Function at 0x1400039dc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc8]
sub rsp, 0x1c8
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rax, qword [0x14007c010]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rdi, r9
mov r13d, r8d
mov dword [rsp + 0x48], r13d
mov r12, rdx
mov qword [rbp - 0x58], rcx
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rdx, [rax + rcx]
xor esi, esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rdx
lea ebx, [rsi + 1]
mov byte [rsp + 0x70], bl
lea r9, [rsp + 0x58]
mov edx, dword [0x140048624]
lea rcx, [rbp - 0x10]
call fcn.1400102b0
mov dword [rbp - 0x78], esi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x7c], esi
mov rcx, rdi
call fcn.140006c14
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x50], rsi
lea r8d, [rsi + 2]
mov edx, esi
mov dword [rbp - 0x80], edx
test rax, rax
je 0x140003acc
mov rcx, rax
cmp word [rax], si
je 0x140003acc
add rcx, r8
add edx, ebx
cmp word [rcx], si
jne 0x140003abf
mov dword [rbp - 0x80], edx
test rdi, rdi
je 0x140003aec
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x140003aec
mov r15d, esi
jmp 0x140003ae5
add rax, r8
add r15d, ebx
cmp word [rax], si
jne 0x140003adf
jmp 0x140003aef
mov r15d, esi
lea eax, [rdx + 0x104]
cmp eax, 0x104
jb 0x140004780
add rax, 3
mov edx, 0xffffffff
cmp rax, rdx
ja 0x140004777
lea ecx, [rax + r15]
cmp ecx, eax
jb 0x14000479e
mov r14d, ecx
add r14, r8
mov qword [rsp + 0x78], r14
cmp r14, rdx
ja 0x140004798
mov eax, r14d
mov qword [rbp - 0x28], rax
lea rcx, [rax + rax]
mov rax, rcx
shr rax, 0x20
test eax, eax
jne 0x140004786
call fcn.140002798
mov rbx, rax
mov rcx, r12
mov eax, esi
test r12, r12
je 0x140003b75
cmp word [r12], si
je 0x140003b75
mov edx, 1
lea rcx, [rcx + 2]
add eax, edx
cmp word [rcx], si
jne 0x140003b6a
lea esi, [rax + 7]
lea ecx, [rsi + rsi]
call fcn.140002798
mov r10, rax
mov qword [rbp - 0x50], rax
mov edx, r13d
mov rcx, rdi
call fcn.14000bd6c
mov dword [rbp - 0x68], eax
xor eax, eax
mov qword [rbp - 0x30], rax
lea rdx, str.Param
test r10, r10
je 0x140004596
test rbx, rbx
je 0x1400045bc
lea rcx, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r12
mov word [rsp + 0x70], ax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, str.FActivateWithDde:
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170a8ce
mov r8d, 0x64
call fcn.14000262c
mov r8d, esi
lea rdx, [0x1400471e8]
mov rcx, qword [rbp - 0x50]
call fcn.14000dc08
mov r8d, esi
mov rdx, r12
call fcn.14000dc84
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x58]
call fcn.14000e39c
xor esi, esi
test eax, eax
jne 0x140004599
lea rdx, str.WinWord
cmp r13d, 9
ja 0x140003daa
mov r14d, dword [rbp + 0x130]
test r14d, r14d
je 0x140003da5
mov rcx, rdi
call fcn.1400038d0
test eax, eax
jne 0x140003d08
lea rcx, [r13*4]
add rcx, r13
add rcx, rcx
lea rdx, str.WinWord
mov rax, qword [rdx + rcx*8 + 0x30]
test rax, rax
je 0x140003d02
cmp word [rax], si
je 0x140003d02
mov qword [rsp + 0x28], rax
lea eax, [rsi + 4]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, eax
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, sil
cmp eax, 5
mov eax, 1
cmove esi, eax
test r13, r13
je 0x140003cee
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, sil
cmp eax, 0xb7
mov eax, 1
cmove esi, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
mov r13d, dword [rsp + 0x48]
xor esi, esi
lea rdx, str.WinWord
jmp 0x140003d04
mov eax, esi
test eax, eax
je 0x140003d12
mov r14d, esi
lea rdx, str.WinWord
test r14d, r14d
je 0x140003da5
mov eax, r13d
lea rcx, [rax + rax*4]
add rcx, rcx
mov rsi, qword [rdx + rcx*8 + 8]
xor r14d, r14d
cmp word [rsi], r14w
jne 0x140003d4d
mov rcx, qword [rbp - 0x70]
call fcn.1400047a4
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140004599
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [fcn.140002250]
lea rcx, [rbp - 0x7c]
call qword [sym.imp.USER32.dll_DdeInitializeW]
test eax, eax
jne 0x14000458f
mov r8d, 0x4b0
mov rdx, rsi
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.USER32.dll_DdeCreateStringHandleW]
mov qword [rbp - 0x18], rax
xor esi, esi
test rax, rax
je 0x140003da5
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.USER32.dll_DdeConnectList]
mov qword [rbp - 0x60], rax
mov r14, qword [rsp + 0x78]
mov byte [rsp + 0x40], 1
cmp qword [rbp - 0x60], rsi
je 0x1400043ed
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x48], 2
cmp r13d, 0xa
sbb edx, edx
and r13d, edx
lea rdx, [0x140048368]
mov rcx, r12
call fcn.14000db08
test eax, eax
jne 0x140003e1e
lea rdx, str.OpenAsReadOnly
mov rcx, r12
call fcn.14000db08
test eax, eax
jne 0x140003e1e
lea rdx, [r13*4]
add rdx, r13
add rdx, rdx
mov r8d, r14d
lea rax, str.WinWord
mov rdx, qword [rax + rdx*8 + 0x28]
mov rcx, rbx
call fcn.14000dc08
movzx edx, word [rbx]
jmp 0x140003e23
mov word [rbx], si
mov edx, esi
mov rax, rbx
mov ecx, esi
test dx, dx
je 0x140003e3d
mov edx, 1
lea rax, [rax + 2]
add ecx, edx
cmp word [rax], si
jne 0x140003e32
add ecx, ecx
mov dword [rsp + 0x78], ecx
cmp dword [rbp - 0x68], esi
je 0x140003e6b
mov r8d, r14d
lea rdx, str._Activate___1___
mov rcx, rbx
call fcn.14000dc08
mov dword [rsp + 0x78], 0x20
mov r12d, dword [rbp - 0x80]
jmp 0x140003f20
mov r12d, dword [rbp - 0x80]
test ecx, ecx
jne 0x140003f20
lea eax, [r12*2 + 0x208]
mov dword [rsp + 0x78], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.ddeexec
mov rcx, qword [rbp - 0x70]
call fcn.14000e39c
test eax, eax
jne 0x140003f1b
mov rcx, qword [rbp - 0x40]
mov eax, 1
cmp dword [rbp - 0x74], eax
jne 0x140003eb7
mov byte [rbx], sil
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x74]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003f1b
test r15d, r15d
je 0x1400040ca
xor edx, edx
mov rcx, rbx
call fcn.14000dccc
mov rsi, rax
test rax, rax
je 0x140003f20
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.14000dc84
mov rcx, rsi
call fcn.1400027dc
mov eax, dword [rsp + 0x78]
lea eax, [rax*2 - 2]
mov dword [rsp + 0x78], eax
jmp 0x140003f20
mov byte [rsp + 0x40], sil
test r15d, r15d
je 0x1400040ca
lea rdx, str.__1_
mov rcx, rbx
call fcn.14000dd3c
mov rsi, rax
xor edx, edx
test rax, rax
jne 0x140003f5f
lea rdx, [0x140047324]
mov rcx, rbx
call fcn.14000dd3c
mov rsi, rax
xor edx, edx
test rax, rax
je 0x1400040ca
mov rcx, qword [rdi + 0x20]
cmp word [rcx], 0x22
jne 0x140003f7a
mov eax, r15d
cmp word [rcx + rax*2 - 2], 0x22
mov r14d, 1
je 0x140003f7d
mov r14d, edx
mov eax, 4
cmp word [rsi], 0x22
lea ecx, [rax - 2]
cmovne eax, ecx
mov dword [rsp + 0x48], eax
lea rcx, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x58], rcx
lea rcx, str.Param
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x70], dx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, str.FActivateWithDde:_Before_FReplaceStrForStr_with
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170a8cf
mov r8d, 0x64
call fcn.14000262c
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x58], rax
lea rax, str.Param
mov qword [rsp + 0x60], rax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x68], rax
xor ecx, ecx
mov word [rsp + 0x70], cx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, str.FActivateWithDde:_Before_FReplaceStrForStr_with
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170a8d0
mov r8d, 0x64
call fcn.14000262c
mov rcx, qword [rdi + 0x20]
mov rax, qword [rbp - 0x28]
dec rax
mov edx, 0xffffffff
cmp rax, rdx
ja 0x14000478c
mov edx, dword [rsp + 0x78]
shr edx, 1
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rcx
mov r14d, dword [rsp + 0x48]
mov dword [rsp + 0x20], r14d
mov r9, rsi
mov r8d, eax
mov rcx, rbx
call fcn.140005020
xor ecx, ecx
test eax, eax
je 0x14000458f
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x58], rax
lea rax, str.Param
mov qword [rsp + 0x60], rax
lea rax, str.DDE_Command
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], cx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov edx, 0x851
mov ecx, 0x170a8d1
mov r8d, 0xc8
call fcn.14000262c
jmp 0x1400040cf
mov r14d, dword [rsp + 0x48]
lea rdx, str.__1_
mov rcx, rbx
call fcn.14000dd3c
mov rsi, rax
xor eax, eax
test rsi, rsi
jne 0x140004105
lea rdx, [0x140047324]
mov rcx, rbx
call fcn.14000dd3c
mov rsi, rax
xor eax, eax
test rsi, rsi
je 0x1400043f1
cmp word [rsi], 0x22
mov ecx, 4
cmove r14d, ecx
lea rcx, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x58], rcx
lea rcx, str.Param
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x70], ax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, str.FActivateWithDde:_Before_FReplaceStrForStr_with
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170a8d2
mov r8d, 0x64
call fcn.14000262c
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x58], rax
lea rax, str.Param
mov qword [rsp + 0x60], rax
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x68], rax
xor eax, eax
mov word [rsp + 0x70], ax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, str.FActivateWithDde:_Before_FReplaceStrForStr_with
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170a8d3
mov r8d, 0x64
call fcn.14000262c
mov rax, qword [rbp - 0x28]
dec rax
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x140004792
mov edx, dword [rsp + 0x78]
shr edx, 1
add edx, r15d
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rsi
mov r8d, eax
mov rcx, rbx
call fcn.140005020
xor r14d, r14d
test eax, eax
je 0x14000458f
lea rsi, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x58], rsi
lea rax, str.Param
mov qword [rsp + 0x60], rax
lea rax, str.DDE_Command
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], r14w
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov edx, 0x851
mov ecx, 0x170a8d4
mov r8d, 0xc8
call fcn.14000262c
cmp byte [rsp + 0x40], r14b
je 0x1400043f8
mov esi, 0xffffffff
mov eax, 0xbb8
lea ecx, [r14 + 1]
cmp r13d, ecx
cmove esi, eax
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.USER32.dll_DdeQueryNextServer]
mov rdi, rax
test rax, rax
je 0x14000458f
lea ecx, [r15 + r12]
lea r14d, [rcx*2 + 2]
xor r15d, r15d
lea r12d, [r15 + 1]
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x58], rax
lea rax, str.Param
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x70], r15w
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, str.FActivateWithDde:_Before_HevDdeClientTransaction_with
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170a8d5
mov r8d, 0x64
call fcn.14000262c
call fcn.14000f440
mov edx, dword [rsp + 0x78]
add edx, r14d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 0x4050
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, rdi
mov rcx, rbx
call qword [sym.imp.USER32.dll_DdeClientTransaction]
mov qword [rbp - 0x20], rax
test rax, rax
jne 0x140004340
cmp r13d, r12d
je 0x140004340
mov rdx, rdi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.USER32.dll_DdeQueryNextServer]
mov rdi, rax
test rax, rax
jne 0x140004295
jmp 0x14000454f
mov dword [rbp - 0x78], r12d
lea rcx, [r13*4]
add rcx, r13
add rcx, rcx
lea rax, str.WinWord
cmp dword [rax + rcx*8 + 0x3c], r15d
je 0x14000454f
mov esi, 0x90
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x20], esi
lea r8, [rbp + 0x20]
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.USER32.dll_DdeQueryConvInfo]
mov rdi, qword [rbp + 0xa8]
mov rcx, rdi
jmp 0x1400043a7
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne 0x140004398
cmp qword [rbp + 0xa8], r15
je 0x14000454f
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400043da
mov edx, 9
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000f440
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x14000454f
mov r12d, dword [rbp - 0x80]
lea rsi, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov dword [rsp + 0x48], 0x208
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.command
mov rcx, qword [rbp - 0x70]
call fcn.14000e39c
xor r15d, r15d
test eax, eax
jne 0x14000454f
mov rcx, qword [rbp - 0x48]
lea eax, [r15 + 1]
cmp dword [rbp - 0x74], eax
jne 0x14000443a
mov byte [rbx], r15b
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x74]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000454f
mov qword [rsp + 0x58], rsi
lea rax, str.Param
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x70], r15w
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r14, str.FActivateWithDde:_Before_FSimpleSpawn_with
mov qword [rsp + 0x20], r14
mov edx, 0x851
mov ecx, 0x170a8d6
mov r8d, 0x64
call fcn.14000262c
mov qword [rsp + 0x58], rsi
lea rax, str.Param
mov qword [rsp + 0x60], rax
mov rsi, qword [rbp - 0x38]
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x70], r15w
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov edx, 0x851
mov ecx, 0x170a8d7
mov r8d, 0x64
call fcn.14000262c
mov eax, 4
cmp r13d, eax
jne 0x140004556
call fcn.14000c03c
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14000454f
mov r8d, 0x208
mov rdx, rbx
mov rcx, rax
call fcn.14000dc84
test rdi, rdi
je 0x14000451f
mov rcx, qword [rdi + 0x28]
jmp 0x140004522
mov rcx, r15
test rdi, rdi
je 0x14000452d
mov r9, qword [rdi + 0x20]
jmp 0x140004530
mov r9, r15
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x30]
mov rdx, rsi
mov r8d, r12d
call fcn.140004a90
mov edx, r15d
test eax, eax
setne dl
mov dword [rbp - 0x78], edx
mov rsi, qword [rsp + 0x50]
jmp 0x14000459c
test rdi, rdi
je 0x140004561
mov rax, qword [rdi + 0x28]
jmp 0x140004564
mov rax, r15
test rdi, rdi
je 0x14000456f
mov r9, qword [rdi + 0x20]
jmp 0x140004572
mov r9, r15
mov ecx, 2
cmp r13d, ecx
jne 0x140004585
cmp dword [rbp - 0x68], r15d
je 0x140004585
mov rsi, r15
mov qword [rsp + 0x20], rax
mov rcx, rbx
jmp 0x140004539
mov rsi, qword [rsp + 0x50]
jmp 0x140004599
mov rsi, rax
xor r15d, r15d
test rbx, rbx
je 0x1400045a9
mov rcx, rbx
call fcn.1400027dc
test rsi, rsi
je 0x1400045b6
mov rcx, rsi
call fcn.1400027dc
mov r10, qword [rbp - 0x50]
jmp 0x1400045bf
xor r15d, r15d
test r10, r10
je 0x1400045cc
mov rcx, r10
call fcn.1400027dc
mov rax, qword [rbp - 0x30]
test rax, rax
je 0x1400045dd
mov rcx, rax
call fcn.1400027dc
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x1400045ef
mov rcx, rax
call qword [sym.imp.USER32.dll_DdeFreeDataHandle]
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x140004604
mov rdx, rax
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.USER32.dll_DdeFreeStringHandle]
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x140004616
mov rcx, rax
call qword [sym.imp.USER32.dll_DdeDisconnectList]
mov ecx, dword [rbp - 0x7c]
test ecx, ecx
je 0x140004623
call qword [sym.imp.USER32.dll_DdeUninitialize]
lea rax, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov qword [rsp + 0x58], rax
lea rax, str.Param
mov qword [rsp + 0x60], rax
mov r14d, dword [rbp - 0x78]
mov dword [rsp + 0x68], r14d
mov word [rsp + 0x6c], r15w
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, str.FActivateWithDde_
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170a8d8
mov r8d, 0x64
call fcn.14000262c
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140004685
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x48], r15
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140004698
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x70], r15
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400046ab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x40], r15
cmp byte [rbp - 0x10], r15b
je 0x140004751
mov ebx, dword [rbp + 0x10]
mov word [rsp + 0x40], bx
mov edi, 0x18
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rdi, qword [rdi + rcx]
test rdi, rdi
je 0x140004751
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x58]
mov rcx, rdi
call fcn.14001042c
mov rax, qword [rbp - 0x58]
cmp rax, qword [rdi + 8]
je 0x140004751
lea rsi, [rax + 0x18]
test rsi, rsi
je 0x140004751
cmp byte [rbp], r15b
je 0x14000473c
mov word [rsp + 0x40], bx
test rdi, rdi
je 0x14000473c
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x58]
mov rcx, rdi
call fcn.14001042c
mov rax, qword [rbp - 0x58]
cmp rax, qword [rdi + 8]
je 0x14000473c
lea rdx, [rax + 0x18]
test rdx, rdx
je 0x14000473c
mov rcx, qword [rbp + 8]
call fcn.140010188
xor edx, edx
mov ecx, ebx
call fcn.140012d88
mov rdx, rsi
mov rcx, qword [rbp - 8]
call fcn.140010188
mov eax, r14d
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14003ee60
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000275c
nop
jmp 0x14000477f
nop
call fcn.14000275c
int3
call fcn.14000275c
int3
call fcn.14000275c
int3
call fcn.14000275c
int3
call fcn.14000275c
int3
call fcn.14000275c
int3