Function at 0x1400077a8
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Get file attributes
Log keystrokes via polling
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x340
lea rcx, [0x140005c1c]
call qword [sym.imp.msvcrt.dll_int____cdecl___unsigned_long_long_unsigned___int64_____cdecl__set_new_handler_int____cdecl___unsigned_long_long_unsigned___int64___]
call fcn.1400020c8
lea rcx, [rsp + 0x220]
mov dword [rsp + 0x220], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edi, edi
cmp eax, edi
je 0x140009931
cmp dword [rsp + 0x230], 2
jne 0x140009931
cmp dword [rsp + 0x224], 5
jb 0x140009931
or dword [rsp + 0x128], 0xffffffff
or dword [rsp + 0x110], 0xffffffff
lea rax, [0x140021d14]
lea ebx, [rdi + 3]
lea rcx, [rsp + 0x118]
mov r13b, dil
mov edx, ebx
mov byte [str.___InstallEnd__], 0x3b
mov byte [str.___Install__UTF_8_], 0x3b
mov qword [rsp + 0x130], rax
mov byte [rsp + 0x30], dil
mov dword [rsp + 0x38], r13d
mov byte [rsp + 0x32], dil
mov r15b, dil
mov qword [rsp + 0x118], rdi
mov dword [rsp + 0x120], edi
mov dword [rsp + 0x124], edi
call fcn.140001140
lea rcx, [rsp + 0x140]
mov edx, ebx
mov qword [rsp + 0x140], rdi
mov dword [rsp + 0x148], edi
mov dword [rsp + 0x14c], edi
call fcn.140001140
lea rax, [0x1400219e0]
lea ebx, [rdi + 1]
lea rcx, [rsp + 0x100]
mov edx, ebx
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0xb4], edi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], 8
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x100], rdi
mov dword [rsp + 0x108], edi
mov dword [rsp + 0x10c], edi
call fcn.140001140
mov rax, qword [rsp + 0x100]
lea ebp, [rdi + 0x20]
mov word [rax], bp
mov rax, qword [rsp + 0x100]
mov word [rax + 2], di
mov dword [rsp + 0x108], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x118]
mov rcx, rax
call fcn.140006598
lea rcx, [rsp + 0x100]
mov rdx, rax
call fcn.140002d44
lea rcx, [rsp + 0x100]
call fcn.140003754
mov r14, qword [rsp + 0x100]
lea rdx, str.sfxlang
add r14, 2
mov rcx, r14
call fcn.140005b60
cmp rax, rdi
je 0x1400079bf
cmp word [rax], 0x3a
jne 0x1400079bf
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll__wtol]
movzx edx, word [0x140026be4]
lea ecx, [rax - 1]
cmp ecx, 0xfffe
cmovbe dx, ax
mov word [0x140026be4], dx
jmp 0x1400079a5
add r14, 2
cmp word [r14], bp
ja 0x1400079a1
jmp 0x1400079b6
cmp ax, bp
ja 0x1400079bf
add r14, 2
movzx eax, word [r14]
cmp ax, di
jne 0x1400079ad
call fcn.1400062e8
lea rdx, str.sfxversion
mov rcx, r14
call fcn.140005b60
cmp rax, rdi
je 0x1400079e2
call fcn.140006ae0
jmp 0x14000964b
lea rdx, str.sfxwaitall
mov rcx, r14
call fcn.140005b60
cmp rax, rdi
je 0x140007a05
mov rcx, rax
call fcn.14000713c
mov edi, eax
jmp 0x14000964b
lea rdx, str.sfxelevation
mov rcx, r14
mov r12b, dil
call fcn.140005b60
cmp rax, rdi
je 0x140007a35
mov r12b, bl
jmp 0x140007a2a
cmp cx, bp
ja 0x140007a32
add rax, 2
movzx ecx, word [rax]
cmp cx, di
jne 0x140007a21
mov r14, rax
mov ebx, 0x208
lea rsi, [0x140026cc8]
cmp dword [0x140026cd4], ebx
jg 0x140007a53
mov edx, ebx
mov rcx, rsi
call fcn.140001140
mov rdx, qword [0x140026cc8]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, edi
jne 0x140007a7f
mov edx, 6
lea ebx, [rdx - 5]
mov ecx, ebx
call fcn.14000c770
mov edi, ebx
jmp 0x14000964b
mov rdx, qword [0x140026cc8]
mov ecx, edi
cmp word [rdx], di
je 0x140007a9c
mov rax, rdx
add rax, 2
add ecx, 1
cmp word [rax], di
jne 0x140007a90
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140026cd0], ecx
lea rdx, str.sfxtest
mov rcx, r14
call fcn.140005b60
cmp rax, rdi
mov rbx, rax
je 0x140007ccd
cmp word [rax], 0x3a
je 0x140007ad4
mov edi, 0x64
jmp 0x14000964b
movzx edx, word [rax + 2]
mov ecx, edx
or ecx, ebp
sub ecx, 0x61
je 0x140007bf9
sub ecx, 2
je 0x140007be1
mov r14d, 1
sub ecx, r14d
je 0x140007b5f
sub ecx, 0xb
je 0x140007b0d
cmp ecx, 7
jne 0x140007aca
mov edi, 0x4828
jmp 0x14000964b
cmp word [rax + 4], 0x3a
jne 0x14000964b
movzx ecx, word [rax + 6]
sub ecx, 0x31
je 0x140007b57
sub ecx, r14d
je 0x140007b4d
sub ecx, r14d
je 0x140007b43
sub ecx, r14d
je 0x140007b4d
cmp ecx, r14d
jne 0x14000964b
mov edi, 7
jmp 0x14000964b
mov edi, 0x1f
jmp 0x14000964b
mov edi, 0x7f
jmp 0x14000964b
mov edi, r14d
jmp 0x14000964b
cmp edx, 0x44
jne 0x140007ba3
cmp word [rax + 4], 0x3a
jne 0x140007aca
add rbx, 6
jmp 0x140007b8e
cmp ax, 0x3a
je 0x140007b96
lea rcx, [0x140026d28]
movzx edx, ax
call fcn.1400014f8
add rbx, 2
movzx eax, word [rbx]
cmp ax, bp
ja 0x140007b75
cmp dword [0x140026d30], edi
jne 0x140007ba7
jmp 0x140007aca
add rbx, 4
mov dword [0x140026d20], edi
cmp word [rbx], 0x3a
jne 0x140007bce
lea rcx, [rbx + 2]
call qword [sym.imp.msvcrt.dll__wtol]
cmp eax, 0xe10
mov dword [0x140026d20], eax
ja 0x140007bce
cmp eax, edi
jne 0x140007bd8
mov dword [0x140026d20], 0xa
mov dword [0x140026d24], r14d
jmp 0x140007c09
movzx eax, word [rax + 4]
sub ax, 0x63
neg ax
sbb eax, eax
add eax, 4
mov dword [0x140026d24], eax
jmp 0x140007c09
mov dword [0x140026d24], 2
jmp 0x140007c09
add rbx, 2
cmp word [rbx], bp
ja 0x140007c05
jmp 0x140007c19
cmp ax, bp
ja 0x140007c21
add rbx, 2
movzx eax, word [rbx]
cmp ax, di
jne 0x140007c10
lea rdx, str.sfxconfig
mov rcx, rbx
mov r14, rbx
call fcn.140005b60
cmp rax, rdi
mov rcx, rax
je 0x140007ccd
cmp word [rax], 0x3a
jne 0x140007c50
jmp 0x140007c4c
cmp ax, bp
ja 0x140007c58
add rcx, 2
movzx eax, word [rcx]
cmp ax, di
jne 0x140007c47
mov rax, qword [rsp + 0x118]
lea rdx, [rsp + 0x118]
mov dword [rsp + 0x120], edi
mov word [rax], di
call fcn.140006598
cmp dword [0x140026d24], 2
mov r14, rax
je 0x140007ccd
mov rcx, qword [0x140026cc8]
mov ebx, dword [rsp + 0x120]
mov dword [0x140026cd0], edi
mov word [rcx], di
mov rcx, rsi
mov edx, ebx
call fcn.140001140
mov r11, qword [rsp + 0x118]
mov rcx, qword [0x140026cc8]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140007cb3
mov dword [0x140026cd0], ebx
lea rcx, [0x140026c78]
cmp rsi, rcx
je 0x140007d22
mov rax, qword [0x140026c78]
mov dword [0x140026c80], edi
mov word [rax], di
mov edx, dword [0x140026cd0]
call fcn.140001140
mov r11, qword [0x140026cc8]
mov rcx, qword [0x140026c78]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140007d02
mov eax, dword [0x140026cd0]
mov dword [0x140026c80], eax
lea rsi, [0x140026c88]
lea rbx, [0x140026cc8]
cmp rbx, rsi
je 0x140007d81
mov rax, qword [0x140026c88]
mov dword [0x140026c90], edi
mov rcx, rsi
mov word [rax], di
mov edx, dword [0x140026cd0]
call fcn.140001140
mov r11, qword [0x140026cc8]
mov rcx, qword [0x140026c88]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140007d61
mov eax, dword [0x140026cd0]
mov dword [0x140026c90], eax
mov rcx, rbx
call fcn.140003c64
cmp eax, edi
jl 0x140007ea1
mov rcx, qword [0x140026c78]
movsxd rbx, eax
mov word [rcx + rbx*2], di
mov dword [0x140026c80], eax
mov rax, qword [0x140026cc8]
lea rdx, [rax + rbx*2 + 2]
mov rcx, rsi
call fcn.140001384
mov r11, qword [0x140026cc8]
lea rsi, [0x140026ca8]
lea rdx, [r11 + rbx*2 + 2]
mov rcx, rsi
call fcn.140001384
movsxd r11, dword [0x140026cb0]
cmp r11d, edi
je 0x140007e18
mov rdx, qword [0x140026ca8]
lea rcx, [rdx + r11*2 - 2]
jmp 0x140007dfb
cmp rcx, rdx
je 0x140007ee4
sub rcx, 2
cmp word [rcx], 0x2e
jne 0x140007dee
sub rcx, rdx
sar rcx, 1
cmp ecx, edi
jle 0x140007e18
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140026cb0], ecx
lea rbx, [0x140026c98]
cmp rsi, rbx
je 0x140007e70
mov rax, qword [0x140026c98]
mov dword [0x140026ca0], edi
mov rcx, rbx
mov word [rax], di
mov edx, dword [0x140026cb0]
call fcn.140001140
mov r11, qword [0x140026ca8]
mov rcx, qword [0x140026c98]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140007e50
mov eax, dword [0x140026cb0]
mov dword [0x140026ca0], eax
mov ecx, 4
call fcn.140002750
mov rcx, rbx
mov rdx, rax
call fcn.140002d44
mov r11, qword [0x140026ca8]
mov rax, qword [0x140026c98]
mov qword [0x140026c28], r11
mov qword [0x140026c38], rax
call fcn.1400029c8
lea rcx, [0x140026cb8]
mov rdx, rax
call fcn.140001384
mov rcx, rbp
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
mov rbx, rax
je 0x140007eec
mov dword [rax + 0x10], edi
lea rax, [0x140021cb0]
mov qword [rbx], rax
lea rax, [0x140021c90]
mov qword [rbx + 8], rax
or qword [rbx + 0x18], 0xffffffffffffffff
jmp 0x140007eef
or ecx, 0xffffffff
jmp 0x140007e07
mov rbx, rdi
cmp rbx, rdi
je 0x140007efd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
mov rdx, qword [0x140026cc8]
lea rcx, [rbx + 0x18]
call fcn.140014980
cmp al, dil
jne 0x140007f3e
mov r8, qword [0x140026cc8]
mov edx, 7
lea ecx, [rdx - 6]
call fcn.14000c770
cmp rbx, rdi
je 0x140007f34
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 2
jmp 0x14000964b
mov esi, 3
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov edx, esi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x6c], edi
call fcn.140002b20
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140005024
cmp al, dil
jne 0x140007f97
lea edx, [rsi + 6]
xor ecx, ecx
call fcn.14000c770
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140007f90
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, esi
jmp 0x14000964b
cmp dword [0x140026d24], edi
jne 0x140008044
lea rdx, str.sfxconfig
mov rcx, r14
call fcn.140005b60
cmp rax, rdi
je 0x140008044
cmp word [rax], 0x3a
jne 0x140007fc5
add rax, 2
movzx ecx, word [rax]
cmp cx, di
je 0x140008023
cmp cx, bp
ja 0x140007fde
add rax, 2
mov cx, word [rax]
cmp cx, di
jne 0x140007fcd
cmp word [rax], di
je 0x140008023
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400073e4
cmp al, dil
jne 0x140008023
mov edx, 0xa
xor ecx, ecx
call fcn.14000c770
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008019
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 4
jmp 0x14000964b
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000964b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x14000964b
lea rcx, [rsp + 0xa8]
call fcn.140014e78
cmp dword [rsp + 0x68], edi
je 0x140008071
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x60]
xor r8d, r8d
call fcn.140004138
cmp al, dil
je 0x140008001
cmp dword [0x140026d24], 4
je 0x140008023
cmp dword [0x140026060], edi
lea rsi, [0x140026060]
je 0x140008195
mov r8d, dword [rsi]
lea rdx, str.7zSfxString_d
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0xe0]
mov edx, 3
mov qword [rsp + 0xe0], rdi
mov dword [rsp + 0xe8], edi
mov dword [rsp + 0xec], edi
call fcn.140001140
lea rcx, [rsp + 0xf0]
mov edx, 3
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xfc], edi
call fcn.140001140
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0xe0]
call fcn.140001384
mov ecx, dword [rsi]
call fcn.140002750
lea rcx, [rsp + 0xf0]
mov rdx, rax
call fcn.140001384
mov rcx, rbp
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
je 0x140008143
lea rdx, [rsp + 0xe0]
mov rcx, rax
call fcn.140002fb8
mov rbp, rax
jmp 0x140008146
mov rbp, rdi
lea rcx, [0x140026670]
call fcn.140014e88
movsxd r11, dword [0x14002667c]
mov rax, qword [0x140026680]
mov rcx, qword [rsp + 0xf0]
mov qword [rax + r11*8], rbp
add dword [0x14002667c], 1
mov ebp, 0x20
add rsi, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xe0]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp dword [rsi], edi
jne 0x14000808d
lea rcx, [rsp + 0xa8]
call fcn.140006628
sub r14, 2
jmp 0x1400081ac
add r14, 2
cmp word [r14], bp
ja 0x1400081a8
jmp 0x1400081bd
cmp ax, bp
ja 0x1400081c6
add r14, 2
movzx eax, word [r14]
cmp ax, di
jne 0x1400081b4
cmp word [r14], 0x2f
je 0x1400081d8
cmp word [r14], 0x2d
jne 0x140008470
cmp word [r14 + 2], 0x21
je 0x14000846c
lea rdx, [0x140021f78]
lea rcx, [r14 + 2]
call fcn.140005928
cmp rax, rdi
je 0x140008253
lea rax, [r14 + 6]
cmp word [rax], 0x30
jb 0x140008209
cmp word [rax], 0x39
jbe 0x140008221
cmp word [rax], 0x61
jb 0x140008215
cmp word [rax], 0x7a
jbe 0x140008221
cmp word [rax], 0x41
jb 0x140008241
cmp word [rax], 0x5a
ja 0x140008241
mov ecx, 1
mov qword [rsp + 0x130], rax
mov r13b, cl
mov al, cl
mov byte [rsp + 0x30], cl
mov dword [rsp + 0x38], r13d
jmp 0x1400081ac
cmp word [rax], bp
ja 0x140008470
lea rax, [0x140021d14]
jmp 0x140008221
lea rdx, [0x140021f70]
lea rcx, [r14 + 2]
call fcn.140005928
cmp rax, rdi
je 0x140008278
lea rdx, [r14 + 6]
lea rcx, str.OverwriteMode
jmp 0x1400083ce
lea rdx, [0x140021f68]
lea rcx, [r14 + 2]
call fcn.140005928
cmp rax, rdi
je 0x1400082bc
lea rdx, [r14 + 6]
cmp word [rdx], 0x30
jb 0x140008470
cmp word [rdx], 0x32
ja 0x140008470
cmp word [r14 + 8], bp
ja 0x140008470
lea rcx, str.GUIMode
jmp 0x1400083ce
lea rdx, [0x140021f60]
lea rcx, [r14 + 2]
call fcn.140005928
cmp rax, rdi
je 0x1400082e1
lea rdx, [r14 + 6]
lea rcx, str.GUIFlags
jmp 0x1400083ce
lea rdx, [0x140021f58]
lea rcx, [r14 + 2]
call fcn.140005928
cmp rax, rdi
je 0x140008306
lea rdx, [r14 + 6]
lea rcx, str.MiscFlags
jmp 0x1400083ce
lea rdx, [0x140021f50]
lea rcx, [r14 + 2]
call fcn.140005928
cmp rax, rdi
je 0x140008346
lea rdx, [r14 + 6]
cmp word [rdx], 0x30
je 0x14000832f
cmp word [rdx], 0x31
jne 0x140008470
cmp word [r14 + 8], bp
ja 0x140008470
lea rcx, str.SelfDelete
jmp 0x1400083ce
lea rdx, [0x140021f48]
lea rcx, [r14 + 2]
call fcn.140005928
cmp rax, rdi
je 0x140008370
cmp word [r14 + 6], bp
ja 0x140008470
mov byte [rsp + 0x32], 1
jmp 0x1400081ac
lea rdx, [0x140021f40]
lea rcx, [r14 + 2]
call fcn.140005928
cmp rax, rdi
je 0x1400083ae
lea rcx, [r14 + 6]
cmp word [rcx], 0x30
jb 0x140008470
cmp word [rcx], 0x39
ja 0x140008470
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140026614], eax
jmp 0x1400081ac
lea rdx, [0x140021f38]
lea rcx, [r14 + 2]
call fcn.140005928
cmp rax, rdi
je 0x1400083e0
lea rdx, [r14 + 8]
lea rcx, str.BeginPromptTimeout
lea r8, [rsp + 0xa8]
call fcn.140006918
jmp 0x1400081ac
cmp word [r14 + 2], 0x79
je 0x1400083f0
cmp word [r14 + 2], 0x59
jne 0x140008402
cmp word [r14 + 4], bp
ja 0x140008402
mov al, 1
mov byte [rsp + 0x30], al
jmp 0x1400081ac
cmp word [r14 + 2], 0x3f
je 0x14000841a
cmp word [r14 + 2], 0x68
je 0x14000841a
cmp word [r14 + 2], 0x48
jne 0x140008429
cmp word [r14 + 4], bp
ja 0x140008429
mov r15b, 1
jmp 0x1400081ac
lea rdx, [rsp + 0xa8]
lea rcx, [r14 + 2]
call fcn.140005ea0
cmp rax, rdi
je 0x140008470
cmp rax, 1
je 0x14000844d
mov r14, rax
jmp 0x1400081ac
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008465
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, ebp
jmp 0x14000964b
add r14, 4
lea rcx, [rsp + 0xa8]
call fcn.140006628
cmp r12b, dil
jne 0x140008692
test byte [0x140026c44], 4
je 0x140008692
call fcn.140002a00
cmp eax, edi
jne 0x140008692
mov esi, 3
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov edx, esi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x4c], edi
call fcn.140001140
lea rcx, [rsp + 0x90]
mov edx, esi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x98], edi
mov dword [rsp + 0x9c], edi
call fcn.140001140
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140006598
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140002cd8
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x130]
mov dx, 0x22
call fcn.1400061ac
lea r8, [0x140021da0]
lea rcx, [rsp + 0x150]
mov rdx, rax
call fcn.140006210
lea r8, str.sfxelevation
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.140006210
lea rcx, [rsp + 0x70]
movzx r8d, bp
mov rdx, rax
call fcn.14000627c
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xc8]
mov rdx, rax
call fcn.140001584
mov rsi, rax
lea rax, [rsp + 0x90]
cmp rsi, rax
je 0x1400085c6
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x98], edi
mov word [rcx], di
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x90]
call fcn.140001140
mov r11, qword [rsi]
mov rsi, qword [rsp + 0x90]
mov rcx, rsi
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x1400085b0
jmp 0x1400085ce
mov rsi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x150]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x130]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 2]
call fcn.140006c08
mov rcx, qword [rsp + 0x80]
cmp eax, edi
jne 0x140008676
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x14000866c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 0xb
jmp 0x14000964b
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140008023
lea r8, [rsp + 0xa0]
lea rdx, str.SetEnvironment
lea rcx, [rsp + 0xa8]
mov dword [rsp + 0xa0], edi
call fcn.140003a08
cmp rax, rdi
mov rsi, rax
je 0x140008863
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.140002cd8
mov rbp, qword [rsp + 0x80]
mov dx, 0x3d
mov rcx, rbp
call fcn.140014ce4
movsxd r12, eax
cmp r12d, edi
jle 0x140008856
lea rcx, [rsp + 0xe0]
mov edx, 3
mov word [rbp + r12*2], di
mov dword [rsp + 0x88], r12d
mov qword [rsp + 0xe0], rdi
mov dword [rsp + 0xe8], edi
mov dword [rsp + 0xec], edi
call fcn.140001140
lea rcx, [rsp + 0xf0]
mov edx, 3
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xfc], edi
call fcn.140001140
mov rax, qword [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
mov edx, r12d
mov dword [rsp + 0xe8], edi
mov word [rax], di
call fcn.140001140
mov rcx, qword [rsp + 0xe0]
sub rcx, rbp
mov r11, rbp
movzx eax, word [r11]
mov word [r11 + rcx], ax
add r11, 2
cmp ax, di
jne 0x14000877f
lea rdx, [rsi + r12*2 + 2]
lea rcx, [rsp + 0xf0]
mov dword [rsp + 0xe8], r12d
call fcn.140001384
mov ecx, 0x20
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, rdi
je 0x1400087cf
lea rdx, [rsp + 0xe0]
mov rcx, rax
call fcn.140002fb8
mov rsi, rax
jmp 0x1400087d2
mov rsi, rdi
lea rcx, [0x140026670]
call fcn.140014e88
movsxd r11, dword [0x14002667c]
mov rax, qword [0x140026680]
mov rcx, qword [rsp + 0xf0]
mov qword [rax + r11*8], rsi
mov r12d, 1
add dword [0x14002667c], r12d
add dword [rsp + 0xa0], r12d
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xe0]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r8, [rsp + 0xa0]
lea rdx, str.SetEnvironment
lea rcx, [rsp + 0xa8]
call fcn.140003a08
cmp rax, rdi
mov rsi, rax
jne 0x1400086c1
mov r13d, dword [rsp + 0x38]
jmp 0x140008869
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r13d, dword [rsp + 0x38]
mov r12d, 1
call fcn.140005de4
mov r11d, dword [0x140026608]
cmp r11d, 0xffffffff
cmove r11d, edi
cmp r15b, dil
mov dword [0x140026608], r11d
je 0x140008913
lea rdx, str.HelpText
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a08
cmp rax, rdi
mov rsi, rax
jne 0x1400088b9
mov ecx, 0x18
call fcn.140002750
mov rsi, rax
lea rcx, [rsp + 0x1a0]
call fcn.14000ae38
mov r8, qword [0x140026c28]
lea r11, [0x1400218f0]
lea rcx, [rsp + 0x1a0]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x1a0], r11
mov dword [rsp + 0x1f0], 0x7d6
mov qword [rsp + 0x20], rdi
call fcn.14000aecc
lea rcx, [rsp + 0x1a0]
call fcn.14000aac8
jmp 0x140008023
mov bpl, byte [rsp + 0x30]
cmp bpl, dil
je 0x140008929
btr r11d, 8
mov dword [0x140026608], r11d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, str.InstallPath
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a08
lea r15, [0x140026c68]
cmp rax, rdi
je 0x14000895f
mov rdx, rax
mov rcx, r15
call fcn.140001384
mov rcx, r15
call fcn.1400058b8
lea rdx, str.BeginPromptTimeout
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a08
cmp rax, rdi
je 0x140008992
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140026c50], eax
cmp dword [0x140026d30], edi
je 0x1400089ca
lea rcx, [rsp + 0xa8]
call fcn.14000c9a0
mov rcx, qword [rsp + 0x60]
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140007f90
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + InitCommonControls]
jmp 0x140007f90
cmp dword [0x140026d24], 3
jne 0x1400089e2
lea rcx, [rsp + 0xa8]
call fcn.14000c8b4
jmp 0x1400089a7
lea rdx, str.BeginPrompt
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a08
cmp rax, rdi
je 0x140008a42
cmp bpl, dil
jne 0x140008a42
mov rcx, qword [0x140026c28]
mov rdx, rax
call fcn.14000b950
cmp eax, edi
je 0x140008bd2
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r13d, r13b
bt ax, 0xf
cmovb r13d, r12d
cmp dword [0x140026d00], edi
je 0x140008a42
btr dword [0x140026608], 7
lea rcx, [rsp + 0x70]
mov edx, 3
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x7c], edi
call fcn.140001140
cmp r13b, dil
mov r12, qword [rsp + 0x130]
je 0x140008b05
mov rbp, r12
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x70]
call fcn.140001384
movzx edx, word [rbp]
lea rcx, [rsp + 0x70]
call fcn.1400014f8
mov rsi, qword [rsp + 0x70]
lea rcx, [rsp + 0xa8]
mov rdx, rsi
xor r8d, r8d
call fcn.140003a08
cmp rax, rdi
je 0x140008bf4
add rbp, 2
cmp word [rbp], 0x30
jb 0x140008ac4
cmp word [rbp], 0x39
jbe 0x140008a72
cmp word [rbp], 0x61
jb 0x140008ad2
cmp word [rbp], 0x7a
jbe 0x140008a72
cmp word [rbp], 0x41
jb 0x140008ae0
cmp word [rbp], 0x5a
jbe 0x140008a72
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x70]
call fcn.140001384
movzx edx, word [r12]
lea rcx, [rsp + 0x70]
call fcn.1400014f8
mov bpl, byte [rsp + 0x30]
cmp dword [rsp + 0x78], edi
mov byte [rsp + 0x31], dil
jne 0x140008b75
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a08
cmp rax, rdi
je 0x140008b48
lea rdx, str.ExecuteFile
lea rcx, [rsp + 0x70]
call fcn.140001384
cmp dword [rsp + 0x78], edi
mov byte [rsp + 0x31], 1
jne 0x140008b75
lea rdx, str.RunProgram
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a08
cmp rax, rdi
je 0x140008b75
lea rdx, str.RunProgram
lea rcx, [rsp + 0x70]
call fcn.140001384
cmp r13b, dil
jne 0x140008c34
cmp bpl, dil
jne 0x140008c34
mov eax, dword [0x140026608]
and ax, 0xc0
cmp al, 0x80
jne 0x140008c34
mov rdx, qword [0x140026c10]
mov rcx, qword [0x140026c18]
call fcn.14000ba34
cmp eax, edi
jne 0x140008c34
cmp byte [0x140026c54], dil
mov rcx, qword [rsp + 0x70]
je 0x140008c2d
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r12d, 1
jmp 0x1400089e2
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008bea
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 5
jmp 0x14000964b
mov r8, rsi
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000c770
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008c23
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 6
jmp 0x14000964b
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140008bd2
mov edx, dword [0x140026c70]
cmp edx, edi
jne 0x140008cb5
lea rdx, str.7ZipSfx._03x
lea rcx, [rsp + 0x80]
call fcn.140005ca8
cmp rax, r15
mov rsi, rax
je 0x140008c9c
mov rcx, qword [0x140026c68]
mov dword [0x140026c70], edi
mov word [rcx], di
mov edx, dword [rax + 8]
mov rcx, r15
call fcn.140001140
mov r11, qword [rsi]
mov rcx, qword [0x140026c68]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008c7f
mov eax, dword [rsi + 8]
mov dword [0x140026c70], eax
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov byte [0x140026bf0], dil
jmp 0x140008d61
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x4c], edi
call fcn.140001140
mov r11, qword [0x140026c68]
mov rcx, qword [rsp + 0x40]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008cd8
mov eax, dword [0x140026c70]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], eax
call fcn.1400058b8
cmp dword [rsp + 0x48], edi
jne 0x140008d4c
mov rax, qword [0x140026c68]
mov dword [0x140026c70], edi
mov rcx, r15
mov word [rax], di
mov edx, dword [rsp + 0x48]
call fcn.140001140
mov r11, qword [rsp + 0x40]
mov rcx, qword [0x140026c68]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008d2e
mov eax, dword [rsp + 0x48]
mov dword [0x140026c70], eax
mov rcx, qword [rsp + 0x40]
mov eax, 1
mov byte [0x140026bf0], al
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
movsxd rcx, dword [0x140026c70]
mov rdx, qword [0x140026c68]
cmp word [rdx + rcx*2 - 2], 0x5c
je 0x140008d7f
cmp word [rdx + rcx*2 - 2], 0x2f
jne 0x140008d8f
add ecx, 0xffffffff
movsxd rax, ecx
mov word [rdx + rax*2], di
mov dword [0x140026c70], ecx
cmp bpl, dil
je 0x140008d9b
or dword [0x140026c44], 3
cmp dword [0x140026d20], edi
jne 0x140008db0
mov rdx, r15
mov rcx, rbx
call fcn.1400018a4
jmp 0x140008dbe
call fcn.14000bacc
cmp eax, edi
jne 0x140008e03
mov eax, 0x80004005
cmp eax, edi
je 0x140008e03
cmp byte [0x140026bf0], dil
jne 0x140008dd7
mov rcx, qword [0x140026c68]
call fcn.140003b68
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140008df9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 8
jmp 0x14000964b
call fcn.140005de4
cmp byte [rsp + 0x32], dil
je 0x140008e22
cmp byte [0x140026bf0], dil
je 0x140008e22
mov r15, qword [rsp + 0x70]
jmp 0x14000976d
lea rcx, [rsp + 0x40]
mov edx, 3
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x4c], edi
call fcn.140001140
cmp r13b, dil
jne 0x140008e59
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xa8]
call fcn.140006530
mov byte [rsp + 0x33], dil
mov rsi, r12
mov qword [rsp + 0x150], r12
mov r15, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov edx, 3
mov dword [rsp + 0xd8], edi
mov byte [rsp + 0x34], dil
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x5c], edi
call fcn.140001140
lea rcx, [rsp + 0xc8]
mov edx, 3
mov qword [rsp + 0xc8], rdi
mov dword [rsp + 0xd0], edi
mov dword [rsp + 0xd4], edi
call fcn.140001140
cmp dword [rsp + 0x78], edi
mov r13d, edi
jne 0x140008ff0
cmp byte [0x140026bf0], dil
jne 0x1400095a2
lea r8, [0x140020bf4]
lea rdx, [0x140026c68]
lea rcx, [rsp + 0x170]
lea rbp, str.setup.exe
call fcn.140006210
lea r8, str.setup.exe
lea rcx, [rsp + 0x160]
mov rdx, rax
call fcn.140006210
mov rsi, rax
lea rax, [rsp + 0x50]
cmp rsi, rax
je 0x140008f5f
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x58], edi
mov word [rcx], di
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x50]
call fcn.140001140
mov r12, qword [rsp + 0x50]
mov r11, qword [rsi]
mov rcx, r12
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140008f42
mov eax, dword [rsi + 8]
mov dword [rsp + 0x58], eax
jmp 0x140008f64
mov r12, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x160]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x170]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140009539
mov byte [rsp + 0x33], 1
lea rcx, [rsp + 0xc8]
mov rdx, rbp
call fcn.140001384
lea rcx, [rsp + 0xc8]
call fcn.1400058fc
mov rsi, qword [rsp + 0xc8]
mov r12d, 1
mov r15w, 0x3a
lea rdx, str.waitall
mov rcx, rsi
call fcn.140005928
cmp rax, rdi
je 0x140009098
cmp word [rax], r15w
jne 0x140009083
add rax, 2
jmp 0x140009086
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0xa8]
mov rdx, r15
call fcn.140003a08
cmp rax, rdi
mov rbp, rax
jne 0x140008f95
add rsi, 2
mov qword [rsp + 0x150], rsi
cmp word [rsi], 0x30
jb 0x140009025
cmp word [rsi], 0x39
jbe 0x140009045
cmp word [rsi], 0x61
jb 0x140009031
cmp word [rsi], 0x7a
jbe 0x140009045
cmp word [rsi], 0x41
jb 0x1400095a2
cmp word [rsi], 0x5a
ja 0x1400095a2
lea rdx, str.AutoInstall
lea rcx, [rsp + 0x70]
call fcn.140001384
movzx edx, word [rsi]
lea rcx, [rsp + 0x70]
call fcn.1400014f8
mov rcx, qword [rsp + 0xc8]
mov dword [rsp + 0x38], edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140008e69
mov rax, rdi
cmp rax, rdi
je 0x140009098
mov rsi, rax
mov byte [rsp + 0x34], r12b
jmp 0x140008fc5
lea rdx, str.hidcon
mov rcx, rsi
call fcn.140005928
cmp rax, rdi
je 0x1400090cb
cmp word [rax], r15w
jne 0x1400090b8
add rax, 2
jmp 0x1400090bb
mov rax, rdi
cmp rax, rdi
je 0x1400090cb
mov rsi, rax
or r13d, r12d
jmp 0x140008fc5
lea rdx, str.nowait
mov rcx, rsi
call fcn.140005928
cmp rax, rdi
je 0x140009105
cmp word [rax], r15w
jne 0x1400090eb
add rax, 2
jmp 0x1400090ee
mov rax, rdi
cmp rax, rdi
je 0x140009105
cmp byte [0x140026bf0], dil
mov rsi, rax
je 0x140008fc5
jmp 0x140009130
lea rdx, str.forcenowait
mov rcx, rsi
call fcn.140005928
cmp rax, rdi
je 0x14000913a
cmp word [rax], r15w
jne 0x140009125
add rax, 2
jmp 0x140009128
mov rax, rdi
cmp rax, rdi
je 0x14000913a
mov rsi, rax
bts r13d, 0x10
jmp 0x140008fc5
lea rdx, [0x140021f40]
mov r8d, 2
mov rcx, rsi
call fcn.140005984
cmp rax, rdi
mov rbp, rax
je 0x140009178
cmp dword [0x140026614], 0xffffffff
jne 0x140009170
lea rcx, [rsi + 4]
call qword [sym.imp.msvcrt.dll__wtol]
mov dword [0x140026614], eax
mov rsi, rbp
jmp 0x140008fc5
lea rdx, [0x140021eb0]
mov r8d, 3
mov rcx, rsi
call fcn.140005984
cmp rax, rdi
je 0x1400091ab
movzx r15d, word [rsi + 6]
mov rsi, rax
sub r15d, 0x30
mov dword [rsp + 0x128], r15d
jmp 0x140008fc0
lea rdx, [0x140021ea8]
mov r8d, 3
mov rcx, rsi
call fcn.140005984
cmp rax, rdi
je 0x1400091e4
movzx r12d, word [rsi + 6]
mov rsi, rax
sub r12d, 0x30
mov dword [rsp + 0x110], r12d
mov r12d, 1
jmp 0x140008fc5
lea rdx, [0x140020a78]
mov rcx, rsi
call fcn.140005928
cmp rax, rdi
je 0x14000920c
cmp word [rax], r15w
jne 0x140009204
add rax, 2
jmp 0x140009207
mov rax, rdi
cmp rax, rdi
jne 0x140009234
lea rdx, str.i386
mov rcx, rsi
call fcn.140005928
cmp rax, rdi
je 0x140009244
cmp word [rax], r15w
jne 0x14000922c
add rax, 2
jmp 0x14000922f
mov rax, rdi
cmp rax, rdi
je 0x140009244
mov rsi, rax
mov dword [rsp + 0xd8], r12d
jmp 0x140008fc5
lea rdx, str.amd64
mov rcx, rsi
call fcn.140005928
cmp rax, rdi
je 0x14000926c
cmp word [rax], r15w
jne 0x140009264
add rax, 2
jmp 0x140009267
mov rax, rdi
cmp rax, rdi
jne 0x140009294
lea rdx, [0x140020a70]
mov rcx, rsi
call fcn.140005928
cmp rax, rdi
je 0x1400092a7
cmp word [rax], r15w
jne 0x14000928c
add rax, 2
jmp 0x14000928f
mov rax, rdi
cmp rax, rdi
je 0x1400092a7
mov rsi, rax
mov dword [rsp + 0xd8], 2
jmp 0x140008fc5
cmp byte [rsp + 0x31], dil
mov r12, qword [rsp + 0x50]
mov r15, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
je 0x140009329
cmp word [rsi], 0x22
je 0x1400092ef
lea rdx, [0x140021d08]
call fcn.140001384
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.140002d44
lea rdx, [0x140021d08]
lea rcx, [rsp + 0x50]
call fcn.140002d44
jmp 0x1400092f7
mov rdx, rsi
call fcn.140001384
lea rdx, str.ExecuteParameters
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a08
cmp rax, rdi
mov rsi, rax
je 0x14000936e
lea rdx, [0x140021e80]
lea rcx, [rsp + 0x50]
call fcn.140002d44
jmp 0x140009361
mov word [r12], di
mov edx, dword [rsp + 0x48]
mov dword [rsp + 0x58], edi
call fcn.140001140
mov r11, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x140009345
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.140002d44
lea rcx, [rsp + 0x90]
mov edx, 3
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x98], edi
mov dword [rsp + 0x9c], edi
call fcn.140001140
mov rsi, qword [rsp + 0x50]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.140006598
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140002cd8
lea rcx, [rsp + 0x90]
call fcn.1400058fc
cmp dword [0x140026d24], edi
jne 0x1400094d2
mov ecx, dword [rsp + 0xd8]
call fcn.1400029ec
cmp eax, edi
je 0x1400094d2
cmp word [r14], di
je 0x14000940a
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140002d44
jmp 0x140009404
add r14, 2
cmp word [r14], di
jne 0x140009400
lea rcx, [rsp + 0x80]
call fcn.1400058fc
mov al, byte [rsp + 0x34]
cmp al, dil
jne 0x1400094b2
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x180]
mov dx, 0x22
call fcn.1400061ac
lea r8, [0x140021d7c]
lea rcx, [rsp + 0x190]
mov rdx, rax
call fcn.140006210
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xe0]
mov rdx, rax
call fcn.140001584
mov rcx, qword [rsp + 0x190]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x180]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rbp, qword [rsp + 0xe0]
mov r8, qword [0x140026c68]
mov rcx, rbp
mov edx, r13d
