Function at 0x140011770
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get geographical location
Get program files directory
Get startup folder
Query environment variable
Set environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rbp
lea rbp, [r11 - 0xd28]
sub rsp, 0xe20
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rbp + 0xd10], rax
lea rdx, str.Environment
lea rcx, [0x140042700]
mov r8d, 1
mov qword [r11 + 0x10], r14
call fcn.140011580
lea rdx, [0x14002e090]
lea rcx, str.OnlineServices
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140040bb8]
lea rcx, str.ISO_LG
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140040bc0]
lea rcx, str.ISO_UILG
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140040bc8]
lea rcx, str.ISO_UILG3
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140040bd0]
lea rcx, str.ISO_UILGCTRY
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140040c10]
lea rcx, str.ISO_UILGCTRYLIST
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140041418]
lea rcx, str.MUIPACKS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140040b68]
lea rcx, str.ISO_COUNTRY
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140040bb0]
lea rcx, str.ISO_COUNTRY3
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140041420]
lea rcx, str.COUNTRY
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140041620]
lea rcx, str.LANGUAGE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400416a0]
lea rcx, str.EXPANDEDLANGUAGE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140041660]
lea rcx, str.NATIVELANGUAGE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140041620]
lea rcx, [0x14002e200]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140040b70]
lea rcx, str.ISOLANGCOUNTRYCODE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1400416e0]
lea rcx, str.CurrentInstanceGUID
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, dword [0x140040b58]
lea rdx, [0x14002ccc8]
lea rcx, [rbp + 0x900]
call fcn.140018028
lea rdx, [rbp + 0x900]
lea rcx, str.COUNTRYID
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, dword [0x140040b5c]
lea rdx, [0x14002ccc8]
lea rcx, [rbp + 0x900]
call fcn.140018028
lea rdx, [rbp + 0x900]
lea rcx, str.COUNTRYCODE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x2f]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.ADMINISTRATIVE_TOOLS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rbp + 0x2e0]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 0x2e]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_ADMINISTRATIVE_TOOLS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x1f]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.CACHE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x3a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.CD_BURNING
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x20]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COOKIES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rbp + 0x2e0]
mov r9d, 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.DESKTOP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x18]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_DESKTOP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 5]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.FAVORITES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x13]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.FONTS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rbp + 0x2e0]
mov r9d, 1
lea edx, [r9 + 0x21]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.HISTORY
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x1b]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.LOCAL_APPDATA
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x22]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_APPDATA
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 4]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.PERSONAL
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.MY_DOCUMENTS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x2d]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_DOCUMENTS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0xc]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.MY_MUSIC
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x34]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMONMUSIC
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x26]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.MY_PICTURES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rbp + 0x2e0]
mov r9d, 1
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x35]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMONPICTURES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0xd]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.MY_VIDEO
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x36]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMONVIDEO
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0xa]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.START_MENU
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x15]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_START_MENU
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.PROGRAMS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x16]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_PROGRAMS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 6]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.STARTUP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rbp + 0x2e0]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 0x17]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_STARTUP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x14]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.TEMPLATES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x2c]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.COMMON_TEMPLATES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x12]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.NETHOOD
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.PRINTHOOD
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 7]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.RECENT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 8]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.SENDTO
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9d, 1
lea rax, [rbp + 0x2e0]
lea edx, [r9 + 0x39]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x2e0]
lea rcx, str.OEM_LINKS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.C:hp_tmp_src_bitswt_wc
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
call fcn.140010b90
lea rcx, str.OSHAL
cmp eax, 1
jne 0x140012091
lea rdx, [0x14002e644]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, str.SOFTWAREWow6432Node
lea rcx, str.SoftwareRegKey
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp ebx, 0xffffffff
je 0x140012127
lea rdx, str.SOFTWAREWow6432NodeMicrosoft
jmp 0x14001211a
lea rdx, [0x14002e6f0]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rbp + 0xb00]
lea rcx, str.CommonProgramFiles
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rbp + 0xb00]
lea rcx, str.CommonProgramFiles_x86_
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rbp + 0xb00]
lea rcx, str.ProgramFiles
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rbp + 0xb00]
lea rcx, str.ProgramFiles_x86_
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, str.SOFTWARE
lea rcx, str.SoftwareRegKey
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp ebx, 0xffffffff
je 0x140012127
lea rdx, str.SOFTWAREMicrosoft
lea rcx, str.SoftwareRegKey
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov qword [rsp + 0xe30], rdi
call fcn.140011030
lea rcx, str.C:System.savutil_vars.ini
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
lea rsi, [0x1400433a0]
lea r14, str.Pavilion
cmp eax, 0xffffffff
je 0x1400129d6
lea r8d, [rbx + 1]
lea rdx, str.Bios_Strings
lea rcx, str.C:System.savutil_vars.ini
call fcn.140011580
lea r8d, [rbx + 1]
lea rdx, str.toolset
lea rcx, str.C:System.savutil_vars.ini
call fcn.140011580
lea r8d, [rbx + 1]
lea rdx, [0x14002e840]
lea rcx, str.C:System.savutil_vars.ini
call fcn.140011580
lea r8d, [rbx + 8]
lea rdx, [0x140043460]
lea rcx, str.LanguageCode
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1d0]
lea rcx, str.CT.AIO
mov qword [rbp + 0x1d0], rbx
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x2d0], rbx
mov qword [rbp + 0x2d8], rax
mov qword [rbp + 0x1e0], rbx
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x1c8], rax
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], rax
mov qword [rbp + 0x1a0], rbx
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x2a0], rbx
mov qword [rbp + 0x2a8], rax
mov qword [rbp + 0x2c0], rbx
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x2b0], rbx
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x210], rbx
mov qword [rbp + 0x218], rax
mov qword [rbp + 0x280], rbx
mov qword [rbp + 0x288], rax
mov qword [rbp + 0x290], rbx
mov qword [rbp + 0x298], rax
mov qword [rbp + 0x220], rbx
mov qword [rbp + 0x228], rax
mov qword [rbp + 0x260], rbx
mov qword [rbp + 0x268], rax
mov qword [rbp + 0x240], rbx
mov qword [rbp + 0x248], rax
mov qword [rbp + 0x200], rbx
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x1f0], rbx
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x230], rbx
mov qword [rbp + 0x238], rax
mov qword [rbp + 0x250], rbx
mov qword [rbp + 0x258], rax
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x278], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x2d0]
lea rcx, str.CT.MT
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1e0]
lea rcx, str.CT.NB
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1c0]
lea rcx, str.CT.TAB
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x190]
lea rcx, str.PLT.TOU
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1a0]
lea rcx, str.PCBR.HP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1b0]
lea rcx, str.PCBR.CPQ
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x2a0]
lea rcx, str.SL.MAI
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x2c0]
lea rcx, str.SL.PRE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x2b0]
lea rcx, str.SL.BUD
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x210]
lea rcx, str.SEG.CON
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x280]
lea rcx, str.SEG.SBSO
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x290]
lea rcx, str.SEG.ENT
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x220]
lea rcx, str.SEG.PRM
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x260]
lea rcx, str.SEG.RPS
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x240]
lea rcx, str.SEG.WKS
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x200]
lea rcx, str.SEG.TC
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x1f0]
lea rcx, str.BBUY
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x230]
lea rcx, str.R_WM
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x250]
lea rcx, str.R_COSTCO
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [rbx + 4]
lea rdx, [rbp + 0x270]
lea rcx, str.R_SAM
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
lea rdx, [0x14002d8e4]
test eax, eax
je 0x140012526
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
lea rdx, [0x14002d8e4]
test eax, eax
je 0x140012526
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x14001254b
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x190]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x14001254b
lea rdx, [0x14002d8e4]
lea rcx, [0x140041ae0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x210]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x140012583
lea rdx, str.Consumer
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Consumer
jmp 0x1400126c8
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x280]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400125bb
lea rdx, str.SBSO
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.SBSO
jmp 0x1400126c8
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x290]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400125f3
lea rdx, str.Enterprise
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Enterprise
jmp 0x1400126c8
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x220]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x14001262b
lea rdx, str.Premium
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Premium
jmp 0x1400126c8
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x260]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x140012660
lea rdx, str.RPOS
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.RPOS
jmp 0x1400126c8
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x140012695
lea rdx, str.Workstation
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Workstation
jmp 0x1400126c8
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400126d5
lea rdx, str.ThinClient
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.ThinClient
lea rcx, [0x1400430a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400126f6
lea rdx, str.BestBuy
jmp 0x14001275e
