Function at 0x140018a00
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a18]
mov eax, 0x2b18
call fcn.1400834a0
sub rsp, rax
movaps xmmword [rsp + 0x2b00], xmm6
movaps xmmword [rsp + 0x2af0], xmm7
mov rax, qword [0x1400e7100]
xor rax, rsp
mov qword [rbp + 0x29e0], rax
mov r12, r9
mov qword [rsp + 0x70], r9
mov rdi, r8
mov r14, rdx
mov r13, rcx
mov rax, qword [rbp + 0x2a88]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x2a90]
mov qword [rsp + 0x40], rax
xor r15d, r15d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x9e0]
call fcn.1400aff50
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x198], 7
mov word [rbp + 0x180], r15w
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 7
mov word [r14], r15w
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x138]
call fcn.140014d30
mov rdx, rax
mov rcx, r14
call fcn.14000eba0
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x140018b2c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018b27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a031
call fcn.140082b70
mov r8, qword [r14 + 0x10]
mov rsi, 0xffffffffffffffff
test r8, r8
je 0x140018c12
mov rdx, r14
mov r9, qword [r14 + 0x18]
cmp r9, 7
jbe 0x140018b50
mov rdx, qword [r14]
lea rcx, [r8 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x140018b77
cmp rcx, rdx
je 0x140018b82
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x140018b68
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
jne 0x140018bc0
mov rdx, r14
cmp r9, 7
jbe 0x140018b8e
mov rdx, qword [r14]
lea rcx, [r8 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2f
je 0x140018bb5
cmp rcx, rdx
je 0x140018c12
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x140018ba6
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
je 0x140018c12
inc rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], r15
mov rax, r8
cmp r8, rcx
jb 0x14001a037
sub rax, rcx
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
mov rax, r14
cmp r9, 7
jbe 0x140018c00
mov rax, qword [r14]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x1a0]
call fcn.140002850
jmp 0x140018c22
mov rdx, r14
lea rcx, [rbp + 0x1a0]
call fcn.140004c20
nop
cmp dword [0x1400eabac], 9
ja 0x140018d1e
lea r10, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova r10, qword [rbp + 0x1a0]
mov rbx, qword [rbp + 0x1b0]
cmp rbx, 7
jb 0x140018d1e
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x1400d4cc0]
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, r15
je 0x140018c96
cmp word [rcx], 0x65
je 0x140018c93
nop dword [rax]
cmp rax, 1
je 0x140018c96
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x140018c80
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140018d1e
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x1400d4cc0]
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x140018db4
add rdx, 2
sub r8, 1
jne 0x140018cc0
sub rcx, r10
sar rcx, 1
jne 0x140018d1e
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rcx, qword [rbp + 0x1a0]
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call fcn.1400b0310
mov qword [rbp + 0x1b0], rbx
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x14001900c
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140018d3e
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1a0]
call fcn.14001a8e0
cmp rax, 0xffffffffffffffff
jne 0x140018d5b
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r15
jne 0x140018d30
cmp rbx, r15
je 0x14001900c
mov rdx, qword [rbx + 0x30]
cmp rdx, qword [rbx + 0x38]
je 0x140018dd6
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x140018d7c
mov rdi, qword [rdi]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140018d8a
mov rdx, qword [rdx]
cmp rcx, rax
jne 0x140018dbd
test rcx, rcx
je 0x140018daa
sub rdx, rdi
movzx eax, word [rdi + rdx]
cmp ax, word [rdi]
jne 0x140018dbd
add rdi, 2
sub rcx, 1
jne 0x140018d97
mov rdx, qword [rbx + 0x38]
sub rdx, 0x20
jmp 0x140018dc1
add rcx, 2
jmp 0x140018c62
mov rdx, qword [rbx + 0x30]
cmp r14, rdx
je 0x140018df4
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140018dec
mov rdx, qword [rdx]
jmp 0x140018dec
cmp r14, rdi
je 0x140018df4
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x140018de9
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r14
call fcn.14000ecd0
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, r14
call fcn.14001a0e0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140019f51
cmp ebx, 0xc015001d
je 0x140019f51
test byte [rbp + 0x2a80], 2
je 0x140019005
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x5e0]
call fcn.1400aff50
mov edx, 0xff
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
lea rax, [rbp + 0x5e0]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140018e72
mov r8, rsi
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x98]
call fcn.140002850
nop
mov r8d, 1
lea rdx, [0x1400d4cbc]
lea rcx, [rbp + 0x98]
call fcn.140004b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x140018ee8
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp - 0x48]
call fcn.140004b20
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.14000eba0
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140018f65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018f5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a03d
call fcn.140082b70
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x140018fa5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018fa0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a043
call fcn.140082b70
movdqa xmm0, xmmword [0x1400d5f60]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], bx
mov rdx, qword [rbp + 0xb0]
cmp rdx, 7
jbe 0x140019f51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018ffb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a049
call fcn.140082b70
jmp 0x140019f51
xor ebx, ebx
jmp 0x140019f51
mov r15d, dword [rbp + 0x2a80]
test r15b, 1
jne 0x140019f4c
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, r14
call fcn.14001a0e0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140019f51
cmp ebx, 0xc015001d
je 0x140019f51
test r15b, 4
jne 0x140019f4c
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x140019063
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r13d, r13d
cmp eax, 0xffffffff
je 0x140019079
mov ebx, r13d
jmp 0x140019f54
mov qword [rbp + 0x1d0], r13
lea r8, [rbp + 0x1d0]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x1400191b7
mov ebx, r13d
nop dword [rax]
test rdi, rdi
jne 0x1400191b7
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x7e0]
call fcn.1400aff50
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x3e0]
call fcn.1400aff50
mov dword [rbp + 0x1c0], 0xff
mov dword [rbp + 0x1c8], r13d
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1c0]
lea r8, [rbp + 0x7e0]
mov edx, ebx
mov rcx, qword [rbp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x3e0]
call fcn.1400993a8
test eax, eax
jne 0x1400191a9
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x1e0]
call fcn.1400aff50
mov dword [rbp + 0x1c0], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x1e0]
test r15b, 8
je 0x14001919a
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x1400191a0
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x14001953c
inc ebx
cmp ebx, 0x1000
jl 0x1400190b0
mov rdi, qword [r12 + 0x10]
test rdi, rdi
je 0x140019372
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
sub rax, rdi
cmp rax, 1
jb 0x14001a04f
cmp qword [r12 + 0x18], 7
jbe 0x1400191f0
mov r12, qword [r12]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea r13, [rdi + 1]
mov eax, 7
lea r12, [rbp - 0x68]
cmp r13, rax
jbe 0x14001924d
mov rax, r13
or rax, 7
cmp rax, rbx
ja 0x14001922c
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
inc rbx
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140002920
mov r12, rax
lea rax, [rbx - 1]
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], rax
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, qword [rsp + 0x70]
mov rcx, r12
call fcn.1400b0310
mov word [r12 + rbx], 0x5c
xor ebx, ebx
mov word [r12 + r13*2], bx
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp - 0x68]
call fcn.140004b20
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r13d, r13d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x1400192fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400192f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a067
call fcn.140082b70
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x14001934c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019347
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a06d
call fcn.140082b70
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140019f15
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax + 8]
lea rdx, [rbp + 0x158]
call fcn.14001a680
nop
mov r8d, 1
lea rdx, [0x1400d4cbc]
mov rcx, rax
call fcn.140004b20
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp - 8]
call fcn.140004b20
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14001944f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001944a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a073
call fcn.140082b70
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14001949d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019498
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a079
call fcn.140082b70
movdqa xmm0, xmmword [0x1400d5f60]
movdqu xmmword [rbp + 8], xmm0
mov word [rbp - 8], r13w
mov rdx, qword [rbp + 0x170]
cmp rdx, 7
jbe 0x1400194f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400194f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a07f
call fcn.140082b70
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140019f15
mov edx, 0x1000
lea rcx, [rbp + 0x9e0]
test r15b, 8
je 0x140019702
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140019708
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
lea rax, [rbp + 0x1e0]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140019560
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0xb8]
call fcn.140002850
nop
mov r8d, 1
lea rdx, [0x1400d4cbc]
lea rcx, [rbp + 0xb8]
call fcn.140004b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r13
mov word [rax], r13w
lea rax, [rbp + 0x3e0]
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400195d0
mov r8, rsi
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp - 0x28]
call fcn.140004b20
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.14000eba0
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14001965e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019658
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a055
call fcn.140082b70
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14001969e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019699
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a05b
call fcn.140082b70
movdqa xmm0, xmmword [0x1400d5f60]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r13w
mov rdx, qword [rbp + 0xd0]
cmp rdx, 7
jbe 0x140019f47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400196f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a061
call fcn.140082b70
mov ebx, r13d
jmp 0x140019f01
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140019730
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xd8]
call fcn.140002850
nop
mov r8d, 1
lea rdx, [0x1400d4cbc]
lea rcx, [rbp + 0xd8]
call fcn.140004b20
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x18]
call fcn.140004b20
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14001981a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019815
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a085
call fcn.140082b70
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x140019868
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019863
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a08b
call fcn.140082b70
movdqa xmm0, xmmword [0x1400d5f60]
movdqu xmmword [rbp + 0x28], xmm0
mov word [rbp + 0x18], r13w
mov rdx, qword [rbp + 0xf0]
cmp rdx, 7
jbe 0x1400198c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400198bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a091
call fcn.140082b70
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140019f15
mov edx, 0x1000
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x108], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140019920
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xf8]
call fcn.140002850
nop
mov r8d, 1
lea rdx, [0x1400d4cbc]
lea rcx, [rbp + 0xf8]
call fcn.140004b20
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x38]
call fcn.140004b20
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x140019a0a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019a05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a097
call fcn.140082b70
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x140019a58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019a53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a09d
call fcn.140082b70
movdqa xmm0, xmmword [0x1400d5f60]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r13w
mov rdx, qword [rbp + 0x110]
cmp rdx, 7
jbe 0x140019ab0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019aab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a0a3
call fcn.140082b70
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140019f15
lea rdx, [rbp + 0x9e0]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x128], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140019b10
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x118]
call fcn.140002850
nop
mov r8d, 1
lea rdx, [0x1400d4cbc]
lea rcx, [rbp + 0x118]
call fcn.140004b20
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x58]
call fcn.140004b20
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x140019bfa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019bf5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a0a9
call fcn.140082b70
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x140019c48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019c43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a0af
call fcn.140082b70
movdqa xmm0, xmmword [0x1400d5f60]
movdqu xmmword [rbp + 0x68], xmm0
mov word [rbp + 0x58], r13w
mov rdx, qword [rbp + 0x130]
cmp rdx, 7
jbe 0x140019ca0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019c9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a0b5
call fcn.140082b70
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140019f15
mov r8d, 0x1000
lea rdx, [rbp + 0x9e0]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp + 0x178]
lea rdx, [0x1400d4d54]
lea rcx, [rbp + 0x9e0]
call fcn.1400996c4
test rax, rax
je 0x140019efc
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r13
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140019d30
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.140002850
nop
mov r8d, 1
lea rdx, [0x1400d4cbc]
lea rcx, [rbp + 0x78]
call fcn.140004b20
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rsp + 0x78]
call fcn.140004b20
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x140019e13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a0bb
call fcn.140082b70
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140019e62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a0c1
call fcn.140082b70
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rbp + 0x90]
cmp rdx, 7
jbe 0x140019eb7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019eb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a0c7
call fcn.140082b70
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140019f15
lea r8, [rbp + 0x178]
lea rdx, [0x1400d4d54]
mov rcx, qword [rbp + 0x178]
call fcn.1400996c4
test rax, rax
jne 0x140019d10
mov ebx, 0xc0000225
mov rcx, qword [rbp + 0x1d0]
test rcx, rcx
jle 0x140019f54
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140019f54
lea rax, [rbp + 0x180]
cmp r14, rax
je 0x140019f47
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
mov r8, qword [rbp + 0x190]
cmova rdx, qword [rbp + 0x180]
mov rcx, r14
call fcn.14000ecd0
mov ebx, r13d
jmp 0x140019f01
mov ebx, 0xc0000225
xor r13d, r13d
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 7
jbe 0x140019f9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a0cd
call fcn.140082b70
mov qword [rbp + 0x1b0], r13
mov qword [rbp + 0x1b8], 7
mov word [rbp + 0x1a0], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x140019ff6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019ff1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a02b
call fcn.140082b70
mov eax, ebx
mov rcx, qword [rbp + 0x29e0]
xor rcx, rsp
call fcn.140082b50
movaps xmm6, xmmword [rsp + 0x2b00]
movaps xmm7, xmmword [rsp + 0x2af0]
add rsp, 0x2b18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.140013d40
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.140001400
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
nop
call fcn.14008e6a0
int3