Function at 0x14008b5a0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rbx, rdx
mov r15, rcx
test rdx, rdx
je 0x14008c8ed
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14008b5e0
test rax, rax
je 0x14008c8ed
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14008c915
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xe8], rax
cmp rbx, 0x10000
jae 0x14008b62f
movzx edx, bx
lea rcx, [rbp + 0xe8]
call fcn.14000d610
jmp 0x14008b64f
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14008b632
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0xe8]
call fcn.14000df90
nop
mov rbx, qword [rbp + 0xe8]
cmp dword [rbx - 8], 1
jle 0x14008b672
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0xe8]
call fcn.14000dd30
mov rbx, qword [rbp + 0xe8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
xor r13d, r13d
test rbx, rbx
jne 0x14008b688
mov eax, r13d
jmp 0x14008b69c
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14024bd08
test eax, eax
js 0x14008c90a
cmp eax, dword [rbx - 0xc]
jg 0x14008c90a
mov dword [rbx - 0x10], eax
mov eax, eax
mov word [rbx + rax*2], r13w
mov edx, dword [rbx - 0x10]
test edx, edx
je 0x14008c8ab
cmp edx, 1
jl 0x14008c90a
cmp word [rbx + 2], 0x3a
jne 0x14008c8ab
cmp dword [rbx - 8], 1
jle 0x14008b6e7
lea rcx, [rbp + 0xe8]
call fcn.14000dd30
mov rbx, qword [rbp + 0xe8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
test rbx, rbx
jne 0x14008b6fa
mov eax, r13d
jmp 0x14008b70e
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14024bd08
test eax, eax
js 0x14008c90a
cmp eax, dword [rbx - 0xc]
jg 0x14008c90a
mov dword [rbx - 0x10], eax
mov eax, eax
mov word [rbx + rax*2], r13w
mov eax, dword [rbx - 0x10]
lea r14d, [rax + rax]
movsxd r12, r14d
mov eax, 2
mul r12
cmovo rax, rsi
mov rcx, rax
call fcn.1400164e0
mov rdi, rax
mov word [rax], r13w
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rsi
nop dword [rax + rax]
inc rcx
cmp word [rdi + rcx*2], r13w
jne 0x14008b760
mov r8d, ecx
mov rdx, rdi
lea rcx, [rbp + 0xe8]
call fcn.14000df90
mov rcx, rdi
call fcn.140095d64
mov rbx, qword [rbp + 0xe8]
lea rcx, [rbx - 0x18]
call fcn.14000de80
add rax, 0x18
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x78]
call fcn.140032ea0
test eax, eax
je 0x14008b801
mov eax, 2
mul r12
cmovo rax, rsi
mov rcx, rax
call fcn.1400164e0
mov rdi, rax
mov word [rax], r13w
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov rcx, rsi
inc rcx
cmp word [rdi + rcx*2], r13w
jne 0x14008b7d6
mov r8d, ecx
mov rdx, rdi
lea rcx, [rbp + 0xe8]
call fcn.14000df90
mov rcx, rdi
call fcn.140095d64
mov rbx, qword [rbp + 0xe8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x14008c8ab
lea rcx, [rbp + 0x50]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0x78]
call fcn.1400a73ac
nop
mov rax, qword [rbp + 0x60]
mov r14, rax
mov rdi, r13
test rax, rax
jle 0x14008b86f
test rdi, rdi
js 0x14008c920
cmp rdi, rax
jge 0x14008c920
mov rax, qword [rbp + 0x58]
mov rdx, qword [rax + rdi*8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008c897
inc rdi
cmp rdi, r14
jge 0x14008b86f
mov rax, qword [rbp + 0x60]
jmp 0x14008b835
mov rax, qword [r15 + 0x238]
cmp dword [rax - 0x10], 0
je 0x14008b9b1
lea rcx, [rbp]
call fcn.1400a64e0
nop
lea r8, [rbp]
lea rdx, [r15 + 0x238]
mov rcx, r15
call fcn.14008cc20
mov r12d, r13d
mov rcx, qword [rbp + 0x10]
test rcx, rcx
jle 0x14008b9a8
mov r14, r13
cmp dword [r15 + 0x48], 2
jne 0x14008b8ec
test r14, r14
js 0x14008c926
cmp r14, rcx
jge 0x14008c926
lea rdi, [r14*8]
mov rax, qword [rbp + 8]
mov rdx, qword [rax + rdi]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c01a
jmp 0x14008b920
test r14, r14
js 0x14008c926
cmp r14, rcx
jge 0x14008c926
lea rdi, [r14*8]
mov rax, qword [rbp + 8]
mov rdx, qword [rax + rdi]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008c01a
cmp r14, qword [rbp + 0x10]
jge 0x14008c926
mov rax, qword [rbp + 8]
mov rcx, qword [rax + rdi]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rbp - 0x70], rax
mov r8d, FDICreate
lea rdx, str.Microsoft_Shared
lea rcx, [rbp - 0x70]
call fcn.1400157c0
mov rdi, qword [rbp - 0x70]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
nop
lea rdx, [rdi - 0x18]
test eax, eax
mov eax, esi
je 0x14008c000
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008b98b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r12d
inc r14
movsxd rax, r12d
mov rcx, qword [rbp + 0x10]
mov rbx, qword [rbp + 0xe8]
cmp rax, rcx
jl 0x14008b8b0
lea rcx, [rbp]
call fcn.1400a6500
mov rdx, qword [r15 + 0x240]
cmp dword [rdx - 0x10], 0
je 0x14008b9da
cmp dword [r15 + 0x358], 0
jne 0x14008b9da
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008c897
mov rax, qword [r15 + 0x248]
cmp dword [rax - 0x10], 0
je 0x14008bccf
lea rcx, [rsp + 0x60]
call fcn.1400a64e0
nop
lea r8, [rsp + 0x60]
lea rdx, [r15 + 0x248]
mov rcx, r15
call fcn.14008cc20
mov r12d, r13d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jle 0x14008bcc5
mov r14, r13
nop
test r14, r14
js 0x14008c944
cmp r14, rcx
jge 0x14008c944
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + r14*8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c0c2
cmp r14, qword [rsp + 0x70]
jge 0x14008c944
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + r14*8]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x28], rax
mov r8d, FDICreate
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x28]
call fcn.1400157c0
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008c09d
cmp r14, qword [rsp + 0x70]
jge 0x14008c93e
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + r14*8]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x20], rax
mov r8d, VariantTimeToDosDateTime
lea rdx, str.Windows_NT
lea rcx, [rsp + 0x20]
call fcn.1400157c0
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008c07e
cmp r14, qword [rsp + 0x70]
jge 0x14008c938
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + r14*8]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rbp + 0xf8], rax
mov r8d, 0x18
lea rdx, str.Windows_SidebarGadgets
lea rcx, [rbp + 0xf8]
call fcn.1400157c0
mov rdx, qword [rbp + 0xf8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c05d
cmp r14, qword [rsp + 0x70]
jge 0x14008c932
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + r14*8]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rbp + 0xf0], rax
mov r8d, FDICreate
lea rdx, str.WindowsPowerShell
lea rcx, [rbp + 0xf0]
call fcn.1400157c0
mov rdx, qword [rbp + 0xf0]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008c03c
cmp dword [r15 + 0x438], eax
jne 0x14008bc28
cmp dword [r15 + 0x43c], eax
jne 0x14008bc28
cmp r14, qword [rsp + 0x70]
jge 0x14008c92c
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + r14*8]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rbp - 0x68], rax
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.WindowsApps
lea rcx, [rbp - 0x68]
call fcn.1400157c0
mov rdi, qword [rbp - 0x68]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
nop
lea rdx, [rdi - 0x18]
test rax, rax
mov eax, esi
jne 0x14008c028
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bc28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bc49
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bc6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bc89
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bca7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r12d
inc r14
movsxd rax, r12d
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rbp + 0xe8]
cmp rax, rcx
jl 0x14008ba20
lea rcx, [rsp + 0x60]
call fcn.1400a6500
mov rdx, qword [r15 + 0x250]
cmp dword [rdx - 0x10], 0
je 0x14008bced
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x258]
cmp dword [rdx - 0x10], 0
je 0x14008bd0b
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x260]
cmp dword [rdx - 0x10], 0
je 0x14008bd29
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x268]
cmp dword [rdx - 0x10], 0
je 0x14008bd47
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x270]
cmp dword [rdx - 0x10], 0
je 0x14008bd65
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x278]
cmp dword [rdx - 0x10], 0
je 0x14008bd83
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x280]
cmp dword [rdx - 0x10], 0
je 0x14008bda1
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x288]
cmp dword [rdx - 0x10], 0
je 0x14008c167
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rcx, qword [r15 + 0x288]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, str.MicrosoftWindows_Virtual_PCVirtual_Applications
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14008bde6
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.1400157c0
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008bfd6
mov rcx, qword [r15 + 0x288]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.MicrosoftWindows_SidebarGadgets
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14008be40
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.1400157c0
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008bfb7
mov rcx, qword [r15 + 0x288]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, str.VirtualStoreProgram_Files__x86_
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14008be91
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.1400157c0
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008bf98
mov rcx, qword [r15 + 0x288]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14008bee1
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.1400157c0
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008bf79
mov rcx, qword [r15 + 0x288]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rbp - 0x60], rax
lea rdx, [0x1402f9050]
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14008bf30
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.1400157c0
mov rdi, qword [rbp - 0x60]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
nop
lea rdx, [rdi - 0x18]
test eax, eax
mov eax, esi
jne 0x14008c0d1
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bf79
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bf98
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bfb7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bfd6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bff4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0xe8]
jmp 0x14008c897
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c013
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0xe8]
lea rcx, [rbp]
call fcn.1400a6500
jmp 0x14008c897
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c03c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c05d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c07e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c09d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c0bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0xe8]
lea rcx, [rsp + 0x60]
call fcn.1400a6500
jmp 0x14008c897
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c0e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c104
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c123
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c142
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c160
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0xe8]
mov rdx, qword [r15 + 0x290]
cmp dword [rdx - 0x10], 0
je 0x14008c260
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rcx, qword [r15 + 0x290]
sub rcx, 0x18
call fcn.14000de80
lea rdi, [rax + 0x18]
mov qword [rbp - 0x50], rdi
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14008c94a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x58]
mov rcx, rdi
call fcn.14002dbf0
mov rdi, qword [rbp - 0x58]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
nop
lea rdx, [rdi - 0x18]
test eax, eax
mov eax, esi
jne 0x14008c228
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c1fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008bff4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0xe8]
jmp 0x14008c897
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c23c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c259
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0xe8]
mov rdx, qword [r15 + 0x298]
cmp dword [rdx - 0x10], 0
je 0x14008c2f2
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14008c955
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x48]
mov rcx, qword [r15 + 0x298]
call fcn.14002dbf0
mov rdi, qword [rbp - 0x48]
test eax, eax
je 0x14008c2d2
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14008c2d2
lea rdx, [rdi - 0x18]
jmp 0x14008c203
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c2eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0xe8]
mov rdx, qword [r15 + 0x2a0]
cmp dword [rdx - 0x10], 0
je 0x14008c310
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2a8]
cmp dword [rdx - 0x10], 0
je 0x14008c32e
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2b0]
cmp dword [rdx - 0x10], 0
je 0x14008c34c
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2b8]
cmp dword [rdx - 0x10], 0
je 0x14008c36a
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2c0]
cmp dword [rdx - 0x10], 0
je 0x14008c388
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2c8]
cmp dword [rdx - 0x10], 0
je 0x14008c3a6
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2d0]
cmp dword [rdx - 0x10], 0
je 0x14008c3c4
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2d8]
cmp dword [rdx - 0x10], 0
je 0x14008c3e2
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2e0]
cmp dword [rdx - 0x10], 0
je 0x14008c400
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2e8]
cmp dword [rdx - 0x10], 0
je 0x14008c41e
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2f0]
cmp dword [rdx - 0x10], 0
je 0x14008c43c
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x2f8]
cmp dword [rdx - 0x10], 0
je 0x14008c45a
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x300]
cmp dword [rdx - 0x10], 0
je 0x14008c478
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x308]
cmp dword [rdx - 0x10], 0
je 0x14008c496
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rdx, qword [r15 + 0x310]
cmp dword [rdx - 0x10], 0
je 0x14008c4b4
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov rax, qword [r15 + 0x318]
cmp dword [rax - 0x10], 0
je 0x14008c694
lea rcx, [rbp - 0x28]
call fcn.1400a64e0
nop
lea r8, [rbp - 0x28]
lea rdx, [r15 + 0x318]
mov rcx, r15
call fcn.14008cc20
mov r12d, r13d
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jle 0x14008c68b
mov r14, r13
test r14, r14
js 0x14008c96c
cmp r14, rcx
jge 0x14008c96c
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax + r14*8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c770
cmp r14, qword [rbp - 0x18]
jge 0x14008c96c
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax + r14*8]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r8d, FDICreate
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x58]
call fcn.1400157c0
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008c74b
cmp r14, qword [rbp - 0x18]
jge 0x14008c966
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax + r14*8]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x50], rax
mov r8d, VariantTimeToDosDateTime
lea rdx, str.Windows_NT
lea rcx, [rsp + 0x50]
call fcn.1400157c0
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008c72c
cmp r14, qword [rbp - 0x18]
jge 0x14008c960
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax + r14*8]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rbp - 0x40], rax
mov r8d, FDICreate
lea rdx, str.WindowsPowerShell
lea rcx, [rbp - 0x40]
call fcn.1400157c0
mov rdi, qword [rbp - 0x40]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
nop
lea rdx, [rdi - 0x18]
test rax, rax
mov eax, esi
jne 0x14008c718
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c631
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c650
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c66e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r12d
inc r14
movsxd rax, r12d
mov rcx, qword [rbp - 0x18]
mov rbx, qword [rbp + 0xe8]
cmp rax, rcx
jl 0x14008c4f5
lea rcx, [rbp - 0x28]
call fcn.1400a6500
mov rax, qword [r15 + 0x320]
cmp dword [rax - 0x10], 0
je 0x14008c843
lea rcx, [rbp + 0x28]
call fcn.1400a64e0
nop
lea r8, [rbp + 0x28]
lea rdx, [r15 + 0x320]
mov rcx, r15
call fcn.14008cc20
mov r12d, r13d
mov rcx, qword [rbp + 0x38]
test rcx, rcx
jle 0x14008c83a
mov r14, r13
cmp dword [r15 + 0x48], 2
jne 0x14008c77e
test r14, r14
js 0x14008c972
cmp r14, rcx
jge 0x14008c972
lea rdi, [r14*8]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + rdi]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c8e2
jmp 0x14008c7b2
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c72c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c74b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c769
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0xe8]
lea rcx, [rbp - 0x28]
call fcn.1400a6500
jmp 0x14008c897
test r14, r14
js 0x14008c972
cmp r14, rcx
jge 0x14008c972
lea rdi, [r14*8]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + rdi]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008c8e2
cmp r14, qword [rbp + 0x38]
jge 0x14008c972
mov rax, qword [rbp + 0x30]
mov rcx, qword [rax + rdi]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rbp - 0x38], rax
mov r8d, FDICreate
lea rdx, str.Microsoft_Shared
lea rcx, [rbp - 0x38]
call fcn.1400157c0
mov rdi, qword [rbp - 0x38]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
nop
lea rdx, [rdi - 0x18]
test eax, eax
mov eax, esi
je 0x14008c8c8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c81d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r12d
inc r14
movsxd rax, r12d
mov rcx, qword [rbp + 0x38]
mov rbx, qword [rbp + 0xe8]
cmp rax, rcx
jl 0x14008c6d5
lea rcx, [rbp + 0x28]
call fcn.1400a6500
mov rdx, qword [r15 + 0x328]
cmp dword [rdx - 0x10], 0
je 0x14008c85d
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov qword [rbp - 0x30], r13
lea r9, [rbp - 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1402d8658]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x14008c891
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x14008c891
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008c897
mov r13d, 1
lea rcx, [rbp + 0x78]
call fcn.1400a73cc
nop
lea rcx, [rbp + 0x50]
call fcn.1400a6500
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14008c8c3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r13d
jmp 0x14008c8ef
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008c8db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0xe8]
lea rcx, [rbp + 0x28]
call fcn.1400a6500
jmp 0x14008c897
xor eax, eax
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
int3