Function at 0x140026930
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2648]
mov eax, 0x2748
call fcn.1401110f0
sub rsp, rax
movaps xmmword [rsp + 0x2730], xmm6
movaps xmmword [rsp + 0x2720], xmm7
mov rax, qword [0x14030d6e8]
xor rax, rsp
mov qword [rbp + 0x2610], rax
mov r12, r9
mov qword [rbp - 0x60], r9
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rbp + 0x26b8]
mov qword [rbp - 0x58], r15
mov r13, qword [rbp + 0x26c0]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x610]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], bx
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140022c40
mov rdx, rax
mov rcx, r14
call fcn.140002de0
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140026a41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026a3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026a3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.1400224d0
nop
cmp dword [0x14030f97c], 9
ja 0x140026b32
lea r10, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r10, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x18]
cmp rbx, 7
jb 0x140026b32
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x1402ed430]
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x140026ab6
cmp word [rcx], 0x65
je 0x140026ab3
nop
cmp rax, 1
je 0x140026ab6
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x140026aa0
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140026b32
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x1402ed430]
sub r9, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140026bdd
add rdx, 2
sub r8, 1
jne 0x140026ae0
sub rcx, r10
sar rcx, 1
jne 0x140026b32
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x18], rbx
mov rsi, qword [rsi + 8]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x140026ee7
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140026b50
mov rdx, qword [rdx]
lea rcx, [rbp - 0x28]
call fcn.1400284e0
cmp rax, 0xffffffffffffffff
jne 0x140026b6a
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
jne 0x140026b42
cmp rbx, rsi
je 0x140026ee7
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x140026be6
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x140026b8e
mov rdi, qword [rdi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x140026b9f
mov r8, qword [rdx]
cmp rcx, rax
jne 0x140026bc8
test rcx, rcx
je 0x140026bc4
sub r8, rdi
nop dword [rax]
movzx eax, word [r8 + rdi]
cmp ax, word [rdi]
jne 0x140026bc8
add rdi, 2
sub rcx, 1
jne 0x140026bb0
lea rdx, [r9 - 0x20]
cmp r14, rdx
je 0x140026c04
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140026bfc
mov rdx, qword [rdx]
jmp 0x140026bfc
add rcx, 2
jmp 0x140026a82
cmp r14, rdi
je 0x140026c04
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x140026bf9
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r14
call fcn.1400022a0
mov r9, r13
mov r8, r15
mov rdx, r14
call fcn.140027b50
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140027a69
cmp ebx, 0xc015001d
je 0x140027a69
test byte [rbp + 0x26b0], 2
je 0x140026edc
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov edx, 0xff
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor r15d, r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x140026c80
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140027b3e
mov qword [rsp + 0x58], 7
cmp rbx, 8
jae 0x140026ccd
mov qword [rsp + 0x50], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x40], r15w
jmp 0x140026d1f
mov rax, rbx
or rax, 7
cmp rax, rsi
ja 0x140026ce8
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x40]
call fcn.1400028c0
mov rdi, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x10]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r15w
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140026d5b
lea rax, [rcx + 1]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rdx, 8
cmovae rax, qword [rsp + 0x40]
mov dword [rax + rcx*2], 0x5c
lea rax, [rsp + 0x40]
jmp 0x140026d7a
mov qword [rsp + 0x20], 1
lea r9, [0x1402ed42c]
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.1400161a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140026db9
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140016120
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.140002de0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140026e36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026e30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026e30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140026e7b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026e76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026e76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
movdqa xmm0, xmmword [0x1402ee070]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140026edf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026ecf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026ecf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
mov ebx, r15d
jmp 0x140027a69
xor r15d, r15d
mov ebx, r15d
jmp 0x140027a69
mov r15d, dword [rbp + 0x26b0]
test r15b, 1
jne 0x140027a64
mov r9, r13
mov r8, qword [rbp - 0x58]
mov rdx, r14
call fcn.140027b50
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140027a69
cmp ebx, 0xc015001d
je 0x140027a69
test r15b, 4
jne 0x140027a64
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x140026f3b
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r13d, r13d
cmp eax, 0xffffffff
je 0x140026f51
mov ebx, r13d
jmp 0x140027a6c
mov qword [rbp + 8], r13
lea r8, [rbp + 8]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x140027064
mov ebx, r13d
nop dword [rax + rax]
test rdi, rdi
jne 0x140027064
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x410]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x210]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 8], 0xff
mov dword [rbp], r13d
lea rax, [rbp - 8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x30], rax
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 8]
lea r8, [rbp + 0x410]
mov edx, ebx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rbp + 0x210]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140027056
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 8], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x10]
test r15b, 8
je 0x140027047
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14002704d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x1400270e1
inc ebx
cmp ebx, 0x1000
jl 0x140026f80
mov rdi, qword [r12 + 0x10]
mov esi, 0x5c
test rdi, rdi
je 0x1400272aa
movabs rsi, 0x7ffffffffffffffe
mov rax, rsi
sub rax, rdi
cmp rax, 1
jb 0x140027b38
cmp qword [r12 + 0x18], 8
jb 0x1400270a1
mov r12, qword [r12]
mov qword [rbp - 0x60], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r13, [rdi + 1]
mov ebx, 7
lea r12, [rsp + 0x40]
cmp r13, rbx
jbe 0x140027199
mov rbx, r13
or rbx, 7
cmp rbx, rsi
jbe 0x140027177
mov rbx, rsi
jmp 0x140027183
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140027100
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x80]
call fcn.1400024c0
nop
lea r8, [0x1402ed42c]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140015eb0
nop
lea r8, [rbp + 0x210]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140015eb0
mov rdx, rax
mov rcx, r14
call fcn.140002de0
lea rcx, [rsp + 0x60]
call fcn.140002050
nop
lea rcx, [rsp + 0x40]
call fcn.140002050
nop
lea rcx, [rbp - 0x80]
call fcn.140002050
mov ebx, r13d
jmp 0x140027a53
mov ecx, 0xa
cmp rbx, rcx
cmovb rbx, rcx
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x40]
call fcn.1400028c0
mov r12, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rbx
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, qword [rbp - 0x60]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov esi, 0x5c
mov word [rbx + r12], si
xor eax, eax
mov word [r12 + r13*2], ax
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x40]
call fcn.140016120
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r13d, r13d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140027240
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002723b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002723b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
movups xmmword [rbp - 0x48], xmm6
movups xmmword [rbp - 0x38], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14002728d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027288
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027288
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140027a26
mov rax, qword [rbp - 0x58]
mov r8d, dword [rax + 8]
lea rdx, [rsp + 0x40]
call fcn.1400281e0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x1400272f2
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 8
jb 0x1400272e7
mov rax, qword [rcx]
mov word [rax + rdx*2], si
mov word [rax + r8*2], r13w
jmp 0x14002730f
mov qword [rsp + 0x20], 1
lea r9, [0x1402ed42c]
mov edx, 1
call fcn.1400161a0
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 7
mov word [rcx], r13w
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.140016120
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x48]
call fcn.140002de0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1400273cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400273c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400273c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140027412
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002740d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002740d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
movdqa xmm0, xmmword [0x1402ee070]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r13w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14002746b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027466
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027466
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140027a26
mov edx, 0x1000
lea rcx, [rbp + 0x610]
test r15b, 8
je 0x1400274a2
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x1400274a8
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp + 0x610]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400274d0
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x40]
call fcn.1400024c0
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140027529
lea rax, [rcx + 1]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rdx, 8
cmovae rax, qword [rsp + 0x40]
mov dword [rax + rcx*2], 0x5c
lea rax, [rsp + 0x40]
jmp 0x140027548
mov qword [rsp + 0x20], 1
lea r9, [0x1402ed42c]
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.1400161a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.140016120
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x48]
call fcn.140002de0
lea rcx, [rbp - 0x80]
call fcn.140002050
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140027611
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002760c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002760c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
movdqa xmm0, xmmword [0x1402ee070]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r13w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14002766a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027665
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027665
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140027a26
mov edx, 0x1000
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x1400276b2
lea rdx, [rbp + 0x610]
lea rcx, [rbp - 0x80]
call fcn.1400024c0
nop
lea r8, [0x1402ed42c]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140015eb0
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.140016120
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.140002de0
lea rcx, [rsp + 0x60]
call fcn.140002050
nop
lea rcx, [rsp + 0x40]
call fcn.140002050
nop
lea rcx, [rbp - 0x80]
call fcn.140002050
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140027a26
lea rdx, [rbp + 0x610]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140027794
lea rdx, [rbp + 0x610]
lea rcx, [rbp - 0x80]
call fcn.1400024c0
nop
lea r8, [0x1402ed42c]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140015eb0
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.140016120
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.140002de0
lea rcx, [rsp + 0x60]
call fcn.140002050
nop
lea rcx, [rsp + 0x40]
call fcn.140002050
nop
lea rcx, [rbp - 0x80]
call fcn.140002050
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140027a26
mov r8d, 0x1000
lea rdx, [rbp + 0x610]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x610]
lea r8, [rbp - 0x50]
lea rdx, [0x1402ed4c4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
je 0x140027a4e
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400278a0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400024c0
nop
mov r8d, 1
lea rdx, [0x1402ed42c]
lea rcx, [rsp + 0x60]
call fcn.140016120
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x40]
call fcn.140016120
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x48]
call fcn.140002de0
mov r8, qword [rbp - 0x68]
cmp r8, 8
jb 0x140027966
inc r8
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.1400023c0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400279a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002799f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027a18
call fcn.140110974
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400279f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400279f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027a1f
call fcn.140110974
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140027a26
mov rcx, qword [rbp - 0x50]
jmp 0x14002786c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [rbp - 0x48]
cmp r14, rax
je 0x140027a49
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
mov r8, qword [rbp - 0x38]
cmovae rdx, qword [rbp - 0x48]
mov rcx, r14
call fcn.1400022a0
mov ebx, r13d
jmp 0x140027a53
mov ebx, 0xc0000225
mov rcx, qword [rbp + 8]
test rcx, rcx
jle 0x140027a6c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140027a6c
mov ebx, 0xc0000225
xor r13d, r13d
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140027aaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027aaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027aaa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r13w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140027b03
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027afe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027afe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140110974
mov eax, ebx
mov rcx, qword [rbp + 0x2610]
xor rcx, rsp
call fcn.140110ce0
movaps xmm6, xmmword [rsp + 0x2730]
movaps xmm7, xmmword [rsp + 0x2720]
add rsp, 0x2748
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400013e0
nop
call fcn.1400013e0
int3