Function at 0x140048590
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2668]
mov eax, 0x2768
call fcn.14006a3e0
sub rsp, rax
mov qword [rbp - 0x40], 0xfffffffffffffffe
movaps xmmword [rsp + 0x2750], xmm6
movaps xmmword [rsp + 0x2740], xmm7
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rbp + 0x2630], rax
mov qword [rbp - 0x48], r9
mov r15, r8
mov rsi, rdx
mov qword [rbp - 0x50], rcx
mov rax, qword [rbp + 0x26d8]
mov qword [rbp - 0x58], rax
mov r12, qword [rbp + 0x26e0]
mov qword [rbp - 0x10], r12
xor r14d, r14d
mov dword [rbp - 8], r14d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x630]
call fcn.140088180
movdqa xmm0, xmmword [0x1400d6210]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp - 0x68], xmm1
lea rax, [rsi + 0x10]
mov qword [rsp + 0x60], rax
mov qword [rax], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140022af0
mov rbx, rax
cmp rsi, rax
je 0x14004868f
mov rcx, rsi
call fcn.140003d5c
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400486d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400486cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049727
call fcn.140069674
mov rdx, rsi
lea rcx, [rbp]
call fcn.140021f50
nop
xor edx, edx
lea ecx, [rdx + 0xa]
xor r9d, r9d
call fcn.14000eebc
test al, al
jne 0x1400487f3
lea rbx, [rbp]
mov r12, qword [rbp]
mov r13, qword [rbp + 0x18]
cmp r13, 8
cmovae rbx, r12
mov r11, qword [rbp + 0x10]
cmp r11, 7
jb 0x1400487ef
lea rdi, [r11 - 6]
lea rdi, [rbx + rdi*2]
mov rax, rbx
lea r8, str.ext_ms_
mov qword [rbp - 8], r8
nop word [rax + rax]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, r14
je 0x14004875a
cmp word [rax], 0x65
je 0x140048757
cmp rcx, 1
je 0x14004875a
dec rcx
add rax, 2
cmp word [rax], 0x65
jne 0x140048744
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400487ef
mov r9d, 7
mov rcx, r8
movzx edx, word [rdx]
mov r8d, 0x65
cmp dx, r8w
jb 0x1400487a7
mov r10, rax
sub r10, qword [rbp - 8]
cmp dx, r8w
ja 0x1400487a7
cmp r9, 1
je 0x1400487b7
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x140048789
add rax, 2
lea r8, str.ext_ms_
jmp 0x140048730
sub rax, rbx
sar rax, 1
jne 0x1400487ef
mov eax, 4
cmp r11, rax
cmovb rax, r11
lea rcx, [rbp]
cmp r13, 8
cmovae rcx, r12
sub r11, rax
mov qword [rbp + 0x10], r11
lea r8, [r11*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.140087d20
mov r12, qword [rbp - 0x10]
mov r13, qword [rbp - 0x50]
mov rdi, qword [r13 + 8]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140048aa1
nop word [rax + rax]
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14004881e
mov rdx, qword [rdx]
lea rcx, [rbp]
call fcn.140020b98
cmp rax, 0xffffffffffffffff
jne 0x140048835
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140048810
cmp rbx, rdi
je 0x140048aa1
mov r8, qword [rbx + 0x30]
cmp r8, qword [rbx + 0x38]
je 0x1400488ae
mov rcx, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 8
jb 0x140048856
mov r15, qword [r15]
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140048864
mov r8, qword [r8]
cmp rax, rcx
jne 0x14004889e
test rax, rax
je 0x1400488a4
movzx ecx, word [r8]
movzx edx, word [r15]
cmp cx, dx
jb 0x14004889e
sub r8, r15
cmp cx, dx
ja 0x14004889e
cmp rax, 1
je 0x1400488a4
dec rax
add r15, 2
movzx ecx, word [r8 + r15]
movzx edx, word [r15]
cmp cx, dx
jae 0x140048881
mov rdx, qword [rbx + 0x30]
jmp 0x1400488b1
mov rdx, qword [rbx + 0x38]
sub rdx, 0x20
jmp 0x1400488b1
mov rdx, r15
mov rcx, rsi
call fcn.140013bfc
mov r9, r12
mov r8, qword [rbp - 0x58]
mov rdx, rsi
call fcn.140049790
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x1400496c9
cmp edx, 0xc015001d
je 0x1400496c9
test byte [rbp + 0x26d0], 2
je 0x1400496cc
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.140088180
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movdqa xmm0, xmmword [0x1400d6210]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r14w
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140003dc0
nop
mov r8d, 1
lea rdx, [0x1400d3c08]
lea rcx, [rsp + 0x68]
call fcn.1400080f4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140048983
mov rdx, qword [rsi]
mov rax, qword [rsp + 0x60]
mov r8, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.1400080f4
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.1400037b4
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140048a01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400489fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004972d
call fcn.140069674
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140048a43
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048a3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049733
call fcn.140069674
movdqa xmm0, xmmword [0x1400d6210]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400496cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048a97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049739
call fcn.140069674
jmp 0x1400496cc
mov r12d, dword [rbp + 0x26d0]
test r12b, 1
jne 0x140048ae1
mov r9, qword [rbp - 0x10]
mov r8, qword [rbp - 0x58]
mov rdx, rsi
call fcn.140049790
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x1400496c9
cmp edx, 0xc015001d
je 0x1400496c9
test r12b, 4
je 0x140048aec
mov r14d, 0xc0000225
jmp 0x1400496cc
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140048af9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400496cc
mov qword [rbp + 0x20], r14
lea r8, [rbp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x140048c11
mov ebx, r14d
test rdi, rdi
jne 0x140048c11
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x430]
call fcn.140088180
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x230]
call fcn.140088180
mov dword [rbp - 0x10], 0xff
mov dword [rbp - 8], r14d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x430]
mov edx, ebx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
lea rcx, [rbp + 0x230]
call fcn.140094224
test eax, eax
jne 0x140048c03
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.140088180
mov dword [rbp - 0x10], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x30]
test r12b, 8
je 0x140048bf8
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140048bfe
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x140048c76
inc ebx
cmp ebx, 0x1000
jl 0x140048b32
mov r13, qword [rbp - 0x48]
mov r8, qword [r13 + 0x10]
movabs rbx, 0x7ffffffffffffffe
test r8, r8
je 0x14004901e
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
mov dword [rbp - 8], 0x10
lea r15, [r8 + 1]
cmp r15, 7
jbe 0x140048e51
cmp r15, rbx
ja 0x14004973f
mov rdi, r15
or rdi, 7
cmp rdi, rbx
jbe 0x140048e18
mov rdi, rbx
jmp 0x140048e25
movdqa xmm0, xmmword [0x1400d6210]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r14w
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140003dc0
nop
mov r8d, 1
lea rdx, [0x1400d3c08]
lea rcx, [rsp + 0x68]
call fcn.1400080f4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rax, [rbp + 0x230]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140048cf0
lea rdx, [rbp + 0x230]
lea rcx, [rsp + 0x40]
call fcn.1400080f4
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.1400037b4
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140048d78
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048d72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049745
call fcn.140069674
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140048dba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048db5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004974b
call fcn.140069674
movdqa xmm0, xmmword [0x1400d6210]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400496b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048e0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049751
call fcn.140069674
jmp 0x1400496b0
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x40]
call fcn.140006218
mov rcx, rax
mov qword [rsp + 0x58], rdi
movzx eax, word [rsp + 0x40]
mov word [rcx], ax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], r14
mov r8, qword [r13 + 0x10]
cmp qword [r13 + 0x18], 8
jb 0x140048e5c
mov r13, qword [r13]
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.1400080f4
mov r8d, 1
lea rdx, [0x1400d3c08]
lea rcx, [rsp + 0x40]
call fcn.1400080f4
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400080f4
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rbp - 0x30]
call fcn.140003d5c
movups xmmword [rbp - 0x30], xmm6
movups xmmword [rbp - 0x20], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140048f06
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048f01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049757
call fcn.140069674
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004901e
lea rax, [rbp - 0x30]
cmp rsi, rax
je 0x1400496b0
mov r15, qword [rbp - 0x20]
lea r13, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r13, qword [rbp - 0x30]
mov rdi, qword [rsi + 0x18]
cmp r15, rdi
ja 0x140048f78
cmp rdi, 8
jb 0x140048f54
mov rsi, qword [rsi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r15
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.140087d20
mov word [rsi + rbx], r14w
jmp 0x1400496b0
cmp r15, rbx
ja 0x14004975d
mov rcx, r15
or rcx, 7
cmp rcx, rbx
ja 0x140048fac
mov rdx, rdi
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp rdi, rax
ja 0x140048fac
lea rax, [rdx + rdi]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.140006218
mov r12, rax
mov rax, qword [rsp + 0x60]
mov qword [rax], r15
mov qword [rsi + 0x18], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, r12
call fcn.140087d20
mov word [rbx + r12], r14w
cmp rdi, 8
jb 0x14004925c
mov rcx, qword [rsi]
lea rdx, [rdi*2 + 2]
cmp rdx, 0x1000
jb 0x140049257
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004971b
jmp 0x140049254
mov rax, qword [rbp - 0x58]
mov r8d, dword [rax + 8]
lea rdx, [rbp - 0x78]
call fcn.140049b70
nop
mov r8d, 1
lea rdx, [0x1400d3c08]
mov rcx, rax
call fcn.1400080f4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400080f4
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rbp - 0x30]
call fcn.140003d5c
movups xmmword [rbp - 0x30], xmm6
movups xmmword [rbp - 0x20], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400490f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400490f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049763
call fcn.140069674
movdqa xmm0, xmmword [0x1400d6210]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140049149
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049144
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049769
call fcn.140069674
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140049264
lea rax, [rbp - 0x30]
cmp rsi, rax
je 0x1400496b0
mov r15, qword [rbp - 0x20]
lea r13, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r13, qword [rbp - 0x30]
mov rdi, qword [rsi + 0x18]
cmp r15, rdi
ja 0x1400491bb
cmp rdi, 8
jb 0x140049197
mov rsi, qword [rsi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r15
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.140087d20
mov word [rsi + rbx], r14w
jmp 0x1400496b0
cmp r15, rbx
ja 0x14004976f
mov rcx, r15
or rcx, 7
cmp rcx, rbx
ja 0x1400491ef
mov rdx, rdi
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp rdi, rax
ja 0x1400491ef
lea rax, [rdi + rdx]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.140006218
mov r12, rax
mov rax, qword [rsp + 0x60]
mov qword [rax], r15
mov qword [rsi + 0x18], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, r12
call fcn.140087d20
mov word [r12 + rbx], r14w
cmp rdi, 8
jb 0x14004925c
mov rcx, qword [rsi]
lea rdx, [rdi*2 + 2]
cmp rdx, 0x1000
jb 0x140049257
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140049775
mov rcx, r8
call fcn.140069674
mov qword [rsi], r12
jmp 0x1400496b0
mov edx, 0x1000
lea rcx, [rbp + 0x630]
test r12b, 8
je 0x14004927e
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140049284
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movdqa xmm0, xmmword [0x1400d6210]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r14w
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x68]
call fcn.140003dc0
nop
mov r8d, 1
lea rdx, [0x1400d3c08]
lea rcx, [rsp + 0x68]
call fcn.1400080f4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400080f4
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rbp - 0x30]
call fcn.140003d5c
movups xmmword [rbp - 0x30], xmm6
movups xmmword [rbp - 0x20], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140049371
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004936c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004977b
call fcn.140069674
movdqa xmm0, xmmword [0x1400d6210]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400493c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400493c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049781
call fcn.140069674
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400494de
lea rax, [rbp - 0x30]
cmp rsi, rax
je 0x1400496b0
mov r15, qword [rbp - 0x20]
lea r13, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r13, qword [rbp - 0x30]
mov rdi, qword [rsi + 0x18]
cmp r15, rdi
ja 0x140049438
cmp rdi, 8
jb 0x140049414
mov rsi, qword [rsi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r15
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.140087d20
mov word [rsi + rbx], r14w
jmp 0x1400496b0
cmp r15, rbx
ja 0x140049715
mov rcx, r15
or rcx, 7
cmp rcx, rbx
ja 0x14004946c
mov rdx, rdi
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp rdi, rax
ja 0x14004946c
lea rax, [rdx + rdi]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.140006218
mov r12, rax
mov rax, qword [rsp + 0x60]
mov qword [rax], r15
mov qword [rsi + 0x18], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, r12
call fcn.140087d20
mov word [rbx + r12], r14w
cmp rdi, 8
jb 0x14004925c
mov rcx, qword [rsi]
lea rdx, [rdi*2 + 2]
cmp rdx, 0x1000
jb 0x140049257
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140049721
jmp 0x140049254
mov edx, 0x1000
lea rcx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x40]
call fcn.1400037fc
nop
lea r8, [0x1400d3c08]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000703c
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140018538
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400037b4
lea rcx, [rbp - 0x78]
call fcn.140003d5c
nop
lea rcx, [rsp + 0x68]
call fcn.140003d5c
nop
lea rcx, [rsp + 0x40]
call fcn.140003d5c
lea rcx, [rbp - 0x30]
call fcn.140022d20
test al, al
jne 0x1400496bb
lea rdx, [rbp + 0x630]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x40]
call fcn.1400037fc
nop
lea r8, [0x1400d3c08]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000703c
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140018538
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400037b4
lea rcx, [rbp - 0x78]
call fcn.140003d5c
nop
lea rcx, [rsp + 0x68]
call fcn.140003d5c
nop
lea rcx, [rsp + 0x40]
call fcn.140003d5c
lea rcx, [rbp - 0x30]
call fcn.140022d20
test al, al
jne 0x1400496bb
mov r8d, 0x1000
lea rdx, [rbp + 0x630]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x38]
lea rdx, [0x1400d4c08]
lea rcx, [rbp + 0x630]
call fcn.14009460c
test rax, rax
je 0x1400496aa
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400037fc
nop
lea r8, [0x1400d3c08]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000703c
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140018538
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400037b4
lea rcx, [rbp - 0x78]
call fcn.140003d5c
nop
lea rcx, [rsp + 0x68]
call fcn.140003d5c
nop
lea rcx, [rsp + 0x40]
call fcn.140003d5c
lea rcx, [rbp - 0x30]
call fcn.140022d20
test al, al
jne 0x1400496bb
lea r8, [rbp - 0x38]
lea rdx, [0x1400d4c08]
mov rcx, qword [rbp - 0x38]
call fcn.14009460c
test rax, rax
jne 0x140049622
mov r14d, 0xc0000225
lea rcx, [rbp + 0x20]
call fcn.140024bc0
jmp 0x1400496cc
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.140013bfc
jmp 0x1400496b0
mov r14d, edx
lea rcx, [rbp]
call fcn.140003d5c
nop
lea rcx, [rbp - 0x30]
call fcn.140003d5c
mov eax, r14d
mov rcx, qword [rbp + 0x2630]
xor rcx, rsp
call fcn.140069650
movaps xmm6, xmmword [rsp + 0x2750]
movaps xmm7, xmmword [rsp + 0x2740]
add rsp, 0x2768
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400080e0
nop
call fcn.1400927c0
int3
call fcn.1400927c0
nop
call fcn.1400927c0
nop
call fcn.1400927c0
nop
call fcn.1400927c0
nop
call fcn.1400927c0
nop
call fcn.1400080e0
nop
call fcn.1400927c0
nop
call fcn.1400927c0
nop
call fcn.1400927c0
int3
call fcn.1400927c0
int3
call fcn.1400080e0
nop
call fcn.1400927c0
nop
call fcn.1400927c0
int3
call fcn.1400080e0
int3
call fcn.1400927c0
nop
call fcn.1400927c0
nop
call fcn.1400927c0
int3