Function at 0x140017288
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x620
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0x610], rax
mov r12, rcx
mov qword [r11 - 0x588], rcx
mov ecx, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [r12 + 0x20], rcx
xor ebx, ebx
mov qword [r12 + 0x18], rbx
mov byte [r12 + 8], bl
mov qword [r12 + 0x48], rcx
mov qword [r12 + 0x40], rbx
mov byte [r12 + 0x30], bl
mov qword [r12 + 0x70], rcx
mov qword [r12 + 0x68], rbx
mov byte [r12 + 0x58], bl
mov qword [r12 + 0x98], rcx
mov qword [r12 + 0x90], rbx
mov byte [r12 + 0x80], bl
mov qword [r12 + 0xc0], rcx
mov qword [r12 + 0xb8], rbx
mov byte [r12 + 0xa8], bl
mov qword [r12 + 0xe8], rcx
mov qword [r12 + 0xe0], rbx
mov byte [r12 + 0xd0], bl
mov qword [r12 + 0x110], rcx
mov qword [r12 + 0x108], rbx
mov byte [r12 + 0xf8], bl
lea rcx, [r12 + 0x120]
call fcn.140017224
nop
mov dword [r12 + 0x160], ebx
mov byte [rsp + 0xf0], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0xf1]
call fcn.1400988d0
mov qword [rsp + 0x58], 0xffffffff80000002
call fcn.14005c0a8
neg eax
sbb r9d, r9d
and r9d, 0x200
add r9d, 0x20019
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x14001744e
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x60], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, str.ProgramFilesDir
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ebp, [rbx + 8]
lea rsi, [0x14010f570]
cmp eax, ebx
je 0x140017442
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.CSetupWrapperApp:_RegQueryValueEx_HKLMSoftwareMicrosoftWindowsCurrentVersion____ProgramFilesDir__Failed_with__d___
mov edx, ebp
mov rcx, rsi
call fcn.140001000
mov rcx, qword [rsp + 0x58]
call fcn.14004e608
jmp 0x14001746e
mov r9d, eax
lea r8, str.Could_not_open_CurrentVersion_reg_key.__error_d
mov ebp, 8
mov edx, ebp
lea rsi, [0x14010f570]
mov rcx, rsi
call fcn.140001000
lea r9, [rsp + 0xf0]
lea r8, str.Program_Filesx86_s
mov edx, 0x80
mov rcx, rsi
call fcn.140001000
lea r11, [rsp + 0xf0]
cmp r11, rbx
je 0x1400174cb
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
cmp rax, rbx
jbe 0x1400174cb
cmp byte [rsp + rax + 0xef], 0x5c
je 0x1400174cb
lea rdx, [rax + 2]
lea r8, [0x1400c55c0]
lea rcx, [rsp + 0xf0]
call fcn.140098ed8
mov qword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x38], bl
lea rcx, str._Program_Filesx86_
call fcn.1400980d0
mov r8, rax
lea rdx, str._Program_Filesx86_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017546
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
lea rcx, str._ProgramFilesx86_
call fcn.1400980d0
mov r8, rax
lea rdx, str._ProgramFilesx86_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x1400175c3
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
lea rcx, str._PFx86_
call fcn.1400980d0
mov r8, rax
lea rdx, str._PFx86_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017640
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
lea rcx, [r12 + 0xf0]
call fcn.14000352c
xor r13d, r13d
mov byte [rsp + 0xf0], r13b
mov qword [rsp + 0x58], 0xffffffff80000002
call fcn.14005c0a8
neg eax
sbb r9d, r9d
and r9d, 0x100
add r9d, 0x20019
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r13d
jne 0x140017721
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x64], 0x104
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.ProgramFilesDir
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r13d
je 0x140017715
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.CSetupWrapperApp:_RegQueryValueEx_HKLMSoftwareMicrosoftWindowsCurrentVersion____ProgramFilesDir__Failed_with__d___
mov edx, ebp
mov rcx, rsi
call fcn.140001000
mov rcx, qword [rsp + 0x58]
call fcn.14004e608
jmp 0x140017735
mov r9d, eax
lea r8, str.Could_not_open_CurrentVersion_reg_key.__error_d
mov edx, ebp
mov rcx, rsi
call fcn.140001000
lea r9, [rsp + 0xf0]
lea r8, str.Program_Files_s
mov edx, 0x80
mov rcx, rsi
call fcn.140001000
lea r11, [rsp + 0xf0]
cmp r11, r13
je 0x140017792
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
cmp rax, r13
jbe 0x140017792
cmp byte [rsp + rax + 0xef], 0x5c
je 0x140017792
lea rdx, [rax + 2]
lea r8, [0x1400c55c0]
lea rcx, [rsp + 0xf0]
call fcn.140098ed8
mov qword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._Program_Files_
call fcn.1400980d0
mov r8, rax
lea rdx, str._Program_Files_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x14001780e
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._ProgramFiles_
call fcn.1400980d0
mov r8, rax
lea rdx, str._ProgramFiles_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x14001788a
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._PF_
call fcn.1400980d0
mov r8, rax
lea rdx, str._PF_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017906
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
lea rcx, [r12 + 0xc8]
call fcn.14000352c
mov byte [rsp + 0xf0], r13b
xor ecx, ecx
call fcn.14005c0a8
mov edx, 0x104
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, r13d
jne 0x14001796c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.CSetupWrapperApp:_GetSystemDirectory___with__d___
mov edx, ebp
mov rcx, rsi
call fcn.140001000
call fcn.14005c0a8
lea r11, [rsp + 0xf0]
cmp r11, r13
je 0x1400179b2
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
cmp rax, r13
jbe 0x1400179b2
cmp byte [rsp + rax + 0xef], 0x5c
je 0x1400179b2
lea rdx, [rax + 2]
lea r8, [0x1400c55c0]
lea rcx, [rsp + 0xf0]
call fcn.140098ed8
call fcn.14004c7b0
cmp eax, r13d
je 0x140017c82
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
lea rcx, [r12 + 0x28]
call fcn.14000352c
mov r14d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._System_
call fcn.1400980d0
mov r8, rax
lea rdx, str._System_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017a60
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._Sys_
call fcn.1400980d0
mov r8, rax
lea rdx, str._Sys_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017ad8
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
lea r8, str..._system32_
mov edx, 0x104
lea rcx, [rsp + 0xf0]
call fcn.140098ed8
mov byte [rsp + 0x200], r13b
xor edx, edx
mov r8d, 0x40f
lea rcx, [rsp + 0x201]
call fcn.1400988d0
mov r8d, 0x410
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea r11, [rsp + 0x200]
cmp r11, r13
je 0x140017b6b
lea rcx, [rsp + 0x200]
call fcn.1400980d0
cmp rax, r13
jbe 0x140017b6b
cmp byte [rsp + rax + 0x1ff], 0x5c
je 0x140017b6b
lea rdx, [rax + 2]
lea r8, [0x1400c55c0]
lea rcx, [rsp + 0x200]
call fcn.140098ed8
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._System32_
call fcn.1400980d0
mov r8, rax
lea rdx, str._System32_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0x200]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x200]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017be3
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._Sys32_
call fcn.1400980d0
mov r8, rax
lea rdx, str._Sys32_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0x200]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x200]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017c5b
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
lea rcx, [rsp + 0x200]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x200]
lea rcx, [r12 + 0x50]
call fcn.14000352c
jmp 0x140017eb2
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
lea rcx, [r12 + 0x50]
call fcn.14000352c
mov r15d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._System32_
call fcn.1400980d0
mov r8, rax
lea rdx, str._System32_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017d22
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._Sys32_
call fcn.1400980d0
mov r8, rax
lea rdx, str._Sys32_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017d9a
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._System_
call fcn.1400980d0
mov r8, rax
lea rdx, str._System_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017e12
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._Sys_
call fcn.1400980d0
mov r8, rax
lea rdx, str._Sys_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140017e8a
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
lea rcx, [r12 + 0x28]
call fcn.14000352c
mov r14d, reloc.OLEAUT32.dll_SafeArrayDestroy
xor ecx, ecx
call fcn.14005c0a8
mov byte [rsp + 0xf0], r13b
call fcn.14005c0a8
cmp eax, r13d
je 0x140017eff
call fcn.14005d27c
mov r11, qword [0x1401203c8]
cmp r11, r13
jne 0x140017ee7
mov ebx, r13d
mov r15d, 0x104
jmp 0x140017f18
mov r15d, 0x104
mov edx, r15d
lea rcx, [rsp + 0xf0]
call r11
mov ebx, eax
jmp 0x140017f18
mov r15d, 0x104
mov edx, r15d
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, eax
call fcn.14005c0a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, r13d
jne 0x140017f4d
cmp eax, 0x78
je 0x140017f4d
mov rcx, qword [0x1401203c8]
mov qword [rsp + 0x20], rcx
mov r9d, eax
lea r8, str.Error__d_calling_GetSystemWow64Directory____pointer_is__p
mov edx, ebp
mov rcx, rsi
call fcn.140001000
lea rax, [rsp + 0xf0]
cmp rax, r13
je 0x140017f8e
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
cmp rax, r13
jbe 0x140017f8e
cmp byte [rsp + rax + 0xef], 0x5c
je 0x140017f8e
lea rdx, [rax + 2]
lea r8, [0x1400c55c0]
lea rcx, [rsp + 0xf0]
call fcn.140098ed8
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._SystemWow64_
call fcn.1400980d0
mov r8, rax
lea rdx, str._SystemWow64_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140018006
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._SysWow64_
call fcn.1400980d0
mov r8, rax
lea rdx, str._SysWow64_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
cmp qword [rsp + 0x50], 0x10
jb 0x14001807e
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._SysWow64_
call fcn.1400980d0
mov r8, rax
lea rdx, str._SysWow64_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140001bdc
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
lea rcx, [r12 + 0x78]
call fcn.14000352c
mov byte [rsp + 0xf0], r13b
mov edx, r15d
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, r13d
jne 0x140018184
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.Error__d_GetWindowsDirectory__
mov edx, ebp
mov rcx, rsi
call fcn.140001000
mov r8d, r15d
lea rdx, [rsp + 0xf0]
lea rcx, str.windir
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, r13d
jne 0x140018184
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.Error__d_GetEnvironmentVariable_windir_
mov edx, ebp
mov rcx, rsi
call fcn.140001000
lea rax, [rsp + 0xf0]
cmp rax, r13
je 0x1400181c5
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
cmp rax, r13
jbe 0x1400181c5
cmp byte [rsp + rax + 0xef], 0x5c
je 0x1400181c5
lea rdx, [rax + 2]
lea r8, [0x1400c55c0]
lea rcx, [rsp + 0xf0]
call fcn.140098ed8
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._Windows_
call fcn.1400980d0
mov r8, rax
lea rdx, str._Windows_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140001bdc
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x38], r13b
lea rcx, str._Win_
call fcn.1400980d0
mov r8, rax
lea rdx, str._Win_
lea rcx, [rsp + 0x30]
call fcn.14000352c
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140001bdc
lea rdx, str._Windir_
lea rcx, [rsp + 0x90]
call fcn.140004698
nop
lea rdx, [rsp + 0x90]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x90]
call fcn.140001bdc
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
lea rcx, [r12 + 0xa0]
call fcn.14000352c
mov byte [rsp + 0xf3], r13b
lea rdx, str._WindowsDrive_
lea rcx, [rsp + 0x68]
call fcn.140004698
nop
lea rdx, [rsp + 0x68]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.140001bdc
mov byte [rsp + 0xf0], r13b
lea rdx, [rsp + 0xf0]
mov ecx, r15d
call fcn.14005c0b0
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
cmp rax, r13
jne 0x140018424
mov r8d, r15d
lea rdx, [rsp + 0xf0]
lea rcx, str.temp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, r13d
jne 0x140018424
lea rdx, str.CMacroExpander:_Both_GetTempPath___and_GetEnvironmentVariable___temp___Failed___
mov rcx, rsi
call fcn.14004b7ec
mov r8d, r15d
lea rdx, [rsp + 0xf0]
lea rcx, [0x1400c7b28]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, r13d
jne 0x140018424
lea rdx, str.CMacroExpander:_Also_failed_to_get_environment_variable__tmp_.
mov rcx, rsi
call fcn.14004b7ec
lea rdx, str.CMacroExpander:_Could_not_set_the_Temp_directory_to_replace__Temp_.
mov rcx, rsi
call fcn.14004b7ec
lea rax, [rsp + 0xf0]
cmp rax, r13
je 0x140018465
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
cmp rax, r13
jbe 0x140018465
cmp byte [rsp + rax + 0xef], 0x5c
je 0x140018465
lea rdx, [rax + 2]
lea r8, [0x1400c55c0]
lea rcx, [rsp + 0xf0]
call fcn.140098ed8
lea rdx, str._Temp_
lea rcx, [rsp + 0x68]
call fcn.140004698
nop
lea rdx, [rsp + 0x68]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.140001bdc
lea rdx, str._Tmp_
lea rcx, [rsp + 0x90]
call fcn.140004698
nop
lea rdx, [rsp + 0x90]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x90]
call fcn.140001bdc
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, r12
call fcn.14000352c
mov byte [rsp + 0xf0], r13b
lea rdx, [rsp + 0xf0]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
cmp rax, r13
jne 0x1400185ce
mov r8d, r15d
lea rdx, [rsp + 0xf0]
lea rcx, str.temp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, r13d
jne 0x1400185ce
lea rdx, str.CMacroExpander:_Both_GetTempPath___and_GetEnvironmentVariable___temp___Failed___
mov rcx, rsi
call fcn.14004b7ec
mov r8d, r15d
lea rdx, [rsp + 0xf0]
lea rcx, [0x1400c7b28]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, r13d
jne 0x1400185ce
lea rdx, str.CMacroExpander:_Also_failed_to_get_environment_variable__tmp_.
mov rcx, rsi
call fcn.14004b7ec
lea rdx, str.CMacroExpander:_Could_not_set_the_Temp_directory_to_replace__Temp_.
mov rcx, rsi
call fcn.14004b7ec
lea rax, [rsp + 0xf0]
cmp rax, r13
je 0x14001860f
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
cmp rax, r13
jbe 0x14001860f
cmp byte [rsp + rax + 0xef], 0x5c
je 0x14001860f
lea rdx, [rax + 2]
lea r8, [0x1400c55c0]
lea rcx, [rsp + 0xf0]
call fcn.140098ed8
lea rdx, str._UserTemp_
lea rcx, [rsp + 0x68]
call fcn.140004698
nop
lea rdx, [rsp + 0x68]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.140001bdc
mov byte [rsp + 0xf0], r13b
mov r8d, r15d
lea rdx, [rsp + 0xf0]
lea rcx, str.allusersprofile
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, r13d
jne 0x14001869a
lea rdx, str.CSetupWrapperApp:_GetEnvironmentVariable___allusersprofile___Failed___
mov rcx, rsi
call fcn.14004b7ec
lea rax, [rsp + 0xf0]
cmp rax, r13
je 0x1400186db
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
cmp rax, r13
jbe 0x1400186db
cmp byte [rsp + rax + 0xef], 0x5c
je 0x1400186db
lea rdx, [rax + 2]
lea r8, [0x1400c55c0]
lea rcx, [rsp + 0xf0]
call fcn.140098ed8
lea rdx, str._allusersprofile_
lea rcx, [rsp + 0x68]
call fcn.140004698
nop
lea rdx, [rsp + 0x68]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.140001bdc
mov byte [rsp + 0xf0], r13b
lea rdx, str._cr_
lea rcx, [rsp + 0x90]
call fcn.140004698
nop
lea rdx, [rsp + 0x90]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [0x1400c79f4]
call fcn.1400980d0
mov r8, rax
lea rdx, [0x1400c79f4]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x90]
call fcn.140001bdc
lea rdx, str._lf_
lea rcx, [rsp + 0x30]
call fcn.140004698
nop
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [0x1400c79e8]
call fcn.1400980d0
mov r8, rax
lea rdx, [0x1400c79e8]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140001bdc
lea rdx, str._crlf_
lea rcx, [rsp + 0xc8]
call fcn.140004698
nop
lea rdx, [rsp + 0xc8]
lea rcx, [r12 + 0x120]
call fcn.14001223c
mov rbx, rax
lea rcx, [0x1400c6110]
call fcn.1400980d0
mov r8, rax
lea rdx, [0x1400c6110]
mov rcx, rbx
call fcn.14000352c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xc8]
call fcn.140001bdc
mov word [r12 + 0x118], r13w
mov rax, r12
mov rcx, qword [rsp + 0x610]
xor rcx, rsp
call fcn.140061100
lea r11, [rsp + 0x620]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret