Function at 0x140041220
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov r14, rcx
mov qword [rcx], 0x10000
xor r12d, r12d
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
mov qword [rcx + 0x20], r12
mov qword [rcx + 0x28], r12
mov qword [rcx + 0x30], r12
mov qword [rcx + 0x38], r12
mov qword [rcx + 0x40], r12
lea ecx, [r12 + 0x48]
call fcn.140071a78
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [r14 + 0x38], rax
mov rax, qword [r14 + 0x10]
cmp rax, qword [r14 + 0x18]
je 0x1400412c4
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea r8d, [r12 + 1]
lea rdx, [0x1400d65c4]
mov rcx, rax
call fcn.140037b30
add qword [r14 + 0x10], 0x20
jmp 0x1400412d7
lea r8, [0x1400d65c4]
mov rdx, rax
lea rcx, [r14 + 8]
call fcn.140043070
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r12w
mov r8d, 0xf
lea rdx, [0x1400d65c8]
lea rcx, [rbp - 9]
call fcn.140037b30
nop
cmp qword [rbp + 7], 0
je 0x1400413d2
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
mov edx, 0x108
lea rcx, [rbp - 0x49]
call fcn.140037c60
mov r8, rax
mov qword [rbp - 0x39], 0x104
mov qword [rbp - 0x31], 0x107
movzx eax, r12w
mov rdi, r8
mov ecx, 0x104
rep stosw word [rdi], ax
mov word [r8 + 0x208], r12w
mov qword [rbp - 0x49], r8
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rdx, r8
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
mov r8d, dword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rax, qword [rbp - 0x39]
cmp rdx, rax
ja 0x1400413a0
lea rax, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rdx
mov word [rax + rdx*2], r12w
jmp 0x1400413af
xor r8d, r8d
sub rdx, rax
lea rcx, [rbp - 0x49]
call fcn.1400401e0
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rbp - 0x39]
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
jmp 0x1400413fe
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], r12w
xor r8d, r8d
lea rdx, [0x1400d56dc]
lea rcx, [rbp - 0x29]
call fcn.140037b30
movups xmm1, xmmword [rbp - 0x19]
movups xmm0, xmmword [rbp - 0x29]
mov rdx, qword [r14 + 0x10]
cmp rdx, qword [r14 + 0x18]
je 0x140041416
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [r14 + 0x10], 0x20
jmp 0x140041463
lea r8, [rbp - 0x29]
lea rcx, [r14 + 8]
call fcn.14003c020
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x140041463
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004145e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004235f
call fcn.140071ab4
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x1400414a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004149e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004235f
call fcn.140071ab4
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r12w
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.USERPROFILE
lea rcx, [rbp - 9]
call fcn.140037b30
nop
cmp qword [rbp + 7], 0
je 0x14004159e
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
mov edx, 0x108
lea rcx, [rbp - 0x49]
call fcn.140037c60
mov r8, rax
mov qword [rbp - 0x39], 0x104
mov qword [rbp - 0x31], 0x107
movzx eax, r12w
mov rdi, r8
mov ecx, 0x104
rep stosw word [rdi], ax
mov word [r8 + 0x208], r12w
mov qword [rbp - 0x49], r8
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rdx, r8
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
mov r8d, dword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rax, qword [rbp - 0x39]
cmp rdx, rax
ja 0x14004156c
lea rax, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rdx
mov word [rax + rdx*2], r12w
jmp 0x14004157b
xor r8d, r8d
sub rdx, rax
lea rcx, [rbp - 0x49]
call fcn.1400401e0
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rbp - 0x39]
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
jmp 0x1400415c3
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], r12w
xor r8d, r8d
lea rdx, [0x1400d56dc]
lea rcx, [rbp - 0x29]
call fcn.140037b30
nop
mov r8d, 8
lea rdx, str.AppData
lea rcx, [rbp - 0x29]
call fcn.140038d10
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [r14 + 0x10]
cmp rdx, qword [r14 + 0x18]
je 0x140041610
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [r14 + 0x10], 0x20
jmp 0x14004165d
lea r8, [rbp + 0x17]
lea rcx, [r14 + 8]
call fcn.14003c020
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x14004165d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041658
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042365
call fcn.140071ab4
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x14004169d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041698
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042365
call fcn.140071ab4
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], r12w
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x1400416ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400416e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042365
call fcn.140071ab4
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r12w
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.ProgramData
lea rcx, [rbp - 9]
call fcn.140037b30
nop
cmp qword [rbp + 7], 0
je 0x1400417e9
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
mov edx, 0x108
lea rcx, [rbp - 0x49]
call fcn.140037c60
mov r8, rax
mov qword [rbp - 0x39], 0x104
mov qword [rbp - 0x31], 0x107
movzx eax, r12w
mov rdi, r8
mov ecx, 0x104
rep stosw word [rdi], ax
mov word [r8 + 0x208], r12w
mov qword [rbp - 0x49], r8
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rdx, r8
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
mov r8d, dword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rax, qword [rbp - 0x39]
cmp rdx, rax
ja 0x1400417b7
lea rax, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rdx
mov word [rax + rdx*2], r12w
jmp 0x1400417c6
xor r8d, r8d
sub rdx, rax
lea rcx, [rbp - 0x49]
call fcn.1400401e0
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rbp - 0x39]
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
jmp 0x140041815
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], r12w
xor r8d, r8d
lea rdx, [0x1400d56dc]
lea rcx, [rbp - 0x29]
call fcn.140037b30
movups xmm1, xmmword [rbp - 0x19]
movups xmm0, xmmword [rbp - 0x29]
mov rdx, qword [r14 + 0x10]
cmp rdx, qword [r14 + 0x18]
je 0x14004182d
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [r14 + 0x10], 0x20
jmp 0x14004187a
lea r8, [rbp - 0x29]
lea rcx, [r14 + 8]
call fcn.14003c020
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x14004187a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041875
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004236b
call fcn.140071ab4
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x1400418ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400418b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004236b
call fcn.140071ab4
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r12w
mov r8d, 6
lea rdx, str.WINDIR
lea rcx, [rbp - 9]
call fcn.140037b30
nop
cmp qword [rbp + 7], 0
je 0x1400419b5
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
mov edx, 0x108
lea rcx, [rbp - 0x49]
call fcn.140037c60
mov r8, rax
mov qword [rbp - 0x39], 0x104
mov qword [rbp - 0x31], 0x107
movzx eax, r12w
mov rdi, r8
mov ecx, 0x104
rep stosw word [rdi], ax
mov word [r8 + 0x208], r12w
mov qword [rbp - 0x49], r8
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rdx, r8
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
mov r8d, dword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rax, qword [rbp - 0x39]
cmp rdx, rax
ja 0x140041983
lea rax, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rdx
mov word [rax + rdx*2], r12w
jmp 0x140041992
xor r8d, r8d
sub rdx, rax
lea rcx, [rbp - 0x49]
call fcn.1400401e0
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rbp - 0x39]
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
jmp 0x1400419e1
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], r12w
xor r8d, r8d
lea rdx, [0x1400d56dc]
lea rcx, [rbp - 0x29]
call fcn.140037b30
movups xmm1, xmmword [rbp - 0x19]
movups xmm0, xmmword [rbp - 0x29]
mov rdx, qword [r14 + 0x10]
cmp rdx, qword [r14 + 0x18]
je 0x1400419f9
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [r14 + 0x10], 0x20
jmp 0x140041a46
lea r8, [rbp - 0x29]
lea rcx, [r14 + 8]
call fcn.14003c020
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x140041a46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041a41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042371
call fcn.140071ab4
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x140041a86
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041a81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042371
call fcn.140071ab4
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r12w
mov r8d, 0x11
lea rdx, str.PROGRAMFILES_x86_
lea rcx, [rbp - 9]
call fcn.140037b30
nop
cmp qword [rbp + 7], 0
je 0x140041b81
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
mov edx, 0x108
lea rcx, [rbp - 0x49]
call fcn.140037c60
mov r8, rax
mov qword [rbp - 0x39], 0x104
mov qword [rbp - 0x31], 0x107
movzx eax, r12w
mov rdi, r8
mov ecx, 0x104
rep stosw word [rdi], ax
mov word [r8 + 0x208], r12w
mov qword [rbp - 0x49], r8
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rdx, r8
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
mov r8d, dword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rax, qword [rbp - 0x39]
cmp rdx, rax
ja 0x140041b4f
lea rax, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rdx
mov word [rax + rdx*2], r12w
jmp 0x140041b5e
xor r8d, r8d
sub rdx, rax
lea rcx, [rbp - 0x49]
call fcn.1400401e0
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rbp - 0x39]
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
jmp 0x140041bad
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], r12w
xor r8d, r8d
lea rdx, [0x1400d56dc]
lea rcx, [rbp - 0x29]
call fcn.140037b30
movups xmm1, xmmword [rbp - 0x19]
movups xmm0, xmmword [rbp - 0x29]
mov rdx, qword [r14 + 0x10]
cmp rdx, qword [r14 + 0x18]
je 0x140041bc5
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [r14 + 0x10], 0x20
jmp 0x140041c12
lea r8, [rbp - 0x29]
lea rcx, [r14 + 8]
call fcn.14003c020
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x140041c12
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041c0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042377
call fcn.140071ab4
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x140041c52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041c4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042377
call fcn.140071ab4
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r12w
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.SYSTEMDRIVE
lea rcx, [rbp - 9]
call fcn.140037b30
nop
cmp qword [rbp + 7], 0
je 0x140041d12
xor r8d, r8d
mov edx, 0x104
lea rcx, [rbp - 0x49]
call fcn.140042f80
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rdx, qword [rbp - 0x49]
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
mov r8d, dword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rax, qword [rbp - 0x39]
cmp rdx, rax
ja 0x140041ce0
lea rax, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rdx
mov word [rax + rdx*2], r12w
jmp 0x140041cef
xor r8d, r8d
sub rdx, rax
lea rcx, [rbp - 0x49]
call fcn.1400401e0
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rbp - 0x39]
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], r12w
jmp 0x140041d37
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], r12w
xor r8d, r8d
lea rdx, [0x1400d56dc]
lea rcx, [rbp - 0x29]
call fcn.140037b30
nop
mov r8d, 0xe
lea rdx, str.Program_Files
lea rcx, [rbp - 0x29]
call fcn.140038d10
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [r14 + 0x10]
cmp rdx, qword [r14 + 0x18]
je 0x140041d84
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [r14 + 0x10], 0x20
jmp 0x140041dd1
lea r8, [rbp + 0x17]
lea rcx, [r14 + 8]
call fcn.14003c020
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x140041dd1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041dcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004237d
call fcn.140071ab4
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x140041e11
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041e0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004237d
call fcn.140071ab4
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], r12w
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x140041e62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041e5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004237d
call fcn.140071ab4
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r12w
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.SYSTEMDRIVE
lea rcx, [rbp - 9]
call fcn.140037b30
lea r8, [rbp - 9]
lea rdx, [rbp - 0x29]
call fcn.140042960
mov r8d, 8
lea rdx, str.AppData
mov rcx, rax
call fcn.140038d10
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [r14 + 0x10]
cmp rdx, qword [r14 + 0x18]
je 0x140041ee2
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [r14 + 0x10], 0x20
jmp 0x140041f2f
lea r8, [rbp + 0x17]
lea rcx, [r14 + 8]
call fcn.14003c020
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x140041f2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041f2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042359
call fcn.140071ab4
lea rcx, [rbp - 0x29]
call fcn.140037a60
mov r8, qword [rbp + 0xf]
cmp r8, 8
jb 0x140041f52
inc r8
mov rdx, qword [rbp - 9]
lea rcx, [rbp - 9]
call fcn.140037cd0
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r12w
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.SYSTEMDRIVE
lea rcx, [rbp - 9]
call fcn.140037b30
lea r8, [rbp - 9]
lea rdx, [rbp - 0x29]
call fcn.140042960
mov r8d, 0x11
lea rdx, str.Application_Data
mov rcx, rax
call fcn.140038d10
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0x17]
lea rcx, [r14 + 8]
call fcn.14003b310
lea rcx, [rbp + 0x17]
call fcn.140037a60
lea rcx, [rbp - 0x29]
call fcn.140037a60
lea rcx, [rbp - 9]
call fcn.140037a60
lea rdx, str.SYSTEMDRIVE
lea rcx, [rbp + 0x17]
call fcn.140037ad0
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x29]
call fcn.140042960
mov rdx, rax
lea r8, str.intel
lea rcx, [rbp - 9]
call fcn.140043290
mov rdx, rax
lea rcx, [r14 + 8]
call fcn.14003b310
lea rcx, [rbp - 9]
call fcn.140037a60
lea rcx, [rbp - 0x29]
call fcn.140037a60
lea rcx, [rbp + 0x17]
call fcn.140037a60
lea rdx, str.SYSTEMDRIVE
lea rcx, [rbp + 0x17]
call fcn.140037ad0
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x29]
call fcn.140042960
mov rdx, rax
lea r8, str._nvidia
lea rcx, [rbp - 9]
call fcn.140043290
mov rdx, rax
lea rcx, [r14 + 8]
call fcn.14003b310
lea rcx, [rbp - 9]
call fcn.140037a60
lea rcx, [rbp - 0x29]
call fcn.140037a60
lea rcx, [rbp + 0x17]
call fcn.140037a60
lea rdx, str.SYSTEMDRIVE
lea rcx, [rbp + 0x17]
call fcn.140037ad0
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x29]
call fcn.140042960
mov rdx, rax
lea r8, str.UsersAll_Users
lea rcx, [rbp - 9]
call fcn.140043290
mov rdx, rax
lea rcx, [r14 + 8]
call fcn.14003b310
lea rcx, [rbp - 9]
call fcn.140037a60
lea rcx, [rbp - 0x29]
call fcn.140037a60
lea rcx, [rbp + 0x17]
call fcn.140037a60
lea rdx, str.SYSTEMDRIVE
lea rcx, [rbp + 0x17]
call fcn.140037ad0
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x29]
call fcn.140042960
mov rdx, rax
lea r8, str.Program_FilesMicrosoftExchange_Server
lea rcx, [rbp - 9]
call fcn.140043290
mov rdx, rax
lea rcx, [r14 + 0x20]
call fcn.14003b310
lea rcx, [rbp - 9]
call fcn.140037a60
lea rcx, [rbp - 0x29]
call fcn.140037a60
lea rcx, [rbp + 0x17]
call fcn.140037a60
lea rdx, str.SYSTEMDRIVE
lea rcx, [rbp + 0x17]
call fcn.140037ad0
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x29]
call fcn.140042960
mov rdx, rax
lea r8, str.Program_Files__x86_MicrosoftExchange_Server
lea rcx, [rbp - 9]
call fcn.140043290
mov rdx, rax
lea rcx, [r14 + 0x20]
call fcn.14003b310
lea rcx, [rbp - 9]
call fcn.140037a60
lea rcx, [rbp - 0x29]
call fcn.140037a60
lea rcx, [rbp + 0x17]
call fcn.140037a60
lea rdx, str.SYSTEMDRIVE
lea rcx, [rbp + 0x17]
call fcn.140037ad0
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x29]
call fcn.140042960
mov rdx, rax
lea r8, str.Program_FilesMicrosoft_SQL_Server
lea rcx, [rbp - 9]
call fcn.140043290
mov rdx, rax
lea rcx, [r14 + 0x20]
call fcn.14003b310
lea rcx, [rbp - 9]
call fcn.140037a60
lea rcx, [rbp - 0x29]
call fcn.140037a60
lea rcx, [rbp + 0x17]
call fcn.140037a60
lea rdx, str.SYSTEMDRIVE
lea rcx, [rbp + 0x17]
call fcn.140037ad0
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x29]
call fcn.140042960
mov rdx, rax
lea r8, str.Program_Files__x86_Microsoft_SQL_Server
lea rcx, [rbp - 9]
call fcn.140043290
mov rdx, rax
lea rcx, [r14 + 0x20]
call fcn.14003b310
lea rcx, [rbp - 9]
call fcn.140037a60
lea rcx, [rbp - 0x29]
call fcn.140037a60
lea rcx, [rbp + 0x17]
call fcn.140037a60
lea rdx, [r14 + 8]
call fcn.140042390
lea rdx, [r14 + 0x20]
call fcn.140042390
lea rdi, [0x14011a200]
lea rbx, [0x14011a300]
mov rdx, rdi
lea rcx, [rbp + 0x17]
call fcn.140038c70
mov dword [rbp + 0x6f], r12d
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x49]
lea rcx, [r14 + 0x38]
call fcn.140043300
lea rcx, [rbp + 0x17]
call fcn.140037a60
add rdi, 0x20
cmp rdi, rbx
jne 0x140042263
lea rdi, [0x14011a300]
lea rbx, [0x14011a340]
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rbp + 0x17]
call fcn.140038c70
mov dword [rbp + 0x6f], 1
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x49]
lea rcx, [r14 + 0x38]
call fcn.140043300
lea rcx, [rbp + 0x17]
call fcn.140037a60
add rdi, 0x20
cmp rdi, rbx
jne 0x1400422b0
lea rdi, [0x1401146e0]
lea rbx, [0x14011a1e0]
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rbp + 0x17]
call fcn.140038c70
mov dword [rbp + 0x6f], 2
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x49]
lea rcx, [r14 + 0x38]
call fcn.140043300
lea rcx, [rbp + 0x17]
call fcn.140037a60
add rdi, 0x20
cmp rdi, rbx
jne 0x140042300
mov rax, r14
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140077e4c
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3