Function at 0x180019fa0
Capabilities:
Check if file exists
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x618]
sub rsp, 0x700
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800a0830]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
cmp qword [rdx + 0x10], rbx
jne 0x18001a053
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbx
cmp qword [rcx + 0x18], 8
jb 0x18001a006
mov rax, qword [rcx]
jmp 0x18001a009
mov rax, rsi
mov word [rax], bx
xor r8d, r8d
lea rdx, [0x18006ae40]
call fcn.18000ae90
nop
mov r8, qword [r14 + 0x18]
cmp r8, 8
jb 0x18001a034
inc r8
mov rdx, qword [r14]
mov rcx, r14
call fcn.18000afe0
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rbx
cmp qword [r14 + 0x18], 8
jb 0x18001a04a
mov r14, qword [r14]
mov word [r14], bx
jmp 0x18001aea8
mov r11, qword [rdx + 0x18]
cmp r11, 8
jb 0x18001a062
mov rcx, qword [rdx]
jmp 0x18001a065
mov rcx, r14
mov r10, qword [rdx + 0x10]
mov r8d, 3
cmp r10, r8
cmovb r8, r10
mov r9d, 1
or rdi, 0xffffffffffffffff
test r8, r8
je 0x18001a0b3
lea rdx, [0x18006eea0]
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001a0a7
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001a090
jmp 0x18001a0b3
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18001a0b6
mov r8d, ebx
test r8d, r8d
jne 0x18001a14d
cmp r10, 3
jne 0x18001a14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18004f390
xor r9d, r9d
lea r8d, [r9 + 0x26]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.18001b7e0
lea rcx, [rbp - 0x40]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001a0f4
mov eax, dword [0x18006c004]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001a11e
mov rax, qword [rsi]
jmp 0x18001a121
mov rax, rsi
mov word [rax], bx
cmp word [rbp - 0x40], 0
jne 0x18001a130
mov rdi, rbx
jmp 0x18001a13e
lea rax, [rbp - 0x40]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001a134
mov r8, rdi
lea rdx, [rbp - 0x40]
mov rcx, rsi
jmp 0x18001a016
cmp r11, 8
jb 0x18001a158
mov rcx, qword [r14]
jmp 0x18001a15b
mov rcx, r14
mov r8d, 3
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18001a197
lea rdx, [0x18006eea8]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001a18b
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001a174
jmp 0x18001a197
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18001a19a
mov r8d, ebx
test r8d, r8d
jne 0x18001a23e
cmp r10, 3
jne 0x18001a23e
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18004f390
xor r9d, r9d
lea r8d, [r9 + 5]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.18001b7e0
lea rcx, [rbp - 0x40]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001a1e0
mov eax, dword [0x18006c004]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001a20a
mov rax, qword [rsi]
jmp 0x18001a20d
mov rax, rsi
mov word [rax], bx
cmp word [rbp - 0x40], 0
je 0x18001a22a
lea rax, [rbp - 0x40]
mov rbx, rdi
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001a220
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.18000ae90
jmp 0x18001aea0
cmp r11, 8
jb 0x18001a249
mov rcx, qword [r14]
jmp 0x18001a24c
mov rcx, r14
mov r8d, 7
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18001a288
lea rdx, str.desktop
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001a27c
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001a265
jmp 0x18001a288
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18001a28b
mov r8d, ebx
test r8d, r8d
jne 0x18001a325
cmp r10, 7
jne 0x18001a325
xor r9d, r9d
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp + 0x3e0]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001a2c0
mov eax, dword [0x18006c004]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001a2ea
mov rax, qword [rsi]
jmp 0x18001a2ed
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18001a30e
lea rax, [rbp + 0x3e0]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001a304
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.18000ae90
jmp 0x18001aea0
cmp r11, 8
jb 0x18001a330
mov rcx, qword [r14]
jmp 0x18001a333
mov rcx, r14
mov r8d, 3
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18001a373
lea rdx, [0x18006eec0]
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001a367
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001a350
jmp 0x18001a373
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18001a376
mov r8d, ebx
test r8d, r8d
jne 0x18001a415
cmp r10, 3
jne 0x18001a415
xor r9d, r9d
lea r8d, [r10 + 3]
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp + 0x3e0]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001a3b0
mov eax, dword [0x18006c004]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001a3da
mov rax, qword [rsi]
jmp 0x18001a3dd
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18001a3fe
lea rax, [rbp + 0x3e0]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001a3f4
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.18000ae90
jmp 0x18001aea0
cmp r11, 8
jb 0x18001a420
mov rcx, qword [r14]
jmp 0x18001a423
mov rcx, r14
mov r8d, 7
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18001a463
lea rdx, str.program
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001a457
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001a440
jmp 0x18001a463
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18001a466
mov r8d, ebx
test r8d, r8d
jne 0x18001a5ce
cmp r10, 7
jne 0x18001a5ce
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18004f390
xor r9d, r9d
lea r8d, [r9 + 0x26]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.18001b7e0
lea rcx, [rbp - 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001a4a3
cmp eax, 3
jl 0x18001a581
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.18004f390
mov r8d, 3
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x3e0]
call fcn.180056948
lea rcx, [rbp + 0x3e0]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001a4f0
movups xmm0, xmmword [str.Program_Files_]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x18006eee8]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x18006eef0]
mov dword [rcx + 0x18], eax
movzx eax, word [0x18006eef4]
mov word [rcx + 0x1c], ax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001a53d
mov rax, qword [rsi]
jmp 0x18001a540
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18001a56a
lea rax, [rbp + 0x3e0]
mov rbx, rdi
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001a560
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.18000ae90
jmp 0x18001aea0
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001a599
mov rax, qword [rsi]
jmp 0x18001a59c
mov rax, rsi
mov word [rax], bx
cmp word [rbp - 0x40], 0
je 0x18001a5ba
lea rax, [rbp - 0x40]
mov rbx, rdi
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001a5b0
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.18000ae90
jmp 0x18001aea0
cmp r11, 8
jb 0x18001a5d9
mov rcx, qword [r14]
jmp 0x18001a5dc
mov rcx, r14
mov r8d, 4
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18001a612
lea rdx, str.curr
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001a60c
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001a5f5
jmp 0x18001a612
cmovb r9d, edi
jmp 0x18001a615
mov r9d, ebx
test r9d, r9d
jne 0x18001a6c1
cmp r10, 4
jne 0x18001a6c1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.18004f390
mov r8d, 0x104
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rbp + 0x3e0]
call fcn.180050efc
mov word [rax + 2], bx
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001a67e
mov rax, qword [rsi]
jmp 0x18001a681
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18001a6aa
lea rax, [rbp + 0x3e0]
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001a6a0
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.18000ae90
jmp 0x18001aea0
lea rdx, str.temp
mov rcx, r14
call fcn.180019b00
test al, al
je 0x18001a7c7
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18004f390
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.18004f390
call fcn.18001b0a0
test al, al
je 0x18001a75c
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.18001b7e0
test eax, eax
je 0x18001a7b6
lea rcx, [rbp - 0x40]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001a730
movsd xmm0, qword [str.Temp_]
movsd qword [rcx], xmm0
mov eax, dword [0x18006ef20]
mov dword [rcx + 8], eax
movzx eax, word [0x18006ef24]
mov word [rcx + 0xc], ax
jmp 0x18001a7b6
lea rdx, [rbp + 0x3e0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea rax, [rbp - 0x40]
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001a790
test rdi, rdi
jne 0x18001a7b6
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.180018630
jmp 0x18001aea0
lea rdx, str.downloads
mov rcx, r14
call fcn.180019b00
test al, al
je 0x18001a8d2
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18004f390
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.18001b7e0
lea rcx, [rbp - 0x40]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001a810
test rax, rax
je 0x18001a86a
mov edx, 0x5c
lea rcx, [rbp - 0x40]
call fcn.180050efc
mov word [rax + 2], bx
lea rcx, [rbp - 0x40]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001a840
movups xmm0, xmmword [0x18006ef50]
movups xmmword [rcx], xmm0
mov eax, dword [0x18006ef60]
mov dword [rcx + 0x10], eax
movzx eax, word [0x18006ef64]
mov word [rcx + 0x14], ax
jmp 0x18001a8c1
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rbp - 0x40]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001a885
test rdi, rdi
je 0x18001a8c1
lea rax, [rbp - 0x40]
sub rax, 2
nop dword [rax]
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x18001a8a0
movups xmm0, xmmword [str.Downloads_]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x18006ef90]
movsd qword [rax + 0x10], xmm1
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.180018630
jmp 0x18001aea0
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x58], bx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1d0]
call fcn.18004f390
mov r8d, 0x104
lea rdx, [rbp + 0x1d0]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x1d0]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001a920
movups xmm0, xmmword [str.AppDataLocalLow_]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x18006efa8]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x18006efb8]
mov dword [rcx + 0x20], eax
movzx eax, word [0x18006efbc]
mov word [rcx + 0x24], ax
cmp word [rbp + 0x1d0], 0
jne 0x18001a962
mov r8, rbx
jmp 0x18001a97b
lea rax, [rbp + 0x1d0]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001a970
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x58]
call fcn.18000ae90
lea rdx, str.locallow
mov rcx, r14
call fcn.180019b00
test al, al
je 0x18001aabc
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.18001b7e0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
cmp word [rbp + 0x1d0], 0
jne 0x18001a9e7
mov r8, rbx
jmp 0x18001a9fc
lea rax, [rbp + 0x1d0]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x18001a9f1
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x38]
call fcn.18000ae90
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
mov r8d, 8
lea rdx, str.LocalLow
lea rcx, [rbp - 0x68]
call fcn.18000ae90
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
mov r8d, 7
lea rdx, str.Roaming
lea rcx, [rsp + 0x78]
call fcn.18000ae90
nop
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.18001ec40
nop
lea rcx, [rsp + 0x78]
call fcn.180009e50
nop
lea rcx, [rbp - 0x68]
call fcn.180009e50
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001aab7
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.18000ad50
nop
jmp 0x18001adf5
lea rdx, str.roaming
mov rcx, r14
call fcn.180019b00
test al, al
jne 0x18001acb2
lea rdx, str.Roaming
mov rcx, r14
call fcn.180019b00
test al, al
jne 0x18001acb2
lea rdx, str.local
mov rcx, r14
call fcn.180019b00
test al, al
je 0x18001ac36
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.18001b7e0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001ab5f
cmp word [rbp + 0x1d0], 0
jne 0x18001ab46
mov rdi, rbx
jmp 0x18001ad0a
lea rax, [rbp + 0x1d0]
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001ab50
jmp 0x18001ad0a
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.18000ad50
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
mov r8d, 5
lea rdx, str.Local
lea rcx, [rsp + 0x78]
call fcn.18000ae90
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
mov r8d, 8
lea rdx, str.LocalLow
lea rcx, [rbp - 0x68]
call fcn.18000ae90
nop
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x38]
call fcn.18001ec40
nop
lea rcx, [rbp - 0x68]
call fcn.180009e50
nop
lea rcx, [rsp + 0x78]
call fcn.180009e50
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001ac31
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.18000ad50
nop
jmp 0x18001adf5
lea rdx, str.system
mov rcx, r14
call fcn.180019b00
test al, al
je 0x18001aca2
xor r9d, r9d
lea r8d, [r9 + 0x25]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.18001b7e0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001adff
cmp word [rbp + 0x1d0], 0
jne 0x18001ac8f
mov rdi, rbx
jmp 0x18001ad0a
lea rax, [rbp + 0x1d0]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001ac96
jmp 0x18001ad0a
mov rdx, r14
mov rcx, rsi
call fcn.180019b50
jmp 0x18001ae95
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.18001b7e0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001ad23
cmp word [rbp + 0x1d0], 0
jne 0x18001acf4
mov rdi, rbx
jmp 0x18001ad0a
lea rax, [rbp + 0x1d0]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001ad00
mov r8, rdi
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x58]
call fcn.18000ae90
jmp 0x18001adff
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.18000ad50
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
mov r8d, 7
lea rdx, str.Roaming
lea rcx, [rsp + 0x78]
call fcn.18000ae90
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
mov r8d, 8
lea rdx, str.LocalLow
lea rcx, [rbp - 0x68]
call fcn.18000ae90
nop
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x38]
call fcn.18001ec40
nop
lea rcx, [rbp - 0x68]
call fcn.180009e50
nop
lea rcx, [rsp + 0x78]
call fcn.180009e50
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001adf5
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.18000ad50
nop
lea rcx, [rsp + 0x38]
call fcn.180009e50
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001ae85
mov r9d, 8
xor r8d, r8d
lea rdx, str.system32
lea rcx, [rsp + 0x58]
call fcn.1800155e0
cmp rax, 0xffffffffffffffff
jne 0x18001ae85
lea r9d, [rax + 0xe]
xor r8d, r8d
lea rdx, str.systemprofile
lea rcx, [rsp + 0x58]
call fcn.1800155e0
cmp rax, 0xffffffffffffffff
jne 0x18001ae85
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001ae70
mov rax, qword [rsi]
jmp 0x18001ae73
mov rax, rsi
mov word [rax], bx
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.180012280
jmp 0x18001ae95
lea rdx, [0x18006ae40]
mov rcx, rsi
call fcn.180018630
nop
lea rcx, [rsp + 0x58]
call fcn.180009e50
nop
mov rcx, r14
call fcn.180009e50
mov rax, rsi
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.18002f6f0
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret