Function at 0x14000d48c
Capabilities:
Copy file
Get keyboard layout
Query environment variable
Query or enumerate registry value
Set environment variable
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x508]
sub rsp, 0x5e0
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
mov r15, rcx
mov qword [rbp - 0x58], rcx
call fcn.14004e968
nop
lea r14, [r15 + 0x128]
mov rdx, r15
mov rcx, r14
call fcn.1400fc070
nop
lea r13, [r15 + 0x188]
mov rcx, r13
call fcn.1400586c0
nop
lea rsi, [r15 + 0x1d8]
mov rcx, rsi
call fcn.140059d14
nop
lea rdi, [r15 + 0x218]
mov rcx, rdi
call fcn.14002eb38
nop
lea rbx, [r15 + 0x260]
mov rcx, rbx
call fcn.140031a74
nop
lea r12, [r15 + 0x4e8]
mov rdx, r15
mov rcx, r12
call fcn.14003e328
nop
lea rax, vtable.CConEmuMain.0
mov qword [r15], rax
lea rax, vtable.CConEmuMain.1.0
mov qword [r14], rax
lea rax, vtable.CConEmuMain.2.0
mov qword [r13], rax
lea rax, vtable.CConEmuMain.3.0
mov qword [rsi], rax
lea rax, vtable.CConEmuMain.4.0
mov qword [rdi], rax
lea rax, vtable.CConEmuMain.5.0
mov qword [rbx], rax
lea rax, vtable.CConEmuMain.6.0
mov qword [r12], rax
xor r13d, r13d
mov word [r15 + 0xa90], r13w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r15 + 0xa92], xmm0
movups xmmword [r15 + 0xaa2], xmm0
movups xmmword [r15 + 0xab2], xmm0
mov qword [r15 + 0xac2], rax
mov qword [r15 + 0xaca], rax
movups xmmword [r15 + 0xad2], xmm0
mov qword [r15 + 0xae2], rax
mov qword [r15 + 0xaea], rax
lea rcx, [r15 + 0xaf2]
mov ebx, 0x208
mov r8d, ebx
xor edx, edx
call fcn.14013b230
lea rdi, [r15 + 0xcfa]
mov word [rdi], r13w
lea rcx, [r15 + 0xcfc]
mov r8d, ebx
xor edx, edx
call fcn.14013b230
lea rsi, [r15 + 0xf04]
mov word [rsi], r13w
lea rcx, [r15 + 0xf06]
mov r8d, ebx
xor edx, edx
call fcn.14013b230
mov word [r15 + 0x110e], r13w
lea rcx, [r15 + 0x1110]
mov r8d, ebx
xor edx, edx
call fcn.14013b230
mov word [r15 + 0x1318], r13w
lea rcx, [r15 + 0x131a]
xor edx, edx
lea r8d, [r13 + 0x4e]
call fcn.14013b230
mov byte [r15 + 0x1368], r13b
lea rcx, [r15 + 0x1370]
call fcn.140120d54
nop
mov word [r15 + 0x1380], r13w
lea rcx, [r15 + 0x1382]
xor edx, edx
lea r8d, [rbx - 2]
call fcn.14013b230
lea rcx, [r15 + 0x1588]
call fcn.140120d54
nop
lea rcx, [r15 + 0x1598]
call fcn.140120d54
nop
lea rcx, [r15 + 0x15a8]
call fcn.140120d54
nop
mov qword [r15 + 0x15b8], r13
mov qword [r15 + 0x15c0], r13
mov byte [r15 + 0x15c8], r13b
mov dword [r15 + 0x15cc], r13d
mov word [r15 + 0x15d0], r13w
mov dword [r15 + 0x15d4], 0xff
mov word [r15 + 0x15d9], r13w
mov byte [r15 + 0x15db], r13b
lea r14, [r15 + 0x15dc]
mov word [r14], r13w
lea rcx, [r15 + 0x15de]
mov r8d, ebx
xor edx, edx
call fcn.14013b230
mov word [r15 + 0x17e6], r13w
lea rcx, [r15 + 0x17e8]
mov r8d, ebx
xor edx, edx
call fcn.14013b230
lea r12, [r15 + 0x19f0]
mov word [r12], r13w
lea rcx, [r15 + 0x19f2]
mov r8d, ebx
xor edx, edx
call fcn.14013b230
lea r13, [r15 + 0x1bfa]
xor eax, eax
mov word [r13], ax
lea rcx, [r15 + 0x1bfc]
mov ebx, 0x21e
mov r8d, ebx
xor edx, edx
call fcn.14013b230
xor ecx, ecx
mov word [r15 + 0x1e1a], cx
lea rcx, [r15 + 0x1e1c]
mov r8d, ebx
xor edx, edx
call fcn.14013b230
mov ebx, 0x143e
mov dword [r15 + 0x203a], ebx
lea rcx, [r15 + 0x203e]
xor edx, edx
lea r8d, [rbx - 4]
call fcn.14013b230
xor eax, eax
mov qword [r15 + 0x3478], rax
mov qword [r15 + 0x3480], rax
mov word [r15 + 0x3488], ax
mov qword [r15 + 0x348c], rbx
mov word [r15 + 0x3494], ax
lea rcx, [r15 + 0x3496]
xor edx, edx
mov r8d, 0xfe
call fcn.14013b230
xorps xmm0, xmm0
movups xmmword [r15 + 0x3598], xmm0
movups xmmword [r15 + 0x35a8], xmm0
movups xmmword [r15 + 0x35b8], xmm0
xor eax, eax
mov qword [r15 + 0x35c8], rax
mov word [r15 + 0x35d0], ax
lea rcx, [r15 + 0x35d2]
mov ebx, 0x40e
mov r8d, ebx
xor edx, edx
call fcn.14013b230
nop
xor eax, eax
mov qword [r15 + 0x39e0], rax
mov qword [r15 + 0x39e8], rax
mov word [r15 + 0x39f0], ax
mov qword [r15 + 0x39f4], 0x143e
mov word [r15 + 0x39fc], ax
lea rcx, [r15 + 0x39fe]
xor edx, edx
mov r8d, 0xfe
call fcn.14013b230
xorps xmm0, xmm0
movups xmmword [r15 + 0x3b00], xmm0
movups xmmword [r15 + 0x3b10], xmm0
movups xmmword [r15 + 0x3b20], xmm0
xor eax, eax
mov qword [r15 + 0x3b30], rax
mov word [r15 + 0x3b38], ax
lea rcx, [r15 + 0x3b3a]
mov r8d, ebx
xor edx, edx
call fcn.14013b230
nop
xor ebx, ebx
mov byte [r15 + 0x3f48], bl
lea rcx, [r15 + 0x3f50]
lea edx, [rbx + 2]
call fcn.14013897c
nop
mov qword [r15 + 0x3fa0], rbx
mov qword [r15 + 0x3fa8], rbx
mov qword [r15 + 0x3fc0], rbx
mov qword [r15 + 0x3fd0], rbx
mov qword [r15 + 0x3ff0], rbx
mov qword [r15 + 0x3ff8], rbx
mov dword [r15 + 0x4000], ebx
xorps xmm0, xmm0
movups xmmword [r15 + 0x4004], xmm0
movups xmmword [r15 + 0x4014], xmm0
mov qword [r15 + 0x4024], rbx
mov byte [r15 + 0x402c], bl
xor eax, eax
movups xmmword [r15 + 0x402e], xmm0
mov word [r15 + 0x403e], ax
mov dword [r15 + 0x4040], ebx
mov qword [r15 + 0x4044], rax
mov dword [r15 + 0x404c], ebx
xor ecx, ecx
mov qword [r15 + 0x4050], rcx
mov dword [r15 + 0x4058], ebx
or rax, 0xffffffffffffffff
mov qword [r15 + 0x4060], rax
mov qword [r15 + 0x4068], rax
xor eax, eax
mov qword [r15 + 0x4070], rax
mov dword [r15 + 0x4078], ebx
mov word [r15 + 0x407c], bx
movups xmmword [r15 + 0x4080], xmm0
mov qword [r15 + 0x4090], rax
mov qword [r15 + 0x4098], rbx
lea rcx, [r15 + 0x40a0]
xor edx, edx
mov r8d, 0x830
call fcn.14013b230
mov byte [r15 + 0x48d1], bl
mov qword [r15 + 0x48d8], rbx
mov byte [r15 + 0x48e0], bl
mov dword [r15 + 0x48e4], ebx
xorps xmm0, xmm0
movups xmmword [r15 + 0x48e8], xmm0
mov qword [r15 + 0x48f8], rbx
mov dword [r15 + 0x4900], ebx
mov dword [r15 + 0x4904], 1
movups xmmword [r15 + 0x4908], xmm0
mov byte [r15 + 0x4918], bl
mov dword [r15 + 0x491c], ebx
movups xmmword [r15 + 0x4920], xmm0
mov dword [r15 + 0x4930], ebx
mov byte [r15 + 0x4934], bl
mov qword [r15 + 0x4960], rbx
mov qword [r15 + 0x4968], rbx
mov qword [r15 + 0x4970], rbx
mov qword [r15 + 0x4978], rbx
mov qword [r15 + 0x4980], rbx
mov word [r15 + 0x4988], bx
mov dword [r15 + 0x498c], ebx
mov word [r15 + 0x4990], bx
lea rcx, [r15 + 0x4998]
call fcn.14005b8b8
nop
mov word [r15 + 0x4dc0], bx
lea rcx, [r15 + 0x4dc2]
xor edx, edx
mov r8d, 0x97e
call fcn.14013b230
mov word [r15 + 0x5740], bx
lea rcx, [r15 + 0x5742]
xor edx, edx
mov r8d, 0xfe
call fcn.14013b230
or rax, 0xffffffffffffffff
mov word [r15 + 0x5840], ax
mov dword [r15 + 0x5842], ebx
mov qword [r15 + 0x5848], rbx
mov qword [r15 + 0x5850], rbx
mov dword [r15 + 0x5858], ebx
xor eax, eax
mov qword [r15 + 0x585c], rax
mov dword [r15 + 0x5864], eax
mov byte [r15 + 0x5868], bl
mov dword [r15 + 0x586c], ebx
mov qword [r15 + 0x5870], rbx
mov qword [r15 + 0x5878], rbx
lea rcx, [r15 + 0x5880]
xor edx, edx
mov r8d, 0x2150
call fcn.14013b230
mov word [r15 + 0x79d0], bx
mov byte [r15 + 0x79d2], bl
mov word [r15 + 0x79d4], bx
lea rcx, [r15 + 0x79d6]
xor edx, edx
mov r8d, 0x206
call fcn.14013b230
mov byte [r15 + 0x7bdc], bl
mov qword [r15 + 0x7be0], rbx
mov byte [r15 + 0x7be8], bl
mov dword [r15 + 0x7bec], ebx
mov qword [r15 + 0x7bf0], rbx
mov byte [r15 + 0x7bf8], bl
mov dword [r15 + 0x7bfc], ebx
mov qword [r15 + 0x7c00], rbx
mov qword [r15 + 0x7c08], rbx
mov qword [r15 + 0x7c10], rbx
mov qword [r15 + 0x7c18], rbx
xor eax, eax
mov qword [r15 + 0x7c20], rax
mov dword [r15 + 0x7c28], ebx
or rax, 0xffffffffffffffff
mov dword [r15 + 0x7c2c], eax
mov word [r15 + 0x7c30], bx
mov byte [r15 + 0x7c32], bl
mov qword [r15 + 0x7c38], rbx
mov qword [r15 + 0x7c48], rbx
mov qword [r15 + 0x7c50], rbx
mov qword [r15 + 0x7c58], rbx
mov qword [r15 + 0x7c60], rbx
mov dword [r15 + 0x7d08], ebx
xorps xmm0, xmm0
movups xmmword [r15 + 0x7d10], xmm0
movups xmmword [r15 + 0x7d20], xmm0
mov dword [r15 + 0x7d30], ebx
mov qword [r15 + 0x7d38], rbx
mov qword [r15 + 0x7d40], rbx
mov qword [r15 + 0x7d48], rbx
mov qword [r15 + 0x7d50], rbx
mov qword [r15 + 0x7d58], rbx
lea rbx, [r15 + 0x7d60]
mov qword [rsp + 0x58], rbx
call fcn.140120014
xor ecx, ecx
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rcx
mov qword [r15 + 0x7d78], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r15 + 0x7d80], xmm0
mov qword [r15 + 0x7d90], rax
mov qword [r15 + 0x7d98], rcx
mov qword [r15 + 0x7da0], rcx
lea rcx, [r15 + 0x7da8]
lea edx, [rax + 2]
call fcn.14013897c
nop
mov qword [0x14021c5d8], r15
call fcn.1401103f8
call fcn.14002d944
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov r8d, 8
lea rbx, [0x14015a140]
mov rdx, rbx
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
cmp word [rbp - 0x20], ax
je 0x14000dc78
cmp word [rbp - 0x1e], ax
lea rax, [0x140167eec]
jne 0x14000dc7b
mov rax, rbx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x12
mov r9d, 0xc
lea r8d, [r9 + 0xa]
lea rdx, [0x140167ef0]
lea rbx, [r15 + 0xad0]
mov rcx, rbx
call fcn.14000cfdc
lea rax, [0x14015a140]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, rbx
lea rdx, [0x14016abd0]
lea rcx, [r15 + 0xa90]
call fcn.140001190
mov rcx, r15
call fcn.140020004
lea rcx, [rbp - 0x50]
call fcn.14000ce60
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rcx + 8]
xor r8d, r8d
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [r15 + 0x7c00], rax
mov rbx, qword [r15 + 0x7c08]
mov qword [r15 + 0x7c08], rdx
or rcx, 0xffffffffffffffff
test rbx, rbx
je 0x14000dd4b
mov eax, ecx
lock xadd dword [rbx + 8], eax
add eax, ecx
jne 0x14000dd4b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rbx + 0xc], eax
add eax, ecx
jne 0x14000dd4b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.COMCTL32.dll_CreateMappedBitmap]
or rcx, 0xffffffffffffffff
mov rbx, qword [rbp - 0x48]
test rbx, rbx
je 0x14000dd7f
mov eax, ecx
lock xadd dword [rbx + 8], eax
add eax, ecx
jne 0x14000dd7f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rbx + 0xc], eax
add eax, ecx
jne 0x14000dd7f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.COMCTL32.dll_CreateMappedBitmap]
mov ecx, 0xc8
call fcn.14011ff78
mov qword [rsp + 0x40], rax
xor ebx, ebx
test rax, rax
je 0x14000dd9f
mov rcx, rax
call fcn.1400751c8
jmp 0x14000dda2
mov rax, rbx
mov qword [r15 + 0x3fb0], rax
mov ecx, 0xff00
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000ddca
mov rdx, r15
mov rcx, rax
call fcn.1400ef37c
jmp 0x14000ddcd
mov rax, rbx
mov qword [r15 + 0x3fc8], rax
mov ecx, 0xac8
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000ddf2
mov rcx, rax
call fcn.1400f3ef0
jmp 0x14000ddf5
mov rax, rbx
mov qword [r15 + 0x3fb8], rax
mov ecx, 0x658
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000de1a
mov rcx, rax
call fcn.1400457e0
jmp 0x14000de1d
mov rax, rbx
mov qword [r15 + 0x3fd8], rax
mov ecx, 0x18
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000de42
mov rcx, rax
call fcn.1400505f8
jmp 0x14000de45
mov rax, rbx
mov qword [r15 + 0x3fe0], rax
mov ecx, 0x60
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000de6a
mov rcx, rax
call fcn.1400c8b4c
jmp 0x14000de6d
mov rax, rbx
mov qword [r15 + 0x3fe8], rax
mov ecx, 0x28
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000de95
mov rdx, r15
mov rcx, rax
call fcn.140003dcc
jmp 0x14000de98
mov rax, rbx
mov qword [r15 + 0x5870], rax
mov ecx, 8
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000debd
mov rcx, rax
call fcn.140059bf0
jmp 0x14000dec0
mov rax, rbx
mov qword [r15 + 0x3ff0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [r15 + 0x7c40], eax
mov eax, 0x601
cmp word [0x1401e30e4], ax
jne 0x14000df34
mov ecx, 0x10
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000df00
mov rcx, rax
call fcn.140128da8
jmp 0x14000df03
mov rax, rbx
mov qword [r15 + 0x7d88], rax
mov ecx, 0x30
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000df2a
mov dl, 1
mov rcx, rax
call fcn.140128db4
jmp 0x14000df2d
mov rax, rbx
mov qword [r15 + 0x7d80], rax
mov ecx, 0x30
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000df54
mov dl, 1
mov rcx, rax
call fcn.140128db4
jmp 0x14000df57
mov rax, rbx
mov qword [r15 + 0x7d78], rax
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4938], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4940], rax
mov edx, 0x7f86
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4950], rax
mov edx, 0x7f01
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4958], rax
mov edx, 0x7f8a
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4948], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0x7c
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4960], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0x7e
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4968], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0x7d
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4970], rax
lea rcx, [r15 + 0x4050]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [r15 + 0x7c40]
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [r15 + 0x5878], rax
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e05e
lea rdx, str.GetLayeredWindowAttributes
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14000e061
mov rax, rbx
mov qword [r15 + 0x7d38], rax
mov eax, 0x501
cmp word [0x1401e30e4], ax
jb 0x14000e124
lea rcx, str.Imm32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [r15 + 0x7d40], rax
test rax, rax
je 0x14000e124
lea rdx, str.ImmSetCompositionFontW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x7d48], rax
lea rdx, str.ImmSetCompositionWindow
mov rcx, qword [r15 + 0x7d40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x7d50], rax
lea rdx, str.ImmGetContext
mov rcx, qword [r15 + 0x7d40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x7d58], rax
cmp qword [r15 + 0x7d48], rbx
je 0x14000e0fb
cmp qword [r15 + 0x7d50], rbx
je 0x14000e0fb
test rax, rax
jne 0x14000e124
mov qword [r15 + 0x7d48], rbx
mov qword [r15 + 0x7d50], rbx
mov qword [r15 + 0x7d58], rbx
mov rcx, qword [r15 + 0x7d40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [r15 + 0x7d40], rbx
mov ecx, 0x50
call fcn.14011ff78
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000e145
mov rcx, rax
call fcn.14000bfd8
mov rcx, rax
jmp 0x14000e148
mov rcx, rbx
lea rax, [rcx + 0x10]
mov qword [r15 + 0x7d98], rax
mov rbx, qword [r15 + 0x7da0]
mov qword [r15 + 0x7da0], rcx
test rbx, rbx
je 0x14000e195
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rbx + 8], eax
add eax, ecx
jne 0x14000e195
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rbx + 0xc], eax
add eax, ecx
jne 0x14000e195
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.COMCTL32.dll_CreateMappedBitmap]
mov rcx, qword [r15 + 0x7d98]
call fcn.1400f3504
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rbx, [r15 + 0x1380]
test eax, eax
jne 0x14000e216
mov dword [rsp + 0x58], 0x206
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ComSpec
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
test eax, eax
je 0x14000e20b
mov word [rbx], cx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp word [rbx], ax
jne 0x14000e22d
xor r8d, r8d
mov edx, 0x104
mov rcx, rbx
call fcn.1401226dc
lea rcx, [rsp + 0x48]
call fcn.140120d54
nop
lea rcx, [rsp + 0x68]
call fcn.140120d54
nop
mov ebx, 0x104
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140121228
mov rdx, rax
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebx, ebx
test eax, eax
je 0x14000e857
lea edx, [rbx + 0x5c]
mov rcx, qword [rsp + 0x48]
call fcn.14013bd50
test rax, rax
je 0x14000e857
lea rcx, [rsp + 0x48]
call fcn.140058574
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140131698
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140120e10
lea rcx, [rbp - 0x40]
call fcn.140120ddc
lea rcx, [rsp + 0x68]
call fcn.140058574
mov rcx, rax
xor edx, edx
call fcn.140122088
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x48]
test al, al
cmove rcx, rdx
call fcn.140058574
mov rdx, rax
lea rbx, [r15 + 0xaf0]
mov rcx, rbx
call fcn.14000d194
mov rdx, rbx
mov rcx, rdi
call fcn.14000d194
mov edx, 0x5c
mov rcx, rdi
call fcn.14013bd50
xor ecx, ecx
test rax, rax
je 0x14000e30b
mov word [rax], cx
xor edx, edx
mov rcx, r15
call fcn.140023cec
lea rcx, [rsp + 0x78]
call fcn.140120d54
nop
lea rdx, [rsp + 0x78]
lea rbx, [r15 + 0x4e8]
mov rcx, rbx
call fcn.14003e9b0
test al, al
je 0x14000e341
bts dword [r15 + 0x15cc], 0xc
mov rdx, rdi
mov rcx, rsi
call fcn.14000d194
lea r8, [0x14016ad58]
mov edx, 0x105
mov rcx, rsi
call fcn.140001f38
mov rcx, r15
call fcn.14000fb34
xor edx, edx
test al, al
jne 0x14000e423
mov rdx, rdi
mov rcx, rsi
call fcn.14000d194
mov rcx, r15
call fcn.14000fb34
xor edx, edx
test al, al
jne 0x14000e423
mov edx, 0x5c
mov rcx, rdi
call fcn.14013bd50
mov rbx, rax
xor edx, edx
test rax, rax
je 0x14000e41c
lea rdx, str._bin
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
test eax, eax
jne 0x14000e41c
sub rbx, r15
sub rbx, 0xcfa
sar rbx, 1
lea r8, [rbx + rbx]
mov rdx, rdi
mov rcx, rsi
call fcn.14013b6b0
xor eax, eax
mov word [r15 + rbx*2 + 0xf04], ax
lea r8, str.libexecConEmu
mov edx, 0x105
mov rcx, rsi
call fcn.140001f38
mov rcx, r15
call fcn.14000fb34
xor edx, edx
test al, al
je 0x14000e40f
or dword [r15 + 0x15cc], 1
jmp 0x14000e41c
mov rdx, rdi
mov rcx, rsi
call fcn.14000d194
xor edx, edx
lea rbx, [r15 + 0x4e8]
mov eax, dword [r15 + 0x15cc]
shr eax, 0xc
test al, 1
je 0x14000e47f
xor r9d, r9d
lea r8, str.....git_bash.exe
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.1401254e8
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140120e10
lea rcx, [rbp - 0x30]
call fcn.140120ddc
lea rcx, [rsp + 0x78]
call fcn.140058574
mov rcx, rax
xor edx, edx
call fcn.140122088
xor edx, edx
test al, al
je 0x14000e47f
or dword [r15 + 0x15cc], 5
mov cl, byte [r15 + 0x15cc]
test cl, 1
je 0x14000e4b5
mov eax, dword [r15 + 0x15cc]
shr eax, 0xc
test al, 1
je 0x14000e4ac
xor edx, edx
mov rcx, rbx
call fcn.140041c70
mov cl, byte [r15 + 0x15cc]
xor edx, edx
test cl, 1
jne 0x14000e5b5
lea rax, str...AppInfoLauncherConEmuPortable.ini
mov qword [rbp - 0x68], rax
lea rax, str...DefaultData_settingsConEmu.xml
mov qword [rbp - 0x60], rax
mov rbx, rdx
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140004b1c
mov r8, qword [rbp + rbx*8 - 0x68]
mov edx, 0x144
lea rcx, [rbp + 0x30]
call fcn.140001f38
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.140122088
test al, al
je 0x14000e5b5
inc rbx
cmp rbx, 2
jb 0x14000e4ce
mov rdx, rdi
mov rcx, r14
call fcn.14000d194
mov edx, 0x5c
mov rcx, r14
call fcn.14013bd50
xor ebx, ebx
test rax, rax
je 0x14000e5b7
mov word [rax], bx
lea edx, [rbx + 0x5c]
mov rcx, r14
call fcn.14013bd50
test rax, rax
je 0x14000e5a4
mov word [rax], bx
lea r8, [0x14016ae64]
mov edx, 0x105
mov rcx, r14
call fcn.140001f38
mov rcx, r14
call fcn.140130c1c
test al, al
jne 0x14000e56a
mov rcx, r14
call fcn.140131a3c
lea r8, str.ConEmu.xml
mov edx, 0x105
mov rcx, r14
call fcn.140001f38
xor edx, edx
mov rcx, r14
call fcn.140122088
test al, al
jne 0x14000e59c
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
or dword [r15 + 0x15cc], 2
mov eax, dword [r15 + 0x15cc]
test al, 2
jne 0x14000e5b7
mov word [r14], bx
jmp 0x14000e5b7
xor ebx, ebx
mov byte [r15 + 0x15d8], bl
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000e600
mov r8d, 0x20
lea rdx, [rbp - 0x10]
lea rcx, str.ConEmuBlockChildDebuggers
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000e600
lea rdx, [0x14016aed8]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
sete al
mov byte [r15 + 0x15d8], al
xor edx, edx
lea rcx, str.ConEmuBlockChildDebuggers
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call fcn.14012be90
mov byte [r15 + 0x4934], al
mov rdx, rdi
lea rcx, str.ConEmuDir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rsi
lea rcx, str.ConEmuBaseDir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140122af8
nop
lea rcx, [rbp - 0x78]
call fcn.14012148c
mov rdx, qword [rbp - 0x78]
test al, al
cmovne rdx, rsi
lea rcx, str.ConEmuBaseDirShort
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [r15 + 0xad0]
lea rcx, str.ConEmuBuild
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea r14, [0x14015a140]
mov rdx, r14
lea rcx, str.ConEmuConfig
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.ConEmuCfgDir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.ConEmuArgs
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.ConEmuArgs2
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov al, byte [r15 + 0x4934]
lea r9, str.ADMIN
neg al
sbb rdx, rdx
and rdx, r9
lea rcx, str.ConEmuIsAdmin
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.ConEmuArgs
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.ConEmuArgs2
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, 0x104
lea rdx, [rbp + 0x2c0]
mov rcx, rdi
call fcn.1401241c8
mov rdx, rax
lea rcx, str.ConEmuDrive
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
mov rcx, r15
call fcn.140011854
mov rcx, r15
call fcn.140011740
mov rdx, rsi
mov rcx, r12
call fcn.14000d194
lea rdx, str.ConEmu.chm
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, r12
call fcn.140122088
test al, al
jne 0x14000e7a7
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14000e7a2
mov rdx, rdi
mov rcx, r12
call fcn.14000d194
lea rdx, str.ConEmu.chm
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, r12
call fcn.140122088
test al, al
jne 0x14000e7a7
mov word [r12], bx
mov rdx, rsi
mov rcx, r13
call fcn.14000d1e0
lea r8, [0x140169840]
mov edi, 0x110
mov edx, edi
mov rcx, r13
call fcn.140001f38
call fcn.140123504
test al, al
je 0x14000e81d
mov rdx, rsi
lea rbx, [r15 + 0x1e1a]
mov rcx, rbx
call fcn.14000d1e0
lea r8, [0x140169820]
mov edx, edi
mov rcx, rbx
call fcn.140001f38
xor edx, edx
mov rcx, rbx
call fcn.140122088
test al, al
jne 0x14000e807
mov rcx, rbx
jmp 0x14000e824
xor edx, edx
mov rcx, r13
call fcn.140122088
test al, al
jne 0x14000e82c
mov rdx, rbx
mov rcx, r13
jmp 0x14000e827
lea rcx, [r15 + 0x1e1a]
mov rdx, r13
call fcn.14000d1e0
mov rcx, r15
call fcn.14000fc00
lea rcx, [r15 + 0x188]
call fcn.140058b1c
nop
lea rcx, [rbp - 0x78]
call fcn.140120ddc
nop
lea rcx, [rsp + 0x78]
call fcn.140120ddc
jmp 0x14000e885
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.GetModuleFileName_failed
call fcn.14011f550
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rsp + 0x68]
call fcn.140120ddc
nop
lea rcx, [rsp + 0x48]
call fcn.140120ddc
nop
mov rax, r15
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x5e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret