Function at 0x14000a210
Capabilities:
Check mutex on windows
Get system information on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xfa8]
mov eax, 0x1080
call fcn.14003cf80
sub rsp, rax
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0xf70], rax
xor r13d, r13d
mov r14, rcx
cmp dword [0x1400502e0], 3
mov ebx, r13d
jne 0x14000a5be
call fcn.1400179e0
test eax, eax
jne 0x14000a332
mov rcx, qword [0x140050310]
lea esi, [rax + 2]
cmp rcx, 0xffffffffffffffff
jne 0x14000a294
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a2be
cmp dword [0x1400516e0], esi
jl 0x14000a2be
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x27
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_user_is_not_an_admin._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x44a
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x14000a2dc
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
test r14, r14
je 0x14000a6e7
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r15d, 0x400
mov edx, 0x9d
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae5b
lea edx, [r15 - 0x18]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x125
jmp 0x14000a6ae
call fcn.14001733c
mov rcx, rax
movabs rax, 0x624dd2f1a9fbe77
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
and rcx, 0xfffffffffffffc00
cmp rcx, 0xc800
ja 0x14000a42c
mov rcx, qword [0x140050310]
mov esi, 2
cmp rcx, 0xffffffffffffffff
jne 0x14000a38e
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a3b8
cmp dword [0x1400516e0], esi
jl 0x14000a3b8
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x38
mov qword [rsp + 0x20], r13
lea rdx, str.Uninstall_denied:_User_does_not_have_enough_diskspace._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x44a
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x14000a3d6
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
test r14, r14
je 0x14000a6e7
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r15d, 0x400
mov edx, 0x99
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae5b
lea edx, [r15 - 0x18]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x14b
jmp 0x14000a6ae
cmp dword [0x140051658], r13d
lea rcx, [rsp + 0x38]
mov edx, r13d
mov qword [rsp + 0x38], r13
sete dl
xor r8d, r8d
call fcn.1400035c8
mov r12, qword [rsp + 0x38]
movsxd r13, eax
test r13d, r13d
jle 0x14000a5a8
mov rcx, qword [0x140050310]
mov esi, 2
cmp rcx, 0xffffffffffffffff
jne 0x14000a482
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a4ad
cmp dword [0x1400516e0], esi
jl 0x14000a4ad
xor esi, esi
lea r9, [rsp + 0x30]
lea rdx, str.UnInstall_denied:_Blocking_dependencies_found._r_n
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14000a4af
xor esi, esi
mov edi, 1
test r14, r14
je 0x14000a543
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r15d, 0x400
mov edx, 0x115
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000a545
lea edx, [r15 - 0x18]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [0x140051658], esi
lea r8, [rsp + 0x70]
mov rcx, qword [0x140050d10]
mov r9d, r15d
mov edx, 0x116
jne 0x14000a51d
mov edx, 0xbb
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x14000a545
mov edx, 0x3eb
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, edi
mov edx, 0x44a
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r14, r13
xor r13d, r13d
mov r15, rax
test rax, rax
je 0x14000a586
test r14, r14
jle 0x14000a5a8
mov esi, r13d
mov r9, qword [r12 + rsi*8]
xor r8d, r8d
mov edx, 0x180
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
add rsi, rdi
cmp rsi, r14
jl 0x14000a569
test r14, r14
jle 0x14000a5a8
mov rsi, r13
mov rcx, qword [r12 + rsi*8]
test rcx, rcx
je 0x14000a5a0
call fcn.14003c2b8
mov qword [r12 + rsi*8], r13
add rsi, rdi
cmp rsi, r14
jl 0x14000a58e
test r12, r12
je 0x14000ae5b
mov rcx, r12
call fcn.14003c2b8
jmp 0x14000ae5b
lea rax, section..data
cmp rax, qword [str.6ij]
jne 0x14000a6f1
cmp qword [0x140051660], r13
je 0x14000ae5b
call fcn.140013f90
test rax, rax
je 0x14000ae5b
call fcn.140013f90
mov rcx, rax
call fcn.140026c90
test eax, eax
jne 0x14000ae5b
call fcn.1400179e0
test eax, eax
jne 0x14000ae5b
mov rcx, qword [0x140050310]
lea esi, [rax + 2]
cmp rcx, 0xffffffffffffffff
jne 0x14000a633
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a65d
cmp dword [0x1400516e0], esi
jl 0x14000a65d
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x2f
mov qword [rsp + 0x20], r13
lea rdx, str.Service_Install_denied:_user_is_not_an_admin._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000a6e7
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r15d, 0x400
mov edx, 0x9d
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae5b
lea edx, [r15 - 0x18]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x159
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae5b
mov edx, 0x3eb
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 1
jmp 0x14000ae5b
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, 6
mov r15d, 0x400
lea edi, [rax - 5]
lea esi, [rax - 4]
cmp ax, word [rsp + 0x40]
jne 0x14000a7c4
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000a739
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a763
cmp dword [0x1400516e0], esi
jl 0x14000a763
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x2d
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_the_OS_Arch_does_not_match._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.1400264a0
neg eax
sbb r12d, r12d
neg r12d
test r14, r14
je 0x14000a895
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x138
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000a897
mov edx, 0x3e8
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea edx, [r12 + 0x139]
jmp 0x14000a860
call fcn.140002268
test eax, eax
je 0x14000a897
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000a7f2
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a81c
cmp dword [0x1400516e0], esi
jl 0x14000a81c
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x30
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_Loc_version_already_installed._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000a895
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x14e
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000a897
mov edx, 0x3e8
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x14f
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000a897
mov edx, 0x3eb
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, edi
call fcn.140009cc4
test eax, eax
jne 0x14000a994
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000a8c5
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a8ef
cmp dword [0x1400516e0], esi
jl 0x14000a8ef
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x3d
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_OS_version_is_greater_than_package_version._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ae59
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9b
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae5b
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x770]
mov r9d, 0x208
mov edx, 0x9c
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000a970
lea r8, [rbp + 0x770]
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.140002480
jmp 0x14000a973
mov eax, r13d
test eax, eax
je 0x14000ae5b
lea edx, [rbx + 0x3eb]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x70]
jmp 0x14000ae50
call fcn.140003d5c
test eax, eax
jne 0x14000aaad
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000a9c2
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000a9ec
cmp dword [0x1400516e0], esi
jl 0x14000a9ec
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x3b
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_a_newer_version_is_already_on_the_system._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ae59
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9b
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae5b
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x770]
mov r9d, 0x208
mov edx, 0x9c
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000aa6d
lea r8, [rbp + 0x770]
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.140002480
jmp 0x14000aa70
mov eax, r13d
test eax, eax
je 0x14000ae5b
lea edx, [rbx + 0x3eb]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea r8, [rsp + 0x70]
mov ecx, esi
lea rdx, str._S._r_n
call fcn.140016868
jmp 0x14000ae59
lea rdx, [rsp + 0x30]
mov word [rsp + 0x30], r13w
lea rcx, [0x140043308]
call fcn.14001a994
test eax, eax
je 0x14000ab9d
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x409
cmp cx, word [rsp + 0x30]
je 0x14000ab9d
cmp cx, ax
jne 0x14000ab9d
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000ab0c
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000ab36
cmp dword [0x1400516e0], esi
jl 0x14000ab36
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, 0x58
mov qword [rsp + 0x20], r13
lea rdx, str.Install_denied:_this_is_a_MUI_system_for_which_a_localized_package_should_not_be_used._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ae59
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9f
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae5b
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0xa0
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
call qword [sym.imp.USER32.dll_LoadStringW]
jmp 0x14000a973
lea r8, str.GlobalServicePackOrHotfix
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
cmove r13d, edi
test r12, r12
je 0x14000abd7
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
test r13d, r13d
je 0x14000ac80
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000ac04
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000ac2e
cmp dword [0x1400516e0], esi
jl 0x14000ac2e
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r12d
mov r8d, 0x34
mov qword [rsp + 0x20], r12
lea rdx, str.Another_Update.exe_package_is_running_on_the_box.__r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ae59
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x143
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae5b
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x142
jmp 0x14000ab83
call fcn.1400179e0
test eax, eax
jne 0x14000ad52
cmp qword [0x140050310], 0xffffffffffffffff
jne 0x14000ac9e
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000acd5
cmp dword [0x1400516e0], esi
jl 0x14000acd5
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r12d
mov r8d, 0x27
mov qword [rsp + 0x20], r12
lea rdx, str.Install_denied:_user_is_not_an_admin._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ad50
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ad52
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9e
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ad52
lea edx, [rbx + 0x3eb]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
add ebx, edi
movsd xmm0, qword [0x140050cd0]
comisd xmm0, xmmword [0x140049d48]
jbe 0x14000ae5b
cmp qword [0x140050310], 0xffffffffffffffff
jne 0x14000ad79
mov edx, esi
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000adb0
cmp dword [0x1400516e0], esi
jl 0x14000adb0
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], r12d
mov r8d, 0x3b
mov qword [rsp + 0x20], r12
lea rdx, str.Install_denied:_user_does_not_have_sufficient_disk_space._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14000ae59
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x99
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae5b
lea edx, [rbx + 0x3e8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x70]
mov r9d, r15d
mov edx, 0x9a
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14000ae5b
cvttsd2si r9, qword [0x140050cd0]
lea r8, [rsp + 0x70]
mov rdx, r15
lea rcx, [rbp + 0x770]
add r9d, edi
call fcn.140001734
test eax, eax
js 0x14000ae5b
lea edx, [rbx + 0x3eb]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rbp + 0x770]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
add ebx, edi
mov eax, ebx
mov rcx, qword [rbp + 0xf70]
xor rcx, rsp
call fcn.14003c6c0
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret