Function at 0x14004af90
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a18]
mov eax, 0x2b18
call fcn.140076600
sub rsp, rax
movaps xmmword [rsp + 0x2b00], xmm6
movaps xmmword [rsp + 0x2af0], xmm7
mov rax, qword [0x1400dd040]
xor rax, rsp
mov qword [rbp + 0x29e0], rax
mov r12, r9
mov qword [rsp + 0x70], r9
mov rdi, r8
mov r14, rdx
mov r13, rcx
mov rax, qword [rbp + 0x2a88]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x2a90]
mov qword [rsp + 0x40], rax
xor r15d, r15d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x9e0]
call fcn.1400a1a80
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x198], 7
mov word [rbp + 0x180], r15w
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 7
mov word [r14], r15w
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x138]
call fcn.140047300
mov rdx, rax
mov rcx, r14
call fcn.14003fd60
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x14004b0bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b0b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5c1
call fcn.140075b8c
mov r8, qword [r14 + 0x10]
mov rsi, 0xffffffffffffffff
test r8, r8
je 0x14004b1a2
mov rdx, r14
mov r9, qword [r14 + 0x18]
cmp r9, 7
jbe 0x14004b0e0
mov rdx, qword [r14]
lea rcx, [r8 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x14004b107
cmp rcx, rdx
je 0x14004b112
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x14004b0f8
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
jne 0x14004b150
mov rdx, r14
cmp r9, 7
jbe 0x14004b11e
mov rdx, qword [r14]
lea rcx, [r8 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2f
je 0x14004b145
cmp rcx, rdx
je 0x14004b1a2
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x14004b136
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
je 0x14004b1a2
inc rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], r15
mov rax, r8
cmp r8, rcx
jb 0x14004c5c7
sub rax, rcx
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
mov rax, r14
cmp r9, 7
jbe 0x14004b190
mov rax, qword [r14]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x1a0]
call fcn.1400015e0
jmp 0x14004b1b2
mov rdx, r14
lea rcx, [rbp + 0x1a0]
call fcn.1400318f0
nop
cmp dword [0x1400e4a0c], 9
ja 0x14004b2ae
lea r10, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova r10, qword [rbp + 0x1a0]
mov rbx, qword [rbp + 0x1b0]
cmp rbx, 7
jb 0x14004b2ae
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x1400c94f0]
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, r15
je 0x14004b226
cmp word [rcx], 0x65
je 0x14004b223
nop dword [rax]
cmp rax, 1
je 0x14004b226
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x14004b210
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14004b2ae
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x1400c94f0]
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x14004b344
add rdx, 2
sub r8, 1
jne 0x14004b250
sub rcx, r10
sar rcx, 1
jne 0x14004b2ae
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rcx, qword [rbp + 0x1a0]
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call fcn.1400a13e0
mov qword [rbp + 0x1b0], rbx
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x14004b59c
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14004b2ce
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1a0]
call fcn.14004ce70
cmp rax, 0xffffffffffffffff
jne 0x14004b2eb
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r15
jne 0x14004b2c0
cmp rbx, r15
je 0x14004b59c
mov rdx, qword [rbx + 0x30]
cmp rdx, qword [rbx + 0x38]
je 0x14004b366
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14004b30c
mov rdi, qword [rdi]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14004b31a
mov rdx, qword [rdx]
cmp rcx, rax
jne 0x14004b34d
test rcx, rcx
je 0x14004b33a
sub rdx, rdi
movzx eax, word [rdi + rdx]
cmp ax, word [rdi]
jne 0x14004b34d
add rdi, 2
sub rcx, 1
jne 0x14004b327
mov rdx, qword [rbx + 0x38]
sub rdx, 0x20
jmp 0x14004b351
add rcx, 2
jmp 0x14004b1f2
mov rdx, qword [rbx + 0x30]
cmp r14, rdx
je 0x14004b384
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14004b37c
mov rdx, qword [rdx]
jmp 0x14004b37c
cmp r14, rdi
je 0x14004b384
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14004b379
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r14
call fcn.14003ff50
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, r14
call fcn.14004c670
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004c4e1
cmp ebx, 0xc015001d
je 0x14004c4e1
test byte [rbp + 0x2a80], 2
je 0x14004b595
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x5e0]
call fcn.1400a1a80
mov edx, 0xff
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
lea rax, [rbp + 0x5e0]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14004b402
mov r8, rsi
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x98]
call fcn.1400015e0
nop
mov r8d, 1
lea rdx, [0x1400c94ec]
lea rcx, [rbp + 0x98]
call fcn.140031860
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x14004b478
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp - 0x48]
call fcn.140031860
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.14003fd60
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004b4f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b4ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5cd
call fcn.140075b8c
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x14004b535
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b530
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5d3
call fcn.140075b8c
movdqa xmm0, xmmword [0x1400ca960]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], bx
mov rdx, qword [rbp + 0xb0]
cmp rdx, 7
jbe 0x14004c4e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b58b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5d9
call fcn.140075b8c
jmp 0x14004c4e1
xor ebx, ebx
jmp 0x14004c4e1
mov r15d, dword [rbp + 0x2a80]
test r15b, 1
jne 0x14004c4dc
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, r14
call fcn.14004c670
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004c4e1
cmp ebx, 0xc015001d
je 0x14004c4e1
test r15b, 4
jne 0x14004c4dc
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x14004b5f3
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r13d, r13d
cmp eax, 0xffffffff
je 0x14004b609
mov ebx, r13d
jmp 0x14004c4e4
mov qword [rbp + 0x1d0], r13
lea r8, [rbp + 0x1d0]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x14004b747
mov ebx, r13d
nop dword [rax]
test rdi, rdi
jne 0x14004b747
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x7e0]
call fcn.1400a1a80
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x3e0]
call fcn.1400a1a80
mov dword [rbp + 0x1c0], 0xff
mov dword [rbp + 0x1c8], r13d
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1c0]
lea r8, [rbp + 0x7e0]
mov edx, ebx
mov rcx, qword [rbp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x3e0]
call fcn.14008846c
test eax, eax
jne 0x14004b739
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x1e0]
call fcn.1400a1a80
mov dword [rbp + 0x1c0], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x1e0]
test r15b, 8
je 0x14004b72a
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004b730
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x14004bacc
inc ebx
cmp ebx, 0x1000
jl 0x14004b640
mov rdi, qword [r12 + 0x10]
test rdi, rdi
je 0x14004b902
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
sub rax, rdi
cmp rax, 1
jb 0x14004c5df
cmp qword [r12 + 0x18], 7
jbe 0x14004b780
mov r12, qword [r12]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea r13, [rdi + 1]
mov eax, 7
lea r12, [rbp - 0x68]
cmp r13, rax
jbe 0x14004b7dd
mov rax, r13
or rax, 7
cmp rax, rbx
ja 0x14004b7bc
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
inc rbx
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.1400016b0
mov r12, rax
lea rax, [rbx - 1]
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], rax
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, qword [rsp + 0x70]
mov rcx, r12
call fcn.1400a13e0
mov word [r12 + rbx], 0x5c
xor ebx, ebx
mov word [r12 + r13*2], bx
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp - 0x68]
call fcn.140031860
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r13d, r13d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004b88e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b889
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5f7
call fcn.140075b8c
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x14004b8dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b8d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5fd
call fcn.140075b8c
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004c4a5
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax + 8]
lea rdx, [rbp + 0x158]
call fcn.14004cc10
nop
mov r8d, 1
lea rdx, [0x1400c94ec]
mov rcx, rax
call fcn.140031860
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp - 8]
call fcn.140031860
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004b9df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b9da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c603
call fcn.140075b8c
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14004ba2d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ba28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c609
call fcn.140075b8c
movdqa xmm0, xmmword [0x1400ca960]
movdqu xmmword [rbp + 8], xmm0
mov word [rbp - 8], r13w
mov rdx, qword [rbp + 0x170]
cmp rdx, 7
jbe 0x14004ba85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ba80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c60f
call fcn.140075b8c
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004c4a5
mov edx, 0x1000
lea rcx, [rbp + 0x9e0]
test r15b, 8
je 0x14004bc92
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004bc98
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
lea rax, [rbp + 0x1e0]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004baf0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0xb8]
call fcn.1400015e0
nop
mov r8d, 1
lea rdx, [0x1400c94ec]
lea rcx, [rbp + 0xb8]
call fcn.140031860
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r13
mov word [rax], r13w
lea rax, [rbp + 0x3e0]
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14004bb60
mov r8, rsi
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp - 0x28]
call fcn.140031860
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.14003fd60
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004bbee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bbe8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5e5
call fcn.140075b8c
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14004bc2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bc29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5eb
call fcn.140075b8c
movdqa xmm0, xmmword [0x1400ca960]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r13w
mov rdx, qword [rbp + 0xd0]
cmp rdx, 7
jbe 0x14004c4d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bc85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5f1
call fcn.140075b8c
mov ebx, r13d
jmp 0x14004c491
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004bcc0
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xd8]
call fcn.1400015e0
nop
mov r8d, 1
lea rdx, [0x1400c94ec]
lea rcx, [rbp + 0xd8]
call fcn.140031860
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x18]
call fcn.140031860
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004bdaa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bda5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c615
call fcn.140075b8c
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x14004bdf8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bdf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c61b
call fcn.140075b8c
movdqa xmm0, xmmword [0x1400ca960]
movdqu xmmword [rbp + 0x28], xmm0
mov word [rbp + 0x18], r13w
mov rdx, qword [rbp + 0xf0]
cmp rdx, 7
jbe 0x14004be50
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004be4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c621
call fcn.140075b8c
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004c4a5
mov edx, 0x1000
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x108], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004beb0
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xf8]
call fcn.1400015e0
nop
mov r8d, 1
lea rdx, [0x1400c94ec]
lea rcx, [rbp + 0xf8]
call fcn.140031860
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x38]
call fcn.140031860
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004bf9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bf95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c627
call fcn.140075b8c
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14004bfe8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bfe3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c62d
call fcn.140075b8c
movdqa xmm0, xmmword [0x1400ca960]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r13w
mov rdx, qword [rbp + 0x110]
cmp rdx, 7
jbe 0x14004c040
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c03b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c633
call fcn.140075b8c
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004c4a5
lea rdx, [rbp + 0x9e0]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x128], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004c0a0
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x118]
call fcn.1400015e0
nop
mov r8d, 1
lea rdx, [0x1400c94ec]
lea rcx, [rbp + 0x118]
call fcn.140031860
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x58]
call fcn.140031860
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004c18a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c185
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c639
call fcn.140075b8c
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x14004c1d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c1d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c63f
call fcn.140075b8c
movdqa xmm0, xmmword [0x1400ca960]
movdqu xmmword [rbp + 0x68], xmm0
mov word [rbp + 0x58], r13w
mov rdx, qword [rbp + 0x130]
cmp rdx, 7
jbe 0x14004c230
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c22b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c645
call fcn.140075b8c
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004c4a5
mov r8d, 0x1000
lea rdx, [rbp + 0x9e0]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp + 0x178]
lea rdx, [0x1400c95a0]
lea rcx, [rbp + 0x9e0]
call fcn.14008962c
test rax, rax
je 0x14004c48c
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r13
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004c2c0
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.1400015e0
nop
mov r8d, 1
lea rdx, [0x1400c94ec]
lea rcx, [rbp + 0x78]
call fcn.140031860
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rsp + 0x78]
call fcn.140031860
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004c3a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c39e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c64b
call fcn.140075b8c
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x14004c3f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c3ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c651
call fcn.140075b8c
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rbp + 0x90]
cmp rdx, 7
jbe 0x14004c447
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c442
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c657
call fcn.140075b8c
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004c4a5
lea r8, [rbp + 0x178]
lea rdx, [0x1400c95a0]
mov rcx, qword [rbp + 0x178]
call fcn.14008962c
test rax, rax
jne 0x14004c2a0
mov ebx, 0xc0000225
mov rcx, qword [rbp + 0x1d0]
test rcx, rcx
jle 0x14004c4e4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004c4e4
lea rax, [rbp + 0x180]
cmp r14, rax
je 0x14004c4d7
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
mov r8, qword [rbp + 0x190]
cmova rdx, qword [rbp + 0x180]
mov rcx, r14
call fcn.14003ff50
mov ebx, r13d
jmp 0x14004c491
mov ebx, 0xc0000225
xor r13d, r13d
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 7
jbe 0x14004c52a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c525
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c65d
call fcn.140075b8c
mov qword [rbp + 0x1b0], r13
mov qword [rbp + 0x1b8], 7
mov word [rbp + 0x1a0], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004c586
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c581
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5bb
call fcn.140075b8c
mov eax, ebx
mov rcx, qword [rbp + 0x29e0]
xor rcx, rsp
call fcn.1400758f0
movaps xmm6, xmmword [rsp + 0x2b00]
movaps xmm7, xmmword [rsp + 0x2af0]
add rsp, 0x2b18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.140044fc0
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.1400015b0
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
nop
call fcn.14007caa4
int3