rbp + 0x640]
lea rax, [r14 + 0x7ffffefa]
test rax, rax
je 0x14002792f
movzx eax, word [rcx + r15]
test ax, ax
je 0x14002792f
mov word [rcx], ax
add rcx, rsi
sub r14, 1
jne 0x14002790d
lea rax, [rcx - 2]
test r14, r14
mov edx, 0x5c
cmovne rax, rcx
lea rcx, [rbp + 0x640]
mov word [rax], bx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x14002795d
mov word [rax], bx
lea rcx, [rbp + 0x640]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop dword [rax + rax]
mov r14d, dword [r12 + 0x70]
xor ecx, ecx
mov dword [rsp + 0x5c], ebx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
lea rdx, [0x14004c0e0]
lea rcx, [rbp + 0x850]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x1400279fb
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
test rax, rax
je 0x1400279fb
lea rdx, str._NoMigrate
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x1400279fb
lea rdx, str.Library_migration_skipped_due_to_installing_app_request._r_n
mov ecx, 4
call fcn.140019ae0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140027f2b
lea rcx, [rbp + 0x20]
call fcn.14001ab20
mov r13d, 0x57
test eax, eax
jne 0x140027a83
lea r8, [rbp + 0x20]
mov ecx, esi
lea rdx, str.ERROR:_Application__S_not_found.__Process_could_not_be_executed._r_n
call fcn.140019b1c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140027a45
mov r13d, eax
jle 0x140027a4f
movzx edi, r13w
or edi, 0x80070000
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop dword [rax + rax]
test edi, edi
js 0x140029090
call fcn.14001c428
test eax, eax
je 0x140029090
lea r8, str.Advpack_INF
jmp 0x14002818b
or rcx, 0xffffffffffffffff
lea rax, [rbp + 0x850]
mov rdi, rcx
inc rdi
cmp word [rax + rdi*2], bx
jne 0x140027a91
add rdi, 5
mov rax, rsi
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.1400014a0
mov r15, rax
test rax, rax
jne 0x140027ac0
lea ecx, [rax + 8]
jmp 0x140027a22
mov r8, rdi
lea rcx, [rbp + 0x850]
mov rdx, r15
call fcn.14001f72c
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov rcx, 0xffffffff80000001
mov dword [rbp - 0x60], 0x68
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x28], rbx
mov dword [rbp - 0x20], ebx
mov qword [rbp - 0x18], rbx
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rbx
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140027b91
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemTotalProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemEstimatedTime
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov edi, 4
lea r8, [rbp + 0x850]
mov ecx, edi
lea rdx, str.Starting_process__S._r_n
call fcn.140019b1c
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x20]
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, r15
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [rax + rax]
test eax, eax
jne 0x140027c4b
mov rcx, r15
call fcn.140001454
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140027c0a
mov eax, r13d
jmp 0x140027c0c
jle 0x140027c14
movzx eax, ax
or eax, 0x80070000
mov r9d, eax
lea r8, [rbp + 0x850]
lea rdx, str.ERROR:_Process__S_failed.__Error:_0x_x._r_n
mov ecx, esi
call fcn.140019b1c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140027a2e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140027a2e
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140027c64
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rbp - 0x80], rbx
test r14d, r14d
je 0x140027ea0
xor r8d, r8d
mov dword [rsp + 0x68], edi
mov edi, 0xfa
mov dword [rsp + 0x58], ebx
mov r9d, edi
mov dword [rsp + 0x60], ebx
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x64], ebx
lea ecx, [r8 + 1]
mov r12d, ebx
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140027e65
mov r14d, 0x2932e0
test r12d, r12d
jne 0x140027d53
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x140027cd0
lea r12d, [rcx + 1]
jmp 0x140027ddc
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x64]
xor r8d, r8d
lea rdx, str.CurrentItemTotalProgressCount
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140027d53
mov rcx, qword [0x14005a748]
lea r12d, [rax + 1]
mov r13d, dword [rsp + 0x64]
test rcx, rcx
je 0x140027d4e
