Function at 0x18001a850
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x618]
sub rsp, 0x700
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
cmp qword [rdx + 0x10], rbx
jne 0x18001a903
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbx
cmp qword [rcx + 0x18], 8
jb 0x18001a8b6
mov rax, qword [rcx]
jmp 0x18001a8b9
mov rax, rsi
mov word [rax], bx
xor r8d, r8d
lea rdx, [0x18006de50]
call fcn.18000ae80
nop
mov r8, qword [r14 + 0x18]
cmp r8, 8
jb 0x18001a8e4
inc r8
mov rdx, qword [r14]
mov rcx, r14
call fcn.18000afd0
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rbx
cmp qword [r14 + 0x18], 8
jb 0x18001a8fa
mov r14, qword [r14]
mov word [r14], bx
jmp 0x18001b7a6
mov r11, qword [rdx + 0x18]
cmp r11, 8
jb 0x18001a912
mov rcx, qword [rdx]
jmp 0x18001a915
mov rcx, r14
mov r10, qword [rdx + 0x10]
mov r8d, 3
cmp r10, r8
cmovb r8, r10
mov r9d, 1
or rdi, 0xffffffffffffffff
test r8, r8
je 0x18001a963
lea rdx, [0x180071f40]
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001a957
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001a940
jmp 0x18001a963
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18001a966
mov r8d, ebx
test r8d, r8d
jne 0x18001a9fd
cmp r10, 3
jne 0x18001a9fd
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18004fb10
xor r9d, r9d
lea r8d, [r9 + 0x26]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.18001c0d0
lea rcx, [rbp - 0x40]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001a9a4
mov eax, dword [0x18006effc]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001a9ce
mov rax, qword [rsi]
jmp 0x18001a9d1
mov rax, rsi
mov word [rax], bx
cmp word [rbp - 0x40], 0
jne 0x18001a9e0
mov rdi, rbx
jmp 0x18001a9ee
lea rax, [rbp - 0x40]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001a9e4
mov r8, rdi
lea rdx, [rbp - 0x40]
mov rcx, rsi
jmp 0x18001a8c6
cmp r11, 8
jb 0x18001aa08
mov rcx, qword [r14]
jmp 0x18001aa0b
mov rcx, r14
mov r8d, 3
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18001aa47
lea rdx, [0x180071f48]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001aa3b
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001aa24
jmp 0x18001aa47
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18001aa4a
mov r8d, ebx
test r8d, r8d
jne 0x18001aaee
cmp r10, 3
jne 0x18001aaee
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18004fb10
xor r9d, r9d
lea r8d, [r9 + 5]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.18001c0d0
lea rcx, [rbp - 0x40]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001aa90
mov eax, dword [0x18006effc]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001aaba
mov rax, qword [rsi]
jmp 0x18001aabd
mov rax, rsi
mov word [rax], bx
cmp word [rbp - 0x40], 0
je 0x18001aada
lea rax, [rbp - 0x40]
mov rbx, rdi
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001aad0
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.18000ae80
jmp 0x18001b79e
cmp r11, 8
jb 0x18001aaf9
mov rcx, qword [r14]
jmp 0x18001aafc
mov rcx, r14
mov r8d, 7
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18001ab38
lea rdx, str.desktop
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001ab2c
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001ab15
jmp 0x18001ab38
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18001ab3b
mov r8d, ebx
test r8d, r8d
jne 0x18001abd5
cmp r10, 7
jne 0x18001abd5
xor r9d, r9d
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp + 0x3e0]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001ab70
mov eax, dword [0x18006effc]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001ab9a
mov rax, qword [rsi]
jmp 0x18001ab9d
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18001abbe
lea rax, [rbp + 0x3e0]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001abb4
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.18000ae80
jmp 0x18001b79e
cmp r11, 8
jb 0x18001abe0
mov rcx, qword [r14]
jmp 0x18001abe3
mov rcx, r14
mov r8d, 3
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18001ac23
lea rdx, [0x180071f60]
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001ac17
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001ac00
jmp 0x18001ac23
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18001ac26
mov r8d, ebx
test r8d, r8d
jne 0x18001acc5
cmp r10, 3
jne 0x18001acc5
xor r9d, r9d
lea r8d, [r10 + 3]
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp + 0x3e0]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001ac60
mov eax, dword [0x18006effc]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001ac8a
mov rax, qword [rsi]
jmp 0x18001ac8d
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18001acae
lea rax, [rbp + 0x3e0]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001aca4
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.18000ae80
jmp 0x18001b79e
cmp r11, 8
jb 0x18001acd0
mov rcx, qword [r14]
jmp 0x18001acd3
mov rcx, r14
mov r8d, 7
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18001ad13
lea rdx, str.program
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001ad07
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001acf0
jmp 0x18001ad13
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18001ad16
mov r8d, ebx
test r8d, r8d
jne 0x18001ae7e
cmp r10, 7
jne 0x18001ae7e
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18004fb10
xor r9d, r9d
lea r8d, [r9 + 0x26]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.18001c0d0
lea rcx, [rbp - 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001ad53
cmp eax, 3
jl 0x18001ae31
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.18004fb10
mov r8d, 3
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x3e0]
call fcn.180057818
lea rcx, [rbp + 0x3e0]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001ada0
movups xmm0, xmmword [str.Program_Files_]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x180071f88]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x180071f90]
mov dword [rcx + 0x18], eax
movzx eax, word [0x180071f94]
mov word [rcx + 0x1c], ax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001aded
mov rax, qword [rsi]
jmp 0x18001adf0
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18001ae1a
lea rax, [rbp + 0x3e0]
mov rbx, rdi
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001ae10
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.18000ae80
jmp 0x18001b79e
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001ae49
mov rax, qword [rsi]
jmp 0x18001ae4c
mov rax, rsi
mov word [rax], bx
cmp word [rbp - 0x40], 0
je 0x18001ae6a
lea rax, [rbp - 0x40]
mov rbx, rdi
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001ae60
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.18000ae80
jmp 0x18001b79e
cmp r11, 8
jb 0x18001ae89
mov rcx, qword [r14]
jmp 0x18001ae8c
mov rcx, r14
mov r8d, 4
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18001aec2
lea rdx, str.curr
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18001aebc
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18001aea5
jmp 0x18001aec2
cmovb r9d, edi
jmp 0x18001aec5
mov r9d, ebx
test r9d, r9d
jne 0x18001af71
cmp r10, 4
jne 0x18001af71
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.18004fb10
mov r8d, 0x104
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rbp + 0x3e0]
call fcn.18005167c
mov word [rax + 2], bx
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001af2e
mov rax, qword [rsi]
jmp 0x18001af31
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18001af5a
lea rax, [rbp + 0x3e0]
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001af50
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.18000ae80
jmp 0x18001b79e
lea rdx, str.temp
mov rcx, r14
call fcn.18001a3b0
test al, al
je 0x18001b077
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18004fb10
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.18004fb10
call fcn.18001b990
test al, al
je 0x18001b00c
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.18001c0d0
test eax, eax
je 0x18001b066
lea rcx, [rbp - 0x40]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001afe0
movsd xmm0, qword [str.Temp_]
movsd qword [rcx], xmm0
mov eax, dword [0x180071fc0]
mov dword [rcx + 8], eax
movzx eax, word [0x180071fc4]
mov word [rcx + 0xc], ax
jmp 0x18001b066
lea rdx, [rbp + 0x3e0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea rax, [rbp - 0x40]
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001b040
test rdi, rdi
jne 0x18001b066
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.1800186b0
jmp 0x18001b79e
lea rdx, str.recirle
mov rcx, r14
call fcn.18001a3b0
test al, al
je 0x18001b0c7
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.18004fb10
xor r9d, r9d
lea r8d, [r9 + 0xa]
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call fcn.18001c0d0
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.1800186b0
jmp 0x18001b79e
lea rdx, str.downloads
mov rcx, r14
call fcn.18001a3b0
test al, al
je 0x18001b1d2
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18004fb10
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.18001c0d0
lea rcx, [rbp - 0x40]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001b110
test rax, rax
je 0x18001b16a
mov edx, 0x5c
lea rcx, [rbp - 0x40]
call fcn.18005167c
mov word [rax + 2], bx
lea rcx, [rbp - 0x40]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001b140
movups xmm0, xmmword [0x180072000]
movups xmmword [rcx], xmm0
mov eax, dword [0x180072010]
mov dword [rcx + 0x10], eax
movzx eax, word [0x180072014]
mov word [rcx + 0x14], ax
jmp 0x18001b1c1
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rbp - 0x40]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001b185
test rdi, rdi
je 0x18001b1c1
lea rax, [rbp - 0x40]
sub rax, 2
nop dword [rax]
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x18001b1a0
movups xmm0, xmmword [str.Downloads_]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x180072040]
movsd qword [rax + 0x10], xmm1
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.1800186b0
jmp 0x18001b79e
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x58], bx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1d0]
call fcn.18004fb10
mov r8d, 0x104
lea rdx, [rbp + 0x1d0]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x1d0]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001b220
