Function at 0x1403d5bf0
Capabilities:
Get common file path
Identify system language via api
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
mov eax, 0x4538
call fcn.14043da60
sub rsp, 0x4538
mov r12, rdx
xor r9d, r9d
xor edx, edx
mov rax, qword [0x14194d6d8]
xor dil, dil
xor rax, rsp
mov r15, rcx
mov qword [rsp + 0x4528], rax
mov rcx, r12
xor r8d, r8d
xor r13b, r13b
mov dword [rsp + 0xa0], r9d
mov dword [rsp + 0x68], r9d
mov dword [rsp + 0xa8], r9d
mov dword [rsp + 0x98], r9d
mov dword [rsp + 0x78], r9d
mov byte [rsp + 0x80], dil
mov dword [rsp + 0x90], r9d
mov dword [rsp + 0x88], r9d
mov byte [rsp + 0x70], r13b
call fcn.1403d1590
mov r14, qword [r15 + 0x40]
xor esi, esi
cmp qword [r15 + 0xd0], 0
mov rbx, qword [r15 + 0xb0]
mov ebp, dword [r15 + 0x60]
lea r8, [rsp + 0x60]
mov eax, dword [r15 + 0x48]
mov qword [r8 + 0x50], r14
mov r14d, esi
mov qword [r8 + 0x68], rbx
setne r14b
mov ecx, 0x1001
mov edx, 1
mov dword [r8 + 0x70], esi
mov rbx, qword [r15 + 0x58]
mov dword [r8 - 0x20], ebp
mov bpl, 1
mov dword [r8 + 0x60], eax
mov dword [r8 + 0x74], 0x5c3f5c5c
mov byte [r8 + 0x78], sil
mov byte [r8 + 0x58], 0
call fcn.14035a450
test eax, eax
jne 0x1403d6113
mov ecx, 0x1001
mov edx, 1
lea r8, [rsp + 0x58]
call fcn.14035a450
test eax, eax
jne 0x1403d6101
mov ecx, 0x1001
mov edx, 1
lea r8, [rsp + 0x50]
call fcn.14035a450
test eax, eax
jne 0x1403d726a
cmp qword [rsp + 0xc8], 3
je 0x1403d7213
mov r8d, dword [r12 + 0x1e0]
cmp r8d, 0xfffffffc
je 0x1403d7207
cmp r8d, 0xfffffffd
je 0x1403d5d67
cmp r8d, 0xfffffffe
jne 0x1403d5d54
lea rcx, str.FOR_TYPE
jmp 0x1403d5d6e
xor ecx, ecx
cmp r8d, 0xffffffff
lea rax, str.FOR_PRINT
cmove rcx, rax
jmp 0x1403d5d6e
lea rcx, str.FOR_ACCEPT
test byte [r12 + 0x299], 4
je 0x1403d5d88
test byte [r12 + 0x290], 1
je 0x1403d5e81
test rcx, rcx
je 0x1403d5e81
mov rdx, qword [rsp + 0x58]
mov r8d, 0x1001
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edx, [rax - 1]
cmp edx, 0xfff
ja 0x1403d5dc3
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0xd0], eax
jmp 0x1403d5f05
mov edx, dword [r12 + 0x1e0]
add edx, 4
cmp edx, 0xa
ja 0x1403d5e40
lea rbx, [0x140000000]
movzx eax, byte [rbx + rdx + 0x59f1fc]
lea rax, [rbx + rax + 0x3d5dec]
jmp rax
xor ebx, ebx
mov rdx, rbx
mov qword [rsp + 0x48], rbx
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d5e72
mov rax, rdx
add rdx, rcx
call fcn.14042af70
mov dword [rsp + 0xd0], eax
xor bpl, bpl
jmp 0x1403d5f05
test rbx, rbx
je 0x1403d704a
mov esi, dword [rsp + 0x40]
cmp byte [rbx], 0x20
jne 0x1403d5ea1
test esi, esi
jle 0x1403d5ec0
inc rbx
dec esi
cmp byte [rbx], 0x20
je 0x1403d5e93
movsxd rax, esi
test esi, esi
jle 0x1403d5ec0
movsx r8d, byte [rax + rbx - 1]
test r8d, 0xffffffdf
jne 0x1403d5ec0
dec esi
dec rax
test esi, esi
jg 0x1403d5ea8
mov r8d, 0x1000
cmp esi, 0x1000
mov rdx, rbx
cmovle r8d, esi
mov dword [rsp + 0xd0], r8d
movsxd r8, r8d
mov rcx, qword [rsp + 0x50]
call fcn.14042ae90
mov eax, dword [rsp + 0xd0]
