Function at 0x140048ab0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2648]
mov eax, 0x2748
call fcn.140069ca0
sub rsp, rax
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rbp + 0x2630], rax
mov r12, r9
mov qword [rbp], r9
mov r14, r8
mov rsi, rdx
mov qword [rbp - 0x48], rcx
mov rax, qword [rbp + 0x26b8]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x26c0]
mov qword [rbp - 8], rax
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x630]
call fcn.14006ba60
xor edi, edi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], di
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp - 0x58], xmm1
lea r15, [rsi + 0x10]
mov qword [rbp - 0x80], r15
mov qword [r15], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x60]
call fcn.140024ef0
mov rbx, rax
cmp rsi, rax
je 0x140048bd9
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x140048bae
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140048ba9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140049d54
mov rcx, r8
call fcn.140068fd0
mov qword [r15], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140048c1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048c16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d54
call fcn.140068fd0
mov rdx, rsi
lea rcx, [rbp + 8]
call fcn.140024440
nop
cmp dword [0x1400c933c], 9
ja 0x140048d33
lea rbx, [rbp + 8]
mov r12, qword [rbp + 8]
mov r13, qword [rbp + 0x20]
cmp r13, 8
cmovae rbx, r12
mov r11, qword [rbp + 0x18]
cmp r11, 7
jb 0x140048d2f
lea r15, [r11 - 6]
lea r15, [rbx + r15*2]
mov rax, rbx
lea r8, str.ext_ms_
mov qword [rbp - 0x78], r8
nop dword [rax]
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov rdx, rdi
je 0x140048c9a
cmp word [rax], 0x65
je 0x140048c97
cmp rcx, 1
je 0x140048c9a
dec rcx
add rax, 2
cmp word [rax], 0x65
jne 0x140048c84
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140048d2f
mov r9d, 7
mov rcx, r8
movzx edx, word [rdx]
mov r8d, 0x65
cmp dx, r8w
jb 0x140048ce7
mov r10, rax
sub r10, qword [rbp - 0x78]
cmp dx, r8w
ja 0x140048ce7
cmp r9, 1
je 0x140048cf7
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x140048cc9
add rax, 2
lea r8, str.ext_ms_
jmp 0x140048c70
sub rax, rbx
sar rax, 1
jne 0x140048d2f
mov eax, 4
cmp r11, rax
cmovb rax, r11
lea rcx, [rbp + 8]
cmp r13, 8
cmovae rcx, r12
sub r11, rax
mov qword [rbp + 0x18], r11
lea r8, [r11*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.14006b390
mov r12, qword [rbp]
mov r13, qword [rbp - 0x48]
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x14004904a
nop word [rax + rax]
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140048d5e
mov rdx, qword [rdx]
lea rcx, [rbp + 8]
call fcn.14002320c
cmp rax, 0xffffffffffffffff
jne 0x140048d78
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r15
jne 0x140048d50
cmp rbx, r15
je 0x14004904a
mov r8, qword [rbx + 0x30]
cmp r8, qword [rbx + 0x38]
je 0x140048ded
mov rcx, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x140048d99
mov r14, qword [r14]
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140048da7
mov r8, qword [r8]
cmp rax, rcx
jne 0x140048de9
test rax, rax
je 0x140048f5c
movzx ecx, word [r8]
movzx edx, word [r14]
cmp cx, dx
jb 0x140048de9
sub r8, r14
cmp cx, dx
ja 0x140048de9
cmp rax, 1
je 0x140048f5c
dec rax
add r14, 2
movzx ecx, word [r8 + r14]
movzx edx, word [r14]
cmp cx, dx
jae 0x140048dc8
mov r14, qword [rbx + 0x30]
mov rdx, r14
mov rcx, rsi
call fcn.140016f20
mov r9, qword [rbp - 8]
mov r8, qword [rbp - 0x38]
mov rdx, rsi
call fcn.140049dc0
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140049d0e
cmp edx, 0xc015001d
je 0x140049d0e
test byte [rbp + 0x26b0], 2
je 0x140049d10
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.14006ba60
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1400066f4
nop
mov r8d, 1
lea rdx, [0x1400b2728]
lea rcx, [rsp + 0x60]
call fcn.140009240
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140048ecc
mov rdx, qword [rsi]
mov rax, qword [rbp - 0x80]
mov r8, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.140009240
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rax, [rbp - 0x68]
cmp rsi, rax
je 0x140048f69
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x140048f53
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140048f46
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140049d5a
mov rcx, r8
call fcn.140068fd0
movups xmm0, xmmword [rbp - 0x48]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x140048faa
mov r14, qword [rbx + 0x38]
sub r14, 0x20
jmp 0x140048ded
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x140048faa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048fa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d5a
call fcn.140068fd0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140048fec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048fe7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d60
call fcn.140068fd0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140049d10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049040
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d66
call fcn.140068fd0
jmp 0x140049d10
mov r15d, dword [rbp + 0x26b0]
test r15b, 1
jne 0x14004908d
mov r9, qword [rbp - 8]
mov r13, qword [rbp - 0x38]
mov r8, r13
mov rdx, rsi
call fcn.140049dc0
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140049d0e
cmp edx, 0xc015001d
je 0x140049d0e
test r15b, 4
je 0x140049097
mov edi, 0xc0000225
jmp 0x140049d10
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400490a4
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140049d10
mov qword [rbp + 0x28], rdi
lea r8, [rbp + 0x28]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd r14, eax
test eax, eax
jne 0x1400491c2
mov ebx, edi
nop dword [rax]
test r14, r14
jne 0x1400491c2
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x430]
call fcn.14006ba60
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x230]
call fcn.14006ba60
mov dword [rbp - 8], 0xff
mov dword [rbp], edi
lea rax, [rbp - 8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 8]
lea r8, [rbp + 0x430]
mov edx, ebx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd r14, eax
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rdx, qword [rbp + 8]
lea rcx, [rbp + 0x230]
call fcn.14007958c
test eax, eax
jne 0x1400491b4
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.14006ba60
mov dword [rbp - 8], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x30]
test r15b, 8
je 0x1400491a5
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x1400491ab
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test r14, r14
je 0x14004935a
inc ebx
cmp ebx, 0x1000
jl 0x1400490e0
mov rcx, qword [r12 + 0x10]
lea r14, [0x1400b2728]
movabs rbx, 0x7ffffffffffffffe
test rcx, rcx
je 0x14004961f
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x140049d6c
cmp qword [r12 + 0x18], 8
jb 0x1400491fd
mov r12, qword [r12]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
mov r9, r12
lea rcx, [rbp - 0x68]
call fcn.14001b334
nop
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rdx, qword [rbp + 8]
mov r8, qword [rbp + 0x18]
lea rcx, [rbp - 0x68]
call fcn.140009240
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14004929e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049291
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d84
call fcn.140068fd0
movups xmm0, xmmword [rbp - 0x48]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1400492e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400492e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d8a
call fcn.140068fd0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004961f
lea rax, [rbp - 0x28]
cmp rsi, rax
je 0x140049cf5
mov r12, qword [rbp - 0x18]
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rsi + 0x18]
cmp r12, r15
ja 0x140049551
cmp r15, 8
jb 0x140049338
mov rsi, qword [rsi]
mov rax, qword [rbp - 0x80]
mov qword [rax], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.14006b390
mov word [rbx + rsi], di
jmp 0x140049cf5
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1400066f4
nop
mov r8d, 1
lea rdx, [0x1400b2728]
lea rcx, [rsp + 0x60]
call fcn.140009240
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rax, [rbp + 0x230]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400493d5
lea rdx, [rbp + 0x230]
lea rcx, [rsp + 0x40]
call fcn.140009240
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rax, [rbp - 0x68]
cmp rsi, rax
je 0x140049470
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x140049467
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004945a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140049d72
mov rcx, r8
call fcn.140068fd0
movups xmm0, xmmword [rbp - 0x48]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400494b1
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1400494b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400494ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d72
call fcn.140068fd0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400494f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400494ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d78
call fcn.140068fd0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140049cf5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049547
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d7e
call fcn.140068fd0
jmp 0x140049cf5
cmp r12, rbx
ja 0x140049d4e
mov rcx, r12
or rcx, 7
cmp rcx, rbx
jbe 0x14004956f
mov rcx, 0xfffffffffffffffe
jmp 0x1400495ba
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
jbe 0x140049589
mov rcx, 0xfffffffffffffffe
jmp 0x1400495ba
lea rax, [rdx + r15]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x140049d48
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400495e6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140049d48
mov rcx, rax
call fcn.140068fd8
test rax, rax
je 0x140049db4
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400495f8
test rcx, rcx
je 0x1400495f5
call fcn.140068fd8
mov r14, rax
jmp 0x1400495f8
mov r14, rdi
mov rax, qword [rbp - 0x80]
mov qword [rax], r12
mov qword [rsi + 0x18], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.14006b390
mov word [rbx + r14], di
jmp 0x1400498c5
mov r8d, dword [r13 + 8]
lea rdx, [rbp - 0x68]
call fcn.14004a270
nop
mov r8d, 1
mov rdx, r14
mov rcx, rax
call fcn.140009240
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rdx, qword [rbp + 8]
mov r8, qword [rbp + 0x18]
lea rcx, [rsp + 0x40]
call fcn.140009240
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400496ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400496e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d90
call fcn.140068fd0
movups xmm0, xmmword [rbp - 0x48]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140049739
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049734
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d96
call fcn.140068fd0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x14004978c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049787
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049d9c
call fcn.140068fd0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140049908
lea rax, [rbp - 0x28]
cmp rsi, rax
je 0x140049cf5
mov r12, qword [rbp - 0x18]
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rsi + 0x18]
cmp r12, r15
ja 0x1400497fc
cmp r15, 8
jb 0x1400497da
mov rsi, qword [rsi]
mov rax, qword [rbp - 0x80]
mov qword [rax], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.14006b390
mov word [rsi + rbx], di
jmp 0x140049cf5
cmp r12, rbx
ja 0x140049d4e
mov rcx, r12
or rcx, 7
cmp rcx, rbx
jbe 0x14004981a
mov rcx, 0xfffffffffffffffe
jmp 0x140049865
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
jbe 0x140049834
mov rcx, 0xfffffffffffffffe
jmp 0x140049865
lea rax, [r15 + rdx]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140049d48
add rcx, rcx
cmp rcx, 0x1000
jb 0x140049891
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140049d48
mov rcx, rax
call fcn.140068fd8
test rax, rax
je 0x140049db4
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400498a3
test rcx, rcx
je 0x1400498a0
call fcn.140068fd8
mov r14, rax
jmp 0x1400498a3
mov r14, rdi
mov rax, qword [rbp - 0x80]
mov qword [rax], r12
mov qword [rsi + 0x18], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.14006b390
mov word [r14 + rbx], di
cmp r15, 8
jb 0x140049900
lea rdx, [r15*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400498fb
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140049db4
mov rcx, r8
call fcn.140068fd0
mov qword [rsi], r14
jmp 0x140049cf5
mov edx, 0x1000
lea rcx, [rbp + 0x630]
test r15b, 8
je 0x140049922
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140049928
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x60]
call fcn.1400066f4
nop
mov r8d, 1
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140009240
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rdx, qword [rbp + 8]
mov r8, qword [rbp + 0x18]
lea rcx, [rsp + 0x40]
call fcn.140009240
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140049a16
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049a09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049da2
call fcn.140068fd0
movups xmm0, xmmword [rbp - 0x48]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140049a60
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049a5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049da8
call fcn.140068fd0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140049ab5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049ab0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049dae
call fcn.140068fd0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140049b2f
lea rax, [rbp - 0x28]
cmp rsi, rax
je 0x140049cf5
mov r12, qword [rbp - 0x18]
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rsi + 0x18]
cmp r12, r15
ja 0x140049b21
cmp r15, 8
jb 0x140049aff
mov rsi, qword [rsi]
mov rax, qword [rbp - 0x80]
mov qword [rax], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.14006b390
mov word [rsi + rbx], di
jmp 0x140049cf5
cmp r12, rbx
ja 0x140049d4e
jmp 0x14004955a
mov edx, 0x1000
lea rcx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x40]
call fcn.140004270
nop
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000803c
nop
lea r8, [rbp + 8]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14001ae20
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004228
lea rcx, [rbp - 0x68]
call fcn.140006690
nop
lea rcx, [rsp + 0x60]
call fcn.140006690
nop
lea rcx, [rsp + 0x40]
call fcn.140006690
lea rcx, [rbp - 0x28]
call fcn.1400250b0
test al, al
jne 0x140049d00
lea rdx, [rbp + 0x630]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x40]
call fcn.140004270
nop
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000803c
nop
lea r8, [rbp + 8]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14001ae20
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004228
lea rcx, [rbp - 0x68]
call fcn.140006690
nop
lea rcx, [rsp + 0x60]
call fcn.140006690
nop
lea rcx, [rsp + 0x40]
call fcn.140006690
lea rcx, [rbp - 0x28]
call fcn.1400250b0
test al, al
jne 0x140049d00
mov r8d, 0x1000
lea rdx, [rbp + 0x630]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x30]
lea rdx, [0x1400b3718]
lea rcx, [rbp + 0x630]
call fcn.140079944
test rax, rax
je 0x140049cf0
nop dword [rax + rax]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140004270
nop
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000803c
nop
lea r8, [rbp + 8]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14001ae20
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004228
lea rcx, [rbp - 0x68]
call fcn.140006690
nop
lea rcx, [rsp + 0x60]
call fcn.140006690
nop
lea rcx, [rsp + 0x40]
call fcn.140006690
lea rcx, [rbp - 0x28]
call fcn.1400250b0
test al, al
jne 0x140049d00
lea r8, [rbp - 0x30]
lea rdx, [0x1400b3718]
mov rcx, qword [rbp - 0x30]
call fcn.140079944
test rax, rax
jne 0x140049c70
mov edi, 0xc0000225
lea rcx, [rbp + 0x28]
call fcn.140026a70
jmp 0x140049d10
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.140016f20
jmp 0x140049cf5
mov edi, edx
lea rcx, [rbp + 8]
call fcn.140006690
nop
lea rcx, [rbp - 0x28]
call fcn.140006690
mov eax, edi
mov rcx, qword [rbp + 0x2630]
xor rcx, rsp
call fcn.140068fb0
add rsp, 0x2748
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140001150
nop
call fcn.1400012b0
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.1400012b0
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
nop
call fcn.140077970
int3
call fcn.140077970
int3