Function at 0x14009aa20
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2f8
movaps xmmword [rsp + 0x2e0], xmm7
movaps xmmword [rsp + 0x2d0], xmm6
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1402b4040]
xor rax, rsp
mov qword [rsp + 0x2c8], rax
lea rsi, [rdx + 8]
mov rdx, qword [rdx + 8]
mov rcx, rdi
call fcn.1400fce30
mov qword [rdi], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x40], rdi
movups xmmword [rdi + 8], xmm0
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x1c0], r12
movaps xmm6, xmmword [0x140270080]
movaps xmmword [rsp + 0x1b0], xmm6
lea rax, [rsp + 0x252]
mov byte [rax + 0x15], 2
lea rcx, [0x140278930]
lea rsi, [rsp + 0x250]
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009ce7c
mov word [rsp + 0x250], 0x7670
mov byte [rsp + 0x252], 0
mov qword [rsp + 0x1f0], r12
movaps xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], 0
cmp byte [rbx + 0x5f], 0
js 0x14009ab04
lea rdx, [rbx + 0x48]
jmp 0x14009ab08
mov rdx, qword [rbx + 0x48]
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov qword [rsp + 0x38], rbx
jne 0x14009aba4
mov dword [rsp + 0x1d0], 0
mov dword [rsp + 0x230], 0xaaaaaaaa
cmp byte [rsp + 0x267], 0
mov rdx, rsi
jns 0x14009ab5f
mov rdx, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x1f0]
lea rdi, [rsp + 0x1d0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x230]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14009c16e
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rsp + 0x267], 0
jns 0x14009abbb
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
movsx rax, byte [rsp + 0x1c7]
test rax, rax
jns 0x14009abd1
mov rax, qword [rsp + 0x1b8]
test rax, rax
je 0x14009cc5f
lea rdx, [rbx + 0x60]
mov rcx, rbx
call fcn.14009ced0
test al, al
jne 0x14009abfe
lea rdx, [rbx + 0x78]
mov rcx, rbx
call fcn.14009ced0
test al, al
je 0x14009b928
movabs rcx, 0x8000000000000000
movsx rdi, byte [rbx + 0xbf]
mov rsi, rdi
test rdi, rdi
jns 0x14009ac1f
mov rsi, qword [rbx + 0xb0]
lea rbx, [rsi + 0xc]
lea rax, [rcx - 9]
mov qword [rsp + 0x1a0], r12
movaps xmmword [rsp + 0x190], xmm6
cmp rbx, rax
ja 0x14009ce7f
cmp rbx, 0xa
mov qword [rsp + 0x80], rax
jbe 0x14009ad4b
lea rax, [rcx - 4]
and rax, rbx
add rax, 4
mov r14, rbx
or r14, 3
cmp r14, 0xb
cmove r14, rax
inc r14
js 0x14009ce88
mov r15, rcx
lea rcx, [r14 + r14]
call fcn.14018fb98
or r14, r15
mov qword [rsp + 0x1a0], r14
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], rbx
mov rbx, qword [rsp + 0x38]
lea rcx, [rbx + 0xa8]
mov rdx, rcx
test dil, dil
jns 0x14009acb3
mov rdx, qword [rcx]
mov qword [rsp + 0x70], rcx
lea rdi, [rax + rsi*2]
cmp rdx, rax
setb cl
cmp rdi, rdx
setbe r8b
or r8b, cl
je 0x14009ce82
test rsi, rsi
je 0x14009ace5
add rsi, rsi
mov rcx, rax
mov r8, rsi
call fcn.1401cdcb0
lea rax, [rdi + 0x18]
lea rcx, [0x14027893a]
cmp rdi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009ce85
movups xmm0, xmmword [0x14027893a]
movups xmmword [rdi], xmm0
movabs rax, 0x7400610064002e
mov qword [rdi + 0x10], rax
mov word [rdi + 0x18], 0
lea rcx, [rsp + 0xd0]
mov r8d, 0xc0
xor edx, edx
call fcn.1401ce350
cmp byte [rsp + 0x1a7], 0
js 0x14009ad69
lea r9, [rsp + 0x190]
jmp 0x14009ad71
xorps xmm0, xmm0
lea rax, [rsp + 0x190]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov byte [rax + 0x17], bl
jmp 0x14009ac9c
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009ad7d
mov rdx, qword [rbx]
lea r8, str.Name
lea rcx, [rsp + 0x250]
call fcn.14009d5b0
cmp byte [rsp + 0xe7], 0
jns 0x14009ada8
mov rcx, qword [rsp + 0xd0]
call fcn.14018fb90
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0xe0], rax
movups xmm0, xmmword [rsp + 0x250]
movaps xmmword [rsp + 0xd0], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009addc
lea r9, [rsp + 0x190]
jmp 0x14009ade4
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009adf0
mov rdx, qword [rbx]
lea rsi, [rsp + 0xe8]
lea r8, [0x14027895e]
lea rcx, [rsp + 0x250]
call fcn.14009d5b0
cmp byte [rsi + 0x17], 0
jns 0x14009ae1f
mov rcx, qword [rsp + 0xe8]
call fcn.14018fb90
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009ae4a
lea r9, [rsp + 0x190]
jmp 0x14009ae52
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009ae5e
mov rdx, qword [rbx]
lea rsi, [rsp + 0x100]
lea r8, [0x14027896e]
lea rcx, [rsp + 0x250]
call fcn.14009d5b0
cmp byte [rsi + 0x17], 0
jns 0x14009ae8d
mov rcx, qword [rsp + 0x100]
call fcn.14018fb90
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009aeb8
lea r9, [rsp + 0x190]
jmp 0x14009aec0
mov r9, qword [rsp + 0x190]
mov qword [rsp + 0x78], rsi
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009aed1
mov rdx, qword [rbx]
lea rsi, [rsp + 0x118]
lea r8, str.URL1
lea rcx, [rsp + 0x250]
call fcn.14009d5b0
cmp byte [rsi + 0x17], 0
jns 0x14009af00
mov rcx, qword [rsp + 0x118]
call fcn.14018fb90
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009af2b
lea r9, [rsp + 0x190]
jmp 0x14009af33
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009af3f
mov rdx, qword [rbx]
lea rsi, [rsp + 0x130]
lea r8, [0x140278980]
lea rcx, [rsp + 0x250]
call fcn.14009d5b0
cmp byte [rsi + 0x17], 0
jns 0x14009af6e
mov rcx, qword [rsp + 0x130]
call fcn.14018fb90
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009af99
lea r9, [rsp + 0x190]
jmp 0x14009afa1
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009afad
mov rdx, qword [rbx]
lea rsi, [rsp + 0x148]
lea r8, str.ServerFileName
lea rcx, [rsp + 0x250]
call fcn.14009d5b0
cmp byte [rsi + 0x17], 0
jns 0x14009afdc
mov rcx, qword [rsp + 0x148]
call fcn.14018fb90
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009b007
lea r9, [rsp + 0x190]
jmp 0x14009b00f
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009b01b
mov rdx, qword [rbx]
lea rdi, [rsp + 0x160]
lea r8, str.UpdatedApplications
lea rcx, [rsp + 0x250]
call fcn.14009d5b0
cmp byte [rdi + 0x17], 0
jns 0x14009b04a
mov rcx, qword [rsp + 0x160]
call fcn.14018fb90
mov rax, qword [rsp + 0x260]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rdi], xmm0
lea rsi, [rsp + 0xb0]
mov qword [rsi + 0x10], r12
movaps xmmword [rsi], xmm6
mov rcx, rsi
mov qword [rsp + 0x68], rdi
mov rdx, rdi
mov r8b, 0x3b
call fcn.14009d740
mov rbx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x88], rax
cmp rbx, rax
je 0x14009b09f
xorps xmm7, xmm7
jmp 0x14009bdc9
movsx rax, byte [rsp + 0xe7]
test rax, rax
mov rdi, qword [rsp + 0x38]
jns 0x14009b0ba
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x14009b834
movsx rax, byte [rsp + 0xff]
test rax, rax
jns 0x14009b0d9
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x14009b834
movsx rax, byte [rsp + 0x117]
test rax, rax
jns 0x14009b0f8
mov rax, qword [rsp + 0x108]
test rax, rax
je 0x14009b834
movsx rax, byte [rsp + 0x147]
test rax, rax
jns 0x14009b117
mov rax, qword [rsp + 0x138]
test rax, rax
je 0x14009b834
movsx rax, byte [rsp + 0x15f]
test rax, rax
jns 0x14009b136
mov rax, qword [rsp + 0x150]
test rax, rax
je 0x14009b834
movsx rax, byte [rsp + 0x177]
test rax, rax
jns 0x14009b155
mov rax, qword [rsp + 0x168]
test rax, rax
je 0x14009b834
lea r12, [rsp + 0x1b0]
mov rcx, r12
call fcn.14009dc80
mov rcx, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x180]
jmp 0x14009b189
cmp r8, rax
jb 0x14009b1a1
add rcx, 0x38
cmp rcx, rdx
je 0x14009b3dc
mov r8, qword [rcx + 0x18]
cmp byte [rcx + 0x20], 1
jne 0x14009b180
cmp r8, rax
ja 0x14009b185
mov r8, qword [rcx + 0x28]
cmp byte [rcx + 0x30], 1
je 0x14009b1b2
cmp r8, rax
jbe 0x14009b185
jmp 0x14009b1b7
cmp r8, rax
jb 0x14009b185
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
call fcn.1400a2620
mov rsi, rax
mov dword [rdi + 0xc0], 0
mov rax, qword [rdi + 0xe0]
mov rcx, qword [rdi + 0xe8]
mov rdx, rcx
sub rdx, rax
dec rcx
cmp rdx, rcx
ja 0x14009ce97
mov qword [rdi + 0xe8], rax
cmp byte [rsp + 0x117], 0
jns 0x14009b21e
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x78], rax
mov rcx, rsi
mov edx, 0x2712
mov r8, qword [rsp + 0x78]
call fcn.1400a25d0
mov rcx, rsi
mov edx, 0x40
xor r8d, r8d
call fcn.1400a25d0
mov rcx, rsi
mov edx, 0x51
xor r8d, r8d
call fcn.1400a25d0
lea r8, [0x14009de20]
mov rcx, rsi
mov edx, 0x4e2b
call fcn.1400a25d0
mov rcx, rsi
mov edx, 0x2711
mov r8, rdi
call fcn.1400a25d0
mov rcx, rsi
mov edx, Ordinal_14
mov r8d, 0xb4
call fcn.1400a25d0
mov rcx, rsi
call fcn.1400a2730
mov qword [rsp + 0x250], rsi
test rsi, rsi
je 0x14009b2a9
lea rcx, [rsp + 0x250]
call fcn.1400a9f00
mov rdx, qword [rdi + 0xe0]
mov r8, qword [rdi + 0xe8]
cmp rdx, r8
je 0x14009cb23
sub r8d, edx
lea rsi, [rsp + 0x1f0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm6
lea r15, [rsp + 0x250]
movaps xmmword [r15], xmm6
movaps xmmword [r15 + 0x40], xmm6
movaps xmmword [r15 + 0x50], xmm6
movups xmmword [r15 + 0x5c], xmm6
movaps xmmword [r15 + 0x30], xmm6
movaps xmmword [r15 + 0x20], xmm6
movaps xmmword [r15 + 0x10], xmm6
mov byte [r15], 0
mov qword [r15 + 0x44], 0
mov dword [r15 + 0x4c], 0x67452301
movabs rax, 0x98badcfeefcdab89
mov qword [r15 + 0x50], rax
mov dword [r15 + 0x58], 0x10325476
mov rcx, r15
call fcn.140094200
mov rcx, r15
call fcn.1400942c0
mov rcx, r15
mov rdx, rsi
call fcn.140094e00
mov bl, byte [rsi + 0x17]
test bl, bl
mov r8, qword [rsi + 8]
movzx eax, bl
mov rdx, rax
cmovs rdx, r8
movsx rcx, byte [rsp + 0x147]
mov r9, rcx
test rcx, rcx
jns 0x14009b377
mov r9, qword [rsp + 0x138]
cmp rdx, r9
lea rsi, [rsp + 0x148]
lea rdx, [rsp + 0x130]
jne 0x14009c714
test cl, cl
jns 0x14009b39c
mov rdx, qword [rsp + 0x130]
test bl, bl
js 0x14009c6ff
je 0x14009c2a3
xor ecx, ecx
mov r8b, byte [rsp + rcx + 0x1f0]
cmp r8b, byte [rdx + rcx]
jne 0x14009c714
inc rcx
cmp rax, rcx
jne 0x14009b3ac
jmp 0x14009c2a3
mov qword [rax + 0x40], Ordinal_26
mov rax, qword [rax + 0x38]
jmp 0x14009b477
lea r14, [rsp + 0x256]
mov byte [r14 + 0x11], 6
lea rax, str.status
lea r8, [rsp + 0x250]
cmp r8, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009ce8b
mov word [rsp + 0x254], 0x7375
mov dword [rsp + 0x250], 0x74617473
mov byte [rsp + 0x256], 0
lea rdi, [rsp + 0x1d0]
mov qword [rdi], r8
lea rbx, [rsp + 0x230]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140276a4b]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182f40
mov rax, qword [rsi]
cmp byte [rax + 0x4f], 0
js 0x14009b3cb
mov byte [rax + 0x4f], 0x13
add rax, 0x38
movups xmm0, xmmword [str.no_update_available]
movups xmmword [rax], xmm0
mov dword [rax + 0xf], 0x656c6261
mov byte [rax + 0x13], 0
cmp byte [rsp + 0x267], 0
lea r8, [rsp + 0x250]
jns 0x14009b4b3
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
lea r8, [rsp + 0x250]
mov byte [rsp + 0x267], 6
lea rax, str.ver_pv
cmp r8, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009ce8e
mov word [rsp + 0x254], 0x7670
mov dword [rsp + 0x250], 0x5f726576
mov byte [rsp + 0x256], 0
mov qword [rsp + 0x1d0], r8
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140276a4b]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182f40
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
cmp rcx, r12
je 0x14009b560
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x1c7]
js 0x14009cd93
test r8b, r8b
js 0x14009b81a
mov rax, qword [rsp + 0x1c0]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009b577
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
lea rax, [rsp + 0x25e]
mov byte [rax + 9], reloc.WLDAP32.dll_Ordinal_14
lea rcx, str.verToBeUpdated
lea r8, [rsp + 0x250]
cmp r8, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009ce91
movabs rax, 0x6465746164705565
mov qword [rsp + 0x256], rax
movabs rax, 0x5565426f54726576
mov qword [rsp + 0x250], rax
mov byte [rsp + 0x25e], 0
mov qword [rsp + 0x1d0], r8
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140276a4b]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182f40
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
lea rdx, [rsp + 0x160]
cmp rcx, rdx
je 0x14009b63e
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x177]
js 0x14009cd74
test r8b, r8b
js 0x14009b800
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009b655
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
mov rsi, qword [rsp + 0xb0]
test rsi, rsi
je 0x14009b696
mov rdi, qword [rsp + 0xb8]
cmp rdi, rsi
je 0x14009b68e
add rdi, 0xffffffffffffffe8
test rdi, rdi
je 0x14009ce79
cmp byte [rdi + 0x17], 0
js 0x14009b6b9
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
jne 0x14009b673
mov rcx, rsi
call fcn.14018fb90
mov rsi, qword [rsp + 0x178]
test rsi, rsi
je 0x14009b6fd
mov rdi, qword [rsp + 0x180]
mov rcx, rsi
cmp rdi, rsi
je 0x14009b6f0
add rdi, 0xffffffffffffffc8
jmp 0x14009b6d7
mov rcx, qword [rdi]
call fcn.14018fb90
jmp 0x14009b682
mov rcx, qword [rdi]
call fcn.14018fb90
lea rax, [rdi - 0x38]
cmp rdi, rsi
mov rdi, rax
je 0x14009b6e8
test rdi, rdi
je 0x14009ce5b
cmp byte [rdi + 0x17], 0
jns 0x14009b6cb
jmp 0x14009b6c3
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x180], rsi
call fcn.14018fb90
cmp byte [rsp + 0x177], 0
jns 0x14009b714
mov rcx, qword [rsp + 0x160]
call fcn.14018fb90
cmp byte [rsp + 0x15f], 0
jns 0x14009b72b
mov rcx, qword [rsp + 0x148]
call fcn.14018fb90
cmp byte [rsp + 0x147], 0
jns 0x14009b742
mov rcx, qword [rsp + 0x130]
call fcn.14018fb90
cmp byte [rsp + 0x12f], 0
jns 0x14009b759
mov rcx, qword [rsp + 0x118]
call fcn.14018fb90
cmp byte [rsp + 0x117], 0
jns 0x14009b770
mov rcx, qword [rsp + 0x100]
call fcn.14018fb90
cmp byte [rsp + 0xff], 0
jns 0x14009b787
mov rcx, qword [rsp + 0xe8]
call fcn.14018fb90
cmp byte [rsp + 0xe7], 0
jns 0x14009b79e
mov rcx, qword [rsp + 0xd0]
call fcn.14018fb90
cmp byte [rsp + 0x1a7], 0
jns 0x14009b7b5
mov rcx, qword [rsp + 0x190]
call fcn.14018fb90
cmp byte [rsp + 0x1c7], 0
jns 0x14009b7cc
mov rcx, qword [rsp + 0x1b0]
call fcn.14018fb90
mov rcx, qword [rsp + 0x2c8]
xor rcx, rsp
call fcn.140192360
movaps xmm6, xmmword [rsp + 0x2d0]
movaps xmm7, xmmword [rsp + 0x2e0]
add rsp, 0x2f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
call fcn.14011d710
jmp 0x14009b63e
mov rdx, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1b8]
call fcn.14011d710
jmp 0x14009b560
mov dword [rdi + 0xc0], 0x67
lea rcx, [rsp + 0x250]
mov edx, 0x67
call fcn.1401f37d0
lea rax, [rsp + 0x1f5]
mov byte [rax + 0x12], 5
lea rcx, str.error
lea r8, [rsp + 0x1f0]
cmp r8, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009ce94
mov dword [rsp + 0x1f0], 0x6f727265
mov word [rsp + 0x1f4], Ordinal_117
lea rax, [rsp + 0x230]
mov qword [rax], r8
lea rcx, [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140276a4b]
lea rsi, [rsp + 0x1d0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182f40
mov rax, qword [rsi]
lea rsi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009b8e2
mov rcx, qword [rsi]
call fcn.14018fb90
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
xor eax, eax
mov byte [rsp + 0x267], al
mov byte [rsp + 0x250], al
cmp byte [rsp + 0x207], al
jns 0x14009b655
mov rcx, qword [rsp + 0x1f0]
call fcn.14018fb90
jmp 0x14009b63e
mov edx, dword [rbx + 0xc0]
lea rcx, [rsp + 0xd0]
call fcn.1401f37d0
lea rax, [rsp + 0x255]
mov byte [rax + 0x12], 5
lea rcx, str.error
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009cea9
mov dword [rsp + 0x250], 0x6f727265
mov word [rsp + 0x254], Ordinal_117
lea rax, [rsp + 0x1d0]
mov qword [rax], rsi
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140276a4b]
lea rdi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
mov r8, rsi
call fcn.140182f40
mov rax, qword [rdi]
lea rsi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009b9c8
mov rcx, qword [rsi]
call fcn.14018fb90
mov rax, qword [rsp + 0xe0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rsi], xmm0
xor eax, eax
mov byte [rsp + 0xe7], al
mov byte [rsp + 0xd0], al
cmp byte [rsp + 0x267], al
jns 0x14009b7b5
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
cmp byte [rsp + 0xe7], 0
jns 0x14009b7b5
mov rcx, qword [rsp + 0xd0]
jmp 0x14009b7b0
mov rcx, r15
mov rdx, qword [rsp + 0x48]
mov r8, rbp
call fcn.14011f310
jmp 0x14009baf6
xor esi, esi
jmp 0x14009baba
mov r12, r14
mov rcx, qword [rsp + 0x178]
sub r15, rcx
sar r15, 3
movabs r8, 0x6db6db6db6db6db7
imul r15, r8
lea r14, [r15 + 1]
movabs rdx, 0x492492492492492
cmp r14, rdx
ja 0x14009ce67
sub rax, rcx
sar rax, 3
imul rax, r8
lea rcx, [rax + rax]
cmp rcx, r14
cmova r14, rcx
movabs rcx, 0x249249249249249
cmp rax, rcx
cmovae r14, rdx
test r14, r14
mov qword [rsp + 0x48], rsi
je 0x14009ba39
cmp r14, rdx
ja 0x14009ce73
imul rcx, r14, 0x38
call fcn.14018fb98
mov rsi, rax
imul r15, r15, 0x38
add r15, rsi
je 0x14009ce6a
test dil, dil
js 0x14009ba24
mov rax, qword [rsp + 0x48]
mov qword [r15], rax
mov qword [r15 + 8], rbp
mov eax, dword [rsp + 0x230]
mov ecx, dword [rsp + 0x233]
mov dword [r15 + 0x10], eax
mov dword [r15 + 0x13], ecx
mov byte [r15 + 0x17], dil
mov qword [r15 + 0x18], r13
mov rax, qword [rsp + 0x60]
mov byte [r15 + 0x20], al
mov eax, dword [rsp + 0x210]
mov ecx, dword [rsp + 0x213]
mov dword [r15 + 0x21], eax
mov dword [r15 + 0x24], ecx
mov qword [r15 + 0x28], r12
mov rax, qword [rsp + 0x58]
mov byte [r15 + 0x30], al
mov r12, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
mov rax, r12
sub rax, rbp
lea r13, [r15 + rax]
je 0x14009bc4d
mov rax, r12
mov rcx, r13
test rcx, rcx
je 0x14009ce55
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
movups xmm0, xmmword [rax + 0x18]
movups xmm1, xmmword [rax + 0x21]
movups xmmword [rcx + 0x21], xmm1
movups xmmword [rcx + 0x18], xmm0
add rax, 0x38
add rcx, 0x38
cmp rax, rbp
jne 0x14009bb4c
jmp 0x14009bba3
mov rcx, qword [r12]
call fcn.14018fb90
add r12, 0x38
cmp r12, rbp
je 0x14009bc45
test r12, r12
je 0x14009ce52
cmp byte [r12 + 0x17], 0
jns 0x14009bb96
jmp 0x14009bb8d
mov rcx, qword [r12]
call fcn.14018fb90
jmp 0x14009bc00
mov rcx, rsi
call fcn.14009dc80
mov r13, rax
lea rcx, [rsi + 0x18]
call fcn.14009dc80
jmp 0x14009bbdc
xor r13d, r13d
xor eax, eax
mov qword [rsp + 0x50], rax
test rsi, rsi
je 0x14009bc15
cmp r12, rsi
je 0x14009bc0d
add r12, 0xffffffffffffffe8
test r12, r12
je 0x14009ce61
cmp byte [r12 + 0x17], 0
js 0x14009bbb6
lea rax, [r12 - 0x18]
cmp r12, rsi
mov r12, rax
jne 0x14009bbef
mov rcx, rsi
call fcn.14018fb90
mov al, byte [rsp + 0x207]
movabs r12, 0xaaaaaaaaaaaaaaaa
mov rsi, qword [rsp + 0x48]
test al, al
jns 0x14009bcc5
mov rcx, qword [rsp + 0x1f0]
call fcn.14018fb90
jmp 0x14009bcc5
mov r12, qword [rsp + 0x178]
imul rax, r14, 0x38
add rsi, rax
add r15, 0x38
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x188], rsi
test r12, r12
je 0x14009bc7d
mov rcx, r12
call fcn.14018fb90
movabs r12, 0xaaaaaaaaaaaaaaaa
mov rsi, qword [rsp + 0x48]
jmp 0x14009bda2
mov rcx, r15
mov rdx, rsi
mov r8, rbp
call fcn.14011f310
jmp 0x14009bd6e
mov rcx, qword [r14]
call fcn.14018fb90
jmp 0x14009bce3
xor esi, esi
xor ebp, ebp
xor edi, edi
xor r13d, r13d
xor eax, eax
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
test r15, r15
je 0x14009bcf7
cmp r14, r15
je 0x14009bcef
add r14, 0xffffffffffffffe8
test r14, r14
je 0x14009ce58
cmp byte [r14 + 0x17], 0
js 0x14009bca4
lea rax, [r14 - 0x18]
cmp r14, r15
mov r14, rax
jne 0x14009bcd3
mov rcx, r15
call fcn.14018fb90
mov r14, qword [rsp + 0x50]
test dil, dil
movzx eax, dil
cmovs rax, rbp
test r13, r13
je 0x14009bdaa
test rax, rax
je 0x14009bdaa
test r14, r14
je 0x14009bdaa
mov r15, qword [rsp + 0x180]
mov rax, qword [rsp + 0x188]
cmp r15, rax
jae 0x14009ba3d
test r15, r15
je 0x14009ce64
test dil, dil
js 0x14009bc91
mov qword [r15], rsi
mov qword [r15 + 8], rbp
mov eax, dword [rsp + 0x230]
mov ecx, dword [rsp + 0x233]
mov dword [r15 + 0x10], eax
mov dword [r15 + 0x13], ecx
mov byte [r15 + 0x17], dil
mov qword [r15 + 0x18], r13
mov rax, qword [rsp + 0x60]
mov byte [r15 + 0x20], al
mov eax, dword [rsp + 0x210]
mov ecx, dword [rsp + 0x213]
mov dword [r15 + 0x21], eax
mov dword [r15 + 0x24], ecx
mov qword [r15 + 0x28], r14
mov rax, qword [rsp + 0x58]
mov byte [r15 + 0x30], al
add r15, 0x38
mov qword [rsp + 0x180], r15
test dil, dil
jns 0x14009bdb7
mov rcx, rsi
call fcn.14018fb90
add rbx, 0x18
cmp rbx, qword [rsp + 0x88]
je 0x14009b09f
mov eax, 0xaaaaaaaa
mov dword [rsp + 0x213], eax
mov dword [rsp + 0x210], eax
xor eax, eax
mov dword [rsp + 0x230], eax
mov dword [rsp + 0x233], eax
movsx rax, byte [rbx + 0x17]
test rax, rax
jns 0x14009bdfa
mov rax, qword [rbx + 8]
test rax, rax
je 0x14009be8a
mov qword [rsp + 0x260], r12
movaps xmmword [rsp + 0x250], xmm6
lea rcx, [rsp + 0x250]
mov rdx, rbx
mov r8b, Ordinal_41
call fcn.14009d740
mov r15, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x258]
mov rax, rsi
sub rax, r15
cmp rax, 0x30
je 0x14009beca
lea rcx, [rsp + 0x1f0]
mov rdx, rbx
mov r8b, 0x5b
call fcn.14009d740
test r15, r15
jne 0x14009c133
mov r15, qword [rsp + 0x1f0]
mov r14, qword [rsp + 0x1f8]
mov qword [rsp + 0x250], r15
mov qword [rsp + 0x258], r14
mov r13b, 1
mov rsi, r14
jmp 0x14009bed0
xor esi, esi
xor ebp, ebp
xor edi, edi
xor r13d, r13d
xor eax, eax
mov qword [rsp + 0x60], rax
xor r14d, r14d
xor eax, eax
mov qword [rsp + 0x58], rax
jmp 0x14009bcfc
mov rdx, qword [r15 + 0x18]
mov r8, qword [r15 + 0x20]
lea rcx, [rsp + 0x1f0]
call fcn.14011f310
jmp 0x14009bf14
cmp rdx, rcx
ja 0x14009bf40
jmp 0x14009ce5e
xor r13d, r13d
mov r14, rsi
sub rsi, r15
cmp rsi, 0x30
mov qword [rsp + 0x60], r13
jne 0x14009bcae
mov qword [rsp + 0x200], r12
movaps xmmword [rsp + 0x1f0], xmm6
cmp byte [r15 + 0x2f], 0
js 0x14009bea9
lea rax, [r15 + 0x18]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x200], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1f0], xmm0
movsx rax, byte [rsp + 0x207]
test rax, rax
mov rdx, qword [rsp + 0x1f8]
mov rcx, rax
cmovs rcx, rdx
dec rcx
test rax, rax
js 0x14009bec0
cmp rcx, rax
jae 0x14009ce5e
test al, al
mov r8, qword [rsp + 0x1f0]
lea r9, [rsp + 0x1f0]
cmovs r9, r8
movzx r9d, byte [r9 + rcx]
xor r10d, r10d
cmp r9d, 0x29
je 0x14009bf89
cmp r9d, 0x5d
je 0x14009bf86
xor ecx, ecx
mov qword [rsp + 0x58], rcx
xor esi, esi
xor ebp, ebp
xor edi, edi
xor r13d, r13d
xor ecx, ecx
mov qword [rsp + 0x50], rcx
jmp 0x14009bc2b
mov r10b, 1
test al, al
jns 0x14009c112
cmp rdx, rcx
jb 0x14009ce70
mov qword [rsp + 0x1f8], rcx
mov byte [r8 + rcx], 0
cmp r14, r15
je 0x14009ce6d
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x1e0], r12
movaps xmmword [rsp + 0x1d0], xmm6
cmp byte [r15 + 0x17], 0
js 0x14009c0f6
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x1e0], rax
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x1d0], xmm0
lea rsi, [rsp + 0x1d0]
movsx rdi, byte [rsp + 0x1e7]
test rdi, rdi
mov rax, qword [rsp + 0x1d0]
mov rbp, qword [rsp + 0x1d8]
cmovs rsi, rax
mov r12, rdi
cmovs r12, rbp
test r12, r12
je 0x14009c0ec
xor edi, edi
movsx ecx, byte [rsi + rdi]
call fcn.140190094
mov byte [rsi + rdi], al
inc rdi
cmp r12, rdi
jne 0x14009c022
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x1d8]
mov dil, byte [rsp + 0x1e7]
lea rcx, [rsp + 0x1e0]
mov eax, dword [rcx]
mov ecx, dword [rcx + 3]
mov dword [rsp + 0x233], ecx
mov dword [rsp + 0x230], eax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x1e0], rax
movaps xmmword [rsp + 0x1d0], xmm6
lea rcx, [rsp + 0x1d0]
lea rdx, [rsp + 0x1f0]
mov r8b, Ordinal_46
call fcn.14009d740
mov rsi, qword [rsp + 0x1d0]
mov r12, qword [rsp + 0x1d8]
mov rax, r12
sub rax, rsi
sar rax, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rax, rcx
cmp rax, 2
je 0x14009bbc1
cmp rax, 1
jne 0x14009bbd7
mov rcx, rsi
call fcn.14009dc80
mov r13, rax
jmp 0x14009bbdc
mov qword [rsp + 0x48], rax
jmp 0x14009c053
mov rdx, qword [r15]
mov r8, qword [r15 + 8]
lea rsi, [rsp + 0x1d0]
mov rcx, rsi
call fcn.14011f310
jmp 0x14009bff0
cmp rcx, rax
ja 0x14009ce70
mov eax, ecx
and al, 0x7f
mov byte [rsp + 0x207], al
lea r8, [rsp + 0x1f0]
jmp 0x14009bfa2
cmp rsi, r15
je 0x14009c157
add rsi, 0xffffffffffffffe8
test rsi, rsi
je 0x14009ce76
cmp byte [rsi + 0x17], 0
js 0x14009c164
lea rax, [rsi - 0x18]
cmp rsi, r15
mov rsi, rax
jne 0x14009c13c
mov rcx, r15
call fcn.14018fb90
jmp 0x14009be62
mov rcx, qword [rsi]
call fcn.14018fb90
jmp 0x14009c14b
mov eax, dword [rsp + 0x230]
dec eax
cmp eax, 1
ja 0x14009ab96
mov qword [rsp + 0xe0], r12
movaps xmmword [rsp + 0xd0], xmm6
mov ebx, dword [rsp + 0x1d0]
cmp rbx, 0x17
jae 0x14009cdb5
lea r14, [rsp + 0xd0]
mov byte [r14 + 0x17], bl
test rbx, rbx
je 0x14009c1bf
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.1401ce350
mov byte [r14 + rbx], 0
cmp byte [rsp + 0xe7], 0
js 0x14009c1d8
lea rax, [rsp + 0xd0]
jmp 0x14009c1e0
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x38]
cmp byte [rsp + 0x267], 0
js 0x14009c1f9
lea rdx, [rsp + 0x250]
jmp 0x14009c201
mov rdx, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x1f0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14009c243
cmp byte [rsp + 0xe7], 0
jns 0x14009ab96
mov rcx, qword [rsp + 0xd0]
call fcn.14018fb90
jmp 0x14009ab96
cmp byte [rsp + 0x1c7], 0
movzx r8d, byte [rsp + 0xe7]
js 0x14009ce06
test r8b, r8b
js 0x14009c284
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x1c0], rax
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x1b0], xmm0
jmp 0x14009ab96
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xd8]
lea rcx, [rsp + 0x1b0]
call fcn.14011d710
jmp 0x14009c223
lea rax, [rsp + 0x258]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rax + 8], rcx
movaps xmmword [rax - 8], xmm6
mov byte [rax + 0xf], 4
lea rcx, str..msi
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009ceaf
movabs rax, 0x690073006d002e
mov qword [rsp + 0x250], rax
mov word [rsp + 0x258], 0
movsx rcx, byte [rsp + 0x15f]
mov rax, rsi
test rcx, rcx
mov rdi, qword [rsp + 0x38]
jns 0x14009c31e
mov rax, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x150]
inc rcx
cmp rcx, 1
je 0x14009c366
lea r8, [rcx - 1]
cmp byte [rax + rcx - 2], 0x2e
mov rcx, r8
jne 0x14009c321
test r8, r8
je 0x14009c366
lea rax, [rsp + 0x230]
mov qword [rsp + 0x20], rax
mov rdx, rsi
lea rsi, [rsp + 0x1d0]
mov rcx, rsi
mov r9, 0xffffffffffffffff
call fcn.14011a3c0
mov al, byte [rsi + 0x17]
jmp 0x14009c376
xor eax, eax
mov byte [rsp + 0x1e7], al
mov byte [rsp + 0x1d0], al
test al, al
movzx r8d, al
lea rdx, [rsp + 0x1d0]
cmovs r8, qword [rdx + 8]
mov rcx, qword [rdx]
cmovs rdx, rcx
test r8, r8
js 0x14009ceb2
sete r9b
test rdx, rdx
setne r10b
or r10b, r9b
je 0x14009ceb5
cmp r8, 3
je 0x14009c3b7
xor esi, esi
jmp 0x14009c3d1
movzx r8d, word [rdx]
xor r8d, 0x7865
movzx edx, byte [rdx + 2]
xor edx, 0x65
or dx, r8w
sete sil
test al, al
jns 0x14009c3da
call fcn.14018fb90
test sil, sil
je 0x14009c43c
cmp byte [rsp + 0x267], 0
jns 0x14009c41e
mov qword [rsp + 0x258], 4
mov rax, qword [rsp + 0x250]
jmp 0x14009c429
xorps xmm0, xmm0
lea rax, [rsp + 0x210]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov byte [rax + 0x17], r14b
jmp 0x14009c4ff
mov byte [rsp + 0x267], 4
mov rax, r15
movabs rcx, 0x6500780065002e
mov qword [rax], rcx
mov word [rax + 8], 0
lea rsi, [rsp + 0x1d0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm6
lea r8, [rsp + 0x250]
mov rcx, rsi
mov rdx, rdi
call fcn.1401dc6c0
movsx rdi, byte [rdi + 0xbf]
mov rbx, rdi
test rdi, rdi
jns 0x14009c484
mov rax, qword [rsp + 0x38]
mov rbx, qword [rax + 0xb0]
lea r14, [rbx + 1]
cmp r14, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
ja 0x14009ceb8
cmp r14, 0xa
jbe 0x14009c3ff
movabs rbp, 0x8000000000000000
lea rax, [rbp - 4]
and rax, r14
add rax, 4
mov r13, r14
or r13, 3
cmp r13, 0xb
cmove r13, rax
inc r13
js 0x14009cec1
lea rcx, [r13*2]
call fcn.14018fb98
or rbp, r13
mov qword [rsp + 0x220], rbp
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r14
mov rdx, qword [rsp + 0x70]
test dil, dil
jns 0x14009c507
mov rdx, qword [rdx]
lea rdi, [rax + rbx*2]
cmp rdx, rax
setb cl
cmp rdi, rdx
setbe r8b
or r8b, cl
je 0x14009cebb
test rbx, rbx
je 0x14009c534
add rbx, rbx
mov rcx, rax
mov r8, rbx
call fcn.1401cdcb0
lea rax, [rdi + 2]
lea rcx, [0x140278900]
cmp rdi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009cebe
movsx r8, byte [rsp + 0x1e7]
test r8, r8
cmovs r8, qword [rsp + 0x1d8]
mov dword [rdi], 0x5c
cmovs rsi, qword [rsp + 0x1d0]
lea rbx, [rsp + 0x210]
mov rcx, rbx
mov rdx, rsi
call fcn.14016f420
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x240], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x230], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
cmp byte [rbx + 0x17], 0
jns 0x14009c5c2
mov rcx, qword [rsp + 0x210]
call fcn.14018fb90
cmp byte [rsp + 0x247], 0
mov rbx, qword [rsp + 0x38]
js 0x14009c5db
lea rcx, [rsp + 0x230]
jmp 0x14009c5e3
mov rcx, qword [rsp + 0x230]
lea rdx, [0x140275790]
call fcn.1401ae000
test rax, rax
setne dil
je 0x14009c69b
mov rsi, rax
mov rcx, qword [rbx + 0xe0]
mov r8, qword [rbx + 0xe8]
sub r8, rcx
mov edx, 1
mov r9, rax
call fcn.1401b1810
mov rcx, rsi
call fcn.1401afcb4
cmp byte [rsp + 0xa7], 0
movzx r8d, byte [rsp + 0x247]
js 0x14009ce2c
test r8b, r8b
js 0x14009c6be
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [rsp + 0x230]
movaps xmmword [rsp + 0x90], xmm0
cmp byte [rsp + 0x1e7], 0
jns 0x14009c678
mov rcx, qword [rsp + 0x1d0]
call fcn.14018fb90
cmp byte [rsp + 0x267], 0
jns 0x14009c68f
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
mov bl, byte [rsp + 0x207]
jmp 0x14009c725
mov dword [rbx + 0xc0], 0x6b
cmp byte [rsp + 0x247], 0
jns 0x14009c661
mov rcx, qword [rsp + 0x230]
call fcn.14018fb90
jmp 0x14009c661
mov rdx, qword [rsp + 0x230]
mov r8, qword [rsp + 0x238]
lea rcx, [rsp + 0x90]
call fcn.14000ae50
jmp 0x14009c6a5
test r8b, r8b
cmovs r8, qword [rsp + 0x1b8]
cmovs r12, qword [rsp + 0x1b0]
mov rdx, r12
call fcn.14011d800
jmp 0x14009c91d
mov rcx, qword [rsp + 0x1f0]
call fcn.1401cdb00
test eax, eax
je 0x14009c2a3
mov rax, qword [rsp + 0x38]
mov dword [rax + 0xc0], 0x6a
xor edi, edi
test bl, bl
jns 0x14009c736
mov rcx, qword [rsp + 0x1f0]
call fcn.14018fb90
test dil, dil
mov rax, qword [rsp + 0x38]
je 0x14009cb1b
cmp byte [rsp + 0xa7], 0
js 0x14009c783
lea r8, [rsp + 0x90]
jmp 0x14009c78b
mov rdx, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1b8]
call fcn.14011d710
jmp 0x14009c91d
mov qword [rax + 0x40], 0x10
mov rax, qword [rax + 0x38]
jmp 0x14009c848
mov r8, qword [rsp + 0x90]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.open
lea r9, [0x140278a00]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea r14, [rsp + 0x256]
mov byte [r14 + 0x11], 6
lea rax, str.status
cmp r15, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009ce9a
mov word [rsp + 0x254], 0x7375
mov dword [rsp + 0x250], 0x74617473
mov byte [rsp + 0x256], 0
lea rdi, [rsp + 0x1d0]
mov qword [rdi], r15
lea rbx, [rsp + 0x230]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140276a4b]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182f40
mov rax, qword [rsi]
cmp byte [rax + 0x4f], 0
js 0x14009c772
mov byte [rax + 0x4f], 0x10
add rax, 0x38
movups xmm0, xmmword [str.Update_initiated]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
cmp byte [rsp + 0x267], 0
jns 0x14009c86d
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
mov byte [rsp + 0x267], 6
lea rax, str.ver_pv
cmp r15, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009ce9d
mov word [rsp + 0x254], 0x7670
mov dword [rsp + 0x250], 0x5f726576
mov byte [rsp + 0x256], 0
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140276a4b]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182f40
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
cmp rcx, r12
je 0x14009c91d
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x1c7]
js 0x14009c6dd
test r8b, r8b
js 0x14009c758
mov rax, qword [rsp + 0x1c0]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009c934
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
lea rax, [rsp + 0x25e]
mov byte [rax + 9], reloc.WLDAP32.dll_Ordinal_14
lea rcx, str.verToBeUpdated
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009cea0
movabs rax, 0x6465746164705565
mov qword [rsp + 0x256], rax
movabs rax, 0x5565426f54726576
mov qword [rsp + 0x250], rax
mov byte [rsp + 0x25e], 0
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140276a4b]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182f40
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
lea rdx, [rsp + 0x160]
cmp rcx, rdx
je 0x14009c9f6
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x177]
js 0x14009cc36
test r8b, r8b
js 0x14009caea
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009ca0d
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
lea rax, [rsp + 0x261]
mov byte [rax + 6], 0x11
lea rcx, str.newVerToInstalled
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009cea3
movups xmm0, xmmword [str.newVerToInstalled]
movaps xmmword [rsp + 0x250], xmm0
mov word [rsp + 0x260], 0x64
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140276a4b]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182f40
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
lea rdx, [rsp + 0xe8]
cmp rcx, rdx
je 0x14009cab8
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0xff]
js 0x14009cc17
test r8b, r8b
js 0x14009cb04
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009cacf
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
cmp byte [rsp + 0xa7], 0
jns 0x14009b655
mov rcx, qword [rsp + 0x90]
jmp 0x14009b650
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
call fcn.14011d710
jmp 0x14009c9f6
mov rdx, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xf0]
call fcn.14011d710
jmp 0x14009cab8
mov edx, dword [rax + 0xc0]
jmp 0x14009cb32
mov dword [rdi + 0xc0], 0x69
mov edx, 0x69
lea rcx, [rsp + 0x250]
call fcn.1401f37d0
lea rax, [rsp + 0x1f5]
mov byte [rax + 0x12], 5
lea rcx, str.error
lea r8, [rsp + 0x1f0]
cmp r8, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009ceac
mov dword [rsp + 0x1f0], 0x6f727265
mov word [rsp + 0x1f4], Ordinal_117
lea rax, [rsp + 0x230]
mov qword [rax], r8
lea rcx, [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140276a4b]
lea rsi, [rsp + 0x1d0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182f40
mov rax, qword [rsi]
lea rsi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009cbd1
mov rcx, qword [rsi]
call fcn.14018fb90
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
xor eax, eax
mov byte [rsp + 0x267], al
mov byte [rsp + 0x250], al
cmp byte [rsp + 0x207], al
jns 0x14009cacf
mov rcx, qword [rsp + 0x1f0]
call fcn.14018fb90
jmp 0x14009cab8
test r8b, r8b
jns 0x14009cc2c
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xe8]
call fcn.14011d800
jmp 0x14009cab8
test r8b, r8b
jns 0x14009cc50
mov r8, qword [rsp + 0x168]
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
call fcn.14011d800
jmp 0x14009c9f6
mov dword [rbx + 0xc0], Ordinal_117
lea rcx, [rsp + 0xd0]
mov edx, 0x6c
call fcn.1401f37d0
lea rax, [rsp + 0x255]
mov byte [rax + 0x12], 5
lea rcx, str.error
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009cea6
mov dword [rsp + 0x250], 0x6f727265
mov word [rsp + 0x254], Ordinal_117
lea rax, [rsp + 0x1d0]
mov qword [rax], rsi
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140276a4b]
lea rbx, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
mov r8, rsi
call fcn.140182f40
mov rax, qword [rbx]
lea rdi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009cd08
mov rcx, qword [rdi]
call fcn.14018fb90
mov rax, qword [rsp + 0xe0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdi], xmm0
xor eax, eax
mov byte [rsp + 0xe7], al
mov byte [rsp + 0xd0], al
cmp byte [rsp + 0x267], al
js 0x14009cd42
mov rbx, qword [rsp + 0x38]
jmp 0x14009abda
mov rcx, qword [rsp + 0x250]
call fcn.14018fb90
cmp byte [rsp + 0xe7], 0
mov rbx, qword [rsp + 0x38]
jns 0x14009abda
mov rcx, qword [rsp + 0xd0]
call fcn.14018fb90
jmp 0x14009abda
test r8b, r8b
jns 0x14009cd89
mov r8, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x160]
call fcn.14011d800
jmp 0x14009b63e
test r8b, r8b
cmovs r8, qword [rsp + 0x1b8]
cmovs r12, qword [rsp + 0x1b0]
mov rdx, r12
call fcn.14011d800
jmp 0x14009b560
mov eax, ebx
and eax, 0xfffffff8
add rax, 8
mov r15, rbx
or r15, 7
cmp r15, 0x17
cmove r15, rax
lea rcx, [r15 + 1]
call fcn.14018fb98
mov r14, rax
mov qword [rsp + 0xd0], rax
movabs rax, 0x8000000000000000
add rax, r15
inc rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xd8], rbx
jmp 0x14009c1b2
test r8b, r8b
lea rdx, [rsp + 0xd0]
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
lea rcx, [rsp + 0x1b0]
call fcn.14011d800
jmp 0x14009c223
test r8b, r8b
lea rdx, [rsp + 0x230]
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
lea rcx, [rsp + 0x90]
call fcn.14000af50
jmp 0x14009c6a5
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3