Function at 0x14001a420
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2648]
mov eax, 0x2748
call fcn.140044090
sub rsp, rax
mov rax, qword [0x140093020]
xor rax, rsp
mov qword [rbp + 0x2630], rax
mov qword [rbp - 0x40], r9
mov r15, r8
mov r14, rdx
mov r12, rcx
mov rsi, qword [rbp + 0x26b8]
mov qword [rbp - 0x70], rsi
mov r13, qword [rbp + 0x26c0]
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x630]
call fcn.140045d80
movzx edx, byte [rsp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140004df0
lea rdx, [0x140085c58]
lea rcx, [rbp - 0x30]
call fcn.140001650
lea rcx, [rbp - 0x30]
call fcn.1400034a0
nop
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.140002db0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140013230
mov rdi, rax
cmp r14, rax
je 0x14001a4fe
mov rcx, r14
call fcn.1400033b0
mov rcx, rdi
call fcn.140003390
mov rbx, rax
mov rcx, r14
call fcn.140003390
mov rcx, rbx
call fcn.140002ed0
mov rdx, rdi
mov rcx, r14
call fcn.1400036b0
lea rcx, [rsp + 0x40]
call fcn.140002d40
mov rdx, r14
lea rcx, [rbp]
call fcn.140012cd0
nop
cmp dword [0x1400962bc], 9
ja 0x14001a5a3
lea rcx, [0x1400861b8]
call fcn.1400040a0
mov rbx, rax
mov rdi, qword [rbp + 0x10]
lea rcx, [rbp]
call fcn.140002960
mov qword [rsp + 0x20], rbx
lea r9, [0x1400861b8]
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140004a80
test rax, rax
jne 0x14001a5a3
mov qword [rbp + 0x20], 4
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x20]
call fcn.140002a20
mov rdi, qword [rax]
mov rbx, qword [rbp + 0x10]
lea rcx, [rbp]
call fcn.140002960
sub rbx, rdi
mov qword [rbp + 0x10], rbx
lea r8, [rbx + 1]
lea rdx, [rax + rdi*2]
mov rcx, rax
call fcn.140004190
add r12, 8
mov rax, qword [r12]
mov qword [rbp - 0x48], rax
mov rdx, r12
lea rcx, [rbp - 0x48]
call fcn.140001650
mov rbx, qword [rbp - 0x48]
mov rax, qword [r12]
mov rcx, qword [rax]
mov qword [rbp + 0x20], rcx
mov rdx, r12
lea rcx, [rbp + 0x20]
call fcn.140001650
mov rax, qword [rbp + 0x20]
mov qword [rbp - 8], rax
xor edx, edx
lea rcx, [rbp - 8]
call fcn.140001650
mov qword [rbp - 0x10], rbx
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.140001650
mov rbx, qword [rbp - 8]
cmp rbx, qword [rbp - 0x10]
je 0x14001a657
lea rcx, [rbx + 0x10]
call fcn.140002c00
mov rsi, rax
mov rcx, rax
call fcn.1400040a0
mov rbx, rax
mov rdi, qword [rbp + 0x10]
lea rcx, [rbp]
call fcn.140002960
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140004a80
mov rbx, qword [rbp - 8]
cmp rax, 0xffffffffffffffff
jne 0x14001a653
mov rbx, qword [rbx]
mov qword [rbp - 8], rbx
cmp rbx, qword [rbp - 0x10]
jne 0x14001a602
mov rsi, qword [rbp - 0x70]
mov rax, qword [r12]
mov qword [rsp + 0x68], rax
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.140001650
cmp rbx, qword [rsp + 0x68]
je 0x14001a835
mov rsi, qword [rbx + 0x30]
cmp rsi, qword [rbx + 0x38]
je 0x14001a6e0
mov rdi, qword [r15 + 0x10]
mov rcx, r15
call fcn.140002960
mov r12, rax
mov r15, qword [rsi + 0x10]
mov rcx, rsi
call fcn.140002960
cmp r15, rdi
jne 0x14001a6be
mov r8, r15
mov rdx, r12
mov rcx, rax
call fcn.1400040e0
test eax, eax
jne 0x14001a6be
mov rdi, qword [rbx + 0x38]
sub rdi, 0x20
jmp 0x14001a6c2
mov rdi, qword [rbx + 0x30]
cmp r14, rdi
je 0x14001a70f
mov rcx, rdi
call fcn.140003390
mov rcx, r14
call fcn.140003390
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
jmp 0x14001a6fc
cmp r14, r15
je 0x14001a70f
mov rcx, r15
call fcn.140003390
mov rcx, r14
call fcn.140003390
mov rbx, qword [r15 + 0x10]
mov rcx, r15
call fcn.140002960
mov r8, rbx
mov rdx, rax
mov rcx, r14
call fcn.1400035b0
mov r9, r13
mov r8, qword [rbp - 0x70]
mov rdx, r14
call fcn.14001b0c0
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14001b07f
cmp eax, 0xc015001d
je 0x14001b07f
test byte [rbp + 0x26b0], 2
je 0x14001a82e
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.140045d80
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x68]
call fcn.140002e30
mov rbx, rax
lea rcx, [0x1400861b4]
call fcn.1400040a0
mov rcx, rax
call fcn.140002ed0
mov r8, rax
lea rdx, [0x1400861b4]
mov rcx, rbx
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002db0
nop
mov rbx, qword [r14 + 0x10]
mov rcx, r14
call fcn.140002960
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002db0
lea rax, [rsp + 0x40]
cmp r14, rax
je 0x14001a80f
mov rcx, r14
call fcn.1400033b0
lea rcx, [rsp + 0x40]
call fcn.140003390
mov rbx, rax
mov rcx, r14
call fcn.140003390
mov rcx, rbx
call fcn.140002ed0
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400036b0
lea rcx, [rsp + 0x40]
call fcn.140002d40
nop
lea rcx, [rsp + 0x70]
call fcn.140002d40
nop
lea rcx, [rbp - 0x68]
call fcn.140002d40
xor esi, esi
jmp 0x14001b081
mov r15d, dword [rbp + 0x26b0]
test r15b, 1
jne 0x14001a871
mov r9, r13
mov r8, rsi
mov rdx, r14
call fcn.14001b0c0
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14001b07f
cmp eax, 0xc015001d
je 0x14001b07f
test r15b, 4
je 0x14001a87b
mov esi, 0xc0000225
jmp 0x14001b081
mov rcx, r14
call fcn.140002c00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
jne 0x14001b081
mov qword [rbp + 0x28], rsi
lea r8, [rbp + 0x28]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rdi, eax
test eax, eax
jne 0x14001a9a0
mov ebx, esi
test rdi, rdi
jne 0x14001a9a0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x430]
call fcn.140045d80
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x230]
call fcn.140045d80
mov dword [rbp - 0x10], 0xff
mov dword [rbp - 8], esi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x430]
mov edx, ebx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rdi, eax
lea rcx, [rbp]
call fcn.140002c00
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.14004a3fc
test eax, eax
jne 0x14001a992
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x30]
call fcn.140045d80
mov dword [rbp - 0x10], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x30]
test r15b, 8
je 0x14001a983
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14001a989
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rdi, rdi
je 0x14001ab58
inc ebx
cmp ebx, 0x1000
jl 0x14001a8c0
mov rbx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140002b20
test al, al
jne 0x14001aa56
lea r8, [0x1400861b4]
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.140004960
mov rdi, rax
mov rbx, qword [rbp + 0x10]
lea rcx, [rbp]
call fcn.140002960
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002db0
lea rcx, [rbp - 0x30]
call fcn.1400033b0
lea rcx, [rsp + 0x40]
call fcn.140003390
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140003390
mov rcx, rbx
call fcn.140002ed0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.1400036b0
lea rcx, [rsp + 0x40]
call fcn.140002d40
nop
lea rcx, [rbp - 0x68]
call fcn.140002d40
lea rcx, [rbp - 0x30]
call fcn.140002c00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001aef7
mov rax, qword [rbp - 0x70]
mov r8d, dword [rax + 8]
lea rdx, [rbp - 0x68]
call fcn.14001b4c0
mov rbx, rax
lea rcx, [0x1400861b4]
call fcn.1400040a0
mov rcx, rax
call fcn.140002ed0
mov r8, rax
lea rdx, [0x1400861b4]
mov rcx, rbx
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002db0
nop
mov rbx, qword [rbp + 0x10]
lea rcx, [rbp]
call fcn.140002960
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002db0
lea rcx, [rbp - 0x30]
call fcn.1400033b0
lea rcx, [rsp + 0x40]
call fcn.140003390
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140003390
mov rcx, rbx
call fcn.140002ed0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.1400036b0
lea rcx, [rsp + 0x40]
call fcn.140002d40
nop
lea rcx, [rsp + 0x70]
call fcn.140002d40
nop
lea rcx, [rbp - 0x68]
call fcn.140002d40
lea rcx, [rbp - 0x30]
call fcn.140002c00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001aef7
mov edx, 0x1000
lea rcx, [rbp + 0x630]
test r15b, 8
je 0x14001ac31
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14001ac37
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x68]
call fcn.140002e30
mov rbx, rax
lea rcx, [0x1400861b4]
call fcn.1400040a0
mov rcx, rax
call fcn.140002ed0
mov r8, rax
lea rdx, [0x1400861b4]
mov rcx, rbx
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002db0
nop
lea rcx, [rbp + 0x230]
call fcn.1400040a0
mov rcx, rax
call fcn.140002ed0
mov r8, rax
lea rdx, [rbp + 0x230]
lea rcx, [rsp + 0x70]
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002db0
lea rax, [rsp + 0x40]
cmp r14, rax
je 0x14001ac0d
mov rcx, r14
call fcn.1400033b0
lea rcx, [rsp + 0x40]
call fcn.140003390
mov rbx, rax
mov rcx, r14
call fcn.140003390
mov rcx, rbx
call fcn.140002ed0
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400036b0
lea rcx, [rsp + 0x40]
call fcn.140002d40
nop
lea rcx, [rsp + 0x70]
call fcn.140002d40
nop
lea rcx, [rbp - 0x68]
call fcn.140002d40
jmp 0x14001b06e
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rbp - 0x68]
call fcn.140002e30
mov rbx, rax
lea rcx, [0x1400861b4]
call fcn.1400040a0
mov rcx, rax
call fcn.140002ed0
mov r8, rax
lea rdx, [0x1400861b4]
mov rcx, rbx
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002db0
nop
mov rbx, qword [rbp + 0x10]
lea rcx, [rbp]
call fcn.140002960
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002db0
lea rcx, [rbp - 0x30]
call fcn.1400033b0
lea rcx, [rsp + 0x40]
call fcn.140003390
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140003390
mov rcx, rbx
call fcn.140002ed0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.1400036b0
lea rcx, [rsp + 0x40]
call fcn.140002d40
nop
lea rcx, [rsp + 0x70]
call fcn.140002d40
nop
lea rcx, [rbp - 0x68]
call fcn.140002d40
lea rcx, [rbp - 0x30]
call fcn.140002c00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001aef7
mov edx, 0x1000
lea rcx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rbp - 0x68]
call fcn.140002e30
mov rbx, rax
lea rcx, [0x1400861b4]
call fcn.1400040a0
mov rcx, rax
call fcn.140002ed0
mov r8, rax
lea rdx, [0x1400861b4]
mov rcx, rbx
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002db0
nop
mov rbx, qword [rbp + 0x10]
lea rcx, [rbp]
call fcn.140002960
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002db0
lea rcx, [rbp - 0x30]
call fcn.1400033b0
lea rcx, [rsp + 0x40]
call fcn.140003390
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140003390
mov rcx, rbx
call fcn.140002ed0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.1400036b0
lea rcx, [rsp + 0x40]
call fcn.140002d40
nop
lea rcx, [rsp + 0x70]
call fcn.140002d40
nop
lea rcx, [rbp - 0x68]
call fcn.140002d40
lea rcx, [rbp - 0x30]
call fcn.140002c00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001aef7
lea rdx, [rbp + 0x630]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rbp + 0x630]
lea rcx, [rbp - 0x68]
call fcn.140002e30
mov rbx, rax
lea rcx, [0x1400861b4]
call fcn.1400040a0
mov rcx, rax
call fcn.140002ed0
mov r8, rax
lea rdx, [0x1400861b4]
mov rcx, rbx
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002db0
nop
mov rbx, qword [rbp + 0x10]
lea rcx, [rbp]
call fcn.140002960
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002db0
lea rcx, [rbp - 0x30]
call fcn.1400033b0
lea rcx, [rsp + 0x40]
call fcn.140003390
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140003390
mov rcx, rbx
call fcn.140002ed0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.1400036b0
lea rcx, [rsp + 0x40]
call fcn.140002d40
nop
lea rcx, [rsp + 0x70]
call fcn.140002d40
nop
lea rcx, [rbp - 0x68]
call fcn.140002d40
lea rcx, [rbp - 0x30]
call fcn.140002c00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001af35
lea rax, [rbp - 0x30]
cmp r14, rax
je 0x14001b06e
lea rcx, [rbp - 0x30]
call fcn.140003390
mov rcx, r14
call fcn.140003390
mov rbx, qword [rbp - 0x20]
lea rcx, [rbp - 0x30]
call fcn.140002960
mov r8, rbx
mov rdx, rax
mov rcx, r14
call fcn.1400035b0
jmp 0x14001b06e
mov r8d, 0x1000
lea rdx, [rbp + 0x630]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8, [rbp - 0x38]
lea rdx, [0x140086270]
lea rcx, [rbp + 0x630]
call fcn.14004e87c
test rax, rax
je 0x14001b069
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140002e30
mov rbx, rax
lea rcx, [0x1400861b4]
call fcn.1400040a0
mov rcx, rax
call fcn.140002ed0
mov r8, rax
lea rdx, [0x1400861b4]
mov rcx, rbx
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002db0
nop
mov rbx, qword [rbp + 0x10]
lea rcx, [rbp]
call fcn.140002960
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001c0d0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002db0
lea rcx, [rbp - 0x30]
call fcn.1400033b0
lea rcx, [rsp + 0x40]
call fcn.140003390
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140003390
mov rcx, rbx
call fcn.140002ed0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.1400036b0
lea rcx, [rsp + 0x40]
call fcn.140002d40
nop
lea rcx, [rsp + 0x70]
call fcn.140002d40
nop
lea rcx, [rbp - 0x68]
call fcn.140002d40
lea rcx, [rbp - 0x30]
call fcn.140002c00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001aef7
lea r8, [rbp - 0x38]
lea rdx, [0x140086270]
mov rcx, qword [rbp - 0x38]
call fcn.14004e87c
test rax, rax
jne 0x14001af70
mov esi, 0xc0000225
mov rcx, qword [rbp + 0x28]
test rcx, rcx
jle 0x14001b081
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001b081
mov esi, eax
lea rcx, [rbp]
call fcn.140002d40
nop
lea rcx, [rbp - 0x30]
call fcn.140002d40
mov eax, esi
mov rcx, qword [rbp + 0x2630]
xor rcx, rsp
call fcn.1400433a0
add rsp, 0x2748
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret