Function at 0x140049380
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2648]
mov eax, 0x2748
call fcn.14006b3f0
sub rsp, rax
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rbp + 0x2630], rax
mov r12, r9
mov qword [rbp - 8], r9
mov r14, r8
mov rdi, rdx
mov qword [rbp - 0x68], rcx
mov rax, qword [rbp + 0x26b8]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x26c0]
mov qword [rbp - 0x38], rax
xor esi, esi
mov dword [rbp + 0x20], esi
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x630]
call fcn.140089760
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], si
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x48], xmm1
lea r15, [rdi + 0x10]
mov qword [rsp + 0x60], r15
mov qword [r15], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.140025230
mov rbx, rax
cmp rdi, rax
je 0x1400494a9
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14004947e
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140049479
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a88c
mov rcx, r8
call fcn.14006a794
mov qword [r15], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400494ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400494e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a88c
call fcn.14006a794
mov rdx, rdi
lea rcx, [rbp]
call fcn.1400245c0
nop
xor edx, edx
lea ecx, [rdx + 0xa]
xor r9d, r9d
call fcn.140013574
test al, al
jne 0x140049613
lea rbx, [rbp]
mov r12, qword [rbp]
mov r13, qword [rbp + 0x18]
cmp r13, 8
cmovae rbx, r12
mov r11, qword [rbp + 0x10]
cmp r11, 7
jb 0x14004960f
lea r15, [r11 - 6]
lea r15, [rbx + r15*2]
mov rax, rbx
lea r8, str.ext_ms_
mov qword [rbp + 0x20], r8
nop dword [rax]
nop dword [rax + rax]
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov rdx, rsi
je 0x14004957a
cmp word [rax], 0x65
je 0x140049577
cmp rcx, 1
je 0x14004957a
dec rcx
add rax, 2
cmp word [rax], 0x65
jne 0x140049564
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14004960f
mov r9d, 7
mov rcx, r8
movzx edx, word [rdx]
mov r8d, 0x65
cmp dx, r8w
jb 0x1400495c7
mov r10, rax
sub r10, qword [rbp + 0x20]
cmp dx, r8w
ja 0x1400495c7
cmp r9, 1
je 0x1400495d7
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x1400495a9
add rax, 2
lea r8, str.ext_ms_
jmp 0x140049550
sub rax, rbx
sar rax, 1
jne 0x14004960f
mov eax, 4
cmp r11, rax
cmovb rax, r11
lea rcx, [rbp]
cmp r13, 8
cmovae rcx, r12
sub r11, rax
mov qword [rbp + 0x10], r11
lea r8, [r11*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.140089350
mov r12, qword [rbp - 8]
mov r13, qword [rbp - 0x68]
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x14004991c
nop word [rax + rax]
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14004963e
mov rdx, qword [rdx]
lea rcx, [rbp]
call fcn.140023674
cmp rax, 0xffffffffffffffff
jne 0x140049655
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x140049630
cmp rbx, r15
je 0x14004991c
mov r8, qword [rbx + 0x30]
cmp r8, qword [rbx + 0x38]
je 0x1400496ca
mov rcx, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x140049676
mov r14, qword [r14]
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140049684
mov r8, qword [r8]
cmp rax, rcx
jne 0x1400496c6
test rax, rax
je 0x14004982f
movzx ecx, word [r8]
movzx edx, word [r14]
cmp cx, dx
jb 0x1400496c6
sub r8, r14
cmp cx, dx
ja 0x1400496c6
cmp rax, 1
je 0x14004982f
dec rax
add r14, 2
movzx ecx, word [r14 + r8]
movzx edx, word [r14]
cmp cx, dx
jae 0x1400496a5
mov r14, qword [rbx + 0x30]
mov rdx, r14
mov rcx, rdi
call fcn.140017420
mov r9, qword [rbp - 0x38]
mov r8, qword [rbp - 0x78]
mov rdx, rdi
call fcn.14004a910
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004a846
cmp edx, 0xc015001d
je 0x14004a846
test byte [rbp + 0x26b0], 2
je 0x14004a848
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.140089760
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1400068b8
nop
mov r8d, 1
lea rdx, [0x1400d6df0]
lea rcx, [rsp + 0x68]
call fcn.1400094c0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14004979e
mov rdx, qword [rdi]
mov rax, qword [rsp + 0x60]
mov r8, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.1400094c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp - 0x58]
cmp rdi, rax
je 0x14004983c
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140049826
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140049819
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a892
mov rcx, r8
call fcn.14006a794
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
jmp 0x14004987d
mov r14, qword [rbx + 0x38]
sub r14, 0x20
jmp 0x1400496ca
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14004987d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049877
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a892
call fcn.14006a794
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400498bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400498ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a898
call fcn.14006a794
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004a848
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049912
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a89e
call fcn.14006a794
jmp 0x14004a848
mov r15d, dword [rbp + 0x26b0]
test r15b, 1
jne 0x14004995f
mov r9, qword [rbp - 0x38]
mov r13, qword [rbp - 0x78]
mov r8, r13
mov rdx, rdi
call fcn.14004a910
mov edx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004a846
cmp edx, 0xc015001d
je 0x14004a846
test r15b, 4
je 0x140049969
mov esi, 0xc0000225
jmp 0x14004a848
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140049976
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004a848
mov qword [rbp + 0x28], rsi
lea r8, [rbp + 0x28]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd r14, eax
test eax, eax
jne 0x140049a8e
mov ebx, esi
nop
test r14, r14
jne 0x140049a8e
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x430]
call fcn.140089760
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x230]
call fcn.140089760
mov dword [rbp - 8], 0xff
mov dword [rbp + 0x20], esi
lea rax, [rbp - 8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 8]
lea r8, [rbp + 0x430]
mov edx, ebx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd r14, eax
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
lea rcx, [rbp + 0x230]
call fcn.140097a84
test eax, eax
jne 0x140049a80
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.140089760
mov dword [rbp - 8], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x30]
test r15b, 8
je 0x140049a75
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140049a7b
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test r14, r14
je 0x140049af6
inc ebx
cmp ebx, 0x1000
jl 0x1400499b0
mov r8, qword [r12 + 0x10]
movabs rbx, 0x7ffffffffffffffe
movabs r14, 0x7fffffffffffffff
test r8, r8
je 0x140049f36
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov dword [rbp + 0x20], 0x10
lea r14, [r8 + 1]
cmp r14, 7
jbe 0x140049d75
cmp r14, rbx
ja 0x14004a8a4
or r14, 7
cmp r14, rbx
jbe 0x140049ceb
mov r14, rbx
jmp 0x140049cf8
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1400068b8
nop
mov r8d, 1
lea rdx, [0x1400d6df0]
lea rcx, [rsp + 0x68]
call fcn.1400094c0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp + 0x230]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140049b70
lea rdx, [rbp + 0x230]
lea rcx, [rsp + 0x40]
call fcn.1400094c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp - 0x58]
cmp rdi, rax
je 0x140049c0b
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140049c02
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140049bf5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a8aa
mov rcx, r8
call fcn.14006a794
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
jmp 0x140049c4c
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140049c4c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049c46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8aa
call fcn.14006a794
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140049c8e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049c89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8b0
call fcn.14006a794
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004a82d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049ce1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8b6
call fcn.14006a794
jmp 0x14004a82d
cmp r14, 0xa
mov eax, 0xa
cmovb r14, rax
lea rcx, [r14 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14004a8c2
add rcx, rcx
cmp rcx, 0x1000
jb 0x140049d47
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004a8c2
mov rcx, rax
call fcn.14006a79c
test rax, rax
je 0x14004a8bc
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140049d59
test rcx, rcx
je 0x140049d56
call fcn.14006a79c
mov rcx, rax
jmp 0x140049d59
mov rcx, rsi
mov qword [rsp + 0x58], r14
movzx eax, word [rsp + 0x40]
mov word [rcx], ax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov r8, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 8
jb 0x140049d81
mov r12, qword [r12]
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.1400094c0
mov r8d, 1
lea rdx, [0x1400d6df0]
lea rcx, [rsp + 0x40]
call fcn.1400094c0
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400094c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140049e27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049e1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8bc
call fcn.14006a794
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140049e71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8c8
call fcn.14006a794
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140049f2c
lea rax, [rbp - 0x28]
cmp rdi, rax
je 0x14004a82d
mov r12, qword [rbp - 0x18]
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rdi + 0x18]
cmp r12, r15
ja 0x140049ee2
cmp r15, 8
jb 0x140049ebf
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.140089350
mov word [rbx + rdi], si
jmp 0x14004a82d
cmp r12, rbx
ja 0x14004a886
mov rcx, r12
or rcx, 7
cmp rcx, rbx
ja 0x140049f16
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
ja 0x140049f16
lea rax, [r15 + rdx]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
jmp 0x14004a14e
movabs r14, 0x7fffffffffffffff
mov r8d, dword [r13 + 8]
lea rdx, [rbp - 0x58]
call fcn.14004ad90
nop
mov r8d, 1
lea rdx, [0x1400d6df0]
mov rcx, rax
call fcn.1400094c0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400094c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14004a005
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049ff8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8ce
call fcn.14006a794
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004a04f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a04a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8d4
call fcn.14006a794
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14004a0a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a09d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8da
call fcn.14006a794
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004a204
lea rax, [rbp - 0x28]
cmp rdi, rax
je 0x14004a82d
mov r12, qword [rbp - 0x18]
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rdi + 0x18]
cmp r12, r15
ja 0x14004a113
cmp r15, 8
jb 0x14004a0f0
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.140089350
mov word [rbx + rdi], si
jmp 0x14004a82d
cmp r12, rbx
ja 0x14004a886
mov rcx, r12
or rcx, 7
cmp rcx, rbx
ja 0x14004a147
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
ja 0x14004a147
lea rax, [r15 + rdx]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, r14
ja 0x14004a880
add rcx, rcx
cmp rcx, 0x1000
jb 0x14004a18c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004a880
mov rcx, rax
call fcn.14006a79c
test rax, rax
je 0x14004a904
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004a19e
test rcx, rcx
je 0x14004a19b
call fcn.14006a79c
mov r14, rax
jmp 0x14004a19e
mov r14, rsi
mov qword [rdi + 0x18], rbx
mov rax, qword [rsp + 0x60]
lea rbx, [r12 + r12]
mov qword [rax], r12
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.140089350
mov word [r14 + rbx], si
cmp r15, 8
jb 0x14004a1fc
lea rdx, [r15*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x14004a1f7
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a904
mov rcx, r8
call fcn.14006a794
mov qword [rdi], r14
jmp 0x14004a82d
mov edx, 0x1000
lea rcx, [rbp + 0x630]
test r15b, 8
je 0x14004a21e
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004a224
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x68]
call fcn.1400068b8
nop
mov r8d, 1
lea rdx, [0x1400d6df0]
lea rcx, [rsp + 0x68]
call fcn.1400094c0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400094c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14004a30b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a2fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8e0
call fcn.14006a794
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004a355
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a350
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8e6
call fcn.14006a794
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004a3a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a3a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8ec
call fcn.14006a794
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004a4cd
lea rax, [rbp - 0x28]
cmp rdi, rax
je 0x14004a82d
mov r12, qword [rbp - 0x18]
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rdi + 0x18]
cmp r12, r15
ja 0x14004a41a
cmp r15, 8
jb 0x14004a3f7
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.140089350
mov word [rbx + rdi], si
jmp 0x14004a82d
cmp r12, rbx
ja 0x14004a886
mov rcx, r12
or rcx, 7
cmp rcx, rbx
ja 0x14004a44e
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
ja 0x14004a44e
lea rax, [rdx + r15]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, r14
ja 0x14004a880
add rcx, rcx
cmp rcx, 0x1000
jb 0x14004a493
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004a880
mov rcx, rax
call fcn.14006a79c
test rax, rax
je 0x14004a904
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004a4a5
test rcx, rcx
je 0x14004a4a2
call fcn.14006a79c
mov r14, rax
jmp 0x14004a4a5
mov r14, rsi
mov rax, qword [rsp + 0x60]
mov qword [rax], r12
mov qword [rdi + 0x18], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.140089350
mov word [rbx + r14], si
jmp 0x14004a1c1
mov edx, 0x1000
lea rcx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x68]
call fcn.1400068b8
nop
mov r8d, 1
lea rdx, [0x1400d6df0]
lea rcx, [rsp + 0x68]
call fcn.1400094c0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400094c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14004a5c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a5b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8f2
call fcn.14006a794
movups xmm0, xmmword [rbp - 0x68]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004a610
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a60b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8f8
call fcn.14006a794
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004a664
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a65f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8fe
call fcn.14006a794
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004a6df
lea rax, [rbp - 0x28]
cmp rdi, rax
je 0x14004a82d
mov r12, qword [rbp - 0x18]
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r15, qword [rdi + 0x18]
cmp r12, r15
ja 0x14004a6d1
cmp r15, 8
jb 0x14004a6ae
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.140089350
mov word [rbx + rdi], si
jmp 0x14004a82d
cmp r12, rbx
ja 0x14004a886
jmp 0x14004a11c
lea rdx, [rbp + 0x630]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rsp + 0x40]
call fcn.140004680
nop
lea r8, [0x1400d6df0]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000811c
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14001b5c8
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004618
lea rcx, [rbp - 0x58]
call fcn.140004070
nop
lea rcx, [rsp + 0x68]
call fcn.140004070
nop
lea rcx, [rsp + 0x40]
call fcn.140004070
lea rcx, [rbp - 0x28]
call fcn.1400253e0
test al, al
jne 0x14004a838
mov r8d, 0x1000
lea rdx, [rbp + 0x630]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x30]
lea rdx, [0x1400d7dd8]
lea rcx, [rbp + 0x630]
call fcn.140097e3c
test rax, rax
je 0x14004a828
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140004680
nop
lea r8, [0x1400d6df0]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000811c
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14001b5c8
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004618
lea rcx, [rbp - 0x58]
call fcn.140004070
nop
lea rcx, [rsp + 0x68]
call fcn.140004070
nop
lea rcx, [rsp + 0x40]
call fcn.140004070
lea rcx, [rbp - 0x28]
call fcn.1400253e0
test al, al
jne 0x14004a838
lea r8, [rbp - 0x30]
lea rdx, [0x1400d7dd8]
mov rcx, qword [rbp - 0x30]
call fcn.140097e3c
test rax, rax
jne 0x14004a7a0
mov esi, 0xc0000225
lea rcx, [rbp + 0x28]
call fcn.140027140
jmp 0x14004a848
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.140017420
jmp 0x14004a82d
mov esi, edx
lea rcx, [rbp]
call fcn.140004070
nop
lea rcx, [rbp - 0x28]
call fcn.140004070
mov eax, esi
mov rcx, qword [rbp + 0x2630]
xor rcx, rsp
call fcn.14006a770
add rsp, 0x2748
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400011a0
nop
call fcn.1400094ac
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.1400094ac
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
int3
call fcn.1400011a0
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
int3
call fcn.140095e24
int3