call fcn.140006c08
mov rcx, rbp
cmp eax, edi
je 0x1400095b9
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400094d2
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x90]
mov r8d, r13d
call fcn.140006d64
cmp eax, edi
jne 0x1400095c0
cmp byte [rsp + 0x31], dil
jne 0x1400096a2
cmp byte [rsp + 0x33], dil
jne 0x1400096a2
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x48], edi
mov word [rax], di
mov rcx, qword [rsp + 0x80]
mov eax, 1
add dword [rsp + 0x38], eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rsi, qword [rsp + 0x150]
jmp 0x140008e6e
cmp byte [0x140026bf0], dil
jne 0x14000954e
mov rcx, qword [0x140026c68]
call fcn.140003b68
mov edx, InitCommonControls
xor ecx, ecx
call fcn.14000c770
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140007b39
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
jmp 0x140007b39
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x50]
jmp 0x1400096cc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400095c8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, InitCommonControls
mov r8, rsi
lea ecx, [rdx - 0xf]
call fcn.14000c770
cmp byte [0x140026bf0], dil
jne 0x1400095ed
mov rcx, qword [0x140026c68]
call fcn.140003b68
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x140009646
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov edi, 9
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x1400219e0]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.140014e78
lea rcx, [rsp + 0xa8]
call fcn.140014f30
mov rcx, qword [rsp + 0x140]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x118]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, edi
jmp 0x140009952
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp dword [0x140026d24], edi
jne 0x14000975e
call fcn.140005de4
mov eax, dword [rsp + 0x128]
mov r12, qword [rsp + 0x130]
lea r8, str.Shortcut
lea rdx, [rsp + 0xa8]
lea rcx, [0x14000768c]
mov r9, r12
mov dword [rsp + 0x20], eax
call fcn.140006994
mov rcx, qword [0x140026c78]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [rsp + 0x110]
lea r8, str.Delete
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0xa8]
lea rcx, [0x140005fd8]
mov r9, r12
call fcn.140006994
cmp byte [0x140026bf0], dil
jne 0x14000975e
mov rcx, qword [0x140026c68]
call fcn.140003b68
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov bpl, byte [rsp + 0x30]
mov eax, dword [0x140026614]
cmp eax, 0xffffffff
jne 0x14000978c
cmp bpl, dil
jne 0x14000981e
mov eax, 1
mov dword [0x140026614], eax
cmp eax, edi
jle 0x14000981e
lea rdx, str.FinishMessage
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a08
cmp rax, rdi
mov rsi, rax
je 0x14000981e
mov ecx, dword [0x140026614]
mov eax, 0x3e7
cmp ecx, eax
cmovg ecx, eax
mov dword [0x140026614], ecx
lea rcx, [rsp + 0x1a0]
call fcn.14000ae38
mov r8, qword [0x140026c28]
lea r11, [0x140021980]
lea rcx, [rsp + 0x1a0]
mov r9, rsi
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x1a0], r11
mov dword [rsp + 0x1f0], 0x7d5
mov qword [rsp + 0x20], rdi
call fcn.14000aecc
lea rcx, [rsp + 0x1a0]
call fcn.14000aac8
cmp byte [rsp + 0x32], dil
jne 0x1400098bd
cmp dword [0x140026d24], edi
jne 0x1400098bd
lea rdx, str.SelfDelete
lea rcx, [rsp + 0xa8]
xor r8d, r8d
call fcn.140003a08
cmp rax, rdi
je 0x1400098bd
cmp word [rax], 0x31
jne 0x1400098bd
mov edx, dword [0x140026cd0]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0x88], edi
mov dword [rsp + 0x8c], edi
call fcn.140001140
mov r11, qword [0x140026cc8]
mov rcx, qword [rsp + 0x80]
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
cmp ax, di
jne 0x14000988f
mov eax, dword [0x140026cd0]
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x88], eax
call fcn.1400071a4
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp rbx, rdi
je 0x1400098dd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + InitCommonControls]
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x1400219e0]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa8], r11
call fcn.140014e78
lea rcx, [rsp + 0xa8]
call fcn.140014f30
mov rcx, qword [rsp + 0x140]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x118]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
jmp 0x140009952
lea r8, str.7_Zip_SFX
lea rdx, str.Sorry__this_program_requires_Microsoft_Windows_2000_or_later.
mov r9d, InitCommonControls
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x14
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret