Function at 0x14001ee60
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2658]
mov eax, 0x2758
call fcn.14004b710
sub rsp, rax
movaps xmmword [rsp + 0x2740], xmm6
movaps xmmword [rsp + 0x2730], xmm7
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rbp + 0x2620], rax
mov r12, r9
mov qword [rbp + 8], r9
mov rsi, r8
mov r14, rdx
mov qword [rbp - 0x50], rcx
mov rax, qword [rbp + 0x26c8]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x26d0]
mov qword [rbp], rax
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x620]
call fcn.14004d310
xor edi, edi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], di
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.14001b390
mov rdx, rax
mov rcx, r14
call fcn.1400152f0
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001ef70
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ef6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff4e
call fcn.14004aa40
mov rdx, r14
lea rcx, [rbp - 0x20]
call fcn.14001ac70
nop
cmp dword [0x1400bec9c], 9
ja 0x14001f085
lea rbx, [rbp - 0x20]
mov r12, qword [rbp - 0x20]
mov r13, qword [rbp - 8]
cmp r13, 8
cmovae rbx, r12
mov r11, qword [rbp - 0x10]
cmp r11, 7
jb 0x14001f081
lea r15, [r11 - 6]
lea r15, [rbx + r15*2]
mov rax, rbx
lea r8, [0x1400ab840]
mov qword [rbp - 0x60], r8
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov rdx, rdi
je 0x14001efec
cmp word [rax], 0x65
je 0x14001efe9
cmp rcx, 1
je 0x14001efec
dec rcx
add rax, 2
cmp word [rax], 0x65
jne 0x14001efd6
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14001f081
mov r9d, 7
mov rcx, r8
movzx edx, word [rdx]
mov r8d, 0x65
cmp dx, r8w
jb 0x14001f039
mov r10, rax
sub r10, qword [rbp - 0x60]
cmp dx, r8w
ja 0x14001f039
cmp r9, 1
je 0x14001f049
dec r9
add rcx, 2
movzx edx, word [rcx + r10]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x14001f01b
add rax, 2
lea r8, [0x1400ab840]
jmp 0x14001efc2
sub rax, rbx
sar rax, 1
jne 0x14001f081
mov eax, 4
cmp r11, rax
cmovb rax, r11
lea rcx, [rbp - 0x20]
cmp r13, 8
cmovae rcx, r12
sub r11, rax
mov qword [rbp - 0x10], r11
lea r8, [r11*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.14004cc60
mov r12, qword [rbp + 8]
mov r13, qword [rbp - 0x50]
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x14001f378
nop dword [rax]
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14001f0ae
mov rdx, qword [rdx]
lea rcx, [rbp - 0x20]
call fcn.140020800
cmp rax, 0xffffffffffffffff
jne 0x14001f0c8
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r15
jne 0x14001f0a0
cmp rbx, r15
je 0x14001f378
mov r8, qword [rbx + 0x30]
cmp r8, qword [rbx + 0x38]
je 0x14001f152
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x14001f0e9
mov rsi, qword [rsi]
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14001f0f7
mov r8, qword [r8]
cmp rax, rcx
jne 0x14001f12f
test rax, rax
je 0x14001f148
movzx ecx, word [r8]
movzx edx, word [rsi]
cmp cx, dx
jb 0x14001f12f
sub r8, rsi
cmp cx, dx
ja 0x14001f12f
cmp rax, 1
je 0x14001f148
dec rax
add rsi, 2
movzx ecx, word [r8 + rsi]
movzx edx, word [rsi]
cmp cx, dx
jae 0x14001f113
mov rdx, qword [rbx + 0x30]
cmp r14, rdx
je 0x14001f170
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14001f168
mov rdx, qword [rdx]
jmp 0x14001f168
mov rdx, qword [rbx + 0x38]
sub rdx, 0x20
jmp 0x14001f133
cmp r14, rsi
je 0x14001f170
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x14001f165
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, r14
call fcn.1400072c0
mov r9, qword [rbp]
mov r8, qword [rbp - 0x58]
mov rdx, r14
call fcn.14001ffc0
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14001fefe
cmp eax, 0xc015001d
je 0x14001fefe
test byte [rbp + 0x26c0], 2
je 0x14001ff00
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x20]
call fcn.14004d310
mov edx, 0xff
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
lea rax, [rbp + 0x20]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14001f1f0
mov r8, rbx
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400072c0
nop
mov r8d, 1
lea rdx, [0x1400ab83c]
lea rcx, [rsp + 0x60]
call fcn.140006810
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14001f25f
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140006810
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.1400152f0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14001f2d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f2d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff54
call fcn.14004aa40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001f31a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f315
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff5a
call fcn.14004aa40
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001ff00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f36e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff60
call fcn.14004aa40
jmp 0x14001ff00
mov r15d, dword [rbp + 0x26c0]
test r15b, 1
jne 0x14001f3b9
mov r9, qword [rbp]
mov r13, qword [rbp - 0x58]
mov r8, r13
mov rdx, r14
call fcn.14001ffc0
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14001fefe
cmp eax, 0xc015001d
je 0x14001fefe
test r15b, 4
je 0x14001f3c3
mov edi, 0xc0000225
jmp 0x14001ff00
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x14001f3d0
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001ff00
mov qword [rbp + 0x10], rdi
lea r8, [rbp + 0x10]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rsi, eax
test eax, eax
jne 0x14001f4ef
mov ebx, edi
nop dword [rax + rax]
test rsi, rsi
jne 0x14001f4ef
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x420]
call fcn.14004d310
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x20]
call fcn.14004d310
mov dword [rbp], 0xff
mov dword [rbp + 8], edi
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp]
lea r8, [rbp + 0x420]
mov edx, ebx
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rsi, eax
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rcx, [rbp + 0x20]
call fcn.140058944
test eax, eax
jne 0x14001f4e1
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x220]
call fcn.14004d310
mov dword [rbp], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x220]
test r15b, 8
je 0x14001f4d2
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14001f4d8
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rsi, rsi
je 0x14001f7b8
inc ebx
cmp ebx, 0x1000
jl 0x14001f410
mov rcx, qword [r12 + 0x10]
lea rsi, [0x1400ab83c]
test rcx, rcx
je 0x14001f61d
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x14001ff66
cmp qword [r12 + 0x18], 8
jb 0x14001f527
mov r12, qword [r12]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov r9, r12
lea rcx, [rbp - 0x80]
call fcn.140009320
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rbp - 0x80]
call fcn.140006810
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14001f5b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f5b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff7e
call fcn.14004aa40
movups xmmword [rbp - 0x40], xmm6
