Function at 0x14004c600
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a18]
mov eax, 0x2b18
call fcn.1400b6430
sub rsp, rax
movaps xmmword [rsp + 0x2b00], xmm6
movaps xmmword [rsp + 0x2af0], xmm7
mov rax, qword [0x140132100]
xor rax, rsp
mov qword [rbp + 0x29e0], rax
mov r12, r9
mov qword [rsp + 0x70], r9
mov rdi, r8
mov r14, rdx
mov r13, rcx
mov rax, qword [rbp + 0x2a88]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x2a90]
mov qword [rsp + 0x40], rax
xor r15d, r15d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x9e0]
call fcn.1400e5c20
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x198], 7
mov word [rbp + 0x180], r15w
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 7
mov word [r14], r15w
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x138]
call fcn.140048930
mov rdx, rax
mov rcx, r14
call fcn.140041440
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x14004c72c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c727
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc31
call fcn.1400b5bec
mov r8, qword [r14 + 0x10]
mov rsi, 0xffffffffffffffff
test r8, r8
je 0x14004c812
mov rdx, r14
mov r9, qword [r14 + 0x18]
cmp r9, 7
jbe 0x14004c750
mov rdx, qword [r14]
lea rcx, [r8 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x14004c777
cmp rcx, rdx
je 0x14004c782
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x14004c768
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
jne 0x14004c7c0
mov rdx, r14
cmp r9, 7
jbe 0x14004c78e
mov rdx, qword [r14]
lea rcx, [r8 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2f
je 0x14004c7b5
cmp rcx, rdx
je 0x14004c812
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x14004c7a6
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
je 0x14004c812
inc rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], r15
mov rax, r8
cmp r8, rcx
jb 0x14004dc37
sub rax, rcx
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
mov rax, r14
cmp r9, 7
jbe 0x14004c800
mov rax, qword [r14]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x1a0]
call fcn.1400015f0
jmp 0x14004c822
mov rdx, r14
lea rcx, [rbp + 0x1a0]
call fcn.140031b00
nop
cmp dword [0x14017fd4c], 9
ja 0x14004c91e
lea r10, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova r10, qword [rbp + 0x1a0]
mov rbx, qword [rbp + 0x1b0]
cmp rbx, 7
jb 0x14004c91e
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, str.ext_ms_
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, r15
je 0x14004c896
cmp word [rcx], 0x65
je 0x14004c893
nop dword [rax]
cmp rax, 1
je 0x14004c896
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x14004c880
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14004c91e
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, str.ext_ms_
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x14004c9b4
add rdx, 2
sub r8, 1
jne 0x14004c8c0
sub rcx, r10
sar rcx, 1
jne 0x14004c91e
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rcx, qword [rbp + 0x1a0]
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call fcn.1400e5fe0
mov qword [rbp + 0x1b0], rbx
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x14004cc0c
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14004c93e
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1a0]
call fcn.14004e4e0
cmp rax, 0xffffffffffffffff
jne 0x14004c95b
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r15
jne 0x14004c930
cmp rbx, r15
je 0x14004cc0c
mov rdx, qword [rbx + 0x30]
cmp rdx, qword [rbx + 0x38]
je 0x14004c9d6
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14004c97c
mov rdi, qword [rdi]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14004c98a
mov rdx, qword [rdx]
cmp rcx, rax
jne 0x14004c9bd
test rcx, rcx
je 0x14004c9aa
sub rdx, rdi
movzx eax, word [rdi + rdx]
cmp ax, word [rdi]
jne 0x14004c9bd
add rdi, 2
sub rcx, 1
jne 0x14004c997
mov rdx, qword [rbx + 0x38]
sub rdx, 0x20
jmp 0x14004c9c1
add rcx, 2
jmp 0x14004c862
mov rdx, qword [rbx + 0x30]
cmp r14, rdx
je 0x14004c9f4
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14004c9ec
mov rdx, qword [rdx]
jmp 0x14004c9ec
cmp r14, rdi
je 0x14004c9f4
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14004c9e9
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r14
call fcn.140041570
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, r14
call fcn.14004dce0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004db51
cmp ebx, 0xc015001d
je 0x14004db51
test byte [rbp + 0x2a80], 2
je 0x14004cc05
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x5e0]
call fcn.1400e5c20
mov edx, 0xff
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
lea rax, [rbp + 0x5e0]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14004ca72
mov r8, rsi
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x98]
call fcn.1400015f0
nop
mov r8d, 1
lea rdx, [0x14011a5cc]
lea rcx, [rbp + 0x98]
call fcn.140031a70
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x14004cae8
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp - 0x48]
call fcn.140031a70
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.140041440
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004cb65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cb5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc3d
call fcn.1400b5bec
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x14004cba5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cba0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc43
call fcn.1400b5bec
movdqa xmm0, xmmword [0x14011ba60]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], bx
mov rdx, qword [rbp + 0xb0]
cmp rdx, 7
jbe 0x14004db51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cbfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc49
call fcn.1400b5bec
jmp 0x14004db51
xor ebx, ebx
jmp 0x14004db51
mov r15d, dword [rbp + 0x2a80]
test r15b, 1
jne 0x14004db4c
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, r14
call fcn.14004dce0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004db51
cmp ebx, 0xc015001d
je 0x14004db51
test r15b, 4
jne 0x14004db4c
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x14004cc63
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r13d, r13d
cmp eax, 0xffffffff
je 0x14004cc79
mov ebx, r13d
jmp 0x14004db54
mov qword [rbp + 0x1d0], r13
lea r8, [rbp + 0x1d0]
lea rdx, [0x14011a5d0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x14004cdb7
mov ebx, r13d
nop dword [rax]
test rdi, rdi
jne 0x14004cdb7
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x7e0]
call fcn.1400e5c20
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x3e0]
call fcn.1400e5c20
mov dword [rbp + 0x1c0], 0xff
mov dword [rbp + 0x1c8], r13d
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1c0]
lea r8, [rbp + 0x7e0]
mov edx, ebx
mov rcx, qword [rbp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x3e0]
call fcn.1400cc3b8
test eax, eax
jne 0x14004cda9
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x1e0]
call fcn.1400e5c20
mov dword [rbp + 0x1c0], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x1e0]
test r15b, 8
je 0x14004cd9a
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004cda0
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x14004d13c
inc ebx
cmp ebx, 0x1000
jl 0x14004ccb0
mov rdi, qword [r12 + 0x10]
test rdi, rdi
je 0x14004cf72
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
sub rax, rdi
cmp rax, 1
jb 0x14004dc4f
cmp qword [r12 + 0x18], 7
jbe 0x14004cdf0
mov r12, qword [r12]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea r13, [rdi + 1]
mov eax, 7
lea r12, [rbp - 0x68]
cmp r13, rax
jbe 0x14004ce4d
mov rax, r13
or rax, 7
cmp rax, rbx
ja 0x14004ce2c
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
inc rbx
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.1400016c0
mov r12, rax
lea rax, [rbx - 1]
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], rax
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, qword [rsp + 0x70]
mov rcx, r12
call fcn.1400e5fe0
mov word [r12 + rbx], 0x5c
xor ebx, ebx
mov word [r12 + r13*2], bx
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp - 0x68]
call fcn.140031a70
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r13d, r13d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004cefe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cef9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc67
call fcn.1400b5bec
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x14004cf4c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cf47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc6d
call fcn.1400b5bec
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004db15
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax + 8]
lea rdx, [rbp + 0x158]
call fcn.14004e280
nop
mov r8d, 1
lea rdx, [0x14011a5cc]
mov rcx, rax
call fcn.140031a70
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp - 8]
call fcn.140031a70
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004d04f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d04a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc73
call fcn.1400b5bec
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14004d09d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d098
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc79
call fcn.1400b5bec
movdqa xmm0, xmmword [0x14011ba60]
movdqu xmmword [rbp + 8], xmm0
mov word [rbp - 8], r13w
mov rdx, qword [rbp + 0x170]
cmp rdx, 7
jbe 0x14004d0f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d0f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc7f
call fcn.1400b5bec
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004db15
mov edx, 0x1000
lea rcx, [rbp + 0x9e0]
test r15b, 8
je 0x14004d302
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004d308
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
lea rax, [rbp + 0x1e0]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004d160
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0xb8]
call fcn.1400015f0
nop
mov r8d, 1
lea rdx, [0x14011a5cc]
lea rcx, [rbp + 0xb8]
call fcn.140031a70
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r13
mov word [rax], r13w
lea rax, [rbp + 0x3e0]
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14004d1d0
mov r8, rsi
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp - 0x28]
call fcn.140031a70
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.140041440
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004d25e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d258
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc55
call fcn.1400b5bec
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14004d29e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d299
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc5b
call fcn.1400b5bec
movdqa xmm0, xmmword [0x14011ba60]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r13w
mov rdx, qword [rbp + 0xd0]
cmp rdx, 7
jbe 0x14004db47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d2f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc61
call fcn.1400b5bec
mov ebx, r13d
jmp 0x14004db01
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004d330
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xd8]
call fcn.1400015f0
nop
mov r8d, 1
lea rdx, [0x14011a5cc]
lea rcx, [rbp + 0xd8]
call fcn.140031a70
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x18]
call fcn.140031a70
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004d41a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d415
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc85
call fcn.1400b5bec
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x14004d468
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d463
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc8b
call fcn.1400b5bec
movdqa xmm0, xmmword [0x14011ba60]
movdqu xmmword [rbp + 0x28], xmm0
mov word [rbp + 0x18], r13w
mov rdx, qword [rbp + 0xf0]
cmp rdx, 7
jbe 0x14004d4c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d4bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc91
call fcn.1400b5bec
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004db15
mov edx, 0x1000
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x108], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004d520
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xf8]
call fcn.1400015f0
nop
mov r8d, 1
lea rdx, [0x14011a5cc]
lea rcx, [rbp + 0xf8]
call fcn.140031a70
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x38]
call fcn.140031a70
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004d60a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d605
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc97
call fcn.1400b5bec
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14004d658
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d653
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc9d
call fcn.1400b5bec
movdqa xmm0, xmmword [0x14011ba60]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r13w
mov rdx, qword [rbp + 0x110]
cmp rdx, 7
jbe 0x14004d6b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d6ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dca3
call fcn.1400b5bec
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004db15
lea rdx, [rbp + 0x9e0]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x128], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004d710
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x118]
call fcn.1400015f0
nop
mov r8d, 1
lea rdx, [0x14011a5cc]
lea rcx, [rbp + 0x118]
call fcn.140031a70
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x58]
call fcn.140031a70
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004d7fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d7f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dca9
call fcn.1400b5bec
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x14004d848
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d843
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dcaf
call fcn.1400b5bec
movdqa xmm0, xmmword [0x14011ba60]
movdqu xmmword [rbp + 0x68], xmm0
mov word [rbp + 0x58], r13w
mov rdx, qword [rbp + 0x130]
cmp rdx, 7
jbe 0x14004d8a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d89b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dcb5
call fcn.1400b5bec
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004db15
mov r8d, 0x1000
lea rdx, [rbp + 0x9e0]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp + 0x178]
lea rdx, [0x14011a658]
lea rcx, [rbp + 0x9e0]
call fcn.1400cc6d4
test rax, rax
je 0x14004dafc
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r13
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004d930
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.1400015f0
nop
mov r8d, 1
lea rdx, [0x14011a5cc]
lea rcx, [rbp + 0x78]
call fcn.140031a70
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rsp + 0x78]
call fcn.140031a70
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004da13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004da0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dcbb
call fcn.1400b5bec
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x14004da62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004da5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dcc1
call fcn.1400b5bec
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rbp + 0x90]
cmp rdx, 7
jbe 0x14004dab7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dab2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dcc7
call fcn.1400b5bec
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004db15
lea r8, [rbp + 0x178]
lea rdx, [0x14011a658]
mov rcx, qword [rbp + 0x178]
call fcn.1400cc6d4
test rax, rax
jne 0x14004d910
mov ebx, 0xc0000225
mov rcx, qword [rbp + 0x1d0]
test rcx, rcx
jle 0x14004db54
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004db54
lea rax, [rbp + 0x180]
cmp r14, rax
je 0x14004db47
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
mov r8, qword [rbp + 0x190]
cmova rdx, qword [rbp + 0x180]
mov rcx, r14
call fcn.140041570
mov ebx, r13d
jmp 0x14004db01
mov ebx, 0xc0000225
xor r13d, r13d
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 7
jbe 0x14004db9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004db95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dccd
call fcn.1400b5bec
mov qword [rbp + 0x1b0], r13
mov qword [rbp + 0x1b8], 7
mov word [rbp + 0x1a0], r13w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14004dbf6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dbf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dc2b
call fcn.1400b5bec
mov eax, ebx
mov rcx, qword [rbp + 0x29e0]
xor rcx, rsp
call fcn.1400b5950
movaps xmm6, xmmword [rsp + 0x2b00]
movaps xmm7, xmmword [rsp + 0x2af0]
add rsp, 0x2b18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400465f0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400015c0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
nop
call fcn.1400bcca0
int3