Function at 0x180014230
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2648]
mov eax, 0x2748
call fcn.180041890
sub rsp, rax
movaps xmmword [rsp + 0x2730], xmm6
movaps xmmword [rsp + 0x2720], xmm7
mov rax, qword [0x180085040]
xor rax, rsp
mov qword [rbp + 0x2610], rax
mov r13, r9
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov r12, qword [rbp + 0x26b8]
mov qword [rbp - 0x60], r12
mov r15, qword [rbp + 0x26c0]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x610]
call fcn.1800634b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.18000c020
mov rdx, rax
mov rcx, r14
call fcn.1800091f0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18001433a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014335
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800155df
call fcn.180040cf8
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.18000b970
nop
cmp dword [0x180cb938c], 9
ja 0x180014422
lea r10, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova r10, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x20]
cmp rbx, 7
jb 0x180014422
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x1800771a0]
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x1800143ae
cmp word [rcx], 0x65
je 0x1800143ab
cmp rax, 1
je 0x1800143ae
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x180014398
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x180014422
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x1800771a0]
sub r9, rax
nop dword [rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x1800144cd
add rdx, 2
sub r8, 1
jne 0x1800143d0
sub rcx, r10
sar rcx, 1
jne 0x180014422
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.180062e10
mov qword [rbp - 0x20], rbx
mov rsi, qword [rsi + 8]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x180014703
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x180014440
mov rdx, qword [rdx]
lea rcx, [rbp - 0x30]
call fcn.180015ef0
cmp rax, 0xffffffffffffffff
jne 0x18001445a
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
jne 0x180014432
cmp rbx, rsi
je 0x180014703
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x1800144d6
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x18001447e
mov rdi, qword [rdi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 7
jbe 0x18001448f
mov r8, qword [rdx]
cmp rcx, rax
jne 0x1800144b8
test rcx, rcx
je 0x1800144b4
sub r8, rdi
nop dword [rax]
movzx eax, word [r8 + rdi]
cmp ax, word [rdi]
jne 0x1800144b8
add rdi, 2
sub rcx, 1
jne 0x1800144a0
lea rdx, [r9 - 0x20]
cmp r14, rdx
je 0x1800144f4
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x1800144ec
mov rdx, qword [rdx]
jmp 0x1800144ec
add rcx, 2
jmp 0x18001437b
cmp r14, rdi
je 0x1800144f4
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x1800144e9
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r14
call fcn.180009640
mov r9, r15
mov r8, r12
mov rdx, r14
call fcn.180015680
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x180015514
cmp ebx, 0xc015001d
je 0x180015514
test byte [rbp + 0x26b0], 2
je 0x1800146fc
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.1800634b0
mov edx, 0xff
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180014570
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x60]
call fcn.180009950
nop
mov r8d, 1
lea rdx, [0x18007719c]
lea rcx, [rsp + 0x60]
call fcn.1800169d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x1800145e3
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1800169d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.1800091f0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x18001465c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014656
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800155e5
call fcn.180040cf8
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x18001469e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014699
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800155eb
call fcn.180040cf8
movdqa xmm0, xmmword [0x180078510]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180015514
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800146f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800155f1
call fcn.180040cf8
jmp 0x180015514
xor ebx, ebx
jmp 0x180015514
mov esi, dword [rbp + 0x26b0]
test sil, 1
jne 0x18001550f
mov r9, r15
mov r8, r12
mov rdx, r14
call fcn.180015680
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x180015514
cmp ebx, 0xc015001d
je 0x180015514
test sil, 4
jne 0x18001550f
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x180014755
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x18001476b
mov ebx, r15d
jmp 0x180015517
mov qword [rbp], r15
lea r8, [rbp]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x180014875
mov ebx, r15d
test rdi, rdi
jne 0x180014875
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x410]
call fcn.1800634b0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.1800634b0
mov dword [rbp - 0x10], 0xff
mov dword [rbp - 8], r15d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x410]
mov edx, ebx
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0x10]
call fcn.18004cf8c
test eax, eax
jne 0x180014867
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x210]
call fcn.1800634b0
mov dword [rbp - 0x10], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x210]
test sil, 8
je 0x180014858
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x18001485e
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x1800148e7
inc ebx
cmp ebx, 0x1000
jl 0x180014795
mov rdi, qword [r13 + 0x10]
test rdi, rdi
je 0x180014be0
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rdi
cmp rax, 1
jb 0x1800155f7
cmp qword [r13 + 0x18], 7
jbe 0x1800148a7
mov r13, qword [r13]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r12, [rdi + 1]
mov ebx, 7
lea r15, [rsp + 0x40]
cmp r12, rbx
jbe 0x180014ad5
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x180014aab
mov rbx, rcx
jmp 0x180014ab7
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x210]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180014910
lea rdx, [rbp + 0x210]
lea rcx, [rsp + 0x60]
call fcn.180009950
nop
mov r8d, 1
lea rdx, [0x18007719c]
lea rcx, [rsp + 0x60]
call fcn.1800169d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rax, [rbp + 0x10]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180014980
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1800169d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.1800091f0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x180014a07
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014a01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800155fd
call fcn.180040cf8
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180014a49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014a44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015603
call fcn.180040cf8
movdqa xmm0, xmmword [0x180078510]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r15w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18001550a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014a9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015609
call fcn.180040cf8
mov ebx, r15d
jmp 0x1800154d6
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
mov qword [rbp - 8], rax
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x40]
call fcn.18000a530
mov r15, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, r13
mov rcx, r15
call fcn.180062e10
mov word [r15 + rbx], 0x5c
xor eax, eax
mov word [r15 + r12*2], ax
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800169d0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x180014b75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014b70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001560f
call fcn.180040cf8
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180014bbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014bba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015615
call fcn.180040cf8
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800154e7
mov r12, qword [rbp - 0x60]
mov r8d, dword [r12 + 8]
lea rdx, [rbp - 0x80]
call fcn.180015c20
nop
mov r8d, 1
lea rdx, [0x18007719c]
mov rcx, rax
call fcn.1800169d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800169d0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x180014ca9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014ca4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001561b
call fcn.180040cf8
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180014cf3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014cee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015621
call fcn.180040cf8
movdqa xmm0, xmmword [0x180078510]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r15w
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x180014d47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014d42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015627
call fcn.180040cf8
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800154e7
mov edx, 0x1000
lea rcx, [rbp + 0x610]
test sil, 8
je 0x180014d7e
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x180014d84
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180014db0
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.180009950
nop
mov r8d, 1
lea rdx, [0x18007719c]
lea rcx, [rsp + 0x60]
call fcn.1800169d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800169d0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x180014e89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014e84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001562d
call fcn.180040cf8
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180014ed3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014ece
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015633
call fcn.180040cf8
movdqa xmm0, xmmword [0x180078510]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r15w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180014f29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014f24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015639
call fcn.180040cf8
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800154e7
mov edx, 0x1000
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x180014f73
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.180009950
nop
mov r8d, 1
lea rdx, [0x18007719c]
lea rcx, [rsp + 0x60]
call fcn.1800169d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800169d0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x18001504c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015047
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001563f
call fcn.180040cf8
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180015096
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015091
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015645
call fcn.180040cf8
movdqa xmm0, xmmword [0x180078510]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r15w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800150ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800150e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001564b
call fcn.180040cf8
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800154e7
lea rdx, [rbp + 0x610]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180015140
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.180009950
nop
mov r8d, 1
lea rdx, [0x18007719c]
lea rcx, [rsp + 0x60]
call fcn.1800169d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800169d0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x180015219
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015214
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015651
call fcn.180040cf8
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180015263
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001525e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015657
call fcn.180040cf8
movdqa xmm0, xmmword [0x180078510]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r15w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800152b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800152b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001565d
call fcn.180040cf8
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800154e7
mov r8d, 0x1000
lea rdx, [rbp + 0x610]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x58]
lea rdx, [0x180077234]
lea rcx, [rbp + 0x610]
call fcn.18004df14
test rax, rax
je 0x1800154d1
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x180015325
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180009950
nop
mov r8d, 1
lea rdx, [0x18007719c]
lea rcx, [rsp + 0x60]
call fcn.1800169d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800169d0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x1800153fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800153f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015663
call fcn.180040cf8
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180015445
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015440
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015669
call fcn.180040cf8
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18001549b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015496
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001566f
call fcn.180040cf8
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800154e7
lea r8, [rbp - 0x58]
lea rdx, [0x180077234]
mov rcx, qword [rbp - 0x58]
call fcn.18004df14
test rax, rax
jne 0x180015310
mov ebx, 0xc0000225
mov rcx, qword [rbp]
test rcx, rcx
jle 0x180015517
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180015517
lea rax, [rbp - 0x50]
cmp r14, rax
je 0x18001550a
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
mov r8, qword [rbp - 0x40]
cmova rdx, qword [rbp - 0x50]
mov rcx, r14
call fcn.180009640
mov ebx, r15d
jmp 0x1800154d6
mov ebx, 0xc0000225
xor r15d, r15d
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x180015557
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015552
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015675
call fcn.180040cf8
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x1800155a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001559f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800155d9
call fcn.180040cf8
mov eax, ebx
mov rcx, qword [rbp + 0x2610]
xor rcx, rsp
call fcn.1800410a0
movaps xmm6, xmmword [rsp + 0x2730]
movaps xmm7, xmmword [rsp + 0x2720]
add rsp, 0x2748
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.180001780
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
nop
call fcn.18004ce30
int3