Function at 0x140032410
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27a0]
mov eax, 0x28a0
call fcn.14003b030
sub rsp, rax
movaps xmmword [rsp + 0x2890], xmm6
movaps xmmword [rsp + 0x2880], xmm7
mov r13, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x780]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x70], xmm1
lea r12, [rdi + 0x10]
mov qword [rbp - 0x60], r12
mov qword [r12], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x138]
call fcn.1400395b0
mov rdx, rax
mov rcx, rdi
call fcn.14002b840
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x140032517
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032512
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032512
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140039820
nop
cmp dword [0x140054568], 0x64
jae 0x140032606
lea r10, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r10, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
cmp rbx, 7
jb 0x140032606
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, str.ext_ms_
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, r15
je 0x14003258e
cmp word [rcx], 0x65
je 0x14003258b
cmp rax, 1
je 0x14003258e
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x140032578
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140032606
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, str.ext_ms_
sub r9, rax
nop dword [rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14003266e
add rdx, 2
sub r8, 1
jne 0x1400325b0
sub rcx, r10
sar rcx, 1
jne 0x140032606
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x70], rbx
mov rsi, qword [rsi + 8]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x14003289c
nop word [rax + rax]
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14003262e
mov rdx, qword [rdx]
lea rcx, [rsp + 0x60]
call fcn.140033bb0
cmp rax, 0xffffffffffffffff
jne 0x140032649
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
jne 0x140032620
cmp rbx, rsi
je 0x14003289c
mov rcx, qword [rbx + 0x30]
cmp rcx, qword [rbx + 0x38]
je 0x14003267f
mov rdx, r14
call fcn.140021610
test al, al
jne 0x140032677
mov r14, qword [rbx + 0x30]
jmp 0x14003267f
add rcx, 2
jmp 0x14003255d
mov r14, qword [rbx + 0x38]
sub r14, 0x20
mov rdx, r14
mov rcx, rdi
call fcn.140032170
mov rdx, rdi
call fcn.140033820
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140033749
cmp ebx, 0xc015001d
je 0x140033749
test byte [rbp + 0x27f0], 2
je 0x140032894
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x180]
call sub.VCRUNTIME140.dll_memset
mov edx, 0xff
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
lea rax, [rbp + 0x180]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140032705
mov r8, rbx
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0xb8]
call fcn.14001e540
nop
mov r8d, 1
lea rdx, [0x140045920]
lea rcx, [rbp + 0xb8]
call fcn.140034ad0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14003277a
mov rdx, qword [rdi]
mov r8, qword [r12]
lea rcx, [rbp - 0x30]
call fcn.140034ad0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.14002b840
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1400327f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400327f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400327f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140032839
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032834
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032834
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp + 0xd0]
cmp rdx, 8
jb 0x140032894
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003288f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003288f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
mov ebx, r15d
jmp 0x140033749
mov r14d, dword [rbp + 0x27f0]
test r14b, 1
jne 0x140033744
mov rdx, rdi
call fcn.140033820
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140033749
cmp ebx, 0xc015001d
je 0x140033749
test r14b, 4
jne 0x140033744
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400328e9
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400328fc
mov ebx, r15d
jmp 0x140033749
lea r8, [rbp + 0x90]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rsi, eax
test eax, eax
jne 0x140032a27
mov ebx, r15d
test rsi, rsi
jne 0x140032a27
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x580]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x380]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x27d8], 0xff
mov dword [rbp + 0x2800], r15d
lea rax, [rbp + 0x27d8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x380]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2800]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x27d8]
lea r8, [rbp + 0x580]
mov edx, ebx
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rsi, eax
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rbp + 0x380]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140032a19
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x180]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x27d8], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x180]
test r14b, 8
je 0x140032a0a
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140032a10
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rsi, rsi
je 0x140032aa4
inc ebx
cmp ebx, 0x1000
jl 0x140032925
mov r15, qword [r13 + 0x10]
test r15, r15
je 0x140032d65
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r15
cmp rax, 1
jb 0x14003381a
cmp qword [r13 + 0x18], 8
jb 0x140032a59
mov r13, qword [r13]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea r12, [r15 + 1]
mov ebx, 7
lea rsi, [rbp - 0x10]
cmp r12, rbx
jbe 0x140032c0f
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x140032b9f
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140032bce
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x138]
call fcn.14001e670
nop
lea r8, [0x140045920]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140033fd0
nop
lea r8, [rbp + 0x380]
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140033fd0
mov rdx, rax
mov rcx, rdi
call fcn.14002b840
lea rcx, [rbp + 0x158]
call fcn.14001e340
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140032b3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032b38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032b38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r15w
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x140032894
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003288f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003288f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140033814
add rcx, rcx
cmp rcx, 0x1000
jb 0x140032bfa
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140033814
mov rcx, rax
call fcn.14003a0fc
test rax, rax
je 0x140032cf3
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140032c0b
test rcx, rcx
je 0x140032c09
call fcn.14003a0fc
mov rsi, rax
jmp 0x140032c0b
xor esi, esi
mov qword [rbp - 0x10], rsi
mov qword [rbp], r12
mov qword [rbp + 8], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], 0x5c
xor r15d, r15d
mov word [rsi + r12*2], r15w
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp - 0x10]
call fcn.140034ad0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140032cb2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032cad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032cad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140032cff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032cfa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032cfa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140032d61
lea rax, [rsp + 0x40]
cmp rdi, rax
je 0x140032894
mov rbx, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r9, qword [rsp + 0x40]
mov rax, qword [rdi + 0x18]
cmp rbx, rax
ja 0x140033734
cmp rax, 8
jb 0x140032d55
mov rdi, qword [rdi]
mov rax, qword [rbp - 0x60]
mov qword [rax], rbx
jmp 0x14003371b
mov r12, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x27f8]
call fcn.140034c80
mov r8d, eax
lea rdx, [rbp + 0x158]
call fcn.140033910
nop
mov r8d, 1
lea rdx, [0x140045920]
mov rcx, rax
call fcn.140034ad0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x10]
call fcn.140034ad0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140032e3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032e3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032e3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140032e8c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032e87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032e87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r15w
mov rdx, qword [rbp + 0x170]
cmp rdx, 8
jb 0x140032ee7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032ee2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032ee2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400336e1
mov edx, 0x1000
lea rcx, [rbp + 0x780]
test r14b, 8
je 0x140032f21
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140032f27
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
lea rax, [rbp + 0x780]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140032f50
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0xd8]
call fcn.14001e540
nop
mov r8d, 1
lea rdx, [0x140045920]
lea rcx, [rbp + 0xd8]
call fcn.140034ad0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x30]
call fcn.140034ad0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140033031
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003302c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003302c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14003307e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033079
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033079
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], r15w
mov rdx, qword [rbp + 0xf0]
cmp rdx, 8
jb 0x1400330d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400330d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400330d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400336e1
mov edx, 0x1000
lea rcx, [rbp + 0x780]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x108], xmm1
lea rax, [rbp + 0x780]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140033130
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0xf8]
call fcn.14001e540
nop
mov r8d, 1
lea rdx, [0x140045920]
lea rcx, [rbp + 0xf8]
call fcn.140034ad0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.140034ad0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140033211
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003320c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003320c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x14003325e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033259
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033259
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], r15w
mov rdx, qword [rbp + 0x110]
cmp rdx, 8
jb 0x1400332b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400332b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400332b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400336e1
lea rdx, [rbp + 0x780]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x128], xmm1
lea rax, [rbp + 0x780]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140033310
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x118]
call fcn.14001e540
nop
mov r8d, 1
lea rdx, [0x140045920]
lea rcx, [rbp + 0x118]
call fcn.140034ad0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x70]
call fcn.140034ad0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400333f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400333f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400333f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x140033447
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033442
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033442
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], r15w
mov rdx, qword [rbp + 0x130]
cmp rdx, 8
jb 0x1400334a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400334a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400334a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400334d6
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140032170
mov ebx, r15d
jmp 0x140033749
mov r8d, 0x1000
lea rdx, [rbp + 0x780]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x780]
lea r8, [rbp - 0x58]
lea rdx, [0x1400459b4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
je 0x140033744
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xb0], r15
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140033530
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.14001e540
nop
mov r8d, 1
lea rdx, [0x140045920]
lea rcx, [rbp + 0x98]
call fcn.140034ad0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp - 0x50]
call fcn.140034ad0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14003360a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033605
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400336cc
call fcn.14003a138
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140033654
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003364f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400336d3
call fcn.14003a138
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r15w
mov rdx, qword [rbp + 0xb0]
cmp rdx, 8
jb 0x1400336a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400336a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400336da
call fcn.14003a138
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400336e1
mov rcx, qword [rbp - 0x58]
jmp 0x1400334f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [rsp + 0x40]
cmp rdi, rax
je 0x140032894
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r9, qword [rsp + 0x40]
mov rax, qword [rdi + 0x18]
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
ja 0x140033734
cmp rax, 8
jb 0x140033717
mov rdi, qword [rdi]
mov qword [r12], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rbx*2], r15w
mov ebx, r15d
jmp 0x140033749
mov rdx, rbx
mov rcx, rdi
call fcn.140031ff0
mov ebx, r15d
jmp 0x140033749
mov ebx, 0xc0000225
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14003378e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033789
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033789
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400337e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400337e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400337e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a138
mov eax, ebx
lea r11, [rsp + 0x28a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001e510
nop
call fcn.14001e3b0
int3