Function at 0x140016960
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2638]
mov eax, 0x2738
call fcn.1400a0340
sub rsp, rax
mov rax, qword [0x1402acd18]
xor rax, rsp
mov qword [rbp + 0x2620], rax
mov r15, r9
mov qword [rbp - 0x58], r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov r13, qword [rbp + 0x26a8]
mov qword [rbp - 0x78], r13
mov r12, qword [rbp + 0x26b0]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x620]
call fcn.1400bc2f0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], bx
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.14000e450
mov rdx, rax
mov rcx, rsi
call fcn.140009970
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140016a57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016a52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017b87
call fcn.1400a031c
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.14000dcc0
nop
cmp dword [0x1402b4a1c], 9
ja 0x140016b42
lea r11, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae r11, qword [rbp - 0x20]
mov r10, qword [rbp - 0x10]
cmp r10, 7
jb 0x140016b42
lea rbx, [r10 - 6]
lea rbx, [r11 + rbx*2]
mov rcx, r11
lea r9, [0x140129340]
mov rax, rbx
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x140016acb
cmp word [rcx], 0x65
je 0x140016ac8
cmp rax, 1
je 0x140016acb
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x140016ab5
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140016b42
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x140129340]
sub r9, rax
nop dword [rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x140016bed
add rdx, 2
sub r8, 1
jne 0x140016af0
sub rcx, r11
sar rcx, 1
jne 0x140016b42
mov eax, 4
cmp r10, rax
cmovb rax, r10
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
sub r10, rax
mov qword [rbp - 0x10], r10
lea r8, [r10*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.1400bd5b0
mov r14, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, r14
je 0x140016e5d
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140016b60
mov rdx, qword [rdx]
lea rcx, [rbp - 0x20]
call fcn.140018590
cmp rax, 0xffffffffffffffff
jne 0x140016b77
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x140016b52
cmp rbx, r14
je 0x140016e5d
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x140016bf6
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x140016b9b
mov rdi, qword [rdi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x140016bac
mov r8, qword [rdx]
cmp rcx, rax
jne 0x140016bd8
test rcx, rcx
je 0x140016bd4
sub r8, rdi
nop dword [rax]
movzx eax, word [rdi + r8]
cmp ax, word [rdi]
jne 0x140016bd8
add rdi, 2
sub rcx, 1
jne 0x140016bc0
lea rdx, [r9 - 0x20]
cmp rsi, rdx
je 0x140016c14
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140016c0c
mov rdx, qword [rdx]
jmp 0x140016c0c
add rcx, 2
jmp 0x140016a98
cmp rsi, rdi
je 0x140016c14
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x140016c09
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rsi
call fcn.140009c80
mov r9, r12
mov r8, r13
mov rdx, rsi
call fcn.140017bf0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140017acc
cmp ebx, 0xc015001d
je 0x140017acc
test byte [rbp + 0x26a0], 2
je 0x140016e56
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x20]
call fcn.1400bc2f0
mov edx, 0xff
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ebx, ebx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], bx
lea rax, [rbp + 0x20]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x140016c90
mov r8, rdi
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x78]
call fcn.140009c80
nop
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140016ce0
lea rax, [rcx + 1]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x78]
cmp rdx, 8
cmovae rax, qword [rbp - 0x78]
mov dword [rax + rcx*2], 0x5c
lea rax, [rbp - 0x78]
jmp 0x140016d04
mov qword [rsp + 0x20], 1
lea r9, [0x14012933c]
movzx r8d, byte [rsp + 0x40]
mov edx, 1
lea rcx, [rbp - 0x78]
call fcn.1400196c0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140016d3b
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400190d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.140009970
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140016db8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016db2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017b8d
call fcn.1400a031c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140016dfa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016df5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017b93
call fcn.1400a031c
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140017acc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016e4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017b99
call fcn.1400a031c
jmp 0x140017acc
xor ebx, ebx
jmp 0x140017acc
mov r14d, dword [rbp + 0x26a0]
test r14b, 1
jne 0x140017ac7
mov r9, r12
mov r8, r13
mov rdx, rsi
call fcn.140017bf0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x140017acc
cmp ebx, 0xc015001d
je 0x140017acc
test r14b, 4
jne 0x140017ac7
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140016eb0
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r12d, r12d
cmp eax, 0xffffffff
je 0x140016ec6
mov ebx, r12d
jmp 0x140017acf
mov qword [rbp + 0x10], r12
lea r8, [rbp + 0x10]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x140016fd0
mov ebx, r12d
test rdi, rdi
jne 0x140016fd0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x420]
call fcn.1400bc2f0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x20]
call fcn.1400bc2f0
mov dword [rbp], 0xff
mov dword [rbp + 8], r12d
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp]
lea r8, [rbp + 0x420]
mov edx, ebx
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rcx, [rbp + 0x20]
call fcn.1400dd1c0
test eax, eax
jne 0x140016fc2
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x220]
call fcn.1400bc2f0
mov dword [rbp], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x220]
test r14b, 8
je 0x140016fb3
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x140016fb9
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x140017044
inc ebx
cmp ebx, 0x1000
jl 0x140016ef0
mov rdi, qword [r15 + 0x10]
mov r13d, 0x5c
test rdi, rdi
je 0x140017258
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rdi
cmp rax, 1
jb 0x140017b9f
cmp qword [r15 + 0x18], 8
jb 0x14001700b
mov r15, qword [r15]
mov qword [rbp - 0x58], r15
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea r12, [rdi + 1]
mov ebx, 7
lea r15, [rsp + 0x48]
cmp r12, rbx
jbe 0x140017140
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x14001711e
mov rbx, rcx
jmp 0x14001712a
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r12w
lea rax, [rbp + 0x220]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140017070
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x68]
call fcn.140009c80
nop
lea r8, [0x14012933c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.140018f40
nop
lea rcx, [rbp + 0x20]
nop word [rax + rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x1400170b0
mov r8, rdi
lea rdx, [rbp + 0x20]
mov rcx, rax
call fcn.1400190d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.140009970
lea rcx, [rsp + 0x48]
call fcn.140009900
nop
lea rcx, [rbp - 0x78]
call fcn.140009900
nop
lea rcx, [rsp + 0x68]
call fcn.140009900
mov ebx, r12d
jmp 0x140017a8e
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x48]
call fcn.140009db0
mov r15, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], rbx
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, qword [rbp - 0x58]
mov rcx, r15
call fcn.1400bd5b0
mov word [rbx + r15], r13w
xor eax, eax
mov word [r15 + r12*2], ax
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400190d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x40]
call fcn.140009970
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400171f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400171f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017ba5
call fcn.1400a031c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14001723b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017236
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017bab
call fcn.1400a031c
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140017a9f
mov r8, qword [rbp - 0x78]
mov r8d, dword [r8 + 8]
lea rdx, [rbp - 0x78]
call fcn.140018320
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x1400172a0
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 8
jb 0x140017294
mov rax, qword [rcx]
mov word [rax + rdx*2], r13w
mov word [rax + r8*2], r12w
jmp 0x1400172c3
mov qword [rsp + 0x20], 1
lea r9, [0x14012933c]
movzx r8d, byte [rsp + 0x40]
mov edx, 1
call fcn.1400196c0
mov rcx, rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 7
mov word [rcx], r12w
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400190d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x40]
call fcn.140009970
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14001737b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017375
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017bb1
call fcn.1400a031c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400173bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400173b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017bb7
call fcn.1400a031c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r12w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140017411
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001740c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017bbd
call fcn.1400a031c
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140017a9f
mov edx, 0x1000
lea rcx, [rbp + 0x620]
test r14b, 8
je 0x140017448
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14001744e
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r12w
lea rax, [rbp + 0x620]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140017470
lea rdx, [rbp + 0x620]
lea rcx, [rbp - 0x78]
call fcn.140009c80
nop
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400174c2
lea rax, [rcx + 1]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x78]
cmp rdx, 8
cmovae rax, qword [rbp - 0x78]
mov dword [rax + rcx*2], 0x5c
lea rax, [rbp - 0x78]
jmp 0x1400174e6
mov qword [rsp + 0x20], 1
lea r9, [0x14012933c]
movzx r8d, byte [rsp + 0x40]
mov edx, 1
lea rcx, [rbp - 0x78]
call fcn.1400196c0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400190d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x40]
call fcn.140009970
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14001759e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017598
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017bc3
call fcn.1400a031c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400175e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400175db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017bc9
call fcn.1400a031c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r12w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140017634
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001762f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017bcf
call fcn.1400a031c
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140017a9f
mov edx, 0x1000
lea rcx, [rbp + 0x620]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r12w
lea rax, [rbp + 0x620]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140017680
lea rdx, [rbp + 0x620]
lea rcx, [rsp + 0x68]
call fcn.140009c80
nop
lea r8, [0x14012933c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.140018f40
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.1400190d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x40]
call fcn.140009970
lea rcx, [rsp + 0x48]
call fcn.140009900
nop
lea rcx, [rbp - 0x78]
call fcn.140009900
nop
lea rcx, [rsp + 0x68]
call fcn.140009900
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140017a9f
lea rdx, [rbp + 0x620]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r12w
lea rax, [rbp + 0x620]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140017770
lea rdx, [rbp + 0x620]
lea rcx, [rsp + 0x68]
call fcn.140009c80
nop
lea r8, [0x14012933c]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.140018f40
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.1400190d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x40]
call fcn.140009970
lea rcx, [rsp + 0x48]
call fcn.140009900
nop
lea rcx, [rbp - 0x78]
call fcn.140009900
nop
lea rcx, [rsp + 0x68]
call fcn.140009900
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140017a9f
mov r8d, 0x1000
lea rdx, [rbp + 0x620]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x48]
lea rdx, [0x1401293d4]
lea rcx, [rbp + 0x620]
call fcn.1400de378
test rax, rax
je 0x140017a89
movzx ebx, byte [rsp + 0x40]
nop word [rax + rax]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r12w
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140017890
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140009c80
nop
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400178e5
lea rax, [rcx + 1]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x48]
cmp rdx, 8
cmovae rax, qword [rsp + 0x48]
mov dword [rax + rcx*2], 0x5c
lea rax, [rsp + 0x48]
jmp 0x140017908
mov qword [rsp + 0x20], 1
lea r9, [0x14012933c]
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400196c0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rsp + 0x68]
call fcn.1400190d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1400179b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400179a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017bd5
call fcn.1400a031c
movups xmm0, xmmword [rbp - 0x78]
movups xmm1, xmmword [rbp - 0x58]
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm1
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400179fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400179f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017bdb
call fcn.1400a031c
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r12w
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140017a53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017a4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017be1
call fcn.1400a031c
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140017a9f
lea r8, [rbp - 0x48]
lea rdx, [0x1401293d4]
mov rcx, qword [rbp - 0x48]
call fcn.1400de378
test rax, rax
jne 0x140017870
mov ebx, 0xc0000225
mov rcx, qword [rbp + 0x10]
test rcx, rcx
jle 0x140017acf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140017acf
lea rax, [rbp - 0x40]
cmp rsi, rax
je 0x140017ac2
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
mov r8, qword [rbp - 0x30]
cmovae rdx, qword [rbp - 0x40]
mov rcx, rsi
call fcn.140009c80
mov ebx, r12d
jmp 0x140017a8e
mov ebx, 0xc0000225
xor r12d, r12d
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140017b0f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017b0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017be7
call fcn.1400a031c
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140017b5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017b57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017b81
call fcn.1400a031c
mov eax, ebx
mov rcx, qword [rbp + 0x2620]
xor rcx, rsp
call fcn.1400a02c0
add rsp, 0x2738
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.140001860
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
int3