movups xmmword [rbp - 0x30], xmm7
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14001f600
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f5fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff84
call fcn.14004aa40
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001fb2e
mov r8d, dword [r13 + 8]
lea rdx, [rbp - 0x80]
call fcn.140020580
nop
mov r8d, 1
mov rdx, rsi
mov rcx, rax
call fcn.140006810
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140006810
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14001f6dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f6d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff8a
call fcn.14004aa40
movups xmmword [rbp - 0x40], xmm6
movups xmmword [rbp - 0x30], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001f727
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f722
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff90
call fcn.14004aa40
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14001f77a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f775
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff96
call fcn.14004aa40
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001fb2e
mov edx, 0x1000
lea rcx, [rbp + 0x620]
test r15b, 8
je 0x14001f976
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14001f97c
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
lea rax, [rbp + 0x220]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14001f7e1
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x60]
call fcn.1400072c0
nop
mov r8d, 1
lea rdx, [0x1400ab83c]
lea rcx, [rsp + 0x60]
call fcn.140006810
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rax, [rbp + 0x20]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14001f850
mov r8, rbx
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140006810
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.1400152f0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14001f8d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f8d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff6c
call fcn.14004aa40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001f918
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f913
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff72
call fcn.14004aa40
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001fee5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f96c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff78
call fcn.14004aa40
jmp 0x14001fee5
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
lea rax, [rbp + 0x620]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14001f9a5
lea rdx, [rbp + 0x620]
lea rcx, [rsp + 0x60]
call fcn.1400072c0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140006810
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140006810
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14001fa76
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fa71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff9c
call fcn.14004aa40
movups xmmword [rbp - 0x40], xmm6
movups xmmword [rbp - 0x30], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001fac0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fabb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ffa2
call fcn.14004aa40
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001fb15
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fb10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ffa8
call fcn.14004aa40
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001fb5a
lea rax, [rbp - 0x40]
cmp r14, rax
je 0x14001fee5
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x30]
mov rcx, r14
call fcn.1400072c0
jmp 0x14001fee5
mov edx, 0x1000
lea rcx, [rbp + 0x620]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
lea rax, [rbp + 0x620]
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14001fb90
lea rdx, [rbp + 0x620]
lea rcx, [rsp + 0x60]
call fcn.1400072c0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140006810
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140006810
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14001fc61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fc5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ffae
call fcn.14004aa40
movups xmmword [rbp - 0x40], xmm6
movups xmmword [rbp - 0x30], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001fcab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fca6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ffb4
call fcn.14004aa40
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001fd00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fcfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff48
call fcn.14004aa40
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001fb2e
lea rdx, [rbp + 0x620]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x40], rdi
movdqa xmm0, xmmword [0x1400acb20]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rax, [rbp + 0x620]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14001fd50
mov r8, rbx
lea rdx, [rbp + 0x620]
lea rcx, [rsp + 0x40]
call fcn.1400072c0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140006810
mov qword [rsp + 0x60], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140006810
mov qword [rbp - 0x80], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140007440
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.1400152f0
lea rcx, [rbp - 0x80]
call fcn.140002400
nop
lea rcx, [rsp + 0x60]
call fcn.140002400
nop
lea rcx, [rsp + 0x40]
call fcn.140002400
lea rcx, [rbp - 0x40]
call fcn.14001b460
test al, al
jne 0x14001fef0
mov r8d, 0x1000
lea rdx, [rbp + 0x620]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x48]
lea rdx, [0x1400ab8d4]
lea rcx, [rbp + 0x620]
call fcn.1400597d0
test rax, rax
je 0x14001fee0
nop dword [rax + rax]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140006890
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140020fd0
nop
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140021040
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400152f0
lea rcx, [rbp - 0x80]
call fcn.140002400
nop
lea rcx, [rsp + 0x60]
call fcn.140002400
nop
lea rcx, [rsp + 0x40]
call fcn.140002400
lea rcx, [rbp - 0x40]
call fcn.14001b460
test al, al
jne 0x14001fef0
lea r8, [rbp - 0x48]
lea rdx, [0x1400ab8d4]
mov rcx, qword [rbp - 0x48]
call fcn.1400597d0
test rax, rax
jne 0x14001fe60
mov edi, 0xc0000225
lea rcx, [rbp + 0x10]
call fcn.1400207c0
jmp 0x14001ff00
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.1400152c0
jmp 0x14001fee5
mov edi, eax
lea rcx, [rbp - 0x20]
call fcn.140002400
nop
lea rcx, [rbp - 0x40]
call fcn.140002400
mov eax, edi
mov rcx, qword [rbp + 0x2620]
xor rcx, rsp
call fcn.14004aa20
movaps xmm6, xmmword [rsp + 0x2740]
movaps xmm7, xmmword [rsp + 0x2730]
add rsp, 0x2758
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140001390
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
nop
call fcn.140057ca0
int3