Function at 0x18000eb80
Capabilities:
Check if file exists
Get common file path
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x618]
sub rsp, 0x700
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x180079370]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
cmp qword [rdx + 0x10], rbx
jne 0x18000ec33
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbx
cmp qword [rcx + 0x18], 8
jb 0x18000ebe6
mov rax, qword [rcx]
jmp 0x18000ebe9
mov rax, rsi
mov word [rax], bx
xor r8d, r8d
lea rdx, [0x180056c38]
call fcn.180009bb0
nop
mov r8, qword [r14 + 0x18]
cmp r8, 8
jb 0x18000ec14
inc r8
mov rdx, qword [r14]
mov rcx, r14
call fcn.180009d00
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rbx
cmp qword [r14 + 0x18], 8
jb 0x18000ec2a
mov r14, qword [r14]
mov word [r14], bx
jmp 0x18000fa88
mov r11, qword [rdx + 0x18]
cmp r11, 8
jb 0x18000ec42
mov rcx, qword [rdx]
jmp 0x18000ec45
mov rcx, r14
mov r10, qword [rdx + 0x10]
mov r8d, 3
cmp r10, r8
cmovb r8, r10
mov r9d, 1
or rdi, 0xffffffffffffffff
test r8, r8
je 0x18000ec93
lea rdx, [0x180059810]
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18000ec87
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18000ec70
jmp 0x18000ec93
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18000ec96
mov r8d, ebx
test r8d, r8d
jne 0x18000ed2d
cmp r10, 3
jne 0x18000ed2d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18003c5d0
xor r9d, r9d
lea r8d, [r9 + 0x26]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.1800103c0
lea rcx, [rbp - 0x40]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18000ecd4
mov eax, dword [0x180056ccc]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18000ecfe
mov rax, qword [rsi]
jmp 0x18000ed01
mov rax, rsi
mov word [rax], bx
cmp word [rbp - 0x40], 0
jne 0x18000ed10
mov rdi, rbx
jmp 0x18000ed1e
lea rax, [rbp - 0x40]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18000ed14
mov r8, rdi
lea rdx, [rbp - 0x40]
mov rcx, rsi
jmp 0x18000ebf6
cmp r11, 8
jb 0x18000ed38
mov rcx, qword [r14]
jmp 0x18000ed3b
mov rcx, r14
mov r8d, 3
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18000ed77
lea rdx, [0x180059818]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18000ed6b
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18000ed54
jmp 0x18000ed77
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18000ed7a
mov r8d, ebx
test r8d, r8d
jne 0x18000ee1e
cmp r10, 3
jne 0x18000ee1e
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18003c5d0
xor r9d, r9d
lea r8d, [r9 + 5]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.1800103c0
lea rcx, [rbp - 0x40]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18000edc0
mov eax, dword [0x180056ccc]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18000edea
mov rax, qword [rsi]
jmp 0x18000eded
mov rax, rsi
mov word [rax], bx
cmp word [rbp - 0x40], 0
je 0x18000ee0a
lea rax, [rbp - 0x40]
mov rbx, rdi
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18000ee00
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.180009bb0
jmp 0x18000fa80
cmp r11, 8
jb 0x18000ee29
mov rcx, qword [r14]
jmp 0x18000ee2c
mov rcx, r14
mov r8d, 7
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18000ee68
lea rdx, str.desktop
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18000ee5c
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18000ee45
jmp 0x18000ee68
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18000ee6b
mov r8d, ebx
test r8d, r8d
jne 0x18000ef05
cmp r10, 7
jne 0x18000ef05
xor r9d, r9d
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp + 0x3e0]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18000eea0
mov eax, dword [0x180056ccc]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18000eeca
mov rax, qword [rsi]
jmp 0x18000eecd
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18000eeee
lea rax, [rbp + 0x3e0]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18000eee4
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.180009bb0
jmp 0x18000fa80
cmp r11, 8
jb 0x18000ef10
mov rcx, qword [r14]
jmp 0x18000ef13
mov rcx, r14
mov r8d, 3
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18000ef53
lea rdx, [0x180059830]
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18000ef47
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18000ef30
jmp 0x18000ef53
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18000ef56
mov r8d, ebx
test r8d, r8d
jne 0x18000eff5
cmp r10, 3
jne 0x18000eff5
xor r9d, r9d
lea r8d, [r10 + 3]
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp + 0x3e0]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18000ef90
mov eax, dword [0x180056ccc]
mov dword [rcx], eax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18000efba
mov rax, qword [rsi]
jmp 0x18000efbd
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18000efde
lea rax, [rbp + 0x3e0]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18000efd4
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.180009bb0
jmp 0x18000fa80
cmp r11, 8
jb 0x18000f000
mov rcx, qword [r14]
jmp 0x18000f003
mov rcx, r14
mov r8d, 7
