Function at 0x14004d9b0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2668]
mov eax, 0x2768
call fcn.1400707c0
sub rsp, rax
mov qword [rbp - 0x40], 0xfffffffffffffffe
movaps xmmword [rsp + 0x2750], xmm6
movaps xmmword [rsp + 0x2740], xmm7
mov rax, qword [0x1400fb088]
xor rax, rsp
mov qword [rbp + 0x2630], rax
mov r12, r9
mov qword [rbp - 8], r9
mov r15, r8
mov r14, rdx
mov qword [rbp - 0x48], rcx
mov rax, qword [rbp + 0x26d8]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x26e0]
mov qword [rbp - 0x58], rax
xor esi, esi
mov dword [rbp + 0x20], esi
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x630]
call fcn.14008e5d0
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], si
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x68], xmm1
lea rax, [r14 + 0x10]
mov qword [rsp + 0x60], rax
mov qword [rax], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140028cb0
mov rbx, rax
cmp r14, rax
je 0x14004dab2
mov rcx, r14
call fcn.14000564c
movups xmm0, xmmword [rbx]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r14 + 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004daf3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004daee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ea93
call fcn.14006fa74
mov rdx, r14
lea rcx, [rbp]
call fcn.1400281e0
nop
xor edx, edx
lea ecx, [rdx + 0xa]
xor r9d, r9d
call fcn.140014278
test al, al
jne 0x14004dc14
lea rbx, [rbp]
mov r12, qword [rbp]
mov r13, qword [rbp + 0x18]
cmp r13, 8
cmovae rbx, r12
mov r11, qword [rbp + 0x10]
cmp r11, 7
jb 0x14004dc10
lea rdi, [r11 - 6]
lea rdi, [rbx + rdi*2]
mov rax, rbx
lea r8, str.ext_ms_
mov qword [rbp + 0x20], r8
nop dword [rax]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, rsi
je 0x14004db7a
cmp word [rax], 0x65
je 0x14004db77
cmp rcx, 1
je 0x14004db7a
dec rcx
add rax, 2
cmp word [rax], 0x65
jne 0x14004db64
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14004dc10
mov r9d, 7
mov rcx, r8
movzx edx, word [rdx]
mov r8d, 0x65
cmp dx, r8w
jl 0x14004dbc7
mov r10, rax
sub r10, qword [rbp + 0x20]
cmp dx, r8w
jg 0x14004dbc7
cmp r9, 1
je 0x14004dbd7
dec r9
add rcx, 2
movzx edx, word [rcx + r10]
movzx r8d, word [rcx]
cmp dx, r8w
jge 0x14004dba9
add rax, 2
lea r8, str.ext_ms_
jmp 0x14004db50
sub rax, rbx
cmp rax, 2
jae 0x14004dc10
mov eax, 4
cmp r11, rax
cmovb rax, r11
lea rcx, [rbp]
cmp r13, 8
cmovae rcx, r12
sub r11, rax
mov qword [rbp + 0x10], r11
lea r8, [r11*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.14008e170
mov r12, qword [rbp - 8]
mov r13, qword [rbp - 0x48]
mov rdi, qword [r13 + 8]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14004decd
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14004dc3e
mov rdx, qword [rdx]
lea rcx, [rbp]
call fcn.140026f14
cmp rax, 0xffffffffffffffff
jne 0x14004dc55
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14004dc30
cmp rbx, rdi
je 0x14004decd
mov rcx, qword [rbx + 0x30]
cmp rcx, qword [rbx + 0x38]
je 0x14004dcd0
mov rax, r15
cmp qword [r15 + 0x18], 8
jb 0x14004dc75
mov rax, qword [r15]
mov r9, rcx
cmp qword [rcx + 0x18], 8
jb 0x14004dc82
mov r9, qword [rcx]
mov rcx, qword [rcx + 0x10]
cmp rcx, qword [r15 + 0x10]
jne 0x14004dccc
test rcx, rcx
je 0x14004dec0
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jl 0x14004dccc
sub r9, rax
cmp dx, r8w
jg 0x14004dccc
cmp rcx, 1
je 0x14004dec0
dec rcx
add rax, 2
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jge 0x14004dcaa
mov r15, qword [rbx + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.14001939c
mov r9, qword [rbp - 0x58]
mov r8, qword [rbp - 0x50]
mov rdx, r14
call fcn.14004eac0
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004ea3d
cmp edx, 0xc015001d
je 0x14004ea3d
test byte [rbp + 0x26d0], 2
je 0x14004ea3f
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.14008e5d0
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1400056b0
nop
mov r8d, 1
lea rdx, [0x1400d94e8]
lea rcx, [rsp + 0x68]
call fcn.14000a14c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14004dda4
mov rdx, qword [r14]
mov rax, qword [rsp + 0x60]
mov r8, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.14000a14c
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp - 0x78]
mov rcx, r14
call fcn.140004c64
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14004de21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004de1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ea99
call fcn.14006fa74
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004de63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004de5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ea99
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004ea3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004deb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ea99
call fcn.14006fa74
jmp 0x14004ea3f
mov r15, qword [rbx + 0x38]
sub r15, 0x20
jmp 0x14004dcd0
mov r15d, dword [rbp + 0x26d0]
test r15b, 1
jne 0x14004df10
mov r9, qword [rbp - 0x58]
mov r13, qword [rbp - 0x50]
mov r8, r13
mov rdx, r14
call fcn.14004eac0
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004ea3d
cmp edx, 0xc015001d
je 0x14004ea3d
test r15b, 4
je 0x14004df1a
mov esi, 0xc0000225
jmp 0x14004ea3f
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x14004df27
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004ea3f
mov qword [rbp - 0x38], rsi
lea r8, [rbp - 0x38]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x14004e04c
mov ebx, esi
nop
test rdi, rdi
jne 0x14004e042
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x430]
call fcn.14008e5d0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x230]
call fcn.14008e5d0
mov dword [rbp - 8], 0xff
mov dword [rbp + 0x20], esi
lea rax, [rbp - 8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 8]
lea r8, [rbp + 0x430]
mov edx, ebx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
lea rcx, [rbp + 0x230]
call fcn.14009a74c
test eax, eax
jne 0x14004e034
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.14008e5d0
mov dword [rbp - 8], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x30]
test r15b, 8
je 0x14004e025
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004e02b
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x14004e1c0
inc ebx
cmp ebx, 0x1000
jl 0x14004df60
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, qword [r12 + 0x10]
test r8, r8
je 0x14004e40f
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov dword [rbp + 0x20], 0x10
lea rdx, [r8 + 1]
cmp rdx, 7
jbe 0x14004e092
lea rcx, [rsp + 0x40]
call fcn.14001eca0
mov qword [rsp + 0x50], rsi
mov r8, qword [r12 + 0x10]
mov rax, qword [r12 + 0x18]
cmp rax, 8
jb 0x14004e0a1
mov r12, qword [r12]
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.14000a14c
mov r8d, 1
lea rdx, [0x1400d94e8]
lea rcx, [rsp + 0x40]
call fcn.14000a14c
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000a14c
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rbp - 0x28]
call fcn.14000564c
movups xmmword [rbp - 0x28], xmm6
movups xmmword [rbp - 0x18], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004e14a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e145
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ea9f
call fcn.14006fa74
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004e40f
lea rax, [rbp - 0x28]
cmp r14, rax
je 0x14004ea3f
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rbp - 0x18]
mov rdi, qword [r14 + 0x18]
cmp r15, rdi
ja 0x14004e35c
cmp rdi, 8
jb 0x14004e19c
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov qword [rax], r15
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.14008e170
mov word [rbx + r14], si
jmp 0x14004ea3f
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1400056b0
nop
mov r8d, 1
lea rdx, [0x1400d94e8]
lea rcx, [rsp + 0x68]
call fcn.14000a14c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp + 0x230]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14004e230
lea rdx, [rbp + 0x230]
lea rcx, [rsp + 0x40]
call fcn.14000a14c
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp - 0x78]
mov rcx, r14
call fcn.140004c64
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14004e2b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e2b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004eaa5
call fcn.14006fa74
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004e2f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e2f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004eaa5
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004e34d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e348
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004eaa5
call fcn.14006fa74
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004ea3f
movabs rbx, 0x7ffffffffffffffe
cmp r15, rbx
ja 0x14004ea8d
mov rcx, r15
or rcx, 7
cmp rcx, rbx
ja 0x14004e39a
mov rdx, rdi
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp rdi, rax
ja 0x14004e39a
lea rax, [rdx + rdi]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
mov rcx, r14
call fcn.140007ec0
mov r12, rax
mov qword [r14 + 0x18], rbx
mov rax, qword [rsp + 0x60]
lea rbx, [r15 + r15]
mov qword [rax], r15
mov r8, rbx
mov rdx, r13
mov rcx, r12
call fcn.14008e170
mov word [rbx + r12], si
cmp rdi, 8
jb 0x14004e407
lea rdx, [rdi*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x14004e402
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004ea87
mov rcx, r8
call fcn.14006fa74
mov qword [r14], r12
jmp 0x14004ea3f
mov r8d, dword [r13 + 8]
lea rdx, [rbp - 0x78]
call fcn.14004ef80
nop
mov r8d, 1
lea rdx, [0x1400d94e8]
mov rcx, rax
call fcn.14000a14c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000a14c
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rbp - 0x28]
call fcn.14000564c
movups xmmword [rbp - 0x28], xmm6
movups xmmword [rbp - 0x18], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004e4e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e4db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004eaab
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14004e533
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e52e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004eaab
call fcn.14006fa74
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004e61a
lea rax, [rbp - 0x28]
cmp r14, rax
je 0x14004ea3f
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rbp - 0x18]
mov rdi, qword [r14 + 0x18]
cmp r15, rdi
ja 0x14004e5a5
cmp rdi, 8
jb 0x14004e581
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov qword [rax], r15
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.14008e170
mov word [r14 + rbx], si
jmp 0x14004ea3f
movabs rbx, 0x7ffffffffffffffe
cmp r15, rbx
ja 0x14004ea8d
mov rcx, r15
or rcx, 7
cmp rcx, rbx
ja 0x14004e5e3
mov rdx, rdi
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp rdi, rax
ja 0x14004e5e3
lea rax, [rdi + rdx]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
mov rcx, r14
call fcn.140007ec0
mov r12, rax
mov rax, qword [rsp + 0x60]
mov qword [rax], r15
mov qword [r14 + 0x18], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, r12
call fcn.14008e170
mov word [r12 + rbx], si
jmp 0x14004e3cc
mov edx, 0x1000
lea rcx, [rbp + 0x630]
test r15b, 8
je 0x14004e634
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004e63a
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x68]
call fcn.1400056b0
nop
mov r8d, 1
lea rdx, [0x1400d94e8]
lea rcx, [rsp + 0x68]
call fcn.14000a14c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000a14c
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rbp - 0x28]
call fcn.14000564c
movups xmmword [rbp - 0x28], xmm6
movups xmmword [rbp - 0x18], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004e724
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e71f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004eab1
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004e778
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e773
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004eab1
call fcn.14006fa74
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004e7fe
lea rax, [rbp - 0x28]
cmp r14, rax
je 0x14004ea3f
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rbp - 0x18]
mov rdi, qword [r14 + 0x18]
cmp r15, rdi
ja 0x14004e7e6
cmp rdi, 8
jb 0x14004e7c2
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov qword [rax], r15
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.14008e170
mov word [r14 + rbx], si
jmp 0x14004ea3f
movabs rbx, 0x7ffffffffffffffe
cmp r15, rbx
ja 0x14004ea8d
jmp 0x14004e36f
mov edx, 0x1000
lea rcx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x68]
call fcn.1400056b0
nop
mov r8d, 1
lea rdx, [0x1400d94e8]
lea rcx, [rsp + 0x68]
call fcn.14000a14c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea r8, [rbp]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call fcn.14001e5c0
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004c64
lea rcx, [rsp + 0x40]
call fcn.14000564c
nop
lea rcx, [rbp - 0x78]
call fcn.14000564c
nop
lea rcx, [rsp + 0x68]
call fcn.14000564c
lea rcx, [rbp - 0x28]
call fcn.140004c54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004e8d7
lea rdx, [rbp - 0x28]
mov rcx, r14
call fcn.14001939c
jmp 0x14004ea3f
lea rdx, [rbp + 0x630]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x40]
call fcn.140004cac
nop
lea r8, [0x1400d94e8]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140008eb8
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14001e5c0
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004c64
lea rcx, [rbp - 0x78]
call fcn.14000564c
nop
lea rcx, [rsp + 0x68]
call fcn.14000564c
nop
lea rcx, [rsp + 0x40]
call fcn.14000564c
lea rcx, [rbp - 0x28]
call fcn.140004c54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004e8c6
mov r8d, 0x1000
lea rdx, [rbp + 0x630]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x30]
lea rdx, [0x1400da4e8]
lea rcx, [rbp + 0x630]
call fcn.14009ab44
test rax, rax
je 0x14004df10
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140004cac
nop
lea r8, [0x1400d94e8]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140008eb8
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14001e5c0
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004c64
lea rcx, [rbp - 0x78]
call fcn.14000564c
nop
lea rcx, [rsp + 0x68]
call fcn.14000564c
nop
lea rcx, [rsp + 0x40]
call fcn.14000564c
lea rcx, [rbp - 0x28]
call fcn.140004c54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004e8c6
lea r8, [rbp - 0x30]
lea rdx, [0x1400da4e8]
mov rcx, qword [rbp - 0x30]
call fcn.14009ab44
test rax, rax
jne 0x14004e9a0
mov esi, 0xc0000225
jmp 0x14004ea3f
mov esi, edx
lea rcx, [rbp]
call fcn.14000564c
nop
lea rcx, [rbp - 0x28]
call fcn.14000564c
mov eax, esi
mov rcx, qword [rbp + 0x2630]
xor rcx, rsp
call fcn.14006fa50
movaps xmm6, xmmword [rsp + 0x2750]
movaps xmm7, xmmword [rsp + 0x2740]
add rsp, 0x2768
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140097f2c
nop
call fcn.14000a138
nop
call fcn.140097f2c
nop
call fcn.140097f2c
nop
call fcn.140097f2c
nop
call fcn.140097f2c
nop
call fcn.140097f2c
nop
call fcn.140097f2c
int3