Function at 0x140001170
Capabilities:
Create process on windows
Set current directory

Disassembly:
push rbx
mov eax, 0x1350
call fcn.14000ca90
sub rsp, rax
mov dword [0x140020e10], 0
mov dword [0x140020e80], 0
lea rdx, [0x140018f88]
lea rcx, [0x140018f8c]
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, [0x140018f88]
lea rcx, str.TOTALEXTFILE
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, [0x140018f88]
lea rcx, str.NEEDREBOOT
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, [0x140018f88]
lea rcx, str.SILENT
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, [0x140018f24]
lea rcx, str.ARCFILEVER
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, [0x140018f24]
lea rcx, str.ARCPRODVER
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, str.USERPROFILE
lea rcx, str.USERPROFILE
call fcn.1400140f0
mov rdx, qword [str.English]
lea rcx, str.SELLANG
call qword [sym.imp.pbcore64.dll_SetVar]
movzx ecx, word [0x14001b010]
mov r8d, 0xa
lea rdx, [rsp + 0x130a]
call fcn.14000cb30
lea rdx, [rsp + 0x130a]
lea rcx, str.PBLANGID
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, [0x140018ec0]
lea rcx, str.DESTPATH
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, [0x140018ea8]
lea rcx, [0x140018eac]
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, [0x140018ea8]
lea rcx, str.PBDLGWIZLOOK
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, str.Paquet_Builder
lea rcx, str.PBWIZLABEL
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, str.Next
lea rcx, str.PBDLGNEXTC
call qword [sym.imp.pbcore64.dll_SetVar]
mov dword [0x140020e00], 0
mov byte [0x140020e70], 0
lea rdx, str._USERPROFILE_
lea rcx, str.DESTPATH
call qword [sym.imp.pbcore64.dll_SetVar]
lea rax, [0x140018ec0]
mov qword [rsp + 0x28], rax
mov al, 1
mov qword [rsp + 0x20], rax
mov r9b, 1
lea r8, [0x140018ec0]
lea rdx, [0x140018ec0]
lea rcx, str._DESTPATH_exclude.bat
call qword [sym.imp.pbcore64.dll_ExecuteProgram]
lea rcx, str._SILENT_
call qword [sym.imp.pbcore64.dll_EvalVar]
mov rcx, rax
lea rdx, [0x140018dd6]
call fcn.14000c9d0
mov bl, 1
lea rdx, str.Extracting
lea rcx, str.PBEXTTEXT
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, [0x140018ea8]
lea rcx, str.PBEXTHC
call qword [sym.imp.pbcore64.dll_SetVar]
lea rdx, str._WizProgressTitle__n_n_WizProgressDesc
lea rcx, str.PBWIZTEXT
call qword [sym.imp.pbcore64.dll_SetVar]
mov r8d, 0x61c
lea rdx, [rsp + 0xcac]
lea rcx, str._DESTPATH_
call qword [sym.imp.pbcore64.dll_EvalVarBuf]
mov eax, dword [0x140020e40]
add eax, 0x12
mov dword [rsp + 0x134c], eax
lea rax, [0x1400010d0]
mov qword [rsp + 0x28], rax
lea rax, section..text
mov qword [rsp + 0x20], rax
mov r9b, bl
lea r8, [rsp + 0x134c]
lea rdx, [rsp + 0xcac]
lea rcx, [0x1400214d0]
call fcn.140002030
mov ebx, eax
mov ecx, dword [0x140020e10]
mov r8d, 0xa
lea rdx, [rsp + 0x12c8]
call fcn.14000cb30
lea rdx, [rsp + 0x12c8]
lea rcx, str.TOTALEXTFILE
call qword [sym.imp.pbcore64.dll_SetVar]
cmp byte [0x140020be0], 0
jne 0x140001544
test ebx, ebx
je 0x14000146a
mov r8d, 0xa
lea rdx, [rsp + 0x32]
mov ecx, ebx
call fcn.14000cb30
lea rdx, [rsp + 0x32]
lea rcx, str.PBEXTERR
call qword [sym.imp.pbcore64.dll_SetVar]
lea rcx, str.ErrorUnpacking__PBEXTERR_
call qword [sym.imp.pbcore64.dll_EvalVar]
mov rdx, rax
mov r9d, InitCommonControls
lea r8, [0x140020bf0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x140001549
mov dword [0x140020e00], 0
lea rax, [0x140018ec0]
mov qword [rsp + 0x28], rax
xor al, al
mov qword [rsp + 0x20], rax
xor r9b, r9b
lea r8, [0x140018ec0]
lea rdx, [0x140018ec0]
lea rcx, str._DESTPATH_csrss.exe
call qword [sym.imp.pbcore64.dll_ExecuteProgram]
mov r8d, 0x61c
lea rdx, [rsp + 0x690]
lea rcx, str._DESTPATH__
call qword [sym.imp.pbcore64.dll_EvalVarBuf]
lea rcx, [rsp + 0x690]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8d, 0x61c
lea rdx, [rsp + 0x74]
lea rcx, str._DESTPATH_exclude.bat
call qword [sym.imp.pbcore64.dll_EvalVarBuf]
mov r8d, 0x61c
lea rdx, [rsp + 0xcac]
lea rcx, [0x140018ec0]
call qword [sym.imp.pbcore64.dll_EvalVarBuf]
xor eax, eax
mov dword [rsp + 0x28], eax
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xcac]
lea r8, [rsp + 0x74]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, str._EXITCODE_
call qword [sym.imp.pbcore64.dll_EvalVar]
mov rcx, rax
mov r8d, 0xa
xor edx, edx
call fcn.14000cc20
jmp 0x140001549
mov eax, 2
add rsp, 0x1350
pop rbx
ret