Function at 0x140028670
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2648]
mov eax, 0x2748
call fcn.14004f980
sub rsp, rax
movaps xmmword [rsp + 0x2730], xmm6
movaps xmmword [rsp + 0x2720], xmm7
mov rax, qword [0x14009d020]
xor rax, rsp
mov qword [rbp + 0x2610], rax
mov r15, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov r13, qword [rbp + 0x26b8]
mov r12, qword [rbp + 0x26c0]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x610]
call fcn.140051420
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x68], xmm1
lea rax, [rdi + 0x10]
mov qword [rbp - 0x80], rax
mov qword [rax], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x60]
call fcn.140019970
mov rdx, rax
mov rcx, rdi
call fcn.140005160
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14002877a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028775
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029979
call fcn.14004ed9c
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140019190
nop
cmp dword [0x1400a074c], 9
ja 0x140028862
lea r10, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r10, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x20]
cmp rbx, 7
jb 0x140028862
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x14008dbc0]
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x1400287ee
cmp word [rcx], 0x65
je 0x1400287eb
cmp rax, 1
je 0x1400287ee
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x1400287d8
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140028862
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x14008dbc0]
sub r9, rax
nop dword [rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x1400288fa
add rdx, 2
sub r8, 1
jne 0x140028810
sub rcx, r10
sar rcx, 1
jne 0x140028862
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.140050d50
mov qword [rbp - 0x20], rbx
mov r14, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, r14
je 0x140028b18
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140028880
mov rdx, qword [rdx]
lea rcx, [rbp - 0x30]
call fcn.14002a250
cmp rax, 0xffffffffffffffff
jne 0x14002889a
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r14
jne 0x140028872
cmp rbx, r14
je 0x140028b18
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x140028903
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x1400288be
mov rsi, qword [rsi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x1400288cf
mov r8, qword [rdx]
cmp rcx, rax
jne 0x140028906
test rcx, rcx
je 0x1400288f4
sub r8, rsi
nop dword [rax]
movzx eax, word [r8 + rsi]
cmp ax, word [rsi]
jne 0x140028906
add rsi, 2
sub rcx, 1
jne 0x1400288e0
lea rdx, [r9 - 0x20]
jmp 0x140028906
add rcx, 2
jmp 0x1400287bb
mov rdx, rsi
mov rcx, rdi
call fcn.140014060
mov r9, r12
mov r8, r13
mov rdx, rdi
call fcn.140029a20
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x1400298ae
cmp ebx, 0xc015001d
je 0x1400298ae
test byte [rbp + 0x26b0], 2
je 0x140028b11
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.140051420
mov edx, 0xff
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140028982
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400057a0
nop
mov r8d, 1
lea rdx, [0x14008dbbc]
lea rcx, [rsp + 0x60]
call fcn.14002ad40
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400289f5
mov rdx, qword [rdi]
mov rax, qword [rbp - 0x80]
mov r8, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.14002ad40
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rbp - 0x78]
mov rcx, rdi
call fcn.140005160
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140028a71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028a6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002997f
call fcn.14004ed9c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140028ab3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028aae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029985
call fcn.14004ed9c
movdqa xmm0, xmmword [0x14008ebb0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400298ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028b07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002998b
call fcn.14004ed9c
jmp 0x1400298ae
xor ebx, ebx
jmp 0x1400298ae
mov r14d, dword [rbp + 0x26b0]
test r14b, 1
jne 0x1400298a9
mov r9, r12
mov r8, r13
mov rdx, rdi
call fcn.140029a20
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x1400298ae
cmp ebx, 0xc015001d
je 0x1400298ae
test r14b, 4
jne 0x1400298a9
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140028b6b
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r12d, r12d
cmp eax, 0xffffffff
je 0x140028b81
mov ebx, r12d
jmp 0x1400298b1
mov qword [rbp], r12
lea r8, [rbp]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rsi, eax
test eax, eax
jne 0x140028c90
mov ebx, r12d
nop dword [rax + rax]
test rsi, rsi
jne 0x140028c90
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x410]
call fcn.140051420
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.140051420
mov dword [rbp - 0x10], 0xff
mov dword [rbp - 8], r12d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x410]
mov edx, ebx
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rsi, eax
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0x10]
call fcn.14005a6b4
test eax, eax
jne 0x140028c82
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x210]
call fcn.140051420
mov dword [rbp - 0x10], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x210]
test r14b, 8
je 0x140028c73
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140028c79
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rsi, rsi
je 0x140028f5c
inc ebx
cmp ebx, 0x1000
jl 0x140028bb0
mov rcx, qword [r15 + 0x10]
lea rsi, [0x14008dbbc]
test rcx, rcx
je 0x140028dbc
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x140029991
cmp qword [r15 + 0x18], 8
jb 0x140028cc5
mov r15, qword [r15]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov r9, r15
lea rcx, [rbp - 0x78]
call fcn.14002ac00
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rbp - 0x78]
call fcn.14002ad40
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140028d57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028d52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299a9
call fcn.14004ed9c
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140028d9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028d9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299af
call fcn.14004ed9c
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140029836
mov r8d, dword [r13 + 8]
lea rdx, [rbp - 0x78]
call fcn.140029fb0
nop
mov r8d, 1
mov rdx, rsi
mov rcx, rax
call fcn.14002ad40
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14002ad40
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140028e80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028e7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299b5
call fcn.14004ed9c
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140028eca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028ec5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299bb
call fcn.14004ed9c
movdqa xmm0, xmmword [0x14008ebb0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140028f1e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028f19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299c1
call fcn.14004ed9c
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140029836
mov edx, 0x1000
lea rcx, [rbp + 0x610]
test r14b, 8
je 0x14002911b
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140029121
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x210]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140028f80
lea rdx, [rbp + 0x210]
lea rcx, [rsp + 0x60]
call fcn.1400057a0
nop
mov r8d, 1
lea rdx, [0x14008dbbc]
lea rcx, [rsp + 0x60]
call fcn.14002ad40
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rax, [rbp + 0x10]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140028ff0
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14002ad40
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x78]
mov rcx, rdi
call fcn.140005160
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140029077
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029071
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029997
call fcn.14004ed9c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400290b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400290b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002999d
call fcn.14004ed9c
movdqa xmm0, xmmword [0x14008ebb0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14002988e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002910e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299a3
call fcn.14004ed9c
mov ebx, r12d
jmp 0x140029898
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140029143
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.1400057a0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14002ad40
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14002ad40
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140029218
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029213
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299c7
call fcn.14004ed9c
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140029262
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002925d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299cd
call fcn.14004ed9c
movdqa xmm0, xmmword [0x14008ebb0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400292b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400292b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299d3
call fcn.14004ed9c
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140029836
mov edx, 0x1000
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140029302
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.1400057a0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14002ad40
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14002ad40
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x1400293d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400293d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299d9
call fcn.14004ed9c
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140029421
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002941c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299df
call fcn.14004ed9c
movdqa xmm0, xmmword [0x14008ebb0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140029477
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029472
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299e5
call fcn.14004ed9c
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140029836
lea rdx, [rbp + 0x610]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x1400294c1
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.1400057a0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14002ad40
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14002ad40
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140029596
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029591
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299eb
call fcn.14004ed9c
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400295e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400295db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299f1
call fcn.14004ed9c
movdqa xmm0, xmmword [0x14008ebb0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140029636
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029631
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299f7
call fcn.14004ed9c
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140029836
mov r8d, 0x1000
lea rdx, [rbp + 0x610]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x610]
lea r8, [rbp - 0x58]
lea rdx, [0x14008dc54]
call fcn.14005b610
test rax, rax
je 0x140029893
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x1400296a2
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400057a0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14002ad40
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14002ad40
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140029774
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002976f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400299fd
call fcn.14004ed9c
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400297be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400297b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029a03
call fcn.14004ed9c
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140029814
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002980f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029a09
call fcn.14004ed9c
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140029836
mov rcx, qword [rbp - 0x58]
jmp 0x140029674
lea rax, [rbp - 0x50]
cmp rdi, rax
je 0x14002988e
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r9, qword [rbp - 0x50]
mov rax, qword [rdi + 0x18]
mov rbx, qword [rbp - 0x40]
cmp rbx, rax
ja 0x140029883
cmp rax, 8
jb 0x140029863
mov rdi, qword [rdi]
mov rax, qword [rbp - 0x80]
mov qword [rax], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rdi
call fcn.140050d50
mov word [rdi + rbx*2], r12w
mov ebx, r12d
jmp 0x140029898
mov rdx, rbx
mov rcx, rdi
call fcn.140014740
mov ebx, r12d
jmp 0x140029898
mov ebx, 0xc0000225
mov rcx, qword [rbp]
test rcx, rcx
jle 0x1400298b1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400298b1
mov ebx, 0xc0000225
xor r12d, r12d
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400298f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400298ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029a0f
call fcn.14004ed9c
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14002993e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029939
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029973
call fcn.14004ed9c
mov eax, ebx
mov rcx, qword [rbp + 0x2610]
xor rcx, rsp
call fcn.14004eaf0
movaps xmm6, xmmword [rsp + 0x2730]
movaps xmm7, xmmword [rsp + 0x2720]
add rsp, 0x2748
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.140001470
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
nop
call fcn.14005a558
int3