Function at 0x1800157f0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2618]
mov eax, 0x2718
call fcn.1800e6000
sub rsp, rax
mov rax, qword [0x180178b40]
xor rax, rsp
mov qword [rbp + 0x2600], rax
mov r12, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov r13, qword [rbp + 0x2688]
mov r15, qword [rbp + 0x2690]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x600]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], bx
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.18000d640
mov rdx, rax
mov rcx, rsi
call fcn.1800089f0
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1800158e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800158e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800158e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.18000cfd0
nop
cmp dword [0x18017d1ac], 9
ja 0x1800159d2
lea r10, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova r10, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x28]
cmp rbx, 7
jb 0x1800159d2
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, str.ext_ms_
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x18001595a
cmp word [rcx], 0x65
je 0x180015957
cmp rax, 1
je 0x18001595a
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x180015944
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x1800159d2
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, str.ext_ms_
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x180015a7d
add rdx, 2
sub r8, 1
jne 0x180015980
sub rcx, r10
sar rcx, 1
jne 0x1800159d2
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rcx, qword [rbp - 0x38]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x28], rbx
mov r14, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, r14
je 0x180015d00
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x1800159f0
mov rdx, qword [rdx]
lea rcx, [rbp - 0x38]
call fcn.180017250
cmp rax, 0xffffffffffffffff
jne 0x180015a07
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x1800159e2
cmp rbx, r14
je 0x180015d00
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x180015a86
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x180015a2b
mov rdi, qword [rdi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 7
jbe 0x180015a3c
mov r8, qword [rdx]
cmp rcx, rax
jne 0x180015a68
test rcx, rcx
je 0x180015a64
sub r8, rdi
nop dword [rax]
movzx eax, word [rdi + r8]
cmp ax, word [rdi]
jne 0x180015a68
add rdi, 2
sub rcx, 1
jne 0x180015a50
lea rdx, [r9 - 0x20]
cmp rsi, rdx
je 0x180015aa4
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x180015a9c
mov rdx, qword [rdx]
jmp 0x180015a9c
add rcx, 2
jmp 0x180015927
cmp rsi, rdi
je 0x180015aa4
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x180015a99
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rsi
call fcn.180008ef0
mov r9, r15
mov r8, r13
mov rdx, rsi
call fcn.1800168d0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x180016804
cmp ebx, 0xc015001d
je 0x180016804
test byte [rbp + 0x2680], 2
je 0x180015cf9
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0xff
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180015b20
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rsp + 0x60]
call fcn.1800097e0
nop
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180015b78
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 7
cmova rax, qword [rsp + 0x60]
mov dword [rax + rcx*2], 0x5c
lea rax, [rsp + 0x60]
jmp 0x180015b97
mov qword [rsp + 0x20], 1
lea r9, [0x180114b34]
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.1800181e0
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x180015bd7
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x40]
call fcn.180017db0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.1800089f0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x180015c53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015c4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180015c4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180015c98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015c93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180015c93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
movdqa xmm0, xmmword [0x180115d60]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180016804
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015cef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180015cef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
jmp 0x180016804
xor ebx, ebx
jmp 0x180016804
mov r14d, dword [rbp + 0x2680]
test r14b, 1
jne 0x1800167ff
mov r9, r15
mov r8, r13
mov rdx, rsi
call fcn.1800168d0
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x180016804
cmp ebx, 0xc015001d
je 0x180016804
test r14b, 4
jne 0x1800167ff
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x180015d53
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180015d69
xor r12d, r12d
mov ebx, r12d
jmp 0x180016807
xor r15d, r15d
mov qword [rbp - 8], r15
lea r8, [rbp - 8]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x180015e7a
mov ebx, r15d
test rdi, rdi
jne 0x180015e7a
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x400]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x200]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x18], 0xff
mov dword [rbp - 0x10], r15d
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x18]
lea r8, [rbp + 0x400]
mov edx, ebx
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x180015e6c
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x18], 0xff
mov edx, 0xff
lea rcx, [rbp]
test r14b, 8
je 0x180015e5d
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x180015e63
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x180015f68
inc ebx
cmp ebx, 0x1000
jl 0x180015d96
mov rcx, qword [r12 + 0x10]
lea r15, [0x180114b34]
test rcx, rcx
je 0x18001608b
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x1800168c3
cmp qword [r12 + 0x18], 7
jbe 0x180015eb2
mov r12, qword [r12]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
mov r9, r12
lea rcx, [rsp + 0x40]
call fcn.180017c70
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
lea rcx, [rsp + 0x40]
call fcn.180017db0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.1800089f0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x180016002
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015ffc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180015ffc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180015f82
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.1800097e0
nop
lea r8, [0x180114b34]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.180017ae0
nop
lea r8, [rbp + 0x200]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180017ae0
mov rdx, rax
mov rcx, rsi
call fcn.1800089f0
lea rcx, [rsp + 0x40]
call fcn.180008980
nop
lea rcx, [rsp + 0x60]
call fcn.180008980
nop
lea rcx, [rbp - 0x80]
call fcn.180008980
xor r12d, r12d
mov ebx, r12d
jmp 0x1800167ee
call fcn.1800e5744
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180016047
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016042
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180016042
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001608e
lea rax, [rbp - 0x58]
cmp rsi, rax
je 0x180016083
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
mov r8, qword [rbp - 0x48]
cmova rdx, qword [rbp - 0x58]
mov rcx, rsi
call fcn.180008ef0
mov ebx, r12d
jmp 0x1800167ee
xor r12d, r12d
mov r8d, dword [r13 + 8]
lea rdx, [rsp + 0x60]
call fcn.180016fb0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
mov edi, 0x5c
cmp rax, 1
jb 0x1800160d7
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 7
jbe 0x1800160cc
mov rax, qword [rcx]
mov word [rax + rdx*2], di
mov word [rax + r8*2], r12w
jmp 0x1800160f0
mov qword [rsp + 0x20], 1
mov r9, r15
mov edx, 1
call fcn.1800181e0
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 7
mov word [rcx], r12w
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
lea rcx, [rsp + 0x40]
call fcn.180017db0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.1800089f0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1800161ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800161a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800161a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1800161f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800161ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800161ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
movdqa xmm0, xmmword [0x180115d60]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18001624c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016247
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180016247
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180016060
mov edx, 0x1000
lea rcx, [rbp + 0x600]
test r14b, 8
je 0x180016283
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x180016289
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x600]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800162b0
lea rdx, [rbp + 0x600]
lea rcx, [rsp + 0x60]
call fcn.1800097e0
nop
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180016309
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 7
cmova rax, qword [rsp + 0x60]
mov dword [rax + rcx*2], 0x5c
lea rax, [rsp + 0x60]
jmp 0x180016324
mov qword [rsp + 0x20], 1
mov r9, r15
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.1800181e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
lea rcx, [rsp + 0x40]
call fcn.180017db0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.1800089f0
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1800163e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800163dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800163dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180016427
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016422
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180016422
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
movdqa xmm0, xmmword [0x180115d60]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180016480
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001647b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001647b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180016060
mov edx, 0x1000
lea rcx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x600]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800164d0
lea rdx, [rbp + 0x600]
lea rcx, [rbp - 0x80]
call fcn.1800097e0
nop
mov r8, r15
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.180017ae0
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
mov rcx, rax
call fcn.180017db0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.1800089f0
lea rcx, [rsp + 0x40]
call fcn.180008980
nop
lea rcx, [rsp + 0x60]
call fcn.180008980
nop
lea rcx, [rbp - 0x80]
call fcn.180008980
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180016060
lea rdx, [rbp + 0x600]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x600]
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1800165b0
lea rdx, [rbp + 0x600]
lea rcx, [rbp - 0x80]
call fcn.1800097e0
nop
mov r8, r15
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.180017ae0
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
mov rcx, rax
call fcn.180017db0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.1800089f0
lea rcx, [rsp + 0x40]
call fcn.180008980
nop
lea rcx, [rsp + 0x60]
call fcn.180008980
nop
lea rcx, [rbp - 0x80]
call fcn.180008980
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180016060
mov r8d, 0x1000
lea rdx, [rbp + 0x600]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x60]
lea rdx, [0x180114bd4]
lea rcx, [rbp + 0x600]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
je 0x1800167e9
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x1800166b5
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1800097e0
nop
mov r8d, 1
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.180017db0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
lea rcx, [rsp + 0x60]
call fcn.180017db0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.1800089f0
mov r8, qword [rbp - 0x68]
cmp r8, 7
jbe 0x180016770
mov rdx, qword [rbp - 0x80]
call fcn.180008fb0
nop
mov r8, qword [rsp + 0x78]
cmp r8, 7
jbe 0x180016785
mov rdx, qword [rsp + 0x60]
call fcn.180008fb0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
mov r8, qword [rsp + 0x58]
cmp r8, 7
jbe 0x1800167ae
mov rdx, qword [rsp + 0x40]
call fcn.180008fb0
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180016060
lea r8, [rbp - 0x60]
lea rdx, [0x180114bd4]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
jne 0x1800166a0
mov ebx, 0xc0000225
mov rcx, qword [rbp - 8]
test rcx, rcx
jle 0x180016807
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180016807
mov ebx, 0xc0000225
xor r12d, r12d
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x18001684a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016845
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180016845
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r12w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x18001689e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016899
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180016899
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
mov eax, ebx
mov rcx, qword [rbp + 0x2600]
xor rcx, rsp
call fcn.1800e5bd0
add rsp, 0x2718
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180001530
nop
int3