Function at 0x14000ea20
Capabilities:
Get thread local storage value

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a8]
sub rsp, 0x2a8
mov rsi, r8
mov rbx, rdx
xor r12d, r12d
mov eax, r12d
mov dword [rsp + 0x64], eax
mov dword [rbp - 0x18], eax
lea ecx, [r12 + 2]
call fcn.1400e8270
mov qword [rbp + 0xb0], rax
mov word [rax], r12w
lea ecx, [r12 + 2]
call fcn.1400e8270
mov rdi, rax
mov qword [rbp], rax
mov word [rax], r12w
lea ecx, [r12 + 2]
call fcn.1400e8270
mov qword [rbp + 0xa8], rax
mov word [rax], r12w
lea ecx, [r12 + 2]
call fcn.1400e8270
mov qword [rbp + 8], rax
mov word [rax], r12w
lea ecx, [r12 + 2]
call fcn.1400e8270
mov r14, rax
mov qword [rbp - 0x30], rax
mov word [rax], r12w
lea r15, [0x14011f8bc]
mov r13d, dword [rbp + 0x218]
cmp r13d, 0xffffffff
jne 0x14000eff6
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rsp + 0x50], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rsp + 0x58], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x70], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x10], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov r14, rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rax, [0x14011eaa0]
test rsi, rsi
cmovne rax, rsi
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.1400e81d8
mov r13, rax
xor ecx, ecx
call fcn.1400e825c
nop
lea ecx, [r12 + 2]
call fcn.1400e8270
mov qword [rsp + 0x70], rax
mov word [rax], r12w
cmp rbx, qword [0x14016aa18]
jne 0x14000ebd4
lea rcx, [0x14011ec08]
jmp 0x14000ebe6
lea rcx, [0x14011ebf8]
cmp rbx, qword [0x14016aa20]
cmovne rcx, r15
call fcn.1400e81d8
mov r12, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test r12, r12
cmovne rcx, r12
call fcn.1400e81d8
mov qword [rsp + 0x78], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rsi, qword [rsp + 0x78]
lea rcx, [0x14011eaa0]
test rsi, rsi
cmovne rcx, rsi
call fcn.1400e81d8
mov qword [rsp + 0x78], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, r13
lea rcx, [rsp + 0x78]
call fcn.140005790
mov rbx, qword [rsp + 0x78]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov r15, rax
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
mov rcx, rsi
call fcn.1400e825c
mov rcx, r12
call fcn.1400e825c
cmp word [r14], 0
je 0x14000ed21
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x78], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, qword [rsp + 0x78]
call fcn.1400e825c
mov r15, qword [rsp + 0x40]
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov rsi, rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x68]
call fcn.1400e81d8
mov r12, rax
xor ecx, ecx
call fcn.1400e825c
nop
mov ecx, 2
call fcn.1400e8270
mov qword [rsp + 0x70], rax
xor ecx, ecx
mov word [rax], cx
mov rax, qword [rbp + 0x1f8]
cmp rax, qword [0x14016aa18]
jne 0x14000ed7a
lea rcx, [0x14011ec08]
jmp 0x14000ed93
lea rcx, [0x14011ebf8]
cmp rax, qword [0x14016aa20]
lea rax, [0x14011f8bc]
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
mov rax, qword [rsp + 0x40]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x20], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [rbp - 0x20]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rsp + 0x78], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.140005790
mov rbx, qword [rsp + 0x78]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x68], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
mov rcx, qword [rbp - 0x20]
call fcn.1400e825c
mov rcx, qword [rsp + 0x40]
call fcn.1400e825c
cmp word [rsi], 0
je 0x14000eecb
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x78], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.140005790
mov rcx, qword [rsp + 0x78]
call fcn.1400e825c
nop
mov ecx, dword [0x1401a9af0]
mov rax, qword gs:[0x58]
mov edx, reloc.OLEAUT32.dll_SafeArrayLock
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140179250], eax
jle 0x14000ef31
lea rcx, [0x140179250]
call fcn.1400e151c
cmp dword [0x140179250], 0xffffffff
jne 0x14000ef31
mov ecx, 2
call fcn.1400e8270
mov qword [0x140179248], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x14011b1f0]
call fcn.1400e137c
lea rcx, [0x140179250]
call fcn.1400e14bc
mov rbx, qword [0x140179248]
lea rcx, [0x14011eaa0]
mov rax, qword [rbp - 0x68]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [0x140179248], rax
mov rcx, rbx
call fcn.1400e825c
xor eax, eax
mov dword [rbp + 0x218], eax
mov rcx, qword [rbp - 0x68]
call fcn.1400e825c
nop
mov rcx, r12
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, r15
call fcn.1400e825c
nop
mov rcx, r13
call fcn.1400e825c
nop
mov rcx, r14
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x10]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400e825c
mov r14, qword [rbp - 0x30]
mov rbx, qword [rbp + 0x1f8]
mov r13d, dword [rbp + 0x218]
mov rsi, qword [rbp + 0x200]
xor r12d, r12d
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.140009290
test eax, eax
jne 0x140010f8c
mov dword [rsp + 0x60], r12d
lea ecx, [rax + 2]
call fcn.1400e8270
mov qword [rsp + 0x50], rax
mov word [rax], r12w
mov ecx, 2
call fcn.1400e8270
mov r15, rax
mov qword [rbp - 0x68], rax
mov word [rax], r12w
mov ecx, 2
call fcn.1400e8270
mov qword [rsp + 0x58], rax
mov word [rax], r12w
mov ecx, 2
call fcn.1400e8270
mov qword [rsp + 0x48], rax
mov word [rax], r12w
mov ecx, 2
call fcn.1400e8270
mov rsi, rax
mov qword [rsp + 0x78], rax
mov word [rax], r12w
mov ecx, 2
call fcn.1400e8270
mov r12, rax
mov qword [rbp - 0x70], rax
xor eax, eax
mov word [r12], ax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rbp - 8]
call fcn.140019020
test eax, eax
jne 0x140010f46
mov ecx, dword [0x1401a9af0]
mov rax, qword gs:[0x58]
lea rax, [rax + rcx*8]
mov qword [rbp - 0x20], rax
mov edi, dword [rsp + 0x60]
xor r13d, r13d
nop word [rax + rax]
mov ecx, dword [rbp - 0x40]
lea eax, [rcx - 1]
cmp eax, 2
jbe 0x14000f140
cmp ecx, 7
je 0x14000f140
mov rcx, r12
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400e825c
nop
mov rcx, r15
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400e825c
jmp 0x140010e8e
mov rbx, qword [rsp + 0x50]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000f150
test rax, rax
jne 0x14000f185
cmp byte [rbp + 0x228], al
je 0x14000f100
lea rcx, [0x14011f8c0]
call fcn.1400e81d8
mov qword [rsp + 0x50], rax
mov rcx, rbx
call fcn.1400e825c
mov rbx, qword [rsp + 0x50]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov r13, rax
mov qword [rbp - 0x68], rax
mov rcx, r15
call fcn.1400e825c
cmp byte [rbp + 0x210], 0
je 0x14000f82d
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x48]
cmp eax, 0x200
lea rcx, str.Wow6432Node_
je 0x14000f1da
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rsp + 0x48], rax
mov rcx, rbx
call fcn.1400e825c
lea rcx, str.CLSID_
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
lea rcx, [0x14011f8f8]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
mov rdi, qword [rsp + 0x40]
lea rcx, [0x14011eaa0]
test rdi, rdi
cmovne rcx, rdi
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140005790
mov rcx, qword [rsp + 0x40]
call fcn.1400e825c
mov rcx, rdi
call fcn.1400e825c
lea rcx, str.HKCRCLSID_
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rbx, qword [rsp + 0x40]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov rdi, rax
mov qword [rbp - 0x30], rax
mov rcx, r14
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, 0xffffffff80000000
call fcn.140009290
test eax, eax
jne 0x14000f369
mov rbx, qword [rsp + 0x48]
lea rcx, [0x14011eaa0]
jmp 0x14000f4f7
lea rcx, str.CLSID_
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
lea rcx, str.ShellOpenCommand
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
mov r15, qword [rsp + 0x40]
lea rcx, [0x14011eaa0]
test r15, r15
cmovne rcx, r15
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
lea rcx, [0x14011eaa0]
test r14, r14
cmovne rcx, r14
call fcn.1400e81d8
mov qword [rsp + 0x48], rax
mov rcx, rbx
call fcn.1400e825c
mov rcx, r14
call fcn.1400e825c
mov rcx, r15
call fcn.1400e825c
lea rcx, str.HKCRCLSID_
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rbx, qword [rsp + 0x40]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x30], rax
mov rcx, rdi
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, 0xffffffff80000000
call fcn.140009290
mov rbx, qword [rsp + 0x48]
lea rcx, [0x14011eaa0]
test eax, eax
jne 0x14000f535
call fcn.1400e81d8
mov qword [rsp + 0x48], rax
mov rcx, rbx
call fcn.1400e825c
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14011eaa0]
mov rcx, qword [rbp - 0x80]
call fcn.140019160
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000f547
call fcn.1400e81d8
mov qword [rsp + 0x48], rax
mov rcx, rbx
call fcn.1400e825c
mov rcx, qword [rsp + 0x58]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000f553
test rax, rax
jne 0x14000f603
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
or edi, 0x20019
lea rcx, str.CLSID_
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x10], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
nop
mov r15d, dword [rsp + 0x64]
or r15d, 1
mov dword [rsp + 0x64], r15d
mov dword [rbp - 0x18], r15d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rbx, qword [rbp - 0x10]
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.140009290
test eax, eax
jne 0x14000f60c
mov dil, 1
jmp 0x14000f60f
mov rbx, qword [rbp - 0x10]
mov r15d, dword [rsp + 0x64]
xor dil, dil
test r15b, 1
je 0x14000f626
and r15d, 0xfffffffe
mov dword [rsp + 0x64], r15d
mov rcx, rbx
call fcn.1400e825c
test dil, dil
je 0x14000f655
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14011eaa0]
mov rcx, qword [rbp - 0x80]
call fcn.140019160
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 2
call fcn.1400e8270
mov qword [rbp - 0x60], rax
xor ecx, ecx
mov word [rax], cx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x48]
call fcn.14000a050
test al, al
jne 0x14000f72b
mov rdi, qword [rbp - 0x58]
test rdi, rdi
je 0x14000f6f1
mov rbx, rdi
mov r14, qword [rbp - 0x50]
cmp rdi, r14
je 0x14000f6b1
nop
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, r14
jne 0x14000f6a0
mov rax, qword [rbp - 0x48]
sub rax, rdi
sar rax, 3
lea rdx, [rax*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000f6e9
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010fd8
mov rcx, rdi
call fcn.1400e0fb8
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
nop
mov rcx, r12
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400e825c
nop
mov rcx, r13
jmp 0x140010e73
mov rax, qword [rsp + 0x58]
mov rbx, r13
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov r13, rax
mov qword [rbp - 0x68], rax
mov rcx, rbx
call fcn.1400e825c
mov rdx, qword [rsp + 0x48]
lea rcx, [rbp + 0x18]
call fcn.140006c00
mov rdx, qword [rax]
mov rbx, qword [rsp + 0x48]
lea rcx, [0x14011eaa0]
test rdx, rdx
cmovne rcx, rdx
call fcn.1400e81d8
mov qword [rsp + 0x48], rax
mov rcx, rbx
call fcn.1400e825c
mov rcx, qword [rbp + 0x18]
call fcn.1400e825c
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp - 0x60]
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x78]
call fcn.14000a570
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.14000bfb0
or r15d, 4
mov dword [rsp + 0x64], r15d
mov rbx, qword [rbp + 0x98]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov rsi, rax
mov qword [rbp - 0x70], rax
mov rcx, r12
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
nop
mov rdi, qword [rbp - 0x58]
test rdi, rdi
je 0x14000fe64
mov rbx, rdi
mov r14, qword [rbp - 0x50]
cmp rdi, r14
je 0x14000fe24
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, r14
jne 0x14000f817
jmp 0x14000fe24
cmp byte [rbp + 0x208], 0
jne 0x14000fc99
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x48]
cmp eax, 0x200
lea rcx, str.Wow6432Node_
je 0x14000f860
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rsp + 0x48], rax
mov rcx, rbx
call fcn.1400e825c
lea rcx, str.CLSID_
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
lea rcx, [0x14011f8f8]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
mov rdi, qword [rsp + 0x40]
lea rcx, [0x14011eaa0]
test rdi, rdi
cmovne rcx, rdi
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140005790
mov rcx, qword [rsp + 0x40]
call fcn.1400e825c
mov rcx, rdi
call fcn.1400e825c
lea rcx, str.HKCRCLSID_
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdi, qword [rsp + 0x40]
mov rbx, r14
lea rcx, [0x14011eaa0]
test rdi, rdi
cmovne rcx, rdi
call fcn.1400e81d8
mov r14, rax
mov qword [rbp - 0x30], rax
mov rcx, rbx
call fcn.1400e825c
mov rcx, rdi
call fcn.1400e825c
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, 0xffffffff80000000
call fcn.140009290
test eax, eax
jne 0x14000fc59
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14011eaa0]
mov rcx, qword [rbp - 0x80]
call fcn.140019160
test eax, eax
jne 0x14000fc59
lea ecx, [rax + 2]
call fcn.1400e8270
mov qword [rbp - 0x60], rax
xor ecx, ecx
mov word [rax], cx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x48]
call fcn.14000a050
test al, al
je 0x14000fc12
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp - 0x60]
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x60]
call fcn.14000a570
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14000bfb0
mov r15d, dword [rsp + 0x64]
or r15d, 0x10
mov rdi, qword [rbp + 0x20]
mov rbx, rsi
lea rcx, [0x14011eaa0]
test rdi, rdi
cmovne rcx, rdi
call fcn.1400e81d8
mov rsi, rax
mov qword [rsp + 0x78], rax
mov rcx, rbx
call fcn.1400e825c
mov rcx, rdi
call fcn.1400e825c
lea rcx, [0x14011f9f0]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
mov rax, qword [rsp + 0x50]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov r14, qword [rsp + 0x40]
lea rcx, [0x14011eaa0]
test r14, r14
cmovne rcx, r14
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
lea rcx, [0x14011eaa0]
test rdi, rdi
cmovne rcx, rdi
call fcn.1400e81d8
mov qword [rsp + 0x58], rax
mov rcx, rbx
call fcn.1400e825c
mov rcx, rdi
call fcn.1400e825c
mov rcx, r14
call fcn.1400e825c
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp - 0x60]
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x28]
call fcn.14000a570
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14000bfb0
or r15d, 0x20
mov dword [rsp + 0x64], r15d
mov rbx, qword [rbp + 0x30]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov rsi, rax
mov qword [rbp - 0x70], rax
mov rcx, r12
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
nop
mov r14, qword [rbp - 0x58]
test r14, r14
je 0x14000fbfa
mov rbx, r14
mov rdi, qword [rbp - 0x50]
cmp r14, rdi
je 0x14000fbe3
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, rdi
jne 0x14000fbd2
mov r8, qword [rbp - 0x48]
sub r8, r14
sar r8, 3
mov rdx, r14
lea rcx, [rbp - 0x58]
call fcn.140017870
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000fe6d
mov r15, qword [rbp - 0x58]
test r15, r15
je 0x14000fc4f
mov rbx, r15
mov rdi, qword [rbp - 0x50]
cmp r15, rdi
je 0x14000fc38
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, rdi
jne 0x14000fc27
mov r8, qword [rbp - 0x48]
sub r8, r15
sar r8, 3
mov rdx, r15
lea rcx, [rbp - 0x58]
call fcn.140017870
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
nop
mov rcx, r12
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400e825c
nop
mov rcx, r13
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400e825c
jmp 0x140010e87
mov ecx, 2
call fcn.1400e8270
mov qword [rbp - 0x60], rax
xor ecx, ecx
mov word [rax], cx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.14000a050
test al, al
jne 0x14000fd7e
mov rdi, qword [rbp - 0x58]
test rdi, rdi
je 0x14000fd34
mov rbx, rdi
mov r15, qword [rbp - 0x50]
cmp rdi, r15
je 0x14000fcf4
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, r15
jne 0x14000fce3
mov rax, qword [rbp - 0x48]
sub rax, rdi
sar rax, 3
lea rdx, [rax*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000fd2c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010fd8
mov rcx, rdi
call fcn.1400e0fb8
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
nop
mov rcx, r12
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400e825c
nop
mov rcx, r13
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400e825c
jmp 0x140010e87
mov rax, qword [rsp + 0x58]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x30], rax
mov rcx, r14
call fcn.1400e825c
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp - 0x60]
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x38]
call fcn.14000a570
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14000bfb0
or dword [rsp + 0x64], 8
mov rbx, qword [rbp + 0x40]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov rsi, rax
mov qword [rbp - 0x70], rax
mov rcx, r12
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
nop
mov rdi, qword [rbp - 0x58]
test rdi, rdi
je 0x14000fe64
mov rbx, rdi
mov r14, qword [rbp - 0x50]
cmp rdi, r14
je 0x14000fe24
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, r14
jne 0x14000fe13
mov rax, qword [rbp - 0x48]
sub rax, rdi
sar rax, 3
lea rdx, [rax*8]
cmp rdx, 0x1000
mov rax, rdi
jb 0x14000fe5c
mov rdi, qword [rdi - 8]
sub rax, rdi
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010fd8
mov rcx, rdi
call fcn.1400e0fb8
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
mov rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], 0
jne 0x14000fe74
test rax, rax
jne 0x14000feee
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000fe90
test rax, rax
je 0x14000feee
mov edx, 0x5c
mov rcx, rsi
call fcn.1400e3c28
test rax, rax
je 0x14000fecf
mov edx, 0x5c
mov rcx, rsi
call fcn.1400e3c28
add rax, 2
lea rcx, [0x14011eaa0]
cmovne rcx, rax
jmp 0x14000fedd
lea rcx, [0x14011eaa0]
test rsi, rsi
cmovne rcx, rsi
call fcn.1400e81d8
mov qword [rbp - 0x68], rax
mov rcx, r13
call fcn.1400e825c
lea rbx, [0x14011eaa0]
mov rax, qword [rbp + 0x200]
test rax, rax
cmovne rbx, rax
mov qword [rbp - 0x18], rbx
mov rcx, rbx
call fcn.1400e81d8
mov r14, rax
mov qword [rsp + 0x70], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x70]
mov r15, qword [rbp + 0x1f8]
mov rdx, r15
lea rcx, [rbp + 0x48]
call fcn.14000b540
mov qword [rsp + 0x68], rax
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov rdi, rax
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e81d8
mov rsi, rax
mov qword [rbp + 0x10], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov ecx, 2
call fcn.1400e8270
mov r13, rax
xor eax, eax
mov word [r13], ax
cmp r15, qword [0x14016aa18]
jne 0x14000ff99
lea rcx, [0x14011ec08]
jmp 0x14000ffb2
lea rcx, [0x14011ebf8]
cmp r15, qword [0x14016aa20]
lea rax, [0x14011f8bc]
cmovne rcx, rax
call fcn.1400e81d8
mov r12, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test r12, r12
cmovne rcx, r12
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov r15, qword [rsp + 0x40]
lea rcx, [0x14011eaa0]
test r15, r15
cmovne rcx, r15
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rbx, qword [rsp + 0x40]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x78], rax
mov rcx, r13
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
mov rcx, r15
call fcn.1400e825c
mov rcx, r12
call fcn.1400e825c
cmp word [rdi], 0
je 0x1400100e1
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdx, qword [rsp + 0x40]
lea rcx, [rbp - 0x78]
call fcn.140005790
mov rcx, qword [rsp + 0x40]
call fcn.1400e825c
nop
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x68]
mov r13, qword [rbp + 0x1f0]
mov rcx, r13
call fcn.1400058c0
movzx ebx, al
mov rcx, qword [rbp - 0x78]
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
nop
mov rcx, r14
call fcn.1400e825c
mov r12, qword [rbp - 0x68]
test bl, bl
je 0x140010521
mov esi, dword [rbp + 0x218]
cmp esi, 0xffffffff
jne 0x1400103ca
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov r15, rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov r12, rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov r13, rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rsp + 0x68], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov rbx, rax
mov qword [rsp + 0x70], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x18]
call fcn.1400e81d8
mov rdi, rax
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x40]
mov rdx, qword [rbp + 0x1f8]
lea rcx, [rbp + 0x58]
call fcn.14000b540
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov rsi, rax
mov qword [rsp + 0x70], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x18]
call fcn.1400e81d8
mov r14, rax
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x40]
mov rdx, qword [rbp + 0x1f8]
lea rcx, [rbp + 0x50]
call fcn.14000b540
mov qword [rsp + 0x70], rax
mov eax, reloc.OLEAUT32.dll_SafeArrayLock
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp - 0x20]
mov rcx, qword [rcx]
mov edx, dword [rax + rcx]
cmp dword [0x140179250], edx
jle 0x140010301
lea rcx, [0x140179250]
call fcn.1400e151c
cmp dword [0x140179250], 0xffffffff
jne 0x140010301
mov ecx, 2
call fcn.1400e8270
mov qword [0x140179248], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x14011b1f0]
call fcn.1400e137c
lea rcx, [0x140179250]
call fcn.1400e14bc
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov rcx, qword [0x140179248]
mov qword [rsp + 0x70], rcx
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [0x140179248], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400e825c
xor eax, eax
mov dword [rbp + 0x218], eax
mov rcx, qword [rbp + 0x50]
call fcn.1400e825c
nop
mov rcx, r14
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x58]
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
nop
mov rcx, rbx
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x38]
call fcn.1400e825c
nop
mov rcx, r13
call fcn.1400e825c
nop
mov rcx, r12
call fcn.1400e825c
nop
mov rcx, r15
call fcn.1400e825c
mov rbx, qword [rsp + 0x40]
mov esi, dword [rbp + 0x218]
mov r12, qword [rbp - 0x68]
mov r13, qword [rbp + 0x1f0]
jmp 0x1400103cf
mov ebx, reloc.OLEAUT32.dll_SafeArrayLock
mov r15, qword [rbp - 0x18]
mov rcx, r15
call fcn.1400e81d8
mov rdi, rax
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x38]
mov rdx, qword [rbp + 0x1f8]
lea rcx, [rbp + 0x68]
call fcn.14000b540
mov r14, rax
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
mov edx, dword [rbx + rcx]
cmp dword [0x140179250], edx
jle 0x14001048f
lea rcx, [0x140179250]
call fcn.1400e151c
cmp dword [0x140179250], 0xffffffff
jne 0x14001045b
mov ecx, 2
call fcn.1400e8270
mov qword [0x140179248], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x14011b1f0]
call fcn.1400e137c
lea rcx, [0x140179250]
call fcn.1400e14bc
cmp esi, 0xffffffff
jne 0x14001048f
mov rbx, qword [0x140179248]
lea rcx, [0x14011eaa0]
test r12, r12
cmovne rcx, r12
call fcn.1400e81d8
mov qword [0x140179248], rax
mov rcx, rbx
call fcn.1400e825c
mov rsi, qword [rbp - 0x70]
jmp 0x14001050d
mov ecx, 2
call fcn.1400e8270
mov rsi, rax
xor eax, eax
mov word [rsi], ax
mov rax, qword [r14]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp - 0x28], rax
mov rcx, rsi
call fcn.1400e825c
cmp dword [0x140178168], 1
jne 0x1400104d8
lea rcx, str.System
jmp 0x1400104f4
mov rcx, qword [0x140178378]
test rcx, rcx
je 0x1400104ed
add rcx, 0x210
jmp 0x1400104f4
lea rcx, str.Local_System
mov r8, rbx
mov rsi, qword [rbp - 0x70]
mov rdx, rsi
call fcn.140060db0
nop
mov rcx, rbx
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x68]
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
jmp 0x140010529
mov rsi, qword [rbp - 0x70]
mov r15, qword [rbp - 0x18]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [0x14011fa00]
mov rcx, qword [rbp - 8]
call fcn.140009290
test eax, eax
jne 0x140010e45
xor r14d, r14d
mov r12d, r14d
mov dword [rsp + 0x60], r14d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rbp - 0x80]
call fcn.140019020
test eax, eax
jne 0x140010e45
jmp 0x140010593
xor r14d, r14d
mov ecx, dword [rbp - 0x40]
lea eax, [rcx - 1]
cmp eax, 2
jbe 0x1400105a7
cmp ecx, 7
jne 0x140010e0e
mov ecx, 2
call fcn.1400e8270
mov qword [rbp - 0x60], rax
mov word [rax], r14w
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r14
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.14000a050
test al, al
jne 0x14001064f
mov rdi, qword [rbp - 0x58]
test rdi, rdi
je 0x140010641
mov rbx, rdi
mov r14, qword [rbp - 0x50]
cmp rdi, r14
je 0x140010601
nop dword [rax]
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, r14
jne 0x1400105f0
mov rax, qword [rbp - 0x48]
sub rax, rdi
sar rax, 3
lea rdx, [rax*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140010639
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010fd8
mov rcx, rdi
call fcn.1400e0fb8
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
jmp 0x140010e0e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rbp - 0x30]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x30], rax
mov rcx, rbx
call fcn.1400e825c
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp - 0x60]
mov rdx, r13
lea rcx, [rbp + 0x70]
call fcn.14000a570
mov rdx, rax
lea rcx, [rbp + 0xb8]
call fcn.14000bfb0
or dword [rsp + 0x64], 2
mov rbx, qword [rbp + 0xb8]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov rdi, rax
mov qword [rbp - 0x70], rax
mov rcx, rsi
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
mov rcx, r15
call fcn.1400e81d8
mov rsi, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, str.Depend
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rsi, rsi
cmovne rcx, rsi
call fcn.1400e81d8
mov qword [rsp + 0x40], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
mov esi, dword [rbp + 0x218]
cmp esi, 0xffffffff
jne 0x140010c5c
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov r13, rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x10], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x90], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x88], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x80], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov rsi, rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, r15
call fcn.1400e81d8
mov r12, rax
xor ecx, ecx
call fcn.1400e825c
nop
mov ecx, 2
call fcn.1400e8270
mov qword [rbp - 0x38], rax
mov word [rax], r14w
mov rax, qword [rbp + 0x1f8]
cmp rax, qword [0x14016aa18]
jne 0x140010835
lea rcx, [0x14011ec08]
jmp 0x14001084e
lea rcx, [0x14011ebf8]
cmp rax, qword [0x14016aa20]
lea rax, [0x14011f8bc]
cmovne rcx, rax
call fcn.1400e81d8
mov r15, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test r15, r15
cmovne rcx, r15
call fcn.1400e81d8
mov qword [rsp + 0x68], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdi, qword [rsp + 0x68]
lea rcx, [0x14011eaa0]
test rdi, rdi
cmovne rcx, rdi
call fcn.1400e81d8
mov qword [rsp + 0x68], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.140005790
mov rbx, qword [rsp + 0x68]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov r14, rax
mov qword [rbp - 0x78], rax
mov rcx, qword [rbp - 0x38]
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
mov rcx, rdi
call fcn.1400e825c
mov rcx, r15
call fcn.1400e825c
cmp word [rsi], 0
je 0x140010984
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x68], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.140005790
mov rcx, qword [rsp + 0x68]
call fcn.1400e825c
mov r14, qword [rbp - 0x78]
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov rdi, rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x18]
call fcn.1400e81d8
mov r15, rax
xor ecx, ecx
call fcn.1400e825c
nop
mov ecx, 2
call fcn.1400e8270
mov qword [rbp - 0x38], rax
xor ecx, ecx
mov word [rax], cx
mov rax, qword [rbp + 0x1f8]
cmp rax, qword [0x14016aa18]
jne 0x1400109db
lea rcx, [0x14011ec08]
jmp 0x1400109f4
lea rcx, [0x14011ebf8]
cmp rax, qword [0x14016aa20]
lea rax, [0x14011f8bc]
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rsp + 0x70], rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
mov rax, qword [rsp + 0x70]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [rbp - 0x78]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rsp + 0x68], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.140005790
mov rbx, qword [rsp + 0x68]
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x68], rax
mov rcx, qword [rbp - 0x38]
call fcn.1400e825c
mov rcx, rbx
call fcn.1400e825c
mov rcx, qword [rbp - 0x78]
call fcn.1400e825c
mov rcx, qword [rsp + 0x70]
call fcn.1400e825c
cmp word [rdi], 0
je 0x140010b2d
lea rcx, [0x14011eb8c]
call fcn.1400e81d8
mov rbx, rax
xor ecx, ecx
call fcn.1400e825c
lea rcx, [0x14011eaa0]
test rbx, rbx
cmovne rcx, rbx
call fcn.1400e81d8
mov qword [rsp + 0x70], rax
xor ecx, ecx
call fcn.1400e825c
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140005790
mov rcx, rbx
call fcn.1400e825c
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.140005790
mov rcx, qword [rsp + 0x70]
call fcn.1400e825c
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov ecx, dword [rcx + rax]
cmp dword [0x140179250], ecx
jle 0x140010b8b
lea rcx, [0x140179250]
call fcn.1400e151c
cmp dword [0x140179250], 0xffffffff
jne 0x140010b8b
mov ecx, 2
call fcn.1400e8270
mov qword [0x140179248], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x14011b1f0]
call fcn.1400e137c
lea rcx, [0x140179250]
call fcn.1400e14bc
mov rbx, qword [0x140179248]
lea rcx, [0x14011eaa0]
mov rax, qword [rsp + 0x68]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [0x140179248], rax
mov rcx, rbx
call fcn.1400e825c
xor eax, eax
mov dword [rbp + 0x218], eax
mov rcx, qword [rsp + 0x68]
call fcn.1400e825c
nop
mov rcx, r15
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
nop
mov rcx, r14
call fcn.1400e825c
nop
mov rcx, r12
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x80]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x88]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x90]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x10]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x28]
call fcn.1400e825c
nop
mov rcx, r13
call fcn.1400e825c
mov rdi, qword [rbp - 0x70]
mov rbx, qword [rbp - 0x38]
mov r15, qword [rbp - 0x18]
mov esi, dword [rbp + 0x218]
mov r12d, dword [rsp + 0x60]
mov r13, qword [rbp + 0x1f0]
jmp 0x140010c61
mov ebx, reloc.OLEAUT32.dll_SafeArrayLock
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x40]
mov rdx, qword [rbp + 0x1f8]
lea rcx, [rbp + 0xa0]
call fcn.14000b540
mov r14, rax
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
mov edx, dword [rbx + rcx]
cmp dword [0x140179250], edx
jle 0x140010d03
lea rcx, [0x140179250]
call fcn.1400e151c
cmp dword [0x140179250], 0xffffffff
jne 0x140010cd6
mov ecx, 2
call fcn.1400e8270
mov qword [0x140179248], rax
xor ecx, ecx
mov word [rax], cx
lea rcx, [0x14011b1f0]
call fcn.1400e137c
lea rcx, [0x140179250]
call fcn.1400e14bc
cmp esi, 0xffffffff
jne 0x140010d03
mov rax, qword [rsp + 0x50]
mov rbx, qword [0x140179248]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [0x140179248], rax
jmp 0x140010d74
mov ecx, 2
call fcn.1400e8270
mov rsi, rax
xor eax, eax
mov word [rsi], ax
mov rax, qword [r14]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp - 0x28], rax
mov rcx, rsi
call fcn.1400e825c
cmp dword [0x140178168], 1
jne 0x140010d4c
lea rcx, str.System
jmp 0x140010d68
mov rcx, qword [0x140178378]
test rcx, rcx
je 0x140010d61
add rcx, 0x210
jmp 0x140010d68
lea rcx, str.Local_System
mov r8, rbx
mov rdx, rdi
call fcn.140060db0
nop
mov rcx, rbx
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0xa0]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x40]
call fcn.1400e825c
nop
mov rdi, qword [rbp - 0x58]
test rdi, rdi
je 0x140010e01
mov rbx, rdi
mov rsi, qword [rbp - 0x50]
cmp rdi, rsi
je 0x140010dc1
nop word [rax + rax]
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, rsi
jne 0x140010db0
mov rax, qword [rbp - 0x48]
sub rax, rdi
sar rax, 3
lea rdx, [rax*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140010df9
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010fd8
mov rcx, rdi
call fcn.1400e0fb8
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
mov rsi, qword [rbp - 0x70]
inc r12d
mov dword [rsp + 0x60], r12d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, r12d
mov rcx, qword [rbp - 0x80]
call fcn.140019020
test eax, eax
je 0x140010590
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x78]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400e825c
mov r14, qword [rbp - 0x30]
xor r13d, r13d
mov edi, dword [rsp + 0x60]
inc edi
mov dword [rsp + 0x60], edi
mov ecx, 2
call fcn.1400e8270
mov qword [rsp + 0x50], rax
mov word [rax], r13w
mov ecx, 2
call fcn.1400e8270
mov r15, rax
mov qword [rbp - 0x68], rax
mov word [rax], r13w
mov ecx, 2
call fcn.1400e8270
mov qword [rsp + 0x58], rax
mov word [rax], r13w
mov ecx, 2
call fcn.1400e8270
mov qword [rsp + 0x48], rax
mov word [rax], r13w
mov ecx, 2
call fcn.1400e8270
mov rsi, rax
mov qword [rsp + 0x78], rax
mov word [rax], r13w
mov ecx, 2
call fcn.1400e8270
mov r12, rax
mov qword [rbp - 0x70], rax
mov word [rax], r13w
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, edi
mov rcx, qword [rbp - 8]
call fcn.140019020
test eax, eax
je 0x14000f0f0
mov rdi, qword [rbp]
mov r13d, dword [rbp + 0x218]
mov rcx, r12
call fcn.1400e825c
nop
mov rcx, rsi
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400e825c
nop
mov rcx, r15
call fcn.1400e825c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400e825c
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, r14
call fcn.1400e825c
nop
mov rcx, qword [rbp + 8]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0xa8]
call fcn.1400e825c
nop
mov rcx, rdi
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0xb0]
call fcn.1400e825c
mov eax, r13d
add rsp, 0x2a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400e8160
nop
int3