Function at 0x14000f364
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
xor ebx, ebx
mov qword [rbp - 0x41], rbx
mov r15d, ebx
mov qword [rbp + 0x7f], rbx
mov r12d, ebx
mov qword [rbp - 0x49], rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r14d, 0x400
mov qword [rbp - 0x11], rbx
mov r8d, r14d
mov qword [rbp - 0x21], rax
mov rcx, rax
mov qword [rbp - 9], r14
xor edx, edx
mov qword [rbp + 7], rbx
mov r13, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14001089c
mov r8d, r14d
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov qword [rbp + 7], rsi
mov edi, r14d
mov qword [rbp - 0x11], r14
lea ebx, [r12 + 0x16]
movups xmm0, xmmword [str.SystemRoot]
movups xmmword [r12 + rsi], xmm0
mov eax, dword [0x14001b3d0]
mov dword [r12 + rsi + 0x10], eax
movzx eax, word [0x14001b3d4]
mov word [r12 + rsi + 0x14], ax
mov r12d, ebx
call fcn.14000d64c
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], r15w
jne 0x14000f42c
call fcn.14000d64c
mov qword [rbp + 0x77], rax
add r14, r14
je 0x14000f4f8
lea r15, [rbx + r14]
cmp r15, rbx
jb 0x14000f55f
cmp r15, rdi
jbe 0x14000f4df
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rax + r15]
cmp rdi, r15
jb 0x14000f558
not rax
xor edx, edx
and rdi, rax
mov rcx, r13
test rsi, rsi
jne 0x14000f4a8
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x14000f4c2
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000f4bd
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r13, rax
test r13, r13
jne 0x14000f4cc
mov ebx, 0x8007000e
jmp 0x14000f564
mov rax, qword [rbp + 0x77]
mov rsi, r13
mov qword [rbp + 7], r13
mov r13, qword [rbp - 0x21]
mov qword [rbp - 0x11], rdi
lea rcx, [rbx + rsi]
mov r8, r14
mov rdx, rax
call sub.msvcrt.dll_memcpy
cmp r12, r15
mov rbx, r15
cmovbe r12, r15
lea r14, [rbx + 2]
cmp r14, rbx
jb 0x14001088c
cmp r14, rdi
jbe 0x14000f5cc
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rax + r14]
cmp rdi, r14
jb 0x14000f5c2
not rax
xor edx, edx
and rdi, rax
mov rcx, r13
test rsi, rsi
jne 0x14000f58f
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x14000f5a4
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000f5a4
mov ebx, 0x8000000b
jmp 0x14000f564
mov ebx, 0x80070057
mov r8d, 0x4b0
mov ecx, 1
lea r9, str.Out_of_memory
lea rdx, str.AslEnvBuildBasic
call fcn.14000c024
mov r15, qword [rbp + 0x7f]
mov r12, qword [rbp - 0x49]
jmp 0x1400108ce
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r15, rax
xor ecx, ecx
test r15, r15
jne 0x14000f5b5
mov ebx, 0x8007000e
jmp 0x140010891
mov rsi, r15
mov qword [rbp + 7], r15
mov qword [rbp - 0x11], rdi
jmp 0x14000f5ce
mov ebx, 0x8000000b
jmp 0x140010891
xor ecx, ecx
cmp r12, r14
mov word [rbx + rsi], cx
lea r15, [r14 + 0x18]
cmovbe r12, r14
cmp r15, r14
jb 0x14001087c
cmp r15, rdi
jbe 0x14000f664
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rax + r15]
cmp rdi, r15
jb 0x14000f6eb
not rax
xor edx, edx
and rdi, rax
mov rcx, r13
test rsi, rsi
jne 0x14000f635
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000f64f
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000f64a
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
jne 0x14000f659
mov ebx, 0x8007000e
jmp 0x140010881
mov rsi, rbx
mov qword [rbp + 7], rbx
mov qword [rbp - 0x11], rdi
movups xmm0, xmmword [str.SystemDrive]
cmp r12, r15
movups xmmword [r14 + rsi], xmm0
cmovbe r12, r15
movsd xmm1, qword [0x14001ada8]
movsd qword [r14 + rsi + 0x10], xmm1
call fcn.14000d64c
lea rbx, [r15 + 4]
mov r13, rax
cmp rbx, r15
jb 0x14001086c
cmp rbx, rdi
jbe 0x14000f732
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rax + rbx]
cmp rdi, rbx
jb 0x14000f728
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x14000f6f5
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x14000f70a
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000f70a
mov ebx, 0x8000000b
jmp 0x140010881
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r14, rax
xor ecx, ecx
test r14, r14
jne 0x14000f71b
mov ebx, 0x8007000e
jmp 0x140010871
mov rsi, r14
mov qword [rbp + 7], r14
mov qword [rbp - 0x11], rdi
jmp 0x14000f734
mov ebx, 0x8000000b
jmp 0x140010871
xor ecx, ecx
mov eax, dword [r13]
lea r14, [rbx + 2]
cmp r12, rbx
mov dword [r15 + rsi], eax
cmovbe r12, rbx
cmp r14, rbx
jb 0x14001085c
mov r13, qword [rbp - 9]
cmp r14, rdi
jbe 0x14000f7d2
lea rax, [r13 - 1]
lea rdi, [rax + r14]
cmp rdi, r14
jb 0x14000f83b
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x14000f7a1
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x14000f7b6
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000f7b6
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r15, rax
xor ecx, ecx
test r15, r15
jne 0x14000f7c7
mov ebx, 0x8007000e
jmp 0x140010861
mov rsi, r15
mov qword [rbp + 7], r15
mov qword [rbp - 0x11], rdi
cmp r12, r14
mov word [rbx + rsi], cx
lea rbx, [r14 + 0xe]
cmovbe r12, r14
cmp rbx, r14
jb 0x14001084c
cmp rbx, rdi
jbe 0x14000f874
lea rax, [r13 - 1]
lea rdi, [rax + rbx]
cmp rdi, rbx
jb 0x14000f926
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x14000f845
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x14000f85f
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000f85a
mov ebx, 0x8000000b
jmp 0x140010861
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r15, rax
test r15, r15
jne 0x14000f869
mov ebx, 0x8007000e
jmp 0x140010851
mov rsi, r15
mov qword [rbp + 7], r15
mov qword [rbp - 0x11], rdi
movsd xmm0, qword [str.WinDir]
cmp r12, rbx
movsd qword [r14 + rsi], xmm0
mov eax, dword [0x14001b3e0]
cmovbe r12, rbx
mov dword [r14 + rsi + 8], eax
movzx eax, word [0x14001b3e4]
mov word [r14 + rsi + 0xc], ax
call fcn.14000d64c
or r14, 0xffffffffffffffff
xor ecx, ecx
inc r14
cmp word [rax + r14*2], cx
jne 0x14000f8ac
call fcn.14000d64c
mov qword [rbp + 0x77], rax
add r14, r14
je 0x14000f97c
lea r15, [r14 + rbx]
cmp r15, rbx
jb 0x14000f9e7
cmp r15, rdi
jbe 0x14000f963
lea rax, [r13 - 1]
lea rdi, [r15 + rax]
cmp rdi, r15
jb 0x14000f9e0
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x14000f930
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x14000f94a
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000f945
mov ebx, 0x8000000b
jmp 0x140010851
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r13, rax
test r13, r13
jne 0x14000f954
mov ebx, 0x8007000e
jmp 0x14000f9ec
mov rax, qword [rbp + 0x77]
mov rsi, r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x11], rdi
lea rcx, [rbx + rsi]
mov r8, r14
mov rdx, rax
call sub.msvcrt.dll_memcpy
cmp r12, r15
mov rbx, r15
cmovbe r12, r15
lea r15, [rbx + 2]
cmp r15, rbx
jb 0x14001083c
cmp r15, rdi
jbe 0x14000fa32
mov rax, qword [rbp - 9]
dec rax
lea rdi, [r15 + rax]
cmp rdi, r15
jb 0x14000fa28
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor r13d, r13d
xor edx, edx
test rsi, rsi
jne 0x14000f9f7
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x14000fa0c
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000fa0c
mov ebx, 0x8000000b
jmp 0x14000f9ec
mov ebx, 0x80070057
mov r8d, 0x4c8
jmp 0x14000f56a
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r14, rax
test r14, r14
jne 0x14000fa1b
mov ebx, 0x8007000e
jmp 0x140010841
mov rsi, r14
mov qword [rbp + 7], r14
mov qword [rbp - 0x11], rdi
jmp 0x14000fa35
mov ebx, 0x8000000b
jmp 0x140010841
xor r13d, r13d
cmp r12, r15
mov word [rbx + rsi], r13w
mov r14d, 1
mov qword [rbp - 1], r15
cmovbe r12, r15
lea rdx, str.RegistryMachineSystemCurrentControlSetControlSession_ManagerEnvironment
mov r8d, r14d
mov qword [rbp - 0x19], r12
lea rcx, [rbp - 0x41]
call fcn.14000c09c
test eax, eax
js 0x14000fdf0
lea rbx, str.DataDrive
mov dword [rbp + 0x77], r13d
mov qword [rbp - 0x39], rbx
mov r8, qword [rbx - 8]
lea rcx, [rbp + 0x7f]
mov rdx, qword [rbp - 0x41]
call fcn.14000c36c
xor ecx, ecx
test eax, eax
js 0x14000fdc0
mov rax, qword [rbx]
or rbx, 0xffffffffffffffff
mov qword [rbp - 0x29], rax
inc rbx
cmp word [rax + rbx*2], cx
jne 0x14000fa9f
add rbx, rbx
je 0x14000fb66
lea r13, [rbx + r15]
mov qword [rbp - 0x31], r13
cmp r13, r15
jb 0x14000fe40
cmp r13, rdi
jbe 0x14000fb4b
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rax + r13]
cmp rdi, r13
jb 0x14000fe39
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x14000fb1a
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x14000fe32
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000fb2f
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r13, rax
test r13, r13
je 0x14000fe32
mov rax, qword [rbp - 0x29]
mov rsi, r13
mov qword [rbp + 7], r13
mov r13, qword [rbp - 0x31]
mov qword [rbp - 0x11], rdi
lea rcx, [r15 + rsi]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_memcpy
cmp r12, r13
mov r15, r13
cmovbe r12, r13
xor ecx, ecx
lea rbx, [r15 + 2]
cmp rbx, r15
jb 0x14000fe97
cmp rbx, rdi
jbe 0x14000fbee
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rbx + rax]
cmp rdi, rbx
jb 0x14000fe5a
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x14000fbc3
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x14000fbd8
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000fbd8
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r13, rax
xor ecx, ecx
test r13, r13
je 0x14000fe53
mov rsi, r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x11], rdi
cmp r12, rbx
mov qword [rbp - 1], rbx
mov eax, 0x3d
cmovbe r12, rbx
mov word [r15 + rsi], ax
mov qword [rbp - 0x19], r12
mov rax, qword [rbp + 0x7f]
or r15, 0xffffffffffffffff
inc r15
cmp word [rax + r15*2], cx
jne 0x14000fc0f
add r15, r15
je 0x14000fce3
lea r13, [r15 + rbx]
mov qword [rbp - 0x29], r13
cmp r13, rbx
jb 0x14000fe6f
cmp r13, rdi
jbe 0x14000fcbc
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rax + r13]
cmp rdi, r13
jb 0x14000fe68
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x14000fc8b
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x14000fe61
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000fca0
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r13, rax
test r13, r13
je 0x14000fe61
mov rax, qword [rbp + 0x7f]
mov rsi, r13
mov qword [rbp + 7], r13
mov r13, qword [rbp - 0x29]
mov qword [rbp - 0x11], rdi
lea rcx, [rbx + rsi]
mov r8, r15
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x7f]
cmp r12, r13
mov rbx, r13
cmovbe r12, r13
mov qword [rbp - 1], rbx
mov qword [rbp - 0x19], r12
xor ecx, ecx
test rax, rax
je 0x14000fd19
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp + 0x7f]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rsi, qword [rbp + 7]
xor ecx, ecx
mov rbx, qword [rbp - 1]
mov rdi, qword [rbp - 0x11]
mov r12, qword [rbp - 0x19]
lea r15, [rbx + 2]
mov qword [rbp + 0x7f], rcx
cmp r15, rbx
jb 0x14000fe8a
cmp r15, rdi
jbe 0x14000fda5
mov rax, qword [rbp - 9]
dec rax
lea rdi, [r15 + rax]
cmp rdi, r15
jb 0x14000fe83
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x14000fd7a
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x14000fd8f
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000fd8f
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r13, rax
xor ecx, ecx
test r13, r13
je 0x14000fe7c
mov rsi, r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x11], rdi
mov r13d, dword [rbp + 0x77]
cmp r12, r15
mov word [rbx + rsi], cx
mov rbx, qword [rbp - 0x39]
cmovbe r12, r15
mov qword [rbp - 0x19], r12
mov qword [rbp - 1], r15
add r13d, r14d
add rbx, 0x10
mov dword [rbp + 0x77], r13d
mov qword [rbp - 0x39], rbx
cmp r13d, 2
jb 0x14000fa79
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ntdll.dll_ZwClose]
nop dword [rax + rax]
xor r13d, r13d
mov qword [rbp - 0x41], r13
mov r8d, r14d
lea rdx, str.RegistryMachineSoftwareMicrosoftWindowsCurrentVersion
lea rcx, [rbp - 0x41]
call fcn.14000c09c
mov ebx, eax
test eax, eax
jns 0x14000fea4
lea r9, str.Failed_to_open_reg_key___x_
mov dword [rsp + 0x20], eax
mov r8d, 0x4fa
lea rdx, str.AslEnvBuildBasic
mov ecx, r14d
call fcn.14000c024
jmp 0x14000f582
mov ebx, 0x8007000e
jmp 0x14000fe45
mov ebx, 0x8000000b
jmp 0x14000fe45
mov ebx, 0x80070057
mov r8d, 0x4de
mov ecx, r14d
jmp 0x14000f56f
mov ebx, 0x8007000e
jmp 0x14000fe9c
mov ebx, 0x8000000b
jmp 0x14000fe9c
mov ebx, 0x8007000e
jmp 0x14000fe74
mov ebx, 0x8000000b
jmp 0x14000fe74
mov ebx, 0x80070057
mov r8d, 0x4e2
jmp 0x14000fe4b
mov ebx, 0x8007000e
jmp 0x14000fe8f
mov ebx, 0x8000000b
jmp 0x14000fe8f
mov ebx, 0x80070057
mov r8d, 0x4e9
jmp 0x14000fe4b
mov ebx, 0x80070057
mov r8d, 0x4e0
jmp 0x14000fe4b
lea rbx, str.CommonProgramFiles
mov dword [rbp + 0x77], r13d
mov qword [rbp - 0x39], rbx
mov r8, qword [rbx - 8]
lea rcx, [rbp + 0x7f]
mov rdx, qword [rbp - 0x41]
call fcn.14000c36c
xor ecx, ecx
test eax, eax
js 0x1400101fa
mov rax, qword [rbx]
or rbx, 0xffffffffffffffff
mov qword [rbp - 0x31], rax
inc rbx
cmp word [rax + rbx*2], cx
jne 0x14000fed9
add rbx, rbx
je 0x14000ffa0
lea r13, [rbx + r15]
mov qword [rbp - 0x29], r13
cmp r13, r15
jb 0x14001029b
cmp r13, rdi
jbe 0x14000ff85
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rax + r13]
cmp rdi, r13
jb 0x140010294
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x14000ff54
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x14001028d
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000ff69
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r13, rax
test r13, r13
je 0x14001028d
mov rax, qword [rbp - 0x31]
mov rsi, r13
mov qword [rbp + 7], r13
mov r13, qword [rbp - 0x29]
mov qword [rbp - 0x11], rdi
lea rcx, [r15 + rsi]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_memcpy
cmp r12, r13
mov r15, r13
cmovbe r12, r13
xor ecx, ecx
lea rbx, [r15 + 2]
cmp rbx, r15
jb 0x1400102f5
cmp rbx, rdi
jbe 0x140010028
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rbx + rax]
cmp rdi, rbx
jb 0x1400102b2
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x14000fffd
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x140010012
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x140010012
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r13, rax
xor ecx, ecx
test r13, r13
je 0x1400102ab
mov rsi, r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x11], rdi
cmp r12, rbx
mov qword [rbp - 1], rbx
mov eax, 0x3d
cmovbe r12, rbx
mov word [r15 + rsi], ax
mov qword [rbp - 0x19], r12
mov rax, qword [rbp + 0x7f]
or r15, 0xffffffffffffffff
inc r15
cmp word [rax + r15*2], cx
jne 0x140010049
add r15, r15
je 0x14001011d
lea r13, [r15 + rbx]
mov qword [rbp - 0x29], r13
cmp r13, rbx
jb 0x1400102c7
cmp r13, rdi
jbe 0x1400100f6
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rax + r13]
cmp rdi, r13
jb 0x1400102c0
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x1400100c5
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x1400102b9
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x1400100da
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r13, rax
test r13, r13
je 0x1400102b9
mov rax, qword [rbp + 0x7f]
mov rsi, r13
mov qword [rbp + 7], r13
mov r13, qword [rbp - 0x29]
mov qword [rbp - 0x11], rdi
lea rcx, [rbx + rsi]
mov r8, r15
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x7f]
cmp r12, r13
mov rbx, r13
cmovbe r12, r13
mov qword [rbp - 1], rbx
mov qword [rbp - 0x19], r12
xor ecx, ecx
test rax, rax
je 0x140010153
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp + 0x7f]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rsi, qword [rbp + 7]
xor ecx, ecx
mov rbx, qword [rbp - 1]
mov rdi, qword [rbp - 0x11]
mov r12, qword [rbp - 0x19]
lea r15, [rbx + 2]
mov qword [rbp + 0x7f], rcx
cmp r15, rbx
jb 0x1400102e5
cmp r15, rdi
jbe 0x1400101df
mov rax, qword [rbp - 9]
dec rax
lea rdi, [rax + r15]
cmp rdi, r15
jb 0x1400102de
mov rcx, qword [rbp - 0x21]
not rax
and rdi, rax
xor edx, edx
test rsi, rsi
jne 0x1400101b4
mov r8, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x1400101c9
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x1400101c9
mov r9, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r13, rax
xor ecx, ecx
test r13, r13
je 0x1400102d7
mov rsi, r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x11], rdi
mov r13d, dword [rbp + 0x77]
cmp r12, r15
mov word [rbx + rsi], cx
mov rbx, qword [rbp - 0x39]
cmovbe r12, r15
mov qword [rbp - 0x19], r12
mov qword [rbp - 1], r15
add r13d, r14d
add rbx, 0x10
mov dword [rbp + 0x77], r13d
mov qword [rbp - 0x39], rbx
cmp r13d, 4
jb 0x14000feb3
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ntdll.dll_ZwClose]
nop dword [rax + rax]
xor r15d, r15d
mov qword [rbp - 0x41], r15
mov rax, qword gs:[0x60]
mov r13, qword [rbp - 0x19]
lea edx, [r15 + 8]
mov qword [rbp - 0x39], r13
mov rcx, qword [rax + 0x30]
lea r8, [r13 + 2]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x49], rax
mov r12, rax
test rax, rax
jne 0x140010305
mov r8d, 0x51e
lea r9, str.Out_of_memory
mov ecx, r14d
lea rdx, str.AslEnvBuildBasic
mov ebx, 0xc0000017
call fcn.14000c024
mov r15, qword [rbp + 0x7f]
jmp 0x1400108ca
mov ebx, 0x8007000e
jmp 0x1400102a0
mov ebx, 0x8000000b
jmp 0x1400102a0
mov ebx, 0x80070057
mov r8d, 0x504
jmp 0x14000fe4b
mov ebx, 0x8007000e
jmp 0x1400102fa
mov ebx, 0x8000000b
jmp 0x1400102fa
mov ebx, 0x8007000e
jmp 0x1400102cc
mov ebx, 0x8000000b
jmp 0x1400102cc
mov ebx, 0x80070057
mov r8d, 0x508
jmp 0x14000fe4b
mov ebx, 0x8007000e
jmp 0x1400102ea
mov ebx, 0x8000000b
jmp 0x1400102ea
mov ebx, 0x80070057
mov r8d, 0x50f
jmp 0x14000fe4b
mov ebx, 0x80070057
mov r8d, 0x506
jmp 0x14000fe4b
mov rsi, qword [rbp + 7]
mov r8, r13
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r8d, r14d
lea rdx, str.RegistryMachineSoftwareMicrosoftWindows_NTCurrentVersionProfileList
lea rcx, [rbp - 0x41]
call fcn.14000c09c
mov ebx, eax
test eax, eax
jns 0x140010359
lea r9, str.Failed_to_open_reg_key___x_
mov dword [rsp + 0x20], eax
mov r8d, 0x528
lea rdx, str.AslEnvBuildBasic
mov ecx, r14d
call fcn.14000c024
mov r15, qword [rbp + 0x7f]
jmp 0x1400108ce
mov r12, qword [rbp - 1]
lea rdi, str.ProgramData
mov rbx, qword [rbp - 0x11]
mov dword [rbp + 0x77], r15d
mov r15, qword [rbp - 0x49]
mov qword [rbp - 0x31], rdi
mov r8, qword [rdi]
lea rcx, [rbp + 0x7f]
mov rdx, qword [rbp - 0x41]
mov r9, r15
call fcn.14000c558
test eax, eax
js 0x140010700
mov r15, qword [rbp + 0x7f]
mov edx, 0x25
mov rcx, r15
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
je 0x1400103dc
mov rax, qword [rdi]
lea r9, str.Failed_to_expand:__ls__ls
mov qword [rsp + 0x28], r15
lea rdx, str.AslEnvBuildBasic
mov r8d, 0x539
mov qword [rsp + 0x20], rax
mov ecx, r14d
call fcn.14000c024
jmp 0x1400106fc
mov rax, qword [rdi + 8]
or r15, 0xffffffffffffffff
mov qword [rbp - 0x29], rax
inc r15
cmp word [rax + r15*2], cx
jne 0x1400103e8
add r15, r15
je 0x1400104a9
lea r13, [r12 + r15]
cmp r13, r12
jb 0x140010789
cmp r13, rbx
jbe 0x140010489
mov rax, qword [rbp - 9]
dec rax
lea rbx, [rax + r13]
cmp rbx, r13
jb 0x140010782
mov rcx, qword [rbp - 0x21]
not rax
and rbx, rax
xor edx, edx
test rsi, rsi
jne 0x14001045c
mov r8, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14001077b
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x140010471
mov r9, rbx
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov rdi, rax
test rdi, rdi
je 0x14001077b
mov rax, qword [rbp - 0x29]
mov rsi, rdi
mov qword [rbp + 7], rdi
mov qword [rbp - 0x11], rbx
lea rcx, [r12 + rsi]
mov r8, r15
mov rdx, rax
call sub.msvcrt.dll_memcpy
cmp qword [rbp - 0x39], r13
mov r12, r13
mov r13, qword [rbp - 0x39]
cmovbe r13, r12
xor ecx, ecx
lea rdi, [r12 + 2]
cmp rdi, r12
jb 0x1400107fe
cmp rdi, rbx
jbe 0x140010532
mov rax, qword [rbp - 9]
dec rax
lea rbx, [rax + rdi]
cmp rbx, rdi
jb 0x1400107a0
mov rcx, qword [rbp - 0x21]
not rax
and rbx, rax
xor edx, edx
test rsi, rsi
jne 0x140010507
mov r8, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x14001051c
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14001051c
mov r9, rbx
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r15, rax
xor ecx, ecx
test r15, r15
je 0x140010799
mov rsi, r15
mov qword [rbp + 7], r15
mov qword [rbp - 0x11], rbx
cmp r13, rdi
mov qword [rbp - 1], rdi
mov eax, 0x3d
cmovbe r13, rdi
mov word [r12 + rsi], ax
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x19], r13
mov r15, qword [rbp + 0x7f]
or r12, 0xffffffffffffffff
inc r12
cmp word [r15 + r12*2], cx
jne 0x140010557
add r12, r12
je 0x140010620
lea r13, [rdi + r12]
cmp r13, rdi
jb 0x1400107b9
cmp r13, rbx
jbe 0x1400105f8
mov rax, qword [rbp - 9]
dec rax
lea rbx, [rax + r13]
cmp rbx, r13
jb 0x1400107b2
mov rcx, qword [rbp - 0x21]
not rax
and rbx, rax
xor edx, edx
test rsi, rsi
jne 0x1400105cb
mov r8, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x1400107a7
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x1400105e0
mov r9, rbx
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r15, rax
test r15, r15
je 0x1400107a7
mov rsi, r15
mov qword [rbp + 7], r15
mov r15, qword [rbp + 0x7f]
mov qword [rbp - 0x11], rbx
lea rcx, [rdi + rsi]
mov r8, r12
mov rdx, r15
call sub.msvcrt.dll_memcpy
cmp qword [rbp - 0x39], r13
mov rdi, r13
mov qword [rbp - 1], r13
mov r13, qword [rbp - 0x39]
cmovbe r13, rdi
xor ecx, ecx
mov qword [rbp - 0x19], r13
test r15, r15
je 0x140010656
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp + 0x7f]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rsi, qword [rbp + 7]
xor ecx, ecx
mov rdi, qword [rbp - 1]
mov rbx, qword [rbp - 0x11]
mov r13, qword [rbp - 0x19]
lea r12, [rdi + 2]
mov qword [rbp + 0x7f], rcx
mov r15, rcx
cmp r12, rdi
jb 0x1400107f1
cmp r12, rbx
jbe 0x1400106e5
mov rax, qword [rbp - 9]
dec rax
lea rbx, [rax + r12]
cmp rbx, r12
jb 0x1400107ea
mov rcx, qword [rbp - 0x21]
not rax
and rbx, rax
xor edx, edx
test rsi, rsi
jne 0x1400106ba
mov r8, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x1400106cf
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x1400106cf
mov r9, rbx
mov r8, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r15, rax
xor ecx, ecx
test r15, r15
je 0x1400107df
mov rsi, r15
mov qword [rbp + 7], r15
mov qword [rbp - 0x11], rbx
cmp r13, r12
mov word [rdi + rsi], cx
mov rdi, qword [rbp - 0x31]
cmovbe r13, r12
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x19], r13
mov r15, qword [rbp - 0x49]
mov eax, dword [rbp + 0x77]
add rdi, 0x10
add eax, r14d
mov qword [rbp - 0x31], rdi
mov dword [rbp + 0x77], eax
cmp eax, 2
jb 0x140010374
mov rcx, qword gs:[0x60]
mov r8, r15
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rax, qword gs:[0x60]
mov edx, 8
mov rdi, qword [rbp - 0x19]
mov rcx, qword [rax + 0x30]
lea rbx, [rdi + 2]
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r15d, r15d
mov r12, rax
test rax, rax
jne 0x14001080e
mov r8d, 0x557
jmp 0x140010269
mov ebx, 0x8007000e
jmp 0x14001078e
mov ebx, 0x8000000b
jmp 0x14001078e
mov ebx, 0x80070057
mov r8d, 0x53d
jmp 0x14000fe4b
mov ebx, 0x8007000e
jmp 0x140010803
mov ebx, 0x8000000b
jmp 0x140010803
mov r15, qword [rbp + 0x7f]
mov ebx, 0x8007000e
jmp 0x1400107be
mov ebx, 0x8000000b
jmp 0x1400107be
mov ebx, 0x80070057
mov r8d, 0x541
lea r9, str.Out_of_memory
mov ecx, r14d
lea rdx, str.AslEnvBuildBasic
call fcn.14000c024
jmp 0x14000f586
mov r15, qword [rbp + 0x7f]
mov ebx, 0x8007000e
jmp 0x1400107f6
mov ebx, 0x8000000b
jmp 0x1400107f6
mov ebx, 0x80070057
mov r8d, 0x548
jmp 0x1400107c4
mov ebx, 0x80070057
mov r8d, 0x53f
jmp 0x14000fe4b
mov rsi, qword [rbp + 7]
mov r8, rdi
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x67]
shr rbx, 1
mov qword [rax], r12
mov r12, r15
mov rax, qword [rbp + 0x6f]
mov qword [rax], rbx
mov ebx, r15d
jmp 0x140010350
mov ebx, 0x80070057
mov r8d, 0x4cc
jmp 0x14000f56a
mov ebx, 0x80070057
mov r8d, 0x4c6
jmp 0x14000f56a
mov ebx, 0x80070057
mov r8d, 0x4c2
jmp 0x14000f56a
mov ebx, 0x80070057
mov r8d, 0x4bc
jmp 0x14000f56a
mov ebx, 0x80070057
mov r8d, 0x4b8
jmp 0x14000f56a
mov ebx, 0x80070057
mov r8d, 0x4b4
jmp 0x14000f56a
xorps xmm0, xmm0
lea r9, str.Out_of_memory
mov r8d, 0x4a6
lea rdx, str.AslEnvBuildBasic
mov ecx, 1
mov ebx, 0x8007000e
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 1], xmm0
call fcn.14000c024
mov rsi, qword [rbp + 7]
test rsi, rsi
je 0x1400108e8
mov rcx, qword [rbp - 0x21]
mov r8, rsi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test r15, r15
je 0x14001090c
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp + 0x7f]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test r12, r12
je 0x14001092f
mov rcx, qword gs:[0x60]
mov r8, r12
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x140010944
call qword [sym.imp.ntdll.dll_ZwClose]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret