Function at 0x1400268b0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2648]
mov eax, 0x2748
call fcn.140114370
sub rsp, rax
movaps xmmword [rsp + 0x2730], xmm6
movaps xmmword [rsp + 0x2720], xmm7
mov rax, qword [0x140287748]
xor rax, rsp
mov qword [rbp + 0x2610], rax
mov r12, r9
mov qword [rbp - 0x60], r9
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rbp + 0x26b8]
mov qword [rbp - 0x58], r15
mov r13, qword [rbp + 0x26c0]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x610]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], bx
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140022cd0
mov rdx, rax
mov rcx, r14
call fcn.140002dc0
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400269c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400269bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400269bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.1400224d0
nop
cmp dword [0x14028a60c], 9
ja 0x140026ab2
lea r10, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r10, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x18]
cmp rbx, 7
jb 0x140026ab2
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x1401c5b50]
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x140026a36
cmp word [rcx], 0x65
je 0x140026a33
nop
cmp rax, 1
je 0x140026a36
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x140026a20
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140026ab2
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x1401c5b50]
sub r9, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140026b5d
add rdx, 2
sub r8, 1
jne 0x140026a60
sub rcx, r10
sar rcx, 1
jne 0x140026ab2
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x18], rbx
mov rsi, qword [rsi + 8]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x140026e67
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140026ad0
mov rdx, qword [rdx]
lea rcx, [rbp - 0x28]
call fcn.140028460
cmp rax, 0xffffffffffffffff
jne 0x140026aea
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
jne 0x140026ac2
cmp rbx, rsi
je 0x140026e67
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x140026b66
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x140026b0e
mov rdi, qword [rdi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x140026b1f
mov r8, qword [rdx]
cmp rcx, rax
jne 0x140026b48
test rcx, rcx
je 0x140026b44
sub r8, rdi
nop dword [rax]
movzx eax, word [r8 + rdi]
cmp ax, word [rdi]
jne 0x140026b48
add rdi, 2
sub rcx, 1
jne 0x140026b30
lea rdx, [r9 - 0x20]
cmp r14, rdx
je 0x140026b84
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140026b7c
mov rdx, qword [rdx]
jmp 0x140026b7c
add rcx, 2
jmp 0x140026a02
cmp r14, rdi
je 0x140026b84
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x140026b79
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r14
call fcn.1400023c0
mov r9, r13
mov r8, r15
mov rdx, r14
call fcn.140027ad0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x1400279e9
cmp ebx, 0xc015001d
je 0x1400279e9
test byte [rbp + 0x26b0], 2
je 0x140026e5c
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov edx, 0xff
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor r15d, r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x140026c00
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140027abe
mov qword [rsp + 0x58], 7
cmp rbx, 8
jae 0x140026c4d
mov qword [rsp + 0x50], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x40], r15w
jmp 0x140026c9f
mov rax, rbx
or rax, 7
cmp rax, rsi
ja 0x140026c68
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x40]
call fcn.1400028e0
mov rdi, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x10]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r15w
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140026cdb
lea rax, [rcx + 1]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rdx, 8
cmovae rax, qword [rsp + 0x40]
mov dword [rax + rcx*2], 0x5c
lea rax, [rsp + 0x40]
jmp 0x140026cfa
mov qword [rsp + 0x20], 1
lea r9, [0x1401c5b4c]
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.140016220
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140026d39
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400161a0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.140002dc0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140026db6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026db0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026db0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140026dfb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026df6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026df6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
movdqa xmm0, xmmword [0x1401c67a0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140026e5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026e4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026e4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
mov ebx, r15d
jmp 0x1400279e9
xor r15d, r15d
mov ebx, r15d
jmp 0x1400279e9
mov r15d, dword [rbp + 0x26b0]
test r15b, 1
jne 0x1400279e4
mov r9, r13
mov r8, qword [rbp - 0x58]
mov rdx, r14
call fcn.140027ad0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x1400279e9
cmp ebx, 0xc015001d
je 0x1400279e9
test r15b, 4
jne 0x1400279e4
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x140026ebb
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r13d, r13d
cmp eax, 0xffffffff
je 0x140026ed1
mov ebx, r13d
jmp 0x1400279ec
mov qword [rbp + 8], r13
lea r8, [rbp + 8]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x140026fe4
mov ebx, r13d
nop dword [rax + rax]
test rdi, rdi
jne 0x140026fe4
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x410]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x210]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 8], 0xff
mov dword [rbp], r13d
lea rax, [rbp - 8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x30], rax
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 8]
lea r8, [rbp + 0x410]
mov edx, ebx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rbp + 0x210]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140026fd6
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 8], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x10]
test r15b, 8
je 0x140026fc7
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140026fcd
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x140027061
inc ebx
cmp ebx, 0x1000
jl 0x140026f00
mov rdi, qword [r12 + 0x10]
mov esi, 0x5c
test rdi, rdi
je 0x14002722a
movabs rsi, 0x7ffffffffffffffe
mov rax, rsi
sub rax, rdi
cmp rax, 1
jb 0x140027ab8
cmp qword [r12 + 0x18], 8
jb 0x140027021
mov r12, qword [r12]
mov qword [rbp - 0x60], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r13, [rdi + 1]
mov ebx, 7
lea r12, [rsp + 0x40]
cmp r13, rbx
jbe 0x140027119
mov rbx, r13
or rbx, 7
cmp rbx, rsi
jbe 0x1400270f7
mov rbx, rsi
jmp 0x140027103
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140027080
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x80]
call fcn.1400025e0
nop
lea r8, [0x1401c5b4c]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140015f30
nop
lea r8, [rbp + 0x210]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140015f30
mov rdx, rax
mov rcx, r14
call fcn.140002dc0
lea rcx, [rsp + 0x60]
call fcn.1400020b0
nop
lea rcx, [rsp + 0x40]
call fcn.1400020b0
nop
lea rcx, [rbp - 0x80]
call fcn.1400020b0
mov ebx, r13d
jmp 0x1400279d3
mov ecx, 0xa
cmp rbx, rcx
cmovb rbx, rcx
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x40]
call fcn.1400028e0
mov r12, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rbx
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, qword [rbp - 0x60]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov esi, 0x5c
mov word [rbx + r12], si
xor eax, eax
mov word [r12 + r13*2], ax
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x40]
call fcn.1400161a0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r13d, r13d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1400271c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400271bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400271bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
movups xmmword [rbp - 0x48], xmm6
movups xmmword [rbp - 0x38], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14002720d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027208
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027208
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400279a6
mov rax, qword [rbp - 0x58]
mov r8d, dword [rax + 8]
lea rdx, [rsp + 0x40]
call fcn.140028160
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x140027272
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 8
jb 0x140027267
mov rax, qword [rcx]
mov word [rax + rdx*2], si
mov word [rax + r8*2], r13w
jmp 0x14002728f
mov qword [rsp + 0x20], 1
lea r9, [0x1401c5b4c]
mov edx, 1
call fcn.140016220
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 7
mov word [rcx], r13w
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.1400161a0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x48]
call fcn.140002dc0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14002734d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027347
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027347
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140027392
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002738d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002738d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
movdqa xmm0, xmmword [0x1401c67a0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r13w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400273eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400273e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400273e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400279a6
mov edx, 0x1000
lea rcx, [rbp + 0x610]
test r15b, 8
je 0x140027422
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140027428
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp + 0x610]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140027450
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x40]
call fcn.1400025e0
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400274a9
lea rax, [rcx + 1]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rdx, 8
cmovae rax, qword [rsp + 0x40]
mov dword [rax + rcx*2], 0x5c
lea rax, [rsp + 0x40]
jmp 0x1400274c8
mov qword [rsp + 0x20], 1
lea r9, [0x1401c5b4c]
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.140016220
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.1400161a0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x48]
call fcn.140002dc0
lea rcx, [rbp - 0x80]
call fcn.1400020b0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140027591
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002758c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002758c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
movdqa xmm0, xmmword [0x1401c67a0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r13w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400275ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400275e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400275e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400279a6
mov edx, 0x1000
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140027632
lea rdx, [rbp + 0x610]
lea rcx, [rbp - 0x80]
call fcn.1400025e0
nop
lea r8, [0x1401c5b4c]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140015f30
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.1400161a0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.140002dc0
lea rcx, [rsp + 0x60]
call fcn.1400020b0
nop
lea rcx, [rsp + 0x40]
call fcn.1400020b0
nop
lea rcx, [rbp - 0x80]
call fcn.1400020b0
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400279a6
lea rdx, [rbp + 0x610]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140027714
lea rdx, [rbp + 0x610]
lea rcx, [rbp - 0x80]
call fcn.1400025e0
nop
lea r8, [0x1401c5b4c]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140015f30
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.1400161a0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.140002dc0
lea rcx, [rsp + 0x60]
call fcn.1400020b0
nop
lea rcx, [rsp + 0x40]
call fcn.1400020b0
nop
lea rcx, [rbp - 0x80]
call fcn.1400020b0
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400279a6
mov r8d, 0x1000
lea rdx, [rbp + 0x610]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x610]
lea r8, [rbp - 0x50]
lea rdx, [0x1401c5be4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
je 0x1400279ce
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140027820
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400025e0
nop
mov r8d, 1
lea rdx, [0x1401c5b4c]
lea rcx, [rsp + 0x60]
call fcn.1400161a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x40]
call fcn.1400161a0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x48]
call fcn.140002dc0
mov r8, qword [rbp - 0x68]
cmp r8, 8
jb 0x1400278e6
inc r8
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.1400024e0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140027924
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002791f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027998
call fcn.140113d64
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140027976
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027971
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002799f
call fcn.140113d64
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400279a6
mov rcx, qword [rbp - 0x50]
jmp 0x1400277ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [rbp - 0x48]
cmp r14, rax
je 0x1400279c9
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
mov r8, qword [rbp - 0x38]
cmovae rdx, qword [rbp - 0x48]
mov rcx, r14
call fcn.1400023c0
mov ebx, r13d
jmp 0x1400279d3
mov ebx, 0xc0000225
mov rcx, qword [rbp + 8]
test rcx, rcx
jle 0x1400279ec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400279ec
mov ebx, 0xc0000225
xor r13d, r13d
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140027a2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027a2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027a2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r13w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140027a83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027a7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027a7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113d64
mov eax, ebx
mov rcx, qword [rbp + 0x2610]
xor rcx, rsp
call fcn.1401140d0
movaps xmm6, xmmword [rsp + 0x2730]
movaps xmm7, xmmword [rsp + 0x2720]
add rsp, 0x2748
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140001450
nop
call fcn.140001450
int3