Function at 0x14005b480
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2658]
mov eax, 0x2758
call fcn.140085be0
sub rsp, rax
movaps xmmword [rsp + 0x2740], xmm6
movaps xmmword [rsp + 0x2730], xmm7
movaps xmmword [rsp + 0x2720], xmm8
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp + 0x2610], rax
mov r15, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov r13, qword [rbp + 0x26c8]
mov r12, qword [rbp + 0x26d0]
xor ebx, ebx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x610]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x68], xmm1
lea rax, [rdi + 0x10]
mov qword [rbp - 0x80], rax
mov qword [rax], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x60]
call fcn.140053620
mov rdx, rax
mov rcx, rdi
call fcn.140050930
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14005b596
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b591
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b591
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140052fd0
nop
cmp dword [0x1400f1d0c], 9
ja 0x14005b682
lea r10, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova r10, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x20]
cmp rbx, 7
jb 0x14005b682
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x14009dbe8]
mov rax, r11
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x14005b60a
cmp word [rcx], 0x65
je 0x14005b607
cmp rax, 1
je 0x14005b60a
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x14005b5f4
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14005b682
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x14009dbe8]
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x14005b71a
add rdx, 2
sub r8, 1
jne 0x14005b630
sub rcx, r10
sar rcx, 1
jne 0x14005b682
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x20], rbx
mov r14, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, r14
je 0x14005b941
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14005b6a0
mov rdx, qword [rdx]
lea rcx, [rbp - 0x30]
call fcn.14005d000
cmp rax, 0xffffffffffffffff
jne 0x14005b6b7
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x14005b692
cmp rbx, r14
je 0x14005b941
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x14005b723
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 7
jbe 0x14005b6db
mov rsi, qword [rsi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 7
jbe 0x14005b6ec
mov r8, qword [rdx]
cmp rcx, rax
jne 0x14005b726
test rcx, rcx
je 0x14005b714
sub r8, rsi
nop dword [rax]
movzx eax, word [rsi + r8]
cmp ax, word [rsi]
jne 0x14005b726
add rsi, 2
sub rcx, 1
jne 0x14005b700
lea rdx, [r9 - 0x20]
jmp 0x14005b726
add rcx, 2
jmp 0x14005b5d7
mov rdx, rsi
mov rcx, rdi
call fcn.140050840
mov r9, r12
mov r8, r13
mov rdx, rdi
call fcn.14005c820
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14005c739
cmp ebx, 0xc015001d
je 0x14005c739
test byte [rbp + 0x26c0], 2
je 0x14005b93a
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov edx, 0xff
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14005b7a2
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140050ff0
nop
mov r8d, 1
lea rdx, [0x14009dbe4]
lea rcx, [rsp + 0x60]
call fcn.14005daf0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14005b815
mov rdx, qword [rdi]
mov rax, qword [rbp - 0x80]
mov r8, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.14005daf0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rbp - 0x78]
mov rcx, rdi
call fcn.140050930
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14005b894
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b88e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b88e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005b8d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b8d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b8d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
movdqa xmm0, xmmword [0x14009efe0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14005c739
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b930
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b930
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
jmp 0x14005c739
xor ebx, ebx
jmp 0x14005c739
mov r14d, dword [rbp + 0x26c0]
test r14b, 1
jne 0x14005c734
mov r9, r12
mov r8, r13
mov rdx, rdi
call fcn.14005c820
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14005c739
cmp ebx, 0xc015001d
je 0x14005c739
test r14b, 4
jne 0x14005c734
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14005b994
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r12d, r12d
cmp eax, 0xffffffff
je 0x14005b9aa
mov ebx, r12d
jmp 0x14005c73c
mov qword [rbp], r12
lea r8, [rbp]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rsi, eax
test eax, eax
jne 0x14005bab5
mov ebx, r12d
test rsi, rsi
jne 0x14005bab5
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x410]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x10], 0xff
mov dword [rbp - 8], r12d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x410]
mov edx, ebx
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rsi, eax
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14005baa7
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x210]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x10], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x210]
test r14b, 8
je 0x14005ba98
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14005ba9e
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rsi, rsi
je 0x14005bb86
inc ebx
cmp ebx, 0x1000
jl 0x14005b9d4
mov rcx, qword [r15 + 0x10]
lea rsi, [0x14009dbe4]
test rcx, rcx
je 0x14005bdc1
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x14005c80b
cmp qword [r15 + 0x18], 7
jbe 0x14005baea
mov r15, qword [r15]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov r9, r15
lea rcx, [rbp - 0x78]
call fcn.14005d9b0
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rbp - 0x78]
call fcn.14005daf0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14005bd59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bd54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bd54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x210]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14005bbb0
lea rdx, [rbp + 0x210]
lea rcx, [rsp + 0x60]
call fcn.140050ff0
nop
mov r8d, 1
lea rdx, [0x14009dbe4]
lea rcx, [rsp + 0x60]
call fcn.14005daf0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rax, [rbp + 0x10]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14005bc20
mov r8, rbx
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14005daf0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x78]
mov rcx, rdi
call fcn.140050930
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14005bcaa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bca4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bca4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005bcef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bcea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bcea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
movdqa xmm0, xmmword [0x14009efe0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14005c72c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bd47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bd47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
mov ebx, r12d
jmp 0x14005c6aa
call fcn.140084b70
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14005bda4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bd9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bd9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005c6d4
mov r8d, dword [r13 + 8]
lea rdx, [rbp - 0x78]
call fcn.14005cd00
nop
mov r8d, 1
mov rdx, rsi
mov rcx, rax
call fcn.14005daf0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14005daf0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14005be88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005be83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005be83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005bed5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bed0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bed0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
movdqa xmm8, xmmword [0x14009efe0]
movdqu xmmword [rsp + 0x50], xmm8
mov word [rsp + 0x40], r12w
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14005bf2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bf29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bf29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005c6d4
mov edx, 0x1000
lea rcx, [rbp + 0x610]
test r14b, 8
je 0x14005bf65
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14005bf6b
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14005bf90
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.140050ff0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14005daf0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14005daf0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14005c068
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c063
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c063
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005c0b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c0b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c0b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
movdqu xmmword [rsp + 0x50], xmm8
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14005c107
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c102
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c102
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005c6d4
mov edx, 0x1000
lea rcx, [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14005c151
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.140050ff0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14005daf0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14005daf0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14005c229
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c224
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c224
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005c276
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c271
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c271
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
movdqu xmmword [rsp + 0x50], xmm8
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14005c2c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c2c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c2c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005c6d4
lea rdx, [rbp + 0x610]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x610]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14005c312
lea rdx, [rbp + 0x610]
lea rcx, [rsp + 0x60]
call fcn.140050ff0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14005daf0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14005daf0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14005c3ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c3e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c3e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005c437
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c432
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c432
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
movdqu xmmword [rsp + 0x50], xmm8
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14005c489
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c484
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c484
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005c6d4
mov r8d, 0x1000
lea rdx, [rbp + 0x610]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x58]
lea rdx, [0x14009dc84]
lea rcx, [rbp + 0x610]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
je 0x14005c6a5
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14005c500
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140050ff0
nop
mov r8d, 1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14005daf0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14005daf0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14005c5d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c5cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005c6bf
call fcn.140084b70
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005c61c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c617
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005c6c6
call fcn.140084b70
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14005c66e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c669
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005c6cd
call fcn.140084b70
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005c6d4
lea r8, [rbp - 0x58]
lea rdx, [0x14009dc84]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
jne 0x14005c4e1
mov ebx, 0xc0000225
mov rcx, qword [rbp]
test rcx, rcx
jle 0x14005c73c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14005c73c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [rbp - 0x50]
cmp rdi, rax
je 0x14005c72c
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r9, qword [rbp - 0x50]
mov rax, qword [rdi + 0x18]
mov rbx, qword [rbp - 0x40]
cmp rbx, rax
ja 0x14005c721
cmp rax, 7
jbe 0x14005c701
mov rdi, qword [rdi]
mov rax, qword [rbp - 0x80]
mov qword [rax], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rbx*2], r12w
mov ebx, r12d
jmp 0x14005c6aa
mov rdx, rbx
mov rcx, rdi
call fcn.1400511b0
mov ebx, r12d
jmp 0x14005c6aa
mov ebx, 0xc0000225
xor r12d, r12d
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14005c77f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c77a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c77a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14005c7d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c7ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c7ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084b70
mov eax, ebx
mov rcx, qword [rbp + 0x2610]
xor rcx, rsp
call fcn.140084e30
lea r11, [rsp + 0x2758]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400439d0
nop
int3