Function at 0x140122170
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2618]
mov eax, 0x2718
call fcn.1403e54f0
sub rsp, rax
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rbp + 0x2600], rax
mov r12, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov r13, qword [rbp + 0x2688]
mov r15, qword [rbp + 0x2690]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x600]
call fcn.14041cf40
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], bx
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.14011e5c0
mov rdx, rax
mov rcx, rsi
call fcn.1400fecf0
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140122263
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012225e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012321c
call fcn.1403e5198
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.14011df50
nop
cmp dword [0x14071a72c], 9
ja 0x140122352
lea r10, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova r10, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x28]
cmp rbx, 7
jb 0x140122352
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x1405390c0]
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x1401222d7
cmp word [rcx], 0x65
je 0x1401222d4
cmp rax, 1
je 0x1401222d7
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x1401222c1
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140122352
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x1405390c0]
sub r9, rax
nop word [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x1401223fd
add rdx, 2
sub r8, 1
jne 0x140122300
sub rcx, r10
sar rcx, 1
jne 0x140122352
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rcx, qword [rbp - 0x38]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.14041c8a0
mov qword [rbp - 0x28], rbx
mov r14, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, r14
je 0x140122677
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140122370
mov rdx, qword [rdx]
xor r8d, r8d
lea rcx, [rbp - 0x38]
call fcn.140123bf0
cmp rax, 0xffffffffffffffff
jne 0x14012238a
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x140122362
cmp rbx, r14
je 0x140122677
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x140122406
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x1401223ae
mov rdi, qword [rdi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 7
jbe 0x1401223bf
mov r8, qword [rdx]
cmp rcx, rax
jne 0x1401223e8
test rcx, rcx
je 0x1401223e4
sub r8, rdi
nop dword [rax]
movzx eax, word [rdi + r8]
cmp ax, word [rdi]
jne 0x1401223e8
add rdi, 2
sub rcx, 1
jne 0x1401223d0
lea rdx, [r9 - 0x20]
cmp rsi, rdx
je 0x140122424
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14012241c
mov rdx, qword [rdx]
jmp 0x14012241c
add rcx, 2
jmp 0x1401222a4
cmp rsi, rdi
je 0x140122424
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x140122419
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rsi
call fcn.1400fe0a0
mov r9, r15
mov r8, r13
mov rdx, rsi
call fcn.140123270
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140123161
cmp ebx, 0xc015001d
je 0x140123161
test byte [rbp + 0x2680], 2
je 0x140122670
xor edx, edx
mov r8d, Ordinal_513
lea rcx, [rbp]
call fcn.14041cf40
mov edx, 0xff
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401224a0
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rsp + 0x60]
call fcn.1400fe2f0
nop
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1401224f8
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 7
cmova rax, qword [rsp + 0x60]
mov dword [rax + rcx*2], 0x5c
lea rax, [rsp + 0x60]
jmp 0x140122517
mov qword [rsp + 0x20], 1
lea r9, [0x1405390bc]
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140111910
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x140122557
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140111740
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.1400fecf0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1401225d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401225ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123222
call fcn.1403e5198
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140122612
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012260d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123228
call fcn.1403e5198
movdqa xmm0, xmmword [0x140539e60]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140123161
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122666
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012322e
call fcn.1403e5198
jmp 0x140123161
xor ebx, ebx
jmp 0x140123161
mov r14d, dword [rbp + 0x2680]
test r14b, 1
jne 0x14012315c
mov r9, r15
mov r8, r13
mov rdx, rsi
call fcn.140123270
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140123161
cmp ebx, 0xc015001d
je 0x140123161
test r14b, 4
jne 0x14012315c
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x1401226ca
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401226e0
xor r12d, r12d
mov ebx, r12d
jmp 0x140123164
xor r15d, r15d
mov qword [rbp - 8], r15
lea r8, [rbp - 8]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x1401227f3
mov ebx, r15d
nop dword [rax]
test rdi, rdi
jne 0x1401227f3
xor edx, edx
mov r8d, Ordinal_513
lea rcx, [rbp + 0x400]
call fcn.14041cf40
xor edx, edx
mov r8d, Ordinal_513
lea rcx, [rbp + 0x200]
call fcn.14041cf40
mov dword [rbp - 0x18], 0xff
mov dword [rbp - 0x10], r15d
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x18]
lea r8, [rbp + 0x400]
mov edx, ebx
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
lea rcx, [rbp + 0x200]
call fcn.140402f74
test eax, eax
jne 0x1401227e5
xor edx, edx
mov r8d, Ordinal_513
lea rcx, [rbp]
call fcn.14041cf40
mov dword [rbp - 0x18], 0xff
mov edx, 0xff
lea rcx, [rbp]
test r14b, 8
je 0x1401227d6
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x1401227dc
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x140122962
inc ebx
cmp ebx, 0x1000
jl 0x140122710
mov rcx, qword [r12 + 0x10]
lea r15, [0x1405390bc]
test rcx, rcx
je 0x1401229fa
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x140123234
cmp qword [r12 + 0x18], 7
jbe 0x14012282b
mov r12, qword [r12]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
mov r9, r12
lea rcx, [rsp + 0x40]
call fcn.140111600
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
lea rcx, [rsp + 0x40]
call fcn.140111740
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.1400fecf0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1401228d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401228d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012323a
call fcn.1403e5198
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14012291a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122915
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123240
call fcn.1403e5198
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401229fd
lea rax, [rbp - 0x58]
cmp rsi, rax
je 0x14012295a
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
mov r8, qword [rbp - 0x48]
cmova rdx, qword [rbp - 0x58]
mov rcx, rsi
call fcn.1400fe0a0
mov ebx, r12d
jmp 0x14012314b
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140122980
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.1400fe2f0
nop
lea r8, [0x1405390bc]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140111330
nop
lea r8, [rbp + 0x200]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140111330
mov rdx, rax
mov rcx, rsi
call fcn.1400fecf0
lea rcx, [rsp + 0x40]
call fcn.1400fdd00
nop
lea rcx, [rsp + 0x60]
call fcn.1400fdd00
nop
lea rcx, [rbp - 0x80]
call fcn.1400fdd00
xor r12d, r12d
mov ebx, r12d
jmp 0x14012314b
xor r12d, r12d
mov r8d, dword [r13 + 8]
lea rdx, [rsp + 0x60]
call fcn.140123950
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
mov edi, 0x5c
cmp rax, 1
jb 0x140122a46
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 7
jbe 0x140122a3b
mov rax, qword [rcx]
mov word [rax + rdx*2], di
mov word [rax + r8*2], r12w
jmp 0x140122a5f
mov qword [rsp + 0x20], 1
mov r9, r15
mov edx, 1
call fcn.140111910
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 7
mov word [rcx], r12w
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
lea rcx, [rsp + 0x40]
call fcn.140111740
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.1400fecf0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140122b1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122b14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123246
call fcn.1403e5198
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140122b5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122b57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012324c
call fcn.1403e5198
movdqa xmm0, xmmword [0x140539e60]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140122bb2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122bad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123252
call fcn.1403e5198
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140122937
mov edx, 0x1000
lea rcx, [rbp + 0x600]
test r14b, 8
je 0x140122be9
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140122bef
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x600]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140122c11
lea rdx, [rbp + 0x600]
lea rcx, [rsp + 0x60]
call fcn.1400fe2f0
nop
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140122c6a
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 7
cmova rax, qword [rsp + 0x60]
mov dword [rax + rcx*2], 0x5c
lea rax, [rsp + 0x60]
jmp 0x140122c85
mov qword [rsp + 0x20], 1
mov r9, r15
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140111910
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
lea rcx, [rsp + 0x40]
call fcn.140111740
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.1400fecf0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140122d40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122d3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123258
call fcn.1403e5198
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140122d82
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122d7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012325e
call fcn.1403e5198
movdqa xmm0, xmmword [0x140539e60]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140122dd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140122dd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123264
call fcn.1403e5198
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140122937
mov edx, 0x1000
lea rcx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x600]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140122e20
lea rdx, [rbp + 0x600]
lea rcx, [rbp - 0x80]
call fcn.1400fe2f0
nop
mov r8, r15
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140111330
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
mov rcx, rax
call fcn.140111740
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.1400fecf0
lea rcx, [rsp + 0x40]
call fcn.1400fdd00
nop
lea rcx, [rsp + 0x60]
call fcn.1400fdd00
nop
lea rcx, [rbp - 0x80]
call fcn.1400fdd00
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140122937
lea rdx, [rbp + 0x600]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x600]
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140122f00
lea rdx, [rbp + 0x600]
lea rcx, [rbp - 0x80]
call fcn.1400fe2f0
nop
mov r8, r15
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140111330
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
mov rcx, rax
call fcn.140111740
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.1400fecf0
lea rcx, [rsp + 0x40]
call fcn.1400fdd00
nop
lea rcx, [rsp + 0x60]
call fcn.1400fdd00
nop
lea rcx, [rbp - 0x80]
call fcn.1400fdd00
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140122937
mov r8d, 0x1000
lea rdx, [rbp + 0x600]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x60]
lea rdx, [0x140539154]
lea rcx, [rbp + 0x600]
call fcn.14040339c
test rax, rax
je 0x140123146
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140123005
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400fe2f0
nop
mov r8d, 1
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140111740
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
lea rcx, [rsp + 0x60]
call fcn.140111740
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.1400fecf0
mov r8, qword [rbp - 0x68]
cmp r8, 7
jbe 0x1401230c4
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.1400fe110
nop
mov r8, qword [rsp + 0x78]
cmp r8, 7
jbe 0x1401230de
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400fe110
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
mov r8, qword [rsp + 0x58]
cmp r8, 7
jbe 0x14012310c
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.1400fe110
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140122937
lea r8, [rbp - 0x60]
lea rdx, [0x140539154]
mov rcx, qword [rbp - 0x60]
call fcn.14040339c
test rax, rax
jne 0x140122ff0
mov ebx, 0xc0000225
mov rcx, qword [rbp - 8]
test rcx, rcx
jle 0x140123164
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140123164
mov ebx, 0xc0000225
xor r12d, r12d
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x1401231a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012319f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012326a
call fcn.1403e5198
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r12w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x1401231f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401231ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140123216
call fcn.1403e5198
mov eax, ebx
mov rcx, qword [rbp + 0x2600]
xor rcx, rsp
call fcn.1403e5550
add rsp, 0x2718
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1400fd2a0
nop
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1403eb834
nop
call fcn.1403eb834
int3