Function at 0x140001c44
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Initialize winsock library
Query environment variable
Query or enumerate registry value
Set current directory
Terminate process

Disassembly:
sub rsp, 0x28
call 0x140001034
add rsp, 0x28
jmp 0x140001c44
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov rax, qword [0x140005050]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
call fcn.14000260c
test byte [0x140005600], 1
je 0x140001ca1
lea rax, [rbp + 0x190]
lea rdx, [0x140003940]
mov qword [rsp + 0x20], rax
call fcn.140002680
xor edx, edx
lea r8, str.WMPPERF_PROC_START
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
nop dword [rax + rax]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x140001ce1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
xor ecx, ecx
mov dword [rsp + 0x54], esi
mov r14d, esi
mov byte [rsp + 0x50], 1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov rcx, rax
lea rdx, str._SuppressDialogs
mov r15, rax
call fcn.140001be0
lea rdx, str._SafeModeOK
mov qword [rbp + 0x190], rax
mov rcx, r15
mov rdi, rax
call fcn.140001be0
mov ecx, 0x43
mov rbx, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
nop dword [rax + rax]
test eax, eax
je 0x140001dab
test rbx, rbx
jne 0x140001dab
test byte [0x140005600], 1
je 0x140001d75
lea rax, [rbp + 0x190]
lea rdx, [0x140003580]
mov qword [rsp + 0x20], rax
call fcn.140002680
call fcn.14000264c
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140001010
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000158c
test al, al
je 0x140001e40
mov qword [rsp + 0x60], rsi
test rdi, rdi
jne 0x140001d54
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], esi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x2900
mov r8d, 0xc0000002
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
nop dword [rax + rax]
test eax, eax
je 0x140001d54
lea rcx, str.comctl32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x60]
lea r9d, [rdi + 0x10]
lea r8, [0x1400037f8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
jmp 0x140001d54
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
nop dword [rax + rax]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140001d54
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x44], esi
mov dword [rbp - 0x80], 0x68
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop dword [rax + rax]
lea r8, str.LocalMicrosoft_WMP_70_CheckForOtherInstanceMutex
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x140001f1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xb7
jne 0x140001f33
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
xor edx, edx
lea rcx, str.WMPlayerApp
call qword [sym.imp.USER32.dll_FindWindowW]
nop dword [rax + rax]
test byte [rbp - 0x44], 1
je 0x140001efc
mov ebx, 1
cmp si, word [rbp - 0x40]
je 0x140001efe
mov ebx, esi
test rax, rax
je 0x140001f0f
test ebx, ebx
jne 0x140001f0f
mov rcx, rax
call fcn.1400013e8
mov edx, ebx
mov rcx, r15
call fcn.1400018d4
jmp 0x1400024c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 5
je 0x1400024c9
mov ecx, 1
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], esi
mov r12d, esi
mov dword [rsp + 0x58], esi
call qword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
nop dword [rax + rax]
lea rcx, str.Microsoft.Windows.MediaPlayer64
call qword [sym.imp.SHELL32.dll_SetCurrentProcessExplicitAppUserModelID]
nop dword [rax + rax]
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathswmplayer.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140002107
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.Path
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400020f1
mov eax, dword [rsp + 0x58]
dec eax
cmp eax, 1
ja 0x1400020f1
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400020f1
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Path
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400020dd
cmp dword [rsp + 0x58], 2
mov rcx, rbx
jne 0x1400020c2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x1400020d3
mov r8d, r14d
xor edx, edx
add r8, r8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x1400020d8
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x1400020a7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop dword [rax + rax]
mov r12d, eax
mov r8, rsi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov r14d, dword [rsp + 0x54]
jmp 0x1400020db
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop dword [rax + rax]
mov r12d, eax
jmp 0x1400020dd
mov r14d, esi
jmp 0x1400020dd
mov r14d, r12d
xor esi, esi
mov r8, rbx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x60], rsi
mov rcx, r15
call fcn.140001728
test al, al
je 0x140002258
test r12d, r12d
je 0x140002258
test r15, r15
je 0x140002214
lea rcx, str._RunOnce:
call fcn.140001a18
mov ecx, eax
lea r8, [rsp + 0x54]
mov edx, 1
call fcn.140001b98
test eax, eax
js 0x140002214
mov rcx, r15
call fcn.140001a18
mov ecx, dword [rsp + 0x54]
lea r8, [rsp + 0x54]
mov edx, eax
call fcn.140001b98
test eax, eax
js 0x140002214
mov ecx, dword [rsp + 0x54]
lea r8, [rsp + 0x70]
call fcn.140001bb8
test eax, eax
js 0x140002214
mov r8d, dword [rsp + 0x70]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140002214
mov r11d, dword [rsp + 0x54]
mov rcx, rax
mov edx, r11d
call fcn.140001b20
mov r8, r15
mov edx, r11d
mov rcx, rbx
call fcn.140001a5c
mov r9, rbx
mov dword [rsp + 0x28], 0xa
and qword [rsp + 0x20], 0
lea r8, str.setup_wm.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax + rax]
cmp rax, 0x20
jbe 0x1400021fb
mov sil, 1
mov byte [rsp + 0x50], 0
mov r8, rbx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test sil, sil
jne 0x140002256
xor esi, esi
mov dword [rsp + 0x28], 0xa
lea r9, str._RunOnce:
mov qword [rsp + 0x20], rsi
lea r8, str.setup_wm.exe
xor ecx, ecx
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax + rax]
cmp rax, 0x20
jbe 0x140002258
call fcn.140001638
jmp 0x1400024b5
xor esi, esi
call fcn.140001638
cmp byte [rsp + 0x50], sil
je 0x1400024b5
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x198
call sub.ntdll.dll_memset
lea rcx, str.wmp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400023f6
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
nop dword [rax + rax]
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov dword [rsp + 0x38], esi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
or edx, 0xffffffff
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
nop dword [rax + rax]
mov ecx, 0x202
lea rdx, [rbp - 0x10]
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop dword [rax + rax]
mov edx, 0xbb8
mov rcx, rbx
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, str.DllCanUnloadNow
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rsi, rax
test rdi, rdi
je 0x140002378
test rax, rax
je 0x1400023ad
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
nop dword [rax + rax]
test byte [rbp - 0x44], 1
movzx r8d, word [rbp - 0x40]
jne 0x14000234f
mov r8d, 0xa
movabs r10, 0xde459e6c7c5a5170
mov rcx, qword [rsp + 0x78]
mov rdx, r15
mov rax, rdi
call qword [0x140003390]
cmp eax, 0x80070005
mov r14d, eax
setne dil
jmp 0x140002383
xor r14d, r14d
xor dil, dil
test rsi, rsi
je 0x1400023ad
movabs r10, 0xd43837ae10dbc970
mov rax, rsi
call qword [0x140003390]
xor esi, esi
test eax, eax
jne 0x1400023c4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
jmp 0x1400023c4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
xor esi, esi
mov r14d, esi
mov dil, sil
test r12d, r12d
jne 0x1400023d5
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop dword [rax + rax]
call qword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
nop dword [rax + rax]
call qword [sym.imp.ole32.dll_OleUninitialize]
nop dword [rax + rax]
test dil, dil
jne 0x1400024b5
cmp qword [rbp + 0x190], rsi
jne 0x1400024b5
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], esi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x2900
mov qword [rsp + 0x70], rsi
mov r8d, 0xc0000001
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
nop dword [rax + rax]
test eax, eax
je 0x14000249f
lea rcx, str.comctl32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x70]
lea r8, [0x1400037f8]
mov r9d, 0x14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop dword [rax + rax]
cmp eax, 6
jne 0x14000249f
mov dword [rsp + 0x28], 0xa
lea r8, str.https:__go.microsoft.com_fwlink__LinkId9996
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400024b5
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test r13, r13
je 0x1400024c9
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test byte [0x140005600], 1
je 0x1400024de
lea rdx, [0x140003580]
call fcn.1400026e4
call fcn.14000264c
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_ExitProcess]