Function at 0x1401d8e60
Capabilities:
Get common file path
Hash data using sha256
Persist via active setup registry key
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf780]
mov eax, 0xf880
call fcn.1402cec90
sub rsp, rax
mov qword [rbp + 0xab8], 0xfffffffffffffffe
mov qword [rsp + 0xf8b8], rbx
mov qword [rsp + 0xf8c0], rsi
mov qword [rsp + 0xf8c8], rdi
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0xf770], rax
mov r13, rcx
mov qword [rsp + 0x68], rcx
xor r14d, r14d
mov dword [rbp - 0x60], r14d
mov dword [rbp - 0x70], r14d
lea rbx, [0x14034d1a0]
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], r14
mov qword [rbp + 0x2d0], rbx
mov qword [rbp + 0x2d8], r14
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x868], rax
mov dword [rbp + 0x870], r14d
mov qword [rbp + 0x878], r14
lea rcx, str.SeTakeOwnershipPrivilege
call fcn.140100af0
lea rax, vtable.Core::Collection_class_Core::String_.0
mov qword [rbp + 0xd40], rax
mov edi, r14d
mov dword [rbp + 0xd48], r14d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xd50], xmm0
mov eax, dword [0x140431ac0]
lea r12, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401d8f67
or eax, 1
mov dword [0x140431ac0], eax
mov qword [0x140431ac8], r12
mov qword [0x140431ad0], 0xffffffff80000002
lea rcx, [0x1403050b0]
call fcn.1402be804
mov qword [rbp + 0x8a0], r14
lea rax, [rbp + 0x8a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x14035cc90]
mov rcx, qword [0x140431ad0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d91ae
lea ecx, [rax + 0x10]
call fcn.1402bcb4c
mov rsi, rax
test rax, rax
je 0x1401d91ae
mov rcx, qword [rbp + 0x8a0]
mov qword [rax], r12
mov qword [rax + 8], rcx
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0xd10], rax
mov dword [rbp + 0xd18], r14d
mov qword [rbp + 0xd20], r14
lea rdx, [rbp + 0xd10]
mov rcx, rsi
call fcn.1400ed120
mov r14, qword [rbp + 0xd20]
test al, al
je 0x1401d9044
mov eax, dword [rbp + 0xd18]
test eax, eax
jle 0x1401d9044
mov rbx, r14
mov edi, eax
nop word [rax + rax]
xor r8d, r8d
lea rdx, str.ControlSet0
mov rcx, rbx
call fcn.140205020
test al, al
je 0x1401d9035
mov rdx, rbx
lea rcx, [rbp + 0xd40]
call fcn.14011a6b0
add rbx, 0x10
dec rdi
jne 0x1401d9010
mov edi, dword [rbp + 0xd48]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
test r14, r14
je 0x1401d9078
lea r9, [fcn.140005eb0]
mov r8d, dword [r14 - 8]
mov edx, 0x10
mov rcx, r14
call fcn.1402bda84
lea rcx, [r14 - 8]
call fcn.1402bcebc
test edi, edi
je 0x1401d91a4
mov edx, edi
lea rcx, [rbp + 0x868]
call fcn.1400c7e30
xor eax, eax
mov r14d, eax
mov r12d, dword [rbp + 0x870]
cmp r12d, edi
mov rdi, qword [rbp + 0xd50]
jl 0x1401d927d
mov rbx, rdi
test rdi, rdi
je 0x1401d927d
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x758], rax
mov rsi, qword [rbp + 0x878]
xor r15d, r15d
lea r13, [0x14034d1a0]
nop word [rax + rax]
mov qword [rbp + 0x2f8], r15
mov edx, dword [rbx + 0x1c]
test edx, edx
jne 0x1401d90f7
mov qword [rbp + 0x2f0], r13
jmp 0x1401d9122
lea rcx, [rbp + 0x2f0]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x1c]
mov eax, dword [rbp + 0x2f8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x10]
mov rcx, qword [rbp + 0x2f0]
call fcn.1402c06dc
mov edx, dword [rbx + 0x1c]
lea rcx, [rbp + 0x2f0]
call fcn.140203bb0
nop
cmp r14d, r12d
jge 0x1401d9172
mov edx, dword [rbp + 0x2fc]
mov rcx, rsi
call fcn.1402028a0
movsxd r9, dword [rbp + 0x2fc]
mov eax, dword [rsi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x2f0]
mov rcx, qword [rsi]
call fcn.1402c06dc
mov edx, dword [rbp + 0x2fc]
mov rcx, rsi
call fcn.140203bb0
nop
cmp dword [rbp + 0x2f8], 0
jle 0x1401d9187
mov rcx, qword [rbp + 0x2f0]
call fcn.1402bd0e0
inc r14d
add rsi, 0x10
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1401d90e0
mov r13, qword [rsp + 0x68]
jmp 0x1401d927d
xor r14d, r14d
lea rbx, [0x14034d1a0]
mov qword [rbp + 0x3f0], 0
mov edx, 0x11
lea rcx, [rbp + 0x3e8]
call fcn.1402028a0
mov eax, dword [rbp + 0x3f0]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.CurrentControlSet
mov rcx, qword [rbp + 0x3e8]
call fcn.1402c06dc
mov edx, 0x11
lea rcx, [rbp + 0x3e8]
call fcn.140203bb0
nop
mov ecx, 0x20
call fcn.1402bcb4c
mov rdi, rax
test rax, rax
je 0x1401d9220
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0
jmp 0x1401d9223
mov rdi, r14
mov edx, dword [rbp + 0x3f4]
lea rcx, [rdi + 0x10]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x3f4]
mov eax, dword [rdi + 0x18]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x3e8]
mov rcx, qword [rdi + 0x10]
call fcn.1402c06dc
mov edx, dword [rbp + 0x3f4]
lea rcx, [rdi + 0x10]
call fcn.140203bb0
mov qword [rdi], r14
mov qword [rdi + 8], r14
cmp dword [rbp + 0x3f0], 0
jle 0x1401d927d
mov rcx, qword [rbp + 0x3e8]
call fcn.1402bd0e0
nop
test rdi, rdi
je 0x1401d92a4
mov rbx, qword [rdi]
cmp dword [rdi + 0x18], 0
jle 0x1401d9294
mov rcx, qword [rdi + 0x10]
call fcn.1402bd0e0
mov rcx, rdi
call fcn.14021ae20
mov rdi, rbx
test rbx, rbx
jne 0x1401d9282
mov rcx, r13
call fcn.1401d6740
mov rcx, r13
call fcn.1401d5e40
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov qword [rbp + 0x210], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersion
mov qword [rbp + 0x218], rax
xor ebx, ebx
mov r14d, ebx
mov dword [rbp - 0x78], ebx
lea r12, [rbp + 0x210]
nop
mov rsi, qword [r12]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9380
lea edx, [rax + 5]
lea rcx, [rbp + 0x2d0]
call fcn.1402028a0
mov eax, dword [rbp + 0x2d8]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x2d0]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x2d0]
call fcn.140203bb0
mov rdx, rsi
lea rcx, [rbp + 0x2d0]
call fcn.140200ef0
xor r9d, r9d
lea r8, [rbp + 0x2d0]
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.1401d7210
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x328], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x328]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x328], 0
jbe 0x1401d9582
xor r15d, r15d
lea r14, [0x14034d1a0]
nop dword [rax]
nop word [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x2b70]
mov edx, edi
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401d9569
lea rax, [rbp + 0x2b70]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d9421
mov qword [rbp + 0x530], r15
test ebx, ebx
jne 0x1401d943f
mov qword [rbp + 0x528], r14
jmp 0x1401d946e
mov edx, ebx
lea rcx, [rbp + 0x528]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x530]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2b70]
mov rcx, qword [rbp + 0x528]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x528]
call fcn.140203bb0
nop
lea r8, [0x14034c088]
mov edx, 0x400
lea rcx, [rbp + 0x2b70]
call fcn.1402bf098
mov r8, rsi
mov edx, 0x400
lea rcx, [rbp + 0x2b70]
call fcn.1402bf098
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x2b70]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9552
lea edx, [rax + 4]
lea rcx, [rbp + 0x2d0]
call fcn.1402028a0
mov eax, dword [rbp + 0x2d8]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, str.HKU_
mov rcx, qword [rbp + 0x2d0]
call fcn.1402c06dc
mov edx, 4
lea rcx, [rbp + 0x2d0]
call fcn.140203bb0
lea rdx, [rbp + 0x2b70]
lea rcx, [rbp + 0x2d0]
call fcn.140200ef0
mov r9, qword [rbp + 0x528]
lea r8, [rbp + 0x2d0]
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.1401d7210
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x530], 0
jle 0x1401d9570
mov rcx, qword [rbp + 0x528]
call fcn.1402bd0e0
jmp 0x1401d9570
cmp eax, 0x103
je 0x1401d957c
cmp edi, dword [rbp + 0x328]
jb 0x1401d93f0
mov r14d, dword [rbp - 0x78]
xor ebx, ebx
inc r14d
mov dword [rbp - 0x78], r14d
add r12, 8
movsxd rax, r14d
cmp rax, 2
jb 0x1401d92e0
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0x210], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0x218], rax
mov eax, ebx
mov dword [rbp - 0x58], ebx
lea r15, [rbp + 0x210]
mov qword [rbp], r15
mov rcx, qword [rsp + 0x68]
nop dword [rax + rax]
mov r14, qword [r15]
mov r13d, ebx
mov rdi, rbx
mov qword [rsp + 0x70], rbx
cmp dword [rcx + 0x18], 0
jl 0x1401d99e5
mov r15, qword [rsp + 0x68]
lea r12, [0x14034d1a0]
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0xf0], 0
mov rsi, rbx
test r13d, r13d
setne sil
add rsi, 0xffffffff80000002
test rdi, rdi
jne 0x1401d9681
test r14, r14
je 0x1401d971a
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x1401d9630
test ebx, ebx
jle 0x1401d971a
mov edx, ebx
lea rcx, [rbp + 0xe8]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0xf0]
inc eax
movsxd rdx, eax
mov r8, r14
mov rcx, qword [rbp + 0xe8]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0xe8]
call fcn.140203bb0
jmp 0x1401d971a
mov rcx, rdi
shl rcx, 4
mov rbx, qword [r15 + 0x20]
add rbx, rcx
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xe8]
call fcn.1402028a0
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0xf0]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0xe8]
call fcn.1402c06dc
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xe8]
call fcn.140203bb0
mov edx, dword [rbp + 0xf4]
inc edx
lea rcx, [rbp + 0xe8]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0xf4]
mov rax, qword [rbp + 0xe8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0xf4]
inc edx
lea rcx, [rbp + 0xe8]
call fcn.140203bb0
mov rdx, r14
lea rcx, [rbp + 0xe8]
call fcn.140200ef0
lea rax, [rbp + 0x8b8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xe8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d99aa
mov dword [rbp + 0x3f8], 0x800
lea rax, [rbp + 0x3f8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x8770]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140352570]
mov rcx, qword [rbp + 0x8b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d999c
cmp dword [rbp + 0x3f8], eax
jbe 0x1401d999c
lea rax, [rbp + 0x8770]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d97a2
xor eax, eax
mov qword [rbp + 0x4d0], rax
test ebx, ebx
jne 0x1401d97c2
mov qword [rbp + 0x4c8], r12
jmp 0x1401d97f1
mov edx, ebx
lea rcx, [rbp + 0x4c8]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x4d0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x8770]
mov rcx, qword [rbp + 0x4c8]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x4c8]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x4c8]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x4c8]
mov rcx, qword [r15 + 8]
call fcn.1400fa8d0
mov r12, rax
test rax, rax
je 0x1401d9980
lea rdi, [0x14034c0a0]
cmp rsi, 0xffffffff80000002
lea rax, [0x14034c0a8]
cmove rdi, rax
test rdi, rdi
jne 0x1401d9853
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x28], rax
jmp 0x1401d9874
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401d9860
xor eax, eax
mov qword [rbp - 0x28], rax
test ebx, ebx
jne 0x1401d9881
lea rax, [0x14034d1a0]
mov qword [rbp - 0x30], rax
jmp 0x1401d98a3
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rbp - 0x30]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140203bb0
nop
mov edx, dword [rbp - 0x24]
inc edx
lea rcx, [rbp - 0x30]
call fcn.1402028a0
movsxd rcx, dword [rbp - 0x24]
mov rax, qword [rbp - 0x30]
mov edi, 0x5c
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x24]
inc edx
lea rcx, [rbp - 0x30]
call fcn.140203bb0
mov ebx, dword [rbp - 0x24]
add ebx, dword [rbp + 0xf4]
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1402028a0
movsxd r9, dword [rbp + 0xf4]
mov ecx, dword [rbp - 0x28]
movsxd rax, dword [rbp - 0x24]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x30]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0xe8]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140203bb0
mov edx, dword [rbp - 0x24]
inc edx
lea rcx, [rbp - 0x30]
call fcn.1402028a0
movsxd rcx, dword [rbp - 0x24]
mov rax, qword [rbp - 0x30]
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x24]
inc edx
lea rcx, [rbp - 0x30]
call fcn.140203bb0
lea rdx, [0x140352570]
lea rcx, [rbp - 0x30]
call fcn.140200ef0
lea rdx, [rbp - 0x30]
mov rcx, r12
call fcn.1400edab0
nop
cmp dword [rbp - 0x28], 0
jle 0x1401d997b
mov rcx, qword [rbp - 0x30]
call fcn.1402bd0e0
mov rdi, qword [rsp + 0x70]
cmp dword [rbp + 0x4d0], 0
jle 0x1401d9995
mov rcx, qword [rbp + 0x4c8]
call fcn.1402bd0e0
lea r12, [0x14034d1a0]
mov rcx, qword [rbp + 0x8b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0xf0], 0
jle 0x1401d99bf
mov rcx, qword [rbp + 0xe8]
call fcn.1402bd0e0
inc r13d
inc rdi
mov qword [rsp + 0x70], rdi
cmp r13d, dword [r15 + 0x18]
mov ebx, 0
jle 0x1401d95f4
mov r15, qword [rbp]
mov eax, dword [rbp - 0x58]
mov rcx, qword [rsp + 0x68]
inc eax
mov dword [rbp - 0x58], eax
add r15, 8
mov qword [rbp], r15
cdqe
cmp rax, 2
mov eax, dword [rbp - 0x58]
jb 0x1401d95d0
lea r13, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0x210], r13
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0x218], rax
mov r14d, ebx
mov dword [rbp - 0x78], ebx
lea r12, [rbp + 0x210]
mov r15d, dword [rbp - 0x60]
lea r13, [0x14034d1a0]
nop word [rax + rax]
lea r9, str.Notify
lea r8, [0x14034c088]
mov rdx, qword [r12]
lea rcx, [rbp + 0x828]
call fcn.140202360
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x828]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9d70
mov dword [rbp + 0x2e0], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x2e0], 0
jbe 0x1401d9d64
mov r15, qword [rsp + 0x68]
xor r14d, r14d
nop dword [rax]
mov r9d, 0x400
lea r8, [rbp + 0x9770]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401d9d47
lea rax, [rbp + 0x898]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x9770]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9d4e
mov dword [rbp + 0x734], 0x800
lea rax, [rbp + 0x734]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xcf70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DLLName
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d9d38
lea rax, [rbp + 0xcf70]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d9b92
mov qword [rbp + 0x490], r14
test ebx, ebx
jne 0x1401d9bb0
mov qword [rbp + 0x488], r13
jmp 0x1401d9bdf
mov edx, ebx
lea rcx, [rbp + 0x488]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x490]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xcf70]
mov rcx, qword [rbp + 0x488]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x488]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x488]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x488]
mov rcx, qword [r15 + 8]
call fcn.1400fa8d0
mov rsi, rax
test rax, rax
je 0x1401d9d23
mov qword [rbp + 0x1c8], r14
mov edx, 5
lea rcx, [rbp + 0x1c0]
call fcn.1402028a0
mov ecx, dword [rbp + 0x1c8]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x1c0]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x1c0]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x834]
add ebx, dword [rbp + 0x1cc]
mov edx, ebx
lea rcx, [rbp + 0x1c0]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x834]
mov ecx, dword [rbp + 0x1c8]
movsxd rax, dword [rbp + 0x1cc]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1c0]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x828]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x1c0]
call fcn.140203bb0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x1c0]
call fcn.140200ef0
lea rdx, [rbp + 0x9770]
lea rcx, [rbp + 0x1c0]
call fcn.140200ef0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x1c0]
call fcn.140200ef0
lea rdx, [rbp + 0x1c0]
mov rcx, rsi
call fcn.1400edab0
nop
cmp dword [rbp + 0x1c8], 0
jle 0x1401d9d23
mov rcx, qword [rbp + 0x1c0]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x490], 0
jle 0x1401d9d38
mov rcx, qword [rbp + 0x488]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401d9d4e
cmp eax, 0x103
je 0x1401d9d5a
cmp edi, dword [rbp + 0x2e0]
jb 0x1401d9af0
mov r15d, dword [rbp - 0x60]
mov r14d, dword [rbp - 0x78]
xor ebx, ebx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x830], 0
jle 0x1401d9d85
mov rcx, qword [rbp + 0x828]
call fcn.1402bd0e0
inc r14d
mov dword [rbp - 0x78], r14d
add r12, 8
movsxd rax, r14d
cmp rax, 2
jb 0x1401d9a40
mov qword [rbp + 0x558], rbx
mov qword [rbp + 0x560], rbx
call fcn.14012d940
mov qword [rbp + 0x558], rax
lea r13, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0x78], r13
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0x80], rax
mov ecx, ebx
mov dword [rsp + 0x70], ebx
mov rax, rbx
mov qword [rbp], rbx
mov r14, qword [rsp + 0x68]
mov r12, qword [rbp + rax*8 + 0x78]
mov qword [rbp + 0x758], r12
mov esi, ebx
mov dword [rbp - 0x78], ebx
mov r13, rbx
mov qword [rbp - 0x68], rbx
cmp dword [r14 + 0x18], 0
jl 0x1401da884
nop word [rax + rax]
lea rax, [0x14034d1a0]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], 0
test r13, r13
jne 0x1401d9ea1
mov rdi, 0xffffffff80000002
mov qword [rbp + 0xd0], rdi
test r12, r12
je 0x1401d9f4a
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [r12 + rbx*2], 0
jne 0x1401d9e50
test ebx, ebx
jle 0x1401d9f48
mov edx, ebx
lea rcx, [rbp + 0xb8]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0xc0]
inc eax
movsxd rdx, eax
mov r8, r12
mov rcx, qword [rbp + 0xb8]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0xb8]
call fcn.140203bb0
jmp 0x1401d9f48
mov rdi, 0xffffffff80000003
mov qword [rbp + 0xd0], rdi
mov rcx, r13
shl rcx, 4
mov rbx, qword [r14 + 0x20]
add rbx, rcx
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xb8]
call fcn.1402028a0
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0xc0]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0xb8]
call fcn.1402c06dc
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xb8]
call fcn.140203bb0
mov edx, dword [rbp + 0xc4]
inc edx
lea rcx, [rbp + 0xb8]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0xc4]
mov rax, qword [rbp + 0xb8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0xc4]
inc edx
lea rcx, [rbp + 0xb8]
call fcn.140203bb0
mov rdx, r12
lea rcx, [rbp + 0xb8]
call fcn.140200ef0
xor ebx, ebx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xb8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401da851
mov r12d, ebx
mov dword [rbp - 0x58], ebx
lea rsi, str.hn6_
mov qword [rbp + 0x168], rsi
nop dword [rax]
mov dword [rbp + 0x72c], 0x800
lea rax, [rbp + 0x72c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc770]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401da814
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xd10], xmm0
mov qword [rbp + 0xd20], rbx
lea rax, [rbp + 0xc770]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d9ff0
xor eax, eax
mov qword [rbp + 0x5f8], rax
test ebx, ebx
jne 0x1401da017
lea rax, [0x14034d1a0]
mov qword [rbp + 0x5f0], rax
jmp 0x1401da046
mov edx, ebx
lea rcx, [rbp + 0x5f0]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x5f8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xc770]
mov rcx, qword [rbp + 0x5f0]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x5f0]
call fcn.140203bb0
nop
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x5f0]
call fcn.1401d3f60
mov ebx, eax
cmp dword [rbp + 0x5f8], 0
jle 0x1401da07f
mov rcx, qword [rbp + 0x5f0]
call fcn.1402bd0e0
mov rdi, qword [rbp + 0xd18]
test ebx, ebx
je 0x1401da7cb
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xd40], xmm0
xor ecx, ecx
mov r14d, ecx
mov qword [rbp + 0xd50], rcx
mov r12, rdi
mov rax, qword [rbp + 0xd10]
sub r12, rax
sar r12, 4
mov rdi, qword [rbp + 0xd48]
mov r13, qword [rbp + 0xd40]
test r12, r12
je 0x1401da2d4
lea rsi, [rax + 0xc]
xor r15d, r15d
nop dword [rax]
nop dword [rax + rax]
mov qword [rbp + 0x1d8], r15
mov edx, dword [rsi]
test edx, edx
jne 0x1401da0fd
lea rbx, [0x14034d1a0]
mov qword [rbp + 0x1d0], rbx
jmp 0x1401da12e
lea rcx, [rbp + 0x1d0]
call fcn.1402028a0
movsxd r9, dword [rsi]
mov eax, dword [rbp + 0x1d8]
inc eax
movsxd rdx, eax
mov r8, qword [rsi - 0xc]
mov rcx, qword [rbp + 0x1d0]
call fcn.1402c06dc
lea rbx, [0x14034d1a0]
mov edx, dword [rsi]
lea rcx, [rbp + 0x1d0]
call fcn.140203bb0
nop
mov r8d, 1
lea rdx, [0x140352e14]
lea rcx, [rbp + 0x1d0]
call fcn.140205020
test al, al
jne 0x1401da2a7
lea rdx, [rbp + 0x1d0]
call fcn.1401d86e0
lea rax, [rbp + 0x1d0]
cmp rax, rdi
jae 0x1401da21b
lea rax, [rbp + 0x1d0]
cmp r13, rax
ja 0x1401da21b
lea rbx, [rbp + 0x1d0]
sub rbx, r13
cmp rdi, r14
jne 0x1401da1ba
lea rcx, [rbp + 0xd40]
call fcn.1400c8e70
mov r14, qword [rbp + 0xd50]
mov rdi, qword [rbp + 0xd48]
mov r13, qword [rbp + 0xd40]
and rbx, 0xfffffffffffffff0
add rbx, r13
mov qword [rbp + 0x710], rdi
mov qword [rbp + 0x210], rdi
test rdi, rdi
je 0x1401da216
mov qword [rdi + 8], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401da1eb
lea rax, [0x14034d1a0]
mov qword [rdi], rax
jmp 0x1401da20a
mov rcx, rdi
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rdi]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
mov rcx, rdi
call fcn.140203bb0
nop
jmp 0x1401da29c
cmp rdi, r14
jne 0x1401da241
lea rcx, [rbp + 0xd40]
call fcn.1400c8e70
mov r14, qword [rbp + 0xd50]
mov rdi, qword [rbp + 0xd48]
mov r13, qword [rbp + 0xd40]
mov qword [rbp + 0x210], rdi
mov qword [rbp + 0x710], rdi
test rdi, rdi
je 0x1401da29c
mov qword [rdi + 8], r15
mov edx, dword [rbp + 0x1dc]
test edx, edx
jne 0x1401da267
mov qword [rdi], rbx
jmp 0x1401da28d
mov rcx, rdi
call fcn.1402028a0
movsxd r9, dword [rbp + 0x1dc]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x1d0]
mov rcx, qword [rdi]
call fcn.1402c06dc
mov edx, dword [rbp + 0x1dc]
mov rcx, rdi
call fcn.140203bb0
nop
add rdi, 0x10
mov qword [rbp + 0xd48], rdi
cmp dword [rbp + 0x1d8], 0
jle 0x1401da2bc
mov rcx, qword [rbp + 0x1d0]
call fcn.1402bd0e0
add rsi, 0x10
dec r12
jne 0x1401da0e0
mov r15d, dword [rbp - 0x60]
mov rsi, qword [rbp + 0x168]
mov rax, rdi
sub rax, r13
sar rax, 4
test rax, rax
je 0x1401da773
lea r12, [r13 + 0xc]
mov rbx, rax
mov qword [rbp - 0x60], rax
mov r13, rax
mov rdi, qword [rbp + 0xd0]
nop dword [rax]
mov qword [rbp + 0x3b8], 0
mov edx, dword [r12]
test edx, edx
jne 0x1401da323
lea rax, [0x14034d1a0]
mov qword [rbp + 0x3b0], rax
jmp 0x1401da34f
lea rcx, [rbp + 0x3b0]
call fcn.1402028a0
movsxd r9, dword [r12]
mov eax, dword [rbp + 0x3b8]
inc eax
movsxd rdx, eax
mov r8, qword [r12 - 0xc]
mov rcx, qword [rbp + 0x3b0]
call fcn.1402c06dc
mov edx, dword [r12]
lea rcx, [rbp + 0x3b0]
call fcn.140203bb0
nop
mov r8b, 1
lea rdx, [rbp + 0x3b0]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call fcn.1400fa8d0
mov r14, rax
test rax, rax
je 0x1401da72f
lea rsi, [0x14034c0a0]
cmp rdi, 0xffffffff80000002
lea rax, [0x14034c0a8]
cmove rsi, rax
test rsi, rsi
jne 0x1401da3ac
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x38], rax
jmp 0x1401da3c4
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1401da3b0
xor eax, eax
mov qword [rbp - 0x38], rax
test ebx, ebx
jne 0x1401da3d1
lea rax, [0x14034d1a0]
mov qword [rbp - 0x40], rax
jmp 0x1401da3f3
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp - 0x38]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp - 0x40]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.140203bb0
nop
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1402028a0
movsxd rcx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x40]
mov esi, 0x5c
mov word [rax + rcx*2], si
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.140203bb0
mov ebx, dword [rbp - 0x34]
add ebx, dword [rbp + 0xc4]
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1402028a0
movsxd r9, dword [rbp + 0xc4]
mov ecx, dword [rbp - 0x38]
movsxd rax, dword [rbp - 0x34]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x40]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0xb8]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.140203bb0
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1402028a0
movsxd rcx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x40]
mov word [rax + rcx*2], si
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.140203bb0
mov rsi, qword [rbp + 0x168]
mov rdx, qword [rsi]
lea rcx, [rbp - 0x40]
call fcn.140200ef0
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0xa18]
call fcn.1400d5970
nop
xor r8d, r8d
lea rdx, str.cmd.exe
mov rcx, rax
call fcn.140202b80
movzx ebx, al
cmp dword [rbp + 0xa20], 0
jle 0x1401da4f0
mov rcx, qword [rbp + 0xa18]
call fcn.1402bd0e0
test bl, bl
je 0x1401da6b3
cmp rdi, 0xffffffff80000002
jne 0x1401da55b
xor eax, eax
mov qword [rbp + 0x648], rax
lea edx, [rax + 4]
lea rcx, [rbp + 0x640]
call fcn.1402028a0
mov eax, dword [rbp + 0x648]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, [0x14034c0a8]
mov rcx, qword [rbp + 0x640]
call fcn.1402c06dc
mov edx, 4
lea rcx, [rbp + 0x640]
call fcn.140203bb0
lea rbx, [rbp + 0x640]
or r15d, 1
jmp 0x1401da58a
mov eax, dword [rbp - 0x78]
dec eax
movsxd r8, eax
shl r8, 4
mov rax, qword [rsp + 0x68]
add r8, qword [rax + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0xa88]
call fcn.140201410
mov rbx, rax
or r15d, 2
mov dword [rbp - 0x70], r15d
xor eax, eax
mov qword [rbp + 0x580], rax
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401da5ae
lea rax, [0x14034d1a0]
mov qword [rbp + 0x578], rax
jmp 0x1401da5d8
lea rcx, [rbp + 0x578]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x580]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x578]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x578]
call fcn.140203bb0
nop
test r15b, 2
je 0x1401da60c
and r15d, 0xfffffffd
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0xa90], 0
jle 0x1401da60c
mov rcx, qword [rbp + 0xa88]
call fcn.1402bd0e0
nop
test r15b, 1
je 0x1401da62f
and r15d, 0xfffffffe
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0x648], 0
jle 0x1401da62f
mov rcx, qword [rbp + 0x640]
call fcn.1402bd0e0
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x578]
lea rcx, [rbp + 0xa98]
call fcn.1401d0f30
nop
mov rdx, rax
lea rcx, [rbp + 0x558]
call fcn.14015bfc0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xdf0]
lea rcx, [rbp + 0x558]
call fcn.1401d1090
nop
cmp dword [rbp + 0xab0], 0
jle 0x1401da688
mov rcx, qword [rbp + 0xaa8]
call fcn.1402bd0e0
cmp dword [rbp + 0xaa0], 0
jle 0x1401da69e
mov rcx, qword [rbp + 0xa98]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x580], 0
jle 0x1401da6b3
mov rcx, qword [rbp + 0x578]
call fcn.1402bd0e0
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.1400edab0
cmp r13, 2
jb 0x1401da71c
lea rdx, str.shell
mov rcx, qword [rsi]
call fcn.1402bcf6c
test eax, eax
jne 0x1401da6e1
lea rdx, [0x140351f90]
jmp 0x1401da6fb
lea rdx, str.userinit
mov rcx, qword [rsi]
call fcn.1402bcf6c
test eax, eax
jne 0x1401da71c
lea rdx, str.userinit.exe
xor r8d, r8d
lea rcx, [rbp + 0x3b0]
call fcn.140202750
test al, al
jne 0x1401da71c
movabs rax, 0x1000000000000
or qword [r14 + 0x40], rax
cmp dword [rbp - 0x38], 0
jle 0x1401da72b
mov rcx, qword [rbp - 0x40]
call fcn.1402bd0e0
mov rbx, qword [rbp - 0x60]
cmp dword [rbp + 0x3b8], 0
jle 0x1401da744
mov rcx, qword [rbp + 0x3b0]
call fcn.1402bd0e0
add r12, 0x10
dec rbx
mov qword [rbp - 0x60], rbx
jne 0x1401da300
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov rdi, qword [rbp + 0xd48]
mov r13, qword [rbp + 0xd40]
test r13, r13
je 0x1401da7c0
mov rbx, r13
cmp r13, rdi
je 0x1401da797
cmp dword [rbx + 8], 0
jle 0x1401da78e
mov rcx, qword [rbx]
call fcn.1402bd0e0
add rbx, 0x10
cmp rbx, rdi
jne 0x1401da780
mov rcx, r13
call fcn.14021ae20
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xd40], xmm0
xor ebx, ebx
mov qword [rbp + 0xd50], rbx
mov rdi, qword [rbp + 0xd18]
mov r12d, dword [rbp - 0x58]
jmp 0x1401da7cd
mov rdi, qword [rbp + 0xd18]
mov r12d, dword [rbp - 0x58]
xor ebx, ebx
mov r14, qword [rbp + 0xd10]
test r14, r14
je 0x1401da814
mov rbx, r14
cmp r14, rdi
je 0x1401da7f8
cmp dword [rbx + 8], 0
jle 0x1401da7ef
mov rcx, qword [rbx]
call fcn.1402bd0e0
add rbx, 0x10
cmp rbx, rdi
jne 0x1401da7e1
mov rcx, r14
call fcn.14021ae20
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xd10], xmm0
xor ebx, ebx
mov qword [rbp + 0xd20], rbx
inc r12d
mov dword [rbp - 0x58], r12d
add rsi, 8
mov qword [rbp + 0x168], rsi
movsxd rax, r12d
cmp rax, 4
jb 0x1401d9f90
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [rbp - 0x78]
mov r14, qword [rsp + 0x68]
mov r12, qword [rbp + 0x758]
mov r13, qword [rbp - 0x68]
cmp dword [rbp + 0xc0], 0
jle 0x1401da866
mov rcx, qword [rbp + 0xb8]
call fcn.1402bd0e0
inc esi
mov dword [rbp - 0x78], esi
inc r13
mov qword [rbp - 0x68], r13
cmp esi, dword [r14 + 0x18]
jle 0x1401d9e10
mov rax, qword [rbp]
mov ecx, dword [rsp + 0x70]
inc ecx
mov dword [rsp + 0x70], ecx
inc rax
mov qword [rbp], rax
movsxd rax, ecx
cmp rax, 2
mov rax, qword [rbp]
jb 0x1401d9de2
lea rax, str.SOFTWAREMicrosoftCommand_Processor
mov qword [rbp + 0x78], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftCommand_Processor
mov qword [rbp + 0x80], rax
mov ecx, ebx
mov dword [rsp + 0x70], ebx
lea rax, [rbp + 0x78]
mov qword [rbp + 0x168], rax
mov rsi, qword [rsp + 0x68]
mov r12, qword [rax]
mov r13d, ebx
mov rdi, rbx
mov qword [rbp], rbx
cmp dword [rsi + 0x18], 0
jl 0x1401daed2
nop dword [rax + rax]
lea rax, [0x14034d1a0]
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], 0
test rdi, rdi
jne 0x1401da973
mov r14, 0xffffffff80000002
test r12, r12
je 0x1401daa13
or rbx, 0xffffffffffffffff
inc rbx
cmp word [r12 + rbx*2], 0
jne 0x1401da922
test ebx, ebx
jle 0x1401daa13
mov edx, ebx
lea rcx, [rbp + 0xd8]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0xe0]
inc eax
movsxd rdx, eax
mov r8, r12
mov rcx, qword [rbp + 0xd8]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0xd8]
call fcn.140203bb0
jmp 0x1401daa13
mov r14, 0xffffffff80000003
mov rcx, rdi
shl rcx, 4
mov rbx, qword [rsi + 0x20]
add rbx, rcx
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xd8]
call fcn.1402028a0
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0xe0]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0xd8]
call fcn.1402c06dc
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xd8]
call fcn.140203bb0
mov edx, dword [rbp + 0xe4]
inc edx
lea rcx, [rbp + 0xd8]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0xe4]
mov rax, qword [rbp + 0xd8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0xe4]
inc edx
lea rcx, [rbp + 0xd8]
call fcn.140203bb0
mov rdx, r12
lea rcx, [rbp + 0xd8]
call fcn.140200ef0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xd8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dae8c
mov dword [rbp + 0x7c0], 0x800
lea rax, [rbp + 0x7c0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa770]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AutoRun
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dae80
lea rax, [rbp + 0xa770]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401daa90
xor eax, eax
mov qword [rbp + 0x4b0], rax
test ebx, ebx
jne 0x1401daab7
lea rax, [0x14034d1a0]
mov qword [rbp + 0x4a8], rax
jmp 0x1401daae6
mov edx, ebx
lea rcx, [rbp + 0x4a8]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x4b0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xa770]
mov rcx, qword [rbp + 0x4a8]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x4a8]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x4a8]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x4a8]
mov rcx, qword [rsi + 8]
call fcn.1400fa8d0
mov rsi, rax
test rax, rax
je 0x1401dae66
lea rdi, [0x14034c0a0]
cmp r14, 0xffffffff80000002
lea rax, [0x14034c0a8]
cmove rdi, rax
test rdi, rdi
jne 0x1401dab48
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x18], rax
jmp 0x1401dab64
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401dab50
xor eax, eax
mov qword [rbp - 0x18], rax
test ebx, ebx
jne 0x1401dab71
lea rax, [0x14034d1a0]
mov qword [rbp - 0x20], rax
jmp 0x1401dab93
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp - 0x18]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rbp - 0x20]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.140203bb0
nop
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1402028a0
movsxd rcx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x20]
mov edi, 0x5c
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.140203bb0
mov ebx, dword [rbp - 0x14]
add ebx, dword [rbp + 0xe4]
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1402028a0
movsxd r9, dword [rbp + 0xe4]
mov ecx, dword [rbp - 0x18]
movsxd rax, dword [rbp - 0x14]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x20]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0xd8]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.140203bb0
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1402028a0
movsxd rcx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x20]
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.140203bb0
lea rdx, str.AutoRun
lea rcx, [rbp - 0x20]
call fcn.140200ef0
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.1400edab0
cmp r14, 0xffffffff80000002
jne 0x1401dacba
xor edi, edi
mov qword [rbp + 0x658], rdi
lea edx, [rdi + 4]
lea rcx, [rbp + 0x650]
call fcn.1402028a0
mov eax, dword [rbp + 0x658]
inc eax
movsxd rdx, eax
lea r9d, [rdi + 4]
lea r8, [0x14034c0a8]
mov rcx, qword [rbp + 0x650]
call fcn.1402c06dc
lea edx, [rdi + 4]
lea rcx, [rbp + 0x650]
call fcn.140203bb0
lea rbx, [rbp + 0x650]
or r15d, 4
jmp 0x1401dace8
lea eax, [r13 - 1]
movsxd r8, eax
shl r8, 4
mov rax, qword [rsp + 0x68]
add r8, qword [rax + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0x968]
call fcn.140201410
mov rbx, rax
or r15d, 8
mov dword [rbp - 0x70], r15d
mov qword [rbp + 0x510], 0
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401dad0e
lea rax, [0x14034d1a0]
mov qword [rbp + 0x508], rax
jmp 0x1401dad38
lea rcx, [rbp + 0x508]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x510]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x508]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x508]
call fcn.140203bb0
nop
test r15b, 8
je 0x1401dad6c
and r15d, 0xfffffff7
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0x970], 0
jle 0x1401dad6c
mov rcx, qword [rbp + 0x968]
call fcn.1402bd0e0
nop
test r15b, 4
je 0x1401dad8f
and r15d, 0xfffffffb
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0x658], 0
jle 0x1401dad8f
mov rcx, qword [rbp + 0x650]
call fcn.1402bd0e0
mov rax, qword [rbp + 0x558]
mov rbx, qword [rax + 8]
mov rdi, rax
cmp byte [rbx + 0x19], 0
jne 0x1401dae0d
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbp + 0x508]
mov rcx, qword [rbx + 0x20]
call fcn.1402bcf6c
test eax, eax
jns 0x1401dadca
mov rbx, qword [rbx + 0x10]
jmp 0x1401dadd0
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401dadb0
mov rax, qword [rbp + 0x558]
cmp rdi, rax
je 0x1401dae0d
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rbp + 0x508]
call fcn.1402bcf6c
test eax, eax
mov rax, qword [rbp + 0x558]
js 0x1401dae0d
mov qword [rbp + 0x918], rdi
lea rdx, [rbp + 0x918]
jmp 0x1401dae1b
mov qword [rbp + 0x930], rax
lea rdx, [rbp + 0x930]
mov rdx, qword [rdx]
cmp rdx, rax
je 0x1401dae3d
add rdx, 0x30
mov rcx, rsi
call fcn.1400edab0
movabs rax, 0x1000000000000
or qword [rsi + 0x40], rax
cmp dword [rbp + 0x510], 0
jle 0x1401dae53
mov rcx, qword [rbp + 0x508]
call fcn.1402bd0e0
nop
cmp dword [rbp - 0x18], 0
jle 0x1401dae62
mov rcx, qword [rbp - 0x20]
call fcn.1402bd0e0
mov rdi, qword [rbp]
cmp dword [rbp + 0x4b0], 0
jle 0x1401dae7b
mov rcx, qword [rbp + 0x4a8]
call fcn.1402bd0e0
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0xe0], 0
jle 0x1401daea1
mov rcx, qword [rbp + 0xd8]
call fcn.1402bd0e0
inc r13d
inc rdi
mov qword [rbp], rdi
cmp r13d, dword [rsi + 0x18]
jle 0x1401da8f0
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov rax, qword [rbp + 0x168]
mov ecx, dword [rsp + 0x70]
xor ebx, ebx
inc ecx
mov dword [rsp + 0x70], ecx
add rax, 8
mov qword [rbp + 0x168], rax
movsxd rax, ecx
cmp rax, 2
mov rax, qword [rbp + 0x168]
jb 0x1401da8d1
mov edx, 0x3b
lea rcx, [rsp + 0x78]
call fcn.1402028a0
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0x3b
lea r8, str.SYSTEMCurrentControlSetControlSession_ManagerSubSystems
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, 0x3b
lea rcx, [rsp + 0x78]
call fcn.140203bb0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401db292
mov dword [rbp + 0x800], 0x800
lea rax, [rbp + 0x800]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x5f70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140355848]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401db287
lea rax, [rbp + 0x5f70]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dafb0
xor r14d, r14d
mov qword [rbp + 0x398], r14
test ebx, ebx
jne 0x1401dafd8
lea r13, [0x14034d1a0]
mov qword [rbp + 0x390], r13
jmp 0x1401db00e
mov edx, ebx
lea rcx, [rbp + 0x390]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x398]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x5f70]
mov rcx, qword [rbp + 0x390]
call fcn.1402c06dc
lea r13, [0x14034d1a0]
mov edx, ebx
lea rcx, [rbp + 0x390]
call fcn.140203bb0
nop
mov edi, r14d
movabs r12, 0x400100100000000
mov r15, qword [rsp + 0x68]
nop
mov r9d, dword [rbp + 0x39c]
sub r9d, edi
mov dword [rsp + 0x20], r14d
mov r8d, edi
lea rdx, str._ServerDll
lea rcx, [rbp + 0x390]
call fcn.1402033a0
mov edi, eax
test eax, eax
jle 0x1401db26a
add edi, 0xb
mov rsi, qword [0x14041eee8]
test rsi, rsi
jne 0x1401db07a
mov ebx, r14d
mov qword [rbp + 0x1b8], r14
jmp 0x1401db095
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1401db080
mov qword [rbp + 0x1b8], r14
test ebx, ebx
jne 0x1401db09e
mov qword [rbp + 0x1b0], r13
jmp 0x1401db0c9
mov edx, ebx
lea rcx, [rbp + 0x1b0]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x1b8]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp + 0x1b0]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x1b0]
call fcn.140203bb0
nop
cmp edi, dword [rbp + 0x39c]
jge 0x1401db141
mov edx, edi
lea rcx, [rbp + 0x390]
call fcn.140200d70
movzx ebx, ax
inc edi
cmp ax, 0x3a
ja 0x1401db0ff
bt r12, rbx
jb 0x1401db141
mov edx, dword [rbp + 0x1bc]
inc edx
lea rcx, [rbp + 0x1b0]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x1bc]
mov rax, qword [rbp + 0x1b0]
mov word [rax + rcx*2], bx
mov edx, dword [rbp + 0x1bc]
inc edx
lea rcx, [rbp + 0x1b0]
call fcn.140203bb0
cmp edi, dword [rbp + 0x39c]
jl 0x1401db0e0
cmp dword [rbp + 0x1bc], 0
jle 0x1401db255
lea rdx, [rbp + 0x1b0]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x1b0]
mov rcx, qword [r15 + 8]
call fcn.1400fa8d0
mov rsi, rax
test rax, rax
je 0x1401db255
mov qword [rbp + 0x310], r14
mov edx, 5
lea rcx, [rbp + 0x308]
call fcn.1402028a0
mov ecx, dword [rbp + 0x310]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x308]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x308]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x314]
add ebx, dword [rbp - 0x7c]
mov edx, ebx
lea rcx, [rbp + 0x308]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x310]
movsxd rax, dword [rbp + 0x314]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x308]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x308]
call fcn.140203bb0
lea rdx, [0x14036a370]
lea rcx, [rbp + 0x308]
call fcn.140200ef0
lea rdx, [rbp + 0x308]
mov rcx, rsi
call fcn.1400edab0
nop
cmp dword [rbp + 0x310], 0
jle 0x1401db255
mov rcx, qword [rbp + 0x308]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x1b8], 0
jle 0x1401db26a
mov rcx, qword [rbp + 0x1b0]
call fcn.1402bd0e0
test edi, edi
jns 0x1401db030
cmp dword [rbp + 0x398], 0
jle 0x1401db287
mov rcx, qword [rbp + 0x390]
call fcn.1402bd0e0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0x78], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0x80], rax
xor esi, esi
mov r12d, esi
lea r13, [rbp + 0x78]
nop dword [rax]
nop dword [rax + rax]
mov r14, qword [r13]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401db5d3
mov word [rbp + 0xd770], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0xd772]
call fcn.1402c5760
mov dword [rbp + 0x778], 0x800
lea rax, [rbp + 0x778]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xd770]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14036a4c0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401db5c8
lea rdi, [rbp + 0xd770]
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x140351edc]
mov rcx, rdi
call fcn.1402c2168
mov rsi, rax
mov r8, rdi
mov edx, 0x400
lea rcx, [rbp + 0x3370]
test rax, rax
je 0x1401db3b9
mov rbx, rax
sub rbx, rdi
sar rbx, 1
mov r9, rbx
call fcn.1402c21a0
add rbx, rbx
cmp rbx, 0x800
jae 0x1401db5e8
xor eax, eax
mov word [rbp + rbx + 0x3370], ax
lea rdi, [rsi + 2]
xor esi, esi
jmp 0x1401db3c2
call fcn.1402bcbb8
xor esi, esi
mov edi, esi
lea rcx, [rbp + 0x3370]
or rdx, 0xffffffffffffffff
mov rax, rdx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401db3d0
test rax, rax
je 0x1401db5bf
lea rax, [rbp + 0x3370]
mov rbx, rdx
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401db3f0
mov qword [rbp + 0x5a0], 0
test ebx, ebx
jne 0x1401db419
lea rax, [0x14034d1a0]
mov qword [rbp + 0x598], rax
jmp 0x1401db448
mov edx, ebx
lea rcx, [rbp + 0x598]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x5a0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x3370]
mov rcx, qword [rbp + 0x598]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x598]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x598]
call fcn.1401d86e0
lea rax, [rbp + 0x3370]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401db470
mov qword [rbp + 0x5d8], 0
test ebx, ebx
jne 0x1401db499
lea rax, [0x14034d1a0]
mov qword [rbp + 0x5d0], rax
jmp 0x1401db4c8
mov edx, ebx
lea rcx, [rbp + 0x5d0]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x5d8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x3370]
mov rcx, qword [rbp + 0x5d0]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x5d0]
call fcn.140203bb0
nop
mov r8b, 1
lea rdx, [rbp + 0x5d0]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call fcn.1400fa8d0
mov rbx, rax
cmp dword [rbp + 0x5d8], 0
jle 0x1401db507
mov rcx, qword [rbp + 0x5d0]
call fcn.1402bd0e0
test rbx, rbx
je 0x1401db5aa
mov qword [rbp + 0x4f0], 0
mov edx, 5
lea rcx, [rbp + 0x4e8]
call fcn.1402028a0
mov eax, dword [rbp + 0x4f0]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x4e8]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x4e8]
call fcn.140203bb0
nop
mov rdx, r14
lea rcx, [rbp + 0x4e8]
call fcn.140200ef0
lea rdx, [0x14036a4a0]
lea rcx, [rbp + 0x4e8]
call fcn.140200ef0
lea rdx, [rbp + 0x4e8]
mov rcx, rbx
call fcn.1400edab0
nop
cmp dword [rbp + 0x4f0], 0
jle 0x1401db5aa
mov rcx, qword [rbp + 0x4e8]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x5a0], 0
jle 0x1401db5bf
mov rcx, qword [rbp + 0x598]
call fcn.1402bd0e0
test rdi, rdi
jne 0x1401db360
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r12d
add r13, 8
movsxd rax, r12d
cmp rax, 2
jae 0x1401db5ee
jmp 0x1401db2c0
call fcn.1402beab0
int3
mov eax, dword [rbp + 0x870]
test eax, eax
jle 0x1401db906
mov r14, qword [rbp + 0x878]
mov r12d, eax
mov r15, qword [rsp + 0x68]
nop dword [rax + rax]
mov r8, qword [r14]
lea rdx, str.SYSTEM_sControlSession_ManagerAppCertDlls
lea rcx, [rbp + 0xa38]
call fcn.140202d40
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x80]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x78]
call fcn.140203bb0
nop
cmp dword [rbp + 0xa40], 0
jle 0x1401db672
mov rcx, qword [rbp + 0xa38]
call fcn.1402bd0e0
mov eax, dword [0x140431ac0]
lea rbx, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401db6aa
or eax, 1
mov dword [0x140431ac0], eax
mov qword [0x140431ac8], rbx
mov qword [0x140431ad0], 0xffffffff80000002
lea rcx, [0x1403050b0]
call fcn.1402be804
mov qword [rbp + 0x8a8], rsi
lea rax, [rbp + 0x8a8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x140431ad0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401db8f9
lea ecx, [rax + 0x10]
call fcn.1402bcb4c
mov rdi, rax
test rax, rax
je 0x1401db700
mov rax, qword [rbp + 0x8a8]
mov qword [rdi], rbx
mov qword [rdi + 8], rax
jmp 0x1401db703
mov rdi, rsi
test rdi, rdi
je 0x1401db8f9
lea rbx, [0x14034d1a0]
mov qword [rbp + 0x610], rbx
mov qword [rbp + 0x618], 0
lea r8, [rbp + 0x610]
lea rdx, str.AppSecDll
mov rcx, rdi
call fcn.1400d9fd0
test al, al
je 0x1401db8d6
mov qword [rbp + 0x470], 0
mov edx, dword [rbp + 0x61c]
test edx, edx
jne 0x1401db761
mov qword [rbp + 0x468], rbx
jmp 0x1401db798
lea rcx, [rbp + 0x468]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x61c]
mov eax, dword [rbp + 0x470]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x610]
mov rcx, qword [rbp + 0x468]
call fcn.1402c06dc
mov edx, dword [rbp + 0x61c]
lea rcx, [rbp + 0x468]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x468]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x468]
mov rcx, qword [r15 + 8]
call fcn.1400fa8d0
mov rsi, rax
test rax, rax
je 0x1401db8bf
xor eax, eax
mov qword [rbp + 0x278], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x270]
call fcn.1402028a0
mov ecx, dword [rbp + 0x278]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x270]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x270]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x27c]
add ebx, dword [rbp - 0x7c]
mov edx, ebx
lea rcx, [rbp + 0x270]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x278]
movsxd rax, dword [rbp + 0x27c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x270]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x270]
call fcn.140203bb0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x270]
call fcn.140200ef0
lea rdx, str.AppSecDll
lea rcx, [rbp + 0x270]
call fcn.140200ef0
lea rdx, [rbp + 0x270]
mov rcx, rsi
call fcn.1400edab0
nop
cmp dword [rbp + 0x278], 0
jle 0x1401db8bf
mov rcx, qword [rbp + 0x270]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x470], 0
jle 0x1401db8d4
mov rcx, qword [rbp + 0x468]
call fcn.1402bd0e0
xor esi, esi
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x618], 0
jle 0x1401db8f9
mov rcx, qword [rbp + 0x610]
call fcn.1402bd0e0
add r14, 0x10
dec r12
jne 0x1401db610
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov qword [rbp + 0x78], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov qword [rbp + 0x80], rax
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x70], ebx
lea rdi, [rbp + 0x78]
mov qword [rbp - 0x68], rdi
mov r13, qword [rdi]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dbe51
mov dword [rbp + 0x320], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x320]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r12d, r14d
cmp dword [rbp + 0x320], 0
jbe 0x1401dbe46
mov r15, qword [rsp + 0x68]
nop dword [rax]
mov r9d, 0x400
lea r8, [rbp + 0x4770]
mov edx, r12d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc r12d
test eax, eax
jne 0x1401dbe2a
lea edx, [rax + 0x2e]
lea rcx, [rbp + 0x4770]
call fcn.1402c0274
test rax, rax
je 0x1401dbe31
lea rax, [rbp + 0x888]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x4770]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dbe1b
mov dword [rbp + 0x7e0], 0x800
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1403675a8]
mov rcx, qword [rbp + 0x888]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dbe1b
lea rax, [rbp + 0x6f70]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dba80
mov qword [rbp + 0x480], 0
test ebx, ebx
jne 0x1401dbaa9
lea rax, [0x14034d1a0]
mov qword [rbp + 0x478], rax
jmp 0x1401dbad8
mov edx, ebx
lea rcx, [rbp + 0x478]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x480]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x6f70]
mov rcx, qword [rbp + 0x478]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x478]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x478]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x478]
mov rcx, qword [r15 + 8]
call fcn.1400fa8d0
mov rbx, rax
test rax, rax
je 0x1401dbe06
mov qword [rbp + 0x388], 0
mov edx, 5
lea rcx, [rbp + 0x380]
call fcn.1402028a0
mov ecx, dword [rbp + 0x388]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x380]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x380]
call fcn.140203bb0
nop
mov rdx, r13
lea rcx, [rbp + 0x380]
call fcn.140200ef0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x380]
call fcn.140200ef0
lea rdx, [rbp + 0x4770]
lea rcx, [rbp + 0x380]
call fcn.140200ef0
lea rdx, str.Debugger
lea rcx, [rbp + 0x380]
call fcn.140200ef0
lea rdx, [rbp + 0x380]
mov rcx, rbx
call fcn.1400edab0
mov rbx, qword [r15 + 8]
mov eax, dword [0x1404214a0]
cmp eax, 0xffffffff
jne 0x1401dbc01
call fcn.140114cf0
test al, al
je 0x1401dbbdf
mov dword [0x1404214a0], 1
jmp 0x1401dbc0a
cmp qword [rbx + 0x2f8], 0
je 0x1401dbbf5
mov dword [0x1404214a0], 1
jmp 0x1401dbc0a
mov dword [0x1404214a0], r14d
jmp 0x1401dbdf0
cmp eax, 1
jne 0x1401dbdf0
lea r8, str.ImageFileExecutionOptions
lea rdx, str.Policies__s_Title
lea rcx, [rbp + 0x988]
call fcn.140202d40
nop
mov rdx, rax
lea rcx, [rbp + 0x908]
call fcn.1400f6d90
nop
cmp dword [rbp + 0x990], 0
jle 0x1401dbc4a
mov rcx, qword [rbp + 0x988]
call fcn.1402bd0e0
lea r8, [rbp + 0x4770]
mov rdx, qword [rbp + 0x908]
lea rcx, [rbp + 0x920]
call fcn.140202d40
nop
mov ecx, 0x90
call fcn.1402bcb4c
mov qword [rbp + 0x210], rax
test rax, rax
je 0x1401dbc96
lea r9, [rbp + 0x920]
lea rdx, [rbp + 0x380]
mov rcx, rax
call fcn.1401fb640
mov rbx, rax
jmp 0x1401dbc99
mov rbx, r14
lea rdx, [rbx + 8]
mov rcx, qword [r15 + 8]
call fcn.1401138e0
movzx edi, al
test al, al
sete r14b
movzx edx, r14b
mov rcx, rbx
call fcn.1400d8ef0
mov rdx, rbx
mov rcx, qword [r15 + 8]
call fcn.1400fab10
mov rcx, rbx
call fcn.1400daa90
mov rsi, rax
mov rcx, rax
call fcn.1400e4d00
mov dword [rbp - 0x78], 7
movzx edx, byte [0x140431249]
mov byte [rsp + 0x20], dl
lea r9, [rbp - 0x78]
lea rdx, [rbp + 0xdf0]
lea rcx, [rsi + 0x18]
call fcn.1400e4f60
mov dword [rbp - 0x78], 8
movzx edx, byte [0x140431249]
mov byte [rsp + 0x20], dl
lea r9, [rbp - 0x78]
lea rdx, [rbp + 0x758]
lea rcx, [rsi + 0x18]
call fcn.1400e4f60
xor eax, eax
mov edx, eax
test dil, dil
setne dl
add edx, 7
mov rcx, rsi
call fcn.1400e4c20
cmp byte [rsi + 0xa], 1
je 0x1401dbd79
mov byte [rsi + 0xa], 1
cmp byte [rsi + 8], 0
je 0x1401dbd79
mov rax, qword [rsi]
mov rdx, qword [0x140430c10]
mov qword [rbp + 0xa78], rax
mov dword [rbp + 0xa80], 1
lea rcx, [rdx + 0x390]
lea r8, [rbp + 0xa78]
call fcn.14011b550
cmp byte [rsi + 9], r14b
je 0x1401dbdb7
mov byte [rsi + 9], r14b
cmp byte [rsi + 8], 0
je 0x1401dbdb7
mov rax, qword [rsi]
mov rdx, qword [0x140430c10]
mov qword [rbp + 0x9a8], rax
mov dword [rbp + 0x9b0], 2
lea rcx, [rdx + 0x390]
lea r8, [rbp + 0x9a8]
call fcn.14011b550
mov dl, 1
mov rcx, rsi
call fcn.1400e4c90
nop
cmp dword [rbp + 0x928], 0
jle 0x1401dbdd8
mov rcx, qword [rbp + 0x920]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x910], 0
jle 0x1401dbded
mov rcx, qword [rbp + 0x908]
call fcn.1402bd0e0
xor r14d, r14d
cmp dword [rbp + 0x388], 0
jle 0x1401dbe06
mov rcx, qword [rbp + 0x380]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x480], 0
jle 0x1401dbe1b
mov rcx, qword [rbp + 0x478]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x888]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401dbe31
cmp eax, 0x103
je 0x1401dbe3e
cmp r12d, dword [rbp + 0x320]
jb 0x1401db9c0
mov ebx, dword [rsp + 0x70]
mov rdi, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
mov dword [rsp + 0x70], ebx
add rdi, 8
mov qword [rbp - 0x68], rdi
movsxd rax, ebx
cmp rax, 2
jb 0x1401db931
lea rax, str.SOFTWARE_
mov qword [rbp + 0x78], rax
lea rax, str.SOFTWAREWow6432Node_
mov qword [rbp + 0x80], rax
mov dword [rbp - 0x58], r14d
lea rax, str.ShellServiceObjectDelayLoad
mov qword [rbp + 0x210], rax
lea rax, str.SharedTaskScheduler
mov qword [rbp + 0x218], rax
lea rcx, [rbp + 0x78]
mov qword [rbp + 0x168], rcx
mov rsi, qword [rcx]
mov qword [rbp], rsi
lea r8, str.MicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
mov rdx, rsi
lea rcx, [rbp - 0x10]
call fcn.140201750
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dc13d
mov dword [rbp + 0x2c8], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, r14d
cmp dword [rbp + 0x2c8], 0
jbe 0x1401dc132
mov rsi, qword [rsp + 0x68]
nop word [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x6770]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401dc11b
mov qword [rbp + 0x1e8], 0
lea edx, [rax + 5]
lea rcx, [rbp + 0x1e0]
call fcn.1402028a0
mov eax, dword [rbp + 0x1e8]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x1e0]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x1e0]
call fcn.140203bb0
nop
mov ebx, dword [rbp - 4]
add ebx, dword [rbp + 0x1ec]
mov edx, ebx
lea rcx, [rbp + 0x1e0]
call fcn.1402028a0
movsxd r9, dword [rbp - 4]
mov ecx, dword [rbp + 0x1e8]
movsxd rax, dword [rbp + 0x1ec]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1e0]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x10]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x1e0]
call fcn.140203bb0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x1e0]
call fcn.140200ef0
lea rdx, [rbp + 0x6770]
lea rcx, [rbp + 0x1e0]
call fcn.140200ef0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x1e0]
call fcn.140200ef0
lea rax, [rbp + 0x6770]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dc070
mov qword [rbp + 0x540], 0
test ebx, ebx
jne 0x1401dc099
lea rax, [0x14034d1a0]
mov qword [rbp + 0x538], rax
jmp 0x1401dc0c8
mov edx, ebx
lea rcx, [rbp + 0x538]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x540]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x6770]
mov rcx, qword [rbp + 0x538]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x538]
call fcn.140203bb0
nop
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x538]
mov rcx, rsi
call fcn.1401d5240
nop
cmp dword [rbp + 0x540], 0
jle 0x1401dc104
mov rcx, qword [rbp + 0x538]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x1e8], 0
jle 0x1401dc122
mov rcx, qword [rbp + 0x1e0]
call fcn.1402bd0e0
jmp 0x1401dc122
cmp eax, 0x103
je 0x1401dc12e
cmp edi, dword [rbp + 0x2c8]
jb 0x1401dbf60
mov rsi, qword [rbp]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.MicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, rsi
lea rcx, [rbp + 0xa58]
call fcn.140201750
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x10]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x10]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x10]
call fcn.140203bb0
nop
cmp dword [rbp + 0xa60], 0
jle 0x1401dc19c
mov rcx, qword [rbp + 0xa58]
call fcn.1402bd0e0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dc41d
mov dword [rbp + 0x318], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x318]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, r14d
cmp dword [rbp + 0x318], 0
jbe 0x1401dc412
mov rsi, qword [rsp + 0x68]
nop word [rax + rax]
mov dword [rbp + 0x790], 0x400
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x790]
lea r8, [rbp + 0x5770]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401dc3fb
mov qword [rbp + 0x238], 0
lea edx, [rax + 5]
lea rcx, [rbp + 0x230]
call fcn.1402028a0
mov eax, dword [rbp + 0x238]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x230]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x230]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x23c]
add ebx, dword [rbp - 4]
mov edx, ebx
lea rcx, [rbp + 0x230]
call fcn.1402028a0
movsxd r9, dword [rbp - 4]
mov ecx, dword [rbp + 0x238]
movsxd rax, dword [rbp + 0x23c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x230]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x10]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x230]
call fcn.140203bb0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x230]
call fcn.140200ef0
lea rdx, [rbp + 0x5770]
lea rcx, [rbp + 0x230]
call fcn.140200ef0
lea rax, [rbp + 0x5770]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dc350
mov qword [rbp + 0x550], 0
test ebx, ebx
jne 0x1401dc379
lea rax, [0x14034d1a0]
mov qword [rbp + 0x548], rax
jmp 0x1401dc3a8
mov edx, ebx
lea rcx, [rbp + 0x548]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x550]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x5770]
mov rcx, qword [rbp + 0x548]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x548]
call fcn.140203bb0
nop
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x548]
mov rcx, rsi
call fcn.1401d5240
nop
cmp dword [rbp + 0x550], 0
jle 0x1401dc3e4
mov rcx, qword [rbp + 0x548]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x238], 0
jle 0x1401dc402
mov rcx, qword [rbp + 0x230]
call fcn.1402bd0e0
jmp 0x1401dc402
cmp eax, 0x103
je 0x1401dc40e
cmp edi, dword [rbp + 0x318]
jb 0x1401dc230
mov rsi, qword [rbp]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13d, r14d
mov dword [rbp - 0x78], r14d
lea r15, [rbp + 0x210]
mov qword [rbp + 0xd0], r15
mov rdi, qword [rsp + 0x68]
nop word [rax + rax]
mov r8, qword [r15]
lea rdx, str.MicrosoftWindowsCurrentVersion_s
lea rcx, [rbp + 0x9c8]
call fcn.140202d40
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x10]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x10]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x10]
call fcn.140203bb0
nop
cmp dword [rbp + 0x9d0], 0
jle 0x1401dc49f
mov rcx, qword [rbp + 0x9c8]
call fcn.1402bd0e0
lea r8, [rbp - 0x10]
mov rdx, rsi
lea rcx, [rbp + 0xa08]
call fcn.140201410
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x10]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x10]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x10]
call fcn.140203bb0
nop
cmp dword [rbp + 0xa10], 0
jle 0x1401dc4fb
mov rcx, qword [rbp + 0xa08]
call fcn.1402bd0e0
xor ebx, ebx
mov r12d, ebx
mov dword [rsp + 0x70], ebx
mov r14d, ebx
mov qword [rbp - 0x68], rbx
cmp dword [rdi + 0x18], ebx
jl 0x1401dc923
lea rax, [0x14034d1a0]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], 0
lea rcx, [rbp + 0x38]
test r14, r14
jne 0x1401dc56d
mov rsi, 0xffffffff80000002
mov edx, dword [rbp - 4]
call fcn.1402028a0
movsxd r9, dword [rbp - 4]
mov eax, dword [rbp + 0x40]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x38]
call fcn.1402c06dc
mov edx, dword [rbp - 4]
lea rcx, [rbp + 0x38]
call fcn.140203bb0
lea r15d, [r14 + 0x5c]
jmp 0x1401dc61f
mov rsi, 0xffffffff80000003
mov rbx, r14
shl rbx, 4
add rbx, qword [rdi + 0x20]
mov edx, dword [rbx - 4]
call fcn.1402028a0
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x40]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x38]
call fcn.1402c06dc
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x38]
call fcn.140203bb0
mov edx, dword [rbp + 0x44]
inc edx
lea rcx, [rbp + 0x38]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x44]
mov rax, qword [rbp + 0x38]
mov r15d, 0x5c
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x44]
inc edx
lea rcx, [rbp + 0x38]
call fcn.140203bb0
mov ebx, dword [rbp + 0x44]
add ebx, dword [rbp - 4]
mov edx, ebx
lea rcx, [rbp + 0x38]
call fcn.1402028a0
movsxd r9, dword [rbp - 4]
mov ecx, dword [rbp + 0x40]
movsxd rax, dword [rbp + 0x44]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x38]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x10]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x38]
call fcn.140203bb0
xor ebx, ebx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x38]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dc8ec
mov dword [rbp + 0x2e8], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbp + 0x2e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x2e8], 0
jbe 0x1401dc8dc
mov r13, qword [rsp + 0x68]
lea r12, [0x14034d1a0]
lea r14, [0x14034c0a8]
mov dword [rbp + 0x718], 0x400
mov dword [rbp + 0x7d8], 0x800
lea rax, [rbp + 0x7d8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x7f70]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x718]
lea r8, [rbp + 0xdf70]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401dc8b6
lea rdx, [0x14034c0a0]
cmp rsi, 0xffffffff80000002
cmove rdx, r14
lea rcx, [rbp + 0x128]
call fcn.140200840
nop
mov edx, dword [rbp + 0x134]
inc edx
lea rcx, [rbp + 0x128]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x134]
mov rax, qword [rbp + 0x128]
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x134]
inc edx
lea rcx, [rbp + 0x128]
call fcn.140203bb0
mov ebx, dword [rbp + 0x134]
add ebx, dword [rbp + 0x44]
mov edx, ebx
lea rcx, [rbp + 0x128]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x44]
mov ecx, dword [rbp + 0x130]
movsxd rax, dword [rbp + 0x134]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x128]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x38]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x128]
call fcn.140203bb0
mov edx, dword [rbp + 0x134]
inc edx
lea rcx, [rbp + 0x128]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x134]
mov rax, qword [rbp + 0x128]
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x134]
inc edx
lea rcx, [rbp + 0x128]
call fcn.140203bb0
lea rdx, [rbp + 0xdf70]
lea rcx, [rbp + 0x128]
call fcn.140200ef0
lea rax, [rbp + 0x7f70]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dc813
xor r15d, r15d
mov qword [rbp + 0x570], r15
test ebx, ebx
jne 0x1401dc834
mov qword [rbp + 0x568], r12
jmp 0x1401dc863
mov edx, ebx
lea rcx, [rbp + 0x568]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x570]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x7f70]
mov rcx, qword [rbp + 0x568]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x568]
call fcn.140203bb0
nop
lea r8, [rbp + 0x128]
lea rdx, [rbp + 0x568]
mov rcx, r13
call fcn.1401d5240
nop
cmp dword [rbp + 0x570], 0
jle 0x1401dc89f
mov rcx, qword [rbp + 0x568]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x130], 0
jle 0x1401dc8bf
mov rcx, qword [rbp + 0x128]
call fcn.1402bd0e0
jmp 0x1401dc8bf
cmp eax, 0x103
je 0x1401dc8d3
jmp 0x1401dc8c1
xor ebx, ebx
cmp edi, dword [rbp + 0x2e8]
mov r15d, 0x5c
jb 0x1401dc6b1
mov r14, qword [rbp - 0x68]
mov r12d, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x68]
cmp dword [rbp + 0x40], 0
jle 0x1401dc8fb
mov rcx, qword [rbp + 0x38]
call fcn.1402bd0e0
inc r12d
mov dword [rsp + 0x70], r12d
inc r14
mov qword [rbp - 0x68], r14
cmp r12d, dword [rdi + 0x18]
jle 0x1401dc514
mov r13d, dword [rbp - 0x78]
mov r15, qword [rbp + 0xd0]
mov rsi, qword [rbp]
inc r13d
mov dword [rbp - 0x78], r13d
add r15, 8
mov qword [rbp + 0xd0], r15
movsxd rax, r13d
cmp rax, 2
jb 0x1401dc440
cmp dword [rbp - 8], 0
jle 0x1401dc951
mov rcx, qword [rbp - 0x10]
call fcn.1402bd0e0
mov ebx, dword [rbp - 0x58]
inc ebx
mov dword [rbp - 0x58], ebx
mov rcx, qword [rbp + 0x168]
add rcx, 8
mov qword [rbp + 0x168], rcx
movsxd rax, ebx
cmp rax, 2
mov r14d, 0
jb 0x1401dbeb0
lea rax, str.F3130CDB_AA52_4C3A_AB32_85FFC23AF9C1
mov qword [rbp + 0xd60], rax
lea rax, str._SystemRoot__system32wbemwbemess.dll
mov qword [rbp + 0xd68], rax
mov byte [rbp + 0xd70], r14b
lea rax, str.42AEDC87_2188_41FD_B9A3_0C966FEABEC1
mov qword [rbp + 0xd78], rax
lea rcx, str._SystemRoot__system32_shell32.dll
mov qword [rbp + 0xd80], rcx
mov byte [rbp + 0xd88], 1
lea rax, str.5839FCA9_774D_42A1_ACDA_D6A79037F57F
mov qword [rbp + 0xd90], rax
lea rax, str._SystemRoot__system32wbem_fastprox.dll
mov qword [rbp + 0xd98], rax
mov byte [rbp + 0xda0], r14b
lea rax, str.FBEB8A05_BEEE_4442_804E_409D6C4515E9
mov qword [rbp + 0xda8], rax
mov qword [rbp + 0xdb0], rcx
mov byte [rbp + 0xdb8], r14b
lea rax, [0x14036aa90]
mov qword [rbp + 0xdc0], rax
lea rax, str._SystemRoot__system32_thumbcache.dll
mov qword [rbp + 0xdc8], rax
mov byte [rbp + 0xdd0], r14b
lea rax, [0x14036a9f0]
mov qword [rbp + 0xdd8], rax
lea rax, str._systemroot__system32wbemwmiprvse.exe
mov qword [rbp + 0xde0], rax
mov byte [rbp + 0xde8], r14b
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x70], esi
cmp dword [rdi + 0x18], esi
mov r15d, dword [rbp - 0x60]
jl 0x1401dd14c
nop
test r13d, r13d
jne 0x1401dcabf
mov qword [rbp + 0x668], 0
lea edx, [r13 + 4]
lea rcx, [rbp + 0x660]
call fcn.1402028a0
mov eax, dword [rbp + 0x668]
inc eax
movsxd rdx, eax
lea r9d, [r13 + 4]
lea r8, [0x14034c0a8]
mov rcx, qword [rbp + 0x660]
call fcn.1402c06dc
lea edx, [r13 + 4]
lea rcx, [rbp + 0x660]
call fcn.140203bb0
lea rbx, [rbp + 0x660]
or r15d, 0x10
jmp 0x1401dcae8
lea eax, [r13 - 1]
movsxd r8, eax
shl r8, 4
add r8, qword [rdi + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0x9e8]
call fcn.140201410
mov rbx, rax
or r15d, 0x20
mov dword [rbp - 0x70], r15d
mov dword [rbp - 0x60], r15d
mov qword [rbp + 0x408], 0
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401dcb12
lea rax, [0x14034d1a0]
mov qword [rbp + 0x400], rax
jmp 0x1401dcb3c
lea rcx, [rbp + 0x400]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x408]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x400]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x400]
call fcn.140203bb0
nop
test r15b, 0x20
je 0x1401dcb74
and r15d, 0xffffffdf
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0x9f0], 0
jle 0x1401dcb74
mov rcx, qword [rbp + 0x9e8]
call fcn.1402bd0e0
nop
test r15b, 0x10
je 0x1401dcb9b
and r15d, 0xffffffef
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0x668], 0
jle 0x1401dcb9b
mov rcx, qword [rbp + 0x660]
call fcn.1402bd0e0
lea rdx, str.SOFTWAREClassesCLSID_
lea rcx, [rbp + 0x400]
call fcn.140200ef0
mov r8b, 1
xor edx, edx
lea rcx, [rbp + 0x400]
call fcn.1400ed8e0
mov r12, rax
test rax, rax
je 0x1401dd125
mov r14d, esi
lea rsi, [rbp + 0xd60]
mov r13, qword [rsp + 0x68]
xor r15d, r15d
nop dword [rax]
mov rbx, qword [rsi]
lea r8, str.LocalServer32_
mov rdx, rbx
lea rcx, [rbp + 0x588]
call fcn.140201750
nop
mov qword [rbp + 0x8b0], r15
lea rax, [rbp + 0x8b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x588]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dcc53
lea ecx, [rax + 0x10]
call fcn.1402bcb4c
mov rdi, rax
test rax, rax
je 0x1401dcc53
mov rax, qword [rbp + 0x8b0]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rdi], rcx
mov qword [rdi + 8], rax
jmp 0x1401dcc56
mov rdi, r15
test rdi, rdi
jne 0x1401dcd2e
lea r8, str.InprocServer32_
mov rdx, rbx
lea rcx, [rbp + 0xa28]
call fcn.140201750
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x588]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x590]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x588]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x588]
call fcn.140203bb0
nop
cmp dword [rbp + 0xa30], edi
jle 0x1401dccc9
mov rcx, qword [rbp + 0xa28]
call fcn.1402bd0e0
mov qword [rbp + 0x880], r15
lea rax, [rbp + 0x880]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x588]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dcd22
lea ecx, [rax + 0x10]
call fcn.1402bcb4c
mov rdi, rax
test rax, rax
je 0x1401dcd22
mov rax, qword [rbp + 0x880]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rdi], rcx
mov qword [rdi + 8], rax
jmp 0x1401dcd25
mov rdi, r15
test rdi, rdi
je 0x1401dd0de
lea rax, [0x14034d1a0]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], r15
lea r8, [rbp + 0xf8]
xor edx, edx
mov rcx, rdi
call fcn.1400d9fd0
test al, al
je 0x1401dd0b5
cmp dword [rbp + 0x104], 0
jle 0x1401dd0b5
mov r8d, 0x104
lea rdx, [rbp + 0x1230]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rbp + 0x1230]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dcd90
mov qword [rbp + 0x208], r15
test ebx, ebx
jne 0x1401dcdb5
lea rax, [0x14034d1a0]
mov qword [rbp + 0x200], rax
jmp 0x1401dcde4
mov edx, ebx
lea rcx, [rbp + 0x200]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x208]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1230]
mov rcx, qword [rbp + 0x200]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x200]
call fcn.140203bb0
nop
mov edx, 0x25
mov rcx, qword [rbp + 0xf8]
call fcn.1402c0274
test rax, rax
je 0x1401dce86
mov r8d, 0x104
lea rdx, [rbp + 0x1960]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rbp + 0x1960]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dce30
test ebx, ebx
jle 0x1401dce6f
mov edx, ebx
lea rcx, [rbp + 0xf8]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x100]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1960]
mov rcx, qword [rbp + 0xf8]
call fcn.1402c06dc
jmp 0x1401dce78
cmp dword [rbp + 0x104], 0
jle 0x1401dce86
mov edx, ebx
lea rcx, [rbp + 0xf8]
call fcn.140203bb0
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x20c], eax
jne 0x1401dceb4
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0x200]
call fcn.1402bcf6c
test eax, eax
sete al
test al, al
jne 0x1401dd0a0
cmp byte [rsi + 0x10], 0
je 0x1401dcffa
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 6]
call fcn.1400ce2e0
test al, al
jne 0x1401dcffa
mov qword [rbp + 0x698], r15
mov edx, 0xb
lea rcx, [rbp + 0x690]
call fcn.1402028a0
mov eax, dword [rbp + 0x698]
inc eax
movsxd rdx, eax
mov r9d, 0xb
lea r8, str.shdocvw.dll
mov rcx, qword [rbp + 0x690]
call fcn.1402c06dc
mov edx, 0xb
lea rcx, [rbp + 0x690]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0xa48]
call fcn.1400d4470
nop
lea r8, [rbp + 0x690]
mov rdx, rax
lea rcx, [rbp + 0x938]
call fcn.1400d4050
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x200]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x208]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x200]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x200]
call fcn.140203bb0
nop
cmp dword [rbp + 0x940], 0
jle 0x1401dcfa1
mov rcx, qword [rbp + 0x938]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0xa50], 0
jle 0x1401dcfb7
mov rcx, qword [rbp + 0xa48]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x698], 0
jle 0x1401dcfcc
mov rcx, qword [rbp + 0x690]
call fcn.1402bd0e0
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x20c], eax
jne 0x1401dcffa
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0x200]
call fcn.1402bcf6c
test eax, eax
sete al
test al, al
jne 0x1401dd0a0
lea r8, [rbp + 0x588]
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x8d8]
call fcn.140201360
nop
mov eax, dword [rbp + 0x104]
add eax, eax
lea rcx, [rbp + 0x1230]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0xf8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x14034d1a0]
lea rdx, [rbp + 0x8d8]
mov rcx, r13
call fcn.1401d4330
test al, al
jne 0x1401dd08a
lea rdx, [rbp + 0xf8]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0xf8]
mov rcx, qword [r13 + 8]
call fcn.1400fa8d0
test rax, rax
je 0x1401dd08a
lea rdx, [rbp + 0x8d8]
mov rcx, rax
call fcn.1400edab0
nop
cmp dword [rbp + 0x8e0], 0
jle 0x1401dd0a0
mov rcx, qword [rbp + 0x8d8]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x208], 0
jle 0x1401dd0b5
mov rcx, qword [rbp + 0x200]
call fcn.1402bd0e0
test rdi, rdi
je 0x1401dd0c8
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x100], 0
jle 0x1401dd0de
mov rcx, qword [rbp + 0xf8]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x590], 0
jle 0x1401dd0f3
mov rcx, qword [rbp + 0x588]
call fcn.1402bd0e0
inc r14d
add rsi, 0x18
movsxd rax, r14d
cmp rax, 6
jb 0x1401dcbe0
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
mov r15d, dword [rbp - 0x60]
mov r13d, dword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
xor esi, esi
cmp dword [rbp + 0x408], 0
jle 0x1401dd13a
mov rcx, qword [rbp + 0x400]
call fcn.1402bd0e0
inc r13d
mov dword [rsp + 0x70], r13d
cmp r13d, dword [rdi + 0x18]
jle 0x1401dca60
mov edx, 0x34
lea rcx, [rsp + 0x78]
call fcn.1402028a0
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0x34
lea r8, str.SOFTWAREMicrosoftActive_SetupInstalled_Components
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, 0x34
lea rcx, [rsp + 0x78]
call fcn.140203bb0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dd550
mov dword [rbp + 0x32c], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x32c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r14d, esi
cmp dword [rbp + 0x32c], 0
jbe 0x1401dd545
nop
mov r9d, 0x400
lea r8, [rbp + 0x8f70]
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc r14d
test eax, eax
jne 0x1401dd531
lea rax, [rbp + 0x890]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x8f70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dd522
mov dword [rbp + 0x720], 0x800
lea rax, [rbp + 0x720]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xe770]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.StubPath
mov rcx, qword [rbp + 0x890]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dd522
lea rbx, [rbp + 0xe770]
cmp word [rbx], 0x22
jne 0x1401dd2c9
add rbx, 2
mov edx, 0x22
mov rcx, rbx
call fcn.1402c0274
jmp 0x1401dd2d8
lea rdx, [0x14036ac08]
mov rcx, rbx
call fcn.1402c2168
mov rdi, rax
test rax, rax
je 0x1401dd2f2
cmp word [rax], 0x2c
mov word [rax], si
jne 0x1401dd2ee
mov rdi, rsi
jmp 0x1401dd2f2
add rdi, 2
mov rdx, rbx
lea rcx, [rbp + 0x6d0]
call fcn.140200840
nop
lea rdx, [rbp + 0x6d0]
call fcn.1401d86e0
cmp dword [rbp + 0x6dc], 3
jl 0x1401dd467
mov rcx, qword [rbp + 0x6d0]
add rcx, 2
mov r8d, 2
lea rdx, [0x1403674e8]
call fcn.1402c213c
test eax, eax
jne 0x1401dd467
mov r8b, 1
lea rdx, [rbp + 0x6d0]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call fcn.1400fa8d0
mov rsi, rax
test rax, rax
je 0x1401dd465
xor eax, eax
mov qword [rbp + 0x228], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x220]
call fcn.1402028a0
mov ecx, dword [rbp + 0x228]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x220]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x220]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x22c]
add ebx, dword [rbp - 0x7c]
mov edx, ebx
lea rcx, [rbp + 0x220]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x228]
movsxd rax, dword [rbp + 0x22c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x220]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x220]
call fcn.140203bb0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x220]
call fcn.140200ef0
lea rdx, [rbp + 0x8f70]
lea rcx, [rbp + 0x220]
call fcn.140200ef0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x220]
call fcn.140200ef0
lea rdx, [rbp + 0x220]
mov rcx, rsi
call fcn.1400edab0
nop
cmp dword [rbp + 0x228], 0
jle 0x1401dd465
mov rcx, qword [rbp + 0x220]
call fcn.1402bd0e0
xor esi, esi
test rdi, rdi
je 0x1401dd50d
lea rdx, [0x14036ac00]
mov rcx, rdi
call fcn.1402c2168
mov rbx, rax
test rax, rax
jne 0x1401dd4ed
lea edx, [rax + 0x3a]
mov rcx, rdi
call fcn.1402c00ac
mov rbx, rax
test rax, rax
jne 0x1401dd4a8
movzx ecx, word [rdi]
call fcn.1402c1a48
test eax, eax
je 0x1401dd4ed
jmp 0x1401dd4ea
cmp word [rax], 0x3a
jne 0x1401dd4ea
movzx eax, word [rax - 4]
test ax, ax
jne 0x1401dd4bd
sub rbx, 2
jmp 0x1401dd4ed
cmp ax, 0x20
jne 0x1401dd4c9
add rbx, 0xfffffffffffffffc
jmp 0x1401dd4ed
cmp ax, 0x2f
jne 0x1401dd4ed
mov edx, 0x20
mov rcx, rbx
call fcn.1402c00ac
mov rbx, rax
test rax, rax
je 0x1401dd4ed
add rbx, 2
jmp 0x1401dd4ed
mov rbx, rdi
cmp dword [rbp + 0x6d8], 0
jle 0x1401dd502
mov rcx, qword [rbp + 0x6d0]
call fcn.1402bd0e0
test rbx, rbx
jne 0x1401dd2b0
jmp 0x1401dd522
cmp dword [rbp + 0x6d8], 0
jle 0x1401dd522
mov rcx, qword [rbp + 0x6d0]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x890]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401dd538
cmp eax, 0x103
je 0x1401dd545
cmp r14d, dword [rbp + 0x32c]
jb 0x1401dd210
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x74
lea rcx, [rsp + 0x78]
call fcn.1402028a0
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0x74
lea r8, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, 0x74
lea rcx, [rsp + 0x78]
call fcn.140203bb0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dd82e
mov dword [rbp + 0x31c], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x31c]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, esi
cmp dword [rbp + 0x31c], 0
jbe 0x1401dd823
mov r15, qword [rsp + 0x68]
nop word [rax + rax]
mov dword [rbp + 0x728], 0x400
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x728]
lea r8, [rbp + 0x7770]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401dd808
lea rax, [rbp + 0x7770]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dd670
mov qword [rbp + 0x4a0], 0
test ebx, ebx
jne 0x1401dd699
lea rax, [0x14034d1a0]
mov qword [rbp + 0x498], rax
jmp 0x1401dd6c8
mov edx, ebx
lea rcx, [rbp + 0x498]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x4a0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x7770]
mov rcx, qword [rbp + 0x498]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x498]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x498]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x498]
mov rcx, qword [r15 + 8]
call fcn.1400fa8d0
mov rsi, rax
test rax, rax
je 0x1401dd7f1
xor eax, eax
mov qword [rbp + 0x258], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x250]
call fcn.1402028a0
mov ecx, dword [rbp + 0x258]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x250]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x250]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x25c]
add ebx, dword [rbp - 0x7c]
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x258]
movsxd rax, dword [rbp + 0x25c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x250]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.140203bb0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x250]
call fcn.140200ef0
lea rdx, [rbp + 0x7770]
lea rcx, [rbp + 0x250]
call fcn.140200ef0
lea rdx, [rbp + 0x250]
mov rcx, rsi
call fcn.1400edab0
nop
cmp dword [rbp + 0x258], 0
jle 0x1401dd7f1
mov rcx, qword [rbp + 0x250]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x4a0], 0
jle 0x1401dd811
mov rcx, qword [rbp + 0x498]
call fcn.1402bd0e0
jmp 0x1401dd811
cmp eax, 0x103
je 0x1401dd81f
jmp 0x1401dd813
xor esi, esi
cmp edi, dword [rbp + 0x31c]
jb 0x1401dd620
mov r15d, dword [rbp - 0x60]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xa]
call fcn.1400ce2e0
test al, al
je 0x1401de44b
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionScheduleTaskCache
mov qword [rbp + 0x78], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionScheduleTaskCache
mov qword [rbp + 0x80], rax
mov r14d, esi
mov dword [rsp + 0x70], esi
lea r12, [rbp + 0x78]
mov qword [rbp - 0x68], r12
movabs r13, 0x2000000000
nop word [rax + rax]
lea r9, str.Tree
lea r8, [0x14034c088]
mov rdx, qword [r12]
lea rcx, [rbp + 0x848]
call fcn.140202360
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x848]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401de419
mov dword [rbp + 0x2e4], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x2e4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x2e4], 0
jbe 0x1401de40c
mov r14, qword [rsp + 0x68]
xor r12d, r12d
nop dword [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x1b70]
mov edx, esi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc esi
test eax, eax
jne 0x1401de3f0
lea rax, [rbp + 0x7e8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1b70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401de3f7
mov dword [rbp + 0x430], 0x800
lea rax, [rbp + 0x430]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x9f70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14036af58]
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1401de3e1
mov qword [rbp + 0x150], r12
mov edx, 5
lea rcx, [rbp + 0x148]
call fcn.1402028a0
mov eax, dword [rbp + 0x150]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x148]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x148]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x854]
add ebx, dword [rbp + 0x154]
mov edx, ebx
lea rcx, [rbp + 0x148]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x854]
mov ecx, dword [rbp + 0x150]
movsxd rax, dword [rbp + 0x154]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x148]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x848]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x148]
call fcn.140203bb0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x148]
call fcn.140200ef0
lea rax, [rbp + 0x1b70]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dda90
mov qword [rbp + 0x428], r12
test ebx, ebx
jne 0x1401ddab5
lea rax, [0x14034d1a0]
mov qword [rbp + 0x420], rax
jmp 0x1401ddae4
mov edx, ebx
lea rcx, [rbp + 0x420]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x428]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1b70]
mov rcx, qword [rbp + 0x420]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x420]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x42c]
add ebx, dword [rbp + 0x154]
mov edx, ebx
lea rcx, [rbp + 0x148]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x42c]
mov ecx, dword [rbp + 0x150]
movsxd rax, dword [rbp + 0x154]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x148]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x420]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x148]
call fcn.140203bb0
nop
cmp dword [rbp + 0x428], 0
jle 0x1401ddb66
mov rcx, qword [rbp + 0x420]
call fcn.1402bd0e0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x148]
call fcn.140200ef0
mov ecx, 0xb8
call fcn.1402bcb4c
mov rdi, rax
mov qword [rbp + 0x210], rax
test rax, rax
je 0x1401ddc2a
lea rax, [rbp + 0x1b70]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401ddba1
mov qword [rbp + 0x5b0], r12
test ebx, ebx
jne 0x1401ddbc6
lea rax, [0x14034d1a0]
mov qword [rbp + 0x5a8], rax
jmp 0x1401ddbf5
mov edx, ebx
lea rcx, [rbp + 0x5a8]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x5b0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1b70]
mov rcx, qword [rbp + 0x5a8]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x5a8]
call fcn.140203bb0
nop
or r15d, 0x40
mov dword [rbp - 0x70], r15d
mov r9b, 1
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x148]
mov rcx, rdi
call fcn.140151e00
mov rbx, rax
jmp 0x1401ddc2d
mov rbx, r12
test r15b, 0x40
je 0x1401ddc4c
and r15d, 0xffffffbf
cmp dword [rbp + 0x5b0], 0
jle 0x1401ddc4c
mov rcx, qword [rbp + 0x5a8]
call fcn.1402bd0e0
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + 0xc0]
or qword [rbx + 0x40], r13
mov rax, qword [rbx]
mov rdx, qword [r14 + 8]
mov rcx, rbx
call qword [rax + 0x70]
mov dl, 1
mov rcx, rbx
call fcn.1400d8ef0
mov rdx, rbx
mov rcx, qword [r14 + 8]
call fcn.1400fab10
lea rax, [rbp + 0x430]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x9f70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14036af50]
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401de155
mov dword [rbp + 0x300], 0x800
mov qword [rbp + 0x3c8], r12
lea edx, [rax + 0x46]
lea rcx, [rbp + 0x3c0]
call fcn.1402028a0
mov eax, dword [rbp + 0x3c8]
inc eax
movsxd rdx, eax
mov r9d, 0x46
lea r8, [0x14036aec0]
mov rcx, qword [rbp + 0x3c0]
call fcn.1402c06dc
mov edx, 0x46
lea rcx, [rbp + 0x3c0]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x9f70]
lea rcx, [rbp + 0x3c0]
call fcn.140200ef0
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x3c0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401de140
mov qword [rbp + 0x268], r12
lea edx, [rax + 5]
lea rcx, [rbp + 0x260]
call fcn.1402028a0
mov eax, dword [rbp + 0x268]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x260]
call fcn.1402c06dc
mov edx, 5
lea rcx, [rbp + 0x260]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x26c]
add ebx, dword [rbp + 0x3cc]
mov edx, ebx
lea rcx, [rbp + 0x260]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x3cc]
mov ecx, dword [rbp + 0x268]
movsxd rax, dword [rbp + 0x26c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x260]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x3c0]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x260]
call fcn.140203bb0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x260]
call fcn.140200ef0
mov ecx, 0xb8
call fcn.1402bcb4c
mov rdi, rax
mov qword [rbp + 0x210], rax
test rax, rax
je 0x1401ddeca
lea rax, [rbp + 0x1b70]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dde40
mov qword [rbp + 0x5c8], r12
test ebx, ebx
jne 0x1401dde65
lea rax, [0x14034d1a0]
mov qword [rbp + 0x5c0], rax
jmp 0x1401dde94
mov edx, ebx
lea rcx, [rbp + 0x5c0]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x5c8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1b70]
mov rcx, qword [rbp + 0x5c0]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x5c0]
call fcn.140203bb0
nop
bts r15d, 7
mov dword [rbp - 0x70], r15d
mov r9b, 1
lea r8, [rbp + 0x5c0]
lea rdx, [rbp + 0x260]
mov rcx, rdi
call fcn.140151e00
mov rbx, rax
jmp 0x1401ddecd
mov rbx, r12
test r15b, r15b
jns 0x1401ddeec
btr r15d, 7
cmp dword [rbp + 0x5c8], 0
jle 0x1401ddeec
mov rcx, qword [rbp + 0x5c0]
call fcn.1402bd0e0
or qword [rbx + 0x40], r13
mov rax, qword [rbx]
mov rdx, qword [r14 + 8]
mov rcx, rbx
call qword [rax + 0x70]
mov dl, 1
mov rcx, rbx
call fcn.1400d8ef0
mov rdx, rbx
mov rcx, qword [r14 + 8]
call fcn.1400fab10
lea rax, [rbp + 0x300]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xaf70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Actions
mov rcx, qword [rbp + 0x8d0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401de11c
mov r8d, dword [rbp + 0x300]
add r8d, 0xffffffe4
lea rdx, [rbp + 0xaf8c]
lea rcx, [rbp + 0xb770]
call fcn.1402bd1f0
lea rax, [rbp + 0xb770]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401ddf76
mov qword [rbp + 0x198], r12
test ebx, ebx
jne 0x1401ddf9b
lea rax, [0x14034d1a0]
mov qword [rbp + 0x190], rax
jmp 0x1401ddfca
mov edx, ebx
lea rcx, [rbp + 0x190]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x198]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xb770]
mov rcx, qword [rbp + 0x190]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x190]
call fcn.140203bb0
nop
lea rdx, [0x140352308]
lea rcx, [rbp + 0x190]
call fcn.140203040
mov r8d, dword [rbp + 0x19c]
lea ecx, [r8 - 4]
cmp eax, ecx
je 0x1401de050
sub r8d, eax
sub r8d, 4
lea edx, [rax + 4]
lea rcx, [rbp + 0x190]
call fcn.140203cb0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x190]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x198]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x190]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x190]
call fcn.140203bb0
mov r8d, 1
lea rdx, [0x14036aebc]
lea rcx, [rbp + 0x190]
call fcn.140202750
test al, al
je 0x1401de0b2
mov ebx, dword [rbp + 0x19c]
lea ecx, [rbx + rbx]
mov r8d, dword [rbp + 0x300]
sub r8d, ecx
sub r8d, 0x1e
movsxd rax, ecx
lea rdx, [rbp + 0xaf8e]
add rdx, rax
lea rcx, [rbp + 0xb770]
call fcn.1402bd1f0
lea edx, [rbx - 1]
mov r8d, 1
lea rcx, [rbp + 0x190]
call fcn.140203cb0
lea rdx, [rbp + 0x190]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x190]
mov rcx, qword [r14 + 8]
call fcn.1400fa8d0
mov rbx, rax
test rax, rax
je 0x1401de107
or qword [rax + 0x40], r13
mov r8, qword [rax]
mov rdx, qword [r14 + 8]
mov rcx, rax
call qword [r8 + 0x70]
lea rdx, [rbp + 0x260]
mov rcx, rbx
call fcn.1400edab0
mov rdx, rbx
mov rcx, qword [r14 + 8]
call fcn.1400fab10
nop
cmp dword [rbp + 0x198], 0
jle 0x1401de11c
mov rcx, qword [rbp + 0x190]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x8d0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x268], 0
jle 0x1401de140
mov rcx, qword [rbp + 0x260]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x3c8], 0
jle 0x1401de155
mov rcx, qword [rbp + 0x3c0]
call fcn.1402bd0e0
mov edx, 0x104
lea rcx, [rbp + 0x1750]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rbp + 0x6b8], r12
mov edx, 6
lea rcx, [rbp + 0x6b0]
call fcn.1402028a0
mov eax, dword [rbp + 0x6b8]
inc eax
movsxd rdx, eax
mov r9d, 6
lea r8, str.Tasks_
mov rcx, qword [rbp + 0x6b0]
call fcn.1402c06dc
mov edx, 6
lea rcx, [rbp + 0x6b0]
call fcn.140203bb0
nop
lea rax, [rbp + 0x1750]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401de1c0
mov qword [rbp + 0x5e8], r12
test ebx, ebx
jne 0x1401de1e5
lea rdi, [0x14034d1a0]
mov qword [rbp + 0x5e0], rdi
jmp 0x1401de21b
mov edx, ebx
lea rcx, [rbp + 0x5e0]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x5e8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1750]
mov rcx, qword [rbp + 0x5e0]
call fcn.1402c06dc
lea rdi, [0x14034d1a0]
mov edx, ebx
lea rcx, [rbp + 0x5e0]
call fcn.140203bb0
nop
lea r8, [rbp + 0x6b0]
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x4b8]
call fcn.1400d4050
nop
cmp dword [rbp + 0x5e8], 0
jle 0x1401de25b
mov rcx, qword [rbp + 0x5e0]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x6b8], 0
jle 0x1401de270
mov rcx, qword [rbp + 0x6b0]
call fcn.1402bd0e0
lea rax, [rbp + 0x1b70]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401de280
mov qword [rbp + 0x440], r12
test ebx, ebx
jne 0x1401de29e
mov qword [rbp + 0x438], rdi
jmp 0x1401de2cd
mov edx, ebx
lea rcx, [rbp + 0x438]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x440]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1b70]
mov rcx, qword [rbp + 0x438]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x438]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x4c4]
add ebx, dword [rbp + 0x444]
mov edx, ebx
lea rcx, [rbp + 0x4b8]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x444]
mov ecx, dword [rbp + 0x4c0]
movsxd rax, dword [rbp + 0x4c4]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x4b8]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x438]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x4b8]
call fcn.140203bb0
nop
cmp dword [rbp + 0x440], 0
jle 0x1401de34f
mov rcx, qword [rbp + 0x438]
call fcn.1402bd0e0
lea rdx, [rbp + 0xac0]
mov rcx, qword [rbp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1401de3b6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8b, 1
lea rdx, [rbp + 0x4b8]
mov rcx, qword [r14 + 8]
call fcn.1400fa8d0
mov rbx, rax
test rax, rax
je 0x1401de3b6
or qword [rax + 0x40], r13
mov r8, qword [rax]
mov rdx, qword [r14 + 8]
mov rcx, rax
call qword [r8 + 0x70]
mov dl, 1
mov rcx, rbx
call fcn.1400d8ef0
mov rdx, rbx
mov rcx, qword [r14 + 8]
call fcn.1400fab10
nop
cmp dword [rbp + 0x4c0], 0
jle 0x1401de3cc
mov rcx, qword [rbp + 0x4b8]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x150], 0
jle 0x1401de3e1
mov rcx, qword [rbp + 0x148]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401de3f7
cmp eax, 0x103
je 0x1401de403
cmp esi, dword [rbp + 0x2e4]
jb 0x1401dd930
mov r14d, dword [rsp + 0x70]
mov r12, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [rbp + 0x850], 0
jle 0x1401de42e
mov rcx, qword [rbp + 0x848]
call fcn.1402bd0e0
inc r14d
mov dword [rsp + 0x70], r14d
add r12, 8
mov qword [rbp - 0x68], r12
movsxd rax, r14d
cmp rax, 2
jb 0x1401dd880
mov edx, 0x32
lea rcx, [rsp + 0x78]
call fcn.1402028a0
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SYSTEMCurrentControlSetControlSecurityProviders
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, 0x32
lea rcx, [rsp + 0x78]
call fcn.140203bb0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401de5e9
mov dword [rbp + 0x730], 0x800
lea rax, [rbp + 0x730]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xef70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SecurityProviders
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401de5de
lea rdi, [rbp + 0xef70]
nop
mov edx, 0x20
mov rcx, rdi
call fcn.1402c0274
mov rbx, rax
test rax, rax
je 0x1401de52c
mov rcx, rsi
cmp word [rax - 2], 0x2c
mov rax, 0xffffffffffffffff
cmove rcx, rax
mov word [rbx + rcx*2], si
mov rdx, rdi
lea rcx, [rbp + 0x818]
call fcn.140200840
nop
lea rdx, [rbp + 0x818]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x818]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call fcn.1400fa8d0
mov rdi, rax
test rax, rax
je 0x1401de5a2
mov r8, qword [rsp + 0x78]
lea rdx, str.HKLM_wsSecurityProviders
lea rcx, [rbp + 0x948]
call fcn.140202d40
nop
mov rdx, rax
mov rcx, rdi
call fcn.1400edab0
nop
cmp dword [rbp + 0x950], 0
jle 0x1401de5a2
mov rcx, qword [rbp + 0x948]
call fcn.1402bd0e0
test rbx, rbx
je 0x1401de5c9
lea rdi, [rbx + 2]
cmp dword [rbp + 0x820], 0
jle 0x1401de500
mov rcx, qword [rbp + 0x818]
call fcn.1402bd0e0
jmp 0x1401de500
cmp dword [rbp + 0x820], 0
jle 0x1401de5de
mov rcx, qword [rbp + 0x818]
call fcn.1402bd0e0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], rsi
call fcn.14000a340
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x678], 0
mov edx, 0x2c
lea rcx, [rbp + 0x670]
call fcn.1402028a0
mov eax, dword [rbp + 0x678]
inc eax
movsxd rdx, eax
mov r9d, 0x2c
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbar
mov rcx, qword [rbp + 0x670]
call fcn.1402c06dc
mov edx, 0x2c
lea rcx, [rbp + 0x670]
call fcn.140203bb0
nop
movzx eax, byte [0x14043124a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x670]
lea rdx, [rbp + 0xdf0]
lea rcx, [rbp + 0x170]
call fcn.1400eac70
nop
cmp dword [rbp + 0x678], 0
jle 0x1401de690
mov rcx, qword [rbp + 0x670]
call fcn.1402bd0e0
mov qword [rbp + 0x688], 0
mov edx, 0x35
lea rcx, [rbp + 0x680]
call fcn.1402028a0
mov eax, dword [rbp + 0x688]
inc eax
movsxd rdx, eax
mov r9d, 0x35
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarExplorer
mov rcx, qword [rbp + 0x680]
call fcn.1402c06dc
mov edx, 0x35
lea rcx, [rbp + 0x680]
call fcn.140203bb0
nop
movzx eax, byte [0x14043124a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x680]
lea rdx, [rbp + 0xdf0]
lea rcx, [rbp + 0x170]
call fcn.1400eac70
nop
cmp dword [rbp + 0x688], 0
jle 0x1401de71d
mov rcx, qword [rbp + 0x680]
call fcn.1402bd0e0
mov qword [rbp + 0x6a8], 0
mov edx, 0x39
lea rcx, [rbp + 0x6a0]
call fcn.1402028a0
mov eax, dword [rbp + 0x6a8]
inc eax
movsxd rdx, eax
mov r9d, 0x39
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarShellBrowser
mov rcx, qword [rbp + 0x6a0]
call fcn.1402c06dc
mov edx, 0x39
lea rcx, [rbp + 0x6a0]
call fcn.140203bb0
nop
movzx eax, byte [0x14043124a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x6a0]
lea rdx, [rbp + 0xdf0]
lea rcx, [rbp + 0x170]
call fcn.1400eac70
nop
cmp dword [rbp + 0x6a8], 0
jle 0x1401de7aa
mov rcx, qword [rbp + 0x6a0]
call fcn.1402bd0e0
mov qword [rbp + 0x6c8], 0
mov edx, 0x37
lea rcx, [rbp + 0x6c0]
call fcn.1402028a0
mov eax, dword [rbp + 0x6c8]
inc eax
movsxd rdx, eax
mov r9d, 0x37
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarWebBrowser
mov rcx, qword [rbp + 0x6c0]
call fcn.1402c06dc
mov edx, 0x37
lea rcx, [rbp + 0x6c0]
call fcn.140203bb0
nop
movzx eax, byte [0x14043124a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x6c0]
lea rdx, [rbp + 0xdf0]
lea rcx, [rbp + 0x170]
call fcn.1400eac70
nop
cmp dword [rbp + 0x6c8], 0
jle 0x1401de837
mov rcx, qword [rbp + 0x6c0]
call fcn.1402bd0e0
mov qword [rbp + 0x6e8], 0
mov edx, 0x33
lea rcx, [rbp + 0x6e0]
call fcn.1402028a0
mov eax, dword [rbp + 0x6e8]
inc eax
movsxd rdx, eax
mov r9d, 0x33
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerUrlSearchHooks
mov rcx, qword [rbp + 0x6e0]
call fcn.1402c06dc
mov edx, 0x33
lea rcx, [rbp + 0x6e0]
call fcn.140203bb0
nop
movzx eax, byte [0x14043124a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x6e0]
lea rdx, [rbp + 0xdf0]
lea rcx, [rbp + 0x170]
call fcn.1400eac70
nop
cmp dword [rbp + 0x6e8], 0
jle 0x1401de8c4
mov rcx, qword [rbp + 0x6e0]
call fcn.1402bd0e0
mov r12d, esi
mov dword [rsp + 0x70], esi
mov r13, qword [rsp + 0x68]
cmp dword [r13 + 0x18], 0
jl 0x1401ded88
mov r15, rsi
mov qword [rbp - 0x68], rsi
mov rax, qword [rbp + 0x170]
nop dword [rax]
mov r14, rsi
test r12d, r12d
setne r14b
add r14, 0xffffffff80000002
mov rbx, qword [rax]
mov qword [rbp - 0x78], rbx
cmp rbx, rax
je 0x1401ded6f
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.140203bb0
lea rax, [0x14034d1a0]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], 0
lea rcx, [rbp + 0x28]
test r15, r15
jne 0x1401de98b
mov edx, dword [rbp - 0x7c]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7c]
mov eax, dword [rbp + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x28]
call fcn.1402c06dc
mov edx, dword [rbp - 0x7c]
jmp 0x1401dea2a
mov rdi, r15
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1402028a0
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.1402c06dc
mov edx, dword [rdi - 4]
lea rcx, [rbp + 0x28]
call fcn.140203bb0
mov edx, dword [rbp + 0x34]
inc edx
lea rcx, [rbp + 0x28]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x34]
mov rax, qword [rbp + 0x28]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x34]
inc edx
lea rcx, [rbp + 0x28]
call fcn.140203bb0
mov edi, dword [rbp + 0x34]
add edi, dword [rbp - 0x7c]
mov edx, edi
lea rcx, [rbp + 0x28]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x30]
movsxd rax, dword [rbp + 0x34]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x28]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, edi
lea rcx, [rbp + 0x28]
call fcn.140203bb0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401decee
mov dword [rbp + 0x2b0], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x2b0], 0
jbe 0x1401dece1
xor r12d, r12d
lea r15, [0x14034d1a0]
or rbx, 0xffffffffffffffff
nop
mov dword [rbp + 0x738], 0x400
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x738]
lea r8, [rbp + 0x3f70]
mov edx, esi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc esi
test eax, eax
jne 0x1401decc6
cmp word [rbp + 0x3f70], 0x7b
jne 0x1401deccd
lea rdx, [0x14034c0a0]
cmp r14, 0xffffffff80000002
lea rax, [0x14034c0a8]
cmove rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140200840
nop
mov edx, dword [rbp + 0x114]
inc edx
lea rcx, [rbp + 0x108]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x114]
mov rax, qword [rbp + 0x108]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x114]
inc edx
lea rcx, [rbp + 0x108]
call fcn.140203bb0
mov edi, dword [rbp + 0x114]
add edi, dword [rbp + 0x34]
mov edx, edi
lea rcx, [rbp + 0x108]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x34]
mov ecx, dword [rbp + 0x110]
movsxd rax, dword [rbp + 0x114]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x108]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x28]
call fcn.1402c06dc
mov edx, edi
lea rcx, [rbp + 0x108]
call fcn.140203bb0
mov edx, dword [rbp + 0x114]
inc edx
lea rcx, [rbp + 0x108]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x114]
mov rax, qword [rbp + 0x108]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x114]
inc edx
lea rcx, [rbp + 0x108]
call fcn.140203bb0
lea rdx, [rbp + 0x3f70]
lea rcx, [rbp + 0x108]
call fcn.140200ef0
lea rax, [rbp + 0x3f70]
mov rdi, rbx
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401dec26
mov qword [rbp + 0x608], r12
test edi, edi
jne 0x1401dec44
mov qword [rbp + 0x600], r15
jmp 0x1401dec73
mov edx, edi
lea rcx, [rbp + 0x600]
call fcn.1402028a0
movsxd r9, edi
mov eax, dword [rbp + 0x608]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x3f70]
mov rcx, qword [rbp + 0x600]
call fcn.1402c06dc
mov edx, edi
lea rcx, [rbp + 0x600]
call fcn.140203bb0
nop
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x600]
mov rcx, r13
call fcn.1401d5240
nop
cmp dword [rbp + 0x608], 0
jle 0x1401decaf
mov rcx, qword [rbp + 0x600]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x110], 0
jle 0x1401deccd
mov rcx, qword [rbp + 0x108]
call fcn.1402bd0e0
jmp 0x1401deccd
cmp eax, 0x103
je 0x1401decd9
cmp esi, dword [rbp + 0x2b0]
jb 0x1401deac0
mov rbx, qword [rbp - 0x78]
mov r15, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [rbp + 0x30], 0
jle 0x1401decfd
mov rcx, qword [rbp + 0x28]
call fcn.1402bd0e0
cmp byte [rbx + 0x19], 0
jne 0x1401ded5a
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ded32
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ded5a
nop dword [rax]
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ded20
jmp 0x1401ded5a
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ded53
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401ded53
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ded40
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x170]
cmp rbx, rax
jne 0x1401de911
mov r12d, dword [rsp + 0x70]
inc r12d
mov dword [rsp + 0x70], r12d
inc r15
mov qword [rbp - 0x68], r15
cmp r12d, dword [r13 + 0x18]
jle 0x1401de8f0
lea rcx, [rbp + 0x170]
call fcn.140009e30
mov qword [rbp + 0x638], 0
mov edx, 0x32
lea rcx, [rbp + 0x630]
call fcn.1402028a0
mov eax, dword [rbp + 0x638]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExplorer_Bars
mov rcx, qword [rbp + 0x630]
call fcn.1402c06dc
mov edx, 0x32
lea rcx, [rbp + 0x630]
call fcn.140203bb0
nop
movzx eax, byte [0x14043124a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x630]
lea rdx, [rbp + 0xdf0]
lea rcx, [rbp + 0x170]
call fcn.1400eac70
nop
cmp dword [rbp + 0x638], 0
jle 0x1401dee21
mov rcx, qword [rbp + 0x630]
call fcn.1402bd0e0
mov qword [rbp + 0x708], 0
mov edx, 0x2f
lea rcx, [rbp + 0x700]
call fcn.1402028a0
mov eax, dword [rbp + 0x708]
inc eax
movsxd rdx, eax
mov r9d, 0x2f
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExtensions
mov rcx, qword [rbp + 0x700]
call fcn.1402c06dc
mov edx, 0x2f
lea rcx, [rbp + 0x700]
call fcn.140203bb0
nop
movzx eax, byte [0x14043124a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x700]
lea rdx, [rbp + 0xdf0]
lea rcx, [rbp + 0x170]
call fcn.1400eac70
nop
cmp dword [rbp + 0x708], 0
jle 0x1401deeae
mov rcx, qword [rbp + 0x700]
call fcn.1402bd0e0
mov r12d, esi
mov dword [rsp + 0x70], esi
cmp dword [r13 + 0x18], 0
jl 0x1401df368
mov r15, rsi
mov qword [rbp - 0x68], rsi
mov rax, qword [rbp + 0x170]
nop
mov r14, rsi
test r12d, r12d
setne r14b
add r14, 0xffffffff80000002
mov rbx, qword [rax]
mov qword [rbp - 0x78], rbx
cmp rbx, rax
je 0x1401df34f
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.140203bb0
lea rax, [0x14034d1a0]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], 0
lea rcx, [rbp + 0x18]
test r15, r15
jne 0x1401def6b
mov edx, dword [rbp - 0x7c]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7c]
mov eax, dword [rbp + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x18]
call fcn.1402c06dc
mov edx, dword [rbp - 0x7c]
jmp 0x1401df00a
mov rdi, r15
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1402028a0
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 0x18]
call fcn.1402c06dc
mov edx, dword [rdi - 4]
lea rcx, [rbp + 0x18]
call fcn.140203bb0
mov edx, dword [rbp + 0x24]
inc edx
lea rcx, [rbp + 0x18]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x24]
mov rax, qword [rbp + 0x18]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x24]
inc edx
lea rcx, [rbp + 0x18]
call fcn.140203bb0
mov edi, dword [rbp + 0x24]
add edi, dword [rbp - 0x7c]
mov edx, edi
lea rcx, [rbp + 0x18]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x20]
movsxd rax, dword [rbp + 0x24]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x18]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, edi
lea rcx, [rbp + 0x18]
call fcn.140203bb0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x18]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401df2ce
mov dword [rbp + 0x324], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x324]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x324], 0
jbe 0x1401df2c1
xor r12d, r12d
lea r15, [0x14034d1a0]
or rbx, 0xffffffffffffffff
nop
mov dword [rbp + 0x71c], 0x800
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x71c]
lea r8, [rbp + 0x4f70]
mov edx, esi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
test eax, eax
jne 0x1401df2a6
cmp word [rbp + 0x4f70], 0x7b
jne 0x1401df2ad
lea rdx, [0x14034c0a0]
cmp r14, 0xffffffff80000002
lea rax, [0x14034c0a8]
cmove rdx, rax
lea rcx, [rbp + 0x118]
call fcn.140200840
nop
mov edx, dword [rbp + 0x124]
inc edx
lea rcx, [rbp + 0x118]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x124]
mov rax, qword [rbp + 0x118]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x124]
inc edx
lea rcx, [rbp + 0x118]
call fcn.140203bb0
mov edi, dword [rbp + 0x124]
add edi, dword [rbp + 0x24]
mov edx, edi
lea rcx, [rbp + 0x118]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x120]
movsxd rax, dword [rbp + 0x124]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x118]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x18]
call fcn.1402c06dc
mov edx, edi
lea rcx, [rbp + 0x118]
call fcn.140203bb0
mov edx, dword [rbp + 0x124]
inc edx
lea rcx, [rbp + 0x118]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x124]
mov rax, qword [rbp + 0x118]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x124]
inc edx
lea rcx, [rbp + 0x118]
call fcn.140203bb0
lea rdx, [rbp + 0x4f70]
lea rcx, [rbp + 0x118]
call fcn.140200ef0
lea rax, [rbp + 0x4f70]
mov rdi, rbx
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401df206
mov qword [rbp + 0x628], r12
test edi, edi
jne 0x1401df224
mov qword [rbp + 0x620], r15
jmp 0x1401df253
mov edx, edi
lea rcx, [rbp + 0x620]
call fcn.1402028a0
movsxd r9, edi
mov eax, dword [rbp + 0x628]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x4f70]
mov rcx, qword [rbp + 0x620]
call fcn.1402c06dc
mov edx, edi
lea rcx, [rbp + 0x620]
call fcn.140203bb0
nop
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x620]
mov rcx, r13
call fcn.1401d5240
nop
cmp dword [rbp + 0x628], 0
jle 0x1401df28f
mov rcx, qword [rbp + 0x620]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x120], 0
jle 0x1401df2ad
mov rcx, qword [rbp + 0x118]
call fcn.1402bd0e0
jmp 0x1401df2ad
cmp eax, 0x103
je 0x1401df2b9
cmp esi, dword [rbp + 0x324]
jb 0x1401df0a0
mov rbx, qword [rbp - 0x78]
mov r15, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [rbp + 0x20], 0
jle 0x1401df2dd
mov rcx, qword [rbp + 0x18]
call fcn.1402bd0e0
cmp byte [rbx + 0x19], 0
jne 0x1401df33a
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401df312
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401df33a
nop dword [rax]
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401df300
jmp 0x1401df33a
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401df333
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401df333
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401df320
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x170]
cmp rbx, rax
jne 0x1401deef1
mov r12d, dword [rsp + 0x70]
inc r12d
mov dword [rsp + 0x70], r12d
inc r15
mov qword [rbp - 0x68], r15
cmp r12d, dword [r13 + 0x18]
jle 0x1401deed0
lea rax, str.ControlPanel
mov qword [rbp + 0xd40], rax
lea rax, str.Desktop
mov qword [rbp + 0xd48], rax
lea rax, str.MyComputer
mov qword [rbp + 0xd50], rax
lea rax, str.NetworkNeighborhood
mov qword [rbp + 0xd58], rax
mov ebx, esi
mov dword [rsp + 0x70], ebx
lea rdi, [rbp + 0xd40]
mov qword [rbp + 0xd0], rdi
mov r14d, 0x5c
nop word [rax + rax]
mov qword [rbp + 0x90], 0
mov edx, 0x32
lea rcx, [rbp + 0x88]
call fcn.1402028a0
mov eax, dword [rbp + 0x90]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
mov rcx, qword [rbp + 0x88]
call fcn.1402c06dc
mov edx, 0x32
lea rcx, [rbp + 0x88]
call fcn.140203bb0
nop
mov edx, dword [rbp + 0x94]
inc edx
lea rcx, [rbp + 0x88]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x94]
mov rax, qword [rbp + 0x88]
mov word [rax + rcx*2], r14w
mov edx, dword [rbp + 0x94]
inc edx
lea rcx, [rbp + 0x88]
call fcn.140203bb0
mov rdx, qword [rdi]
lea rcx, [rbp + 0x88]
call fcn.140200ef0
mov edx, dword [rbp + 0x94]
inc edx
lea rcx, [rbp + 0x88]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x94]
mov rax, qword [rbp + 0x88]
mov word [rax + rcx*2], r14w
mov edx, dword [rbp + 0x94]
inc edx
lea rcx, [rbp + 0x88]
call fcn.140203bb0
lea rdx, str.NameSpace
lea rcx, [rbp + 0x88]
call fcn.140200ef0
mov eax, dword [0x140431ac0]
lea r15, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401df4e2
or eax, 1
mov dword [0x140431ac0], eax
mov qword [0x140431ac8], r15
mov qword [0x140431ad0], 0xffffffff80000002
lea rcx, [0x1403050b0]
call fcn.1402be804
mov qword [rbp + 0x8c0], rsi
lea rax, [rbp + 0x8c0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x88]
mov rcx, qword [0x140431ad0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401df993
lea ecx, [rax + 0x10]
call fcn.1402bcb4c
mov r13, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1401df53f
mov rax, qword [rbp + 0x8c0]
mov qword [r13], r15
mov qword [r13 + 8], rax
jmp 0x1401df546
mov r13, rsi
mov qword [rbp - 0x68], rsi
lea r15, vtable.Core::Array_class_Core::String_.0
test r13, r13
je 0x1401df99a
mov qword [rbp + 0xd10], r15
mov dword [rbp + 0xd18], esi
mov qword [rbp + 0xd20], rsi
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xd10]
mov rcx, r13
call fcn.1400ed120
test al, al
je 0x1401df96d
mov eax, dword [rbp + 0xd18]
test eax, eax
jle 0x1401df96d
mov rsi, qword [rbp + 0xd20]
mov r15, rsi
mov r12d, eax
mov r13, qword [rsp + 0x68]
mov r8d, 1
lea rdx, [0x140355efc]
mov rcx, r15
call fcn.140205020
test al, al
je 0x1401df93f
mov r8, qword [rsi]
lea rdx, str.HKLMSOFTWAREClassesCLSID_s_
lea rcx, [rbp + 0x748]
call fcn.140202d40
nop
xor ebx, ebx
mov qword [rbp + 0x450], rbx
mov edx, dword [rbp + 0x754]
test edx, edx
jne 0x1401df607
lea r14, [0x14034d1a0]
mov qword [rbp + 0x448], r14
jmp 0x1401df645
lea rcx, [rbp + 0x448]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x754]
mov eax, dword [rbp + 0x450]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x748]
mov rcx, qword [rbp + 0x448]
call fcn.1402c06dc
mov edx, dword [rbp + 0x754]
lea r14, [0x14034d1a0]
lea rcx, [rbp + 0x448]
call fcn.140203bb0
nop
lea rdx, str.ShellOpenCommand
lea rcx, [rbp + 0x448]
call fcn.140200ef0
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x448]
call fcn.1400ed8e0
mov rdi, rax
test rax, rax
je 0x1401df914
mov qword [rbp + 0x330], r14
mov qword [rbp + 0x338], rbx
lea r8, [rbp + 0x330]
mov rdx, qword [0x14041eee8]
mov rcx, rax
call fcn.1400d9fd0
test al, al
je 0x1401df8f0
lea rdx, [rbp + 0x330]
call fcn.1401d86e0
cmp dword [rbp + 0x33c], 2
jle 0x1401df8f0
mov r8d, 2
lea rdx, [0x14034cf98]
lea rcx, [rbp + 0x330]
call fcn.140203160
test eax, eax
jle 0x1401df750
lea r8d, [rax - 1]
lea rdx, [rbp + 0x958]
lea rcx, [rbp + 0x330]
call fcn.140204810
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x330]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x338]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x330]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x330]
call fcn.140203bb0
nop
cmp dword [rbp + 0x960], 0
jle 0x1401df750
mov rcx, qword [rbp + 0x958]
call fcn.1402bd0e0
mov r8b, 1
lea rdx, [rbp + 0x330]
mov rcx, qword [r13 + 8]
call fcn.1400fa8d0
mov r14, rax
test rax, rax
je 0x1401df8f0
lea rdx, [rbp + 0x748]
mov rcx, rax
call fcn.1400e5650
mov qword [rbp - 0x48], 0
mov edx, 4
lea rcx, [rbp - 0x50]
call fcn.1402028a0
mov ecx, dword [rbp - 0x48]
inc ecx
movsxd rdx, ecx
mov r9d, 4
lea r8, [0x14034c0a8]
mov rcx, qword [rbp - 0x50]
call fcn.1402c06dc
mov edx, 4
lea rcx, [rbp - 0x50]
call fcn.140203bb0
nop
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.1402028a0
movsxd rcx, dword [rbp - 0x44]
mov rax, qword [rbp - 0x50]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.140203bb0
mov ebx, dword [rbp - 0x44]
add ebx, dword [rbp + 0x94]
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x94]
mov ecx, dword [rbp - 0x48]
movsxd rax, dword [rbp - 0x44]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x50]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x88]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.140203bb0
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.1402028a0
movsxd rcx, dword [rbp - 0x44]
mov rax, qword [rbp - 0x50]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.140203bb0
mov ebx, dword [rbp - 0x44]
add ebx, dword [rsi + 0xc]
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.1402028a0
movsxd r9, dword [rsi + 0xc]
mov ecx, dword [rbp - 0x48]
movsxd rax, dword [rbp - 0x44]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x50]
lea rcx, [rax + rcx*2]
mov r8, qword [rsi]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.140203bb0
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.1402028a0
movsxd rcx, dword [rbp - 0x44]
mov rax, qword [rbp - 0x50]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.140203bb0
lea rdx, [rbp - 0x50]
mov rcx, r14
call fcn.1400e5650
nop
cmp dword [rbp - 0x48], 0
jle 0x1401df8f0
mov rcx, qword [rbp - 0x50]
call fcn.1402bd0e0
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x338], 0
jle 0x1401df914
mov rcx, qword [rbp + 0x330]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x450], 0
jle 0x1401df92a
mov rcx, qword [rbp + 0x448]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x750], 0
jle 0x1401df93f
mov rcx, qword [rbp + 0x748]
call fcn.1402bd0e0
add r15, 0x10
add rsi, 0x10
dec r12
jne 0x1401df5b0
mov r13, qword [rbp - 0x68]
mov ebx, dword [rsp + 0x70]
mov rdi, qword [rbp + 0xd0]
xor esi, esi
lea r14d, [r12 + 0x5c]
lea r15, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r13]
mov edx, 1
mov rcx, r13
call qword [rax]
nop
mov qword [rbp + 0xd10], r15
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
jmp 0x1401df99a
lea r15, vtable.Core::Array_class_Core::String_.0
cmp dword [rbp + 0x90], 0
jle 0x1401df9af
mov rcx, qword [rbp + 0x88]
call fcn.1402bd0e0
inc ebx
mov dword [rsp + 0x70], ebx
add rdi, 8
mov qword [rbp + 0xd0], rdi
movsxd rax, ebx
cmp rax, 4
jb 0x1401df3c0
mov qword [rbp + 0x288], 0
mov edx, 0x54
lea rcx, [rbp + 0x280]
call fcn.1402028a0
mov eax, dword [rbp + 0x288]
inc eax
movsxd rdx, eax
mov r9d, 0x54
lea r8, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerShellIconOverlayIdentifiers_
mov rcx, qword [rbp + 0x280]
call fcn.1402c06dc
mov edx, 0x54
lea rcx, [rbp + 0x280]
call fcn.140203bb0
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x280]
call fcn.1400ed8e0
mov r12, rax
test rax, rax
je 0x1401dfdd7
mov qword [rbp + 0xd10], r15
mov dword [rbp + 0xd18], esi
mov qword [rbp + 0xd20], rsi
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xd10]
mov rcx, r12
call fcn.1400ed120
mov r13, qword [rsp + 0x68]
test al, al
je 0x1401dfdb1
mov eax, dword [rbp + 0xd18]
test eax, eax
jle 0x1401dfdb1
mov r14, qword [rbp + 0xd20]
lea rdi, [r14 + 0xc]
mov r15d, eax
nop word [rax + rax]
mov r8d, 1
lea rdx, [0x140355efc]
mov rcx, r14
call fcn.140205020
test al, al
je 0x1401dfbe8
mov qword [rbp + 0x160], 0
mov edx, dword [rbp + 0x28c]
test edx, edx
jne 0x1401dfae2
lea rax, [0x14034d1a0]
mov qword [rbp + 0x158], rax
jmp 0x1401dfb19
lea rcx, [rbp + 0x158]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x28c]
mov eax, dword [rbp + 0x160]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x280]
mov rcx, qword [rbp + 0x158]
call fcn.1402c06dc
mov edx, dword [rbp + 0x28c]
lea rcx, [rbp + 0x158]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x164]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x158]
call fcn.1402028a0
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x160]
movsxd rax, dword [rbp + 0x164]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x158]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x158]
call fcn.140203bb0
mov edx, dword [rbp + 0x164]
inc edx
lea rcx, [rbp + 0x158]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x164]
mov rax, qword [rbp + 0x158]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x164]
inc edx
lea rcx, [rbp + 0x158]
call fcn.140203bb0
lea r8, [rbp + 0x158]
mov rdx, r14
mov rcx, r13
call fcn.1401d5240
nop
cmp dword [rbp + 0x160], 0
jle 0x1401dfd99
mov rcx, qword [rbp + 0x158]
call fcn.1402bd0e0
jmp 0x1401dfd99
xor r8d, r8d
mov rdx, qword [rdi - 0xc]
mov rcx, r12
call fcn.1400ed560
mov rsi, rax
test rax, rax
je 0x1401dfd97
lea rax, [0x14034d1a0]
mov qword [rbp + 0x768], rax
xor ebx, ebx
mov qword [rbp + 0x770], rbx
lea r8, [rbp + 0x768]
xor edx, edx
mov rcx, rsi
call fcn.1400d9fd0
test al, al
je 0x1401dfd74
lea r8d, [rbx + 1]
lea rdx, [0x140355efc]
lea rcx, [rbp + 0x768]
call fcn.140205020
test al, al
je 0x1401dfd74
mov qword [rbp + 0x188], rbx
mov edx, dword [rbp + 0x28c]
test edx, edx
jne 0x1401dfc73
lea rax, [0x14034d1a0]
mov qword [rbp + 0x180], rax
jmp 0x1401dfcaa
lea rcx, [rbp + 0x180]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x28c]
mov eax, dword [rbp + 0x188]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x280]
mov rcx, qword [rbp + 0x180]
call fcn.1402c06dc
mov edx, dword [rbp + 0x28c]
lea rcx, [rbp + 0x180]
call fcn.140203bb0
nop
mov ebx, dword [rbp + 0x18c]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x180]
call fcn.1402028a0
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x188]
movsxd rax, dword [rbp + 0x18c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x180]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x180]
call fcn.140203bb0
mov edx, dword [rbp + 0x18c]
inc edx
lea rcx, [rbp + 0x180]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x18c]
mov rax, qword [rbp + 0x180]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x18c]
inc edx
lea rcx, [rbp + 0x180]
call fcn.140203bb0
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x768]
mov rcx, r13
call fcn.1401d5240
nop
cmp dword [rbp + 0x188], 0
jle 0x1401dfd74
mov rcx, qword [rbp + 0x180]
call fcn.1402bd0e0
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp + 0x770], 0
jle 0x1401dfd97
mov rcx, qword [rbp + 0x768]
call fcn.1402bd0e0
xor esi, esi
add r14, 0x10
add rdi, 0x10
dec r15
jne 0x1401dfaa0
lea r15, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp + 0xd10], r15
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
jmp 0x1401dfddc
mov r13, qword [rsp + 0x68]
cmp dword [rbp + 0x288], 0
jle 0x1401dfdf1
mov rcx, qword [rbp + 0x280]
call fcn.1402bd0e0
lea rcx, [rbp + 0x170]
call fcn.140009e30
mov qword [rbp + 0x6f8], 0
mov edx, 0x35
lea rcx, [rbp + 0x6f0]
call fcn.1402028a0
mov eax, dword [rbp + 0x6f8]
inc eax
movsxd rdx, eax
mov r9d, 0x35
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_
mov rcx, qword [rbp + 0x6f0]
call fcn.1402c06dc
mov edx, 0x35
lea rcx, [rbp + 0x6f0]
call fcn.140203bb0
nop
movzx eax, byte [0x14043124a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x6f0]
lea rdx, [rbp + 0xdf0]
lea rcx, [rbp + 0x170]
call fcn.1400eac70
nop
cmp dword [rbp + 0x6f8], 0
jle 0x1401dfe8a
mov rcx, qword [rbp + 0x6f0]
call fcn.1402bd0e0
mov r15d, esi
mov dword [rsp + 0x70], esi
cmp dword [r13 + 0x18], 0
jl 0x1401e02ad
mov r14, rsi
mov rax, qword [rbp + 0x170]
nop word [rax + rax]
test r15d, r15d
setne sil
add rsi, 0xffffffff80000002
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401e0293
xor r12d, r12d
lea r15, [0x14034d1a0]
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.140203bb0
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r12
lea rcx, [rbp + 8]
test r14, r14
jne 0x1401dff4f
mov edx, dword [rbp - 0x7c]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7c]
mov eax, dword [rbp + 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rbp + 8]
call fcn.1402c06dc
mov edx, dword [rbp - 0x7c]
jmp 0x1401dffee
mov rdi, r14
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1402028a0
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 8]
call fcn.1402c06dc
mov edx, dword [rdi - 4]
lea rcx, [rbp + 8]
call fcn.140203bb0
mov edx, dword [rbp + 0x14]
inc edx
lea rcx, [rbp + 8]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x14]
mov rax, qword [rbp + 8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x14]
inc edx
lea rcx, [rbp + 8]
call fcn.140203bb0
mov edi, dword [rbp + 0x14]
add edi, dword [rbp - 0x7c]
mov edx, edi
lea rcx, [rbp + 8]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x10]
movsxd rax, dword [rbp + 0x14]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 8]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, edi
lea rcx, [rbp + 8]
call fcn.140203bb0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401e0220
mov dword [rbp + 0x3e0], 0x800
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xbf70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.load
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401e0214
cmp dword [rbp + 0x3e0], eax
jbe 0x1401e0214
lea rax, [rbp + 0xbf70]
or rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401e0080
mov qword [rbp + 0x3d8], r12
test edi, edi
jne 0x1401e009e
mov qword [rbp + 0x3d0], r15
jmp 0x1401e00cd
mov edx, edi
lea rcx, [rbp + 0x3d0]
call fcn.1402028a0
movsxd r9, edi
mov eax, dword [rbp + 0x3d8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xbf70]
mov rcx, qword [rbp + 0x3d0]
call fcn.1402c06dc
mov edx, edi
lea rcx, [rbp + 0x3d0]
call fcn.140203bb0
nop
cmp dword [rbp + 0x3dc], 0
jle 0x1401e01ff
lea rdx, [rbp + 0x3d0]
call fcn.1401d86e0
lea rdx, [0x14034c0a0]
cmp rsi, 0xffffffff80000002
lea rax, [0x14034c0a8]
cmove rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.140200840
nop
mov edx, dword [rbp + 0x2ac]
inc edx
lea rcx, [rbp + 0x2a0]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x2ac]
mov rax, qword [rbp + 0x2a0]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x2ac]
inc edx
lea rcx, [rbp + 0x2a0]
call fcn.140203bb0
mov edi, dword [rbp + 0x2ac]
add edi, dword [rbp + 0x14]
mov edx, edi
lea rcx, [rbp + 0x2a0]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x14]
mov ecx, dword [rbp + 0x2a8]
movsxd rax, dword [rbp + 0x2ac]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x2a0]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 8]
call fcn.1402c06dc
mov edx, edi
lea rcx, [rbp + 0x2a0]
call fcn.140203bb0
lea rdx, str.load
lea rcx, [rbp + 0x2a0]
call fcn.140200ef0
mov r8b, 1
lea rdx, [rbp + 0x3d0]
mov rcx, qword [r13 + 8]
call fcn.1400fa8d0
test rax, rax
je 0x1401e01e9
lea rdx, [rbp + 0x2a0]
mov rcx, rax
call fcn.1400edab0
nop
cmp dword [rbp + 0x2a8], 0
jle 0x1401e01ff
mov rcx, qword [rbp + 0x2a0]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x3d8], 0
jle 0x1401e0214
mov rcx, qword [rbp + 0x3d0]
call fcn.1402bd0e0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x10], 0
jle 0x1401e022f
mov rcx, qword [rbp + 8]
call fcn.1402bd0e0
cmp byte [rbx + 0x19], 0
jne 0x1401e027e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401e025e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401e027e
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401e0250
jmp 0x1401e027e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401e027b
cmp rbx, qword [rax + 0x10]
jne 0x1401e027b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401e0268
mov rbx, rax
mov rax, qword [rbp + 0x170]
cmp rbx, rax
jne 0x1401dfee0
mov r15d, dword [rsp + 0x70]
inc r15d
mov dword [rsp + 0x70], r15d
inc r14
cmp r15d, dword [r13 + 0x18]
mov esi, 0
jle 0x1401dfeb0
lea rax, [0x140352308]
mov qword [rbp + 0xd10], rax
lea rax, str.exefile
mov qword [rbp + 0xd18], rax
lea rax, str..pif
mov qword [rbp + 0xd20], rax
lea rax, str.piffile
mov qword [rbp + 0xd28], rax
lea rax, str..com
mov qword [rbp + 0xd30], rax
lea rax, str.comfile
mov qword [rbp + 0xd38], rax
mov eax, esi
mov dword [rbp - 0x78], eax
lea r13, [rbp + 0xd10]
lea r15, str.Wow6432Node
mov rdi, qword [rsp + 0x68]
nop dword [rax]
mov dword [rsp + 0x70], esi
mov rbx, rsi
mov qword [rbp - 0x68], rbx
cmp dword [rdi + 0x18], 0
jl 0x1401e0c8a
lea rax, [0x14034d1a0]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], r15
jmp 0x1401e0357
lea rax, [0x14034d1a0]
mov qword [rbp + 0x340], rax
mov qword [rbp + 0x348], 0
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], 0
lea rcx, [rbp + 0x340]
test rbx, rbx
jne 0x1401e03dc
lea edx, [rbx + 4]
mov r12, 0xffffffff80000002
call fcn.1402028a0
mov eax, dword [rbp + 0x348]
inc eax
movsxd rdx, eax
lea r9d, [rbx + 4]
lea r8, [0x14034c0a8]
mov rcx, qword [rbp + 0x340]
call fcn.1402c06dc
lea edx, [rbx + 4]
lea rcx, [rbp + 0x340]
call fcn.140203bb0
mov edx, dword [rbp + 0x144]
test edx, edx
jle 0x1401e04ac
xor edx, edx
jmp 0x1401e049a
mov edx, 3
mov r12, 0xffffffff80000003
call fcn.1402028a0
mov eax, dword [rbp + 0x348]
inc eax
movsxd rdx, eax
mov r9d, 3
lea r8, [0x14034c0a0]
mov rcx, qword [rbp + 0x340]
call fcn.1402c06dc
mov edx, 3
lea rcx, [rbp + 0x340]
call fcn.140203bb0
shl rbx, 4
add rbx, qword [rdi + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x138]
call fcn.1402028a0
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x140]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x138]
call fcn.1402c06dc
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x138]
call fcn.140203bb0
mov edx, dword [rbp + 0x144]
inc edx
lea rcx, [rbp + 0x138]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x144]
mov rax, qword [rbp + 0x138]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x144]
inc edx
lea rcx, [rbp + 0x138]
call fcn.140203bb0
mov edx, dword [rbp + 0x144]
mov r14d, esi
lea r15, [rbp + 0x78]
nop dword [rax]
nop word [rax + rax]
mov qword [rbp + 0x2c0], 0
test edx, edx
jne 0x1401e04df
lea rbx, [0x14034d1a0]
mov qword [rbp + 0x2b8], rbx
jmp 0x1401e051d
lea rcx, [rbp + 0x2b8]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x144]
mov eax, dword [rbp + 0x2c0]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x2b8]
call fcn.1402c06dc
mov edx, dword [rbp + 0x144]
lea rbx, [0x14034d1a0]
lea rcx, [rbp + 0x2b8]
call fcn.140203bb0
nop
lea rdx, str.SOFTWARE
lea rcx, [rbp + 0x2b8]
call fcn.140200ef0
mov rdx, qword [r15]
lea rcx, [rbp + 0x2b8]
call fcn.140200ef0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x2b8]
call fcn.140200ef0
lea rdx, str.Classes
lea rcx, [rbp + 0x2b8]
call fcn.140200ef0
lea rax, [rbp + 0x5b8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x2b8]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401e0c07
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xb0], 0
mov rdx, qword [0x14041eee8]
lea rcx, [rbp + 0x518]
call fcn.140200840
nop
mov rdx, qword [0x14041eee8]
lea rcx, [rbp + 0x370]
call fcn.140200840
nop
mov rdx, qword [0x14041eee8]
lea rcx, [rbp + 0x360]
call fcn.140200840
nop
mov dword [rbp + 0xc8], 0x800
mov rsi, qword [r13]
lea r9, [rbp + 0xc8]
lea r8, [rbp + 0x2370]
mov rdx, rsi
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401e0786
lea rax, [rbp + 0x2370]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401e0630
test ebx, ebx
jle 0x1401e066f
mov edx, ebx
lea rcx, [rbp + 0x518]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x520]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2370]
mov rcx, qword [rbp + 0x518]
call fcn.1402c06dc
jmp 0x1401e0678
cmp dword [rbp + 0x524], 0
jle 0x1401e0686
mov edx, ebx
lea rcx, [rbp + 0x518]
call fcn.140203bb0
mov r8, qword [rbp + 0x518]
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x978]
call fcn.140202d40
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xb0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa8]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.140203bb0
nop
cmp dword [rbp + 0x980], 0
jle 0x1401e06f5
mov rcx, qword [rbp + 0x978]
call fcn.1402bd0e0
mov dword [rbp + 0xc8], 0x800
lea r9, [rbp + 0xc8]
lea r8, [rbp + 0x2370]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401e0786
lea rax, [rbp + 0x2370]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401e0730
test ebx, ebx
jle 0x1401e076f
mov edx, ebx
lea rcx, [rbp + 0x370]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x378]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2370]
mov rcx, qword [rbp + 0x370]
call fcn.1402c06dc
jmp 0x1401e0778
cmp dword [rbp + 0x37c], 0
jle 0x1401e0786
mov edx, ebx
lea rcx, [rbp + 0x370]
call fcn.140203bb0
mov r8, rsi
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x998]
call fcn.140202d40
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xb0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa8]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.140203bb0
nop
cmp dword [rbp + 0x9a0], 0
jle 0x1401e07f1
mov rcx, qword [rbp + 0x998]
call fcn.1402bd0e0
mov dword [rbp + 0xc8], 0x800
lea r9, [rbp + 0xc8]
lea r8, [rbp + 0x2370]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
or rdx, 0xffffffffffffffff
test eax, eax
jne 0x1401e088a
lea rax, [rbp + 0x2370]
mov rbx, rdx
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401e0830
test ebx, ebx
jle 0x1401e086f
mov edx, ebx
lea rcx, [rbp + 0x360]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x368]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2370]
mov rcx, qword [rbp + 0x360]
call fcn.1402c06dc
jmp 0x1401e0878
cmp dword [rbp + 0x36c], 0
jle 0x1401e088a
mov edx, ebx
lea rcx, [rbp + 0x360]
call fcn.140203bb0
or rdx, 0xffffffffffffffff
mov rcx, qword [rbp + 0x370]
test rcx, rcx
je 0x1401e0a17
mov rax, rdx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401e08a0
test rax, rax
sete al
test al, al
jne 0x1401e0a17
mov r8d, 1
lea rdx, [0x14036b658]
lea rcx, [rbp + 0x370]
call fcn.140205020
test al, al
jne 0x1401e0a17
xor eax, eax
mov qword [rbp + 0x4e0], rax
mov edx, dword [rbp + 0x37c]
test edx, edx
jne 0x1401e08fc
lea rax, [0x14034d1a0]
mov qword [rbp + 0x4d8], rax
jmp 0x1401e0933
lea rcx, [rbp + 0x4d8]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x37c]
mov eax, dword [rbp + 0x4e0]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x370]
mov rcx, qword [rbp + 0x4d8]
call fcn.1402c06dc
mov edx, dword [rbp + 0x37c]
lea rcx, [rbp + 0x4d8]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x4d8]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x4d8]
mov rcx, qword [rdi + 8]
call fcn.1400fa8d0
mov rdi, rax
test rax, rax
je 0x1401e09fd
mov rcx, qword [rbp + 0x518]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x2b8]
mov r8, qword [rbp + 0x340]
lea rdx, str._s_s_s_shellopencommand_
lea rcx, [rbp + 0x9b8]
call fcn.140202d40
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xb0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa8]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.140203bb0
nop
cmp dword [rbp + 0x9c0], 0
jle 0x1401e09ed
mov rcx, qword [rbp + 0x9b8]
call fcn.1402bd0e0
lea rdx, [rbp + 0xa8]
mov rcx, rdi
call fcn.1400edab0
nop
cmp dword [rbp + 0x4e0], 0
jle 0x1401e0a12
mov rcx, qword [rbp + 0x4d8]
call fcn.1402bd0e0
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rbp + 0x360]
test rcx, rcx
je 0x1401e0b9b
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401e0a30
test rax, rax
sete al
test al, al
jne 0x1401e0b9b
mov r8d, 1
lea rdx, [0x14036b658]
lea rcx, [rbp + 0x360]
call fcn.140205020
test al, al
jne 0x1401e0b9b
xor eax, eax
mov qword [rbp + 0x500], rax
mov edx, dword [rbp + 0x36c]
test edx, edx
jne 0x1401e0a8c
lea rax, [0x14034d1a0]
mov qword [rbp + 0x4f8], rax
jmp 0x1401e0ac3
lea rcx, [rbp + 0x4f8]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x36c]
mov eax, dword [rbp + 0x500]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x360]
mov rcx, qword [rbp + 0x4f8]
call fcn.1402c06dc
mov edx, dword [rbp + 0x36c]
lea rcx, [rbp + 0x4f8]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x4f8]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x4f8]
mov rcx, qword [rdi + 8]
call fcn.1400fa8d0
mov rdi, rax
test rax, rax
je 0x1401e0b86
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp + 0x2b8]
mov r8, qword [rbp + 0x340]
lea rdx, str._s_s_s_shellopencommand_
lea rcx, [rbp + 0x9d8]
call fcn.140202d40
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xb0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa8]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.140203bb0
nop
cmp dword [rbp + 0x9e0], 0
jle 0x1401e0b76
mov rcx, qword [rbp + 0x9d8]
call fcn.1402bd0e0
lea rdx, [rbp + 0xa8]
mov rcx, rdi
call fcn.1400edab0
nop
cmp dword [rbp + 0x500], 0
jle 0x1401e0b9b
mov rcx, qword [rbp + 0x4f8]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x368], 0
jle 0x1401e0bbf
mov rcx, qword [rbp + 0x360]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x378], 0
jle 0x1401e0bd5
mov rcx, qword [rbp + 0x370]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x520], 0
jle 0x1401e0beb
mov rcx, qword [rbp + 0x518]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0xb0], 0
jle 0x1401e0c00
mov rcx, qword [rbp + 0xa8]
call fcn.1402bd0e0
xor esi, esi
mov rdi, qword [rsp + 0x68]
cmp dword [rbp + 0x2c0], 0
jle 0x1401e0c1c
mov rcx, qword [rbp + 0x2b8]
call fcn.1402bd0e0
inc r14d
add r15, 8
movsxd rax, r14d
cmp rax, 2
jae 0x1401e0c37
mov edx, dword [rbp + 0x144]
jmp 0x1401e04c0
cmp dword [rbp + 0x140], 0
jle 0x1401e0c4d
mov rcx, qword [rbp + 0x138]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x348], 0
jle 0x1401e0c62
mov rcx, qword [rbp + 0x340]
call fcn.1402bd0e0
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rbx, qword [rbp - 0x68]
inc rbx
mov qword [rbp - 0x68], rbx
cmp eax, dword [rdi + 0x18]
jle 0x1401e0350
mov eax, dword [rbp - 0x78]
lea r15, str.Wow6432Node
inc eax
mov dword [rbp - 0x78], eax
add r13, 0x10
cdqe
cmp rax, 3
mov eax, dword [rbp - 0x78]
jb 0x1401e0320
mov r14d, esi
mov r13, qword [rsp + 0x68]
lea r12, [0x14034d1a0]
cmp dword [rdi + 0x18], 0
jl 0x1401e1075
mov rdi, rsi
lea r15, [0x140352308]
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], 0
test rdi, rdi
jne 0x1401e0ce8
mov rsi, 0xffffffff80000002
jmp 0x1401e0d76
mov rsi, 0xffffffff80000003
mov rbx, rdi
shl rbx, 4
add rbx, qword [r13 + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x1a0]
call fcn.1402028a0
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x1a8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x1a0]
call fcn.1402c06dc
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x1a0]
call fcn.140203bb0
mov edx, dword [rbp + 0x1ac]
inc edx
lea rcx, [rbp + 0x1a0]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x1ac]
mov rax, qword [rbp + 0x1a0]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x1ac]
inc edx
lea rcx, [rbp + 0x1a0]
call fcn.140203bb0
lea rdx, str.SOFTWAREClasses
lea rcx, [rbp + 0x1a0]
call fcn.140200ef0
lea rax, [rbp + 0x740]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x1a0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401e1047
mov dword [rbp + 0x7a8], 0x100
lea r9, [rbp + 0x7a8]
lea r8, [rbp + 0x1440]
mov rdx, r15
mov rcx, qword [rbp + 0x740]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401e1039
lea r8, [rbp + 0x1440]
lea rdx, str._s_shellopencommand_
lea rcx, [rbp + 0x838]
call fcn.140202d40
nop
mov dword [rbp + 0x724], 0x400
lea r9, [rbp + 0x724]
lea r8, [rbp + 0x3b70]
mov rdx, qword [rbp + 0x838]
mov rcx, qword [rbp + 0x740]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401e1024
lea rax, [rbp + 0x3b70]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401e0e40
xor eax, eax
mov qword [rbp + 0x418], rax
test ebx, ebx
jne 0x1401e0e60
mov qword [rbp + 0x410], r12
jmp 0x1401e0e8f
mov edx, ebx
lea rcx, [rbp + 0x410]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0x418]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x3b70]
mov rcx, qword [rbp + 0x410]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x410]
call fcn.140203bb0
nop
mov r8d, 1
lea rdx, [0x14036b658]
lea rcx, [rbp + 0x410]
call fcn.140205020
test al, al
jne 0x1401e100e
lea rdx, [rbp + 0x410]
call fcn.1401d86e0
lea rdx, [0x14034c0a0]
cmp rsi, 0xffffffff80000002
lea rax, [0x14034c0a8]
cmove rdx, rax
lea rcx, [rbp + 0x58]
call fcn.140200840
nop
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x58]
mov esi, 0x5c
mov word [rax + rcx*2], si
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.140203bb0
mov ebx, dword [rbp + 0x64]
add ebx, dword [rbp + 0x1ac]
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x1ac]
mov ecx, dword [rbp + 0x60]
movsxd rax, dword [rbp + 0x64]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x58]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x1a0]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.140203bb0
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x58]
mov word [rax + rcx*2], si
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.140203bb0
mov ebx, dword [rbp + 0x844]
add ebx, dword [rbp + 0x64]
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x844]
mov ecx, dword [rbp + 0x60]
movsxd rax, dword [rbp + 0x64]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x58]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x838]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.140203bb0
mov r8b, 1
lea rdx, [rbp + 0x410]
mov rcx, qword [r13 + 8]
call fcn.1400fa8d0
test rax, rax
je 0x1401e0ffe
lea rdx, [rbp + 0x58]
mov rcx, rax
call fcn.1400edab0
nop
cmp dword [rbp + 0x60], 0
jle 0x1401e100e
mov rcx, qword [rbp + 0x58]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x418], 0
jle 0x1401e1024
mov rcx, qword [rbp + 0x410]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x840], 0
jle 0x1401e1039
mov rcx, qword [rbp + 0x838]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x740]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x1a8], 0
jle 0x1401e105c
mov rcx, qword [rbp + 0x1a0]
call fcn.1402bd0e0
inc r14d
inc rdi
cmp r14d, dword [r13 + 0x18]
jle 0x1401e0cc5
xor esi, esi
lea r15, str.Wow6432Node
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], r15
mov r15d, esi
mov dword [rsp + 0x70], esi
lea r12, [rbp + 0x78]
mov qword [rbp - 0x68], r12
nop
lea r8, str.SOFTWARE
mov edx, 0x104
lea rcx, [rbp + 0xe10]
call fcn.1402bcbb8
mov r8, qword [r12]
mov edx, 0x104
lea rcx, [rbp + 0xe10]
call fcn.1402bf098
lea r8, str.ClientsStartMenuInternet_
mov edx, 0x104
lea rcx, [rbp + 0xe10]
call fcn.1402bf098
call fcn.1400ed890
mov qword [rbp + 0x8c8], rsi
lea rcx, [rbp + 0x8c8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0xe10]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401e14c7
lea ecx, [rax + 0x10]
call fcn.1402bcb4c
mov r14, rax
mov qword [rbp + 0x758], rax
lea rbx, vtable.Core::Array_class_Core::String_.0
test rax, rax
je 0x1401e14ce
mov rcx, qword [rbp + 0x8c8]
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [r14], rax
mov qword [r14 + 8], rcx
mov qword [rbp + 0xd10], rbx
mov dword [rbp + 0xd18], esi
mov qword [rbp + 0xd20], rsi
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xd10]
mov rcx, r14
call fcn.1400ed120
test al, al
je 0x1401e14a2
mov eax, dword [rbp + 0xd18]
test eax, eax
jle 0x1401e14a2
mov rdi, qword [rbp + 0xd20]
mov esi, eax
xor r14d, r14d
lea r15, [0x14034d1a0]
or r12, 0xffffffffffffffff
nop word [rax + rax]
lea r8, [rbp + 0xe10]
mov edx, 0x104
lea rcx, [rbp + 0x1020]
call fcn.1402bcbb8
mov r8, qword [rdi]
mov edx, 0x104
lea rcx, [rbp + 0x1020]
call fcn.1402bf098
lea r8, str._shellopencommand
mov edx, 0x104
lea rcx, [rbp + 0x1020]
call fcn.1402bf098
mov dword [rbp + 0x7dc], 0x208
lea r9, [rbp + 0x7dc]
lea r8, [rbp + 0x1540]
lea rdx, [rbp + 0x1020]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401e147e
lea rax, [rbp + 0x1540]
mov rbx, r12
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401e1232
mov qword [rbp + 0xa0], r14
test ebx, ebx
jne 0x1401e1250
mov qword [rbp + 0x98], r15
jmp 0x1401e127f
mov edx, ebx
lea rcx, [rbp + 0x98]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp + 0xa0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1540]
mov rcx, qword [rbp + 0x98]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x98]
call fcn.140203bb0
nop
mov r8d, 1
lea rdx, [0x140355194]
lea rcx, [rbp + 0x98]
call fcn.140205020
lea rcx, [rbp + 0x98]
test al, al
je 0x1401e1343
mov r8d, 1
lea rdx, [0x140355194]
call fcn.140203160
test eax, eax
jle 0x1401e13c2
lea r9d, [rax - 1]
mov r8d, 1
lea rdx, [rbp + 0x9f8]
lea rcx, [rbp + 0x98]
call fcn.140204ad0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x98]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xa0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x98]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x98]
call fcn.140203bb0
nop
cmp dword [rbp + 0xa00], 0
jle 0x1401e13c2
mov rcx, qword [rbp + 0x9f8]
jmp 0x1401e13bd
lea rdx, str..exe
call fcn.140203040
test eax, eax
js 0x1401e13c2
lea r9d, [rax + 4]
xor r8d, r8d
lea rdx, [rbp + 0xa68]
lea rcx, [rbp + 0x98]
call fcn.140204ad0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x98]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xa0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x98]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x98]
call fcn.140203bb0
nop
cmp dword [rbp + 0xa70], 0
jle 0x1401e13c2
mov rcx, qword [rbp + 0xa68]
call fcn.1402bd0e0
lea rdx, [rbp + 0x98]
call fcn.1401d86e0
cmp dword [rbp + 0xa4], 0
jle 0x1401e1469
mov r8b, 1
lea rdx, [rbp + 0x98]
mov rcx, qword [r13 + 8]
call fcn.1400fa8d0
mov rbx, rax
test rax, rax
je 0x1401e1469
lea rdx, [0x14034c0a8]
lea rcx, [rbp + 0x858]
call fcn.140200840
nop
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x858]
call fcn.140200ef0
lea rdx, [rbp + 0x1020]
lea rcx, [rbp + 0x858]
call fcn.140200ef0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x858]
call fcn.140200ef0
lea rdx, [rbp + 0x858]
mov rcx, rbx
call fcn.1400edab0
nop
cmp dword [rbp + 0x860], 0
jle 0x1401e1469
mov rcx, qword [rbp + 0x858]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0xa0], 0
jle 0x1401e147e
mov rcx, qword [rbp + 0x98]
call fcn.1402bd0e0
add rdi, 0x10
dec rsi
jne 0x1401e11b0
mov r14, qword [rbp + 0x758]
mov r15d, dword [rsp + 0x70]
mov r12, qword [rbp - 0x68]
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
nop
mov qword [rbp + 0xd10], rbx
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
jmp 0x1401e14ce
lea rbx, vtable.Core::Array_class_Core::String_.0
inc r15d
mov dword [rsp + 0x70], r15d
add r12, 8
mov qword [rbp - 0x68], r12
movsxd rax, r15d
cmp rax, 2
jb 0x1401e1090
lea rdx, str.HKLMSOFTWAREMozillaPlugins
lea rcx, [rbp + 0x798]
call fcn.140200840
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x798]
call fcn.1400ed8e0
mov r12, rax
test rax, rax
je 0x1401e17ba
mov qword [rbp + 0xd10], rbx
mov dword [rbp + 0xd18], esi
mov qword [rbp + 0xd20], rsi
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xd10]
mov rcx, r12
call fcn.1400ed120
test al, al
je 0x1401e1795
mov eax, dword [rbp + 0xd18]
test eax, eax
jle 0x1401e1795
mov rsi, qword [rbp + 0xd20]
mov r15d, eax
lea r14, [0x14034d1a0]
nop word [rax + rax]
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, r12
call fcn.1400ed560
mov rdi, rax
test rax, rax
je 0x1401e177f
mov qword [rbp + 0x780], r14
xor ebx, ebx
mov qword [rbp + 0x788], rbx
mov qword [rbp + 0x808], r14
mov qword [rbp + 0x810], rbx
lea r8, [rbp + 0x780]
lea rdx, str.Path
mov rcx, rax
call fcn.1400d9fd0
test al, al
je 0x1401e1746
xor r8d, r8d
lea rdx, str.disabled
lea rcx, [rbp + 0x780]
call fcn.140202b80
test al, al
jne 0x1401e1746
mov r8b, 1
lea rdx, [rbp + 0x780]
mov rcx, qword [r13 + 8]
call fcn.1400fa8d0
mov r14, rax
test rax, rax
je 0x1401e173f
mov qword [rbp + 0x1f8], rbx
mov edx, dword [rbp + 0x7a4]
test edx, edx
jne 0x1401e1634
lea rax, [0x14034d1a0]
mov qword [rbp + 0x1f0], rax
jmp 0x1401e166b
lea rcx, [rbp + 0x1f0]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x7a4]
mov eax, dword [rbp + 0x1f8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x798]
mov rcx, qword [rbp + 0x1f0]
call fcn.1402c06dc
mov edx, dword [rbp + 0x7a4]
lea rcx, [rbp + 0x1f0]
call fcn.140203bb0
nop
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x1f0]
call fcn.140200ef0
mov ebx, dword [rbp + 0x1fc]
add ebx, dword [rsi + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x1f0]
call fcn.1402028a0
movsxd r9, dword [rsi + 0xc]
mov ecx, dword [rbp + 0x1f8]
movsxd rax, dword [rbp + 0x1fc]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1f0]
lea rcx, [rax + rcx*2]
mov r8, qword [rsi]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x1f0]
call fcn.140203bb0
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x1f0]
call fcn.140200ef0
lea rdx, [rbp + 0x1f0]
mov rcx, r14
call fcn.1400edab0
lea r8, [rbp + 0x808]
lea rdx, str.XPTPath
mov rcx, rdi
call fcn.1400d9fd0
test al, al
je 0x1401e172a
lea rdx, [rbp + 0x808]
mov rcx, r14
call fcn.1400e5650
nop
cmp dword [rbp + 0x1f8], 0
jle 0x1401e173f
mov rcx, qword [rbp + 0x1f0]
call fcn.1402bd0e0
lea r14, [0x14034d1a0]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x810], 0
jle 0x1401e176a
mov rcx, qword [rbp + 0x808]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x788], 0
jle 0x1401e177f
mov rcx, qword [rbp + 0x780]
call fcn.1402bd0e0
add rsi, 0x10
dec r15
jne 0x1401e1580
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp + 0xd10], rbx
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x7a0], 0
jle 0x1401e17cf
mov rcx, qword [rbp + 0x798]
call fcn.1402bd0e0
lea rdx, str.HKLMSOFTWAREClassesDirectoryShellexCopyHookHandlers
lea rcx, [rbp + 0x7c8]
call fcn.140200840
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x7c8]
call fcn.1400ed8e0
mov r15, rax
test rax, rax
je 0x1401e1a20
mov qword [rbp + 0xd10], rbx
mov dword [rbp + 0xd18], esi
mov qword [rbp + 0xd20], rsi
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xd10]
mov rcx, r15
call fcn.1400ed120
test al, al
je 0x1401e19fc
mov eax, dword [rbp + 0xd18]
test eax, eax
jle 0x1401e19fc
mov rdi, qword [rbp + 0xd20]
mov r14d, eax
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, r15
call fcn.1400ed560
mov rsi, rax
test rax, rax
je 0x1401e19e6
lea r12, [0x14034d1a0]
mov qword [rbp + 0x7b0], r12
xor ebx, ebx
mov qword [rbp + 0x7b8], rbx
lea r8, [rbp + 0x7b0]
xor edx, edx
mov rcx, rax
call fcn.1400d9fd0
test al, al
je 0x1401e19c3
lea r8d, [rbx + 1]
lea rdx, [0x140355efc]
lea rcx, [rbp + 0x7b0]
call fcn.140205020
test al, al
je 0x1401e19c3
mov qword [rbp + 0x50], rbx
mov edx, dword [rbp + 0x7d4]
test edx, edx
jne 0x1401e18cf
mov qword [rbp + 0x48], r12
jmp 0x1401e18fd
lea rcx, [rbp + 0x48]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x7d4]
mov eax, dword [rbp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x7c8]
mov rcx, qword [rbp + 0x48]
call fcn.1402c06dc
mov edx, dword [rbp + 0x7d4]
lea rcx, [rbp + 0x48]
call fcn.140203bb0
nop
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x54]
mov rax, qword [rbp + 0x48]
mov r12d, 0x5c
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.140203bb0
mov ebx, dword [rbp + 0x54]
add ebx, dword [rdi + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.1402028a0
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rbp + 0x50]
movsxd rax, dword [rbp + 0x54]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x48]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.140203bb0
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x54]
mov rax, qword [rbp + 0x48]
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.140203bb0
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x7b0]
mov rcx, r13
call fcn.1401d5240
nop
cmp dword [rbp + 0x50], 0
jle 0x1401e19c3
mov rcx, qword [rbp + 0x48]
call fcn.1402bd0e0
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp + 0x7b8], 0
jle 0x1401e19e6
mov rcx, qword [rbp + 0x7b0]
call fcn.1402bd0e0
add rdi, 0x10
dec r14
jne 0x1401e1852
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r15]
mov edx, 1
mov rcx, r15
call qword [rax]
nop
mov qword [rbp + 0xd10], rbx
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x7d0], 0
jle 0x1401e1a35
mov rcx, qword [rbp + 0x7c8]
call fcn.1402bd0e0
lea rdx, str.HKLMSOFTWAREWow6432NodeMozillaFirefoxExtensions
lea rcx, [rbp + 0x7f0]
call fcn.140200840
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x7f0]
call fcn.1400ed8e0
mov r12, rax
test rax, rax
je 0x1401e1ec7
mov qword [rbp + 0xd10], rbx
mov dword [rbp + 0xd18], esi
mov qword [rbp + 0xd20], rsi
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xd10]
mov rcx, r12
call fcn.1400ed400
test al, al
je 0x1401e1eb1
mov ecx, dword [rbp + 0xd18]
test ecx, ecx
jle 0x1401e1eb1
mov rsi, qword [rbp + 0xd20]
add rsi, 0xc
mov r15d, ecx
lea r14, vtable.Core::ByteArray.0
xor ebx, ebx
nop word [rax + rax]
mov qword [rbp + 0x3a8], 0
mov edx, dword [rsi]
test edx, edx
jne 0x1401e1af1
lea rdi, [0x14034d1a0]
mov qword [rbp + 0x3a0], rdi
jmp 0x1401e1b22
lea rcx, [rbp + 0x3a0]
call fcn.1402028a0
movsxd r9, dword [rsi]
mov eax, dword [rbp + 0x3a8]
inc eax
movsxd rdx, eax
mov r8, qword [rsi - 0xc]
mov rcx, qword [rbp + 0x3a0]
call fcn.1402c06dc
lea rdi, [0x14034d1a0]
mov edx, dword [rsi]
lea rcx, [rbp + 0x3a0]
call fcn.140203bb0
nop
mov r8d, 1
lea rdx, [0x140355efc]
lea rcx, [rbp + 0x3a0]
call fcn.140205020
test al, al
je 0x1401e1e86
mov qword [rbp + 0x350], rdi
mov qword [rbp + 0x358], 0
lea r8, [rbp + 0x350]
mov rdx, qword [rbp + 0x3a0]
mov rcx, r12
call fcn.1400d9fd0
test al, al
je 0x1401e1e70
lea rdx, str.chromecontentoverlay.xul
lea rcx, [rbp + 0x8f8]
call fcn.140200840
nop
lea r8, [rbp + 0x8f8]
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x8e8]
call fcn.1400d4050
nop
cmp dword [rbp + 0x900], 0
jle 0x1401e1bc6
mov rcx, qword [rbp + 0x8f8]
call fcn.1402bd0e0
mov qword [rbp + 0xd40], r14
mov dword [rbp + 0xd48], ebx
mov qword [rbp + 0xd50], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp + 0xd58], rax
lea rdx, [rbp + 0xd40]
lea rcx, [rbp + 0x8e8]
call fcn.14020c740
mov r14, qword [rbp + 0xd50]
test al, al
je 0x1401e1e22
mov qword [rbp + 0xd60], 0
movups xmm0, xmmword [0x14032eb00]
movups xmmword [rbp + 0xd68], xmm0
movups xmm1, xmmword [0x14032eb10]
movups xmmword [rbp + 0xd78], xmm1
lea r8, [rbp + 0xd60]
mov edx, dword [rbp + 0xd48]
mov rcx, r14
call fcn.14018f300
lea rdx, [rbp + 0xd60]
lea rcx, [rbp + 0xdf0]
call fcn.14018f3f0
mov r8b, 1
lea rdx, [rbp + 0x8e8]
mov rcx, qword [r13 + 8]
call fcn.1400fa8d0
mov rdi, rax
test rax, rax
je 0x1401e1e22
mov qword [rbp + 0x248], 0
mov edx, dword [rbp + 0x7fc]
test edx, edx
jne 0x1401e1c9c
lea rax, [0x14034d1a0]
mov qword [rbp + 0x240], rax
jmp 0x1401e1cd3
lea rcx, [rbp + 0x240]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x7fc]
mov eax, dword [rbp + 0x248]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x7f0]
mov rcx, qword [rbp + 0x240]
call fcn.1402c06dc
mov edx, dword [rbp + 0x7fc]
lea rcx, [rbp + 0x240]
call fcn.140203bb0
nop
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x240]
call fcn.140200ef0
mov ebx, dword [rbp + 0x24c]
add ebx, dword [rbp + 0x3ac]
mov edx, ebx
lea rcx, [rbp + 0x240]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x3ac]
mov ecx, dword [rbp + 0x248]
movsxd rax, dword [rbp + 0x24c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x240]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x3a0]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x240]
call fcn.140203bb0
lea rdx, [rbp + 0x240]
mov rcx, rdi
call fcn.1400edab0
mov r8d, 1
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x350]
call fcn.140202750
test al, al
jne 0x1401e1dbb
mov edx, dword [rbp + 0x35c]
inc edx
lea rcx, [rbp + 0x350]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x35c]
mov rax, qword [rbp + 0x350]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x35c]
inc edx
lea rcx, [rbp + 0x350]
call fcn.140203bb0
lea rdx, [rbp + 0x350]
mov rcx, rdi
call fcn.1400e5650
lea rdx, [rbp + 0xdf0]
mov rcx, rdi
call fcn.14016b340
mov rbx, qword [r13 + 8]
cmp qword [rbx + 0x438], 0
je 0x1401e1e0b
mov eax, dword [rdi + 0x40]
shr rax, 0x14
test al, 1
jne 0x1401e1dfb
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rdx, rdi
mov rcx, qword [rbx + 0x438]
call fcn.1401d18d0
nop
cmp dword [rbp + 0x248], 0
jle 0x1401e1e20
mov rcx, qword [rbp + 0x240]
call fcn.1402bd0e0
xor ebx, ebx
lea rax, vtable.Core::ByteArray.0
mov qword [rbp + 0xd40], rax
test r14, r14
je 0x1401e1e54
mov r8, r14
xor edx, edx
mov rcx, qword [rbp + 0xd58]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0xd50], rbx
mov dword [rbp + 0xd48], ebx
cmp dword [rbp + 0x8f0], 0
jle 0x1401e1e69
mov rcx, qword [rbp + 0x8e8]
call fcn.1402bd0e0
lea r14, vtable.Core::ByteArray.0
cmp dword [rbp + 0x358], 0
jle 0x1401e1e86
mov rcx, qword [rbp + 0x350]
call fcn.1402bd0e0
nop
cmp dword [rbp + 0x3a8], 0
jle 0x1401e1e9b
mov rcx, qword [rbp + 0x3a0]
call fcn.1402bd0e0
add rsi, 0x10
dec r15
jne 0x1401e1ad0
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0xd10], rbx
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x7f8], 0
jle 0x1401e1edc
mov rcx, qword [rbp + 0x7f0]
call fcn.1402bd0e0
mov rcx, r13
call fcn.1401e2360
mov rcx, r13
call fcn.1401e3d10
mov rax, qword [r13 + 8]
cmp dword [rax + 0x10], 1
je 0x1401e22cd
lea rax, str.SoftwareMicrosoftWindowsShellNoRoamMUICache
mov qword [rbp + 0x78], rax
lea rax, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov qword [rbp + 0x80], rax
mov dword [rbp - 0x78], esi
cmp dword [r13 + 0x18], 0
jle 0x1401e22cd
mov r14, rsi
mov qword [rbp + 0xd0], rsi
mov r15, qword [rsp + 0x68]
mov r13d, esi
mov dword [rsp + 0x70], esi
lea rsi, [rbp + 0x78]
mov qword [rbp - 0x68], rsi
nop
lea rdx, [0x14034c0a0]
lea rcx, [rbp + 0x68]
call fcn.140200840
nop
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
mov r12d, 0x5c
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.140203bb0
mov rdi, qword [r15 + 0x20]
mov ebx, dword [rbp + 0x74]
add ebx, dword [rdi + r14 + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x68]
call fcn.1402028a0
movsxd r9, dword [rdi + r14 + 0xc]
mov ecx, dword [rbp + 0x70]
movsxd rax, dword [rbp + 0x74]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x68]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi + r14]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x68]
call fcn.140203bb0
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1402028a0
movsxd rcx, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.140203bb0
mov rdx, qword [rsi]
lea rcx, [rbp + 0x68]
call fcn.140200ef0
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x68]
call fcn.1400ed8e0
mov r12, rax
mov qword [rbp + 0x758], rax
test rax, rax
je 0x1401e227f
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0xd10], rax
xor ebx, ebx
mov dword [rbp + 0xd18], ebx
mov qword [rbp + 0xd20], rbx
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xd10]
mov rcx, r12
call fcn.1400ed400
test al, al
je 0x1401e2253
mov eax, dword [rbp + 0xd18]
test eax, eax
jle 0x1401e2253
mov rsi, qword [rbp + 0xd20]
lea rdi, [rsi + 0xc]
mov r15d, eax
mov r12, qword [rsp + 0x68]
lea r13, [0x14034d1a0]
nop word [rax + rax]
cmp dword [rdi], 2
jl 0x1401e2226
mov edx, 1
mov rcx, rsi
call fcn.140200d70
cmp ax, 0x3a
jne 0x1401e2226
mov qword [rbp + 0x460], 0
mov edx, dword [rdi]
test edx, edx
jne 0x1401e20ca
mov qword [rbp + 0x458], r13
jmp 0x1401e20f4
lea rcx, [rbp + 0x458]
call fcn.1402028a0
movsxd r9, dword [rdi]
mov eax, dword [rbp + 0x460]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0xc]
mov rcx, qword [rbp + 0x458]
call fcn.1402c06dc
mov edx, dword [rdi]
lea rcx, [rbp + 0x458]
call fcn.140203bb0
nop
lea rdx, [rbp + 0x458]
call fcn.1401d86e0
mov r8b, 1
lea rdx, [rbp + 0x458]
mov rcx, qword [r12 + 8]
call fcn.1400fa8d0
mov r14, rax
test rax, rax
je 0x1401e2211
mov qword [rbp + 0x298], 0
mov edx, dword [rbp + 0x74]
test edx, edx
jne 0x1401e214a
mov qword [rbp + 0x290], r13
jmp 0x1401e2178
lea rcx, [rbp + 0x290]
call fcn.1402028a0
movsxd r9, dword [rbp + 0x74]
mov eax, dword [rbp + 0x298]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x290]
call fcn.1402c06dc
mov edx, dword [rbp + 0x74]
lea rcx, [rbp + 0x290]
call fcn.140203bb0
nop
lea rdx, [0x14034c088]
lea rcx, [rbp + 0x290]
call fcn.140200ef0
mov ebx, dword [rbp + 0x29c]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x290]
call fcn.1402028a0
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x298]
movsxd rax, dword [rbp + 0x29c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x290]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp + 0x290]
call fcn.140203bb0
lea rdx, [rbp + 0x290]
mov rcx, r14
call fcn.1400e5650
nop
cmp dword [rbp + 0x298], 0
jle 0x1401e220f
mov rcx, qword [rbp + 0x290]
call fcn.1402bd0e0
xor ebx, ebx
cmp dword [rbp + 0x460], 0
jle 0x1401e2226
mov rcx, qword [rbp + 0x458]
call fcn.1402bd0e0
add rsi, 0x10
add rdi, 0x10
dec r15
jne 0x1401e2090
mov r12, qword [rbp + 0x758]
mov r13d, dword [rsp + 0x70]
mov rsi, qword [rbp - 0x68]
mov r14, qword [rbp + 0xd0]
mov r15, qword [rsp + 0x68]
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
lea rbx, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0xd10], rbx
xor edx, edx
lea rcx, [rbp + 0xd10]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x70], 0
jle 0x1401e228e
mov rcx, qword [rbp + 0x68]
call fcn.1402bd0e0
inc r13d
mov dword [rsp + 0x70], r13d
add rsi, 8
mov qword [rbp - 0x68], rsi
movsxd rax, r13d
cmp rax, 2
jb 0x1401e1f40
mov eax, dword [rbp - 0x78]
inc eax
mov dword [rbp - 0x78], eax
add r14, 0x10
mov qword [rbp + 0xd0], r14
cmp eax, dword [r15 + 0x18]
mov esi, 0
jl 0x1401e1f30
mov r8, qword [rbp + 0x170]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x170]
call fcn.140009b50
lea rcx, [rbp + 0x170]
call fcn.140009260
nop
lea rcx, [rbp + 0x558]
call fcn.14015b650
nop
lea rcx, [rbp + 0x868]
call fcn.1400c7d10
nop
lea rcx, [rbp + 0x2d0]
call fcn.140005eb0
nop
lea rcx, [rsp + 0x78]
call fcn.140005eb0
mov al, 1
mov rcx, qword [rbp + 0xf770]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0xf880]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret