Function at 0x140079ba0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a18]
mov eax, 0x2b18
call fcn.1400a4d00
sub rsp, rax
movaps xmmword [rsp + 0x2b00], xmm6
movaps xmmword [rsp + 0x2af0], xmm7
mov rax, qword [0x14016f0a8]
xor rax, rsp
mov qword [rbp + 0x29e0], rax
mov r12, r9
mov qword [rsp + 0x60], r9
mov rsi, r8
mov r14, rdx
mov r13, rcx
mov rax, qword [rbp + 0x2a88]
mov qword [rsp + 0x68], rax
mov rax, qword [rbp + 0x2a90]
mov qword [rsp + 0x70], rax
xor edi, edi
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x9e0]
call fcn.1400a6a20
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rdi
mov qword [rbp + 0x198], 7
mov word [rbp + 0x180], di
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x138]
call fcn.140072780
mov rdx, rax
mov rcx, r14
call fcn.14006f8e0
lea rcx, [rbp + 0x138]
call fcn.14006fae0
mov rdx, r14
lea rcx, [rbp + 0x1a0]
call fcn.140072160
nop
cmp dword [0x140176c7c], 9
ja 0x140079d9b
lea r10, [rbp + 0x1a0]
mov r15, qword [rbp + 0x1a0]
mov r12, qword [rbp + 0x1b8]
cmp r12, 8
cmovae r10, r15
mov rbx, qword [rbp + 0x1b0]
cmp rbx, 7
jb 0x140079d96
lea r11, [rbx - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r9, [0x1401536a0]
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, rdi
je 0x140079d17
cmp word [rcx], 0x65
je 0x140079d14
cmp rax, 1
je 0x140079d17
dec rax
add rcx, 2
cmp word [rcx], 0x65
jne 0x140079d01
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140079d96
mov r8d, 7
mov rdx, r9
mov r9, rcx
lea rax, [0x1401536a0]
sub r9, rax
nop word [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140079e4d
add rdx, 2
sub r8, 1
jne 0x140079d40
sub rcx, r10
sar rcx, 1
jne 0x140079d96
mov eax, 4
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x1a0]
cmp r12, 8
cmovae rcx, r15
sub rbx, rax
lea rdx, [rcx + rax*2]
lea r8, [rbx*2 + 2]
call fcn.1400a6380
mov qword [rbp + 0x1b0], rbx
mov r12, qword [rsp + 0x60]
mov r15, qword [r13 + 8]
mov rbx, qword [r15]
cmp rbx, r15
je 0x140079fd4
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140079dbe
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1a0]
call fcn.14007b3e0
cmp rax, 0xffffffffffffffff
jne 0x140079ddb
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r15
jne 0x140079db0
cmp rbx, r15
je 0x140079fd4
mov rdx, qword [rbx + 0x30]
mov r9, qword [rbx + 0x38]
cmp rdx, r9
je 0x140079e56
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x140079dff
mov rsi, qword [rsi]
mov rcx, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x140079e10
mov r8, qword [rdx]
cmp rcx, rax
jne 0x140079e38
test rcx, rcx
je 0x140079e34
sub r8, rsi
nop dword [rax]
movzx eax, word [r8 + rsi]
cmp ax, word [rsi]
jne 0x140079e38
add rsi, 2
sub rcx, 1
jne 0x140079e20
lea rdx, [r9 - 0x20]
cmp r14, rdx
je 0x140079e74
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140079e6c
mov rdx, qword [rdx]
jmp 0x140079e6c
add rcx, 2
jmp 0x140079ce6
cmp r14, rsi
je 0x140079e74
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x140079e69
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, r14
call fcn.14006fb50
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
mov rdx, r14
call fcn.14007aca0
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14007ac23
cmp eax, 0xc015001d
je 0x14007ac23
test byte [rbp + 0x2a80], 2
je 0x14007ac25
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x5e0]
call fcn.1400a6a20
mov edx, 0xff
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
lea rax, [rbp + 0x5e0]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140079f00
mov r8, rbx
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x98]
call fcn.1400701c0
nop
mov r8d, 1
lea rdx, [0x14015369c]
lea rcx, [rbp + 0x98]
call fcn.14007bdc0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140079f74
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp - 0x48]
call fcn.14007bdc0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.14006f8e0
lea rcx, [rsp + 0x40]
call fcn.14006fae0
nop
lea rcx, [rbp - 0x48]
call fcn.14006fae0
nop
lea rcx, [rbp + 0x98]
call fcn.14006fae0
jmp 0x14007ac25
mov r15d, dword [rbp + 0x2a80]
test r15b, 1
jne 0x14007a014
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
mov rdx, r14
call fcn.14007aca0
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14007ac23
cmp eax, 0xc015001d
je 0x14007ac23
test r15b, 4
je 0x14007a01e
mov edi, 0xc0000225
jmp 0x14007ac25
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x14007a02b
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14007ac25
mov qword [rbp + 0x1d0], rdi
lea r8, [rbp + 0x1d0]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
movsxd rsi, eax
test eax, eax
jne 0x14007a176
mov ebx, edi
nop dword [rax]
test rsi, rsi
jne 0x14007a176
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x7e0]
call fcn.1400a6a20
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x3e0]
call fcn.1400a6a20
mov dword [rbp + 0x1c0], 0xff
mov dword [rbp + 0x1c8], edi
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x1c0]
lea r8, [rbp + 0x7e0]
mov edx, ebx
mov rcx, qword [rbp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movsxd rsi, eax
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rdx, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x3e0]
call fcn.1400ba26c
test eax, eax
jne 0x14007a168
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x1e0]
call fcn.1400a6a20
mov dword [rbp + 0x1c0], 0xff
mov edx, 0xff
lea rcx, [rbp + 0x1e0]
test r15b, 8
je 0x14007a159
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14007a15f
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test rsi, rsi
je 0x14007a1ee
inc ebx
cmp ebx, 0x1000
jl 0x14007a070
mov rsi, qword [r12 + 0x10]
test rsi, rsi
je 0x14007a41f
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, 1
jb 0x14007ac79
cmp qword [r12 + 0x18], 8
jb 0x14007a1af
mov r12, qword [r12]
mov qword [rsp + 0x60], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea r13, [rsi + 1]
mov ebx, 7
lea r12, [rsp + 0x78]
cmp r13, rbx
jbe 0x14007a312
mov rbx, r13
or rbx, 7
cmp rbx, rcx
jbe 0x14007a2f0
mov rbx, rcx
jmp 0x14007a2fc
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
lea rax, [rbp + 0x1e0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14007a214
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0xb8]
call fcn.1400701c0
nop
mov r8d, 1
lea rdx, [0x14015369c]
lea rcx, [rbp + 0xb8]
call fcn.14007bdc0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rax, [rbp + 0x3e0]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14007a280
mov r8, rbx
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp - 0x28]
call fcn.14007bdc0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.14006f8e0
lea rcx, [rsp + 0x40]
call fcn.14006fae0
nop
lea rcx, [rbp - 0x28]
call fcn.14006fae0
nop
lea rcx, [rbp + 0xb8]
call fcn.14006fae0
jmp 0x14007ac0f
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x78]
call fcn.1400704a0
mov r12, rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call fcn.1400a6380
mov word [rbx + r12], 0x5c
mov word [r12 + r13*2], di
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rsp + 0x78]
call fcn.14007bdc0
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x14007a3c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a3be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ac7f
call fcn.1400a4250
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
movdqa xmm0, xmmword [0x140154c40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.14006fae0
nop
lea rcx, [rsp + 0x78]
call fcn.14006fae0
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 8
cmovae rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14007aa21
mov rax, qword [rsp + 0x68]
mov r8d, dword [rax + 8]
lea rdx, [rbp + 0x158]
call fcn.14007b170
nop
mov r8d, 1
lea rdx, [0x14015369c]
mov rcx, rax
call fcn.14007bdc0
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp - 8]
call fcn.14007bdc0
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x14007a4ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a4fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ac85
call fcn.1400a4250
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
movdqa xmm0, xmmword [0x140154c40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.14006fae0
nop
lea rcx, [rbp - 8]
call fcn.14006fae0
nop
lea rcx, [rbp + 0x158]
call fcn.14006fae0
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 8
cmovae rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14007aa21
mov edx, 0x1000
lea rcx, [rbp + 0x9e0]
test r15b, 8
je 0x14007a581
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14007a587
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
lea rax, [rbp + 0x9e0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14007a5b0
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xd8]
call fcn.1400701c0
nop
mov r8d, 1
lea rdx, [0x14015369c]
lea rcx, [rbp + 0xd8]
call fcn.14007bdc0
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x18]
call fcn.14007bdc0
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x14007a69d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a698
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ac8b
call fcn.1400a4250
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
movdqa xmm0, xmmword [0x140154c40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.14006fae0
nop
lea rcx, [rbp + 0x18]
call fcn.14006fae0
nop
lea rcx, [rbp + 0xd8]
call fcn.14006fae0
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 8
cmovae rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14007aa21
mov edx, 0x1000
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x108], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14007a740
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xf8]
call fcn.1400701c0
nop
mov r8d, 1
lea rdx, [0x14015369c]
lea rcx, [rbp + 0xf8]
call fcn.14007bdc0
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x38]
call fcn.14007bdc0
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x14007a82d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a828
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ac91
call fcn.1400a4250
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
movdqa xmm0, xmmword [0x140154c40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.14006fae0
nop
lea rcx, [rbp + 0x38]
call fcn.14006fae0
nop
lea rcx, [rbp + 0xf8]
call fcn.14006fae0
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 8
cmovae rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14007aa21
lea rdx, [rbp + 0x9e0]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x128], xmm1
lea rax, [rbp + 0x9e0]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14007a8d0
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x118]
call fcn.1400701c0
nop
mov r8d, 1
lea rdx, [0x14015369c]
lea rcx, [rbp + 0x118]
call fcn.14007bdc0
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x58]
call fcn.14007bdc0
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x14007a9bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a9b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ac97
call fcn.1400a4250
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
movdqa xmm0, xmmword [0x140154c40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.14006fae0
nop
lea rcx, [rbp + 0x58]
call fcn.14006fae0
nop
lea rcx, [rbp + 0x118]
call fcn.14006fae0
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 8
cmovae rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007aa5c
lea rax, [rbp + 0x180]
cmp r14, rax
je 0x14007ac0f
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 8
cmovae rdx, qword [rbp + 0x180]
mov r8, qword [rbp + 0x190]
mov rcx, r14
call fcn.14006fb50
jmp 0x14007ac0f
mov r8d, 0x1000
lea rdx, [rbp + 0x9e0]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x9e0]
lea r8, [rbp + 0x178]
lea rdx, [0x140153734]
call fcn.1400ba6f0
test rax, rax
je 0x14007ac0a
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x90], rdi
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14007aab1
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.1400701c0
nop
mov r8d, 1
lea rdx, [0x14015369c]
lea rcx, [rbp + 0x78]
call fcn.14007bdc0
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
lea rcx, [rbp - 0x68]
call fcn.14007bdc0
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm7
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x14007ab99
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ab94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ac73
call fcn.1400a4250
movups xmmword [rbp + 0x180], xmm6
movups xmmword [rbp + 0x190], xmm7
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.14006fae0
nop
lea rcx, [rbp - 0x68]
call fcn.14006fae0
nop
lea rcx, [rbp + 0x78]
call fcn.14006fae0
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 8
cmovae rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14007aa21
mov rcx, qword [rbp + 0x178]
jmp 0x14007aa7d
mov edi, 0xc0000225
mov rcx, qword [rbp + 0x1d0]
test rcx, rcx
jle 0x14007ac25
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007ac25
mov edi, eax
lea rcx, [rbp + 0x1a0]
call fcn.14006fae0
nop
lea rcx, [rbp + 0x180]
call fcn.14006fae0
mov eax, edi
mov rcx, qword [rbp + 0x29e0]
xor rcx, rsp
call fcn.1400a3fe0
movaps xmm6, xmmword [rsp + 0x2b00]
movaps xmm7, xmmword [rsp + 0x2af0]
add rsp, 0x2b18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400b67d8
nop
call fcn.140001790
nop
call fcn.1400b67d8
nop
call fcn.1400b67d8
nop
call fcn.1400b67d8
nop
call fcn.1400b67d8
nop
call fcn.1400b67d8
int3