Function at 0x140048da0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2648]
mov eax, 0x2748
call fcn.14006b3b0
sub rsp, rax
mov rax, qword [0x1400f0020]
xor rax, rsp
mov qword [rbp + 0x2630], rax
mov r12, r9
mov qword [rbp + 0x20], r9
mov r14, r8
mov rdi, rdx
mov qword [rbp - 0x68], rcx
mov rax, qword [rbp + 0x26b8]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x26c0]
mov qword [rbp + 0x18], rax
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x630]
call fcn.140089280
xor esi, esi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], si
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x48], xmm1
lea r15, [rdi + 0x10]
mov qword [rsp + 0x60], r15
mov qword [r15], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.140024fe0
mov rbx, rax
cmp rdi, rax
je 0x140048ec6
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140048e9b
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140048e96
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a104
mov rcx, r8
call fcn.14006a754
mov qword [r15], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140048f07
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048f02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a104
call fcn.14006a754
mov rdx, rdi
lea rcx, [rbp - 8]
call fcn.140024390
nop
cmp dword [0x1400f590c], 9
ja 0x140049023
lea rbx, [rbp - 8]
mov r12, qword [rbp - 8]
mov r13, qword [rbp + 0x10]
cmp r13, 8
cmovae rbx, r12
mov r11, qword [rbp + 8]
cmp r11, 7
jb 0x14004901f
lea r15, [r11 - 6]
lea r15, [rbx + r15*2]
mov rax, rbx
lea r8, str.ext_ms_
mov qword [rbp - 0x78], r8
nop dword [rax]
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov rdx, rsi
je 0x140048f8a
cmp word [rax], 0x65
je 0x140048f87
cmp rcx, 1
je 0x140048f8a
dec rcx
add rax, 2
cmp word [rax], 0x65
jne 0x140048f74
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14004901f
mov r9d, 7
mov rcx, r8
movzx edx, word [rdx]
mov r8d, 0x65
cmp dx, r8w
jb 0x140048fd7
mov r10, rax
sub r10, qword [rbp - 0x78]
cmp dx, r8w
ja 0x140048fd7
cmp r9, 1
je 0x140048fe7
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x140048fb9
add rax, 2
lea r8, str.ext_ms_
jmp 0x140048f60
sub rax, rbx
sar rax, 1
jne 0x14004901f
mov eax, 4
cmp r11, rax
cmovb rax, r11
lea rcx, [rbp - 8]
cmp r13, 8
cmovae rcx, r12
sub r11, rax
mov qword [rbp + 8], r11
lea r8, [r11*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.140088e50
mov r12, qword [rbp + 0x20]
mov r13, qword [rbp - 0x68]
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x14004932c
nop word [rax + rax]
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14004904e
mov rdx, qword [rdx]
lea rcx, [rbp - 8]
call fcn.140023584
cmp rax, 0xffffffffffffffff
jne 0x140049065
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x140049040
cmp rbx, r15
je 0x14004932c
mov r8, qword [rbx + 0x30]
cmp r8, qword [rbx + 0x38]
je 0x1400490da
mov rcx, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x140049086
mov r14, qword [r14]
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140049094
mov r8, qword [r8]
cmp rax, rcx
jne 0x1400490d6
test rax, rax
je 0x14004923f
movzx ecx, word [r8]
movzx edx, word [r14]
cmp cx, dx
jb 0x1400490d6
sub r8, r14
cmp cx, dx
ja 0x1400490d6
cmp rax, 1
je 0x14004923f
dec rax
add r14, 2
movzx ecx, word [r14 + r8]
movzx edx, word [r14]
cmp cx, dx
jae 0x1400490b5
mov r14, qword [rbx + 0x30]
mov rdx, r14
mov rcx, rdi
call fcn.14001725c
mov r9, qword [rbp + 0x18]
mov r8, qword [rbp - 0x38]
mov rdx, rdi
call fcn.14004a180
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004a0be
cmp edx, 0xc015001d
je 0x14004a0be
test byte [rbp + 0x26b0], 2
je 0x14004a0c0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.140089280
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140006890
nop
mov r8d, 1
lea rdx, [0x1400d88e8]
lea rcx, [rsp + 0x68]
call fcn.1400093cc
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400491ae
mov rdx, qword [rdi]
mov rax, qword [rsp + 0x60]
mov r8, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.1400093cc
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp - 0x58]
cmp rdi, rax
je 0x14004924c
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140049236
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140049229
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a10a
mov rcx, r8
call fcn.14006a754
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
jmp 0x14004928d
mov r14, qword [rbx + 0x38]
sub r14, 0x20
jmp 0x1400490da
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14004928d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049287
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a10a
call fcn.14006a754
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400492cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400492ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a110
call fcn.14006a754
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004a0c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049322
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a116
call fcn.14006a754
jmp 0x14004a0c0
mov r15d, dword [rbp + 0x26b0]
test r15b, 1
jne 0x14004936f
mov r9, qword [rbp + 0x18]
mov r13, qword [rbp - 0x38]
mov r8, r13
mov rdx, rdi
call fcn.14004a180
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004a0be
cmp edx, 0xc015001d
je 0x14004a0be
test r15b, 4
je 0x140049379
mov esi, 0xc0000225
jmp 0x14004a0c0
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140049386
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004a0c0
mov qword [rbp + 0x28], rsi
lea r8, [rbp + 0x28]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd r14, eax
test eax, eax
jne 0x1400494a2
mov ebx, esi
nop
test r14, r14
jne 0x1400494a2
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x430]
call fcn.140089280
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x230]
call fcn.140089280
mov dword [rbp + 0x18], 0xff
mov dword [rbp + 0x20], esi
lea rax, [rbp + 0x18]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x430]
mov edx, ebx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd r14, eax
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
lea rcx, [rbp + 0x230]
call fcn.140099b40
test eax, eax
jne 0x140049494
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.140089280
mov dword [rbp + 0x18], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x30]
test r15b, 8
je 0x140049485
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004948b
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test r14, r14
je 0x140049634
inc ebx
cmp ebx, 0x1000
jl 0x1400493c0
mov rcx, qword [r12 + 0x10]
lea r14, [0x1400d88e8]
movabs rbx, 0x7ffffffffffffffe
test rcx, rcx
je 0x1400498d0
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x14004a11c
cmp qword [r12 + 0x18], 8
jb 0x1400494dd
mov r12, qword [r12]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
mov r9, r12
lea rcx, [rbp - 0x58]
call fcn.14001ba4c
nop
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rbp - 0x58]
call fcn.1400093cc
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14004957e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049571
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a134
call fcn.14006a754
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x1400495c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400495c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a13a
call fcn.14006a754
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400498d0
lea rax, [rbp - 0x28]
cmp rdi, rax
je 0x14004a0a5
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rdi + 0x18]
mov r12, qword [rbp - 0x18]
cmp r12, r15
jbe 0x140049f20
cmp r12, rbx
ja 0x14004a0fe
mov rcx, r12
or rcx, 7
cmp rcx, rbx
jbe 0x14004981f
mov rcx, 0xfffffffffffffffe
jmp 0x14004986a
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140006890
nop
mov r8d, 1
lea rdx, [0x1400d88e8]
lea rcx, [rsp + 0x68]
call fcn.1400093cc
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp + 0x230]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400496a4
lea rdx, [rbp + 0x230]
lea rcx, [rsp + 0x40]
call fcn.1400093cc
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp - 0x58]
cmp rdi, rax
je 0x14004973f
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140049736
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140049729
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a122
mov rcx, r8
call fcn.14006a754
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
jmp 0x140049780
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140049780
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004977a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a122
call fcn.14006a754
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400497c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400497bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a128
call fcn.14006a754
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004a0a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049815
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a12e
call fcn.14006a754
jmp 0x14004a0a5
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
jbe 0x140049839
mov rcx, 0xfffffffffffffffe
jmp 0x14004986a
lea rax, [rdx + r15]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14004a0f8
add rcx, rcx
cmp rcx, 0x1000
jb 0x140049896
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004a0f8
mov rcx, rax
call fcn.14006a75c
test rax, rax
je 0x14004a176
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400498a8
test rcx, rcx
je 0x1400498a5
call fcn.14006a75c
mov r14, rax
jmp 0x1400498a8
mov r14, rsi
mov rax, qword [rsp + 0x60]
mov qword [rax], r12
mov qword [rdi + 0x18], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.140088e50
mov word [rbx + r14], si
jmp 0x140049b4b
mov r8d, dword [r13 + 8]
lea rdx, [rbp - 0x58]
call fcn.14004a710
nop
mov r8d, 1
mov rdx, r14
mov rcx, rax
call fcn.1400093cc
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rsp + 0x40]
call fcn.1400093cc
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14004999b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004998e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a140
call fcn.14006a754
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400499e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400499e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a146
call fcn.14006a754
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140049a38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049a33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a14c
call fcn.14006a754
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140049b8e
lea rax, [rbp - 0x28]
cmp rdi, rax
je 0x14004a0a5
mov r12, qword [rbp - 0x18]
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rdi + 0x18]
cmp r12, r15
jbe 0x140049f20
cmp r12, rbx
ja 0x14004a0fe
mov rcx, r12
or rcx, 7
cmp rcx, rbx
jbe 0x140049a9f
mov rcx, 0xfffffffffffffffe
jmp 0x140049aea
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
jbe 0x140049ab9
mov rcx, 0xfffffffffffffffe
jmp 0x140049aea
lea rax, [r15 + rdx]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14004a0f8
add rcx, rcx
cmp rcx, 0x1000
jb 0x140049b16
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004a0f8
mov rcx, rax
call fcn.14006a75c
test rax, rax
je 0x14004a176
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140049b28
test rcx, rcx
je 0x140049b25
call fcn.14006a75c
mov r14, rax
jmp 0x140049b28
mov r14, rsi
mov qword [rdi + 0x18], rbx
mov rax, qword [rsp + 0x60]
lea rbx, [r12 + r12]
mov qword [rax], r12
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.140088e50
mov word [r14 + rbx], si
cmp r15, 8
jb 0x140049b86
lea rdx, [r15*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x140049b81
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a176
mov rcx, r8
call fcn.14006a754
mov qword [rdi], r14
jmp 0x14004a0a5
mov edx, 0x1000
lea rcx, [rbp + 0x630]
test r15b, 8
je 0x140049ba8
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140049bae
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x68]
call fcn.140006890
nop
mov r8d, 1
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.1400093cc
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rsp + 0x40]
call fcn.1400093cc
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140049c91
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049c84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a152
call fcn.14006a754
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140049cdb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049cd6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a158
call fcn.14006a754
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140049d2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049d2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a15e
call fcn.14006a754
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400495e3
mov edx, 0x1000
lea rcx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x68]
call fcn.140006890
nop
mov r8d, 1
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.1400093cc
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rsp + 0x40]
call fcn.1400093cc
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140049e41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049e34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a164
call fcn.14006a754
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140049e8b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049e86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a16a
call fcn.14006a754
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140049edf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049eda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a170
call fcn.14006a754
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140049f5a
lea rax, [rbp - 0x28]
cmp rdi, rax
je 0x14004a0a5
mov r12, qword [rbp - 0x18]
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rdi + 0x18]
cmp r12, r15
ja 0x140049f4c
cmp r15, 8
jb 0x140049f29
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.140088e50
mov word [rbx + rdi], si
jmp 0x14004a0a5
cmp r12, rbx
ja 0x14004a0fe
jmp 0x140049a8a
lea rdx, [rbp + 0x630]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x40]
call fcn.1400045e8
nop
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000812c
nop
lea r8, [rbp - 8]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14001b398
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004580
lea rcx, [rbp - 0x58]
call fcn.140004090
nop
lea rcx, [rsp + 0x68]
call fcn.140004090
nop
lea rcx, [rsp + 0x40]
call fcn.140004090
lea rcx, [rbp - 0x28]
call fcn.140025190
test al, al
jne 0x14004a0b0
mov r8d, 0x1000
lea rdx, [rbp + 0x630]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x30]
lea rdx, [0x1400d98e8]
lea rcx, [rbp + 0x630]
call fcn.14009a02c
test rax, rax
je 0x14004a0a0
nop word [rax + rax]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400045e8
nop
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000812c
nop
lea r8, [rbp - 8]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14001b398
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004580
lea rcx, [rbp - 0x58]
call fcn.140004090
nop
lea rcx, [rsp + 0x68]
call fcn.140004090
nop
lea rcx, [rsp + 0x40]
call fcn.140004090
lea rcx, [rbp - 0x28]
call fcn.140025190
test al, al
jne 0x14004a0b0
lea r8, [rbp - 0x30]
lea rdx, [0x1400d98e8]
mov rcx, qword [rbp - 0x30]
call fcn.14009a02c
test rax, rax
jne 0x14004a020
mov esi, 0xc0000225
lea rcx, [rbp + 0x28]
call fcn.140026e80
jmp 0x14004a0c0
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.14001725c
jmp 0x14004a0a5
mov esi, edx
lea rcx, [rbp - 8]
call fcn.140004090
nop
lea rcx, [rbp - 0x28]
call fcn.140004090
mov eax, esi
mov rcx, qword [rbp + 0x2630]
xor rcx, rsp
call fcn.14006a730
add rsp, 0x2748
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001300
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140001300
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
nop
call fcn.140097d64
int3
call fcn.140097d64
int3