Function at 0x140015f20
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2628]
mov eax, 0x2728
call fcn.14009aa40
sub rsp, rax
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rbp + 0x2610], rax
mov r13, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [rbp + 0x2698]
mov qword [rbp - 0x58], rax
mov r12, qword [rbp + 0x26a0]
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x610]
call fcn.1400b6650
xor ecx, ecx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], cx
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [r14 + 0x10], rcx
mov qword [r14 + 0x18], 7
mov word [r14], cx
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call fcn.14000e0a0
mov rdx, rax
mov rcx, r14
call fcn.1400095a0
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140016013
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001600e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016fdb
call fcn.14009aa1c
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.14000d8d0
nop
cmp dword [0x1402aab7c], 9
ja 0x140016123
lea rbx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rbx, qword [rbp - 0x28]
mov r11, qword [rbp - 0x18]
cmp r11, 7
jb 0x140016123
lea rsi, [r11 - 6]
lea rsi, [rbx + rsi*2]
mov rax, rbx
lea r8, [0x14011fcd0]
mov qword [rbp], r8
nop
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x14001608c
cmp word [rax], 0x65
je 0x140016089
cmp rcx, 1
je 0x14001608c
dec rcx
add rax, 2
cmp word [rax], 0x65
jne 0x140016076
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140016123
mov r9d, 7
mov rcx, r8
movzx edx, word [rdx]
mov r8d, 0x65
cmp dx, r8w
jb 0x1400160d9
mov r10, rax
sub r10, qword [rbp]
cmp dx, r8w
ja 0x1400160d9
cmp r9, 1
je 0x1400160e9
dec r9
add rcx, 2
movzx edx, word [rcx + r10]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x1400160bb
add rax, 2
lea r8, [0x14011fcd0]
jmp 0x140016060
sub rax, rbx
sar rax, 1
jne 0x140016123
mov eax, 4
cmp r11, rax
cmovb rax, r11
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
sub r11, rax
mov qword [rbp - 0x18], r11
lea r8, [r11*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.1400b76e0
mov rsi, qword [r15 + 8]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x140016458
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140016141
mov rdx, qword [rdx]
lea rcx, [rbp - 0x28]
call fcn.1400179b0
cmp rax, 0xffffffffffffffff
jne 0x140016158
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x140016133
cmp rbx, rsi
je 0x140016458
mov r8, qword [rbx + 0x30]
cmp r8, qword [rbx + 0x38]
je 0x1400161e2
mov rcx, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x140016179
mov rdi, qword [rdi]
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140016187
mov r8, qword [r8]
cmp rax, rcx
jne 0x1400161bf
test rax, rax
je 0x1400161d8
movzx ecx, word [r8]
movzx edx, word [rdi]
cmp cx, dx
jb 0x1400161bf
sub r8, rdi
cmp cx, dx
ja 0x1400161bf
cmp rax, 1
je 0x1400161d8
dec rax
add rdi, 2
movzx ecx, word [r8 + rdi]
movzx edx, word [rdi]
cmp cx, dx
jae 0x1400161a3
mov rdx, qword [rbx + 0x30]
cmp r14, rdx
je 0x140016200
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x1400161f8
mov rdx, qword [rdx]
jmp 0x1400161f8
mov rdx, qword [rbx + 0x38]
sub rdx, 0x20
jmp 0x1400161c3
cmp r14, rdi
je 0x140016200
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x1400161f5
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r14
call fcn.1400098b0
mov r9, r12
mov r8, qword [rbp - 0x58]
mov rdx, r14
call fcn.140017020
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140016f46
cmp ebx, 0xc015001d
je 0x140016f46
test byte [rbp + 0x2690], 2
je 0x140016451
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.1400b6650
mov edx, 0xff
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ebx, ebx
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], bx
lea rax, [rbp + 0x10]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp word [rax + rsi*2], bx
jne 0x140016280
mov r8, rsi
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x68]
call fcn.1400098b0
nop
mov r8, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x80]
mov rax, rdx
sub rax, r8
cmp rax, 1
jb 0x1400162dd
lea rcx, [r8 + 1]
mov qword [rsp + 0x78], rcx
lea rax, [rsp + 0x68]
cmp rdx, 8
cmovae rax, qword [rsp + 0x68]
mov edx, 0x5c
mov word [rax + r8*2], dx
mov word [rax + rcx*2], bx
lea rax, [rsp + 0x68]
jmp 0x140016302
mov qword [rsp + 0x20], 1
lea r9, [0x14011fccc]
movzx r8d, byte [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.1400192c0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140016339
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x48]
call fcn.140018fc0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rbp - 0x78]
mov rcx, r14
call fcn.1400095a0
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400163b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400163ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016fe1
call fcn.14009aa1c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400163f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400163ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016fe7
call fcn.14009aa1c
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140016f46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016447
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016fed
call fcn.14009aa1c
jmp 0x140016f46
xor ebx, ebx
jmp 0x140016f46
mov esi, dword [rbp + 0x2690]
test sil, 1
jne 0x140016f41
mov r9, r12
mov r8, qword [rbp - 0x58]
mov rdx, r14
call fcn.140017020
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140016f46
cmp ebx, 0xc015001d
je 0x140016f46
test sil, 4
jne 0x140016f41
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x1400164ab
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x1400164c1
mov ebx, r15d
jmp 0x140016f49
mov qword [rbp + 8], r15
lea r8, [rbp + 8]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x1400165cf
mov ebx, r15d
nop dword [rax + rax]
test rdi, rdi
jne 0x1400165cf
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x410]
call fcn.1400b6650
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x210]
call fcn.1400b6650
mov dword [rbp - 8], 0xff
mov dword [rbp], r15d
lea rax, [rbp - 8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x30], rax
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 8]
lea r8, [rbp + 0x410]
mov edx, ebx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rbp + 0x210]
call fcn.1400d47b0
test eax, eax
jne 0x1400165c1
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.1400b6650
mov dword [rbp - 8], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x10]
test sil, 8
je 0x1400165b6
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x1400165bc
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x14001663a
inc ebx
cmp ebx, 0x1000
jl 0x1400164f0
mov rdi, qword [r13 + 0x10]
test rdi, rdi
je 0x1400169d1
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rdi
cmp rax, 1
jb 0x140016ff3
cmp qword [r13 + 0x18], 8
jb 0x140016601
mov r13, qword [r13]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
lea r12, [rdi + 1]
mov ebx, 7
lea r15, [rsp + 0x48]
cmp r12, rbx
jbe 0x1400168b9
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x140016897
mov rbx, rcx
jmp 0x1400168a3
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
lea rax, [rbp + 0x10]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140016660
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400098b0
nop
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, r8
cmp rax, 1
jb 0x1400166be
lea rcx, [r8 + 1]
mov qword [rsp + 0x58], rcx
lea rax, [rsp + 0x48]
cmp rdx, 8
cmovae rax, qword [rsp + 0x48]
mov edx, 0x5c
mov word [rax + r8*2], dx
mov word [rax + rcx*2], r15w
lea rax, [rsp + 0x48]
jmp 0x1400166e3
mov qword [rsp + 0x20], 1
lea r9, [0x14011fccc]
movzx r8d, byte [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400192c0
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rax, [rbp + 0x210]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140016714
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x80]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x14001676a
lea rdi, [rcx + rsi]
mov qword [rsp + 0x78], rdi
lea rbx, [rsp + 0x68]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x68]
lea r8, [rsi + rsi]
lea rcx, [rbx + rcx*2]
lea rdx, [rbp + 0x210]
call fcn.1400b76e0
mov word [rbx + rdi*2], r15w
lea rax, [rsp + 0x68]
jmp 0x140016789
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x210]
movzx r8d, byte [rsp + 0x40]
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.1400192c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x78]
mov rcx, r14
call fcn.1400095a0
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400167f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400167ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016ff9
call fcn.14009aa1c
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140016836
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016831
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016fff
call fcn.14009aa1c
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r15w
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140016f26
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001688a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017005
call fcn.14009aa1c
mov ebx, r15d
jmp 0x140016f30
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x48]
call fcn.1400099e0
mov r15, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], rbx
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, r13
mov rcx, r15
call fcn.1400b76e0
mov edx, 0x5c
mov word [r15 + rbx], dx
xor eax, eax
mov word [r15 + r12*2], ax
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x48]
call fcn.140018fc0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x48]
call fcn.1400095a0
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140016972
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001696c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001700b
call fcn.14009aa1c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400169b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400169af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017011
call fcn.14009aa1c
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140016f03
mov rax, qword [rbp - 0x58]
mov r8d, dword [rax + 8]
lea rdx, [rsp + 0x68]
call fcn.140017730
nop
lea r8, [0x14011fccc]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140018e30
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.140018fc0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x48]
call fcn.1400095a0
lea rcx, [rbp - 0x78]
call fcn.140009530
nop
lea rcx, [rsp + 0x48]
call fcn.140009530
nop
lea rcx, [rsp + 0x68]
call fcn.140009530
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140016f03
mov edx, 0x1000
lea rcx, [rbp + 0x610]
test sil, 8
je 0x140016a95
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140016a9b
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
lea rax, [rbp + 0x610]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140016ac0
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x48]
call fcn.1400098b0
nop
lea r8, [0x14011fccc]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.140018e30
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.140018fc0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x48]
call fcn.1400095a0
lea rcx, [rbp - 0x78]
call fcn.140009530
nop
lea rcx, [rsp + 0x68]
call fcn.140009530
nop
lea rcx, [rsp + 0x48]
call fcn.140009530
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140016f03
mov edx, 0x1000
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
lea rax, [rbp + 0x610]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140016bb0
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x48]
call fcn.1400098b0
nop
lea r8, [0x14011fccc]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.140018e30
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.140018fc0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x48]
call fcn.1400095a0
lea rcx, [rbp - 0x78]
call fcn.140009530
nop
lea rcx, [rsp + 0x68]
call fcn.140009530
nop
lea rcx, [rsp + 0x48]
call fcn.140009530
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140016f03
lea rdx, [rbp + 0x610]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
lea rax, [rbp + 0x610]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140016ca0
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x48]
call fcn.1400098b0
nop
lea r8, [0x14011fccc]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.140018e30
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.140018fc0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x48]
call fcn.1400095a0
lea rcx, [rbp - 0x78]
call fcn.140009530
nop
lea rcx, [rsp + 0x68]
call fcn.140009530
nop
lea rcx, [rsp + 0x48]
call fcn.140009530
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140016f03
mov r8d, 0x1000
lea rdx, [rbp + 0x610]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x610]
lea r8, [rbp - 0x50]
lea rdx, [0x14011fd64]
call fcn.1400d578c
test rax, rax
je 0x140016f2b
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r15w
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140016db0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400098b0
nop
mov r8d, 1
lea rdx, [0x14011fccc]
lea rcx, [rsp + 0x68]
call fcn.140018fc0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x48]
call fcn.140018fc0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x48]
call fcn.1400095a0
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140016e94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016e8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017017
call fcn.14009aa1c
nop
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x140016eb1
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140009a50
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x140016ee1
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140009a50
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140016f03
mov rcx, qword [rbp - 0x50]
jmp 0x140016d77
lea rax, [rbp - 0x48]
cmp r14, rax
je 0x140016f26
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
mov r8, qword [rbp - 0x38]
cmovae rdx, qword [rbp - 0x48]
mov rcx, r14
call fcn.1400098b0
mov ebx, r15d
jmp 0x140016f30
mov ebx, 0xc0000225
mov rcx, qword [rbp + 8]
test rcx, rcx
jle 0x140016f49
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140016f49
mov ebx, 0xc0000225
xor r15d, r15d
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140016f85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016f80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016fd5
call fcn.14009aa1c
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r15w
mov r8, qword [rbp - 0x30]
cmp r8, 8
jb 0x140016fb0
inc r8
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x48]
call fcn.140009a50
mov eax, ebx
mov rcx, qword [rbp + 0x2610]
xor rcx, rsp
call fcn.14009a9c0
add rsp, 0x2728
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.140001830
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
int3