Function at 0x14000dfa0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rbp
push rdi
push r14
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov rax, qword [0x14021c398]
test rax, rax
jne 0x14000dfe6
lea rdx, [0x14014fdc0]
mov ecx, 0x200000
call fcn.14002e8b0
mov qword [0x14021c398], rax
xor r14d, r14d
test rax, rax
je 0x14000dff2
mov word [rax], r14w
cmp qword [0x140227f10], r14
jne 0x14000e019
mov edx, 0x22000
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x140227f10], rax
mov dword [0x140227f18], r14d
mov rax, qword [0x14021ad98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rcx, qword [0x14021ad98]
test rcx, rcx
je 0x14000e061
mov edx, dword [0x14021ada4]
call fcn.14003c464
mov rdx, rax
mov rcx, qword [0x14021ad98]
jmp 0x14000e064
mov edx, r14d
mov dword [0x14021ada0], edx
test rcx, rcx
je 0x14000e0c2
lea eax, [rdx + 0xb]
cmp eax, dword [0x14021ada4]
jae 0x14000e0c2
mov eax, edx
lea rcx, [rcx + rax*2]
movups xmm0, xmmword [0x1401b9de0]
movups xmmword [rcx], xmm0
mov eax, dword [0x1401b9df0]
mov dword [rcx + 0x10], eax
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
mov word [rcx + 0x14], ax
mov eax, dword [0x14021ada0]
add eax, 0xb
mov dword [0x14021ada0], eax
mov ecx, eax
mov rax, qword [0x14021ad98]
mov word [rax + rcx*2], r14w
mov rcx, qword [0x14021ad98]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000e0dc
xor edx, edx
mov rcx, qword [0x14021ad98]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [0x14021ad98]
test rcx, rcx
je 0x14000e128
mov edx, dword [0x14021ada0]
lea eax, [rdx + 8]
cmp eax, dword [0x14021ada4]
jae 0x14000e128
movups xmm0, xmmword [str.Crashes]
movups xmmword [rcx + rdx*2], xmm0
mov eax, dword [0x14021ada0]
add eax, 8
mov dword [0x14021ada0], eax
mov ecx, eax
mov rax, qword [0x14021ad98]
mov word [rax + rcx*2], r14w
mov rcx, qword [0x14021ad98]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000e142
xor edx, edx
mov rcx, qword [0x14021ad98]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp qword [0x14021afb8], r14
je 0x14000e199
mov edx, dword [0x14021afc4]
lea rcx, str.MT5WEBSETUP64
call fcn.14003c464
mov edi, dword [0x14021afc4]
lea ecx, [rdi - 1]
cmp eax, edi
cmovb ecx, eax
mov edi, ecx
lea rbx, [rcx + rcx]
mov r8, rbx
lea rdx, str.MT5WEBSETUP64
mov rcx, qword [0x14021afb8]
call fcn.14014cbf0
mov dword [0x14021afc0], edi
mov rax, qword [0x14021afb8]
mov word [rbx + rax], r14w
cmp qword [0x14021b1d8], r14
je 0x14000e1f0
mov edx, dword [0x14021b1e4]
lea rcx, str.MetaTrader_Web_Setup
call fcn.14003c464
mov edi, dword [0x14021b1e4]
lea ecx, [rdi - 1]
cmp eax, edi
cmovb ecx, eax
mov edi, ecx
lea rbx, [rcx + rcx]
mov r8, rbx
lea rdx, str.MetaTrader_Web_Setup
mov rcx, qword [0x14021b1d8]
call fcn.14014cbf0
mov dword [0x14021b1e0], edi
mov rax, qword [0x14021b1d8]
mov word [rbx + rax], r14w
mov dword [0x14021c328], 0x1f4
mov dword [0x14021c32c], 0x106e
mov dword [0x14021c330], 0x2b0b
mov dword [0x140227f58], 0x106e
mov rax, qword [0x14021b3f8]
test rax, rax
je 0x14000e22f
mov dword [0x14021b400], r14d
mov word [rax], r14w
cmp qword [0x14021c390], r14
jne 0x14000e246
xor ecx, ecx
call fcn.140035ae0
mov qword [0x14021c390], rax
cmp qword [0x14021c340], r14
je 0x14000e29d
mov edx, dword [0x14021c34c]
lea rcx, str.28_Feb_2024
call fcn.14003c464
mov edi, dword [0x14021c34c]
lea ecx, [rdi - 1]
cmp eax, edi
cmovb ecx, eax
mov edi, ecx
lea rbx, [rcx + rcx]
mov r8, rbx
lea rdx, str.28_Feb_2024
mov rcx, qword [0x14021c340]
call fcn.14014cbf0
mov dword [0x14021c348], edi
mov rax, qword [0x14021c340]
mov word [rbx + rax], r14w
cmp dword [0x14021bc80], 1
jb 0x14000e2bc
mov rax, qword [0x14021bc78]
test rax, rax
je 0x14000e2bc
cmp word [rax], r14w
je 0x14000e2bc
xor al, al
jmp 0x14000e2be
mov al, 1
test al, al
je 0x14000e59d
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x30]
call fcn.14014d290
mov r8d, 0x100
lea rdx, [rsp + 0x30]
lea rcx, str.CLIENTNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rsi, 0xffffffffffffffff
test eax, eax
jne 0x14000e31b
mov r8d, 0x100
lea rdx, [rsp + 0x30]
lea rcx, str.COMPUTERNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000e43d
cmp qword [0x14021bc78], r14
je 0x14000e36e
mov edx, dword [0x14021bc84]
lea rcx, [rsp + 0x30]
call fcn.14003c464
mov edx, dword [0x14021bc84]
lea ecx, [rdx - 1]
cmp eax, edx
cmovb ecx, eax
mov edi, ecx
lea rbx, [rcx + rcx]
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, qword [0x14021bc78]
call fcn.14014cbf0
mov dword [0x14021bc80], edi
mov rax, qword [0x14021bc78]
mov word [rbx + rax], r14w
mov r8d, 0x100
lea rdx, [rsp + 0x30]
lea rcx, str.USERDOMAIN
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000e43d
mov rdx, qword [0x14021bc78]
test rdx, rdx
je 0x14000e43d
mov ecx, dword [0x14021bc80]
lea eax, [rcx + 1]
cmp eax, dword [0x14021bc84]
jae 0x14000e3dc
mov eax, dword [0x1401b6678]
mov word [rdx + rcx*2], ax
mov eax, dword [0x14021bc80]
inc eax
mov dword [0x14021bc80], eax
mov ecx, eax
mov rax, qword [0x14021bc78]
mov word [rax + rcx*2], r14w
mov rdx, qword [0x14021bc78]
test rdx, rdx
je 0x14000e43d
lea rax, [rsp + 0x30]
mov rdi, rsi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x14000e3f0
test edi, edi
je 0x14000e43d
mov ecx, dword [0x14021bc80]
lea eax, [rdi + rcx]
cmp eax, dword [0x14021bc84]
jae 0x14000e43d
lea rcx, [rdx + rcx*2]
mov r8d, edi
add r8, r8
lea rdx, [rsp + 0x30]
call fcn.14014cbf0
mov ecx, dword [0x14021bc80]
add ecx, edi
mov dword [0x14021bc80], ecx
mov rax, qword [0x14021bc78]
mov word [rax + rcx*2], r14w
mov dword [rbp + 0x570], 0x1fe
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rbp + 0x568], r14
mov dword [rbp + 0x578], r14d
lea rax, [rbp + 0x568]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_SoftwareSettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e59d
lea rax, [rbp + 0x570]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x578]
xor r8d, r8d
lea rdx, str.MQL5.Login
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14000e59d
cmp word [rsp + 0x30], r14w
je 0x14000e59d
mov rcx, qword [0x14021bc78]
test rcx, rcx
je 0x14000e59d
mov edx, dword [0x14021bc80]
lea eax, [rdx + 5]
cmp eax, dword [0x14021bc84]
jae 0x14000e543
lea rcx, [rcx + rdx*2]
movsd xmm0, qword [str._for]
movsd qword [rcx], xmm0
movzx eax, word [0x1401c04a0]
mov word [rcx + 8], ax
mov eax, dword [0x14021bc80]
add eax, 5
mov dword [0x14021bc80], eax
mov ecx, eax
mov rax, qword [0x14021bc78]
mov word [rax + rcx*2], r14w
mov rcx, qword [0x14021bc78]
test rcx, rcx
je 0x14000e59d
lea rax, [rsp + 0x30]
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], r14w
jne 0x14000e550
test esi, esi
je 0x14000e59d
mov edx, dword [0x14021bc80]
lea eax, [rsi + rdx]
cmp eax, dword [0x14021bc84]
jae 0x14000e59d
lea rcx, [rcx + rdx*2]
mov r8d, esi
add r8, r8
lea rdx, [rsp + 0x30]
call fcn.14014cbf0
mov ecx, dword [0x14021bc80]
add ecx, esi
mov dword [0x14021bc80], ecx
mov rax, qword [0x14021bc78]
mov word [rax + rcx*2], r14w
lea rdi, [rbp + 0x130]
xor eax, eax
mov ecx, 0x100
rep stosd dword [rdi], eax
lea rcx, [rbp + 0x130]
call fcn.14000dbf0
cmp qword [0x14021be98], 0
je 0x14000e611
mov edx, dword [0x14021bea4]
lea rcx, [rbp + 0x130]
call fcn.14003c464
mov edx, dword [0x14021bea4]
lea ecx, [rdx - 1]
cmp eax, edx
cmovb ecx, eax
mov edi, ecx
lea rbx, [rcx + rcx]
mov r8, rbx
lea rdx, [rbp + 0x130]
mov rcx, qword [0x14021be98]
call fcn.14014cbf0
mov dword [0x14021bea0], edi
mov rax, qword [0x14021be98]
mov word [rbx + rax], r14w
lea rdi, [rbp + 0x130]
xor eax, eax
mov ecx, 0x100
rep stosd dword [rdi], eax
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret