Function at 0x140012860
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get geographical location
Get program files directory
Get startup folder
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0xd20]
sub rsp, 0xe20
mov rax, qword [0x1400623d0]
xor rax, rsp
mov qword [rbp + 0xd10], rax
lea rdx, str.Environment
lea rcx, [0x140065980]
mov r8d, 1
mov qword [rsp + 0xe30], rsi
call fcn.140012670
lea rdx, str.Online_Services
lea rcx, str.OnlineServices
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140063e38]
lea rcx, str.ISO_LG
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140063e40]
lea rcx, str.ISO_UILG
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140063e48]
lea rcx, str.ISO_UILG3
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140063e50]
lea rcx, str.ISO_UILGCTRY
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140063e90]
lea rcx, str.ISO_UILGCTRYLIST
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140064698]
lea rcx, str.MUIPACKS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140063de8]
lea rcx, str.ISO_COUNTRY
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140063e30]
lea rcx, str.ISO_COUNTRY3
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400646a0]
lea rcx, str.COUNTRY
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400648a0]
lea rcx, str.LANGUAGE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140064920]
lea rcx, str.EXPANDEDLANGUAGE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400648e0]
lea rcx, str.NATIVELANGUAGE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400648a0]
lea rcx, [0x140048af0]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140063df0]
lea rcx, str.ISOLANGCOUNTRYCODE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140064960]
lea rcx, str.CurrentInstanceGUID
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, dword [0x140063dd8]
lea rdx, [0x140047568]
lea rcx, [rbp + 0x900]
call fcn.14001c9d4
lea rdx, [rbp + 0x900]
lea rcx, str.COUNTRYID
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, dword [0x140063ddc]
lea rdx, [0x140047568]
lea rcx, [rbp + 0x900]
call fcn.14001c9d4
lea rdx, [rbp + 0x900]
lea rcx, str.COUNTRYCODE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x2f]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.ADMINISTRATIVE_TOOLS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rbp + 0x2e0]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 0x2e]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_ADMINISTRATIVE_TOOLS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x1f]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.CACHE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x3a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.CD_BURNING
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x20]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COOKIES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rbp + 0x2e0]
mov r9d, 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.DESKTOP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x18]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_DESKTOP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 5]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.FAVORITES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x13]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.FONTS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rbp + 0x2e0]
mov r9d, 1
lea edx, [r9 + 0x21]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.HISTORY
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x1b]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.LOCAL_APPDATA
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x22]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_APPDATA
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 4]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.PERSONAL
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.MY_DOCUMENTS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x2d]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_DOCUMENTS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0xc]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.MY_MUSIC
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x34]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMONMUSIC
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x26]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.MY_PICTURES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rbp + 0x2e0]
mov r9d, 1
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x35]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMONPICTURES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0xd]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.MY_VIDEO
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x36]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMONVIDEO
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0xa]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.START_MENU
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x15]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_START_MENU
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.PROGRAMS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x16]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_PROGRAMS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 6]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.STARTUP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rbp + 0x2e0]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 0x17]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_STARTUP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x14]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.TEMPLATES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x2c]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_TEMPLATES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x12]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.NETHOOD
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.PRINTHOOD
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 7]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.RECENT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 8]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.SENDTO
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x39]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.OEM_LINKS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.C:hp_tmp_src_bitswt_wc
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
call fcn.140010240
lea rcx, str.OSHAL
cmp eax, 1
jne 0x140013180
lea rdx, [0x140048f34]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, str.SOFTWAREWow6432Node
lea rcx, str.SoftwareRegKey
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp ebx, 0xffffffff
je 0x140013216
lea rdx, str.SOFTWAREWow6432NodeMicrosoft
jmp 0x140013209
lea rdx, [0x140048fe0]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rbp + 0xb00]
lea rcx, str.CommonProgramFiles
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rbp + 0xb00]
lea rcx, str.CommonProgramFiles_x86_
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rbp + 0xb00]
lea rcx, str.ProgramFiles
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rbp + 0xb00]
lea rcx, str.ProgramFiles_x86_
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, str.SOFTWARE
lea rcx, str.SoftwareRegKey
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp ebx, 0xffffffff
je 0x140013216
lea rdx, str.SOFTWAREMicrosoft
lea rcx, str.SoftwareRegKey
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov qword [rsp + 0xe38], rdi
call fcn.140012120
lea rcx, str.C:System.savutil_vars.ini
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
lea rsi, str.Pavilion
cmp eax, 0xffffffff
je 0x140013969
lea r8d, [rbx + 1]
lea rdx, str.Bios_Strings
lea rcx, str.C:System.savutil_vars.ini
call fcn.140012670
lea r8d, [rbx + 1]
lea rdx, str.toolset
lea rcx, str.C:System.savutil_vars.ini
call fcn.140012670
lea r8d, [rbx + 1]
lea rdx, [0x140049130]
lea rcx, str.C:System.savutil_vars.ini
call fcn.140012670
lea r8d, [rbx + 8]
lea rdx, [0x140066720]
lea rcx, str.LanguageCode
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x210]
lea rcx, str.CT.AIO
mov qword [rbp + 0x210], rbx
mov qword [rbp + 0x218], rax
mov qword [rbp + 0x2a0], rbx
mov qword [rbp + 0x2a8], rax
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1a0], rbx
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], rax
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x278], rax
mov qword [rbp + 0x250], rbx
mov qword [rbp + 0x258], rax
mov qword [rbp + 0x2d0], rbx
mov qword [rbp + 0x2d8], rax
mov qword [rbp + 0x2c0], rbx
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x2b0], rbx
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x1e0], rbx
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x290], rbx
mov qword [rbp + 0x298], rax
mov qword [rbp + 0x240], rbx
mov qword [rbp + 0x248], rax
mov qword [rbp + 0x200], rbx
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x280], rbx
mov qword [rbp + 0x288], rax
mov qword [rbp + 0x220], rbx
mov qword [rbp + 0x228], rax
mov qword [rbp + 0x260], rbx
mov qword [rbp + 0x268], rax
mov qword [rbp + 0x1d0], rbx
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x1f0], rbx
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x1c8], rax
mov qword [rbp + 0x230], rbx
mov qword [rbp + 0x238], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x2a0]
lea rcx, str.CT.MT
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1b0]
lea rcx, str.CT.NB
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1a0]
lea rcx, str.CT.TAB
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x190]
lea rcx, str.PLT.TOU
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x270]
lea rcx, str.PCBR.HP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x250]
lea rcx, str.PCBR.CPQ
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x2d0]
lea rcx, str.SL.MAI
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x2c0]
lea rcx, str.SL.PRE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x2b0]
lea rcx, str.SL.BUD
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1e0]
lea rcx, str.SEG.CON
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x290]
lea rcx, str.SEG.SBSO
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x240]
lea rcx, str.SEG.ENT
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x200]
lea rcx, str.SEG.PRM
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x280]
lea rcx, str.SEG.RPS
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x220]
lea rcx, str.SEG.WKS
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x260]
lea rcx, str.SEG.TC
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1d0]
lea rcx, str.BBUY
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1f0]
lea rcx, str.R_WM
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1c0]
lea rcx, str.R_COSTCO
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x230]
lea rcx, str.R_SAM
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x210]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
lea rdx, [0x1400481d4]
test eax, eax
je 0x14001360e
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
lea rdx, [0x1400481d4]
test eax, eax
je 0x14001360e
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x140013633
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x190]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x140013633
lea rdx, [0x1400481d4]
lea rcx, [0x140064d60]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x14001366b
lea rdx, str.Consumer
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Consumer
jmp 0x1400137b0
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x290]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400136a3
lea rdx, str.SBSO
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.SBSO
jmp 0x1400137b0
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400136db
lea rdx, str.Enterprise
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Enterprise
jmp 0x1400137b0
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x140013713
lea rdx, str.Premium
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Premium
jmp 0x1400137b0
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x280]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x140013748
lea rdx, str.RPOS
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.RPOS
jmp 0x1400137b0
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x220]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x14001377d
lea rdx, str.Workstation
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Workstation
jmp 0x1400137b0
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x260]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400137bd
lea rdx, str.ThinClient
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.ThinClient
lea rcx, [0x140066320]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400137de
lea rdx, str.BestBuy
jmp 0x140013846
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400137ff
lea rdx, str.Walmart
jmp 0x140013846
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x140013820
lea rdx, str.Costco
jmp 0x140013846
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x230]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
lea rdx, str.SAMS
test eax, eax
je 0x140013846
lea rdx, [0x140066320]
lea rcx, [0x140066730]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x140066730]
lea rcx, str.Channel
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x250]
call fcn.14001b25c
test eax, eax
jne 0x140013887
lea rdx, str.Compaq
jmp 0x1400138a5
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x270]
call fcn.14001b25c
test eax, eax
jne 0x1400138b2
lea rdx, [0x1400493b0]
lea rcx, [0x140066220]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400138d3
lea rdx, str.Notebook
jmp 0x1400138f9
lea rdx, [0x1400481d4]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
lea rdx, str.Tablet
test eax, eax
je 0x1400138f9
lea rdx, str.Desktop
lea rcx, [0x1400663a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rcx, str.C:hp_binRStone.INI
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140013950
lea rdx, str.BIOS_Strings
lea rcx, str.c:hp_binRStone.ini
mov r8d, 1
call fcn.140012670
lea rdx, [0x1400662a0]
lea rcx, str.BrandName
mov r8d, 0x80
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x140013e1f
lea rdx, [0x140066320]
lea rcx, str.BrandName
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x140013e1f
lea rdx, [0x140048138]
lea rcx, [0x140064d78]
call fcn.14001b25c
test eax, eax
je 0x140013c14
lea rdx, [0x140048148]
lea rcx, [0x140064d78]
call fcn.14001b25c
test eax, eax
je 0x140013c14
lea rdx, [0x140048160]
lea rcx, [0x140064d78]
call fcn.14001b25c
test eax, eax
je 0x140013c14
lea rdx, [0x140048158]
lea rcx, [0x140064d78]
call fcn.14001b25c
test eax, eax
je 0x140013a03
lea rdx, [0x140048160]
lea rcx, [0x140064d78]
call fcn.14001b25c
test eax, eax
je 0x140013a03
lea rdx, [0x1400481b0]
lea rcx, [0x140064d78]
call fcn.14001b25c
test eax, eax
jne 0x140013e1f
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x40], ebx
call fcn.14001a650
lea rdx, [rsp + 0x40]
lea rcx, str.C:hp_binRStone.ini
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140013a53
lea rdx, str.SBSO
lea rcx, [0x140066320]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140013aa7
lea rdx, [0x140046cfc]
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x140013a74
lea rdx, str.SBSO
jmp 0x140013a9a
lea rdx, [0x140049624]
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea rdx, str.Workstation
test eax, eax
je 0x140013a9a
lea rdx, str.Enterprise
lea rcx, [0x140066320]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Compaq
lea rcx, [0x140066520]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
lea rcx, [0x140066220]
lea rdx, str.Compaq
test rax, rax
jne 0x140013ad5
lea rdx, [0x1400493b0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rcx, [rbp + 0x6f4]
xor edx, edx
mov r8d, 0x204
mov dword [rbp + 0x6f0], ebx
call fcn.14001a650
lea rdx, [rbp + 0x6f0]
lea rcx, [0x140049628]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x6f0]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x140013b20
mov rax, qword [str.Application_DataHPhpcasldetect.ini]
mov qword [rcx], rax
mov rax, qword [0x140049658]
mov qword [rcx + 8], rax
mov rax, qword [0x140049660]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140049668]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140049670]
mov qword [rcx + 0x20], rax
mov rax, qword [0x140049678]
mov qword [rcx + 0x28], rax
mov rax, qword [0x140049680]
mov qword [rcx + 0x30], rax
mov rax, qword [0x140049688]
mov qword [rcx + 0x38], rax
mov rax, qword [0x140049690]
mov qword [rcx + 0x40], rax
mov eax, dword [0x140049698]
mov dword [rcx + 0x48], eax
lea rcx, str.C:ProgramDataHPhpcasldetect.ini
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140013bb0
lea rcx, str.C:ProgramDataHPhpcasldetect.ini
jmp 0x140013be4
lea rcx, [rbp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140013bcb
lea rcx, [rbp + 0x6f0]
jmp 0x140013be4
lea rcx, str.C:_swsetupPINtoolshpcasldetect.ini
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140013bf6
lea rcx, str.C:_swsetupPINtoolshpcasldetect.ini
lea rdx, str.Wireless
mov r8d, 1
call fcn.140012670
lea rdx, str.Notebook
lea rcx, [0x1400663a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
call fcn.140011260
jmp 0x140013e1f
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x1fc
mov dword [rsp + 0x40], ebx
call fcn.14001a650
lea rcx, [rbp + 0x6f4]
xor edx, edx
mov r8d, 0x1fc
mov dword [rbp + 0x6f0], ebx
call fcn.14001a650
mov rcx, rbx
nop word [rax + rax]
movzx eax, word [rcx + rsi]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x3e], ax
test ax, ax
jne 0x140013c50
lea rcx, str.C:hp_binRStonePost.INI
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140013c7d
lea rcx, str.C:hp_binRStonePost.INI
jmp 0x140013cb1
lea rcx, str.C:hp_binRStone_BBV.INI
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140013c98
lea rcx, str.C:hp_binRStone_BBV.INI
jmp 0x140013cb1
lea rcx, str.C:hp_binRStonePre.INI
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140013cc3
lea rcx, str.C:hp_binRStonePre.INI
lea rdx, str.Bios_Strings
mov r8d, 1
call fcn.140012670
lea rdx, [rsp + 0x40]
lea rcx, str.BrandName
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rsp + 0x40]
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Mini
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x140013d1a
lea rdx, str.Mini
lea rcx, str.Series
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x140013d37
lea rdx, str.Premium
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea rdx, str.Premium
test eax, eax
je 0x140013d3e
lea rdx, str.Consumer
lea rcx, [0x140066320]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Compaq
lea rcx, [0x140066520]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140013d83
lea rdx, str.Presario
lea rcx, [0x1400662a0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea rdx, [0x1400493b0]
test eax, eax
jne 0x140013d8a
lea rdx, str.Compaq
lea rcx, [0x140066220]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [rbp + 0x6f0]
lea rcx, str.ModelName
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x6f0]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140013dc0
test rax, rax
je 0x140013de2
lea rdx, [rbp + 0x6f0]
lea rcx, [0x140066620]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rcx, str.C:System.sav_flagsconvertible.flg
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140013e06
lea rcx, str.C:System.sav_flags_tablet.flg
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140013e0b
call fcn.140011260
lea rdx, str.Notebook
lea rcx, [0x1400663a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x1400662a0]
lea rcx, str.SubBrand
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140066220]
lea rcx, str.Brand
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400493b0]
lea rcx, [0x140066220]
call fcn.14001b25c
lea rcx, str.PCBrand
mov rdx, rsi
test eax, eax
je 0x140013e6f
lea rdx, str.Presario
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
lea rcx, [rbp + 0x4f4]
lea r8d, [rdx + 0x7c]
mov dword [rbp + 0x4f0], ebx
call fcn.14001a650
xor edx, edx
lea rcx, [rbp + 0x5f4]
lea r8d, [rdx + 0x7c]
mov dword [rbp + 0x5f0], ebx
call fcn.14001a650
xor edx, edx
lea rcx, [rbp + 0x674]
lea r8d, [rdx + 0x7c]
mov dword [rbp + 0x670], ebx
call fcn.14001a650
xor edx, edx
lea rcx, [rbp + 0x574]
lea r8d, [rdx + 0x7c]
mov dword [rbp + 0x570], ebx
call fcn.14001a650
mov r8d, dword [0x140064c44]
mov rsi, qword [rsp + 0xe30]
cmp r8d, 6
jne 0x140013f3e
cmp dword [0x140064c48], 2
jne 0x140013f3e
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140016550
mov r8d, dword [rsp + 0x38]
lea rdx, [0x140047560]
lea rcx, [rbp + 0x5f0]
call fcn.14001c9d4
mov r8d, dword [rsp + 0x30]
lea rdx, [0x140047560]
lea rcx, [rbp + 0x670]
call fcn.14001c9d4
mov r8d, dword [rsp + 0x34]
jmp 0x140013f72
lea rdx, [0x140047560]
lea rcx, [rbp + 0x5f0]
call fcn.14001c9d4
mov r8d, dword [0x140064c48]
lea rdx, [0x140047560]
lea rcx, [rbp + 0x670]
call fcn.14001c9d4
mov r8d, dword [0x140064c4c]
lea rdx, [0x140047560]
lea rcx, [rbp + 0x570]
call fcn.14001c9d4
lea rdx, [rbp + 0x5f0]
lea rcx, str.WinOSMajor
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rbp + 0x670]
lea rcx, str.WinOSMinor
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rbp + 0x570]
lea rcx, str.WinOSBuild
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
movzx r8d, word [0x140064d54]
lea rdx, [0x140047560]
lea rcx, [rbp + 0x4f0]
call fcn.14001c9d4
lea rdx, [rbp + 0x4f0]
lea rcx, str.WinOSSPMajor
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
movzx r8d, word [0x140064d56]
lea rdx, [0x140047560]
lea rcx, [rbp + 0x4f0]
call fcn.14001c9d4
lea rdx, [rbp + 0x4f0]
lea rcx, str.WinOSSPMinor
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, dword [0x140064694]
lea rdx, [0x140047560]
lea rcx, [rbp + 0x4f0]
call fcn.14001c9d4
lea rdx, [rbp + 0x4f0]
lea rcx, str.WinOSProductType
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [0x140064c44], 6
jae 0x140014190
mov r9d, 1
lea rax, [rbp + 0x2e0]
xor r8d, r8d
lea edx, [r9 + 0x1e]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rbp + 0x2e0]
mov edx, 0x5c
call fcn.14001ad74
test rax, rax
je 0x140014187
lea rcx, [rax + 2]
mov edx, 0x5c
call fcn.14001ad74
mov rdi, rax
test rax, rax
je 0x140014187
mov word [rax], bx
mov rdx, rbx
nop word [rax + rax]
movzx ecx, word [rbp + rdx + 0x2e0]
lea rdx, [rdx + 2]
mov word [rbp + rdx + 0x8fe], cx
test cx, cx
jne 0x1400140c0
lea rcx, [rbp + 0x900]
sub rcx, 2
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x1400140e4
mov rax, qword [str.Default_User]
lea rdx, [rbp + 0x900]
mov qword [rcx], rax
mov rax, qword [0x140049840]
mov qword [rcx + 8], rax
mov rax, qword [0x140049848]
mov qword [rcx + 0x10], rax
mov eax, dword [0x140049850]
mov dword [rcx + 0x18], eax
lea rcx, str.DEFAULT_USER
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, [rdi + 2]
mov edx, 0x5c
call fcn.14001ad74
mov r8, rax
test rax, rax
je 0x140014187
lea rcx, [rbp + 0x900]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x140014150
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x140014160
lea rdx, [rbp + 0x900]
lea rcx, str.DEFAULT_FAVORITES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x14004989c]
jmp 0x1400141de
lea rdx, str.C:UsersDefaultFavorites
lea rcx, str.DEFAULT_FAVORITES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, str.C:UsersDefault
lea rcx, str.DEFAULT_USER
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [0x140064c48]
test eax, eax
jne 0x1400141cb
lea rdx, str.VISTA
jmp 0x1400141de
lea rdx, str.Win7
cmp eax, 1
je 0x1400141de
lea rdx, str.Win8
lea rcx, str.OSName
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call fcn.140012570
mov rdi, qword [rsp + 0xe38]
nop dword [rax + rax]
lea rdx, str.Default
lea rcx, [0x140065980]
mov r8d, ebx
call fcn.140012670
lea rdx, [0x140063e40]
lea rcx, [0x140065980]
mov r8d, ebx
call fcn.140012670
lea rdx, [0x140063df0]
lea rcx, [0x140065980]
mov r8d, ebx
call fcn.140012670
inc ebx
cmp ebx, 5
jle 0x140014200
lea rdx, [0x140066180]
lea rcx, str.Platform
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140064d78]
lea rcx, str.PlatformCode
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400661a0]
lea rcx, str.SystemFamily
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140066520]
lea rcx, str.ProductName
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140066420]
lea rcx, str.SerialNumber
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140064b60]
lea rcx, str.SystemGUID
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400664a0]
lea rcx, str.ProductNumber
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400666a0]
lea rcx, str.SystemBoardProductId
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400666a0]
lea rcx, str.SystemId
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140066620]
lea rcx, str.ModelNumber
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140066720]
lea rcx, str.LanguageCode
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400663a0]
lea rcx, str.HardwareType
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140066320]
lea rcx, str.Segment
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140064d60]
lea rcx, str.TOUCHINPUT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140064d68]
lea rcx, str.PENINPUT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140064d70]
lea rcx, str.TOUCHCOUNT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rbp + 0xd10]
xor rcx, rsp
call fcn.14001a120
mov rbx, qword [rsp + 0xe40]
add rsp, 0xe20
pop rbp
ret