Function at 0x14000de60
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rbp
push rdi
push r14
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov rax, qword [0x14021d648]
test rax, rax
jne 0x14000dea6
lea rdx, [0x1401ae572]
mov ecx, 0x200000
call fcn.14002ec60
mov qword [0x14021d648], rax
xor r14d, r14d
test rax, rax
je 0x14000deb2
mov word [rax], r14w
cmp qword [0x140229240], r14
jne 0x14000ded9
mov edx, 0x22000
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x140229240], rax
mov dword [0x140229248], r14d
mov rax, qword [0x14021be28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rcx, qword [0x14021be28]
test rcx, rcx
je 0x14000df21
mov edx, dword [0x14021be34]
call fcn.14003c814
mov rdx, rax
mov rcx, qword [0x14021be28]
jmp 0x14000df24
mov edx, r14d
mov dword [0x14021be30], edx
test rcx, rcx
je 0x14000df87
lea eax, [rdx + 0xb]
cmp eax, dword [0x14021be34]
jae 0x14000df87
mov eax, edx
lea rdx, [rcx + rax*2]
lea rsi, [0x1401bad40]
mov rdi, rdx
mov ecx, 5
rep movsd dword [rdi], dword [rsi]
lea rdi, [rdx + 0x14]
lea rsi, [0x1401bad54]
mov ecx, 2
rep movsb byte [rdi], byte [rsi]
mov eax, dword [0x14021be30]
add eax, 0xb
mov dword [0x14021be30], eax
mov ecx, eax
mov rax, qword [0x14021be28]
mov word [rax + rcx*2], r14w
mov rcx, qword [0x14021be28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000dfa1
xor edx, edx
mov rcx, qword [0x14021be28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [0x14021be28]
test rcx, rcx
je 0x14000dff4
mov edx, dword [0x14021be30]
lea eax, [rdx + 8]
cmp eax, dword [0x14021be34]
jae 0x14000dff4
lea rdi, [rcx + rdx*2]
lea rsi, str.Crashes
mov ecx, 4
rep movsd dword [rdi], dword [rsi]
mov eax, dword [0x14021be30]
add eax, 8
mov dword [0x14021be30], eax
mov ecx, eax
mov rax, qword [0x14021be28]
mov word [rax + rcx*2], r14w
mov rcx, qword [0x14021be28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000e00e
xor edx, edx
mov rcx, qword [0x14021be28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, str.MT5WEBSETUP64
lea rcx, [0x14021c040]
call fcn.140003290
lea rdx, str.MetaTrader_Web_Setup
lea rcx, [0x14021c480]
call fcn.140003290
mov dword [0x14021d5d8], 0x1f4
mov dword [0x14021d5dc], 0x10dc
mov dword [0x14021d5e0], 0x2fb5
mov dword [0x140229288], 0x10dc
mov rax, qword [0x14021c6a8]
test rax, rax
je 0x14000e073
mov dword [0x14021c6b0], r14d
mov word [rax], r14w
cmp qword [0x14021d640], r14
jne 0x14000e08a
xor ecx, ecx
call fcn.140035e90
mov qword [0x14021d640], rax
lea rdx, str.22_May_2024
lea rcx, [0x14021d5e8]
call fcn.140003290
cmp dword [0x14021cf30], 1
jb 0x14000e0bc
mov rax, qword [0x14021cf28]
test rax, rax
je 0x14000e0bc
cmp word [rax], r14w
je 0x14000e0bc
xor al, al
jmp 0x14000e0be
mov al, 1
test al, al
je 0x14000e41b
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x30]
call fcn.14014e180
mov r8d, 0x100
lea rdx, [rsp + 0x30]
lea rcx, str.CLIENTNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rbx, 0xffffffffffffffff
test eax, eax
jne 0x14000e11b
mov r8d, 0x100
lea rdx, [rsp + 0x30]
lea rcx, str.COMPUTERNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000e28c
cmp qword [0x14021cf28], r14
je 0x14000e18b
mov edx, dword [0x14021cf34]
lea rcx, [rsp + 0x30]
call fcn.14003c814
mov ecx, dword [0x14021cf34]
lea r8d, [rcx - 1]
cmp eax, ecx
cmovb r8d, eax
lea edx, [r8 + r8]
mov rax, qword [0x14021cf28]
mov ecx, edx
shr rcx, 2
lea rsi, [rsp + 0x30]
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x14000e178
and rdx, 0xfffffffffffffffc
lea rsi, [rsp + 0x30]
add rsi, rdx
lea rdi, [rdx + rax]
rep movsb byte [rdi], byte [rsi]
mov dword [0x14021cf30], r8d
mov rax, qword [0x14021cf28]
mov word [rax + r8*2], r14w
mov r8d, 0x100
lea rdx, [rsp + 0x30]
lea rcx, str.USERDOMAIN
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000e28c
mov rcx, qword [0x14021cf28]
test rcx, rcx
je 0x14000e28c
mov edx, dword [0x14021cf30]
lea eax, [rdx + 1]
cmp eax, dword [0x14021cf34]
jae 0x14000e212
lea rdx, [rcx + rdx*2]
lea rsi, [0x1401b7670]
mov rdi, rdx
xor ecx, ecx
rep movsd dword [rdi], dword [rsi]
lea rsi, [0x1401b7670]
mov rdi, rdx
mov ecx, 2
rep movsb byte [rdi], byte [rsi]
mov eax, dword [0x14021cf30]
inc eax
mov dword [0x14021cf30], eax
mov ecx, eax
mov rax, qword [0x14021cf28]
mov word [rax + rcx*2], r14w
mov rcx, qword [0x14021cf28]
test rcx, rcx
je 0x14000e28c
lea rax, [rsp + 0x30]
mov rdx, rbx
nop
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x14000e220
test edx, edx
je 0x14000e28c
mov edi, dword [0x14021cf30]
lea eax, [rdx + rdi]
cmp eax, dword [0x14021cf34]
jae 0x14000e28c
lea eax, [rdx + rdx]
mov r8d, eax
lea r9, [rcx + rdi*2]
mov ecx, eax
shr rcx, 2
lea rsi, [rsp + 0x30]
mov rdi, r9
rep movsd dword [rdi], dword [rsi]
mov ecx, eax
and ecx, 3
je 0x14000e272
and r8, 0xfffffffffffffffc
lea rsi, [rsp + 0x30]
add rsi, r8
lea rdi, [r8 + r9]
rep movsb byte [rdi], byte [rsi]
mov ecx, dword [0x14021cf30]
add ecx, edx
mov dword [0x14021cf30], ecx
mov rax, qword [0x14021cf28]
mov word [rax + rcx*2], r14w
mov dword [rbp + 0x570], 0x1fe
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rbp + 0x568], r14
mov dword [rbp + 0x578], r14d
lea rax, [rbp + 0x568]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_SoftwareSettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e41b
lea rax, [rbp + 0x570]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x578]
xor r8d, r8d
lea rdx, str.MQL5.Login
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14000e41b
cmp word [rsp + 0x30], r14w
je 0x14000e41b
mov rdi, qword [0x14021cf28]
test rdi, rdi
je 0x14000e41b
mov edx, dword [0x14021cf30]
lea eax, [rdx + 5]
cmp eax, dword [0x14021cf34]
jae 0x14000e39e
lea rdx, [rdi + rdx*2]
lea rsi, str._for
mov rdi, rdx
mov ecx, 2
rep movsd dword [rdi], dword [rsi]
lea rdi, [rdx + 8]
lea rsi, [0x1401c1340]
mov ecx, 2
rep movsb byte [rdi], byte [rsi]
mov eax, dword [0x14021cf30]
add eax, 5
mov dword [0x14021cf30], eax
mov ecx, eax
mov rax, qword [0x14021cf28]
mov word [rax + rcx*2], r14w
mov rdi, qword [0x14021cf28]
test rdi, rdi
je 0x14000e41b
lea rax, [rsp + 0x30]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x14000e3b0
test ebx, ebx
je 0x14000e41b
mov ecx, dword [0x14021cf30]
lea eax, [rbx + rcx]
cmp eax, dword [0x14021cf34]
jae 0x14000e41b
lea eax, [rbx + rbx]
mov edx, eax
lea r8, [rdi + rcx*2]
mov ecx, eax
shr rcx, 2
lea rsi, [rsp + 0x30]
mov rdi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, eax
and ecx, 3
je 0x14000e401
and rdx, 0xfffffffffffffffc
lea rsi, [rsp + 0x30]
add rsi, rdx
lea rdi, [rdx + r8]
rep movsb byte [rdi], byte [rsi]
mov ecx, dword [0x14021cf30]
add ecx, ebx
mov dword [0x14021cf30], ecx
mov rax, qword [0x14021cf28]
mov word [rax + rcx*2], r14w
lea rdi, [rbp + 0x130]
xor eax, eax
mov ecx, 0x100
rep stosd dword [rdi], eax
lea rcx, [rbp + 0x130]
call fcn.14000dab0
cmp qword [0x14021d148], 0
je 0x14000e4ae
mov edx, dword [0x14021d154]
lea rcx, [rbp + 0x130]
call fcn.14003c814
mov ecx, dword [0x14021d154]
lea r8d, [rcx - 1]
cmp eax, ecx
cmovb r8d, eax
lea edx, [r8 + r8]
mov rax, qword [0x14021d148]
mov ecx, edx
shr rcx, 2
lea rsi, [rbp + 0x130]
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x14000e49b
and rdx, 0xfffffffffffffffc
lea rsi, [rbp + 0x130]
add rsi, rdx
lea rdi, [rdx + rax]
rep movsb byte [rdi], byte [rsi]
mov dword [0x14021d150], r8d
mov rax, qword [0x14021d148]
mov word [rax + r8*2], r14w
lea rdi, [rbp + 0x130]
xor eax, eax
mov ecx, 0x100
rep stosd dword [rdi], eax
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret