Function at 0x100001bb0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1000
call fcn.100004270
sub rsp, rax
mov rax, qword [0x100006170]
xor rax, rsp
mov qword [rsp + 0xff0], rax
xor r13d, r13d
mov qword [rsp + 0x78], rdx
mov ebp, ecx
mov dword [rsp + 0x8c], ecx
lea ebx, [r13 + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, ebx
mov dword [rsp + 0x94], r13d
mov dword [rsp + 0x88], r13d
mov word [rsp + 0x90], r13w
mov word [0x1000071e0], r13w
mov word [0x100006fd0], r13w
mov word [0x1000069b0], r13w
mov word [0x1000067a0], r13w
mov byte [rsp + 0x71], r13b
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor r8d, r8d
xor edx, edx
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
lea rax, [0x100007410]
lea rdi, [0x1000073f0]
mov qword [0x100007400], r13
mov qword [0x1000073f0], rax
lea rax, [0x100001368]
mov byte [0x100007408], bl
mov qword [0x100007430], rax
lea rax, [0x100001378]
mov byte [0x100007409], r13b
mov word [0x10000740a], r13w
mov dword [0x10000740c], r13d
mov qword [0x100007420], r13
mov qword [0x100007438], rax
mov qword [0x100007410], r13
mov byte [0x100007428], bl
mov byte [0x100007429], r13b
mov word [0x10000742a], r13w
mov dword [0x10000742c], r13d
mov qword [0x100006180], rdi
lea rsi, [0x100007430]
lea r15d, [r13 + 8]
mov r8, qword [rsi]
lea rax, [rdi + 8]
lea rcx, [0x100001ab0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], r13
mov r9d, ebx
mov rdx, rdi
mov qword [rsp + 0x28], r13
add rsi, r15
mov qword [rsp + 0x98], r8
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x20], rax
call sub.ADVAPI32.dll_RegisterTraceGuidsW
mov rdi, qword [rdi]
cmp rdi, r13
jne 0x100001ce2
lea rdx, [0x100001360]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_setlocale]
lea rdx, [rsp + 0xc0]
lea rcx, [0x1000013c8]
mov r8d, 0x64
mov qword [rsp + 0x98], r13
call fcn.100003108
xor ecx, ecx
cmp eax, r13d
je 0x100001d7c
lea r8, [rsp + 0xc0]
lea edx, [rcx + 0x22]
call fcn.100002cd4
jmp 0x100001d86
mov edx, 0x23
call fcn.100002cd4
mov edx, 0x24
xor ecx, ecx
call fcn.100002cd4
cmp ebp, 2
jge 0x100001da8
call fcn.100002f94
call fcn.100001b5c
mov eax, ebx
jmp 0x100002b7a
lea rcx, [rsp + 0x3a2]
xor edx, edx
mov r8d, 0x616
mov word [rsp + 0xbd0], r13w
mov word [rsp + 0xde0], r13w
mov word [rsp + 0x9c0], r13w
mov word [rsp + 0x190], r13w
mov word [rsp + 0x3a0], r13w
call sub.msvcrt.dll_memset
lea eax, [rbp - 1]
mov sil, r13b
mov byte [rsp + 0x72], r13b
cmp eax, ebx
mov byte [rsp + 0x70], r13b
mov r12d, r13d
mov edi, r13d
mov dword [rsp + 0x74], r13d
mov r14d, ebx
mov rbp, rbx
mov r13d, 0x30c
jle 0x1000025df
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx + rbp*8]
cmp word [rax], 0x2d
lea rsi, [rax + 2]
je 0x100001e36
cmp word [rax], 0x2f
jne 0x100001d97
lea rdx, [0x1000013e8]
mov rcx, rsi
call fcn.100001860
xor ecx, ecx
cmp eax, ecx
jne 0x100001e53
or r15d, ebx
jmp 0x1000025c2
lea rdx, [0x1000013f8]
mov rcx, rsi
call fcn.100001860
xor ecx, ecx
cmp eax, ecx
jne 0x100001e71
or r15d, 2
jmp 0x1000025c2
lea rdx, [0x100001410]
mov r8d, 3
mov rcx, rsi
call fcn.100001960
xor r9d, r9d
cmp eax, r9d
jne 0x100001ef8
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
cmp rcx, 3
jbe 0x100001d97
lea r8, [0x1000067a0]
mov dword [rsp + 0x94], ebx
mov edx, 0x104
mov rcx, r8
sub rsi, r8
lea rax, [rdx + 0x7ffffefa]
cmp rax, r9
je 0x100001ee6
movzx eax, word [rcx + rsi + 6]
cmp ax, r9w
je 0x100001ee6
mov word [rcx], ax
add rcx, 2
sub rdx, rbx
jne 0x100001ec3
cmp rdx, r9
jne 0x100001eef
sub rcx, 2
mov word [rcx], r9w
jmp 0x1000024ea
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towupper]
cmp ax, 0x4c
jne 0x100001f2b
cmp word [rsi + 2], 0x3a
jne 0x100001f2b
lea rcx, [rsi + 4]
mov dword [rsp + 0x88], ebx
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x90], eax
jmp 0x1000025c2
lea rdx, [0x100001418]
mov rcx, rsi
call fcn.100001860
xor ecx, ecx
cmp eax, ecx
jne 0x100001f70
lea r8d, [rcx + 2]
lea rcx, [0x100001420]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ecx, ecx
cmp rax, rcx
je 0x1000026f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
or r15d, 4
jmp 0x1000025c2
lea rdx, [0x100001440]
mov rcx, rsi
call fcn.100001860
xor ecx, ecx
cmp eax, ecx
jne 0x100001f8d
or r12d, ebx
jmp 0x1000025c2
lea rdx, [0x100001468]
mov rcx, rsi
call fcn.100001860
xor ecx, ecx
cmp eax, ecx
jne 0x100001fab
or r12d, 2
jmp 0x1000025c2
lea rdx, [0x100001490]
mov rcx, rsi
call fcn.100001860
xor ecx, ecx
cmp eax, ecx
jne 0x100001fc9
or r12d, 0x20
jmp 0x1000025c2
lea rdx, [0x1000014b8]
mov rcx, rsi
call fcn.100001860
xor ecx, ecx
cmp eax, ecx
jne 0x100001fe7
or r12d, 0x40
jmp 0x1000025c2
lea rdx, [0x1000014e0]
mov rcx, rsi
call fcn.100001860
xor r9d, r9d
cmp eax, r9d
jne 0x100002012
cmp edi, r9d
jne 0x100001d97
mov edi, ebx
mov dword [rsp + 0x74], ebx
jmp 0x1000025c2
lea rdx, [0x100001508]
mov rcx, rsi
call fcn.100001860
xor r9d, r9d
cmp eax, r9d
jne 0x10000203f
cmp edi, r9d
jne 0x100001d97
lea edi, [r9 + 2]
mov dword [rsp + 0x74], edi
jmp 0x1000025c2
lea rdx, [0x100001530]
mov r8d, 0xa
mov rcx, rsi
call fcn.100001960
xor ecx, ecx
cmp eax, ecx
jne 0x100002141
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
cmp rcx, 0xa
jbe 0x100001d97
lea r8, [0x100001548]
lea rcx, [rsp + 0x3a0]
mov rdx, r13
call fcn.100001788
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x1000020de
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov edx, edi
mov rcx, rax
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
mov rcx, qword [0x100006180]
lea rax, [0x100006180]
cmp rcx, rax
je 0x1000020de
test byte [rcx + 0x1c], bl
je 0x1000020de
cmp byte [rcx + 0x19], 2
jb 0x1000020de
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000013b8]
mov edx, 0xa
mov r9d, edi
call fcn.100001a74
lea r8, [rsi + 0x14]
lea rcx, [rsp + 0x3a0]
mov rdx, r13
call fcn.100001788
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x100002343
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov edx, edi
mov rcx, rax
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
mov rcx, qword [0x100006180]
lea rax, [0x100006180]
cmp rcx, rax
je 0x100002343
test byte [rcx + 0x1c], bl
je 0x100002343
cmp byte [rcx + 0x19], 2
jb 0x100002343
mov edx, 0xb
jmp 0x100002330
lea rdx, [0x100001550]
mov r8d, 4
mov rcx, rsi
call fcn.100001960
xor ecx, ecx
cmp eax, ecx
jne 0x100002243
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
cmp rcx, 4
jbe 0x100001d97
lea r8, [0x10000155c]
lea rcx, [rsp + 0x3a0]
mov rdx, r13
call fcn.100001788
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x1000021e0
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov edx, edi
mov rcx, rax
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
mov rcx, qword [0x100006180]
lea rax, [0x100006180]
cmp rcx, rax
je 0x1000021e0
test byte [rcx + 0x1c], bl
je 0x1000021e0
cmp byte [rcx + 0x19], 2
jb 0x1000021e0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000013b8]
mov edx, 0xc
mov r9d, edi
call fcn.100001a74
lea r8, [rsi + 8]
lea rcx, [rsp + 0x3a0]
mov rdx, r13
call fcn.100001788
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x100002343
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov edx, edi
mov rcx, rax
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
mov rcx, qword [0x100006180]
lea rax, [0x100006180]
cmp rcx, rax
je 0x100002343
test byte [rcx + 0x1c], bl
je 0x100002343
cmp byte [rcx + 0x19], 2
jb 0x100002343
mov edx, 0xd
jmp 0x100002330
lea rdx, [0x100001568]
mov r8d, 4
mov rcx, rsi
call fcn.100001960
xor ecx, ecx
cmp eax, ecx
jne 0x10000234c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
cmp rcx, 4
jbe 0x100001d97
lea r8, [0x100001574]
lea rcx, [rsp + 0x3a0]
mov rdx, r13
call fcn.100001788
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x1000022e2
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov edx, edi
mov rcx, rax
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
mov rcx, qword [0x100006180]
lea rax, [0x100006180]
cmp rcx, rax
je 0x1000022e2
test byte [rcx + 0x1c], bl
je 0x1000022e2
cmp byte [rcx + 0x19], 2
jb 0x1000022e2
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000013b8]
mov edx, 0xe
mov r9d, edi
call fcn.100001a74
lea r8, [rsi + 8]
lea rcx, [rsp + 0x3a0]
mov rdx, r13
call fcn.100001788
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x100002343
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov edx, edi
mov rcx, rax
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
mov rcx, qword [0x100006180]
lea rax, [0x100006180]
cmp rcx, rax
je 0x100002343
test byte [rcx + 0x1c], bl
je 0x100002343
cmp byte [rcx + 0x19], 2
jb 0x100002343
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000013b8]
mov r9d, edi
call fcn.100001a74
or r15d, 0x20
jmp 0x1000024ea
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towupper]
cmp ax, 0x43
jne 0x100002383
cmp word [rsi + 2], 0x3a
jne 0x100002383
xor eax, eax
cmp r12d, eax
jne 0x100001d97
lea rcx, [rsi + 4]
mov byte [rsp + 0x72], bl
call qword [sym.imp.msvcrt.dll__wtol]
mov r12d, eax
jmp 0x1000025c2
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towupper]
cmp ax, 0x49
jne 0x1000023bc
cmp word [rsi + 2], 0x3a
jne 0x1000023bc
xor eax, eax
cmp edi, eax
jne 0x100001d97
lea rcx, [rsi + 4]
mov byte [rsp + 0x70], bl
call qword [sym.imp.msvcrt.dll__wtol]
mov edi, eax
mov dword [rsp + 0x74], eax
jmp 0x1000025c2
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towupper]
cmp ax, 0x4e
jne 0x1000023eb
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + rbp*8]
add rcx, 4
je 0x100001d9c
lea rdx, [rsp + 0x190]
jmp 0x1000025b3
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towupper]
cmp ax, 0x42
jne 0x1000024f3
mov rcx, qword [rsp + 0x78]
xor eax, eax
mov r8, qword [rcx + rbp*8]
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
cmp rcx, 3
jbe 0x100001d97
cmp word [r8 + 4], 0x3a
jne 0x100001d97
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x3a0]
repne scasw ax, word [rdi]
not rcx
cmp rcx, rbx
jne 0x100001d97
xor r9d, r9d
lea rax, [rsp + 0x3a0]
mov rdx, r13
sub r8, rax
lea rcx, [rsp + 0x3a0]
mov edi, r9d
lea rax, [rdx + 0x7ffffcf2]
cmp rax, r9
je 0x10000248a
movzx eax, word [rcx + r8 + 6]
cmp ax, r9w
je 0x10000248a
mov word [rcx], ax
add rcx, 2
sub rdx, rbx
jne 0x100002466
cmp rdx, r9
jne 0x100002498
sub rcx, 2
mov edi, 0x8007007a
cmp edi, r9d
mov word [rcx], r9w
jge 0x1000024e6
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov edx, edi
mov rcx, rax
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
mov rcx, qword [0x100006180]
lea rax, [0x100006180]
cmp rcx, rax
je 0x1000024e6
test byte [rcx + 0x1c], bl
je 0x1000024e6
cmp byte [rcx + 0x19], 2
jb 0x1000024e6
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000013b8]
mov edx, 0x10
mov r9d, edi
call fcn.100001a74
mov byte [rsp + 0x71], bl
mov edi, dword [rsp + 0x74]
jmp 0x1000025c2
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towupper]
cmp ax, 0x55
jne 0x100002522
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + rbp*8]
add rcx, 4
je 0x100001d9c
lea rdx, [rsp + 0xbd0]
jmp 0x1000025b3
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towupper]
cmp ax, 0x50
jne 0x100002581
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
mov rax, qword [rcx + rbp*8]
cmp word [rax + 4], 0x3a
jne 0x10000254b
cmp word [rax + 6], r9w
je 0x10000256f
lea rcx, [rax + 4]
cmp rcx, r9
je 0x100001d9c
lea rdx, [rsp + 0xde0]
call fcn.100003310
xor ecx, ecx
cmp eax, ecx
je 0x100001d9c
lea rax, [rsp + 0xde0]
mov qword [rsp + 0x98], rax
jmp 0x1000025c2
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towupper]
mov ecx, 0x41
cmp ax, cx
jne 0x100001d97
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + rbp*8]
add rcx, 4
je 0x100001d9c
lea rdx, [rsp + 0x9c0]
call fcn.100003310
xor ecx, ecx
cmp eax, ecx
je 0x100001d9c
mov eax, dword [rsp + 0x8c]
add r14d, ebx
add rbp, rbx
dec eax
cmp r14d, eax
jl 0x100001e19
mov sil, byte [rsp + 0x72]
lea rax, [0x1000069b0]
xor r14d, r14d
lea rdx, [rsp + 0x3a0]
mov rcx, rax
sub rdx, rax
mov edi, r14d
lea rax, [r13 + 0x7ffffcf2]
cmp rax, r14
je 0x10000261c
movzx eax, word [rcx + rdx]
cmp ax, r14w
je 0x10000261c
mov word [rcx], ax
add rcx, 2
sub r13, rbx
jne 0x1000025fa
cmp r13, r14
jne 0x10000262a
sub rcx, 2
mov edi, 0x8007007a
cmp edi, r14d
mov word [rcx], r14w
jge 0x100002678
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov edx, edi
mov rcx, rax
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
mov rcx, qword [0x100006180]
lea rax, [0x100006180]
cmp rcx, rax
je 0x100002678
test byte [rcx + 0x1c], bl
je 0x100002678
cmp byte [rcx + 0x19], 2
jb 0x100002678
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000013b8]
mov edx, 0x11
mov r9d, edi
call fcn.100001a74
cmp sil, r14b
jne 0x1000026ad
cmp r12d, r14d
je 0x1000026ad
cmp r12d, ebx
je 0x1000026ad
cmp r12d, 2
je 0x1000026ad
cmp r12d, 0x20
je 0x1000026ad
cmp r12d, 0x40
je 0x1000026ad
cmp r12d, 0x21
je 0x1000026ad
mov eax, 0x41
cmp r12d, eax
jne 0x100001d97
mov r13d, dword [rsp + 0x74]
cmp byte [rsp + 0x70], r14b
jne 0x1000026cd
cmp r13d, r14d
je 0x1000026cd
cmp r13d, ebx
je 0x1000026cd
cmp r13d, 2
jne 0x100001d97
test r15b, 4
je 0x100002705
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x3a0]
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
cmp rcx, rbx
jae 0x100002705
lea edx, [rax + 0x1b]
jmp 0x1000026f9
mov edx, 0x1e
mov ecx, ebx
call fcn.100002cd4
jmp 0x100001d9c
movsxd rsi, dword [rsp + 0x8c]
mov rbp, qword [rsp + 0x78]
mov rax, qword [rbp + rsi*8 - 8]
cmp word [rax], 0x2d
je 0x100002723
cmp word [rax], 0x2f
jne 0x100002735
cmp word [rax + 2], 0x3f
jne 0x100002735
cmp word [rax + 4], r14w
je 0x100001d97
test r15b, 0x20
je 0x100002746
cmp byte [rsp + 0x71], r14b
jne 0x100001d97
mov r8, rax
mov edx, 0x104
lea rcx, [0x1000071e0]
mov edi, r14d
lea rax, [rdx + 0x7ffffefa]
cmp rax, r14
je 0x10000277e
movzx eax, word [r8]
cmp ax, r14w
je 0x10000277e
mov word [rcx], ax
add r8, 2
add rcx, 2
sub rdx, rbx
jne 0x100002758
cmp rdx, r14
jne 0x10000278c
sub rcx, 2
mov edi, 0x8007007a
cmp edi, r14d
mov word [rcx], r14w
jge 0x1000027da
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov edx, edi
mov rcx, rax
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
mov rcx, qword [0x100006180]
lea rax, [0x100006180]
cmp rcx, rax
je 0x1000027da
test byte [rcx + 0x1c], bl
je 0x1000027da
cmp byte [rcx + 0x19], 2
jb 0x1000027da
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000013b8]
mov edx, 0x12
mov r9d, edi
call fcn.100001a74
mov rcx, qword [rbp + rsi*8 - 8]
lea rbp, [0x100006fd0]
mov r8d, 0x104
mov rdx, rbp
mov qword [0x100007440], rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r14d
jne 0x100002899
mov r8, qword [0x100007440]
mov edx, 0x105
mov rcx, rbp
sub r8, rbp
mov edi, r14d
lea rax, [rdx + 0x7ffffef9]
cmp rax, r14
je 0x10000283d
movzx eax, word [rcx + r8]
cmp ax, r14w
je 0x10000283d
mov word [rcx], ax
add rcx, 2
sub rdx, rbx
jne 0x10000281a
cmp rdx, r14
jne 0x10000284b
sub rcx, 2
mov edi, 0x8007007a
cmp edi, r14d
mov word [rcx], r14w
jge 0x100002899
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov edx, edi
mov rcx, rax
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
mov rcx, qword [0x100006180]
lea rax, [0x100006180]
cmp rcx, rax
je 0x100002899
test byte [rcx + 0x1c], bl
je 0x100002899
cmp byte [rcx + 0x19], 2
jb 0x100002899
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000013b8]
mov edx, 0x13
mov r9d, edi
call fcn.100001a74
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000028bb
mov r8, rbp
mov edx, 0x1d
mov ecx, ebx
call fcn.100002cd4
jmp 0x100001d9c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, r14d
jge 0x1000028e3
mov r8d, eax
mov edx, 0x26
mov ecx, ebx
call fcn.100002cd4
mov ebx, 3
jmp 0x100001d9c
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [rsp + 0x80]
lea r9, [0x100001398]
lea rcx, [0x100001388]
mov r8d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x80], r14
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp eax, r14d
je 0x100002a00
mov ecx, 0x208
call fcn.100003784
mov rdi, rax
cmp rax, r14
je 0x1000029ee
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, r14d
je 0x1000029e6
lea r8, [0x100001580]
mov edx, 0x104
mov rcx, rdi
call fcn.100001788
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
cmp rax, r14
je 0x1000029df
lea rdx, [0x1000015a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r14
je 0x1000029d6
call rax
lea r11, [rsp + 0x80]
lea r9, [0x100001398]
lea rcx, [0x100001388]
mov r8d, ebx
xor edx, edx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rbp, [0x100006fd0]
mov rcx, rdi
call sub.msvcrt.dll_free
cmp esi, r14d
je 0x100002a00
mov r8d, esi
mov edx, 0x25
jmp 0x1000028d2
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x3a0]
repne scasw ax, word [rdi]
not rcx
cmp rcx, rbx
mov rcx, qword [rsp + 0x80]
je 0x100002a5a
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
lea r9, [rsp + 0x190]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], r13d
lea r8, [0x1000069b0]
mov rdx, rbp
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r15d
call qword [rax + 0x28]
jmp 0x100002b26
cmp dword [rsp + 0x94], r14d
je 0x100002ad7
mov eax, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
lea r9, [rsp + 0x190]
mov word [rsp + 0x60], ax
mov eax, dword [rsp + 0x88]
mov r8, rbp
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x9c0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xbd0]
lea rdx, [0x1000067a0]
mov qword [rsp + 0x20], rax
call fcn.1000033dc
jmp 0x100002b26
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
lea r9, [rsp + 0xbd0]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x98]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x9c0]
lea r8, [rsp + 0x190]
mov qword [rsp + 0x20], rdx
mov rdx, rbp
call qword [rax + 0x18]
mov edi, eax
cmp eax, r14d
je 0x100002b41
mov r8d, dword [rsp + 0xac]
mov edx, 0x27
mov ecx, ebx
call fcn.100002cd4
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, r14d
jne 0x100002b6e
mov edx, 0x20
mov ecx, ebx
call fcn.100002cd4
mov ebx, r14d
jmp 0x100001d9c
call fcn.100001b5c
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xff0]
xor rcx, rsp
call fcn.100003bd0
mov rbx, qword [rsp + 0x1050]
add rsp, 0x1000
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret