Function at 0x1400107a0
Capabilities:
Check if file exists
Encode data using xor
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2738]
mov eax, 0x2838
call fcn.140012f10
sub rsp, rax
movaps xmmword [rsp + 0x2820], xmm6
movaps xmmword [rsp + 0x2810], xmm7
mov rax, qword [0x140035040]
xor rax, rsp
mov qword [rbp + 0x2700], rax
mov qword [rbp - 0x80], r9
mov rsi, r8
mov r14, rdx
mov r13, rcx
mov rax, qword [rbp + 0x27a8]
mov qword [rbp + 0x48], rax
mov r12, qword [rbp + 0x27b0]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x700]
call fcn.140023250
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], bx
movups xmm2, xmmword [r14]
movups xmmword [rsp + 0x60], xmm2
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rdi, [rsp + 0x60]
movq r8, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rdx, xmm0
cmp rdx, 7
cmova rdi, r8
lea rcx, [rsp + 0x60]
cmova rcx, r8
movq rax, xmm1
lea r15, [rcx + rax*2]
lea rbx, [rsp + 0x60]
cmova rbx, r8
cmp rbx, r15
je 0x1400108bf
sub rdi, rbx
nop
movzx ecx, word [rbx]
call fcn.140018eac
mov word [rbx + rdi], ax
add rbx, 2
cmp rbx, r15
jne 0x1400108a0
movups xmm1, xmmword [rsp + 0x70]
movups xmm2, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x28], xmm2
movups xmmword [rbp + 0x38], xmm1
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
lea rdx, [rbp + 0x28]
mov rcx, r14
call fcn.140008c30
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x14001092a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010925
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119bd
call fcn.140012d84
mov rdx, r14
lea rcx, [rbp - 0x78]
call fcn.140001e00
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rdi, 0xffffffffffffffff
mov rdx, rax
cmp qword [rax + 0x10], 0
jne 0x14001095d
lea rcx, [rbp - 0x18]
call fcn.140001e00
jmp 0x140010ab8
lea rcx, [rbp + 0x58]
call fcn.140001e00
nop
lea rdx, [rbp + 0x58]
mov r10, qword [rbp + 0x58]
mov r11, qword [rbp + 0x70]
cmp r11, 7
cmova rdx, r10
mov r9, qword [rbp + 0x68]
test r9, r9
je 0x1400109bb
lea rcx, [r9 - 1]
mov rax, rdi
cmp rcx, rdi
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x1400109af
nop dword [rax]
cmp rcx, rdx
je 0x1400109bb
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x1400109a0
sub rcx, rdx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
jne 0x140010a13
lea rdx, [rbp + 0x58]
cmp r11, 7
cmova rdx, r10
test r9, r9
je 0x140010a97
lea rcx, [r9 - 1]
mov rax, rdi
cmp rcx, rdi
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2f
je 0x140010a03
nop dword [rax + rax]
cmp rcx, rdx
je 0x140010a97
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x1400109f0
sub rcx, rdx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x140010a97
inc rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r15
mov qword [rbp], r15
cmp r9, rcx
jb 0x1400119c3
sub r9, rcx
mov r8, rdi
cmp r9, rdi
cmovb r8, r9
lea rax, [rbp + 0x58]
cmp r11, 7
cmova rax, r10
lea rdx, [rax + rcx*2]
lea rcx, [rbp - 0x18]
call fcn.140001190
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x140010aa7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119c9
call fcn.140012d84
jmp 0x140010aa7
movups xmm0, xmmword [rbp + 0x58]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rbp + 0x68]
movups xmmword [rbp - 8], xmm1
mov word [rbp + 0x58], r15w
mov qword [rbp + 0x70], 7
mov qword [rbp + 0x68], r15
mov rcx, rbx
call fcn.1400035b0
nop
cmp dword [0x140036020], 0x64
jae 0x140010ba2
lea r10, [rbp - 0x18]
cmp qword [rbp], 7
cmova r10, qword [rbp - 0x18]
mov rbx, qword [rbp - 8]
cmp rbx, 7
jb 0x140010ba2
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, str.ext_ms_
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, r15
je 0x140010b26
cmp word [rcx], 0x65
je 0x140010b23
cmp rax, 1
je 0x140010b26
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x140010b10
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140010ba2
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, str.ext_ms_
sub r9, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140010c39
add rdx, 2
sub r8, 1
jne 0x140010b50
sub rcx, r10
sar rcx, 1
jne 0x140010ba2
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rcx, qword [rbp - 0x18]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.140022bb0
mov qword [rbp - 8], rbx
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x140010eaf
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140010bc0
mov rdx, qword [rdx]
xor r8d, r8d
lea rcx, [rbp - 0x18]
call fcn.140011a60
cmp rax, 0xffffffffffffffff
jne 0x140010bda
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x140010bb2
cmp rbx, r15
je 0x140010eaf
mov rdx, qword [rbx + 0x30]
mov r8, qword [rbx + 0x38]
cmp rdx, r8
je 0x140010c5b
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 7
jbe 0x140010bfe
mov rsi, qword [rsi]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140010c0c
mov rdx, qword [rdx]
cmp rcx, rax
jne 0x140010c42
test rcx, rcx
je 0x140010c33
sub rdx, rsi
nop dword [rax]
movzx eax, word [rdx + rsi]
cmp ax, word [rsi]
jne 0x140010c42
add rsi, 2
sub rcx, 1
jne 0x140010c20
lea rdx, [r8 - 0x20]
jmp 0x140010c46
add rcx, 2
jmp 0x140010af5
mov rdx, qword [rbx + 0x30]
cmp r14, rdx
je 0x140010c79
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140010c71
mov rdx, qword [rdx]
jmp 0x140010c71
cmp r14, rsi
je 0x140010c79
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 7
jbe 0x140010c6e
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, r14
call fcn.140003790
mov r8, r12
mov rdx, r14
mov rcx, r13
call fcn.140010510
mov ebx, eax
test eax, eax
jns 0x1400118f2
cmp eax, 0xc015001d
je 0x1400118f2
test byte [rbp + 0x27a0], 2
je 0x140010ea8
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x100]
call fcn.140023250
mov edx, 0xff
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
lea rax, [rbp + 0x100]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140010ce5
mov r8, rdi
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 8]
call fcn.140001190
nop
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x20]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140010d39
lea rax, [rcx + 1]
mov qword [rbp + 0x18], rax
lea rax, [rbp + 8]
cmp rdx, 7
cmova rax, qword [rbp + 8]
mov dword [rax + rcx*2], 0x5c
lea rax, [rbp + 8]
jmp 0x140010d5a
mov qword [rsp + 0x20], 1
lea r9, [0x140026958]
xor r8d, r8d
mov edx, 1
lea rcx, [rbp + 8]
call fcn.1400014a0
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x140010d96
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp - 0x38]
call fcn.140003710
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rbp + 0x28]
mov rcx, r14
call fcn.140008c30
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140010e0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010e08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119cf
call fcn.140012d84
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x140010e4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010e49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119d5
call fcn.140012d84
movdqa xmm0, xmmword [0x140026700]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], bx
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x1400118f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010e9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119db
call fcn.140012d84
jmp 0x1400118f2
xor ebx, ebx
jmp 0x1400118f2
mov r15d, dword [rbp + 0x27a0]
test r15b, 1
jne 0x1400118ed
mov r8, r12
mov rdx, r14
mov rcx, r13
call fcn.140010510
mov ebx, eax
test eax, eax
jns 0x1400118f2
cmp eax, 0xc015001d
je 0x1400118f2
test r15b, 4
jne 0x1400118ed
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x140010efa
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140010f10
xor r12d, r12d
mov ebx, r12d
jmp 0x1400118f5
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.140010090
xor r12d, r12d
mov edx, r12d
nop word [rax + rax]
movsx ecx, byte [rax]
xor word [rax + rdx + 2], cx
movsx ecx, byte [rax]
xor word [rax + rdx + 4], cx
add rdx, 4
cmp rdx, 0x74
jb 0x140010f30
mov word [rax + 0x76], r12w
lea r8, [rsp + 0x58]
lea rdx, [rax + 2]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rsi, eax
test eax, eax
jne 0x140011063
mov ebx, r12d
test rsi, rsi
jne 0x140011063
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x500]
call fcn.140023250
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x300]
call fcn.140023250
mov dword [rsp + 0x44], 0xff
mov dword [rsp + 0x48], r12d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x300]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x44]
lea r8, [rbp + 0x500]
mov edx, ebx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rsi, eax
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x300]
call fcn.140019824
test eax, eax
jne 0x140011055
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x100]
call fcn.140023250
mov dword [rsp + 0x44], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x100]
test r15b, 8
je 0x140011046
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14001104c
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rsi, rsi
je 0x14001118a
inc ebx
cmp ebx, 0x1000
jl 0x140010f73
mov rax, qword [rbp - 0x80]
cmp qword [rax + 0x10], r12
je 0x140011132
lea r8, [0x140026958]
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.14000f420
nop
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
mov rcx, rax
call fcn.140003710
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x1400110f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400110f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119e1
call fcn.140012d84
movups xmmword [rbp - 0x58], xmm6
movups xmmword [rbp - 0x48], xmm7
mov r8, qword [rbp + 0x40]
cmp r8, 7
jbe 0x140011115
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x28]
call fcn.1400032c0
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400116bb
mov rcx, qword [rbp + 0x48]
call fcn.140006e00
mov r8d, eax
lea rdx, [rbp + 0x28]
mov rcx, r13
call fcn.140010190
mov rcx, rax
mov r8, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, r8
cmp rax, 1
jb 0x140011228
lea r9, [r8 + 1]
mov qword [rcx + 0x10], r9
mov rax, rcx
cmp rdx, 7
jbe 0x140011179
mov rax, qword [rcx]
mov word [rax + r8*2], 0x5c
mov word [rax + r9*2], r12w
jmp 0x140011248
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
lea rax, [rbp + 0x100]
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x1400111a0
mov r8, rdi
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x38]
call fcn.140001190
nop
lea r8, [0x140026958]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 8]
call fcn.14000f3b0
nop
lea r8, [rbp + 0x300]
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.14000f3b0
mov rdx, rax
mov rcx, r14
call fcn.140008c30
lea rcx, [rbp + 0x28]
call fcn.1400035b0
nop
lea rcx, [rbp + 8]
call fcn.1400035b0
nop
mov r8, qword [rbp - 0x20]
cmp r8, 7
jbe 0x1400116de
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.1400032c0
mov ebx, r12d
jmp 0x1400118f5
mov qword [rsp + 0x20], 1
lea r9, [0x140026958]
xor r8d, r8d
mov edx, 1
call fcn.1400014a0
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 7
mov word [rcx], r12w
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
lea rcx, [rbp - 0x38]
call fcn.140003710
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x1400112e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400112e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119e7
call fcn.140012d84
movups xmmword [rbp - 0x58], xmm6
movups xmmword [rbp - 0x48], xmm7
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x140011330
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001132b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119ed
call fcn.140012d84
movdqa xmm0, xmmword [0x140026700]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], r12w
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140011382
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001137d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119f3
call fcn.140012d84
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400116bb
mov edx, 0x1000
lea rcx, [rbp + 0x700]
test r15b, 8
je 0x1400113b9
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x1400113bf
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
lea rax, [rbp + 0x700]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400113e0
lea rdx, [rbp + 0x700]
lea rcx, [rbp - 0x38]
call fcn.140001190
nop
lea r8, [0x140026958]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 8]
call fcn.14000f3b0
nop
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
mov rcx, rax
call fcn.140003710
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x140011482
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001147d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119f9
call fcn.140012d84
movups xmmword [rbp - 0x58], xmm6
movups xmmword [rbp - 0x48], xmm7
mov r8, qword [rbp + 0x20]
cmp r8, 7
jbe 0x1400114a1
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 8]
call fcn.1400032c0
movdqa xmm0, xmmword [0x140026700]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r12w
mov r8, qword [rbp - 0x20]
cmp r8, 7
jbe 0x1400114ca
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.1400032c0
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400116bb
mov edx, 0x1000
lea rcx, [rbp + 0x700]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
lea rax, [rbp + 0x700]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140011512
lea rdx, [rbp + 0x700]
lea rcx, [rbp - 0x38]
call fcn.140001190
nop
lea r8, [0x140026958]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 8]
call fcn.14000f3b0
nop
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
mov rcx, rax
call fcn.140003710
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x58]
call fcn.140008c30
lea rcx, [rbp + 0x28]
call fcn.1400035b0
nop
lea rcx, [rbp + 8]
call fcn.1400035b0
nop
mov r8, qword [rbp - 0x20]
cmp r8, 7
jbe 0x1400115b4
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.1400032c0
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400116bb
lea rdx, [rbp + 0x700]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
lea rax, [rbp + 0x700]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140011600
lea rdx, [rbp + 0x700]
lea rcx, [rbp - 0x38]
call fcn.140001190
nop
lea r8, [0x140026958]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 8]
call fcn.14000f3b0
nop
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
mov rcx, rax
call fcn.140003710
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x58]
call fcn.140008c30
lea rcx, [rbp + 0x28]
call fcn.1400035b0
nop
lea rcx, [rbp + 8]
call fcn.1400035b0
nop
mov r8, qword [rbp - 0x20]
cmp r8, 7
jbe 0x1400116a2
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.1400032c0
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400116e6
lea rax, [rbp - 0x58]
cmp r14, rax
je 0x1400116de
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
mov rcx, r14
call fcn.140003790
mov ebx, r12d
jmp 0x1400118f5
mov cl, 0x7a
mov word [rbp + 0x48], 0x7a
movsx ecx, cl
movzx eax, cx
xor ax, 0x2a
mov word [rbp + 0x4a], ax
movzx eax, cx
xor ax, 0x3b
mov word [rbp + 0x4c], ax
movzx eax, cx
xor ax, 0x2e
mov word [rbp + 0x4e], ax
xor cx, 0x32
mov word [rbp + 0x50], cx
mov word [rbp + 0x52], r12w
mov r8d, 0x1000
lea rdx, [rbp + 0x700]
lea rcx, [rbp + 0x4a]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rsp + 0x50]
lea rdx, [0x14002695c]
lea rcx, [rbp + 0x700]
call fcn.1400197ac
test rax, rax
je 0x1400118e6
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r12
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140011772
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.140001190
nop
mov r8d, 1
lea rdx, [0x140026958]
lea rcx, [rbp - 0x38]
call fcn.140003710
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
lea rcx, [rbp + 8]
call fcn.140003710
movups xmm6, xmmword [rax]
movups xmmword [rbp + 0x28], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm7
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x140011848
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011843
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119ff
call fcn.140012d84
movups xmmword [rbp - 0x58], xmm6
movups xmmword [rbp - 0x48], xmm7
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r12w
lea rcx, [rbp + 0x28]
call fcn.1400035b0
nop
mov r8, qword [rbp + 0x20]
cmp r8, 7
jbe 0x140011882
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 8]
call fcn.1400032c0
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r12w
mov r8, qword [rbp - 0x20]
cmp r8, 7
jbe 0x1400118aa
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.1400032c0
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400116bb
lea r8, [rsp + 0x50]
lea rdx, [0x14002695c]
mov rcx, qword [rsp + 0x50]
call fcn.1400197ac
test rax, rax
jne 0x140011760
mov ebx, 0xc0000225
jmp 0x1400118f5
mov ebx, 0xc0000225
xor r12d, r12d
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x140011935
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011930
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a05
call fcn.140012d84
mov qword [rbp - 8], r12
mov qword [rbp], 7
mov word [rbp - 0x18], r12w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x140011982
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001197d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400119b7
call fcn.140012d84
mov eax, ebx
mov rcx, qword [rbp + 0x2700]
xor rcx, rsp
call fcn.140012ea0
movaps xmm6, xmmword [rsp + 0x2820]
movaps xmm7, xmmword [rsp + 0x2810]
add rsp, 0x2838
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140018ca4
nop
call fcn.140018ca4
nop
call fcn.140003660
nop
call fcn.140018ca4
nop
call fcn.140018ca4
nop
call fcn.140018ca4
nop
call fcn.140018ca4
nop
call fcn.140018ca4
nop
call fcn.140018ca4
nop
call fcn.140018ca4
nop
call fcn.140018ca4
nop
call fcn.140018ca4
nop
call fcn.140018ca4
nop
call fcn.140018ca4
int3