Function at 0x14004b900
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2648]
mov eax, 0x2748
call fcn.14006d3c0
sub rsp, rax
movaps xmmword [rsp + 0x2730], xmm6
movaps xmmword [rsp + 0x2720], xmm7
mov rax, qword [0x1400cc0b8]
xor rax, rsp
mov qword [rbp + 0x2610], rax
mov r12, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov r13, qword [rbp + 0x26b8]
mov r15, qword [rbp + 0x26c0]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x610]
call fcn.14006f000
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x78], xmm1
lea rax, [rdi + 0x10]
mov qword [rsp + 0x60], rax
mov qword [rax], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.140028960
mov rbx, rax
cmp rdi, rax
je 0x14004ba39
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14004ba07
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004ba02
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004cf84
mov rcx, r8
call fcn.14006c550
mov rax, qword [rsp + 0x60]
xor ecx, ecx
mov qword [rax], rcx
mov qword [rdi + 0x18], 7
mov word [rdi], cx
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14004ba79
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ba74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cf84
call fcn.14006c550
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140028020
nop
cmp dword [0x1400d01bc], 9
ja 0x14004bb62
lea r10, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r10, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x20]
cmp rbx, 7
jb 0x14004bb62
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, str.ext_ms_
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x14004baed
cmp word [rcx], 0x65
je 0x14004baea
cmp rax, 1
je 0x14004baed
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x14004bad7
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14004bb62
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, str.ext_ms_
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x14004bbfa
add rdx, 2
sub r8, 1
jne 0x14004bb10
sub rcx, r10
sar rcx, 1
jne 0x14004bb62
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.14006e930
mov qword [rbp - 0x20], rbx
mov r14, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, r14
je 0x14004be66
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14004bb80
mov rdx, qword [rdx]
lea rcx, [rbp - 0x30]
call fcn.140026d90
cmp rax, 0xffffffffffffffff
jne 0x14004bb9a
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r14
jne 0x14004bb72
cmp rbx, r14
je 0x14004be66
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x14004bc03
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x14004bbbe
mov rsi, qword [rsi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x14004bbcf
mov r8, qword [rdx]
cmp rcx, rax
jne 0x14004bc06
test rcx, rcx
je 0x14004bbf4
sub r8, rsi
nop dword [rax]
movzx eax, word [rsi + r8]
cmp ax, word [rsi]
jne 0x14004bc06
add rsi, 2
sub rcx, 1
jne 0x14004bbe0
lea rdx, [r9 - 0x20]
jmp 0x14004bc06
add rcx, 2
jmp 0x14004baba
mov rdx, rsi
mov rcx, rdi
call fcn.140018d78
mov r9, r15
mov r8, r13
mov rdx, rdi
call fcn.14004d020
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004ceb5
cmp ebx, 0xc015001d
je 0x14004ceb5
test byte [rbp + 0x26b0], 2
je 0x14004be5f
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.14006f000
mov edx, 0xff
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp + 0x10]
mov rsi, 0xffffffffffffffff
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14004bc82
mov r8, rsi
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x68]
call fcn.140009374
nop
mov r8d, 1
lea rdx, [0x1400b8c80]
lea rcx, [rsp + 0x68]
call fcn.140009ff0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14004bcf5
mov rdx, qword [rdi]
mov rax, qword [rsp + 0x60]
mov r8, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.140009ff0
movups xmm6, xmmword [rax]
movups xmmword [rbp - 0x78], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm7
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rax, [rbp - 0x78]
cmp rdi, rax
je 0x14004bd7f
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14004bd6d
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004bd68
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004cf8a
mov rcx, r8
call fcn.14006c550
movups xmmword [rdi], xmm6
movups xmmword [rdi + 0x10], xmm7
mov edx, 7
mov word [rbp - 0x78], bx
jmp 0x14004bd83
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14004bdc0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bdba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cf8a
call fcn.14006c550
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004be02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bdfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cf90
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], bx
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004ceb5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004be55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cf96
call fcn.14006c550
jmp 0x14004ceb5
xor ebx, ebx
jmp 0x14004ceb5
mov r14d, dword [rbp + 0x26b0]
test r14b, 1
je 0x14004be7d
mov ebx, 0xc0000225
jmp 0x14004ceb5
mov r9, r15
mov r8, r13
mov rdx, rdi
call fcn.14004d020
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14004ceb5
cmp ebx, 0xc015001d
je 0x14004ceb5
test r14b, 4
je 0x14004beb8
mov ebx, 0xc0000225
jmp 0x14004ceb5
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14004bec5
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004bed9
xor eax, eax
mov ebx, eax
jmp 0x14004ceb5
xor r15d, r15d
mov qword [rbp], r15
lea r8, [rbp]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rsi, eax
test eax, eax
jne 0x14004bfe9
mov ebx, r15d
test rsi, rsi
jne 0x14004bfe9
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x410]
call fcn.14006f000
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x210]
call fcn.14006f000
mov dword [rbp - 0x10], 0xff
mov dword [rbp - 8], r15d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x410]
mov edx, ebx
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rsi, eax
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0x210]
call fcn.14007f5d8
test eax, eax
jne 0x14004bfdb
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call fcn.14006f000
mov dword [rbp - 0x10], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x10]
test r14b, 8
je 0x14004bfcc
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004bfd2
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rsi, rsi
je 0x14004c17b
inc ebx
cmp ebx, 0x1000
jl 0x14004bf06
mov rcx, qword [r12 + 0x10]
lea r15, [0x1400b8c80]
movabs rbx, 0x7ffffffffffffffe
test rcx, rcx
je 0x14004c30e
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x14004cf9c
cmp qword [r12 + 0x18], 8
jb 0x14004c024
mov r12, qword [r12]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
mov r9, r12
lea rcx, [rsp + 0x68]
call fcn.14001de74
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x68]
call fcn.140009ff0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14004c0b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c0b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfa2
call fcn.14006c550
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004c102
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c0fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfa8
call fcn.14006c550
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004c30e
lea rax, [rbp - 0x50]
cmp rdi, rax
je 0x14004c1dc
mov r14, qword [rbp - 0x40]
lea r12, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r12, qword [rbp - 0x50]
mov r15, qword [rdi + 0x18]
cmp r14, r15
ja 0x14004c1e7
cmp r15, 8
jb 0x14004c154
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r14
lea r8, [r14 + r14]
mov rdx, r12
mov rcx, rdi
call fcn.14006e930
xor r13d, r13d
mov word [rdi + r14*2], r13w
mov ebx, r13d
jmp 0x14004cea5
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140004d8c
nop
lea r8, [0x1400b8c80]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140008e7c
nop
lea r8, [rbp + 0x210]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140008e7c
mov rdx, rax
mov rcx, rdi
call fcn.140004d44
lea rcx, [rsp + 0x68]
call fcn.140007668
nop
lea rcx, [rbp - 0x78]
call fcn.140007668
nop
lea rcx, [rsp + 0x40]
call fcn.140007668
xor r13d, r13d
mov ebx, r13d
jmp 0x14004cea5
cmp r14, rbx
ja 0x14004cf7e
mov rcx, r14
or rcx, 7
cmp rcx, rbx
jbe 0x14004c20c
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c25e
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
jbe 0x14004c22d
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c25e
lea rax, [rdx + r15]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14004d00e
add rcx, rcx
cmp rcx, 0x1000
jb 0x14004c28d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004d00e
mov rcx, rax
call fcn.14006c558
test rax, rax
je 0x14004d008
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
xor r13d, r13d
jmp 0x14004c2a5
test rcx, rcx
je 0x14004c29f
call fcn.14006c558
mov rsi, rax
xor r13d, r13d
jmp 0x14004c2a5
xor r13d, r13d
mov rsi, r13
mov qword [rdi + 0x18], rbx
mov rax, qword [rsp + 0x60]
lea rbx, [r14 + r14]
mov qword [rax], r14
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call fcn.14006e930
mov word [rbx + rsi], r13w
cmp r15, 8
jb 0x14004c303
lea rdx, [r15*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14004c2fe
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004d008
mov rcx, r8
call fcn.14006c550
mov qword [rdi], rsi
mov ebx, r13d
jmp 0x14004cea5
mov r8d, dword [r13 + 8]
lea rdx, [rsp + 0x68]
call fcn.14004d500
nop
mov r8d, 1
mov rdx, r15
mov rcx, rax
call fcn.140009ff0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
xor r13d, r13d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.140009ff0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14004c3d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c3d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfae
call fcn.14006c550
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004c420
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c41b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfb4
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004c475
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c470
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfba
call fcn.14006c550
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004c5a3
lea rax, [rbp - 0x50]
cmp rdi, rax
je 0x14004c1df
mov r14, qword [rbp - 0x40]
lea r12, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r12, qword [rbp - 0x50]
mov r15, qword [rdi + 0x18]
cmp r14, r15
ja 0x14004c4e7
cmp r15, 8
jb 0x14004c4c3
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r14
lea r8, [r14 + r14]
mov rdx, r12
mov rcx, rdi
call fcn.14006e930
mov word [rdi + r14*2], r13w
mov ebx, r13d
jmp 0x14004cea5
cmp r14, rbx
ja 0x14004cf7e
mov rcx, r14
or rcx, 7
cmp rcx, rbx
jbe 0x14004c50c
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c55e
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
jbe 0x14004c52d
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c55e
lea rax, [rdx + r15]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14004d00e
add rcx, rcx
cmp rcx, 0x1000
jb 0x14004c58d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004d00e
mov rcx, rax
call fcn.14006c558
test rax, rax
je 0x14004d008
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14004c2a5
test rcx, rcx
je 0x14004c2a2
call fcn.14006c558
mov rsi, rax
jmp 0x14004c2a5
mov edx, 0x1000
lea rcx, [rbp + 0x610]
test r14b, 8
je 0x14004c5bd
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14004c5c3
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp + 0x610]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14004c5e5
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x68]
call fcn.140009374
nop
mov r8d, 1
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.140009ff0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.140009ff0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14004c6ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c6b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfc0
call fcn.14006c550
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004c704
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c6ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfc6
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004c759
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c754
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfcc
call fcn.14006c550
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004c8a8
lea rax, [rbp - 0x50]
cmp rdi, rax
je 0x14004c1df
lea r12, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r12, qword [rbp - 0x50]
mov r15, qword [rdi + 0x18]
mov r14, qword [rbp - 0x40]
cmp r14, r15
ja 0x14004c7cb
cmp r15, 8
jb 0x14004c7a7
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r14
lea r8, [r14 + r14]
mov rdx, r12
mov rcx, rdi
call fcn.14006e930
mov word [rdi + r14*2], r13w
mov ebx, r13d
jmp 0x14004cea5
cmp r14, rbx
ja 0x14004cf7e
mov rcx, r14
or rcx, 7
cmp rcx, rbx
jbe 0x14004c7f0
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c842
mov rdx, r15
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r15, rax
jbe 0x14004c811
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14004c842
lea rax, [r15 + rdx]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14004d00e
add rcx, rcx
cmp rcx, 0x1000
jb 0x14004c86e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004d00e
mov rcx, rax
call fcn.14006c558
test rax, rax
je 0x14004d008
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14004c880
test rcx, rcx
je 0x14004c87d
call fcn.14006c558
mov rsi, rax
jmp 0x14004c880
mov rsi, r13
mov rax, qword [rsp + 0x60]
mov qword [rax], r14
mov qword [rdi + 0x18], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call fcn.14006e930
mov word [rsi + rbx], r13w
jmp 0x14004c2c8
mov edx, 0x1000
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp + 0x610]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14004c8d5
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x68]
call fcn.140009374
nop
mov r8d, 1
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.140009ff0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.140009ff0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14004c9aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c9a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfd2
call fcn.14006c550
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004c9f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c9ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfd8
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004ca49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ca44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfde
call fcn.14006c550
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004c776
lea rdx, [rbp + 0x610]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp + 0x610]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14004ca93
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x68]
call fcn.140009374
nop
mov r8, r15
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140008e7c
nop
lea r8, [rbp - 0x30]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14001d5d4
mov r14, rax
lea rax, [rbp - 0x50]
cmp rax, r14
je 0x14004cb55
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14004cb23
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cb1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfe4
call fcn.14006c550
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r13w
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14004cb95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cb90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfe4
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004cbe9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cbe4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cfea
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14004cc3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cc39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cff0
call fcn.14006c550
lea rcx, [rbp - 0x50]
call fcn.140028b40
test al, al
je 0x14004cc5f
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.140018d78
mov ebx, r13d
jmp 0x14004cea5
mov r8d, 0x1000
lea rdx, [rbp + 0x610]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x610]
lea r8, [rbp - 0x58]
lea rdx, [0x1400b9fc8]
call fcn.14007facc
test rax, rax
je 0x14004cea0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004ccb0
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140009374
nop
mov r8d, 1
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140009ff0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.140009ff0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14004cd80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cd7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cff6
call fcn.14006c550
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004cdca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cdc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cffc
call fcn.14006c550
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14004ce1e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ce19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d002
call fcn.14006c550
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004ce40
mov rcx, qword [rbp - 0x58]
jmp 0x14004cc80
lea rax, [rbp - 0x50]
cmp rdi, rax
je 0x14004c1df
mov r14, qword [rbp - 0x40]
lea r12, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r12, qword [rbp - 0x50]
mov r15, qword [rdi + 0x18]
cmp r14, r15
ja 0x14004ce92
cmp r15, 8
jb 0x14004ce71
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rax], r14
lea r8, [r14 + r14]
mov rdx, r12
mov rcx, rdi
call fcn.14006e930
mov word [rdi + r14*2], r13w
mov ebx, r13d
jmp 0x14004cea5
cmp r14, rbx
ja 0x14004cf7e
jmp 0x14004c4f0
mov ebx, 0xc0000225
mov rcx, qword [rbp]
test rcx, rcx
jle 0x14004ceb5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14004cef5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cef0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d014
call fcn.14006c550
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], ax
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14004cf43
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cf3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cf78
call fcn.14006c550
mov eax, ebx
mov rcx, qword [rbp + 0x2610]
xor rcx, rsp
call fcn.14006c530
movaps xmm6, xmmword [rsp + 0x2730]
movaps xmm7, xmmword [rsp + 0x2720]
add rsp, 0x2748
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14007d788
nop
call fcn.1400012b0
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.1400012b0
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
int3
call fcn.14007d788
int3
call fcn.140001150
nop
call fcn.14007d788
int3