Function at 0x14004bb70
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2798]
mov eax, 0x2898
call fcn.14006d380
sub rsp, rax
movaps xmmword [rsp + 0x2880], xmm6
movaps xmmword [rsp + 0x2870], xmm7
mov rax, qword [0x1400c7100]
xor rax, rsp
mov qword [rbp + 0x2760], rax
mov r12, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov r13, qword [rbp + 0x2808]
mov r15, qword [rbp + 0x2810]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x760]
call fcn.140098980
xorps xmm0, xmm0
movups xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], rbx
mov qword [rbp + 0x120], 7
mov word [rbp + 0x108], bx
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x20]
call fcn.140028400
mov rbx, rax
cmp rdi, rax
je 0x14004bcaf
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14004bc81
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004bc7c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004d0ef
mov rcx, r8
call fcn.14006c690
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], 7
mov word [rdi], ax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14004bcef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bcea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d0ef
call fcn.14006c690
mov rdx, rdi
lea rcx, [rbp + 0x128]
call fcn.140027a30
nop
cmp dword [0x1400cb15c], 9
ja 0x14004bdfe
lea r10, [rbp + 0x128]
cmp qword [rbp + 0x140], 7
cmova r10, qword [rbp + 0x128]
mov rbx, qword [rbp + 0x138]
cmp rbx, 7
jb 0x14004bdfe
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, str.ext_ms_
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x14004bd76
cmp word [rcx], 0x65
je 0x14004bd73
nop dword [rax]
cmp rax, 1
je 0x14004bd76
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x14004bd60
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14004bdfe
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, str.ext_ms_
sub r9, rax
nop dword [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14004be9a
add rdx, 2
sub r8, 1
jne 0x14004bda0
sub rcx, r10
sar rcx, 1
jne 0x14004bdfe
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x128]
cmp qword [rbp + 0x140], 7
cmova rcx, qword [rbp + 0x128]
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call fcn.1400982e0
mov qword [rbp + 0x138], rbx
mov r14, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, r14
je 0x14004c11c
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14004be1e
mov rdx, qword [rdx]
lea rcx, [rbp + 0x128]
call fcn.1400267fc
cmp rax, 0xffffffffffffffff
jne 0x14004be3b
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r14
jne 0x14004be10
cmp rbx, r14
je 0x14004c11c
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x14004bea3
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 7
jbe 0x14004be5f
mov rsi, qword [rsi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 7
jbe 0x14004be70
mov r8, qword [rdx]
cmp rcx, rax
jne 0x14004bea6
test rcx, rcx
je 0x14004be94
sub r8, rsi
nop dword [rax]
movzx eax, word [rsi + r8]
cmp ax, word [rsi]
jne 0x14004bea6
add rsi, 2
sub rcx, 1
jne 0x14004be80
lea rdx, [r9 - 0x20]
jmp 0x14004bea6
add rcx, 2
jmp 0x14004bd3f
mov rdx, rsi
mov rcx, rdi
call fcn.140018650
mov r9, r15
mov r8, r13
mov rdx, rdi
call fcn.14004d180
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004d00f
cmp ebx, 0xc015001d
je 0x14004d00f
test byte [rbp + 0x2800], 2
je 0x14004c115
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x160]
call fcn.140098980
mov edx, 0xff
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x90], xmm1
lea rax, [rbp + 0x160]
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14004bf30
mov r8, rsi
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x80]
call fcn.140008f40
nop
mov r8d, 1
lea rdx, [0x1400b4510]
lea rcx, [rbp + 0x80]
call fcn.140009be4
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14004bfaa
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140009be4
movups xmm6, xmmword [rax]
movups xmmword [rbp + 0x60], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm7
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rax, [rbp + 0x60]
cmp rdi, rax
je 0x14004c030
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14004c01e
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004c019
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004d0f5
mov rcx, r8
call fcn.14006c690
movups xmmword [rdi], xmm6
movups xmmword [rdi + 0x10], xmm7
mov edx, 7
mov word [rbp + 0x60], bx
jmp 0x14004c034
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x14004c071
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c06b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d0f5
call fcn.14006c690
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14004c0b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c0ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d0fb
call fcn.14006c690
movdqa xmm0, xmmword [0x1400b61d0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], bx
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x14004d00f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c10b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d101
call fcn.14006c690
jmp 0x14004d00f
xor ebx, ebx
jmp 0x14004d00f
mov r14d, dword [rbp + 0x2800]
test r14b, 1
jne 0x14004d00a
mov r9, r15
mov r8, r13
mov rdx, rdi
call fcn.14004d180
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004d00f
cmp ebx, 0xc015001d
je 0x14004d00f
test r14b, 4
jne 0x14004d00a
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14004c16f
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004c185
xor r12d, r12d
mov ebx, r12d
jmp 0x14004d012
xor r15d, r15d
mov qword [rbp + 0x158], r15
lea r8, [rbp + 0x158]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rsi, eax
test eax, eax
jne 0x14004c2c7
mov ebx, r15d
nop dword [rax + rax]
test rsi, rsi
jne 0x14004c2c7
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x560]
call fcn.140098980
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x360]
call fcn.140098980
mov dword [rbp + 0x148], 0xff
mov dword [rbp + 0x150], r15d
lea rax, [rbp + 0x148]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x360]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x148]
lea r8, [rbp + 0x560]
mov edx, ebx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rsi, eax
lea rdx, [rbp + 0x128]
cmp qword [rbp + 0x140], 7
cmova rdx, qword [rbp + 0x128]
lea rcx, [rbp + 0x360]
call fcn.14007f8ec
test eax, eax
jne 0x14004c2b9
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x160]
call fcn.140098980
mov dword [rbp + 0x148], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x160]
test r14b, 8
je 0x14004c2aa
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004c2b0
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rsi, rsi
je 0x14004c487
inc ebx
cmp ebx, 0x1000
jl 0x14004c1c0
mov rcx, qword [r12 + 0x10]
lea r15, [0x1400b4510]
movabs rbx, 0x7ffffffffffffffe
test rcx, rcx
je 0x14004c60d
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x14004d107
cmp qword [r12 + 0x18], 7
jbe 0x14004c302
mov r12, qword [r12]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
mov r9, r12
lea rcx, [rbp - 0x20]
call fcn.14001d988
nop
lea rdx, [rbp + 0x128]
cmp qword [rbp + 0x140], 7
cmova rdx, qword [rbp + 0x128]
mov r8, qword [rbp + 0x138]
lea rcx, [rbp - 0x20]
call fcn.140009be4
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x120]
cmp rdx, 7
jbe 0x14004c3a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c3a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d10d
call fcn.14006c690
movups xmmword [rbp + 0x108], xmm6
movups xmmword [rbp + 0x118], xmm7
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14004c3f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c3f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d113
call fcn.14006c690
lea rcx, [rbp + 0x108]
cmp qword [rbp + 0x120], 7
cmova rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004c610
lea rax, [rbp + 0x108]
cmp rdi, rax
je 0x14004d005
mov r14, qword [rbp + 0x118]
lea r12, [rbp + 0x108]
cmp qword [rbp + 0x120], 7
cmova r12, qword [rbp + 0x108]
mov r15, qword [rdi + 0x18]
cmp r14, r15
ja 0x14004c4f2
mov rbx, rdi
cmp r15, 7
jbe 0x14004c464
mov rbx, qword [rdi]
mov qword [rdi + 0x10], r14
lea r8, [r14 + r14]
mov rdx, r12
mov rcx, rbx
call fcn.1400982e0
xor r12d, r12d
mov word [rbx + r14*2], r12w
mov ebx, r12d
jmp 0x14004cfe2
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x20]
call fcn.140005868
nop
lea r8, [0x1400b4510]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140008938
nop
lea r8, [rbp + 0x360]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140008938
mov rdx, rax
mov rcx, rdi
call fcn.140005820
lea rcx, [rbp + 0x40]
call fcn.140007620
nop
lea rcx, [rbp + 0x20]
call fcn.140007620
nop
lea rcx, [rbp - 0x20]
call fcn.140007620
xor r12d, r12d
mov ebx, r12d
jmp 0x14004cfe2
cmp r14, rbx
ja 0x14004d13d
mov rcx, r14
or rcx, 7
cmp rcx, rbx
jbe 0x14004c517
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c568
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
jbe 0x14004c538
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c568
lea rax, [rdx + r15]
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14004d149
add rcx, rcx
cmp rcx, 0x1000
jb 0x14004c594
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004d149
mov rcx, rax
call fcn.14006c698
test rax, rax
je 0x14004d143
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14004c5a5
test rcx, rcx
je 0x14004c5a0
call fcn.14006c698
jmp 0x14004c5a2
xor eax, eax
mov rsi, rax
mov qword [rdi + 0x18], rbx
lea rbx, [r14 + r14]
mov qword [rdi + 0x10], r14
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call fcn.1400982e0
xor r12d, r12d
mov word [rbx + rsi], r12w
cmp r15, 7
jbe 0x14004c602
lea rdx, [r15*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14004c5fd
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004d143
mov rcx, r8
call fcn.14006c690
mov qword [rdi], rsi
mov ebx, r12d
jmp 0x14004cfe2
xor r12d, r12d
mov r8d, dword [r13 + 8]
lea rdx, [rbp + 0x40]
call fcn.14004d660
nop
mov r8d, 1
mov rdx, r15
mov rcx, rax
call fcn.140009be4
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x128]
cmp qword [rbp + 0x140], 7
cmova rdx, qword [rbp + 0x128]
mov r8, qword [rbp + 0x138]
lea rcx, [rbp - 0x80]
call fcn.140009be4
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x120]
cmp rdx, 7
jbe 0x14004c6e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c6dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d119
call fcn.14006c690
movups xmmword [rbp + 0x108], xmm6
movups xmmword [rbp + 0x118], xmm7
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14004c72f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c72a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d11f
call fcn.14006c690
movdqa xmm0, xmmword [0x1400b61d0]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x14004c781
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c77c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d125
call fcn.14006c690
lea rcx, [rbp + 0x108]
cmp qword [rbp + 0x120], 7
cmova rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004c8bc
lea rax, [rbp + 0x108]
cmp rdi, rax
je 0x14004d005
mov r14, qword [rbp + 0x118]
lea r12, [rbp + 0x108]
cmp qword [rbp + 0x120], 7
cmova r12, qword [rbp + 0x108]
mov r15, qword [rdi + 0x18]
cmp r14, r15
jbe 0x14004c458
cmp r14, rbx
ja 0x14004d13d
mov rcx, r14
or rcx, 7
cmp rcx, rbx
jbe 0x14004c807
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c858
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
jbe 0x14004c828
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c858
lea rax, [r15 + rdx]
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14004d149
add rcx, rcx
cmp rcx, 0x1000
jb 0x14004c884
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004d149
mov rcx, rax
call fcn.14006c698
test rax, rax
je 0x14004d143
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14004c895
test rcx, rcx
je 0x14004c890
call fcn.14006c698
jmp 0x14004c892
xor eax, eax
mov rsi, rax
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call fcn.1400982e0
xor r12d, r12d
mov word [rsi + rbx], r12w
jmp 0x14004c5c7
mov edx, 0x1000
lea rcx, [rbp + 0x760]
test r14b, 8
je 0x14004c8d6
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004c8dc
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp + 0x760]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14004c902
lea rdx, [rbp + 0x760]
lea rcx, [rbp + 0xa0]
call fcn.140008f40
nop
mov r8d, 1
mov rdx, r15
lea rcx, [rbp + 0xa0]
call fcn.140009be4
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x128]
cmp qword [rbp + 0x140], 7
cmova rdx, qword [rbp + 0x128]
mov r8, qword [rbp + 0x138]
lea rcx, [rbp - 0x60]
call fcn.140009be4
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x120]
cmp rdx, 7
jbe 0x14004c9e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c9e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d12b
call fcn.14006c690
movups xmmword [rbp + 0x108], xmm6
movups xmmword [rbp + 0x118], xmm7
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14004ca36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ca31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d131
call fcn.14006c690
movdqa xmm0, xmmword [0x1400b61d0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 7
jbe 0x14004ca8e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ca89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d137
call fcn.14006c690
lea rcx, [rbp + 0x108]
cmp qword [rbp + 0x120], 7
cmova rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004cb51
lea rax, [rbp + 0x108]
cmp rdi, rax
je 0x14004d005
mov r14, qword [rbp + 0x118]
lea r12, [rbp + 0x108]
cmp qword [rbp + 0x120], 7
cmova r12, qword [rbp + 0x108]
mov r15, qword [rdi + 0x18]
cmp r14, r15
jbe 0x14004c458
cmp r14, rbx
ja 0x14004d13d
mov rcx, r14
or rcx, 7
cmp rcx, rbx
jbe 0x14004cb17
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c568
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
jbe 0x14004cb3b
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c568
lea rax, [rdx + r15]
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
jmp 0x14004c549
mov edx, 0x1000
lea rcx, [rbp + 0x760]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
lea rax, [rbp + 0x760]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14004cb82
lea rdx, [rbp + 0x760]
lea rcx, [rbp + 0xc0]
call fcn.140008f40
nop
mov r8d, 1
mov rdx, r15
lea rcx, [rbp + 0xc0]
call fcn.140009be4
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x128]
cmp qword [rbp + 0x140], 7
cmova rdx, qword [rbp + 0x128]
mov r8, qword [rbp + 0x138]
lea rcx, [rbp - 0x40]
call fcn.140009be4
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x120]
cmp rdx, 7
jbe 0x14004cc68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cc63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d14f
call fcn.14006c690
movups xmmword [rbp + 0x108], xmm6
movups xmmword [rbp + 0x118], xmm7
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14004ccb6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ccb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d155
call fcn.14006c690
movdqa xmm0, xmmword [0x1400b61d0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r12w
mov rdx, qword [rbp + 0xd8]
cmp rdx, 7
jbe 0x14004cd0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cd09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d15b
call fcn.14006c690
lea rcx, [rbp + 0x108]
cmp qword [rbp + 0x120], 7
cmova rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004cff6
lea rdx, [rbp + 0x760]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rbp + 0x760]
lea rcx, [rbp - 0x20]
call fcn.140005868
nop
mov r8, r15
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140008938
nop
lea r8, [rbp + 0x128]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14001d108
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140005820
lea rcx, [rbp + 0x40]
call fcn.140007620
nop
lea rcx, [rbp + 0x20]
call fcn.140007620
nop
lea rcx, [rbp - 0x20]
call fcn.140007620
lea rcx, [rbp + 0x108]
call fcn.140028630
test al, al
jne 0x14004cff6
mov r8d, 0x1000
lea rdx, [rbp + 0x760]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp + 0x100]
lea rdx, [0x1400b5838]
lea rcx, [rbp + 0x760]
call fcn.14007fde0
test rax, rax
je 0x14004cfdd
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14004ce12
mov rdx, rax
lea rcx, [rbp]
call fcn.140008f40
nop
mov r8d, 1
mov rdx, r15
lea rcx, [rbp]
call fcn.140009be4
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x128]
cmp qword [rbp + 0x140], 7
cmova rdx, qword [rbp + 0x128]
mov r8, qword [rbp + 0x138]
lea rcx, [rsp + 0x40]
call fcn.140009be4
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x120]
cmp rdx, 7
jbe 0x14004cef4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ceef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d161
call fcn.14006c690
movups xmmword [rbp + 0x108], xmm6
movups xmmword [rbp + 0x118], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14004cf44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cf3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d167
call fcn.14006c690
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x14004cf98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cf93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d16d
call fcn.14006c690
lea rcx, [rbp + 0x108]
cmp qword [rbp + 0x120], 7
cmova rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004cff6
lea r8, [rbp + 0x100]
lea rdx, [0x1400b5838]
mov rcx, qword [rbp + 0x100]
call fcn.14007fde0
test rax, rax
jne 0x14004ce00
mov ebx, 0xc0000225
mov rcx, qword [rbp + 0x158]
test rcx, rcx
jle 0x14004d012
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004d012
lea rdx, [rbp + 0x108]
mov rcx, rdi
call fcn.140018650
mov ebx, r12d
jmp 0x14004cfe2
mov ebx, 0xc0000225
xor r12d, r12d
mov rdx, qword [rbp + 0x140]
cmp rdx, 7
jbe 0x14004d058
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d053
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d173
call fcn.14006c690
mov qword [rbp + 0x138], r12
mov qword [rbp + 0x140], 7
mov word [rbp + 0x128], r12w
mov rdx, qword [rbp + 0x120]
cmp rdx, 7
jbe 0x14004d0b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d0af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d0e9
call fcn.14006c690
mov eax, ebx
mov rcx, qword [rbp + 0x2760]
xor rcx, rsp
call fcn.14006c670
movaps xmm6, xmmword [rsp + 0x2880]
movaps xmm7, xmmword [rsp + 0x2870]
add rsp, 0x2898
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.1400012b0
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
int3
call fcn.1400012b0
int3
call fcn.14007da9c
int3
call fcn.140001150
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
int3