movups xmm0, xmmword [str.AppDataLocalLow_]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x180072058]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x180072068]
mov dword [rcx + 0x20], eax
movzx eax, word [0x18007206c]
mov word [rcx + 0x24], ax
cmp word [rbp + 0x1d0], 0
jne 0x18001b262
mov r8, rbx
jmp 0x18001b27b
lea rax, [rbp + 0x1d0]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001b270
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x58]
call fcn.18000ae80
lea rdx, str.locallow
mov rcx, r14
call fcn.18001a3b0
test al, al
je 0x18001b3bb
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.18001c0d0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
cmp word [rbp + 0x1d0], 0
jne 0x18001b2e7
mov r8, rbx
jmp 0x18001b2fc
lea rax, [rbp + 0x1d0]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x18001b2f1
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x38]
call fcn.18000ae80
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
mov r8d, 8
lea rdx, str.LocalLow
lea rcx, [rbp - 0x68]
call fcn.18000ae80
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
mov r8d, 7
lea rdx, str.Roaming
lea rcx, [rsp + 0x78]
call fcn.18000ae80
nop
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.18001f3c0
nop
lea rcx, [rsp + 0x78]
call fcn.180009e40
nop
lea rcx, [rbp - 0x68]
call fcn.180009e40
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.180019910
test al, al
je 0x18001b3b6
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.18000ad40
nop
jmp 0x18001b6f4
lea rdx, str.roaming
mov rcx, r14
call fcn.18001a3b0
test al, al
jne 0x18001b5b0
lea rdx, str.Roaming
mov rcx, r14
call fcn.18001a3b0
test al, al
jne 0x18001b5b0
lea rdx, str.local
mov rcx, r14
call fcn.18001a3b0
test al, al
je 0x18001b535
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.18001c0d0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0x1d0]
call fcn.180019910
test al, al
je 0x18001b45f
cmp word [rbp + 0x1d0], 0
jne 0x18001b444
mov rdi, rbx
jmp 0x18001b60a
lea rax, [rbp + 0x1d0]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001b450
jmp 0x18001b60a
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.18000ad40
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
mov r8d, 5
lea rdx, str.Local
lea rcx, [rsp + 0x78]
call fcn.18000ae80
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
mov r8d, 8
lea rdx, str.LocalLow
lea rcx, [rbp - 0x68]
call fcn.18000ae80
nop
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x38]
call fcn.18001f3c0
nop
lea rcx, [rbp - 0x68]
call fcn.180009e40
nop
lea rcx, [rsp + 0x78]
call fcn.180009e40
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.180019910
test al, al
je 0x18001b530
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.18000ad40
nop
jmp 0x18001b6f4
lea rdx, str.system
mov rcx, r14
call fcn.18001a3b0
test al, al
je 0x18001b5a0
xor r9d, r9d
lea r8d, [r9 + 0x25]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.18001c0d0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0x1d0]
call fcn.180019910
test al, al
je 0x18001b6fe
cmp word [rbp + 0x1d0], 0
jne 0x18001b58d
mov rdi, rbx
jmp 0x18001b60a
lea rax, [rbp + 0x1d0]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001b594
jmp 0x18001b60a
mov rdx, r14
mov rcx, rsi
call fcn.18001a400
jmp 0x18001b793
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.18001c0d0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0x1d0]
call fcn.180019910
test al, al
je 0x18001b623
cmp word [rbp + 0x1d0], 0
jne 0x18001b5f1
mov rdi, rbx
jmp 0x18001b60a
lea rax, [rbp + 0x1d0]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001b600
mov r8, rdi
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x58]
call fcn.18000ae80
jmp 0x18001b6fe
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.18000ad40
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
mov r8d, 7
lea rdx, str.Roaming
lea rcx, [rsp + 0x78]
call fcn.18000ae80
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
mov r8d, 8
lea rdx, str.LocalLow
lea rcx, [rbp - 0x68]
call fcn.18000ae80
nop
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x38]
call fcn.18001f3c0
nop
lea rcx, [rbp - 0x68]
call fcn.180009e40
nop
lea rcx, [rsp + 0x78]
call fcn.180009e40
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.180019910
test al, al
je 0x18001b6f4
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.18000ad40
nop
lea rcx, [rsp + 0x38]
call fcn.180009e40
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call fcn.180019910
test al, al
je 0x18001b783
mov r9d, 8
xor r8d, r8d
lea rdx, str.system32
lea rcx, [rsp + 0x58]
call fcn.180015600
cmp rax, 0xffffffffffffffff
jne 0x18001b783
lea r9d, [rax + 0xe]
xor r8d, r8d
lea rdx, str.systemprofile
lea rcx, [rsp + 0x58]
call fcn.180015600
cmp rax, 0xffffffffffffffff
jne 0x18001b783
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18001b76e
mov rax, qword [rsi]
jmp 0x18001b771
mov rax, rsi
mov word [rax], bx
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.180012220
jmp 0x18001b793
lea rdx, [0x18006de50]
mov rcx, rsi
call fcn.1800186b0
nop
lea rcx, [rsp + 0x58]
call fcn.180009e40
nop
mov rcx, r14
call fcn.180009e40
mov rax, rsi
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.18002fe60
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret