Function at 0x140049a50
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2668]
mov eax, 0x2768
call fcn.14006c780
sub rsp, rax
mov qword [rbp - 0x40], 0xfffffffffffffffe
movaps xmmword [rsp + 0x2750], xmm6
movaps xmmword [rsp + 0x2740], xmm7
mov rax, qword [0x1400f3080]
xor rax, rsp
mov qword [rbp + 0x2630], rax
mov qword [rbp - 0x48], r9
mov r14, r8
mov rdi, rdx
mov qword [rbp - 0x50], rcx
mov rax, qword [rbp + 0x26d8]
mov qword [rbp - 0x58], rax
mov r12, qword [rbp + 0x26e0]
mov qword [rbp - 0x10], r12
xor esi, esi
mov dword [rbp - 8], esi
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x630]
call fcn.14008a450
movdqa xmm0, xmmword [0x1400d76e0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], si
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x68], xmm1
lea r15, [rdi + 0x10]
mov qword [rbp - 0x80], r15
mov qword [r15], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x60]
call fcn.140025b70
mov rbx, rax
cmp rdi, rax
je 0x140049b8e
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140049b63
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140049b5e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004ac5c
mov rcx, r8
call fcn.14006bb24
mov qword [r15], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140049bd0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049bcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac5c
call fcn.14006bb24
mov rdx, rdi
lea rcx, [rbp]
call fcn.140024f50
nop
xor edx, edx
lea ecx, [rdx + 0xa]
xor r9d, r9d
call fcn.1400135d4
test al, al
jne 0x140049cf3
lea rbx, [rbp]
mov r12, qword [rbp]
mov r13, qword [rbp + 0x18]
cmp r13, 8
cmovae rbx, r12
mov r11, qword [rbp + 0x10]
cmp r11, 7
jb 0x140049cef
lea r15, [r11 - 6]
lea r15, [rbx + r15*2]
mov rax, rbx
lea r8, str.ext_ms_
mov qword [rbp - 8], r8
nop word [rax + rax]
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov rdx, rsi
je 0x140049c5a
cmp word [rax], 0x65
je 0x140049c57
cmp rcx, 1
je 0x140049c5a
dec rcx
add rax, 2
cmp word [rax], 0x65
jne 0x140049c44
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140049cef
mov r9d, 7
mov rcx, r8
movzx edx, word [rdx]
mov r8d, 0x65
cmp dx, r8w
jb 0x140049ca7
mov r10, rax
sub r10, qword [rbp - 8]
cmp dx, r8w
ja 0x140049ca7
cmp r9, 1
je 0x140049cb7
dec r9
add rcx, 2
movzx edx, word [rcx + r10]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x140049c89
add rax, 2
lea r8, str.ext_ms_
jmp 0x140049c30
sub rax, rbx
sar rax, 1
jne 0x140049cef
mov eax, 4
cmp r11, rax
cmovb rax, r11
lea rcx, [rbp]
cmp r13, 8
cmovae rcx, r12
sub r11, rax
mov qword [rbp + 0x10], r11
lea r8, [r11*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.14008a040
mov r12, qword [rbp - 0x10]
mov r13, qword [rbp - 0x50]
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x140049feb
nop word [rax + rax]
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140049d1e
mov rdx, qword [rdx]
lea rcx, [rbp]
call fcn.1400237a4
cmp rax, 0xffffffffffffffff
jne 0x140049d35
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x140049d10
cmp rbx, r15
je 0x140049feb
mov r8, qword [rbx + 0x30]
cmp r8, qword [rbx + 0x38]
je 0x140049daa
mov rcx, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x140049d56
mov r14, qword [r14]
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140049d64
mov r8, qword [r8]
cmp rax, rcx
jne 0x140049da6
test rax, rax
je 0x140049efd
movzx ecx, word [r8]
movzx edx, word [r14]
cmp cx, dx
jb 0x140049da6
sub r8, r14
cmp cx, dx
ja 0x140049da6
cmp rax, 1
je 0x140049efd
dec rax
add r14, 2
movzx ecx, word [r8 + r14]
movzx edx, word [r14]
cmp cx, dx
jae 0x140049d85
mov r14, qword [rbx + 0x30]
mov rdx, r14
mov rcx, rdi
call fcn.14001725c
mov r9, r12
mov r8, qword [rbp - 0x58]
mov rdx, rdi
call fcn.14004acc0
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004ac06
cmp edx, 0xc015001d
je 0x14004ac06
test byte [rbp + 0x26d0], 2
je 0x14004ac08
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.14008a450
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movdqa xmm0, xmmword [0x1400d76e0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140004c64
nop
mov r8d, 1
lea rdx, [0x1400d4ed8]
lea rcx, [rsp + 0x60]
call fcn.140009530
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140049e7d
mov rdx, qword [rdi]
mov rax, qword [rbp - 0x80]
mov r8, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.140009530
movups xmm6, xmmword [rax]
movups xmmword [rbp - 0x78], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm7
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp - 0x78]
cmp rdi, rax
je 0x140049f0a
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140049ef4
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140049eef
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004ac62
mov rcx, r8
call fcn.14006bb24
movups xmmword [rdi], xmm6
movups xmmword [rdi + 0x10], xmm7
jmp 0x140049f4b
mov r14, qword [rbx + 0x38]
sub r14, 0x20
jmp 0x140049daa
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140049f4b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049f45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac62
call fcn.14006bb24
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140049f8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049f88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac68
call fcn.14006bb24
movdqa xmm0, xmmword [0x1400d76e0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14004ac08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049fe1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac6e
call fcn.14006bb24
jmp 0x14004ac08
mov r12d, dword [rbp + 0x26d0]
test r12b, 1
jne 0x14004a02b
mov r9, qword [rbp - 0x10]
mov r8, qword [rbp - 0x58]
mov rdx, rdi
call fcn.14004acc0
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004ac06
cmp edx, 0xc015001d
je 0x14004ac06
test r12b, 4
je 0x14004a035
mov esi, 0xc0000225
jmp 0x14004ac08
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14004a042
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004ac08
mov qword [rbp + 0x20], rsi
lea r8, [rbp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd r14, eax
test eax, eax
jne 0x14004a162
mov ebx, esi
nop word [rax + rax]
test r14, r14
jne 0x14004a162
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x430]
call fcn.14008a450
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x230]
call fcn.14008a450
mov dword [rbp - 0x10], 0xff
mov dword [rbp - 8], esi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x430]
mov edx, ebx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd r14, eax
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
lea rcx, [rbp + 0x230]
call fcn.140096c74
test eax, eax
jne 0x14004a154
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.14008a450
mov dword [rbp - 0x10], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x30]
test r12b, 8
je 0x14004a145
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004a14b
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test r14, r14
je 0x14004a1d4
inc ebx
cmp ebx, 0x1000
jl 0x14004a080
mov r13, qword [rbp - 0x48]
mov r8, qword [r13 + 0x10]
movabs rbx, 0x7ffffffffffffffe
movabs rcx, 0x7fffffffffffffff
mov r14, 0xffffffffffffffff
test r8, r8
je 0x14004a687
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov dword [rbp - 8], 0x10
lea r15, [r8 + 1]
cmp r15, 7
jbe 0x14004a432
cmp r15, rbx
ja 0x14004ac74
or r15, 7
cmp r15, rbx
jbe 0x14004a3b3
mov r15, rbx
jmp 0x14004a3c0
movdqa xmm0, xmmword [0x1400d76e0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140004c64
nop
mov r8d, 1
lea rdx, [0x1400d4ed8]
lea rcx, [rsp + 0x60]
call fcn.140009530
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp + 0x230]
mov r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], 0
jne 0x14004a244
mov r8, r14
lea rdx, [rbp + 0x230]
lea rcx, [rsp + 0x40]
call fcn.140009530
movups xmm6, xmmword [rax]
movups xmmword [rbp - 0x78], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm7
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp - 0x78]
cmp rdi, rax
je 0x14004a2d2
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14004a2c9
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004a2c4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004ac7a
mov rcx, r8
call fcn.14006bb24
movups xmmword [rdi], xmm6
movups xmmword [rdi + 0x10], xmm7
jmp 0x14004a313
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14004a313
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a30d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac7a
call fcn.14006bb24
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004a355
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a350
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac80
call fcn.14006bb24
movdqa xmm0, xmmword [0x1400d76e0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14004abed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a3a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac86
call fcn.14006bb24
jmp 0x14004abed
cmp r15, 0xa
mov eax, 0xa
cmovb r15, rax
lea rax, [r15 + 1]
lea rdx, [rax + rax]
cmp rax, rcx
jbe 0x14004a3d2
mov rdx, r14
jmp 0x14004a3db
cmp rdx, 0x1000
jb 0x14004a402
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r14
call fcn.14006bb2c
test rax, rax
je 0x14004ac8c
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14004a417
test rdx, rdx
je 0x14004a414
mov rcx, rdx
call fcn.14006bb2c
mov rcx, rax
jmp 0x14004a417
mov rcx, rsi
mov qword [rsp + 0x58], r15
movzx eax, word [rsp + 0x40]
mov word [rcx], ax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov r8, qword [r13 + 0x10]
cmp qword [r13 + 0x18], 8
jb 0x14004a43d
mov r13, qword [r13]
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.140009530
mov r8d, 1
lea rdx, [0x1400d4ed8]
lea rcx, [rsp + 0x40]
call fcn.140009530
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140009530
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14004a4d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a4ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac8c
call fcn.14006bb24
movups xmmword [rbp - 0x30], xmm6
movups xmmword [rbp - 0x20], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004a51d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a518
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac92
call fcn.14006bb24
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004a687
lea rax, [rbp - 0x30]
cmp rdi, rax
je 0x14004abed
mov r12, qword [rbp - 0x20]
lea r13, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r13, qword [rbp - 0x30]
mov r15, qword [rdi + 0x18]
cmp r12, r15
ja 0x14004a58d
cmp r15, 8
jb 0x14004a56b
mov rdi, qword [rdi]
mov rax, qword [rbp - 0x80]
mov qword [rax], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.14008a040
mov word [rbx + rdi], si
jmp 0x14004abed
cmp r12, rbx
ja 0x14004ac56
mov rcx, r12
or rcx, 7
cmp rcx, rbx
ja 0x14004a5c1
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
ja 0x14004a5c1
lea rax, [rdx + r15]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
movabs rcx, 0x7fffffffffffffff
lea rax, [rbx + 1]
cmp rax, rcx
lea rdx, [rax + rax]
jbe 0x14004a5dd
mov rdx, r14
jmp 0x14004a5e6
cmp rdx, 0x1000
jb 0x14004a60d
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r14
call fcn.14006bb2c
test rax, rax
je 0x14004acaa
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004a622
test rdx, rdx
je 0x14004a61f
mov rcx, rdx
call fcn.14006bb2c
mov r14, rax
jmp 0x14004a622
mov r14, rsi
mov qword [rdi + 0x18], rbx
mov rax, qword [rbp - 0x80]
lea rbx, [r12 + r12]
mov qword [rax], r12
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.14008a040
cmp r15, 8
mov word [rbx + r14], si
jb 0x14004a67f
lea rdx, [r15*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x14004a67a
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004acaa
mov rcx, r8
call fcn.14006bb24
mov qword [rdi], r14
jmp 0x14004abed
mov rax, qword [rbp - 0x58]
mov r8d, dword [rax + 8]
lea rdx, [rbp - 0x78]
call fcn.14004b110
nop
mov r8d, 1
lea rdx, [0x1400d4ed8]
mov rcx, rax
call fcn.140009530
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140009530
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14004a749
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a744
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac98
call fcn.14006bb24
movups xmmword [rbp - 0x30], xmm6
movups xmmword [rbp - 0x20], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004a793
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a78e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac9e
call fcn.14006bb24
movdqa xmm0, xmmword [0x1400d76e0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14004a7e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a7e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aca4
call fcn.14006bb24
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004a860
lea rax, [rbp - 0x30]
cmp rdi, rax
je 0x14004abed
mov r12, qword [rbp - 0x20]
lea r13, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r13, qword [rbp - 0x30]
mov r15, qword [rdi + 0x18]
cmp r12, r15
ja 0x14004a852
cmp r15, 8
jb 0x14004a830
mov rdi, qword [rdi]
mov rax, qword [rbp - 0x80]
mov qword [rax], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.14008a040
mov word [rbx + rdi], si
jmp 0x14004abed
cmp r12, rbx
ja 0x14004ac56
jmp 0x14004a596
mov edx, 0x1000
lea rcx, [rbp + 0x630]
test r12b, 8
je 0x14004a87a
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004a880
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movdqa xmm0, xmmword [0x1400d76e0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x60]
call fcn.140004c64
nop
mov r8d, 1
lea rdx, [0x1400d4ed8]
lea rcx, [rsp + 0x60]
call fcn.140009530
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140009530
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14004a957
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a952
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004acb0
call fcn.14006bb24
movups xmmword [rbp - 0x30], xmm6
movups xmmword [rbp - 0x20], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004a9a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a99c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004acb6
call fcn.14006bb24
movdqa xmm0, xmmword [0x1400d76e0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14004a9f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a9f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ac50
call fcn.14006bb24
lea rcx, [rbp - 0x30]
call fcn.14000424c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004abf8
mov edx, 0x1000
lea rcx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x40]
call fcn.1400042a4
nop
lea r8, [0x1400d4ed8]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140008034
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14001b38c
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14000425c
lea rcx, [rbp - 0x78]
call fcn.140004c00
nop
lea rcx, [rsp + 0x60]
call fcn.140004c00
nop
lea rcx, [rsp + 0x40]
call fcn.140004c00
lea rcx, [rbp - 0x30]
call fcn.140025d30
test al, al
jne 0x14004abf8
lea rdx, [rbp + 0x630]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x40]
call fcn.1400042a4
nop
lea r8, [0x1400d4ed8]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140008034
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14001b38c
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14000425c
lea rcx, [rbp - 0x78]
call fcn.140004c00
nop
lea rcx, [rsp + 0x60]
call fcn.140004c00
nop
lea rcx, [rsp + 0x40]
call fcn.140004c00
lea rcx, [rbp - 0x30]
call fcn.140025d30
test al, al
jne 0x14004abf8
mov r8d, 0x1000
lea rdx, [rbp + 0x630]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x38]
lea rdx, [0x1400d5ed8]
lea rcx, [rbp + 0x630]
call fcn.14009702c
test rax, rax
je 0x14004abe8
nop word [rax + rax]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400042a4
nop
lea r8, [0x1400d4ed8]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140008034
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14001b38c
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14000425c
lea rcx, [rbp - 0x78]
call fcn.140004c00
nop
lea rcx, [rsp + 0x60]
call fcn.140004c00
nop
lea rcx, [rsp + 0x40]
call fcn.140004c00
lea rcx, [rbp - 0x30]
call fcn.140025d30
test al, al
jne 0x14004abf8
lea r8, [rbp - 0x38]
lea rdx, [0x1400d5ed8]
mov rcx, qword [rbp - 0x38]
call fcn.14009702c
test rax, rax
jne 0x14004ab60
mov esi, 0xc0000225
lea rcx, [rbp + 0x20]
call fcn.140027740
jmp 0x14004ac08
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.14001725c
jmp 0x14004abed
mov esi, edx
lea rcx, [rbp]
call fcn.140004c00
nop
lea rcx, [rbp - 0x30]
call fcn.140004c00
mov eax, esi
mov rcx, qword [rbp + 0x2630]
xor rcx, rsp
call fcn.14006bb00
movaps xmm6, xmmword [rsp + 0x2750]
movaps xmm7, xmmword [rsp + 0x2740]
add rsp, 0x2768
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140095014
nop
call fcn.14000951c
nop
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.14000951c
nop
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.140095014
int3
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.140095014
int3