movsxd rax, eax
mov rdx, qword [rsp + 0x50]
mov byte [rax + rdx], 0
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x48], rbx
cmp byte [rbx], 0x20
jne 0x1403d5f36
test eax, eax
jle 0x1403d5f5c
inc rbx
dec eax
cmp byte [rbx], 0x20
jne 0x1403d5f2a
test eax, eax
jle 0x1403d7033
inc rbx
dec eax
cmp byte [rbx], 0x20
je 0x1403d5f18
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0xd0], eax
movsxd r8, eax
test eax, eax
jle 0x1403d5f5c
movsx r9d, byte [r8 + rbx - 1]
test r9d, 0xffffffdf
jne 0x1403d5f86
dec eax
dec r8
mov dword [rsp + 0xd0], eax
test eax, eax
jg 0x1403d5f3d
jne 0x1403d5f86
test byte [r12 + 0x299], 4
je 0x1403d5f86
mov rcx, r12
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0xd0]
call fcn.1403d73d0
test eax, eax
jne 0x1403d700c
test r14d, r14d
jne 0x1403d5fd7
mov rbx, qword [rsp + 0x48]
mov rax, rbx
mov edx, 4
lea rcx, [rsp + 0xd4]
call fcn.14042b020
test eax, eax
jne 0x1403d73c1
mov byte [rsp + 0xb8], 1
cmp esi, 0x1000
jg 0x1403d6964
xor sil, sil
test bpl, bpl
je 0x1403d609c
movsxd r8, dword [rsp + 0xd0]
jmp 0x1403d600b
je 0x1403d5fec
cmp esi, 0x1000
jg 0x1403d6964
test bpl, bpl
jne 0x1403d5ffe
jmp 0x1403d5ff1
test bpl, bpl
jne 0x1403d5ffe
mov rbx, qword [rsp + 0x48]
xor sil, sil
jmp 0x1403d609c
movsxd r8, dword [rsp + 0xd0]
mov rbx, qword [rsp + 0x48]
mov rcx, r12
mov rdx, rbx
mov byte [rbx + r8], 0
xor sil, sil
call fcn.14036dc10
cmp eax, 0xffffffff
je 0x1403d69a3
xor bpl, bpl
cmp eax, 1
je 0x1403d603d
cmp eax, 0xfffffffa
jne 0x1403d6057
cmp dword [0x141a6ae3c], 0
jne 0x1403d6057
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [r12 + 0x1a0], rax
mov rbx, qword [rsp + 0x48]
jmp 0x1403d609c
test eax, eax
jne 0x1403d6075
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [r12 + 0x1a0], rax
mov rbx, qword [rsp + 0x48]
jmp 0x1403d609c
cmp eax, 2
jne 0x1403d6094
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [r12 + 0x1a0], rax
mov rbx, qword [rsp + 0x48]
jmp 0x1403d609c
mov rbx, qword [rsp + 0x48]
mov sil, 1
mov rcx, rbx
lea rdx, [rsp + 0x4420]
test cl, 3
je 0x1403d60bf
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x1403d60c4
inc rdx
test cl, 3
jne 0x1403d60ac
call fcn.1404318f0
cmp dword [0x141a6ae3c], 0
je 0x1403d60e1
test bpl, bpl
jne 0x1403d60e1
cmp qword [r12 + 0x1a0], 0xffffffffffffffff
je 0x1403d6989
mov rcx, qword [rsp + 0x58]
call fcn.14035a530
mov rcx, qword [rsp + 0x60]
call fcn.14035a530
mov rcx, qword [rsp + 0x50]
call fcn.14035a530
jmp 0x1403d611b
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x40], eax
call fcn.14035a530
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x1403d692c
mov rax, qword [r15]
cmp rax, 5
ja 0x1403d68de
mov edx, eax
lea rbx, [0x140000000]
movzx eax, byte [rbx + rdx + 0x59f208]
lea rax, [rbx + rax + 0x3d6143]
jmp rax
or byte [r12 + 0x299], 2
mov rbx, qword [r12 + 0xd8]
test ebp, ebp
je 0x1403d6680
test byte [r12 + 0x298], 0x80
je 0x1403d6680
or byte [r12 + 0x292], 8
mov rcx, r12
xor edx, edx
and byte [r12 + 0x295], 0x7f
call fcn.14036eff0
and byte [r12 + 0x299], 0xfd
mov qword [r12 + 0xd8], rbx
cmp dword [0x141a6ae3c], 0
je 0x1403d66c1
test byte [r12 + 0x298], 0x80
je 0x1403d66c1
and byte [r12 + 0x292], 0xf7
mov edx, 0xffffffff
test eax, eax
mov rcx, qword [rsp + 0x4528]
mov qword [rsp + 0x4528], 0
cmove eax, edx
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403d7287
add rsp, 0x4538
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test byte [r12 + 0x290], 4
je 0x1403d6769
mov eax, dword [rsp + 0xa0]
cmp eax, dword [r12 + 0x238]
je 0x1403d6769
cmp qword [r15 + 0x68], 0
jne 0x1403d672c
cmp qword [r15], 0
je 0x1403d6769
mov rcx, qword [rsp + 0x4528]
mov qword [rsp + 0x4528], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403d7287
mov eax, 0x230
add rsp, 0x4538
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp dword [0x141a6ae3c], 0
je 0x1403d67a5
test byte [r12 + 0x298], 0x80
je 0x1403d67a5
cmp qword [r15 + 0x108], 0
je 0x1403d67a5
cmp qword [r15 + 0x110], 0
je 0x1403d679c
or byte [r12 + 0x299], 1
jmp 0x1403d67a5
and byte [r12 + 0x299], 0xfe
mov rcx, qword [rsp + 0x4528]
mov qword [rsp + 0x4528], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403d7287
xor eax, eax
add rsp, 0x4538
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x23c
mov eax, 0x30
test byte [r12 + 0x290], 0x20
mov rcx, qword [rsp + 0x4528]
mov qword [rsp + 0x4528], 0
cmovne eax, edx
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403d7287
add rsp, 0x4538
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x4528]
mov qword [rsp + 0x4528], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403d7287
add rsp, 0x4538
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x58]
call fcn.14035a530
mov rcx, qword [rsp + 0x60]
call fcn.14035a530
mov rcx, qword [rsp + 0x50]
call fcn.14035a530
mov eax, 0x311
jmp 0x1403d692c
test sil, sil
jne 0x1403d60e1
mov qword [r12 + 0x1a0], 0
jmp 0x1403d60e1
mov al, byte [rsp + 0xb8]
test al, al
jne 0x1403d7002
test byte [r12 + 0x299], 8
jne 0x1403d69ce
cmp qword [rsp + 0xb0], 0
je 0x1403d6ca1
jmp 0x1403d69dd
cmp qword [rsp + 0xb0], 0
je 0x1403d6fe8
mov rbx, qword [rsp + 0xb0]
cmp byte [rbx], 0x20
jne 0x1403d6a0a
mov ebp, dword [rsp + 0xc0]
test ebp, ebp
jle 0x1403d6fdc
inc rbx
dec ebp
cmp byte [rbx], 0x20
je 0x1403d69f1
mov dword [rsp + 0xc0], ebp
mov ebp, dword [rsp + 0xc0]
movsxd rbp, ebp
test ebp, ebp
jle 0x1403d6a40
mov r8d, dword [rsp + 0xc0]
movsx esi, byte [rbp + rbx - 1]
test esi, 0xffffffdf
jne 0x1403d6a38
dec r8d
dec rbp
test r8d, r8d
jg 0x1403d6a20
mov dword [rsp + 0xc0], r8d
test r14d, r14d
jne 0x1403d6a6c
mov rax, rbx
lea rcx, [rsp + 0xd4]
mov edx, 4
call fcn.14042b020
test eax, eax
jne 0x1403d73b3
mov byte [rsp + 0xb8], 1
jmp 0x1403d6a6e
je 0x1403d6aa3
cmp dword [rsp + 0xc0], 0x1000
jl 0x1403d6ab4
mov rcx, qword [rsp + 0x58]
call fcn.14035a530
mov rcx, qword [rsp + 0x60]
call fcn.14035a530
mov rcx, qword [rsp + 0x50]
call fcn.14035a530
mov eax, 0x311
jmp 0x1403d692c
cmp dword [rsp + 0xc0], 0x104
jge 0x1403d6c79
movsxd rbp, dword [rsp + 0xc0]
mov rdx, rbx
mov r8, rbp
mov rcx, qword [rsp + 0x60]
call fcn.14042ae90
mov rax, qword [rsp + 0x60]
mov byte [rbp + rax], 0
mov rsi, qword [rsp + 0x60]
test rsi, rsi
je 0x1403d6fc8
cmp byte [rsi], 0x20
jne 0x1403d6b05
mov eax, dword [rsp + 0xc0]
test eax, eax
jle 0x1403d6b2c
inc rsi
dec eax
cmp byte [rsi], 0x20
je 0x1403d6af0
mov dword [rsp + 0xc0], eax
cmp dword [rsp + 0xc0], 0
jle 0x1403d6b33
mov eax, dword [rsp + 0xc0]
movsxd rax, eax
movsx ebx, byte [rsi + rax - 1]
test ebx, 0xffffffdf
jne 0x1403d6b2c
dec eax
test eax, eax
jg 0x1403d6b16
mov dword [rsp + 0xc0], eax
cmp qword [rsp + 0xc8], 3
je 0x1403d6e1e
test rsi, rsi
je 0x1403d6b76
mov al, byte [rsp + 0xb8]
test al, al
je 0x1403d6b62
movsxd rax, dword [rsp + 0xc0]
cmp byte [rax + rsi], 0x5c
je 0x1403d6b87
jmp 0x1403d6b76
movsxd rax, dword [rsp + 0xc0]
mov al, byte [rax + rsi - 1]
cmp al, 0x2f
je 0x1403d6b87
cmp al, 0x5c
je 0x1403d6b87
cmp dword [rsp + 0xc0], 0
jle 0x1403d6b87
mov ebp, 1
jmp 0x1403d6b89
xor ebp, ebp
test r14d, r14d
jne 0x1403d6b99
mov al, byte [rsp + 0xb8]
test al, al
je 0x1403d6bd8
mov eax, dword [rsp + 0xc0]
add eax, dword [rsp + 0xd0]
add eax, ebp
cmp eax, 0x1000
jle 0x1403d6bef
mov rcx, qword [rsp + 0x58]
call fcn.14035a530
mov rcx, qword [rsp + 0x60]
call fcn.14035a530
mov rcx, qword [rsp + 0x50]
call fcn.14035a530
mov eax, 0x311
jmp 0x1403d692c
mov eax, dword [rsp + 0xc0]
add eax, dword [rsp + 0xd0]
add eax, ebp
cmp eax, 0x104
jg 0x1403d6c51
movsxd rbx, dword [rsp + 0xc0]
lea rcx, [rsp + 0x4420]
mov rdx, rsi
mov r8, rbx
call fcn.14042ae90
lea rcx, [rsp + rbx + 0x4420]
test ebp, ebp
je 0x1403d6c19
mov byte [rcx], 0x5c
add rcx, rbp
movsxd r8, dword [rsp + 0xd0]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x40], rbp
call fcn.14042ae90
movsxd rax, dword [rsp + 0xd0]
add rbx, qword [rsp + 0x40]
lea rdx, [rsp + rax + 0x4420]
mov byte [rbx + rdx], 0
jmp 0x1403d60e1
mov rcx, qword [rsp + 0x58]
call fcn.14035a530
mov rcx, qword [rsp + 0x60]
call fcn.14035a530
mov rcx, qword [rsp + 0x50]
call fcn.14035a530
mov eax, 0x302
jmp 0x1403d692c
mov rcx, qword [rsp + 0x58]
call fcn.14035a530
mov rcx, qword [rsp + 0x60]
call fcn.14035a530
mov rcx, qword [rsp + 0x50]
call fcn.14035a530
mov eax, 0x302
jmp 0x1403d692c
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp eax, 0x411
jne 0x1403d6d9e
mov rax, rsp
xor ecx, ecx
mov r8, qword [rsp + 0x48]
mov edx, 1
mov r9d, 0xffffffff
lea rbx, [rsp + 0xd4]
mov qword [rax + 0x20], rbx
mov dword [rax + 0x28], 0x1001
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
mov edx, 0x1001
xor r9d, r9d
lea r8, [rsp + 0x20d6]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
cmp rax, 0x2002
jae 0x1403d6982
cmp dword [rsp + 0x40], 0
je 0x1403d6e02
cmp rax, 0x1001
jae 0x1403d6e02
mov rsi, rsp
xor ecx, ecx
xor ebx, ebx
xor edx, edx
mov rax, qword [rsp + 0x60]
lea r8, [rsp + 0x20d6]
mov r9d, 0xffffffff
mov qword [rsi + 0x20], rax
mov dword [rsi + 0x28], 0x1000
mov qword [rsi + 0x30], rbx
mov qword [rsi + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [rsp + 0xd0]
neg ebx
add ebx, dword [rsp + 0x40]
dec ebx
movsxd rbx, ebx
test rbx, rbx
jle 0x1403d6e02
mov rax, qword [rsp + 0x60]
xor edx, edx
test byte [rdx + rax], 0x80
jne 0x1403d6e02
inc rdx
cmp rdx, rbx
jl 0x1403d6d7e
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xd0], eax
jmp 0x1403d6e02
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
cmp eax, 0x411
je 0x1403d6cb5
mov rcx, qword [rsp + 0x48]
mov edx, 0x1001
mov r8, qword [rsp + 0x60]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov ebp, eax
cmp ebp, 0x1000
ja 0x1403d6982
test ebp, ebp
je 0x1403d6e02
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
mov r8d, ebp
mov edx, 0x3f
call fcn.140441070
test rax, rax
jne 0x1403d6e02
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0xd0], ebp
mov dword [rsp + 0xc0], 0
xor esi, esi
cmp qword [rsp + 0xc8], 3
jne 0x1403d6b87
test byte [r12 + 0x291], 0x20
jne 0x1403d6b42
lea rcx, str.FORT_TMPDIR
lea rdx, [rsp + 0x42e5]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
ja 0x1403d6fb4
mov byte [rsp + 0x42e5], 0
cmp qword [rsp + 0xb0], 0
je 0x1403d6f3b
xor eax, eax
mov dword [rsp + 0x42e0], eax
pxor xmm0, xmm0
mov byte [rsp + 0x42e4], al
mov eax, 0x100
movdqu xmmword [rsp + rax + 0x41d0], xmm0
movdqu xmmword [rsp + rax + 0x41c0], xmm0
movdqu xmmword [rsp + rax + 0x41b0], xmm0
movdqu xmmword [rsp + rax + 0x41a0], xmm0
sub rax, 0x40
jne 0x1403d6e83
mov rcx, rsi
lea rdx, [0x14059f414]
xor r8d, r8d
lea r9, [rsp + 0x41e0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1403d6f13
test byte [r12 + 0x299], 8
lea rcx, [rsp + 0x41e2]
lea rax, [rsp + 0x41e0]
cmove rcx, rax
lea rdx, [rsp + 0x4420]
test cl, 3
je 0x1403d6f09
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x1403d6f0e
inc rdx
test cl, 3
jne 0x1403d6ef6
call fcn.1404318f0
jmp 0x1403d60e1
mov rcx, qword [rsp + 0x58]
call fcn.14035a530
mov rcx, qword [rsp + 0x60]
call fcn.14035a530
mov rcx, qword [rsp + 0x50]
call fcn.14035a530
mov eax, 0x2b
jmp 0x1403d692c
test byte [r12 + 0x299], 8
je 0x1403d6f5f
mov byte [rsp + 0x40d8], 0x2e
lea rsi, [rsp + 0x40d8]
mov byte [rsi + 1], 0
jmp 0x1403d6e6a
test rax, rax
je 0x1403d6f8c
mov r8d, 0x104
lea rcx, [rsp + 0x40d8]
lea rdx, [rsp + 0x42e5]
call fcn.1403815f0
lea rsi, [rsp + 0x40d8]
jmp 0x1403d6e6a
mov ecx, 0x104
lea rdx, [rsp + 0x40d8]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
lea rsi, [rsp + 0x40d8]
cmove rsi, rbx
jmp 0x1403d6e6a
cmp rax, 0x105
jae 0x1403d6e53
inc rax
jmp 0x1403d6e5b
cmp qword [rsp + 0xc8], 3
jne 0x1403d6b76
jmp 0x1403d6e1e
mov dword [rsp + 0xc0], ebp
jmp 0x1403d6a40
cmp qword [rsp + 0xc8], 3
jne 0x1403d7002
test byte [r12 + 0x291], 0x20
je 0x1403d6ca1
mov rbx, qword [rsp + 0x48]
jmp 0x1403d609c
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x40], eax
call fcn.14035a530
mov rcx, qword [rsp + 0x60]
call fcn.14035a530
mov rcx, qword [rsp + 0x50]
call fcn.14035a530
jmp 0x1403d610f
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0xd0], eax
je 0x1403d5f5e
jmp 0x1403d5f86
lea rdx, str.FORT_d
mov rcx, qword [rsp + 0x50]
call fcn.14036c680
mov rdx, qword [rsp + 0x58]
mov r8d, 0x1001
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rdx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
ja 0x1403d71de
cmp qword [rsp + 0x40], 0
je 0x1403d7091
mov rdx, qword [rsp + 0x40]
mov byte [rdx], 0
test rax, rax
je 0x1403d70ae
mov rbx, qword [rsp + 0x58]
dec eax
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0xd0], eax
jmp 0x1403d5f05
mov edx, dword [r12 + 0x1e0]
add edx, 4
cmp edx, 0xa
ja 0x1403d7138
lea rbx, [0x140000000]
movzx eax, byte [rbx + rdx + 0x59f210]
lea rax, [rbx + rax + 0x3d70d7]
jmp rax
xor ebx, ebx
test byte [r12 + 0x299], 4
jne 0x1403d7195
test byte [r12 + 0x291], 0x20
je 0x1403d716b
mov rbx, qword [r12 + 0xd0]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0xc8], 0
jmp 0x1403d71a7
lea rdx, str.fort._d
mov rcx, qword [rsp + 0x50]
mov r8d, dword [r12 + 0x1e0]
mov qword [rsp + 0x48], rbx
call fcn.14036c680
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x48], rbx
jmp 0x1403d71a7
mov rax, qword [rsp + 0x50]
mov byte [rax], 0
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x48], rbx
mov rdx, rbx
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d71d2
mov rax, rdx
add rdx, rcx
call fcn.14042af70
mov dword [rsp + 0xd0], eax
jmp 0x1403d5f05
cmp rax, 0x1001
jae 0x1403d71ee
inc rax
jmp 0x1403d7091
cmp qword [rsp + 0x40], 0
je 0x1403d7096
mov rdx, qword [rsp + 0x40]
mov byte [rdx], 0
jmp 0x1403d7096
lea rcx, str.FOR_READ
jmp 0x1403d5d6e
test byte [r12 + 0x291], 0x20
jne 0x1403d5d2d
test rbx, rbx
je 0x1403d7233
mov ecx, 0x212
xor edx, edx
call fcn.140383960
lea rdx, str.SCRATCH
mov r8d, 0x1000
mov rcx, qword [rsp + 0x50]
call fcn.1403815f0
mov rbx, qword [rsp + 0x50]
mov r8d, 7
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0xd0], 7
jmp 0x1403d600b
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x40], eax
call fcn.14035a530
mov rcx, qword [rsp + 0x58]
call fcn.14035a530
jmp 0x1403d610f
call fcn.14043dac0
mov rax, rsp
lea rcx, [rsp + 0x4420]
xor edx, edx
mov r8d, 3
xor r9d, r9d
mov dword [rax + 0x20], 3
mov dword [rax + 0x28], 0
mov qword [rax + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x1403d6657
mov rcx, rbx
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rcx, qword [r12 + 0x1a0]
lea rdx, [rsp + 0x43ec]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x84]
cmp eax, dword [rsp + 0x4408]
jne 0x1403d732c
mov eax, dword [rsp + 0x94]
cmp eax, dword [rsp + 0x4418]
jne 0x1403d732c
mov eax, dword [rsp + 0x98]
cmp eax, dword [rsp + 0x441c]
je 0x1403d6703
mov ebp, dword [0x141a6ae3c]
jmp 0x1403d6657
test r14d, r14d
jne 0x1403d6a6e
jmp 0x1403d6aa3
test r14d, r14d
jne 0x1403d5fd9
jmp 0x1403d5fec