call qword [sym.imp.USER32.dll_IsWindow]
nop dword [rax + rax]
test eax, eax
je 0x140027d4e
mov rcx, qword [0x14005a748]
mov r9d, r13d
xor r8d, r8d
mov edx, 0x5d9
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax + rax]
mov r13d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140027ddc
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x64]
xor r8d, r8d
lea rdx, str.CurrentItemProgressCount
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140027ddc
mov rcx, qword [0x14005a748]
mov r13d, dword [rsp + 0x64]
test rcx, rcx
je 0x140027dd7
call qword [sym.imp.USER32.dll_IsWindow]
nop dword [rax + rax]
test eax, eax
je 0x140027dd7
mov rcx, qword [0x14005a748]
mov r9d, r13d
xor r8d, r8d
mov edx, 0x5d8
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax + rax]
mov r13d, dword [rsp + 0x58]
mov ecx, 1
cmp r13d, r14d
ja 0x140027e12
add r13d, edi
lea rdx, [rsp + 0x78]
mov r9d, edi
mov dword [rsp + 0x58], r13d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
nop dword [rax + rax]
cmp eax, 0x102
je 0x140027cb4
jmp 0x140027e65
mov r9d, r14d
mov dword [rsp + 0x5c], 1
lea r8, [rbp + 0x850]
lea rdx, str.ERROR:__Process__S_deadlocked.__Terminated_after__lums._r_n
call fcn.140019b1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140027e4f
lea ecx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop dword [rax + rax]
cmp dword [rsp + 0x5c], ebx
jne 0x140027e95
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
nop dword [rax + rax]
test eax, eax
je 0x140027e95
mov ecx, dword [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov r12, qword [rsp + 0x70]
mov r13d, 0x57
mov rcx, r15
call fcn.140001454
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140027ec3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsp + 0x78], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140027f21
lea rdx, str.CurrentItemTotalProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemEstimatedTime
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
cmp dword [rsp + 0x5c], ebx
jne 0x140027a2e
mov edi, ebx
jmp 0x140027a4f
lea rdx, str.ERROR:_Install_for_package_was_halted.__RunDll32.exe_was_not_found_on_the_system._r_n
mov ecx, 2
mov edi, 0x80070002
call fcn.140019ae0
jmp 0x140029090
mov r14d, 0x104
lea rcx, [rbp + 0x20]
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140027f7d
lea r8, str._rundll32.exe
mov edx, r14d
lea rcx, [rbp + 0x20]
call fcn.140010d0c
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
or edi, 0xffffffff
cmp eax, edi
je 0x140027f98
test al, 0x10
je 0x140027fe4
mov edx, 0x103
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140027fc4
lea r8, str._rundll32.exe
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.140010d0c
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, edi
je 0x140027f32
test al, 0x10
jne 0x140027f32
mov r12d, 0x208
lea r8, [rbp + 0x20]
lea rax, [rbp + 0x230]
mov edx, r12d
sub r8, rax
lea rcx, [rbp + 0x230]
mov esi, 2
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x140028029
movzx eax, word [rcx + r8]
test ax, ax
je 0x140028029
mov word [rcx], ax
add rcx, rsi
sub rdx, 1
jne 0x140028007
test rdx, rdx
lea rax, [rcx - 2]
lea r8, str._setupapi_InstallHinfSection_Uninstall_132
mov rdx, r12
cmovne rax, rcx
cmp r13d, 3
lea rcx, [rbp + 0x230]
mov word [rax], bx
lea rax, str._setupapi_InstallHinfSection_DefaultInstall_132
cmovne r8, rax
call fcn.140010d0c
mov r8, r15
lea rcx, [rbp + 0x230]
mov rdx, r12
call fcn.140010d0c
mov rax, qword [rsp + 0x70]
mov r8, qword [rax + 0x28]
test r8, r8
je 0x14002808b
mov rdx, r12
lea rcx, [rbp + 0x230]
call fcn.140010d0c
mov r12, qword [rsp + 0x70]
xor ecx, ecx
mov dword [rsp + 0x5c], ebx
mov qword [rsp + 0x50], rbx
mov r14d, dword [r12 + 0x70]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
lea rdx, [0x14004c0e0]
lea rcx, [rbp + 0x230]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14002811b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
test rax, rax
je 0x14002811b
lea rdx, str._NoMigrate
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14002811b
lea rdx, str.Library_migration_skipped_due_to_installing_app_request._r_n
mov ecx, 4
call fcn.140019ae0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140028652
lea rcx, [rbp + 0x20]
call fcn.14001ab20
mov r13d, 0x57
test eax, eax
jne 0x1400281aa
lea r8, [rbp + 0x20]
mov ecx, esi
lea rdx, str.ERROR:_Application__S_not_found.__Process_could_not_be_executed._r_n
call fcn.140019b1c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140028165
mov r13d, eax
jle 0x14002816f
movzx edi, r13w
or edi, 0x80070000
test edi, edi
js 0x140029090
call fcn.14001c428
test eax, eax
je 0x140029090
lea r8, str.Setupapi_INF
or dword [0x140059568], 8
lea rdx, str.__Reboot_requested_due_to__S_file_copy._r_n
mov ecx, esi
call fcn.140019b1c
mov edi, 0xd2af9
jmp 0x140029090
or rcx, 0xffffffffffffffff
lea rax, [rbp + 0x230]
mov rdi, rcx
inc rdi
cmp word [rax + rdi*2], bx
jne 0x1400281b8
add rdi, 5
mov rax, rsi
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.1400014a0
mov r15, rax
test rax, rax
jne 0x1400281e7
lea ecx, [rax + 8]
jmp 0x140028142
mov r8, rdi
lea rcx, [rbp + 0x230]
mov rdx, r15
call fcn.14001f72c
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov rcx, 0xffffffff80000001
mov dword [rbp - 0x60], 0x68
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x28], rbx
mov dword [rbp - 0x20], ebx
mov qword [rbp - 0x18], rbx
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rbx
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400282b8
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemTotalProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemEstimatedTime
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov edi, 4
lea r8, [rbp + 0x230]
mov ecx, edi
lea rdx, str.Starting_process__S._r_n
call fcn.140019b1c
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x20]
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, r15
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [rax + rax]
test eax, eax
jne 0x140028372
mov rcx, r15
call fcn.140001454
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140028331
mov eax, r13d
jmp 0x140028333
jle 0x14002833b
movzx eax, ax
or eax, 0x80070000
mov r9d, eax
lea r8, [rbp + 0x230]
lea rdx, str.ERROR:_Process__S_failed.__Error:_0x_x._r_n
mov ecx, esi
call fcn.140019b1c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14002814e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x14002814e
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14002838b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rbp - 0x80], rbx
test r14d, r14d
je 0x1400285c7
xor r8d, r8d
mov dword [rsp + 0x68], edi
mov edi, 0xfa
mov dword [rsp + 0x58], ebx
mov r9d, edi
mov dword [rsp + 0x64], ebx
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x60], ebx
lea ecx, [r8 + 1]
mov r12d, ebx
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x14002858c
mov r14d, 0x2932e0
test r12d, r12d
jne 0x14002847a
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x1400283f7
lea r12d, [rcx + 1]
jmp 0x140028503
lea rax, [rsp + 0x64]
mov dword [rsp + 0x64], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.CurrentItemTotalProgressCount
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002847a
mov rcx, qword [0x14005a748]
lea r12d, [rax + 1]
mov r13d, dword [rsp + 0x60]
test rcx, rcx
je 0x140028475
call qword [sym.imp.USER32.dll_IsWindow]
nop dword [rax + rax]
test eax, eax
je 0x140028475
mov rcx, qword [0x14005a748]
mov r9d, r13d
xor r8d, r8d
mov edx, 0x5d9
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax + rax]
mov r13d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140028503
lea rax, [rsp + 0x64]
mov dword [rsp + 0x64], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.CurrentItemProgressCount
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140028503
mov rcx, qword [0x14005a748]
mov r13d, dword [rsp + 0x60]
test rcx, rcx
je 0x1400284fe
call qword [sym.imp.USER32.dll_IsWindow]
nop dword [rax + rax]
test eax, eax
je 0x1400284fe
mov rcx, qword [0x14005a748]
mov r9d, r13d
xor r8d, r8d
mov edx, 0x5d8
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax + rax]
mov r13d, dword [rsp + 0x58]
mov ecx, 1
cmp r13d, r14d
ja 0x140028539
add r13d, edi
lea rdx, [rsp + 0x78]
mov r9d, edi
mov dword [rsp + 0x58], r13d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
nop dword [rax + rax]
cmp eax, 0x102
je 0x1400283db
jmp 0x14002858c
mov r9d, r14d
mov dword [rsp + 0x5c], 1
lea r8, [rbp + 0x230]
lea rdx, str.ERROR:__Process__S_deadlocked.__Terminated_after__lums._r_n
call fcn.140019b1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140028576
lea ecx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop dword [rax + rax]
cmp dword [rsp + 0x5c], ebx
jne 0x1400285bc
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
nop dword [rax + rax]
test eax, eax
je 0x1400285bc
mov ecx, dword [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov r12, qword [rsp + 0x70]
mov r13d, 0x57
mov rcx, r15
call fcn.140001454
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400285ea
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsp + 0x78], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140028648
lea rdx, str.CurrentItemTotalProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemEstimatedTime
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
cmp dword [rsp + 0x5c], ebx
jne 0x14002814e
mov edi, ebx
jmp 0x140028177
mov qword [rbp - 0x70], rbx
mov dword [rbp - 0x68], 0x2a
mov qword [rsp + 0x78], rbx
mov dword [rbp - 0x80], ebx
call fcn.14001c428
mov dword [0x140059564], eax
lea r8, str.Uninstall
mov dword [0x14005956c], r14d
mov rax, qword [r12 + 0xc0]
mov qword [rbp - 0x78], rax
cmp r13d, 3
je 0x14002869c
mov r8, qword [r12 + 0x28]
mov r9d, esi
lea rcx, [rsp + 0x78]
mov rdx, r15
call fcn.140039a8c
mov edi, eax
test eax, eax
jns 0x1400286f8
cmp byte [r12 + 0x94], bl
je 0x1400286db
or dword [0x14005a760], 4
lea rdx, str.ERROR:_Install_of__S_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov r8, r15
mov ecx, 2
call fcn.140019b1c
mov edi, ebx
jmp 0x1400286f8
mov dword [0x14005a768], eax
mov rax, qword [r12 + 0xc0]
mov ecx, dword [rax + 0x64]
add ecx, dword [0x140059320]
mov dword [0x14005a764], ecx
lea rcx, [rsp + 0x78]
call fcn.140038aac
jmp 0x140029090
mov edi, 0x80004005
jmp 0x140029090
lea rax, [rbp + 0x230]
mov r8, r15
sub r8, rax
lea rcx, [rbp + 0x230]
mov r13d, r14d
mov edx, 0x207
mov esi, 2
lea rax, [rdx + 0x7ffffdf7]
test rax, rax
je 0x140028753
movzx eax, word [rcx + r8]
test ax, ax
je 0x140028753
mov word [rcx], ax
add rcx, rsi
sub rdx, r14
jne 0x140028732
test rdx, rdx
lea rax, [rcx - 2]
mov r12d, 0x208
lea r8, reloc.ATL.DLL_AtlInternalQueryInterface
cmovne rax, rcx
mov edx, r12d
lea rcx, [rbp + 0x230]
mov word [rax], bx
call fcn.140010d0c
mov rax, qword [rsp + 0x70]
mov r8, qword [rax + 0x28]
test r8, r8
je 0x14002879a
mov edx, r12d
lea rcx, [rbp + 0x230]
call fcn.140010d0c
mov r12, qword [rsp + 0x70]
xor edx, edx
mov rcx, qword [r12 + 0xc0]
call fcn.140025bc4
mov rcx, rax
cmp rax, 0x186a0
jae 0x1400287c7
mov eax, 0xd1b71759
mul ecx
mov ecx, edx
shr ecx, 0xd
jmp 0x1400287d7
mov eax, 0x4f8b588f
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x10
cmp ecx, 0x64
jbe 0x1400287ee
mov eax, 0xcccccccd
mul ecx
shr edx, 3
mov dword [0x14005a770], edx
jmp 0x1400287fe
mov eax, 0x14
cmp ecx, eax
cmovb ecx, eax
mov dword [0x14005a770], ecx
lea rdx, [0x14004c0e0]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x140028839
mov dword [0x14005a778], r14d
mov ecx, 0x64
mov r14d, 0x1f4
call fcn.140019314
mov r13d, dword [0x140059334]
jmp 0x14002885a
mov ecx, dword [0x14005a770]
mov r14d, 0x1388
mov dword [0x14005a778], ebx
call fcn.140019314
mov ecx, 0x26ec
call fcn.140019024
mov rcx, qword [0x14005a748]
lea r9, [0x140029fb0]
mov r8d, r14d
mov edx, 0x2f00
call qword [sym.imp.USER32.dll_SetTimer]
nop dword [rax + rax]
test r13d, r13d
je 0x140028e13
mov r14d, dword [r12 + 0x70]
xor ecx, ecx
mov dword [rsp + 0x5c], ebx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
lea rdx, [0x14004c0e0]
lea rcx, [rbp + 0x230]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x140028910
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
test rax, rax
je 0x140028910
lea rdx, str._NoMigrate
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x140028910
lea rdx, str.Library_migration_skipped_due_to_installing_app_request._r_n
mov ecx, 4
call fcn.140019ae0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140028e0c
mov rcx, r15
call fcn.14001ab20
mov r13d, 0x57
test eax, eax
jne 0x14002896b
mov r8, r15
lea rdx, str.ERROR:_Application__S_not_found.__Process_could_not_be_executed._r_n
mov ecx, esi
call fcn.140019b1c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x14002895c
mov r13d, eax
jle 0x140028f33
movzx edi, r13w
or edi, 0x80070000
jmp 0x140028f33
or rcx, 0xffffffffffffffff
lea rax, [rbp + 0x230]
mov rdi, rcx
inc rdi
cmp word [rax + rdi*2], bx
jne 0x140028979
add rdi, 5
mov rax, rsi
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.1400014a0
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x1400289a6
lea ecx, [rax + 8]
jmp 0x140028935
mov r8, rdi
lea rcx, [rbp + 0x230]
mov rdx, rax
call fcn.14001f72c
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov rcx, 0xffffffff80000001
mov dword [rbp - 0x60], 0x68
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x28], rbx
mov dword [rbp - 0x20], ebx
mov qword [rbp - 0x18], rbx
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rbx
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140028a77
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemTotalProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemEstimatedTime
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
lea r8, [rbp + 0x230]
mov ecx, 4
lea rdx, str.Starting_process__S._r_n
call fcn.140019b1c
mov rdi, qword [rbp + 0x10]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, rdi
mov qword [rsp + 0x38], rbx
mov rcx, r15
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [rax + rax]
test eax, eax
jne 0x140028b32
mov rcx, rdi
call fcn.140001454
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140028af1
mov eax, r13d
jmp 0x140028af3
jle 0x140028afb
movzx eax, ax
or eax, 0x80070000
mov r9d, eax
lea r8, [rbp + 0x230]
lea rdx, str.ERROR:_Process__S_failed.__Error:_0x_x._r_n
mov ecx, esi
call fcn.140019b1c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140028941
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140028941
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140028b4b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rbp - 0x80], rbx
test r14d, r14d
je 0x140028d80
xor r8d, r8d
mov dword [rsp + 0x58], ebx
mov edi, 0xfa
mov dword [rsp + 0x68], 4
mov r9d, edi
mov dword [rsp + 0x64], ebx
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x60], ebx
lea ecx, [r8 + 1]
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140028d4a
mov r14d, 0x2932e0
test r13d, r13d
jne 0x140028c36
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x140028bb8
lea r13d, [rcx + 1]
jmp 0x140028cba
lea rax, [rsp + 0x64]
mov dword [rsp + 0x64], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.CurrentItemTotalProgressCount
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140028c36
mov rcx, qword [0x14005a748]
lea r13d, [rax + 1]
mov r12d, dword [rsp + 0x60]
test rcx, rcx
je 0x140028c36
call qword [sym.imp.USER32.dll_IsWindow]
nop dword [rax + rax]
test eax, eax
je 0x140028c36
mov rcx, qword [0x14005a748]
mov r9d, r12d
xor r8d, r8d
mov edx, 0x5d9
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140028cba
lea rax, [rsp + 0x64]
mov dword [rsp + 0x64], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.CurrentItemProgressCount
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140028cba
mov rcx, qword [0x14005a748]
mov r12d, dword [rsp + 0x60]
test rcx, rcx
je 0x140028cba
call qword [sym.imp.USER32.dll_IsWindow]
nop dword [rax + rax]
test eax, eax
je 0x140028cba
mov rcx, qword [0x14005a748]
mov r9d, r12d
xor r8d, r8d
mov edx, 0x5d8
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax + rax]
mov eax, dword [rsp + 0x58]
mov ecx, 1
cmp eax, r14d
ja 0x140028cf2
add eax, edi
lea rdx, [rsp + 0x78]
mov r9d, edi
mov dword [rsp + 0x58], eax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
nop dword [rax + rax]
cmp eax, 0x102
je 0x140028b9c
jmp 0x140028d45
mov r9d, r14d
mov dword [rsp + 0x5c], 1
lea r8, [rbp + 0x230]
lea rdx, str.ERROR:__Process__S_deadlocked.__Terminated_after__lums._r_n
call fcn.140019b1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140028d2f
lea ecx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop dword [rax + rax]
mov r12, qword [rsp + 0x70]
cmp dword [rsp + 0x5c], ebx
jne 0x140028d7a
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
nop dword [rax + rax]
test eax, eax
je 0x140028d7a
mov ecx, dword [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov r13d, 0x57
mov rcx, qword [rbp + 0x10]
call fcn.140001454
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140028da4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsp + 0x78], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140028e02
lea rdx, str.CurrentItemTotalProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemProgressCount
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.CurrentItemEstimatedTime
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
cmp dword [rsp + 0x5c], ebx
jne 0x140028941
mov edi, ebx
jmp 0x140028f33
lea rdx, [0x14004c0e0]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x140028f22
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140028f0f
mov r14d, 0x104
lea rcx, [rbp + 0x640]
mov edx, r14d
call fcn.14001b20c
test eax, eax
je 0x140028efe
lea r8, str.wmdbexport.exe
mov edx, r14d
lea rcx, [rbp + 0x640]
call fcn.140010d0c
test eax, eax
js 0x140028efe
lea rax, [rbp + 0x640]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], bx
jne 0x140028ebd
lea eax, [rcx*2 + 2]
mov r9d, 1
mov rcx, qword [rsp + 0x50]
lea rdx, str.WMC_WMPDBExport
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rbp + 0x640]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rdx, str.wmdbexport.exe_was_not_run_as_wmp11_installs_did_not_complete.
mov ecx, 4
call fcn.140019b1c
jmp 0x140028f33
mov r8, r15
lea rdx, str.ERROR:__S_was_not_executed_as_the_WMP11_install_check_was__ve._Setup_will_not_fail_because_of_this_issue._r_n
mov ecx, esi
call fcn.140019b1c
cmp dword [0x14005a778], ebx
mov ecx, 0x64
jne 0x140028f46
mov ecx, dword [0x14005a770]
call fcn.140019120
mov rcx, qword [0x14005a748]
mov edx, 0x2f00
call qword [sym.imp.USER32.dll_KillTimer]
nop dword [rax + rax]
test edi, edi
jns 0x140028f8b
cmp byte [r12 + 0x94], bl
je 0x140028f8b
or dword [0x14005a760], 1
lea rdx, str.ERROR:_Execution_of__S_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov r8, r15
mov ecx, esi
call fcn.140019b1c
mov edi, ebx
mov r14d, 0xd2af9
cmp dword [r12 + 0x90], ebx
je 0x140028ff8
cmp edi, 0x80070bc2
je 0x140029009
cmp edi, 0x8007f901
jne 0x140028faf
mov edi, ebx
jmp 0x140029028
cmp edi, 0x8007f02a
jne 0x140028fbe
mov edi, 0xc00d2afb
jmp 0x140029028
test edi, edi
js 0x140028fd9
call fcn.14001c428
mov dword [0x140059564], eax
mov dword [0x14005956c], 1
jmp 0x140029028
mov rax, qword [r12 + 0xc0]
mov dword [0x14005a768], edi
mov ecx, dword [rax + 0x64]
add ecx, dword [0x140059320]
mov dword [0x14005a764], ecx
jmp 0x140029028
test edi, edi
js 0x140029028
call fcn.14001c428
cmp dword [0x140059564], eax
jae 0x140029028
or dword [0x140059568], 8
lea r8, str.External_App
lea rdx, str.__Reboot_requested_due_to__S_file_copy._r_n
mov ecx, esi
call fcn.140019b1c
mov edi, r14d
mov edx, edi
mov rcx, r15
call fcn.1400245a4
test eax, eax
jne 0x14002904a
or dword [0x14005a760], esi
lea rdx, str.ERROR:_DRM_licence_migration_failed._Setup_will_not_fail_because_of_this_issue._r_n
mov ecx, esi
call fcn.140019b1c
lea rdx, str.wmp11.exe
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x140029080
lea rdx, str.wmp11_64.exe
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x140029090
test edi, edi
js 0x14002908a
cmp edi, r14d
setne bl
mov dword [0x140059334], ebx
mov r8d, edi
lea rdx, str.__Package_install_complete.__Last_result_0x_x._r_n
mov ecx, 4
call fcn.140019b1c
xor edx, edx
mov rcx, r12
call fcn.140024a14
mov eax, edi
mov rcx, qword [rbp + 0xc60]
xor rcx, rsp
call fcn.1400017f0
mov rbx, qword [rsp + 0xdb8]
add rsp, 0xd70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret