Function at 0x14001ae30
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27c8]
mov eax, 0x28c8
call fcn.140046b40
sub rsp, rax
movaps xmmword [rsp + 0x28b0], xmm6
movaps xmmword [rsp + 0x28a0], xmm7
mov rax, qword [0x140094060]
xor rax, rsp
mov qword [rbp + 0x2790], rax
mov r15, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov r13, qword [rbp + 0x2838]
mov r12, qword [rbp + 0x2840]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x790]
call fcn.140048df0
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], rbx
mov qword [rbp + 0x150], 7
mov word [rbp + 0x138], bx
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x80], xmm1
lea rax, [rdi + 0x10]
mov qword [rsp + 0x48], rax
mov qword [rax], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xf0]
call fcn.140012e60
mov rdx, rax
mov rcx, rdi
call fcn.14000fc10
mov rdx, qword [rbp + 0x108]
cmp rdx, 8
jb 0x14001af4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001af4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c294
call fcn.140046500
mov rdx, rdi
lea rcx, [rbp + 0x158]
call fcn.140012670
nop
cmp dword [0x14009764c], 9
ja 0x14001b05e
lea r10, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae r10, qword [rbp + 0x158]
mov rbx, qword [rbp + 0x168]
cmp rbx, 7
jb 0x14001b05e
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x140085c10]
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x14001afd6
cmp word [rcx], 0x65
je 0x14001afd3
nop dword [rax]
cmp rax, 1
je 0x14001afd6
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x14001afc0
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14001b05e
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x140085c10]
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x14001b0fa
add rdx, 2
sub r8, 1
jne 0x14001b000
sub rcx, r10
sar rcx, 1
jne 0x14001b05e
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rcx, qword [rbp + 0x158]
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call fcn.140048740
mov qword [rbp + 0x168], rbx
mov r14, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, r14
je 0x14001b329
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14001b07e
mov rdx, qword [rdx]
lea rcx, [rbp + 0x158]
call fcn.14001cb60
cmp rax, 0xffffffffffffffff
jne 0x14001b09b
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r14
jne 0x14001b070
cmp rbx, r14
je 0x14001b329
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x14001b103
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x14001b0bf
mov rsi, qword [rsi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x14001b0d0
mov r8, qword [rdx]
cmp rcx, rax
jne 0x14001b106
test rcx, rcx
je 0x14001b0f4
sub r8, rsi
nop dword [rax]
movzx eax, word [rsi + r8]
cmp ax, word [rsi]
jne 0x14001b106
add rsi, 2
sub rcx, 1
jne 0x14001b0e0
lea rdx, [r9 - 0x20]
jmp 0x14001b106
add rcx, 2
jmp 0x14001af9f
mov rdx, rsi
mov rcx, rdi
call fcn.14000fb20
mov r9, r12
mov r8, r13
mov rdx, rdi
call fcn.14001c330
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14001c1b4
cmp ebx, 0xc015001d
je 0x14001c1b4
test byte [rbp + 0x2830], 2
je 0x14001b322
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.140048df0
mov edx, 0xff
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rbp + 0x190]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14001b190
mov r8, rbx
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x70]
call fcn.140010730
nop
mov r8d, 1
lea rdx, [0x140085c0c]
lea rcx, [rbp - 0x70]
call fcn.14001d6c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001b204
mov rdx, qword [rdi]
mov rax, qword [rsp + 0x48]
mov r8, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.14001d6c0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14000fc10
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14001b284
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b27e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c29a
call fcn.140046500
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14001b2c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b2c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2a0
call fcn.140046500
movdqa xmm0, xmmword [0x140086eb0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bx
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001c1b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b318
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2a6
call fcn.140046500
jmp 0x14001c1b4
xor ebx, ebx
jmp 0x14001c1b4
mov r14d, dword [rbp + 0x2830]
test r14b, 1
jne 0x14001c1af
mov r9, r12
mov r8, r13
mov rdx, rdi
call fcn.14001c330
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14001c1b4
cmp ebx, 0xc015001d
je 0x14001c1b4
test r14b, 4
jne 0x14001c1af
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001b37c
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r12d, r12d
cmp eax, 0xffffffff
je 0x14001b392
mov ebx, r12d
jmp 0x14001c1b7
mov qword [rbp + 0x188], r12
lea r8, [rbp + 0x188]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rsi, eax
test eax, eax
jne 0x14001b4c9
mov ebx, r12d
test rsi, rsi
jne 0x14001b4c9
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x590]
call fcn.140048df0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x390]
call fcn.140048df0
mov dword [rbp + 0x178], 0xff
mov dword [rbp + 0x180], r12d
lea rax, [rbp + 0x178]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x390]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x178]
lea r8, [rbp + 0x590]
mov edx, ebx
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rsi, eax
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x390]
call fcn.140058800
test eax, eax
jne 0x14001b4bb
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.140048df0
mov dword [rbp + 0x178], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x190]
test r14b, 8
je 0x14001b4ac
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14001b4b2
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rsi, rsi
je 0x14001b7e3
inc ebx
cmp ebx, 0x1000
jl 0x14001b3c2
mov rcx, qword [r15 + 0x10]
lea rsi, [0x140085c0c]
test rcx, rcx
je 0x14001b622
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x14001c2ac
cmp qword [r15 + 0x18], 8
jb 0x14001b4fe
mov r15, qword [r15]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov r9, r15
lea rcx, [rbp + 0xd0]
call fcn.14001d580
nop
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp + 0xd0]
call fcn.14001d6c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x14001b5a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b5a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2c4
call fcn.140046500
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x14001b5fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b5f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2ca
call fcn.140046500
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 8
cmovae rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001c129
mov r8d, dword [r13 + 8]
lea rdx, [rbp + 0x110]
call fcn.14001c8c0
nop
mov r8d, 1
mov rdx, rsi
mov rcx, rax
call fcn.14001d6c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp - 0x30]
call fcn.14001d6c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x14001b6f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b6f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2d0
call fcn.140046500
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001b744
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b73f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2d6
call fcn.140046500
movdqa xmm0, xmmword [0x140086eb0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r12w
mov rdx, qword [rbp + 0x128]
cmp rdx, 8
jb 0x14001b79c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b797
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2dc
call fcn.140046500
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 8
cmovae rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001c129
mov edx, 0x1000
lea rcx, [rbp + 0x790]
test r14b, 8
je 0x14001b96e
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14001b974
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rbp + 0x190]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14001b800
mov r8, rbx
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x70]
call fcn.140010730
nop
mov r8d, 1
lea rdx, [0x140085c0c]
lea rcx, [rbp - 0x70]
call fcn.14001d6c0
mov rbx, rax
mov r8, rax
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140010710
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14000fe70
nop
lea r8, [rbp + 0x390]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14001d3f0
mov rdx, rax
mov rcx, rdi
call fcn.14000fc10
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14001b8b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b8b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2b2
call fcn.140046500
movdqa xmm0, xmmword [0x140086eb0]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r12w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14001b90e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b909
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2b8
call fcn.140046500
movdqa xmm0, xmmword [0x140086eb0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r12w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001c191
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b961
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2be
call fcn.140046500
mov ebx, r12d
jmp 0x14001c19b
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rax, [rbp + 0x790]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001b9a0
lea rdx, [rbp + 0x790]
lea rcx, [rbp + 0x70]
call fcn.140010730
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rbp + 0x70]
call fcn.14001d6c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp - 0x10]
call fcn.14001d6c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x14001ba80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ba7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2e2
call fcn.140046500
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001bace
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bac9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2e8
call fcn.140046500
movdqa xmm0, xmmword [0x140086eb0]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r12w
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x14001bb23
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bb1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2ee
call fcn.140046500
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 8
cmovae rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001c129
mov edx, 0x1000
lea rcx, [rbp + 0x790]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
lea rax, [rbp + 0x790]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001bb80
lea rdx, [rbp + 0x790]
lea rcx, [rbp + 0x90]
call fcn.140010730
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rbp + 0x90]
call fcn.14001d6c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp + 0x10]
call fcn.14001d6c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x14001bc66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bc61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2f4
call fcn.140046500
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14001bcb4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bcaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c2fa
call fcn.140046500
movdqa xmm0, xmmword [0x140086eb0]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r12w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x14001bd0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bd07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c300
call fcn.140046500
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 8
cmovae rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001c129
lea rdx, [rbp + 0x790]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
lea rax, [rbp + 0x790]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14001bd63
lea rdx, [rbp + 0x790]
lea rcx, [rbp + 0xb0]
call fcn.140010730
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rbp + 0xb0]
call fcn.14001d6c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp + 0x30]
call fcn.14001d6c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x14001be49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001be44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c306
call fcn.140046500
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14001be97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001be92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c30c
call fcn.140046500
movdqa xmm0, xmmword [0x140086eb0]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], r12w
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x14001beef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001beea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c312
call fcn.140046500
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 8
cmovae rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001bf28
lea rdx, [rbp + 0x138]
mov rcx, rdi
call fcn.14000fb20
mov ebx, r12d
jmp 0x14001c19b
mov r8d, 0x1000
lea rdx, [rbp + 0x790]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x790]
lea r8, [rbp + 0x130]
lea rdx, [0x140085ca4]
call fcn.140058c7c
test rax, rax
je 0x14001c196
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001bf80
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.140010730
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rbp + 0x50]
call fcn.14001d6c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp - 0x50]
call fcn.14001d6c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x14001c05c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c057
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c318
call fcn.140046500
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14001c0aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c0a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c31e
call fcn.140046500
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r12w
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x14001c0fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c0f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c324
call fcn.140046500
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 8
cmovae rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001c129
mov rcx, qword [rbp + 0x130]
jmp 0x14001bf49
lea rax, [rbp + 0x138]
cmp rdi, rax
je 0x14001c191
lea r9, [rbp + 0x138]
cmp qword [rbp + 0x150], 8
cmovae r9, qword [rbp + 0x138]
mov rax, qword [rdi + 0x18]
mov rbx, qword [rbp + 0x148]
cmp rbx, rax
ja 0x14001c186
cmp rax, 8
jb 0x14001c165
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x48]
mov qword [rax], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rdi
call fcn.140048740
mov word [rdi + rbx*2], r12w
mov ebx, r12d
jmp 0x14001c19b
mov rdx, rbx
mov rcx, rdi
call fcn.1400108e0
mov ebx, r12d
jmp 0x14001c19b
mov ebx, 0xc0000225
mov rcx, qword [rbp + 0x188]
test rcx, rcx
jle 0x14001c1b7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c1b7
mov ebx, 0xc0000225
xor r12d, r12d
mov rdx, qword [rbp + 0x170]
cmp rdx, 8
jb 0x14001c1fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c1f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c32a
call fcn.140046500
mov qword [rbp + 0x168], r12
mov qword [rbp + 0x170], 7
mov word [rbp + 0x158], r12w
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x14001c259
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c254
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c28e
call fcn.140046500
mov eax, ebx
mov rcx, qword [rbp + 0x2790]
xor rcx, rsp
call fcn.1400464e0
movaps xmm6, xmmword [rsp + 0x28b0]
movaps xmm7, xmmword [rsp + 0x28a0]
add rsp, 0x28c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.140001380
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
nop
call fcn.1400546f4
int3