Function at 0x1400f2de0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a18]
mov eax, 0x2b18
call fcn.14011d180
sub rsp, rax
movaps xmmword [rsp + 0x2b00], xmm6
movaps xmmword [rsp + 0x2af0], xmm7
mov rax, qword [0x14019d0c0]
xor rax, rsp
mov qword [rbp + 0x29e0], rax
mov qword [rsp + 0x60], r9
mov r15, r8
mov r14, rdx
mov qword [rsp + 0x70], rcx
mov rax, qword [rbp + 0x2a88]
mov qword [rsp + 0x68], rax
mov rax, qword [rbp + 0x2a90]
mov qword [rsp + 0x78], rax
xor edi, edi
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x9e0]
call fcn.14014c1f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x188], xmm0
mov qword [rbp + 0x198], rdi
mov qword [rbp + 0x1a0], 7
mov word [rbp + 0x188], di
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x140]
call fcn.1400eb880
mov rdx, rax
mov rcx, r14
call fcn.1400e8c40
lea rcx, [rbp + 0x140]
call fcn.1400152a0
mov r9, qword [r14 + 0x10]
lea rsi, [rdi - 1]
test r9, r9
je 0x1400f2fb3
mov rdx, r14
mov r8, qword [r14 + 0x18]
cmp r8, 7
jbe 0x1400f2ef0
mov rdx, qword [r14]
lea rcx, [r9 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x1400f2f17
cmp rcx, rdx
je 0x1400f2f22
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x1400f2f08
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
jne 0x1400f2f60
mov rdx, r14
cmp r8, 7
jbe 0x1400f2f2e
mov rdx, qword [r14]
lea rcx, [r9 - 1]
mov rax, rsi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2f
je 0x1400f2f55
cmp rcx, rdx
je 0x1400f2fb3
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x1400f2f46
sub rcx, rdx
sar rcx, 1
cmp rcx, rsi
je 0x1400f2fb3
inc rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a8], xmm0
mov qword [rbp + 0x1b8], rdi
mov qword [rbp + 0x1c0], rdi
mov rax, r9
cmp r9, rcx
jb 0x1400f3fb8
sub rax, rcx
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
mov rax, r14
cmp qword [r14 + 0x18], 7
jbe 0x1400f2fa1
mov rax, qword [r14]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x1a8]
call fcn.140015310
jmp 0x1400f2fc3
mov rdx, r14
lea rcx, [rbp + 0x1a8]
call fcn.1400e8ce0
nop
cmp dword [0x1401a888c], 9
ja 0x1400f30b6
lea r10, [rbp + 0x1a8]
mov r12, qword [rbp + 0x1a8]
mov r13, qword [rbp + 0x1c0]
cmp r13, 7
cmova r10, r12
mov rbx, qword [rbp + 0x1b8]
cmp rbx, 7
jb 0x1400f30b6
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x14017bad0]
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, rdi
je 0x1400f303a
cmp word [rcx], 0x65
je 0x1400f3037
cmp rax, 1
je 0x1400f303a
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x1400f3024
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x1400f30b6
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x14017bad0]
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x1400f315f
add rdx, 2
sub r8, 1
jne 0x1400f3060
sub rcx, r10
sar rcx, 1
jne 0x1400f30b6
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x1a8]
cmp r13, 7
cmova rcx, r12
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call fcn.14014bb50
mov qword [rbp + 0x1b8], rbx
mov r13, qword [rsp + 0x70]
mov r12, qword [r13 + 8]
mov rbx, qword [r12]
cmp rbx, r12
je 0x1400f32f4
nop dword [rax]
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x1400f30de
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1a8]
call fcn.1400f4730
cmp rax, 0xffffffffffffffff
jne 0x1400f30fb
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r12
jne 0x1400f30d0
cmp rbx, r12
je 0x1400f32f4
mov rdx, qword [rbx + 0x30]
cmp rdx, qword [rbx + 0x38]
je 0x1400f3181
mov rax, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 7
jbe 0x1400f311c
mov r15, qword [r15]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x1400f312a
mov rdx, qword [rdx]
cmp rcx, rax
jne 0x1400f3168
test rcx, rcx
je 0x1400f3155
sub rdx, r15
nop word [rax + rax]
movzx eax, word [r15 + rdx]
cmp ax, word [r15]
jne 0x1400f3168
add r15, 2
sub rcx, 1
jne 0x1400f3140
mov rdx, qword [rbx + 0x38]
sub rdx, 0x20
jmp 0x1400f316c
add rcx, 2
jmp 0x1400f3009
mov rdx, qword [rbx + 0x30]
cmp r14, rdx
je 0x1400f319f
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x1400f3197
mov rdx, qword [rdx]
jmp 0x1400f3197
cmp r14, r15
je 0x1400f319f
mov r8, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 7
jbe 0x1400f3194
mov r15, qword [r15]
mov rdx, r15
mov rcx, r14
call fcn.140066880
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x68]
mov rdx, r14
call fcn.1400f3ff0
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1400f3f62
cmp eax, 0xc015001d
je 0x1400f3f62
test byte [rbp + 0x2a80], 2
je 0x1400f3f64
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x5e0]
call fcn.14014c1f0
mov edx, 0xff
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp + 0x5e0]
nop dword [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400f3220
mov r8, rsi
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0xa0]
call fcn.140015310
nop
mov r8d, 1
lea rdx, [0x14017babc]
lea rcx, [rbp + 0xa0]
call fcn.1400f5110
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x1400f3294
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp - 0x40]
call fcn.1400f5110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400e8c40
lea rcx, [rsp + 0x40]
call fcn.1400152a0
nop
lea rcx, [rbp - 0x40]
call fcn.1400152a0
nop
lea rcx, [rbp + 0xa0]
call fcn.1400152a0
jmp 0x1400f3f64
mov r12d, dword [rbp + 0x2a80]
test r12b, 1
jne 0x1400f3334
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x68]
mov rdx, r14
call fcn.1400f3ff0
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1400f3f62
cmp eax, 0xc015001d
je 0x1400f3f62
test r12b, 4
je 0x1400f333e
mov edi, 0xc0000225
jmp 0x1400f3f64
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x1400f334b
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400f3f64
mov qword [rbp + 0x1d8], rdi
lea r8, [rbp + 0x1d8]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd r15, eax
test eax, eax
jne 0x1400f3496
mov ebx, edi
nop dword [rax]
test r15, r15
jne 0x1400f3496
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x7e0]
call fcn.14014c1f0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x3e0]
call fcn.14014c1f0
mov dword [rbp + 0x1c8], 0xff
mov dword [rbp + 0x1d0], edi
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x1c8]
lea r8, [rbp + 0x7e0]
mov edx, ebx
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd r15, eax
lea rdx, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 7
cmova rdx, qword [rbp + 0x1a8]
lea rcx, [rbp + 0x3e0]
call fcn.14013785c
test eax, eax
jne 0x1400f3488
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x1e0]
call fcn.14014c1f0
mov dword [rbp + 0x1c8], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x1e0]
test r12b, 8
je 0x1400f3479
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x1400f347f
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test r15, r15
je 0x1400f37a3
inc ebx
cmp ebx, 0x1000
jl 0x1400f3390
mov rcx, qword [rsp + 0x60]
mov r15, qword [rcx + 0x10]
test r15, r15
je 0x1400f363a
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
sub rax, r15
cmp rax, 1
jb 0x1400f3fbe
cmp qword [rcx + 0x18], 7
jbe 0x1400f34d1
mov rcx, qword [rcx]
mov qword [rsp + 0x60], rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [r15 + 1]
mov ecx, 7
lea r13, [rbp - 0x80]
cmp rax, rcx
jbe 0x1400f352e
or rax, rcx
cmp rax, rbx
ja 0x1400f3509
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
inc rbx
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.1400153e0
mov r13, rax
lea rcx, [rbx - 1]
mov qword [rbp - 0x80], rax
lea rax, [r15 + 1]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rcx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.14014bb50
mov word [rbx + r13], 0x5c
mov word [r13 + r15*2 + 2], di
lea rdx, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 7
cmova rdx, qword [rbp + 0x1a8]
mov r8, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x80]
call fcn.1400f5110
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 7
jbe 0x1400f35df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f35da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f3fc4
call fcn.14011c93c
movups xmmword [rbp + 0x188], xmm6
movups xmmword [rbp + 0x198], xmm7
movdqa xmm0, xmmword [0x14017cf40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.1400152a0
nop
lea rcx, [rbp - 0x80]
call fcn.1400152a0
lea rcx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 7
cmova rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400f3d31
mov rax, qword [rsp + 0x68]
mov r8d, dword [rax + 8]
lea rdx, [rbp + 0x160]
call fcn.1400f44c0
nop
mov r8d, 1
lea rdx, [0x14017babc]
mov rcx, rax
call fcn.1400f5110
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 7
cmova rdx, qword [rbp + 0x1a8]
mov r8, qword [rbp + 0x1b8]
lea rcx, [rbp]
call fcn.1400f5110
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 7
jbe 0x1400f371a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f3715
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f3fca
call fcn.14011c93c
movups xmmword [rbp + 0x188], xmm6
movups xmmword [rbp + 0x198], xmm7
movdqa xmm0, xmmword [0x14017cf40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.1400152a0
nop
lea rcx, [rbp]
call fcn.1400152a0
nop
lea rcx, [rbp + 0x160]
call fcn.1400152a0
lea rcx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 7
cmova rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400f3d31
mov edx, 0x1000
lea rcx, [rbp + 0x9e0]
test r12b, 8
je 0x1400f38a0
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x1400f38a6
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
lea rax, [rbp + 0x1e0]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x1400f37c2
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0xc0]
call fcn.140015310
nop
mov r8d, 1
lea rdx, [0x14017babc]
lea rcx, [rbp + 0xc0]
call fcn.1400f5110
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rax, [rbp + 0x3e0]
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400f3830
mov r8, rsi
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp - 0x20]
call fcn.1400f5110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400e8c40
lea rcx, [rsp + 0x40]
call fcn.1400152a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400152a0
nop
lea rcx, [rbp + 0xc0]
call fcn.1400152a0
jmp 0x1400f3f4e
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x1400f38c5
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xe0]
call fcn.140015310
nop
mov r8d, 1
lea rdx, [0x14017babc]
lea rcx, [rbp + 0xe0]
call fcn.1400f5110
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 7
cmova rdx, qword [rbp + 0x1a8]
mov r8, qword [rbp + 0x1b8]
lea rcx, [rbp + 0x20]
call fcn.1400f5110
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 7
jbe 0x1400f39b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f39ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f3fd0
call fcn.14011c93c
movups xmmword [rbp + 0x188], xmm6
movups xmmword [rbp + 0x198], xmm7
movdqa xmm0, xmmword [0x14017cf40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.1400152a0
nop
lea rcx, [rbp + 0x20]
call fcn.1400152a0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400152a0
lea rcx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 7
cmova rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400f3d31
mov edx, 0x1000
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400f3a50
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x100]
call fcn.140015310
nop
mov r8d, 1
lea rdx, [0x14017babc]
lea rcx, [rbp + 0x100]
call fcn.1400f5110
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 7
cmova rdx, qword [rbp + 0x1a8]
mov r8, qword [rbp + 0x1b8]
lea rcx, [rbp + 0x40]
call fcn.1400f5110
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 7
jbe 0x1400f3b3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f3b38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f3fd6
call fcn.14011c93c
movups xmmword [rbp + 0x188], xmm6
movups xmmword [rbp + 0x198], xmm7
movdqa xmm0, xmmword [0x14017cf40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.1400152a0
nop
lea rcx, [rbp + 0x40]
call fcn.1400152a0
nop
lea rcx, [rbp + 0x100]
call fcn.1400152a0
lea rcx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 7
cmova rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400f3d31
lea rdx, [rbp + 0x9e0]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x130], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400f3be0
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x120]
call fcn.140015310
nop
mov r8d, 1
lea rdx, [0x14017babc]
lea rcx, [rbp + 0x120]
call fcn.1400f5110
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 7
cmova rdx, qword [rbp + 0x1a8]
mov r8, qword [rbp + 0x1b8]
lea rcx, [rbp + 0x60]
call fcn.1400f5110
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 7
jbe 0x1400f3ccd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f3cc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f3fdc
call fcn.14011c93c
movups xmmword [rbp + 0x188], xmm6
movups xmmword [rbp + 0x198], xmm7
movdqa xmm0, xmmword [0x14017cf40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.1400152a0
nop
lea rcx, [rbp + 0x60]
call fcn.1400152a0
nop
lea rcx, [rbp + 0x120]
call fcn.1400152a0
lea rcx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 7
cmova rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f3d6c
lea rax, [rbp + 0x188]
cmp r14, rax
je 0x1400f3f4e
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 7
cmova rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
mov rcx, r14
call fcn.140066880
jmp 0x1400f3f4e
mov r8d, 0x1000
lea rdx, [rbp + 0x9e0]
lea rcx, [0x14017bac0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp + 0x180]
lea rdx, [0x14017bacc]
lea rcx, [rbp + 0x9e0]
call fcn.140137b78
test rax, rax
je 0x1400f3f49
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], rdi
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400f3dd0
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.140015310
nop
mov r8d, 1
lea rdx, [0x14017babc]
lea rcx, [rbp + 0x80]
call fcn.1400f5110
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 7
cmova rdx, qword [rbp + 0x1a8]
mov r8, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x60]
call fcn.1400f5110
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm7
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 7
jbe 0x1400f3ebe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f3eb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f3fb2
call fcn.14011c93c
movups xmmword [rbp + 0x188], xmm6
movups xmmword [rbp + 0x198], xmm7
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.1400152a0
nop
lea rcx, [rbp - 0x60]
call fcn.1400152a0
nop
lea rcx, [rbp + 0x80]
call fcn.1400152a0
lea rcx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 7
cmova rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400f3d31
lea r8, [rbp + 0x180]
lea rdx, [0x14017bacc]
mov rcx, qword [rbp + 0x180]
call fcn.140137b78
test rax, rax
jne 0x1400f3db0
mov edi, 0xc0000225
mov rcx, qword [rbp + 0x1d8]
test rcx, rcx
jle 0x1400f3f64
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400f3f64
mov edi, eax
lea rcx, [rbp + 0x1a8]
call fcn.1400152a0
nop
lea rcx, [rbp + 0x188]
call fcn.1400152a0
mov eax, edi
mov rcx, qword [rbp + 0x29e0]
xor rcx, rsp
call fcn.14011c6a0
movaps xmm6, xmmword [rsp + 0x2b00]
movaps xmm7, xmmword [rsp + 0x2af0]
add rsp, 0x2b18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14012387c
nop
call fcn.1400098d0
nop
call fcn.140001660
nop
call fcn.14012387c
nop
call fcn.14012387c
nop
call fcn.14012387c
nop
call fcn.14012387c
nop
call fcn.14012387c
int3