Function at 0x14005e610
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a18]
mov eax, 0x2b18
call fcn.14008cb70
sub rsp, rax
movaps xmmword [rsp + 0x2b00], xmm6
movaps xmmword [rsp + 0x2af0], xmm7
movaps xmmword [rsp + 0x2ae0], xmm8
mov rax, qword [0x14014e0c0]
xor rax, rsp
mov qword [rbp + 0x29d0], rax
mov r12, r9
mov r14, r8
mov rdi, rdx
mov r13, rcx
mov rax, qword [rbp + 0x2a88]
mov qword [rsp + 0x68], rax
mov rax, qword [rbp + 0x2a90]
mov qword [rsp + 0x60], rax
xor r15d, r15d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x9d0]
call fcn.1400bb630
xorps xmm0, xmm0
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x190], 7
mov word [rbp + 0x178], r15w
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x130]
call fcn.140056330
mov rdx, rax
mov rcx, rdi
call fcn.1400532b0
mov rdx, qword [rbp + 0x148]
cmp rdx, 7
jbe 0x14005e73e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e739
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fba7
call fcn.14008bfa0
mov r8, qword [rdi + 0x10]
mov rsi, 0xffffffffffffffff
test r8, r8
je 0x14005e82e
mov rdx, rdi
mov r9, qword [rdi + 0x18]
cmp r9, 7
jbe 0x14005e762
mov rdx, qword [rdi]
lea rcx, [r8 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x14005e78f
nop word [rax + rax]
cmp rcx, rdx
je 0x14005e79a
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x14005e780
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
jne 0x14005e7da
mov rdx, rdi
cmp r9, 7
jbe 0x14005e7a6
mov rdx, qword [rdi]
lea rcx, [r8 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2f
je 0x14005e7cf
nop
cmp rcx, rdx
je 0x14005e82e
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x14005e7c0
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
je 0x14005e82e
inc rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1a8], r15
mov qword [rbp + 0x1b0], r15
mov rax, qword [rdi + 0x10]
cmp rax, rcx
jb 0x14005fbad
sub rax, rcx
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
mov rax, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14005e81c
mov rax, qword [rdi]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x198]
call fcn.140053c20
jmp 0x14005e83e
mov rdx, rdi
lea rcx, [rbp + 0x198]
call fcn.140053350
nop
cmp dword [0x1401555cc], 9
ja 0x14005e93e
lea r10, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 7
cmova r10, qword [rbp + 0x198]
mov rbx, qword [rbp + 0x1a8]
cmp rbx, 7
jb 0x14005e93e
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, str.ext_ms_
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, r15
je 0x14005e8b6
cmp word [rcx], 0x65
je 0x14005e8b3
nop dword [rax]
cmp rax, 1
je 0x14005e8b6
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x14005e8a0
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14005e93e
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, str.ext_ms_
sub r9, rax
nop dword [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14005e9d3
add rdx, 2
sub r8, 1
jne 0x14005e8e0
sub rcx, r10
sar rcx, 1
jne 0x14005e93e
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 7
cmova rcx, qword [rbp + 0x198]
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call fcn.1400baef0
mov qword [rbp + 0x1a8], rbx
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x14005ebf7
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14005e95e
mov rdx, qword [rdx]
lea rcx, [rbp + 0x198]
call fcn.140060480
cmp rax, 0xffffffffffffffff
jne 0x14005e978
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x14005e950
cmp rbx, r15
je 0x14005ebf7
mov rdx, qword [rbx + 0x30]
cmp rdx, qword [rbx + 0x38]
je 0x14005e9e0
mov rax, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 7
jbe 0x14005e999
mov r14, qword [r14]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14005e9a7
mov rdx, qword [rdx]
cmp rcx, rax
jne 0x14005e9dc
test rcx, rcx
je 0x14005e9c9
sub rdx, r14
movzx eax, word [rdx + r14]
cmp ax, word [r14]
jne 0x14005e9dc
add r14, 2
sub rcx, 1
jne 0x14005e9b4
mov r14, qword [rbx + 0x38]
sub r14, 0x20
jmp 0x14005e9e0
add rcx, 2
jmp 0x14005e87e
mov r14, qword [rbx + 0x30]
mov rcx, rdi
mov rdx, r14
call fcn.1400531c0
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rdx, rdi
call fcn.14005fc50
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14005fab3
cmp ebx, 0xc015001d
je 0x14005fab3
test byte [rbp + 0x2a80], 2
je 0x14005ebf0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x5d0]
call fcn.1400bb630
mov edx, 0xff
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rax, [rbp + 0x5d0]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14005ea66
mov r8, rsi
lea rdx, [rbp + 0x5d0]
lea rcx, [rbp + 0x70]
call fcn.140053c20
nop
mov r8d, 1
lea rdx, [0x140135d6c]
lea rcx, [rbp + 0x70]
call fcn.140060f70
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14005ead6
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rbp - 0x70]
call fcn.140060f70
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400532b0
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005eb53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eb4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbb3
call fcn.14008bfa0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14005eb93
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eb8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbb9
call fcn.14008bfa0
movdqa xmm0, xmmword [0x140137380]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], bx
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14005fab3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ebe6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbbf
call fcn.14008bfa0
jmp 0x14005fab3
xor ebx, ebx
jmp 0x14005fab3
mov r15d, dword [rbp + 0x2a80]
test r15b, 1
je 0x14005ec0e
mov ebx, 0xc0000225
jmp 0x14005fab3
mov r9, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r8, r13
mov rdx, rdi
call fcn.14005fc50
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14005fab3
cmp ebx, 0xc015001d
je 0x14005fab3
test r15b, 4
je 0x14005ec50
mov ebx, 0xc0000225
jmp 0x14005fab3
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14005ec5d
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005ec6f
xor ebx, ebx
jmp 0x14005fab3
mov qword [rbp + 0x1c8], 0
lea r8, [rbp + 0x1c8]
lea rdx, [0x140135d70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd r14, eax
test eax, eax
jne 0x14005edaa
xor ebx, ebx
test r14, r14
jne 0x14005edaa
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x7d0]
call fcn.1400bb630
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x3d0]
call fcn.1400bb630
mov dword [rbp + 0x1b8], 0xff
xor ecx, ecx
mov dword [rbp + 0x1c0], ecx
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x1b8]
lea r8, [rbp + 0x7d0]
mov edx, ebx
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd r14, eax
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 7
cmova rdx, qword [rbp + 0x198]
lea rcx, [rbp + 0x3d0]
call fcn.14009f124
test eax, eax
jne 0x14005ed9c
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x1d0]
call fcn.1400bb630
mov dword [rbp + 0x1b8], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x1d0]
test r15b, 8
je 0x14005ed8d
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14005ed93
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test r14, r14
je 0x14005ef70
inc ebx
cmp ebx, 0x1000
jl 0x14005eca2
mov rcx, qword [r12 + 0x10]
lea rbx, [0x140135d6c]
test rcx, rcx
je 0x14005f132
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x14005fbc5
cmp qword [r12 + 0x18], 7
jbe 0x14005ede2
mov r12, qword [r12]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov r9, r12
lea rcx, [rbp + 0x110]
call fcn.140060e30
nop
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 7
cmova rdx, qword [rbp + 0x198]
mov r8, qword [rbp + 0x1a8]
lea rcx, [rbp + 0x110]
call fcn.140060f70
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp + 0x190]
cmp rdx, 7
jbe 0x14005ee8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ee8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbdd
call fcn.14008bfa0
movups xmmword [rbp + 0x178], xmm6
movups xmmword [rbp + 0x188], xmm7
mov rdx, qword [rbp + 0x128]
cmp rdx, 7
jbe 0x14005eee3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eede
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbe3
call fcn.14008bfa0
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 7
cmova rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005f135
lea rax, [rbp + 0x178]
cmp rdi, rax
je 0x14005fb99
lea r9, [rbp + 0x178]
cmp qword [rbp + 0x190], 7
cmova r9, qword [rbp + 0x178]
mov rax, qword [rdi + 0x18]
mov rbx, qword [rbp + 0x188]
cmp rbx, rax
ja 0x14005fb8e
cmp rax, 7
mov rsi, rdi
jbe 0x14005ef50
mov rsi, qword [rdi]
mov qword [rdi + 0x10], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rsi
call fcn.1400baef0
mov word [rsi + rbx*2], r14w
mov ebx, r14d
jmp 0x14005faa0
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
lea rax, [rbp + 0x1d0]
mov r8, rsi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14005ef90
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x90]
call fcn.140053c20
nop
mov r8d, 1
lea rdx, [0x140135d6c]
lea rcx, [rbp + 0x90]
call fcn.140060f70
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x18], 7
xor r14d, r14d
mov qword [rax + 0x10], r14
mov word [rax], r14w
lea rax, [rbp + 0x3d0]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14005f000
mov r8, rsi
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp - 0x50]
call fcn.140060f70
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400532b0
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005f08e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f088
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbcb
call fcn.14008bfa0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14005f0ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f0c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbd1
call fcn.14008bfa0
movdqa xmm0, xmmword [0x140137380]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14005fb99
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f125
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbd7
call fcn.14008bfa0
mov ebx, r14d
jmp 0x14005faa0
xor r14d, r14d
mov r8d, dword [r13 + 8]
lea rdx, [rbp + 0x150]
call fcn.1400601e0
nop
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.140060f70
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 7
cmova rdx, qword [rbp + 0x198]
mov r8, qword [rbp + 0x1a8]
lea rcx, [rbp - 0x30]
call fcn.140060f70
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp + 0x190]
cmp rdx, 7
jbe 0x14005f209
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f204
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbe9
call fcn.14008bfa0
movups xmmword [rbp + 0x178], xmm6
movups xmmword [rbp + 0x188], xmm7
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14005f257
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f252
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbef
call fcn.14008bfa0
movdqa xmm6, xmmword [0x140137380]
movdqu xmmword [rbp - 0x20], xmm6
mov word [rbp - 0x30], r14w
mov rdx, qword [rbp + 0x168]
cmp rdx, 7
jbe 0x14005f2af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f2aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbf5
call fcn.14008bfa0
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 7
cmova rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005ef09
mov edx, 0x1000
lea rcx, [rbp + 0x9d0]
test r15b, 8
je 0x14005f2ef
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14005f2f5
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
lea rax, [rbp + 0x9d0]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14005f314
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0xb0]
call fcn.140053c20
nop
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0xb0]
call fcn.140060f70
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 7
cmova rdx, qword [rbp + 0x198]
mov r8, qword [rbp + 0x1a8]
lea rcx, [rbp - 0x10]
call fcn.140060f70
movups xmm7, xmmword [rax]
movups xmm8, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp + 0x190]
cmp rdx, 7
jbe 0x14005f3fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f3f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fbfb
