Function at 0x140019990
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2658]
mov eax, 0x2758
call fcn.1400b6200
sub rsp, rax
movaps xmmword [rsp + 0x2740], xmm6
movaps xmmword [rsp + 0x2730], xmm7
movaps xmmword [rsp + 0x2720], xmm8
mov rax, qword [0x14012df00]
xor rax, rsp
mov qword [rbp + 0x2610], rax
mov r12, r9
mov r14, r8
mov rdi, rdx
mov r13, rcx
mov rax, qword [rbp + 0x26c8]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp + 0x26d0]
mov qword [rbp - 0x10], rax
xor r15d, r15d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x610]
call fcn.1400e71a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r15w
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400119f0
mov rdx, rax
mov rcx, rdi
call fcn.14000eac0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140019aa7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019aa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001adb5
call fcn.1400b5af0
mov r8, qword [rdi + 0x10]
mov rsi, 0xffffffffffffffff
test r8, r8
je 0x140019b83
mov rdx, rdi
mov r9, qword [rdi + 0x18]
cmp r9, 7
jbe 0x140019acb
mov rdx, qword [rdi]
lea rcx, [r8 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x140019af2
cmp rcx, rdx
je 0x140019afd
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x140019ae3
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
jne 0x140019b3b
mov rdx, rdi
cmp r9, 7
jbe 0x140019b09
mov rdx, qword [rdi]
lea rcx, [r8 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2f
je 0x140019b30
cmp rcx, rdx
je 0x140019b83
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x140019b21
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
je 0x140019b83
inc rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov rax, qword [rdi + 0x10]
cmp rax, rcx
jb 0x14001adbb
sub rax, rcx
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
mov rax, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140019b74
mov rax, qword [rdi]
lea rdx, [rax + rcx*2]
lea rcx, [rbp - 0x30]
call fcn.14000f4b0
jmp 0x140019b90
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.14000eb60
nop
cmp dword [0x14028601c], 9
ja 0x140019c72
lea r10, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova r10, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x20]
cmp rbx, 7
jb 0x140019c72
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x140117700]
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, r15
je 0x140019bf6
cmp word [rcx], 0x65
je 0x140019bf3
nop
cmp rax, 1
je 0x140019bf6
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x140019be0
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140019c72
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x140117700]
sub r9, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140019d02
add rdx, 2
sub r8, 1
jne 0x140019c20
sub rcx, r10
sar rcx, 1
jne 0x140019c72
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.1400e6b00
mov qword [rbp - 0x20], rbx
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x140019f23
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140019c90
mov rdx, qword [rdx]
lea rcx, [rbp - 0x30]
call fcn.14001b690
cmp rax, 0xffffffffffffffff
jne 0x140019ca7
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x140019c82
cmp rbx, r15
je 0x140019f23
mov rdx, qword [rbx + 0x30]
cmp rdx, qword [rbx + 0x38]
je 0x140019d0f
mov rax, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 7
jbe 0x140019cc8
mov r14, qword [r14]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140019cd6
mov rdx, qword [rdx]
cmp rcx, rax
jne 0x140019d0b
test rcx, rcx
je 0x140019cf8
sub rdx, r14
movzx eax, word [rdx + r14]
cmp ax, word [r14]
jne 0x140019d0b
add r14, 2
sub rcx, 1
jne 0x140019ce3
mov r14, qword [rbx + 0x38]
sub r14, 0x20
jmp 0x140019d0f
add rcx, 2
jmp 0x140019bc4
mov r14, qword [rbx + 0x30]
mov rcx, rdi
mov rdx, r14
call fcn.14000e9d0
mov r9, qword [rbp - 0x10]
mov r8, qword [rbp - 0x60]
mov rdx, rdi
call fcn.14001ae60
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14001acd6
cmp ebx, 0xc015001d
je 0x14001acd6
test byte [rbp + 0x26c0], 2
je 0x140019f1c
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.1400e71a0
mov edx, 0xff
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x10]
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140019d90
mov r8, rsi
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x60]
call fcn.14000f4b0
nop
mov r8d, 1
lea rdx, [0x1401176fc]
lea rcx, [rsp + 0x60]
call fcn.14001c180
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140019e03
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14001c180
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.14000eac0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140019e7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001adc1
call fcn.1400b5af0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140019ebe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019eb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001adc7
call fcn.1400b5af0
movdqa xmm0, xmmword [0x140118a00]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14001acd6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001adcd
call fcn.1400b5af0
jmp 0x14001acd6
xor ebx, ebx
jmp 0x14001acd6
mov r15d, dword [rbp + 0x26c0]
test r15b, 1
je 0x140019f3a
mov ebx, 0xc0000225
jmp 0x14001acd6
mov r9, qword [rbp - 0x10]
mov r13, qword [rbp - 0x60]
mov r8, r13
mov rdx, rdi
call fcn.14001ae60
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14001acd6
cmp ebx, 0xc015001d
je 0x14001acd6
test r15b, 4
je 0x140019f7a
mov ebx, 0xc0000225
jmp 0x14001acd6
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140019f87
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140019f99
xor ebx, ebx
jmp 0x14001acd6
mov qword [rbp], 0
lea r8, [rbp]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd r14, eax
test eax, eax
jne 0x14001a0a7
xor ebx, ebx
test r14, r14
jne 0x14001a0a7
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x410]
call fcn.1400e71a0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.1400e71a0
mov dword [rbp - 0x10], 0xff
xor ecx, ecx
mov dword [rbp - 8], ecx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x410]
mov edx, ebx
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd r14, eax
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0x10]
call fcn.1400cd714
test eax, eax
jne 0x14001a099
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x210]
call fcn.1400e71a0
mov dword [rbp - 0x10], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x210]
test r15b, 8
je 0x14001a08a
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14001a090
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test r14, r14
je 0x14001a231
inc ebx
cmp ebx, 0x1000
jl 0x140019fc6
mov rcx, qword [r12 + 0x10]
lea rbx, [0x1401176fc]
test rcx, rcx
je 0x14001a3eb
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x14001add3
cmp qword [r12 + 0x18], 7
jbe 0x14001a0df
mov r12, qword [r12]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov r9, r12
lea rcx, [rbp - 0x80]
call fcn.14001c040
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rbp - 0x80]
call fcn.14001c180
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14001a174
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a16f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001adeb
call fcn.1400b5af0
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14001a1bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a1b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001adf1
call fcn.1400b5af0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001a3ee
lea rax, [rbp - 0x50]
cmp rdi, rax
je 0x14001ada7
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r9, qword [rbp - 0x50]
mov rax, qword [rdi + 0x18]
mov rbx, qword [rbp - 0x40]
cmp rbx, rax
ja 0x14001ad9c
cmp rax, 7
mov rsi, rdi
jbe 0x14001a211
mov rsi, qword [rdi]
mov qword [rdi + 0x10], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rsi
call fcn.1400e6b00
mov word [rsi + rbx*2], r14w
mov ebx, r14d
jmp 0x14001acc6
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x210]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001a250
lea rdx, [rbp + 0x210]
lea rcx, [rsp + 0x60]
call fcn.14000f4b0
nop
mov r8d, 1
lea rdx, [0x1401176fc]
lea rcx, [rsp + 0x60]
call fcn.14001c180
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rax, [rbp + 0x10]
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14001a2c0
mov r8, rsi
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14001c180
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.14000eac0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14001a347
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a341
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001add9
call fcn.1400b5af0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14001a389
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a384
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001addf
call fcn.1400b5af0
movdqa xmm0, xmmword [0x140118a00]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14001ada7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a3de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ade5
call fcn.1400b5af0
mov ebx, r14d
jmp 0x14001acc6
xor r14d, r14d
mov r8d, dword [r13 + 8]
lea rdx, [rbp - 0x80]
call fcn.14001b3f0
nop
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.14001c180
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001c180
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14001a4b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a4ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001adf7
call fcn.1400b5af0
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14001a4fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a4f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001adfd
call fcn.1400b5af0
movdqa xmm6, xmmword [0x140118a00]
movdqu xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], r14w
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14001a550
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a54b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae03
call fcn.1400b5af0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001a1d9
mov edx, 0x1000
lea rcx, [rbp + 0x610]
test r15b, 8
je 0x14001a587
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14001a58d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001a5b0
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.14000f4b0
nop
mov r8d, 1
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14001c180
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001c180
movups xmm7, xmmword [rax]
movups xmm8, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14001a686
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a681
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae09
call fcn.1400b5af0
movups xmmword [rbp - 0x50], xmm7
movups xmmword [rbp - 0x40], xmm8
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14001a6d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a6cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae0f
call fcn.1400b5af0
movdqu xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14001a71f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a71a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae15
call fcn.1400b5af0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001a1d9
mov edx, 0x1000
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001a770
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.14000f4b0
nop
mov r8d, 1
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14001c180
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001c180
movups xmm7, xmmword [rax]
movups xmm8, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14001a846
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a841
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae1b
call fcn.1400b5af0
movups xmmword [rbp - 0x50], xmm7
movups xmmword [rbp - 0x40], xmm8
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14001a891
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a88c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae21
call fcn.1400b5af0
movdqu xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14001a8df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a8da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae27
call fcn.1400b5af0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001a1d9
lea rdx, [rbp + 0x610]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001a930
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.14000f4b0
nop
mov r8d, 1
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14001c180
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001c180
movups xmm7, xmmword [rax]
movups xmm8, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14001aa06
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aa01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae2d
call fcn.1400b5af0
movups xmmword [rbp - 0x50], xmm7
movups xmmword [rbp - 0x40], xmm8
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14001aa51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aa4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae33
call fcn.1400b5af0
movdqu xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14001aa9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aa9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae39
call fcn.1400b5af0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001a1d9
mov r8d, 0x1000
lea rdx, [rbp + 0x610]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x58]
lea rdx, [0x1401177b0]
lea rcx, [rbp + 0x610]
call fcn.1400cda30
test rax, rax
je 0x14001acc1
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14001ab15
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000f4b0
nop
mov r8d, 1
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14001c180
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001c180
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14001abe7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001abe2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae45
call fcn.1400b5af0
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14001ac31
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ac2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae4b
call fcn.1400b5af0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14001ac87
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ac82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae51
call fcn.1400b5af0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001a1d9
lea r8, [rbp - 0x58]
lea rdx, [0x1401177b0]
mov rcx, qword [rbp - 0x58]
call fcn.1400cda30
test rax, rax
jne 0x14001ab00
mov ebx, 0xc0000225
mov rcx, qword [rbp]
test rcx, rcx
jle 0x14001acd6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14001ad16
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ad11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ae3f
call fcn.1400b5af0
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], ax
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14001ad64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ad5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001adaf
call fcn.1400b5af0
mov eax, ebx
mov rcx, qword [rbp + 0x2610]
xor rcx, rsp
call fcn.1400b5ad0
lea r11, [rsp + 0x2758]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdx, rbx
mov rcx, rdi
call fcn.14000f670
mov ebx, r14d
jmp 0x14001acc6
call fcn.1400c4e44
nop
call fcn.1400c4e44
int3
call fcn.1400035e0
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.140001f80
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
nop
call fcn.1400c4e44
int3