Function at 0x1400b0f50
Capabilities:
Check if file exists
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
cmp dword [0x140455d78], 0
je 0x1400b0fa3
movzx ecx, word [0x140455b60]
call fcn.14007f830
test eax, eax
je 0x1400b1fa8
mov qword [rsp + 0x58], 4
mov qword [rsp + 0x60], 1
jmp 0x1400b0fb5
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x2f0], rbx
lea r10, [0x140334938]
mov qword [rsp + 0x2f8], rsi
lea rcx, [0x140334d70]
mov qword [rsp + 0x300], rdi
lea r8, [0x140334960]
mov qword [rsp + 0x2d8], r12
mov qword [rsp + 0x2d0], r13
mov qword [rsp + 0x2c8], r14
xor r14d, r14d
mov esi, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x2c0], r15
nop dword [rax]
mov rbx, r14
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x48], rbx
mov edi, r14d
cmp dword [0x140455b64], 0
jne 0x1400b1f45
movsxd rax, edi
mov r9d, 0x20019
imul rdx, rax, 0x208
cmp dword [0x140455d78], 0
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
je 0x1400b1054
add rdx, rcx
jmp 0x1400b1057
add rdx, r8
mov rcx, qword [r10 + rsi*8]
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b1f17
mov rcx, qword [rbp - 0x78]
lea r9, [rbp - 0x64]
mov qword [rsp + 0x38], r14
lea r8, [rbp - 0x60]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov r13d, r14d
mov qword [rsp + 0x20], r14
mov dword [rbp - 0x64], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x1400b1f0d
nop dword [rax]
inc r13d
cmp dword [0x140455b64], 0
jne 0x1400b1eff
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov r9d, 1
mov qword [rbp - 0x80], r14
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x68], r14d
mov r12, r14
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b1191
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b11a0
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
lea rdx, [0x140336870]
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b1191
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x1400b1191
add eax, 4
mov ecx, eax
mov dword [rbp - 0x68], eax
call fcn.140125a94
mov r12, rax
test rax, rax
je 0x1400b1191
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, [0x140336870]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b1186
cmp dword [rbp - 0x68], eax
ja 0x1400b1191
mov rcx, r12
call fcn.140125e14
mov r12, r14
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b11a0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov r9d, 1
mov qword [rbp - 0x80], r14
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x68], r14d
mov r15, r14
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b1271
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b1280
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
lea rdx, str.QuietDisplayName
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b1271
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x1400b1271
add eax, 4
mov ecx, eax
mov dword [rbp - 0x68], eax
call fcn.140125a94
mov r15, rax
test rax, rax
je 0x1400b1271
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
xor r8d, r8d
mov qword [rsp + 0x20], r15
lea rdx, str.QuietDisplayName
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b1266
cmp dword [rbp - 0x68], eax
ja 0x1400b1271
mov rcx, r15
call fcn.140125e14
mov r15, r14
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b1280
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12, r12
jne 0x1400b128e
test r15, r15
je 0x1400b1eb3
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
xor esi, esi
mov qword [rbp - 0x80], r14
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x68], esi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
lea r8d, [rsi + 4]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b135b
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b136a
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
lea rdx, [0x1403367b0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b135b
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x1400b135b
add eax, 4
mov ecx, eax
mov dword [rbp - 0x68], eax
call fcn.140125a94
mov r14, rax
test rax, rax
je 0x1400b135b
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [0x1403367b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b1350
cmp dword [rbp - 0x68], esi
ja 0x1400b135b
mov rcx, r14
call fcn.140125e14
mov r14, rsi
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b136a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov r9d, 1
mov qword [rbp - 0x80], rsi
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x68], esi
mov rdi, rsi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b143a
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b1449
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
lea rdx, [0x1403367d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b143a
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x1400b143a
add eax, 4
mov ecx, eax
mov dword [rbp - 0x68], eax
call fcn.140125a94
mov rdi, rax
test rax, rax
je 0x1400b143a
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x1403367d0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b142f
cmp dword [rbp - 0x68], esi
ja 0x1400b143a
mov rcx, rdi
call fcn.140125e14
mov rdi, rsi
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b1449
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov r9d, 1
mov qword [rbp - 0x80], rsi
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x68], esi
mov rbx, rsi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b1519
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b1528
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
lea rdx, [0x1403367e8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b1519
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x1400b1519
add eax, 4
mov ecx, eax
mov dword [rbp - 0x68], eax
call fcn.140125a94
mov rbx, rax
test rax, rax
je 0x1400b1519
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x1403367e8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b150e
cmp dword [rbp - 0x68], esi
ja 0x1400b1519
mov rcx, rbx
call fcn.140125e14
mov rbx, rsi
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b1528
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
jne 0x1400b153b
test rdi, rdi
jne 0x1400b153b
test rbx, rbx
je 0x1400b1eb0
mov ecx, 0x4b0
call fcn.140125dd0
xor edx, edx
mov r8d, 0x4b0
mov rcx, rax
mov rsi, rax
call fcn.1402767a0
cmp dword [0x140455d78], 0
lea rdx, [0x140334938]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rdx + rax*8]
lea rdx, [rsi + 8]
mov qword [rsi], rcx
je 0x1400b15f2
imul r8, qword [rsp + 0x48], 0x208
lea rax, [0x140334d70]
mov ecx, 2
add r8, rax
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [r8]
lea r8, [r8 + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [r8 - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [r8 - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [r8 - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [r8 - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [r8 - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [r8 - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [r8 - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x1400b1590
mov eax, dword [r8]
mov dword [rdx], eax
jmp 0x1400b1667
imul rax, qword [rsp + 0x48], 0x208
lea rcx, [0x140334960]
add rax, rcx
mov ecx, 2
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x1400b1610
mov ecx, dword [rax]
mov dword [rdx], ecx
lea rcx, [rsi + 0x210]
mov edx, 2
lea rax, [rbp - 0x60]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1400b1680
mov eax, dword [rax]
lea r9d, [rdx + 1]
mov dword [rcx], eax
lea r8d, [rdx + 4]
mov qword [rsi + 0x428], r14
lea rdx, [rbp - 0x60]
mov qword [rsi + 0x430], rbx
test r12, r12
mov qword [rsi + 0x420], r15
mov rax, r15
cmovne rax, r12
mov qword [rsi + 0x458], rdi
mov qword [rsi + 0x418], rax
xor r14d, r14d
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov ebx, r14d
mov qword [rbp - 0x80], r14
mov dword [rbp - 0x68], r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b17d7
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b17e6
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
lea rdx, str.InstallDate
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b17d7
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x1400b17d7
add eax, 4
mov ecx, eax
mov dword [rbp - 0x68], eax
call fcn.140125a94
mov rbx, rax
test rax, rax
je 0x1400b17d7
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.InstallDate
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b17cc
cmp dword [rbp - 0x68], r14d
ja 0x1400b17d7
mov rcx, rbx
call fcn.140125e14
mov rbx, r14
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b17e6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi + 0x438], rbx
lea rax, [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x60]
mov r9d, 1
mov qword [rbp - 0x80], r14
mov rbx, r14
mov dword [rbp - 0x68], r14d
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b18bf
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b18ce
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
lea rdx, [0x140336930]
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b18bf
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x1400b18bf
add eax, 4
mov ecx, eax
mov dword [rbp - 0x68], eax
call fcn.140125a94
mov rbx, rax
test rax, rax
je 0x1400b18bf
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x140336930]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b18b4
cmp dword [rbp - 0x68], r14d
ja 0x1400b18bf
mov rcx, rbx
call fcn.140125e14
mov rbx, r14
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b18ce
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi + 0x440], rbx
lea rax, [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x60]
mov r9d, 1
mov qword [rbp - 0x80], r14
mov rbx, r14
mov dword [rbp - 0x68], r14d
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b19a7
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b19b6
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
lea rdx, [0x140336948]
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b19a7
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x1400b19a7
add eax, 4
mov ecx, eax
mov dword [rbp - 0x68], eax
call fcn.140125a94
mov rbx, rax
test rax, rax
je 0x1400b19a7
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x140336948]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b199c
cmp dword [rbp - 0x68], r14d
ja 0x1400b19a7
mov rcx, rbx
call fcn.140125e14
mov rbx, r14
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b19b6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi + 0x448], rbx
lea rax, [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x60]
mov r9d, 1
mov qword [rbp - 0x80], r14
mov rbx, r14
mov dword [rbp - 0x68], r14d
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b1a8f
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b1a9e
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
lea rdx, str.LocationRoot
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b1a8f
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x1400b1a8f
add eax, 4
mov ecx, eax
mov dword [rbp - 0x68], eax
call fcn.140125a94
mov rbx, rax
test rax, rax
je 0x1400b1a8f
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.LocationRoot
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b1a84
cmp dword [rbp - 0x68], r14d
ja 0x1400b1a8f
mov rcx, rbx
call fcn.140125e14
mov rbx, r14
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400b1a9e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 1
mov qword [rsi + 0x450], rbx
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x70]
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x70], r14
mov dword [rbp - 0x68], r14d
lea r8d, [r9 + 3]
mov dword [rbp - 0x80], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b1b0b
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b1b1a
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x140443784]
lea rax, [rbp - 0x68]
lea rdx, str.SystemComponent
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b1b1a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x68]
lea rdx, [rbp - 0x60]
mov dword [rsi + 0x460], eax
mov r9d, 1
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x70]
mov qword [rbp - 0x70], r14
mov dword [rbp - 0x68], r14d
lea r8d, [r9 + 3]
mov dword [rbp - 0x80], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b1b89
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b1b98
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x140443784]
lea rax, [rbp - 0x68]
lea rdx, [0x1403368b0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b1b98
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x68]
lea rdx, [rbp - 0x60]
mov dword [rsi + 0x464], eax
mov r9d, 1
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x70]
mov qword [rbp - 0x70], r14
mov dword [rbp - 0x68], r14d
lea r8d, [r9 + 3]
mov dword [rbp - 0x80], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b1c07
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b1c16
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x140443784]
lea rax, [rbp - 0x68]
lea rdx, [0x1403368d8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b1c16
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x68]
lea rdx, [rbp - 0x60]
mov dword [rsi + 0x468], eax
mov r9d, 1
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x70]
mov qword [rbp - 0x70], r14
mov dword [rbp - 0x68], r14d
lea r8d, [r9 + 3]
mov dword [rbp - 0x80], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b1c85
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b1c94
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x140443784]
lea rax, [rbp - 0x68]
lea rdx, str.EstimatedSize
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b1c94
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x68]
mov rcx, rsi
mov dword [rsi + 0x46c], eax
call fcn.1400b0810
mov dword [rsi + 0x4a0], eax
mov rdi, r14
test eax, eax
jne 0x1400b1deb
xor edx, edx
mov rcx, rsi
call fcn.1400b0150
mov qword [rsi + 0x480], rax
test rax, rax
je 0x1400b1deb
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b1deb
mov rbx, qword [rsi + 0x480]
test rbx, rbx
je 0x1400b1d3f
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x1400b1d3f
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b1d3f
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x1400b1d10
cmp rax, 2
jbe 0x1400b1d3f
mov r8d, 1
lea rdx, str._HOMEDRIVE___USERPROFILE___HOMEPATH___temp___PATH___SystemDrive___APPDATA___ProgramFiles_x86____ProgramFiles___windir___windir___systemroot___systemroot____systemroot____systemroot__:_Recycle.Bin_:_Recycle.Bin_:Windows_:Windows_:Users_:Documents_and_Settings_:ProgramData_:ProgramDataPackages_:ProgramDataPackages_:ProgramDataPackage_Cache_:Program_Files__x86__:Program_Files__x86_Microsoft_:Program_Files__x86_Microsoft_:Program_Files__x86_Microsoft_:Program_Files__x86_Microsoft_:Program_Files__x86_Windows_:Program_Files__x86_Windows_:Program_Files__x86_Windows_:Program_Files__x86_Windows_:Program_Files__x86_Common_Files_:Program_Files__x86_Common_Files_:Program_Files_:Program_FilesMicrosoft_:Program_FilesMicrosoft_:Program_FilesMicrosoft_:Program_FilesMicrosoft_:Program_FilesWindows_:Program_FilesWindows_:Program_FilesWindows_:Program_FilesWindows_:Program_FilesWindowsCommon_Files_:Program_FilesWindowsCommon_Files_:Program_FilesWindowsApps_:Program_FilesWindowsApps_:UsersAppDataLocal_:UsersAppDataLocalOneDrive_:UsersAppDataLocalOneDrive_:UsersAppDataLocalPackages_:UsersAppDataLocalPackages_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalLow_:UsersAppDataLocalLowMicrosoft_:UsersAppDataLocalLowMicrosoft_:UsersAppDataLocalLowMicrosoft_:UsersAppDataLocalLowMicrosoft_:UsersAppDataRoaming_:UsersAppDataRoamingMicrosoft_:UsersAppDataRoamingMicrosoft_:UsersAppDataRoamingMicrosoft_:UsersAppDataRoamingMicrosoft_:UsersAppData_:UsersDocuments_:UsersDesktop_:UsersDesktop_:UsersOneDrive_:UsersOneDrive_
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
mov ecx, r14d
setne cl
jmp 0x1400b1d42
mov ecx, r14d
test ecx, ecx
je 0x1400b1deb
lea rdx, [0x1404580f0]
lea rcx, [rsp + 0x68]
call fcn.1400b2500
mov rcx, qword [rsi + 0x480]
mov rdx, rax
call fcn.1400b0bb0
mov dword [rsi + 0x490], eax
test eax, eax
jne 0x1400b1db9
lea rdx, [0x140458040]
lea rcx, [rsp + 0x68]
call fcn.1400b2500
mov rdx, rax
mov rcx, rsi
call fcn.1400afe40
mov qword [rsi + 0x494], rax
test rax, rax
je 0x1400b1da8
mov dword [rsi + 0x490], 1
jmp 0x1400b1db9
xor edx, edx
mov rcx, rsi
call fcn.1400b08c0
mov qword [rsi + 0x488], rax
mov rcx, qword [rsi + 0x488]
mov rdi, qword [rsi + 0x480]
test rcx, rcx
je 0x1400b1ddd
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b1ddd
mov rdi, qword [rsi + 0x488]
mov rcx, rdi
call fcn.1400693f0
mov dword [rsi + 0x4a4], eax
cmp dword [rsi + 0x46c], r14d
ja 0x1400b1e96
cmp dword [rsi + 0x4a0], r14d
jne 0x1400b1e96
test rdi, rdi
je 0x1400b1e96
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x1400b1e96
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b1e96
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], r14w
jne 0x1400b1e30
cmp rax, 2
jbe 0x1400b1e96
mov r8d, 1
lea rdx, str._HOMEDRIVE___USERPROFILE___HOMEPATH___temp___PATH___SystemDrive___APPDATA___ProgramFiles_x86____ProgramFiles___windir___windir___systemroot___systemroot____systemroot____systemroot__:_Recycle.Bin_:_Recycle.Bin_:Windows_:Windows_:Users_:Documents_and_Settings_:ProgramData_:ProgramDataPackages_:ProgramDataPackages_:ProgramDataPackage_Cache_:Program_Files__x86__:Program_Files__x86_Microsoft_:Program_Files__x86_Microsoft_:Program_Files__x86_Microsoft_:Program_Files__x86_Microsoft_:Program_Files__x86_Windows_:Program_Files__x86_Windows_:Program_Files__x86_Windows_:Program_Files__x86_Windows_:Program_Files__x86_Common_Files_:Program_Files__x86_Common_Files_:Program_Files_:Program_FilesMicrosoft_:Program_FilesMicrosoft_:Program_FilesMicrosoft_:Program_FilesMicrosoft_:Program_FilesWindows_:Program_FilesWindows_:Program_FilesWindows_:Program_FilesWindows_:Program_FilesWindowsCommon_Files_:Program_FilesWindowsCommon_Files_:Program_FilesWindowsApps_:Program_FilesWindowsApps_:UsersAppDataLocal_:UsersAppDataLocalOneDrive_:UsersAppDataLocalOneDrive_:UsersAppDataLocalPackages_:UsersAppDataLocalPackages_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalLow_:UsersAppDataLocalLowMicrosoft_:UsersAppDataLocalLowMicrosoft_:UsersAppDataLocalLowMicrosoft_:UsersAppDataLocalLowMicrosoft_:UsersAppDataRoaming_:UsersAppDataRoamingMicrosoft_:UsersAppDataRoamingMicrosoft_:UsersAppDataRoamingMicrosoft_:UsersAppDataRoamingMicrosoft_:UsersAppData_:UsersDocuments_:UsersDesktop_:UsersDesktop_:UsersOneDrive_:UsersOneDrive_
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
je 0x1400b1e96
mov edx, 1
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.140052070
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b1e96
lea r9, [rsi + 0x470]
mov r8, rdi
lea rdx, [0x14007d250]
mov rcx, rax
call fcn.140052330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140456df8]
xor r9d, r9d
mov r8, rsi
mov edx, 0x591
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400b1eb3
xor r14d, r14d
xor edx, edx
mov dword [rbp - 0x64], 0x104
mov r8d, 0x208
lea rcx, [rbp - 0x60]
call fcn.1402767a0
mov rcx, qword [rbp - 0x78]
lea r9, [rbp - 0x64]
mov qword [rsp + 0x38], r14
lea r8, [rbp - 0x60]
mov qword [rsp + 0x30], r14
mov edx, r13d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x1400b10b0
mov rbx, qword [rsp + 0x48]
mov edi, dword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
lea rcx, [0x140334d70]
inc rbx
mov dword [rsp + 0x40], edi
lea r8, [0x140334960]
mov qword [rsp + 0x48], rbx
lea r10, [0x140334938]
cmp rbx, qword [rsp + 0x58]
jl 0x1400b1020
inc rsi
mov qword [rsp + 0x50], rsi
cmp rsi, qword [rsp + 0x60]
jl 0x1400b1010
mov rcx, qword [0x140456df8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x592
call qword [sym.imp.USER32.dll_PostMessageW]
mov r15, qword [rsp + 0x2c0]
mov r14, qword [rsp + 0x2c8]
mov r13, qword [rsp + 0x2d0]
mov r12, qword [rsp + 0x2d8]
mov rdi, qword [rsp + 0x300]
mov rsi, qword [rsp + 0x2f8]
mov rbx, qword [rsp + 0x2f0]
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140125a70
add rsp, 0x2e0
pop rbp
ret