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18000f043
lea rdx, str.program
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18000f037
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18000f020
jmp 0x18000f043
mov r8d, r9d
cmp word [rcx], ax
cmovb r8d, edi
jmp 0x18000f046
mov r8d, ebx
test r8d, r8d
jne 0x18000f1ae
cmp r10, 7
jne 0x18000f1ae
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18003c5d0
xor r9d, r9d
lea r8d, [r9 + 0x26]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.1800103c0
lea rcx, [rbp - 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x18000f083
cmp eax, 3
jl 0x18000f161
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.18003c5d0
mov r8d, 3
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x3e0]
call fcn.1800424d0
lea rcx, [rbp + 0x3e0]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18000f0d0
movups xmm0, xmmword [str.Program_Files_]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x180059858]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x180059860]
mov dword [rcx + 0x18], eax
movzx eax, word [0x180059864]
mov word [rcx + 0x1c], ax
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18000f11d
mov rax, qword [rsi]
jmp 0x18000f120
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18000f14a
lea rax, [rbp + 0x3e0]
mov rbx, rdi
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18000f140
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.180009bb0
jmp 0x18000fa80
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18000f179
mov rax, qword [rsi]
jmp 0x18000f17c
mov rax, rsi
mov word [rax], bx
cmp word [rbp - 0x40], 0
je 0x18000f19a
lea rax, [rbp - 0x40]
mov rbx, rdi
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18000f190
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.180009bb0
jmp 0x18000fa80
cmp r11, 8
jb 0x18000f1b9
mov rcx, qword [r14]
jmp 0x18000f1bc
mov rcx, r14
mov r8d, 4
cmp r10, r8
cmovb r8, r10
test r8, r8
je 0x18000f1f2
lea rdx, str.curr
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18000f1ec
add rcx, 2
add rdx, 2
sub r8, r9
jne 0x18000f1d5
jmp 0x18000f1f2
cmovb r9d, edi
jmp 0x18000f1f5
mov r9d, ebx
test r9d, r9d
jne 0x18000f2a1
cmp r10, 4
jne 0x18000f2a1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.18003c5d0
mov r8d, 0x104
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rbp + 0x3e0]
call fcn.18003c770
mov word [rax + 2], bx
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18000f25e
mov rax, qword [rsi]
jmp 0x18000f261
mov rax, rsi
mov word [rax], bx
cmp word [rbp + 0x3e0], 0
je 0x18000f28a
lea rax, [rbp + 0x3e0]
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18000f280
mov r8, rbx
lea rdx, [rbp + 0x3e0]
mov rcx, rsi
call fcn.180009bb0
jmp 0x18000fa80
lea rdx, str.temp
mov rcx, r14
call fcn.18000e6e0
test al, al
je 0x18000f3a7
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18003c5d0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3e0]
call fcn.18003c5d0
call fcn.18000fc80
test al, al
je 0x18000f33c
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.1800103c0
test eax, eax
je 0x18000f396
lea rcx, [rbp - 0x40]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18000f310
movsd xmm0, qword [str.Temp_]
movsd qword [rcx], xmm0
mov eax, dword [0x180059890]
mov dword [rcx + 8], eax
movzx eax, word [0x180059894]
mov word [rcx + 0xc], ax
jmp 0x18000f396
lea rdx, [rbp + 0x3e0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea rax, [rbp - 0x40]
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18000f370
test rdi, rdi
jne 0x18000f396
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.18000c7c0
jmp 0x18000fa80
lea rdx, str.downloads
mov rcx, r14
call fcn.18000e6e0
test al, al
je 0x18000f4b2
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18003c5d0
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.1800103c0
lea rcx, [rbp - 0x40]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18000f3f0
test rax, rax
je 0x18000f44a
mov edx, 0x5c
lea rcx, [rbp - 0x40]
call fcn.18003c770
mov word [rax + 2], bx
lea rcx, [rbp - 0x40]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18000f420
movups xmm0, xmmword [0x1800598c0]
movups xmmword [rcx], xmm0
mov eax, dword [0x1800598d0]
mov dword [rcx + 0x10], eax
movzx eax, word [0x1800598d4]
mov word [rcx + 0x14], ax
jmp 0x18000f4a1
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rbp - 0x40]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18000f465
test rdi, rdi
je 0x18000f4a1
lea rax, [rbp - 0x40]
sub rax, 2
nop dword [rax]
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x18000f480
movups xmm0, xmmword [str.Downloads_]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x180059900]
movsd qword [rax + 0x10], xmm1
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.18000c7c0
jmp 0x18000fa80
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x58], bx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1d0]
call fcn.18003c5d0
mov r8d, 0x104
lea rdx, [rbp + 0x1d0]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x1d0]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18000f500
movups xmm0, xmmword [str.AppDataLocalLow_]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x180059918]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x180059928]
mov dword [rcx + 0x20], eax
movzx eax, word [0x18005992c]
mov word [rcx + 0x24], ax
cmp word [rbp + 0x1d0], 0
jne 0x18000f542
mov r8, rbx
jmp 0x18000f55b
lea rax, [rbp + 0x1d0]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18000f550
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x58]
call fcn.180009bb0
lea rdx, str.locallow
mov rcx, r14
call fcn.18000e6e0
test al, al
je 0x18000f69c
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.1800103c0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
cmp word [rbp + 0x1d0], 0
jne 0x18000f5c7
mov r8, rbx
jmp 0x18000f5dc
lea rax, [rbp + 0x1d0]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x18000f5d1
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x38]
call fcn.180009bb0
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
mov r8d, 8
lea rdx, str.LocalLow
lea rcx, [rbp - 0x68]
call fcn.180009bb0
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
mov r8d, 7
lea rdx, str.Roaming
lea rcx, [rsp + 0x78]
call fcn.180009bb0
nop
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.1800139b0
nop
lea rcx, [rsp + 0x78]
call fcn.1800064c0
nop
lea rcx, [rbp - 0x68]
call fcn.1800064c0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000f697
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.180009a70
nop
jmp 0x18000f9d5
lea rdx, str.roaming
mov rcx, r14
call fcn.18000e6e0
test al, al
jne 0x18000f892
lea rdx, str.Roaming
mov rcx, r14
call fcn.18000e6e0
test al, al
jne 0x18000f892
lea rdx, str.local
mov rcx, r14
call fcn.18000e6e0
test al, al
je 0x18000f816
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.1800103c0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000f73f
cmp word [rbp + 0x1d0], 0
jne 0x18000f726
mov rdi, rbx
jmp 0x18000f8ea
lea rax, [rbp + 0x1d0]
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18000f730
jmp 0x18000f8ea
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.180009a70
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
mov r8d, 5
lea rdx, str.Local
lea rcx, [rsp + 0x78]
call fcn.180009bb0
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
mov r8d, 8
lea rdx, str.LocalLow
lea rcx, [rbp - 0x68]
call fcn.180009bb0
nop
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x38]
call fcn.1800139b0
nop
lea rcx, [rbp - 0x68]
call fcn.1800064c0
nop
lea rcx, [rsp + 0x78]
call fcn.1800064c0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000f811
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.180009a70
nop
jmp 0x18000f9d5
lea rdx, str.system
mov rcx, r14
call fcn.18000e6e0
test al, al
je 0x18000f882
xor r9d, r9d
lea r8d, [r9 + 0x25]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.1800103c0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000f9df
cmp word [rbp + 0x1d0], 0
jne 0x18000f86f
mov rdi, rbx
jmp 0x18000f8ea
lea rax, [rbp + 0x1d0]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18000f876
jmp 0x18000f8ea
mov rdx, r14
mov rcx, rsi
call fcn.18000e730
jmp 0x18000fa75
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call fcn.1800103c0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000f903
cmp word [rbp + 0x1d0], 0
jne 0x18000f8d4
mov rdi, rbx
jmp 0x18000f8ea
lea rax, [rbp + 0x1d0]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18000f8e0
mov r8, rdi
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x58]
call fcn.180009bb0
jmp 0x18000f9df
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.180009a70
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
mov r8d, 7
lea rdx, str.Roaming
lea rcx, [rsp + 0x78]
call fcn.180009bb0
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
mov r8d, 8
lea rdx, str.LocalLow
lea rcx, [rbp - 0x68]
call fcn.180009bb0
nop
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x38]
call fcn.1800139b0
nop
lea rcx, [rbp - 0x68]
call fcn.1800064c0
nop
lea rcx, [rsp + 0x78]
call fcn.1800064c0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000f9d5
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.180009a70
nop
lea rcx, [rsp + 0x38]
call fcn.1800064c0
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000fa65
mov r9d, 8
xor r8d, r8d
lea rdx, str.system32
lea rcx, [rsp + 0x58]
call fcn.180009e20
cmp rax, 0xffffffffffffffff
jne 0x18000fa65
lea r9d, [rax + 0xe]
xor r8d, r8d
lea rdx, str.systemprofile
lea rcx, [rsp + 0x58]
call fcn.180009e20
cmp rax, 0xffffffffffffffff
jne 0x18000fa65
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
cmp qword [rsi + 0x18], 8
jb 0x18000fa50
mov rax, qword [rsi]
jmp 0x18000fa53
mov rax, rsi
mov word [rax], bx
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.180009510
jmp 0x18000fa75
lea rdx, [0x180056c38]
mov rcx, rsi
call fcn.18000c7c0
nop
lea rcx, [rsp + 0x58]
call fcn.1800064c0
nop
mov rcx, r14
call fcn.1800064c0
mov rax, rsi
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.18001b720
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret