Function at 0x140016d80
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27c8]
mov eax, 0x28c8
call fcn.140043b40
sub rsp, rax
movaps xmmword [rsp + 0x28b0], xmm6
movaps xmmword [rsp + 0x28a0], xmm7
mov rax, qword [0x140089040]
xor rax, rsp
mov qword [rbp + 0x2790], rax
mov r12, r9
mov qword [rsp + 0x48], r9
mov rdi, r8
mov rsi, rdx
mov r15, rcx
mov rax, qword [rbp + 0x2838]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x2840]
mov qword [rbp + 0x178], rax
xor r14d, r14d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x790]
call fcn.140066440
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r14
mov qword [rbp + 0x150], 7
mov word [rbp + 0x138], r14w
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xf0]
call fcn.14000ee80
mov rdx, rax
mov rcx, rsi
call fcn.140002930
mov rdx, qword [rbp + 0x108]
cmp rdx, 7
jbe 0x140016eab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016ea6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018246
call fcn.1400430cc
mov r8, qword [rsi + 0x10]
mov r13, 0xffffffffffffffff
test r8, r8
je 0x140016f91
mov rdx, rsi
mov r9, qword [rsi + 0x18]
cmp r9, 7
jbe 0x140016ecf
mov rdx, qword [rsi]
lea rcx, [r8 - 1]
mov rax, r13
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x140016ef6
cmp rcx, rdx
je 0x140016f01
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x140016ee7
sub rcx, rdx
sar rcx, 1
cmp rcx, r13
jne 0x140016f3f
mov rdx, rsi
cmp r9, 7
jbe 0x140016f0d
mov rdx, qword [rsi]
lea rcx, [r8 - 1]
mov rax, r13
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2f
je 0x140016f34
cmp rcx, rdx
je 0x140016f91
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x140016f25
sub rcx, rdx
sar rcx, 1
cmp rcx, r13
je 0x140016f91
inc rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r14
mov qword [rbp + 0x170], r14
mov rax, r8
cmp r8, rcx
jb 0x14001824c
sub rax, rcx
mov r8, r13
cmp rax, r13
cmovb r8, rax
mov rax, rsi
cmp r9, 7
jbe 0x140016f7f
mov rax, qword [rsi]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x158]
call fcn.140002d90
jmp 0x140016fa1
mov rdx, rsi
lea rcx, [rbp + 0x158]
call fcn.140004440
nop
cmp dword [0x14008c41c], 9
ja 0x14001709e
lea r10, [rbp + 0x158]
cmp qword [rbp + 0x170], 7
cmova r10, qword [rbp + 0x158]
mov rbx, qword [rbp + 0x168]
cmp rbx, 7
jb 0x14001709e
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x14007b3d0]
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, r14
je 0x140017016
cmp word [rcx], 0x65
je 0x140017013
nop dword [rax]
cmp rax, 1
je 0x140017016
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x140017000
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14001709e
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x14007b3d0]
sub r9, rax
nop dword [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140017134
add rdx, 2
sub r8, 1
jne 0x140017040
sub rcx, r10
sar rcx, 1
jne 0x14001709e
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x158]
cmp qword [rbp + 0x170], 7
cmova rcx, qword [rbp + 0x158]
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call fcn.140065da0
mov qword [rbp + 0x168], rbx
mov r14, qword [r15 + 8]
mov rbx, qword [r14]
cmp rbx, r14
je 0x140017381
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x1400170be
mov rdx, qword [rdx]
lea rcx, [rbp + 0x158]
call fcn.140018ae0
cmp rax, 0xffffffffffffffff
jne 0x1400170db
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r14
jne 0x1400170b0
cmp rbx, r14
je 0x140017381
mov rdx, qword [rbx + 0x30]
cmp rdx, qword [rbx + 0x38]
je 0x140017156
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x1400170fc
mov rdi, qword [rdi]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14001710a
mov rdx, qword [rdx]
cmp rcx, rax
jne 0x14001713d
test rcx, rcx
je 0x14001712a
sub rdx, rdi
movzx eax, word [rdi + rdx]
cmp ax, word [rdi]
jne 0x14001713d
add rdi, 2
sub rcx, 1
jne 0x140017117
mov rdx, qword [rbx + 0x38]
sub rdx, 0x20
jmp 0x140017141
add rcx, 2
jmp 0x140016fe1
mov rdx, qword [rbx + 0x30]
cmp rsi, rdx
je 0x140017174
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14001716c
mov rdx, qword [rdx]
jmp 0x14001716c
cmp rsi, rdi
je 0x140017174
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x140017169
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rsi
call fcn.140004260
mov r9, qword [rbp + 0x178]
mov r8, qword [rsp + 0x40]
mov rdx, rsi
call fcn.1400182e0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140018166
cmp ebx, 0xc015001d
je 0x140018166
test byte [rbp + 0x2830], 2
je 0x14001737a
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.140066440
mov edx, 0xff
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rax, [rbp + 0x190]
inc r13
cmp word [rax + r13*2], 0
jne 0x1400171f1
mov r8, r13
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x70]
call fcn.140002d90
nop
mov r8d, 1
lea rdx, [0x14007b3cc]
lea rcx, [rbp + 0x70]
call fcn.140004380
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x140017262
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x50]
call fcn.140004380
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140002930
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x1400172dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400172d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018252
call fcn.1400430cc
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14001731d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017318
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018258
call fcn.1400430cc
movdqa xmm0, xmmword [0x14007c5f0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], bx
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140018166
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017370
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001825e
call fcn.1400430cc
jmp 0x140018166
xor ebx, ebx
jmp 0x140018166
mov r14d, dword [rbp + 0x2830]
test r14b, 1
jne 0x140018161
mov r9, qword [rbp + 0x178]
mov r8, qword [rsp + 0x40]
mov rdx, rsi
call fcn.1400182e0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140018166
cmp ebx, 0xc015001d
je 0x140018166
test r14b, 4
jne 0x140018161
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x1400173da
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x1400173f0
mov ebx, r15d
jmp 0x140018169
mov qword [rbp + 0x188], r15
lea r8, [rbp + 0x188]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x140017527
mov ebx, r15d
test rdi, rdi
jne 0x140017527
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x590]
call fcn.140066440
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x390]
call fcn.140066440
mov dword [rbp + 0x178], 0xff
mov dword [rbp + 0x180], r15d
lea rax, [rbp + 0x178]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x390]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x178]
lea r8, [rbp + 0x590]
mov edx, ebx
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 7
cmova rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x390]
call fcn.14004e260
test eax, eax
jne 0x140017519
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.140066440
mov dword [rbp + 0x178], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x190]
test r14b, 8
je 0x14001750a
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140017510
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x1400178a9
inc ebx
cmp ebx, 0x1000
jl 0x140017420
mov rdi, qword [r12 + 0x10]
test rdi, rdi
je 0x1400176e6
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
sub rax, rdi
cmp rax, 1
jb 0x140018264
cmp qword [r12 + 0x18], 7
jbe 0x140017560
mov r12, qword [r12]
mov qword [rsp + 0x48], r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea r12, [rdi + 1]
mov eax, 7
lea r15, [rbp - 0x70]
cmp r12, rax
jbe 0x1400175c1
mov rax, r12
or rax, 7
cmp rax, rbx
ja 0x14001759c
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
inc rbx
mov qword [rbp + 0x180], rbx
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x70]
call fcn.140003250
mov r15, rax
lea rax, [rbx - 1]
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], rax
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, qword [rsp + 0x48]
mov rcx, r15
call fcn.140065da0
mov word [rbx + r15], 0x5c
xor ebx, ebx
mov word [r15 + r12*2], bx
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 7
cmova rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp - 0x70]
call fcn.140004380
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x140017672
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001766d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001826a
call fcn.1400430cc
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x1400176c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400176bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018270
call fcn.1400430cc
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 7
cmova rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001812a
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 8]
lea rdx, [rbp + 0x110]
call fcn.140018880
nop
mov r8d, 1
lea rdx, [0x14007b3cc]
mov rcx, rax
call fcn.140004380
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 7
cmova rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp - 0x30]
call fcn.140004380
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x1400177c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400177be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018276
call fcn.1400430cc
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x140017811
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001780c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001827c
call fcn.1400430cc
movdqa xmm0, xmmword [0x14007c5f0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp + 0x128]
cmp rdx, 7
jbe 0x140017869
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017864
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018282
call fcn.1400430cc
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 7
cmova rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001812a
mov edx, 0x1000
lea rcx, [rbp + 0x790]
test r14b, 8
je 0x14001791f
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140017925
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x70]
call fcn.1400022e0
nop
lea r8, [0x14007b3cc]
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140019490
nop
lea r8, [rbp + 0x390]
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.140019490
mov rdx, rax
mov rcx, rsi
call fcn.140002930
lea rcx, [rbp + 0x110]
call fcn.140002270
nop
lea rcx, [rbp + 0xf0]
call fcn.140002270
nop
lea rcx, [rsp + 0x70]
call fcn.140002270
mov ebx, r15d
jmp 0x140018116
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
lea rax, [rbp + 0x790]
mov r8, r13
inc r8
cmp word [rax + r8*2], 0
jne 0x140017944
lea rdx, [rbp + 0x790]
lea rcx, [rbp + 0x90]
call fcn.140002d90
nop
mov r8d, 1
lea rdx, [0x14007b3cc]
lea rcx, [rbp + 0x90]
call fcn.140004380
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 7
cmova rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp - 0x10]
call fcn.140004380
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x140017a2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017a29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018288
call fcn.1400430cc
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x140017a7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017a77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001828e
call fcn.1400430cc
movdqa xmm0, xmmword [0x14007c5f0]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r15w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x140017ad4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017acf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018294
call fcn.1400430cc
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 7
cmova rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001812a
mov edx, 0x1000
lea rcx, [rbp + 0x790]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
lea rax, [rbp + 0x790]
mov r8, r13
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140017b30
lea rdx, [rbp + 0x790]
lea rcx, [rbp + 0xb0]
call fcn.140002d90
nop
mov r8d, 1
lea rdx, [0x14007b3cc]
lea rcx, [rbp + 0xb0]
call fcn.140004380
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 7
cmova rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp + 0x10]
call fcn.140004380
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x140017c1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017c15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001829a
call fcn.1400430cc
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140017c68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017c63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400182a0
call fcn.1400430cc
movdqa xmm0, xmmword [0x14007c5f0]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r15w
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x140017cc0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017cbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400182a6
call fcn.1400430cc
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 7
cmova rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001812a
lea rdx, [rbp + 0x790]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
lea rax, [rbp + 0x790]
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140017d20
lea rdx, [rbp + 0x790]
lea rcx, [rbp + 0xd0]
call fcn.140002d90
nop
mov r8d, 1
lea rdx, [0x14007b3cc]
lea rcx, [rbp + 0xd0]
call fcn.140004380
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 7
cmova rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rbp + 0x30]
call fcn.140004380
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x140017e0a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017e05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400182ac
call fcn.1400430cc
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x140017e58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017e53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400182b2
call fcn.1400430cc
movdqa xmm0, xmmword [0x14007c5f0]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], r15w
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x140017eb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017eab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400182b8
call fcn.1400430cc
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 7
cmova rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140017ee9
lea rdx, [rbp + 0x138]
mov rcx, rsi
call fcn.140004410
mov ebx, r15d
jmp 0x140018116
mov r8d, 0x1000
lea rdx, [rbp + 0x790]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp + 0x130]
lea rdx, [0x14007b464]
lea rcx, [rbp + 0x790]
call fcn.14004f1e8
test rax, rax
je 0x140018111
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r15
mov r8, r13
inc r8
cmp word [rax + r8*2], 0
jne 0x140017f42
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.140002d90
nop
mov r8d, 1
lea rdx, [0x14007b3cc]
lea rcx, [rbp + 0x50]
call fcn.140004380
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 7
cmova rdx, qword [rbp + 0x158]
mov r8, qword [rbp + 0x168]
lea rcx, [rsp + 0x50]
call fcn.140004380
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x140018028
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018023
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400182be
call fcn.1400430cc
movups xmmword [rbp + 0x138], xmm6
movups xmmword [rbp + 0x148], xmm7
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140018078
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400182c4
call fcn.1400430cc
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x1400180cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400180c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400182ca
call fcn.1400430cc
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 7
cmova rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001812a
lea r8, [rbp + 0x130]
lea rdx, [0x14007b464]
mov rcx, qword [rbp + 0x130]
call fcn.14004f1e8
test rax, rax
jne 0x140017f30
mov ebx, 0xc0000225
mov rcx, qword [rbp + 0x188]
test rcx, rcx
jle 0x140018169
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140018169
lea rax, [rbp + 0x138]
cmp rsi, rax
je 0x14001815c
lea rdx, [rbp + 0x138]
cmp qword [rbp + 0x150], 7
mov r8, qword [rbp + 0x148]
cmova rdx, qword [rbp + 0x138]
mov rcx, rsi
call fcn.140004260
mov ebx, r15d
jmp 0x140018116
mov ebx, 0xc0000225
xor r15d, r15d
mov rdx, qword [rbp + 0x170]
cmp rdx, 7
jbe 0x1400181af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400181aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400182d0
call fcn.1400430cc
mov qword [rbp + 0x168], r15
mov qword [rbp + 0x170], 7
mov word [rbp + 0x158], r15w
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x14001820b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018206
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018240
call fcn.1400430cc
mov eax, ebx
mov rcx, qword [rbp + 0x2790]
xor rcx, rsp
call fcn.140042e30
movaps xmm6, xmmword [rsp + 0x28b0]
movaps xmm7, xmmword [rsp + 0x28a0]
add rsp, 0x28c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.1400029d0
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.140001410
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
nop
call fcn.14004e104
int3