Function at 0x14002c700
Capabilities:
Get common file path
Get program files directory
Get startup folder
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1fd0]
mov eax, 0x20d0
call fcn.140216080
sub rsp, rax
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x1fc0], rax
mov rbx, rcx
test rcx, rcx
je 0x14002d95b
mov rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002c754
test rax, rax
je 0x14002d95b
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14002d998
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
cmp rbx, 0x10000
jae 0x14002c79f
movzx edx, bx
lea rcx, [rsp + 0x30]
call fcn.14000d610
jmp 0x14002c7bd
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14002c7a2
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000df90
nop
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 8], 1
jle 0x14002c7da
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000dd30
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
xor r14d, r14d
test rbx, rbx
jne 0x14002c7f0
mov eax, r14d
jmp 0x14002c804
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14024bd08
test eax, eax
js 0x14002d98d
cmp eax, dword [rbx - 0xc]
jg 0x14002d98d
mov dword [rbx - 0x10], eax
mov eax, eax
mov word [rbx + rax*2], r14w
mov edx, dword [rbx - 0x10]
test edx, edx
je 0x14002d91e
cmp edx, 1
jl 0x14002d98d
cmp word [rbx + 2], 0x3a
jne 0x14002d91e
cmp dword [rbx - 8], 1
jle 0x14002c84b
lea rcx, [rsp + 0x30]
call fcn.14000dd30
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
test rbx, rbx
jne 0x14002c85e
mov eax, r14d
jmp 0x14002c872
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14024bd08
test eax, eax
js 0x14002d98d
cmp eax, dword [rbx - 0xc]
jg 0x14002d98d
mov dword [rbx - 0x10], eax
mov eax, eax
mov word [rbx + rax*2], r14w
mov eax, dword [rbx - 0x10]
lea r15d, [rax + rax]
movsxd r12, r15d
mov eax, 2
mul r12
cmovo rax, rsi
mov rcx, rax
call fcn.1400164e0
mov rdi, rax
mov word [rax], r14w
mov r8d, r15d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rsi
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], r14w
jne 0x14002c8c0
mov r8d, ecx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14000df90
mov rcx, rdi
call fcn.140095d64
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx - 0x18]
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.140032ea0
test eax, eax
je 0x14002c95b
mov eax, 2
mul r12
cmovo rax, rsi
mov rcx, rax
call fcn.1400164e0
mov rdi, rax
mov word [rax], r14w
mov r8d, r15d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov rcx, rsi
inc rcx
cmp word [rdi + rcx*2], r14w
jne 0x14002c934
mov r8d, ecx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14000df90
mov rcx, rdi
call fcn.140095d64
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x14002d91e
lea rcx, [rsp + 0x70]
call fcn.1400a64e0
nop
lea rcx, [rbp - 0x68]
call fcn.1400a73ac
nop
mov rax, qword [rbp - 0x80]
movsxd r15, eax
test eax, eax
jle 0x14002c9cb
mov rdi, r14
nop
test rdi, rdi
js 0x14002d9a3
cmp rdi, rax
jge 0x14002d9a3
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax + rdi*8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14002d909
inc rdi
cmp rdi, r15
jge 0x14002c9cb
mov rax, qword [rbp - 0x80]
jmp 0x14002c990
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2b]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002ca11
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x24]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002ca57
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r13, str.Internet_Explorer
mov r15d, 0x7ffffffe
lea r12, str.Windows_NT
test eax, eax
js 0x14002cc04
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14002d9b4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x40]
cmp rax, 0x10000
jae 0x14002caf3
lea rax, [rbp - 0x40]
movzx edx, ax
lea rcx, [rsp + 0x40]
call fcn.14000d610
jmp 0x14002cb1c
lea rcx, [rbp - 0x40]
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002cb00
mov r8d, eax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.14000df90
nop
mov rax, rsi
nop
inc rax
cmp word [r13 + rax*2], 0
jne 0x14002cb20
mov r8d, eax
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.1400157c0
mov rdi, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14002cef9
mov ecx, 0x1000
lea rax, [rbp - 0x40]
nop
cmp word [rax], 0
je 0x14002cb70
add rax, 2
sub rcx, 1
jne 0x14002cb60
mov eax, 0x1000
sub rax, rcx
test rcx, rcx
cmove rax, r14
je 0x14002cbd0
mov edx, 0x1000
sub rdx, rax
lea rcx, [rbp - 0x40]
lea rcx, [rcx + rax*2]
je 0x14002cbc1
mov rax, r15
mov r9, r12
sub r9, rcx
nop dword [rax]
test rax, rax
je 0x14002cbc1
movzx r8d, word [rcx + r9]
test r8w, r8w
je 0x14002cbc1
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x14002cba0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r14w
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14002cef9
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002cbff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002cc49
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002cc8e
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xb]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002ccd3
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002cd18
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x19]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002cd5d
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x16]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002cda2
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x17]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002cde7
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x19]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002ce2c
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x16]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002ce71
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d034
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14002d9b4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
cmp rax, 0x10000
jae 0x14002cf20
lea rax, [rbp - 0x40]
movzx edx, ax
lea rcx, [rsp + 0x48]
call fcn.14000d610
jmp 0x14002cf4c
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d954
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
jmp 0x14002d909
lea rcx, [rbp - 0x40]
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002cf30
mov r8d, eax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x48]
call fcn.14000df90
nop
lea rdx, str.MicrosoftWindows_Virtual_PCVirtual_Applications
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14002cf56
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.1400157c0
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14002d596
mov ecx, 0x1000
lea rax, [rbp - 0x40]
cmp word [rax], 0
je 0x14002cfa0
add rax, 2
sub rcx, 1
jne 0x14002cf90
mov eax, 0x1000
sub rax, rcx
test rcx, rcx
cmove rax, r14
je 0x14002d000
mov edx, 0x1000
sub rdx, rax
lea rcx, [rbp - 0x40]
lea rcx, [rcx + rax*2]
je 0x14002cff1
mov rax, r15
lea r9, str.MicrosoftWindows_SidebarGadgets
sub r9, rcx
test rax, rax
je 0x14002cff1
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x14002cff1
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x14002cfd0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r14w
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14002d596
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d02f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d079
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d0be
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2e]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d103
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 3]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d148
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x28]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d18d
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x18]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d1d2
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 7]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d217
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xd]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d25c
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d2a1
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x27]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d2e6
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2d]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d32b
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x35]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d370
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d3b5
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x37]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d3fa
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x38]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d43f
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1f]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d484
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d4c9
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d523
lea r8, str.MicrosoftInternet_ExplorerQuick_Launch
mov edx, 0x1000
lea rcx, [rbp - 0x40]
call fcn.1402528bc
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d684
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14002d9b4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x40]
cmp rax, 0x10000
jae 0x14002d5bd
lea rax, [rbp - 0x40]
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.14000d610
jmp 0x14002d5e0
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d954
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
jmp 0x14002d909
lea rcx, [rbp - 0x40]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002d5c4
mov r8d, eax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x38]
call fcn.14000df90
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14002d9a9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call fcn.14002dbf0
mov rdi, qword [rsp + 0x58]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
nop
lea rdx, [rdi - 0x18]
test eax, eax
mov eax, esi
jne 0x14002d64d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d63f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
jmp 0x14002cefd
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d661
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d67f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d809
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14002d9b4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
cmp rax, 0x10000
jae 0x14002d70c
lea rax, [rbp - 0x40]
movzx edx, ax
lea rcx, [rsp + 0x50]
call fcn.14000d610
jmp 0x14002d72f
lea rcx, [rbp - 0x40]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002d713
mov r8d, eax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x50]
call fcn.14000df90
nop
mov rax, rsi
inc rax
cmp word [r13 + rax*2], 0
jne 0x14002d732
mov r8d, eax
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.1400157c0
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14002d93b
mov ecx, 0x1000
lea rax, [rbp - 0x40]
cmp word [rax], 0
je 0x14002d781
add rax, 2
sub rcx, 1
jne 0x14002d771
mov eax, 0x1000
sub rax, rcx
test rcx, rcx
cmove rax, r14
je 0x14002d7d5
mov edx, 0x1000
sub rdx, rax
lea rcx, [rbp - 0x40]
lea rcx, [rcx + rax*2]
je 0x14002d7c6
sub r12, rcx
test r15, r15
je 0x14002d7c6
movzx eax, word [rcx + r12]
test ax, ax
je 0x14002d7c6
mov word [rcx], ax
add rcx, 2
dec r15
sub rdx, 1
jne 0x14002d7a7
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r14w
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14002d93b
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d804
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d84e
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002d893
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp - 0x40]
call fcn.140241ba0
mov r8d, 0x1000
lea rdx, [rbp - 0x40]
lea rcx, str._ProgramFiles_Windows_SidebarGadgets
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1402d8658]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x14002d903
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14002d903
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14002d909
mov r14d, 1
lea rcx, [rbp - 0x68]
call fcn.1400a73cc
nop
lea rcx, [rsp + 0x70]
call fcn.1400a6500
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14002d936
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r14d
jmp 0x14002d95d
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d954
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
jmp 0x14002d909
xor eax, eax
mov rcx, qword [rbp + 0x1fc0]
xor rcx, rsp
call fcn.1402155d0
lea r11, [rsp + 0x20d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
int3