call fcn.14008bfa0
movups xmmword [rbp + 0x178], xmm7
movups xmmword [rbp + 0x188], xmm8
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14005f44a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f445
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc01
call fcn.14008bfa0
movdqu xmmword [rbp], xmm6
mov word [rbp - 0x10], r14w
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x14005f49a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f495
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc07
call fcn.14008bfa0
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 7
cmova rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005ef09
mov edx, 0x1000
lea rcx, [rbp + 0x9d0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
lea rax, [rbp + 0x9d0]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14005f4f1
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0xd0]
call fcn.140053c20
nop
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0xd0]
call fcn.140060f70
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 7
cmova rdx, qword [rbp + 0x198]
mov r8, qword [rbp + 0x1a8]
lea rcx, [rbp + 0x10]
call fcn.140060f70
movups xmm7, xmmword [rax]
movups xmm8, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp + 0x190]
cmp rdx, 7
jbe 0x14005f5d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f5d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc0d
call fcn.14008bfa0
movups xmmword [rbp + 0x178], xmm7
movups xmmword [rbp + 0x188], xmm8
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14005f627
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f622
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc13
call fcn.14008bfa0
movdqu xmmword [rbp + 0x20], xmm6
mov word [rbp + 0x10], r14w
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x14005f677
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f672
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc19
call fcn.14008bfa0
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 7
cmova rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005ef09
lea rdx, [rbp + 0x9d0]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x100], xmm1
lea rax, [rbp + 0x9d0]
mov r8, rsi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14005f6d0
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0xf0]
call fcn.140053c20
nop
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0xf0]
call fcn.140060f70
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 7
cmova rdx, qword [rbp + 0x198]
mov r8, qword [rbp + 0x1a8]
lea rcx, [rbp + 0x30]
call fcn.140060f70
movups xmm7, xmmword [rax]
movups xmm8, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp + 0x190]
cmp rdx, 7
jbe 0x14005f7b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f7b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc1f
call fcn.14008bfa0
movups xmmword [rbp + 0x178], xmm7
movups xmmword [rbp + 0x188], xmm8
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14005f806
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f801
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc25
call fcn.14008bfa0
movdqu xmmword [rbp + 0x40], xmm6
mov word [rbp + 0x30], r14w
mov rdx, qword [rbp + 0x108]
cmp rdx, 7
jbe 0x14005f856
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f851
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc2b
call fcn.14008bfa0
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 7
cmova rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005ef09
mov r8d, 0x1000
lea rdx, [rbp + 0x9d0]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp + 0x170]
lea rdx, [0x140135df8]
lea rcx, [rbp + 0x9d0]
call fcn.1400a0310
test rax, rax
je 0x14005fa9b
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], r14
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14005f8d2
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.140053c20
nop
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0x50]
call fcn.140060f70
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 7
cmova rdx, qword [rbp + 0x198]
mov r8, qword [rbp + 0x1a8]
lea rcx, [rsp + 0x70]
call fcn.140060f70
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp + 0x190]
cmp rdx, 7
jbe 0x14005f9b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f9ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc37
call fcn.14008bfa0
movups xmmword [rbp + 0x178], xmm6
movups xmmword [rbp + 0x188], xmm7
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x14005fa00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f9fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc3d
call fcn.14008bfa0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14005fa52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fa4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc43
call fcn.14008bfa0
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 7
cmova rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005ef09
lea r8, [rbp + 0x170]
lea rdx, [0x140135df8]
mov rcx, qword [rbp + 0x170]
call fcn.1400a0310
test rax, rax
jne 0x14005f8c0
mov ebx, 0xc0000225
mov rcx, qword [rbp + 0x1c8]
test rcx, rcx
jle 0x14005fab3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 7
jbe 0x14005faf9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005faf4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fc31
call fcn.14008bfa0
xor eax, eax
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x1b0], 7
mov word [rbp + 0x198], ax
mov rdx, qword [rbp + 0x190]
cmp rdx, 7
jbe 0x14005fb56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fb51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fba1
call fcn.14008bfa0
mov eax, ebx
mov rcx, qword [rbp + 0x29d0]
xor rcx, rsp
call fcn.14008bd40
lea r11, [rsp + 0x2b18]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdx, rbx
mov rcx, rdi
call fcn.140053de0
mov ebx, r14d
jmp 0x14005faa0
call fcn.140092088
nop
call fcn.140092088
int3
call fcn.140056450
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140001bc0
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
nop
call fcn.140092088
int3