Function at 0x140007344
Capabilities:
Copy file
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x418]
sub rsp, 0x518
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x140042038]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov r13, r9
mov r12, r8
mov rbx, rdx
mov rdi, rcx
mov rsi, qword [rbp + 0x480]
mov r14, qword [rbp + 0x488]
mov r15, qword [rbp + 0x490]
xor eax, eax
cmp byte [rcx + 0x1710], al
je 0x1400073be
lea r9, str.Compiling_script...
xor r8d, r8d
mov edx, 0x40b
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.140008694
test al, al
je 0x140007af5
mov r8, r13
mov rdx, r12
mov rcx, rdi
call fcn.140007b20
xor eax, eax
cmp byte [rdi + 0x1710], al
je 0x140007482
cmp byte [rdi + 0x1713], al
jne 0x140007454
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetActiveWindow]
xor eax, eax
mov r9d, eax
cmp dword [rdi + 0x898], eax
setne r9b
mov qword [rsp + 0x20], rax
mov edx, 0x40d
mov r8d, 0xf1
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov al, byte [rdi + 0x1713]
neg al
sbb edx, edx
neg edx
add edx, 0x3ff
xor ecx, ecx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 0xf5
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov r8, r12
mov edx, 0x403
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
cmp byte [rdi + 0x1713], al
jne 0x140007482
mov r8, r13
mov edx, 0x404
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
mov rcx, rsi
cmp byte [rdi + 0x1713], al
cmovne rcx, r12
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
mov eax, 2
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400074d2
mov r8, r12
mov ebx, 0xa02e
mov edx, ebx
mov rcx, rdi
call fcn.140004cac
mov eax, ebx
jmp 0x140007afa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, r15
xor ecx, ecx
cmp byte [rdi + 0x1713], cl
cmovne r9, r12
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.140008b28
xor r14d, r14d
test al, al
je 0x140007af5
cmp byte [rdi + 0x1713], r14b
je 0x140007513
xor eax, eax
jmp 0x140007afa
cmp byte [rdi + 0x1714], r14b
jne 0x140007551
lea rbx, [rdi + 0xaa8]
lea rdx, [rdi + 0x8a0]
mov rcx, rbx
call fcn.140017878
mov rcx, rbx
cmp dword [rdi + 0x898], r14d
lea rdx, str.AutoItSC_x64.bin
jne 0x14000754c
lea rdx, str.AutoItSC.bin
call fcn.14001784c
mov ebx, 1
cmp byte [rdi + 0x1714], r14b
je 0x140007587
lea rcx, [rdi + 0xaa8]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14000763a
mov r8, rsi
mov ebx, 0xa02f
jmp 0x1400074c1
lea rax, str.BIN64
lea r8, str.BIN32
cmp dword [rdi + 0x898], r14d
cmovne r8, rax
lea r9, [rsp + 0x40]
mov edx, 0xa
call fcn.140009bf4
test rax, rax
jne 0x1400075c8
lea rdx, str.Error:_Unable_to_extract_interpreter.
mov rcx, rdi
call fcn.140004bbc
jmp 0x140007af5
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov dword [rbp - 0x78], r14d
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
mov word [rbp - 0x58], r14w
mov word [rbp + 0x1b0], r14w
mov qword [rbp + 0x3d8], r14
mov qword [rbp - 0x74], rbx
mov qword [rsp + 0x78], rax
mov r8d, 0x104
mov rdx, rsi
lea rcx, [rbp + 0x1b0]
call fcn.1400174ac
mov word [rbp + 0x3b8], r14w
lea rcx, [rsp + 0x70]
call fcn.140001be0
test eax, eax
jne 0x140007aad
mov rcx, rsi
call fcn.1400116d8
cmp eax, 0xffffffff
je 0x140007aad
mov r8b, bl
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1400031e0
mov dword [rsp + 0x64], r14d
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14000766c
lea rcx, [rsp + 0x48]
call fcn.1400034d8
mov edx, eax
mov rax, qword [rsp + 0x58]
jmp 0x14000766f
mov edx, r14d
mov dword [rsp + 0x64], r14d
test rax, rax
je 0x140007687
lea rcx, [rsp + 0x48]
call fcn.14000346c
mov edx, eax
jmp 0x14000768e
mov dword [rsp + 0x64], ebx
mov edx, r14d
mov eax, dword [rdi + 0x898]
neg eax
sbb ecx, ecx
and ecx, 0x12ee0
add ecx, 0xe242e
cmp edx, ecx
cmovne ebx, r14d
lea rcx, [rsp + 0x48]
call fcn.1400032ec
test bl, bl
jne 0x1400076c4
lea rdx, str.Error:_Binary_integrity_cant_be_verified.
jmp 0x1400075bb
cmp byte [rdi + 0x1710], r14b
je 0x1400076e6
lea r9, str.Updating_resources...
xor r8d, r8d
mov edx, 0x40b
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.USER32.dll_SendMessageW]
lea r14, [rdi + 0x1818]
mov rcx, qword [r14]
xor ebx, ebx
test rcx, rcx
je 0x140007703
lea edx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov qword [r14], rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov qword [r14], rax
mov rcx, rdi
test rax, rax
jne 0x14000772b
mov edx, 0xa041
mov r8, rsi
call fcn.140004cac
jmp 0x140007af5
mov ebx, 1
mov word [rdi + 0x184a], bx
mov rdx, r15
call fcn.140009a04
xor r15d, r15d
mov rcx, rdi
test al, al
je 0x140007719
call fcn.140009138
mov rcx, rdi
call fcn.140009ae0
test al, al
je 0x1400078f1
cmp byte [rdi + 0x1814], bl
je 0x140007773
cmp byte [rdi + 0x1718], r15b
jne 0x1400077f9
lea r9, [rsp + 0x40]
mov ebx, 4
mov r8d, 0xa6
mov edx, ebx
call fcn.140009bf4
test rax, rax
je 0x1400077b7
mov ecx, 0x809
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], 0xa6
mov r9d, ebx
mov r8d, dword [rsp + 0x40]
mov rdx, rax
mov rcx, r14
call fcn.14000c318
jmp 0x1400077ba
mov al, r15b
test al, al
mov eax, 2
cmove r15d, eax
mov edx, 0xa4
mov rcx, rdi
call fcn.140009c84
mov bl, al
mov edx, 0xa2
mov rcx, rdi
call fcn.140009c84
test al, bl
jne 0x1400077e9
or r15d, 4
test r15d, r15d
jne 0x1400078f1
xor r15d, r15d
lea ebx, [r15 + 1]
mov edx, 0xa9
mov rcx, rdi
call fcn.140009c84
test al, al
je 0x1400078f1
mov edx, 0x63
mov rcx, rdi
call fcn.140009c84
test al, al
je 0x1400078f1
cmp byte [rdi + 0x1814], bl
je 0x140007834
cmp byte [rdi + 0x1808], r15b
je 0x140007887
lea r9, [rsp + 0x40]
mov edx, 5
mov r8d, 0x3e8
call fcn.140009bf4
test rax, rax
je 0x140007879
mov ecx, 0x809
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], 0x3e8
mov r9d, 5
mov r8d, dword [rsp + 0x40]
mov rdx, rax
mov rcx, r14
call fcn.14000c318
jmp 0x14000787c
mov al, r15b
test al, al
je 0x1400078f1
mov byte [rdi + 0x1808], r15b
mov rcx, rdi
call fcn.1400093dc
mov rdx, qword [rdi + 0x1840]
test rdx, rdx
je 0x1400078c2
movzx r8d, word [rdi + 0x1848]
mov eax, 0x809
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], rbx
mov r9d, 0x10
mov rcx, r14
call fcn.14000c318
jmp 0x1400078c4
mov al, bl
test al, al
je 0x1400078f1
mov rcx, qword [r14]
test rcx, rcx
je 0x1400078db
xor edx, edx
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov qword [r14], r15
cmp word [r13], r15w
je 0x1400078f9
mov r8, rsi
mov rdx, r13
call fcn.14000b7ec
test al, al
jne 0x1400078f9
mov rcx, rdi
jmp 0x140007719
cmp byte [rdi + 0x1710], r15b
je 0x14000791b
lea r9, str.Updating_.exe_headers...
xor r8d, r8d
mov edx, 0x40b
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1400031e0
mov r8b, byte [rsp + 0x61]
test r8b, r8b
jne 0x140007944
lea rcx, [rsp + 0x48]
call fcn.140003368
mov r8b, byte [rsp + 0x61]
mov r10d, 0x4550
mov r11d, 0x14c
mov r14d, 0x8664
mov r9d, 0x5a4d
mov rax, qword [rsp + 0x58]
cmp dword [rdi + 0x89c], r15d
je 0x1400079b8
test r8b, r8b
jne 0x1400079bd
test rax, rax
je 0x140007a17
cmp word [rax], r9w
jne 0x1400079c7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], r10d
jne 0x1400079c7
cmp word [rcx + 4], r11w
jne 0x1400079a2
mov edx, 3
cmp word [rcx + 0x5c], dx
je 0x1400079c7
mov word [rcx + 0x5c], dx
jmp 0x1400079c7
cmp word [rcx + 4], r14w
jne 0x1400079c7
mov edx, 3
cmp word [rcx + 0x5c], dx
je 0x1400079c7
mov word [rcx + 0x5c], dx
test r8b, r8b
je 0x1400079c7
mov dword [rsp + 0x64], 8
jmp 0x140007a1b
test rax, rax
je 0x140007a17
cmp word [rax], r9w
jne 0x140007a0d
movsxd rbx, dword [rax + 0x3c]
add rbx, rax
cmp dword [rbx], r10d
jne 0x140007a03
cmp word [rbx + 4], r11w
je 0x1400079ec
cmp word [rbx + 4], r14w
jne 0x140007a03
mov dword [rsp + 0x64], r15d
mov edx, dword [rbx + 0x58]
lea rcx, [rsp + 0x48]
call fcn.14000346c
mov dword [rbx + 0x58], eax
jmp 0x140007a1b
mov dword [rsp + 0x64], 7
jmp 0x140007a1b
mov dword [rsp + 0x64], 6
jmp 0x140007a1b
mov dword [rsp + 0x64], ebx
lea rcx, [rsp + 0x48]
call fcn.1400032ec
cmp dword [rdi + 0x894], r15d
je 0x140007a6c
cmp dword [rdi + 0x898], r15d
jne 0x140007a6c
cmp byte [rdi + 0x1710], r15b
je 0x140007a59
lea r9, str.Compressing_stub_executable_with_upx.exe...
xor r8d, r8d
mov edx, 0x40b
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rsi
mov rcx, rdi
call fcn.140009f74
test eax, eax
jne 0x140007afa
cmp byte [rdi + 0x1710], r15b
je 0x140007a8e
lea r9, str.Writing_destination_.exe...
xor r8d, r8d
mov edx, 0x40b
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14000750c
mov r8, r12
jmp 0x14000757d
lea rdx, str.Error:_Unable_to_create_temporary_executable:_n_n
lea rcx, [rsp + 0x48]
call fcn.14000454c
nop
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14000a610
lea rdx, str._n_nCheck_your_AV_definitions_are_up_to_date__or_create_an_exclusion_for_the_above_folder.
lea rcx, [rsp + 0x48]
call fcn.14000a610
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.140004bbc
nop
lea rcx, [rsp + 0x48]
call fcn.1400016b0
mov eax, 0xffff
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140015ef0
add rsp, 0x518
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret