Function at 0x140050df0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27c8]
mov eax, 0x28c8
call fcn.14007c6c0
sub rsp, rax
movaps xmmword [rsp + 0x28b0], xmm6
movaps xmmword [rsp + 0x28a0], xmm7
mov rax, qword [0x1400f5098]
xor rax, rsp
mov qword [rbp + 0x2790], rax
mov r15, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov r13, qword [rbp + 0x2838]
mov r12, qword [rbp + 0x2840]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x790]
call fcn.14007e370
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rbx
mov qword [rbp + 0x148], 7
mov word [rbp + 0x130], bx
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x58], xmm1
lea rax, [rdi + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rax], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xe8]
call fcn.14004d2f0
mov rdx, rax
mov rcx, rdi
call fcn.14003dda0
mov rdx, qword [rbp + 0x100]
cmp rdx, 8
jb 0x140050f10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050f0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052227
call fcn.14007bc4c
mov rdx, rdi
lea rcx, [rbp + 0x150]
call fcn.14004cb20
nop
cmp dword [0x1400f8a9c], 9
ja 0x14005101e
lea r10, [rbp + 0x150]
cmp qword [rbp + 0x168], 8
cmovae r10, qword [rbp + 0x150]
mov rbx, qword [rbp + 0x160]
cmp rbx, 7
jb 0x14005101e
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x1400e1a10]
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x140050f96
cmp word [rcx], 0x65
je 0x140050f93
nop dword [rax]
cmp rax, 1
je 0x140050f96
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x140050f80
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14005101e
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x1400e1a10]
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x1400510ba
add rdx, 2
sub r8, 1
jne 0x140050fc0
sub rcx, r10
sar rcx, 1
jne 0x14005101e
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x150]
cmp qword [rbp + 0x168], 8
cmovae rcx, qword [rbp + 0x150]
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call fcn.14007dcb0
mov qword [rbp + 0x160], rbx
mov r14, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, r14
je 0x1400512e5
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14005103e
mov rdx, qword [rdx]
lea rcx, [rbp + 0x150]
call fcn.140052b00
cmp rax, 0xffffffffffffffff
jne 0x14005105b
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r14
jne 0x140051030
cmp rbx, r14
je 0x1400512e5
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x1400510c3
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x14005107f
mov rsi, qword [rsi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x140051090
mov r8, qword [rdx]
cmp rcx, rax
jne 0x1400510c6
test rcx, rcx
je 0x1400510b4
sub r8, rsi
nop dword [rax]
movzx eax, word [rsi + r8]
cmp ax, word [rsi]
jne 0x1400510c6
add rsi, 2
sub rcx, 1
jne 0x1400510a0
lea rdx, [r9 - 0x20]
jmp 0x1400510c6
add rcx, 2
jmp 0x140050f60
mov rdx, rsi
mov rcx, rdi
call fcn.14003dd20
mov r9, r12
mov r8, r13
mov rdx, rdi
call fcn.1400522d0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140052147
cmp ebx, 0xc015001d
je 0x140052147
test byte [rbp + 0x2830], 2
je 0x1400512de
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.14007e370
mov edx, 0xff
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp + 0x190]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140051150
mov r8, rbx
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x68]
call fcn.140001360
nop
mov r8d, 1
lea rdx, [0x1400e1a0c]
lea rcx, [rsp + 0x68]
call fcn.140037080
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400511c2
mov rdx, qword [rdi]
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
lea rcx, [rbp - 0x38]
call fcn.140037080
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14003dda0
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140051243
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005123d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005222d
call fcn.14007bc4c
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140051283
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005127e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052233
call fcn.14007bc4c
movdqa xmm0, xmmword [0x1400e2e50]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], bx
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140052147
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400512d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052239
call fcn.14007bc4c
jmp 0x140052147
xor ebx, ebx
jmp 0x140052147
mov r14d, dword [rbp + 0x2830]
test r14b, 1
jne 0x140052142
mov r9, r12
mov r8, r13
mov rdx, rdi
call fcn.1400522d0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140052147
cmp ebx, 0xc015001d
je 0x140052147
test r14b, 4
jne 0x140052142
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140051338
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r12d, r12d
cmp eax, 0xffffffff
je 0x14005134e
mov ebx, r12d
jmp 0x14005214a
mov qword [rbp + 0x180], r12
lea r8, [rbp + 0x180]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rsi, eax
test eax, eax
jne 0x140051487
mov ebx, r12d
nop
test rsi, rsi
jne 0x140051487
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x590]
call fcn.14007e370
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x390]
call fcn.14007e370
mov dword [rbp + 0x170], 0xff
mov dword [rbp + 0x178], r12d
lea rax, [rbp + 0x170]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x390]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x178]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x170]
lea r8, [rbp + 0x590]
mov edx, ebx
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rsi, eax
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 8
cmovae rdx, qword [rbp + 0x150]
lea rcx, [rbp + 0x390]
call fcn.14008f1cc
test eax, eax
jne 0x140051479
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.14007e370
mov dword [rbp + 0x170], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x190]
test r14b, 8
je 0x14005146a
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140051470
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rsi, rsi
je 0x1400517a1
inc ebx
cmp ebx, 0x1000
jl 0x140051380
mov rcx, qword [r15 + 0x10]
lea rsi, [0x1400e1a0c]
test rcx, rcx
je 0x1400515e0
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x14005223f
cmp qword [r15 + 0x18], 8
jb 0x1400514bc
mov r15, qword [r15]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov r9, r15
lea rcx, [rbp + 0xc8]
call fcn.140039070
nop
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 8
cmovae rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
lea rcx, [rbp + 0xc8]
call fcn.140037080
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x140051566
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051561
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052257
call fcn.14007bc4c
movups xmmword [rbp + 0x130], xmm6
movups xmmword [rbp + 0x140], xmm7
mov rdx, qword [rbp + 0xe0]
cmp rdx, 8
jb 0x1400515ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400515b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005225d
call fcn.14007bc4c
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae rcx, qword [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400520bc
mov r8d, dword [r13 + 8]
lea rdx, [rbp + 0x108]
call fcn.140052860
nop
mov r8d, 1
mov rdx, rsi
mov rcx, rax
call fcn.140037080
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 8
cmovae rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
lea rcx, [rbp - 0x18]
call fcn.140037080
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x1400516b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400516af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052263
call fcn.14007bc4c
movups xmmword [rbp + 0x130], xmm6
movups xmmword [rbp + 0x140], xmm7
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x140051702
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400516fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052269
call fcn.14007bc4c
movdqa xmm0, xmmword [0x1400e2e50]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], r12w
mov rdx, qword [rbp + 0x120]
cmp rdx, 8
jb 0x14005175a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051755
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005226f
call fcn.14007bc4c
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae rcx, qword [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400520bc
mov edx, 0x1000
lea rcx, [rbp + 0x790]
test r14b, 8
je 0x140051909
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14005190f
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp + 0x190]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400517c0
mov r8, rbx
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x68]
call fcn.140001360
nop
lea r8, [0x1400e1a0c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x58]
call fcn.1400532b0
nop
lea r8, [rbp + 0x390]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400532b0
mov rdx, rax
mov rcx, rdi
call fcn.14003dda0
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140051856
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051851
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052245
call fcn.14007bc4c
movdqa xmm0, xmmword [0x1400e2e50]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r12w
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x1400518aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400518a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005224b
call fcn.14007bc4c
movdqa xmm0, xmmword [0x1400e2e50]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r12w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140052124
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400518fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052251
call fcn.14007bc4c
mov ebx, r12d
jmp 0x14005212e
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
lea rax, [rbp + 0x790]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140051935
lea rdx, [rbp + 0x790]
lea rcx, [rbp + 0x88]
call fcn.140001360
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rbp + 0x88]
call fcn.140037080
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 8
cmovae rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
lea rcx, [rbp + 8]
call fcn.140037080
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x140051a1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051a16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052275
call fcn.14007bc4c
movups xmmword [rbp + 0x130], xmm6
movups xmmword [rbp + 0x140], xmm7
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x140051a69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051a64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005227b
call fcn.14007bc4c
movdqa xmm0, xmmword [0x1400e2e50]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r12w
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb 0x140051ac1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051abc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052281
call fcn.14007bc4c
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae rcx, qword [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400520bc
mov edx, 0x1000
lea rcx, [rbp + 0x790]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb8], xmm1
lea rax, [rbp + 0x790]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140051b20
lea rdx, [rbp + 0x790]
lea rcx, [rbp + 0xa8]
call fcn.140001360
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rbp + 0xa8]
call fcn.140037080
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 8
cmovae rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
lea rcx, [rbp + 0x28]
call fcn.140037080
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x140051c06
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051c01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052287
call fcn.14007bc4c
movups xmmword [rbp + 0x130], xmm6
movups xmmword [rbp + 0x140], xmm7
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x140051c54
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051c4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005228d
call fcn.14007bc4c
movdqa xmm0, xmmword [0x1400e2e50]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r12w
mov rdx, qword [rbp + 0xc0]
cmp rdx, 8
jb 0x140051cac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051ca7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052293
call fcn.14007bc4c
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae rcx, qword [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400520bc
lea rdx, [rbp + 0x790]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
lea rax, [rbp + 0x790]
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140051d00
lea rdx, [rbp + 0x790]
lea rcx, [rbp - 0x58]
call fcn.140001360
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rbp - 0x58]
call fcn.140037080
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 8
cmovae rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
lea rcx, [rbp + 0x48]
call fcn.140037080
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x140051de0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051ddb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052299
call fcn.14007bc4c
movups xmmword [rbp + 0x130], xmm6
movups xmmword [rbp + 0x140], xmm7
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x140051e2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051e29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005229f
call fcn.14007bc4c
movdqa xmm0, xmmword [0x1400e2e50]
movdqu xmmword [rbp + 0x58], xmm0
mov word [rbp + 0x48], r12w
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140051e80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051e7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400522a5
call fcn.14007bc4c
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae rcx, qword [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140051eb9
lea rdx, [rbp + 0x130]
mov rcx, rdi
call fcn.14003dd20
mov ebx, r12d
jmp 0x14005212e
mov r8d, 0x1000
lea rdx, [rbp + 0x790]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x790]
lea r8, [rbp + 0x128]
lea rdx, [0x1400e1ac0]
call fcn.1400903b8
test rax, rax
je 0x140052129
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], r12
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140051f10
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140001360
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rbp + 0x68]
call fcn.140037080
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 8
cmovae rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
lea rcx, [rbp - 0x78]
call fcn.140037080
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x140051fec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051fe7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400522ab
call fcn.14007bc4c
movups xmmword [rbp + 0x130], xmm6
movups xmmword [rbp + 0x140], xmm7
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14005203a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052035
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400522b1
call fcn.14007bc4c
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r12w
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x14005208e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052089
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400522b7
call fcn.14007bc4c
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae rcx, qword [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400520bc
mov rcx, qword [rbp + 0x128]
jmp 0x140051eda
lea rax, [rbp + 0x130]
cmp rdi, rax
je 0x140052124
lea r9, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae r9, qword [rbp + 0x130]
mov rax, qword [rdi + 0x18]
mov rbx, qword [rbp + 0x140]
cmp rbx, rax
ja 0x140052119
cmp rax, 8
jb 0x1400520f8
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x40]
mov qword [rax], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rdi
call fcn.14007dcb0
mov word [rdi + rbx*2], r12w
mov ebx, r12d
jmp 0x14005212e
mov rdx, rbx
mov rcx, rdi
call fcn.14003e160
mov ebx, r12d
jmp 0x14005212e
mov ebx, 0xc0000225
mov rcx, qword [rbp + 0x180]
test rcx, rcx
jle 0x14005214a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14005214a
mov ebx, 0xc0000225
xor r12d, r12d
mov rdx, qword [rbp + 0x168]
cmp rdx, 8
jb 0x140052190
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005218b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400522bd
call fcn.14007bc4c
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x168], 7
mov word [rbp + 0x150], r12w
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x1400521ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400521e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052221
call fcn.14007bc4c
mov eax, ebx
mov rcx, qword [rbp + 0x2790]
xor rcx, rsp
call fcn.14007b9a0
movaps xmm6, xmmword [rsp + 0x28b0]
movaps xmm7, xmmword [rsp + 0x28a0]
add rsp, 0x28c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140001330
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
nop
call fcn.140082678
int3