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x230]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x140012717
lea rdx, str.Walmart
jmp 0x14001275e
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x250]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x140012738
lea rdx, str.Costco
jmp 0x14001275e
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x270]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
lea rdx, str.SAMS
test eax, eax
je 0x14001275e
lea rdx, [0x1400430a0]
lea rcx, [0x140043470]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x140043470]
lea rcx, str.Channel
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x1b0]
call fcn.140017124
test eax, eax
jne 0x14001279f
lea rdx, str.Compaq
jmp 0x1400127bd
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x1a0]
call fcn.140017124
test eax, eax
jne 0x1400127ca
lea rdx, [0x14002eac0]
lea rcx, [0x140042fa0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1400127eb
lea rdx, str.Notebook
jmp 0x140012811
lea rdx, [0x14002d8e4]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
lea rdx, str.Tablet
test eax, eax
je 0x140012811
lea rdx, str.Desktop
lea rcx, [0x140043120]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x1400432a0]
lea rcx, [0x140043220]
mov r8d, 5
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x140012973
lea rdx, [0x14002d848]
lea rcx, [0x140041af8]
call fcn.140017124
test eax, eax
je 0x140012c84
lea rdx, [0x14002d858]
lea rcx, [0x140041af8]
call fcn.140017124
test eax, eax
je 0x140012c84
lea rdx, [0x14002d870]
lea rcx, [0x140041af8]
call fcn.140017124
test eax, eax
je 0x140012c84
lea rdx, [0x14002d868]
lea rcx, [0x140041af8]
call fcn.140017124
test eax, eax
je 0x140012a70
lea rdx, [0x14002d870]
lea rcx, [0x140041af8]
call fcn.140017124
test eax, eax
je 0x140012a70
lea rdx, [0x14002d8c0]
lea rcx, [0x140041af8]
call fcn.140017124
test eax, eax
jne 0x140012e8b
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x40], ebx
call fcn.1400166f0
lea rdx, [rsp + 0x40]
lea rcx, str.C:hp_binRStone.ini
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140012ac0
lea rdx, str.SBSO
lea rcx, [0x1400430a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140012b14
lea rdx, [0x14002c724]
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x140012ae1
lea rdx, str.SBSO
jmp 0x140012b07
lea rdx, [0x14002edd4]
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea rdx, str.Workstation
test eax, eax
je 0x140012b07
lea rdx, str.Enterprise
lea rcx, [0x1400430a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Compaq
lea rcx, [0x1400432a0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
lea rcx, [0x140042fa0]
lea rdx, str.Compaq
test rax, rax
jne 0x140012b42
lea rdx, [0x14002eac0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rcx, [rbp + 0x6f4]
xor edx, edx
mov r8d, 0x204
mov dword [rbp + 0x6f0], ebx
call fcn.1400166f0
lea rdx, [rbp + 0x6f0]
lea rcx, [0x14002edd8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x6f0]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x140012b90
mov rax, qword [str.Application_DataHPhpcasldetect.ini]
mov qword [rcx], rax
mov rax, qword [0x14002ee08]
mov qword [rcx + 8], rax
mov rax, qword [0x14002ee10]
mov qword [rcx + 0x10], rax
mov rax, qword [0x14002ee18]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14002ee20]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14002ee28]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14002ee30]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14002ee38]
mov qword [rcx + 0x38], rax
mov rax, qword [0x14002ee40]
mov qword [rcx + 0x40], rax
mov eax, dword [0x14002ee48]
mov dword [rcx + 0x48], eax
lea rcx, str.C:ProgramDataHPhpcasldetect.ini
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140012c20
lea rcx, str.C:ProgramDataHPhpcasldetect.ini
jmp 0x140012c54
lea rcx, [rbp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140012c3b
lea rcx, [rbp + 0x6f0]
jmp 0x140012c54
lea rcx, str.C:_swsetupPINtoolshpcasldetect.ini
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140012c66
lea rcx, str.C:_swsetupPINtoolshpcasldetect.ini
lea rdx, str.Wireless
mov r8d, 1
call fcn.140011580
lea rdx, str.Notebook
lea rcx, [0x140043120]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
call fcn.140010580
jmp 0x140012e8b
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x1fc
mov dword [rsp + 0x40], ebx
call fcn.1400166f0
lea rcx, [rbp + 0x6f4]
xor edx, edx
mov r8d, 0x1fc
mov dword [rbp + 0x6f0], ebx
call fcn.1400166f0
mov rcx, rbx
nop word [rax + rax]
movzx eax, word [rcx + r14]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x3e], ax
test ax, ax
jne 0x140012cc0
lea rcx, str.C:hp_binRStonePost.INI
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140012cee
lea rcx, str.C:hp_binRStonePost.INI
jmp 0x140012d22
lea rcx, str.C:hp_binRStone_BBV.INI
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140012d09
lea rcx, str.C:hp_binRStone_BBV.INI
jmp 0x140012d22
lea rcx, str.C:hp_binRStonePre.INI
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140012d34
lea rcx, str.C:hp_binRStonePre.INI
lea rdx, str.Bios_Strings
mov r8d, 1
call fcn.140011580
lea rdx, [rsp + 0x40]
lea rcx, str.BrandName
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rsp + 0x40]
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Mini
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x140012d8b
lea rdx, str.Mini
lea rcx, str.Series
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x140012da8
lea rdx, str.Premium
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea rdx, str.Premium
test eax, eax
je 0x140012daf
lea rdx, str.Consumer
lea rcx, [0x1400430a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.Compaq
lea rcx, [0x1400432a0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140012df4
lea rdx, str.Presario
lea rcx, [0x140043020]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea rdx, [0x14002eac0]
test eax, eax
jne 0x140012dfb
lea rdx, str.Compaq
lea rcx, [0x140042fa0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [rbp + 0x6f0]
lea rcx, str.ModelName
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x6f0]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140012e30
test rax, rax
je 0x140012e4e
lea rdx, [rbp + 0x6f0]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rcx, str.C:System.sav_flagsconvertible.flg
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140012e72
lea rcx, str.C:System.sav_flags_tablet.flg
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140012e77
call fcn.140010580
lea rdx, str.Notebook
lea rcx, [0x140043120]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]