Function at 0x7ff668c39bf0
Capabilities:
Delete registry value
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe00]
sub rsp, 0xf00
mov rax, qword [0x7ff668cee700]
xor rax, rsp
mov qword [rbp + 0xdf0], rax
movzx r12d, cl
mov byte [rbp + 0x848], cl
xor r14d, r14d
mov dword [rsp + 0x50], r14d
test cl, cl
jne 0x7ff668c39d2f
call qword [sym.imp.msvcp140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.msvcp140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x7ff668c39c60
imul rax, rax, 0x64
jmp 0x7ff668c39c7b
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7ffffffb57e837fe
movabs rdi, 0x7fffffffffffffff
cmp rax, rcx
jg 0x7ff668c39ca7
movabs rcx, 0x4a817c800
add rcx, rax
mov qword [rbp - 0x70], rcx
jmp 0x7ff668c39cab
mov qword [rbp - 0x70], rdi
lea rcx, [rbp - 0x70]
call fcn.7ff668c48a30
mov eax, 1
xchg dword [0x7ff668cf5468], eax
call qword [sym.imp.msvcp140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.msvcp140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x7ff668c39cdd
imul rax, rax, 0x64
jmp 0x7ff668c39cf8
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffffc46535fe
cmp rax, rcx
jg 0x7ff668c39d1e
add rax, 0x3b9aca00
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.7ff668c48a30
jmp 0x7ff668c39d3a
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x70]
call fcn.7ff668c48a30
jmp 0x7ff668c39d3a
mov eax, 1
xchg dword [0x7ff668cf5468], eax
mov qword [rbp + 0x290], r14
movdqa xmm0, xmmword [0x7ff668cda1f0]
movdqu xmmword [rbp + 0x2a0], xmm0
mov word [rbp + 0x290], r14w
mov dword [rsp + 0x50], 2
lea rcx, [rbp + 0x290]
call fcn.7ff668c2e220
test eax, eax
jne 0x7ff668c3c035
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x290]
call fcn.7ff668c2c6e0
nop
mov rcx, rax
call fcn.7ff668c398c0
test al, al
sete bl
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0x10
jb 0x7ff668c39dda
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff668c39dd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff668c39dd5
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff668cb8f00
mov qword [rbp + 0x2c0], r14
mov qword [rbp + 0x2c8], 0xf
mov byte [rbp + 0x2b0], 0
mov dword [rsp + 0x50], r14d
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 8
jb 0x7ff668c39e41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff668c39e3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff668c39e3c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff668cb8f00
test bl, bl
je 0x7ff668c39e55
mov eax, 0x15
xchg dword [0x7ff668cf5468], eax
jmp 0x7ff668c3bfae
lea rcx, [rbp + 0x928]
call fcn.7ff668c53b80
nop
cmp byte [rbp + 0x948], 0
jne 0x7ff668c39e7b
mov eax, 0x14
xchg dword [0x7ff668cf5468], eax
jmp 0x7ff668c3bfa2
movabs rax, 0xa31a43507c312bbb
mov qword [rbp - 0x60], rax
movabs rax, 0x9da3d80feed482df
mov qword [rbp - 0x58], rax
movabs r13, 0xcc6e1c3e155644d7
mov qword [rbp + 0xcc0], r13
movabs r15, 0x9da3d80feebae7b4
mov qword [rbp + 0xcc8], r15
movdqa xmm0, xmmword [rbp + 0xcc0]
pxor xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
xor eax, eax
mov qword [rbp + 0x1f8], rax
mov byte [rbp + 0x1f0], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x950], xmm0
lea ecx, [rax + 0x20]
call fcn.7ff668cb8f08
mov rbx, rax
lea rax, [rbp + 0x849]
mov qword [rbp + 0x950], rax
mov qword [rbp + 0x958], rbx
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
lea rax, [rbp - 0x60]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x7ff668c39f22
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.7ff668bf3ef0
nop
mov qword [rbp + 0x1f8], rbx
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0x200], rax
mov byte [rbp + 0x208], 1
mov byte [rbp + 0x210], 0
xor eax, eax
mov qword [rbp + 0x218], rax
lea rdx, [rbp + 0x928]
lea rcx, [rbp + 0x210]
call fcn.7ff668c50250
lea rax, [rbp + 0x210]
mov qword [rbp + 0x220], rax
mov byte [rbp + 0x228], 1
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0x310], rax
lea rax, [rbp + 0x230]
mov qword [rbp + 0x318], rax
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x270]
call fcn.7ff668c40350
lea rax, [rbp + 0x270]
mov qword [rbp + 0x280], rax
mov byte [rbp + 0x288], 1
lea rax, [rbp + 0x270]
mov qword [rbp + 0x320], rax
lea rax, [rbp + 0x290]
mov qword [rbp + 0x328], rax
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x8c0]
call fcn.7ff668c40350
nop
lea r9, [fcn.7ff668c3c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x270]
call fcn.7ff668cb8f80
nop
lea r9, [fcn.7ff668c3c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x1f0]
call fcn.7ff668cb8f80
movabs rax, 0xcc401c57152644b6
mov qword [rbp + 0x20], rax
movabs rax, 0x9dc7d86eeed5e7d8
mov qword [rbp + 0x28], rax
movabs rax, 0x6be7c832f9f6890c
mov qword [rbp + 0x30], rax
movabs rax, 0xf90b44507344d4e7
mov qword [rbp + 0x38], rax
mov qword [rbp + 0xc60], r13
mov qword [rbp + 0xc68], r15
movabs rax, 0x6b8bc81cf9848969
mov qword [rbp + 0xc70], rax
movabs rdi, 0xf90b44357332d48e
mov qword [rbp + 0xc78], rdi
movdqa xmm0, xmmword [rbp + 0x20]
pxor xmm0, xmmword [rbp + 0xc60]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x30]
pxor xmm1, xmmword [rbp + 0xc70]
movdqa xmmword [rbp + 0x30], xmm1
mov qword [rbp + 0x1d0], r14
mov qword [rbp + 0x1e0], r14
mov qword [rbp + 0x1e8], 7
mov word [rbp + 0x1d0], r14w
lea rax, [rbp + 0x20]
mov r8, rsi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff668c3a0f0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x1d0]
call fcn.7ff668c41f90
nop
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x8c0]
call fcn.7ff668c40090
mov rbx, rax
movabs rax, 0xcc0b1c4d152344f8
mov qword [rbp + 0x40], rax
movabs rax, 0x9dd7d87ceee5e7c6
mov qword [rbp + 0x48], rax
movabs rax, 0x6bf8c869f9f08908
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0xc30], r13
mov qword [rbp + 0xc38], r15
movabs rax, 0x6b8bc81cf9848969
mov qword [rbp + 0xc40], rax
mov qword [rbp + 0xc48], rdi
movdqa xmm0, xmmword [rbp + 0x40]
pxor xmm0, xmmword [rbp + 0xc30]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0x50]
pxor xmm1, xmmword [rbp + 0xc40]
movdqa xmmword [rbp + 0x50], xmm1
mov qword [rbp + 0x2d0], r14
mov qword [rbp + 0x2e0], r14
mov qword [rbp + 0x2e8], 7
lea rax, [rbp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff668c3a1c0
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x2d0]
call fcn.7ff668c41f90
mov r9, rbx
lea r8, [rbp + 0x2d0]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x8f8]
call fcn.7ff668c537e0
nop
mov rdx, qword [rbp + 0x308]
cmp rdx, 0x10
jb 0x7ff668c3a23d
inc rdx
mov rcx, qword [rbp + 0x2f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff668c3a238
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff668c3a238
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff668cb8f00
mov qword [rbp + 0x300], r14
mov qword [rbp + 0x308], 0xf
mov byte [rbp + 0x2f0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 8
jb 0x7ff668c3a29f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff668c3a29a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff668c3a29a
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff668cb8f00
cmp byte [rbp + 0x920], 0
je 0x7ff668c3a6c3
cmp dword [rbp + 0x8f8], 0xc8
jne 0x7ff668c3a6c3
cmp qword [rbp + 0x910], 0
je 0x7ff668c3a6c3
mov qword [rbp + 0x438], r14
lea rax, [rbp + 0x400]
mov qword [rsp + 0x78], rax
mov byte [rbp + 0x870], 0
xor edx, edx
lea rcx, [rbp + 0x878]
call fcn.7ff668c41d40
nop
mov r15d, 4
mov dword [rsp + 0x50], r15d
lea rax, [rbp + 0x510]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x548], r14
mov rcx, qword [rbp + 0x438]
test rcx, rcx
je 0x7ff668c3a32f
mov rax, qword [rcx]
lea rdx, [rbp + 0x510]
call qword [rax]
mov qword [rbp + 0x548], rax
lea rcx, [rbp + 0x900]
mov rax, qword [rbp + 0x910]
cmp qword [rbp + 0x918], 0x10
jb 0x7ff668c3a353
mov rcx, qword [rbp + 0x900]
add rax, rcx
jmp 0x7ff668c3a35d
add rax, rcx
lea rcx, [rbp + 0x900]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
lea r8, [rbp + 0x510]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x750]
call fcn.7ff668c48b60
nop
lea r8, [rbp + 0x870]
mov rcx, rax
call fcn.7ff668c44b90
nop
lea rcx, [rbp + 0x798]
call fcn.7ff668c44a00
mov rcx, qword [rbp + 0x788]
test rcx, rcx
je 0x7ff668c3a3c8
mov rax, qword [rcx]
lea rdx, [rbp + 0x750]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x788], r14
mov rcx, qword [rbp + 0x438]
test rcx, rcx
je 0x7ff668c3a3ee
mov rax, qword [rcx]
lea rdx, [rbp + 0x400]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x438], r14
mov edx, 0xd
cmp byte [rbp + 0x870], 1
jne 0x7ff668c3a4ba
mov rax, qword [rbp + 0x878]
mov r13, qword [rax]
mov rbx, qword [r13 + 8]
mov r14, r13
cmp byte [rbx + 0x19], 0
jne 0x7ff668c3a479
mov r12d, edx
nop word [rax + rax]
lea rcx, [rbx + 0x20]
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x7ff668c3a432
mov rcx, qword [rcx]
mov r8, rdi
cmp rdi, r12
cmova r8, r12
lea rdx, str.pending_reset
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x7ff668c3a5b9
js 0x7ff668c3a5c2
mov r14, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x7ff668c3a420
movzx r12d, byte [rbp + 0x848]
movabs rdi, 0xf90b44357332d48e
mov edx, 0xd
cmp byte [r14 + 0x19], 0
jne 0x7ff668c3a4b7
lea rcx, [r14 + 0x20]
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x7ff668c3a492
mov rcx, qword [rcx]
mov r8, rbx
cmp rbx, 0xd
cmova r8, rdx
lea rdx, str.pending_reset
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x7ff668c3a5cb
js 0x7ff668c3a5d5
xor r14d, r14d
xor bl, bl
test r15b, 1
je 0x7ff668c3a50c
and r15d, 0xfffffffe
mov dword [rsp + 0x50], r15d
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0x10
jb 0x7ff668c3a50c
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff668c3a507
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff668c3a5b2
call fcn.7ff668cb8f00
test bl, bl
je 0x7ff668c3a69c
mov qword [rbp + 0x190], r14
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1a8], 0xf
mov byte [rbp + 0x190], 0
mov r8d, 0xd
lea rdx, str.pending_reset
lea rcx, [rbp + 0x190]
call fcn.7ff668bf3ef0
nop
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x870]
call fcn.7ff668c3ff40
cmp byte [rax], 4
jne 0x7ff668c3bfde
movzx ebx, byte [rax + 8]
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0x10
jb 0x7ff668c3a64c
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff668c3a647
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff668c3a647
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rdi, r12
jae 0x7ff668c3a456
mov rbx, qword [rbx + 0x10]
jmp 0x7ff668c3a45c
cmp rbx, 0xd
ja 0x7ff668c3a4b7
cmp r14, r13
je 0x7ff668c3a4b7
xor r14d, r14d
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1c8], 0xf
mov byte [rbp + 0x1b0], r14b
lea r8d, [r14 + 0xd]
lea rdx, str.pending_reset
lea rcx, [rbp + 0x1b0]
call fcn.7ff668bf3ef0
nop
mov r15d, 5
mov dword [rsp + 0x50], r15d
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x870]
call fcn.7ff668c3ff40
cmp byte [rax], 4
jne 0x7ff668c3a4ba
mov bl, 1
jmp 0x7ff668c3a4bc
call fcn.7ff668cb8f00
test bl, bl
je 0x7ff668c3a69c
lea rax, [rbp + 0x840]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREDefaultUserEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7ff668c3a691
lea rdx, str.HASH
mov rcx, qword [rbp + 0x840]
call qword [sym.imp.advapi32.dll_RegDeleteValueA]
mov eax, 0x18
xchg dword [0x7ff668cf5468], eax
movzx edx, byte [rbp + 0x870]
lea rcx, [rbp + 0x878]
call fcn.7ff668c41850
movabs r15, 0x9da3d80feebae7b4
movabs r13, 0xcc6e1c3e155644d7
lea rcx, [rbp + 0x8f8]
call fcn.7ff668c3f210
lea rcx, [rbp + 0x9d0]
call fcn.7ff668c541c0
nop
cmp byte [rbp + 0x9f0], 0
jne 0x7ff668c3a6f5
mov eax, 0x14
xchg dword [0x7ff668cf5468], eax
jmp 0x7ff668c3bf81
lea rcx, [rbp + 0x8d0]
call fcn.7ff668c547b0
nop
cmp qword [rbp + 0x8e0], 0
jne 0x7ff668c3a71c
mov eax, 0x16
xchg dword [0x7ff668cf5468], eax
jmp 0x7ff668c3bf74
lea rax, [rbp + 0x838]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREDefaultUserEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7ff668c3a7d2
lea rax, [rbp + 0x8f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x880]
xor r8d, r8d
lea rdx, str.HASH
mov rcx, qword [rbp + 0x838]
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x7ff668c3a7c5
mov eax, dword [rbp + 0x8e0]
inc eax
lea rcx, [rbp + 0x8d0]
cmp qword [rbp + 0x8e8], 0x10
cmovae rcx, qword [rbp + 0x8d0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.HASH
mov rcx, qword [rbp + 0x838]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x838]
call qword [sym.imp.advapi32.dll_RegCloseKey]
movabs rax, 0xcc6e1c5b723730a4
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], r15
mov qword [rbp + 0x850], r13
mov qword [rbp + 0x858], r15
movdqa xmm0, xmmword [rbp - 0x50]
pxor xmm0, xmmword [rbp + 0x850]
movdqa xmmword [rbp - 0x50], xmm0
xor eax, eax
mov qword [rbp + 0x238], rax
mov byte [rbp + 0x230], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x850], xmm0
lea ecx, [rax + 0x20]
call fcn.7ff668cb8f08
mov rbx, rax
lea rax, [rbp + 0x848]
mov qword [rbp + 0x850], rax
mov qword [rbp + 0x858], rbx
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
lea rax, [rbp - 0x50]
inc rsi
cmp byte [rax + rsi], 0
jne 0x7ff668c3a851
mov r8, rsi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.7ff668bf3ef0
nop
mov qword [rbp + 0x238], rbx
lea rax, [rbp + 0x230]
mov qword [rbp + 0x240], rax
mov byte [rbp + 0x248], 1
movabs rax, 0xcc6e6e5b71372bbb
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], r15
mov qword [rbp + 0xd10], r13
mov qword [rbp + 0xd18], r15
movdqa xmm0, xmmword [rbp - 0x40]
pxor xmm0, xmmword [rbp + 0xd10]
movdqa xmmword [rbp - 0x40], xmm0
lea rax, [rbp - 0x40]
mov qword [rbp + 0x880], rax
xor eax, eax
mov qword [rbp + 0x258], rax
mov byte [rbp + 0x250], 3
lea rax, [rbp + 0x84a]
mov qword [rbp + 0x838], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x850], xmm0
mov ecx, 1
call fcn.7ff668bf54a0
mov rcx, rax
call fcn.7ff668bf4250
lea r8, [rbp + 0x838]
mov rdx, rax
lea rcx, [rbp + 0x850]
call fcn.7ff668c503e0
nop
lea r8, [rbp + 0x880]
mov rdx, qword [rbp + 0x858]
call fcn.7ff668c503f0
lea rcx, [rbp + 0x850]
call fcn.7ff668c503d0
mov rbx, rax
lea rcx, [rbp + 0x850]
call fcn.7ff668c44af0
mov qword [rbp + 0x258], rbx
lea rax, [rbp + 0x250]
mov qword [rbp + 0x260], rax
mov byte [rbp + 0x268], 1
lea rax, [rbp + 0x230]
mov qword [rbp + 0x330], rax
lea rax, [rbp + 0x270]
mov qword [rbp + 0x338], rax
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x6d0]
call fcn.7ff668c3f280
nop
movabs rax, 0xa31a43507c312bbb
mov qword [rbp - 0x30], rax
movabs rax, 0x9da3d80feed482df
mov qword [rbp - 0x28], rax
mov qword [rbp + 0xc50], r13
mov qword [rbp + 0xc58], r15
movdqa xmm0, xmmword [rbp - 0x30]
pxor xmm0, xmmword [rbp + 0xc50]
movdqa xmmword [rbp - 0x30], xmm0
lea rax, [rbp - 0x30]
mov qword [rbp + 0x838], rax
lea rdx, [rbp + 0x838]
lea rcx, [rbp + 0x550]
call fcn.7ff668c43520
nop
lea rdx, [rbp + 0x928]
lea rcx, [rbp + 0x570]
call fcn.7ff668c435d0
nop
lea rax, [rbp + 0x550]
mov qword [rbp + 0x340], rax
lea rax, [rbp + 0x590]
mov qword [rbp + 0x348], rax
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x6f0]
call fcn.7ff668c3f280
nop
movabs rax, 0x931a7f4b713936a7
mov qword [rbp - 0x20], rax
movabs rax, 0x9da3d80f8bd786da
mov qword [rbp - 0x18], rax
mov qword [rbp + 0xc80], r13
mov qword [rbp + 0xc88], r15
movdqa xmm0, xmmword [rbp - 0x20]
pxor xmm0, xmmword [rbp + 0xc80]
movdqa xmmword [rbp - 0x20], xmm0
lea rax, [rbp - 0x20]
mov qword [rbp + 0x838], rax
lea rdx, [rbp + 0x838]
lea rcx, [rbp + 0x4d0]
call fcn.7ff668c43520
nop
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0x4f0]
call fcn.7ff668c435d0
nop
lea rax, [rbp + 0x4d0]
mov qword [rbp + 0x350], rax
lea rax, [rbp + 0x510]
mov qword [rbp + 0x358], rax
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x710]
call fcn.7ff668c3f280
nop
movabs rax, 0xcc6e1c3e713f33bf
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], r15
mov qword [rbp + 0xc90], r13
mov qword [rbp + 0xc98], r15
movdqa xmm0, xmmword [rbp - 0x10]
pxor xmm0, xmmword [rbp + 0xc90]
movdqa xmmword [rbp - 0x10], xmm0
lea rax, [rbp - 0x10]
mov qword [rbp + 0x838], rax
lea rdx, [rbp + 0x838]
lea rcx, [rbp + 0x590]
call fcn.7ff668c43520
nop
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x5b0]
call fcn.7ff668c435d0
nop
lea rax, [rbp + 0x590]
mov qword [rbp + 0x360], rax
lea rax, [rbp + 0x5d0]
mov qword [rbp + 0x368], rax
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x730]
call fcn.7ff668c3f280
nop
lea rax, [rbp + 0x6d0]
mov qword [rbp + 0x390], rax
lea rax, [rbp + 0x750]
mov qword [rbp + 0x398], rax
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x888]
call fcn.7ff668c40350
nop
lea r9, [fcn.7ff668c3c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rbp + 0x6d0]
call fcn.7ff668cb8f80
nop
lea r9, [fcn.7ff668c3c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x590]
call fcn.7ff668cb8f80
nop
lea r9, [fcn.7ff668c3c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x4d0]
call fcn.7ff668cb8f80
nop
lea r9, [fcn.7ff668c3c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x550]
call fcn.7ff668cb8f80
nop
lea r9, [fcn.7ff668c3c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x230]
call fcn.7ff668cb8f80
lea rax, [rbp + 0x610]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x78], rax
movabs rax, 0xe11a725b61382b94
mov qword [rbp + 0x60], rax
movabs rax, 0xedc2f8358bca9ee0
mov qword [rbp + 0x68], rax
movabs rax, 0x4e2bc7d9aede519
mov qword [rbp + 0x70], rax
movabs rax, 0xf90b2a5a0058fbe0
mov qword [rbp + 0x78], rax
mov qword [rbp + 0xc10], r13
mov qword [rbp + 0xc18], r15
movabs rax, 0x6b8bc81cf9848969
mov qword [rbp + 0xc20], rax
mov qword [rbp + 0xc28], rdi
movdqa xmm0, xmmword [rbp + 0x60]
pxor xmm0, xmmword [rbp + 0xc10]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [rbp + 0x70]
pxor xmm1, xmmword [rbp + 0xc20]
movdqa xmmword [rbp + 0x70], xmm1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x3c0]
call fcn.7ff668bf3e90
nop
lea rax, [rbp + 0x630]
mov qword [rbp + 0x840], rax
lea rdx, [rbp + 0x610]
lea rcx, [rbp + 0x888]
call fcn.7ff668c40090
mov rsi, rax
lea rax, [rbp + 0x3c0]
mov qword [rbp + 0x370], rax
lea rax, [rbp + 0x3e0]
mov qword [rbp + 0x378], rax
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x4a0]
call fcn.7ff668c404e0
mov rdi, rax
movabs rax, 0xcc6e1c3e41050b87
mov qword [rbp], rax
mov qword [rbp + 8], r15
mov qword [rbp + 0xca0], r13
mov qword [rbp + 0xca8], r15
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rbp + 0xca0]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [rbp + 0x630]
call fcn.7ff668bf3e90
mov rbx, rax
movabs rax, 0xa80f73523b3f34b6
mov qword [rbp + 0xc0], rax
movabs rax, 0xb2c6ae66829495d1
mov qword [rbp + 0xc8], rax
movabs rax, 0x6b8bc81c91f0fc08
mov qword [rbp + 0xd0], rax
movabs rax, 0xf90b44357332d48e
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xdd0], r13
mov qword [rbp + 0xdd8], r15
movabs rcx, 0x6b8bc81cf9848969
mov qword [rbp + 0xde0], rcx
mov qword [rbp + 0xde8], rax
movdqa xmm0, xmmword [rbp + 0xc0]
pxor xmm0, xmmword [rbp + 0xdd0]
movdqa xmmword [rbp + 0xc0], xmm0
movdqa xmm1, xmmword [rbp + 0xd0]
pxor xmm1, xmmword [rbp + 0xde0]
movdqa xmmword [rbp + 0xd0], xmm1
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x5f0]
call fcn.7ff668bf3e90
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x980]
call fcn.7ff668bf4590
nop
lea r9, [fcn.7ff668bf3e00]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x3c0]
call fcn.7ff668cb8f80
cmp byte [rbp + 0x9c0], 0
je 0x7ff668c3bf3f
mov eax, dword [0x7ff668cf5468]
cmp eax, 0x18
je 0x7ff668c3bf4a
lea rax, [rbp + 0x6b0]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x4b8]
mov qword [rsp + 0x78], rax
movabs rax, 0xe11a725b61382b94
mov qword [rbp + 0xa0], rax
movabs rax, 0xedc2f8358bca9ee0
mov qword [rbp + 0xa8], rax
movabs rax, 0x4e2bc7d9aede519
mov qword [rbp + 0xb0], rax
movabs rax, 0xf90b2a5a0058fbe0
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xcf0], r13
mov qword [rbp + 0xcf8], r15
movabs rax, 0x6b8bc81cf9848969
mov qword [rbp + 0xd00], rax
movabs rcx, 0xf90b44357332d48e
mov qword [rbp + 0xd08], rcx
movdqa xmm0, xmmword [rbp + 0xa0]
pxor xmm0, xmmword [rbp + 0xcf0]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [rbp + 0xb0]
pxor xmm1, xmmword [rbp + 0xd00]
movdqa xmmword [rbp + 0xb0], xmm1
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x3e0]
call fcn.7ff668bf3e90
nop
lea rax, [rbp + 0x5d0]
mov qword [rbp + 0x840], rax
lea rdx, [rbp + 0x6b0]
lea rcx, [rbp + 0x888]
call fcn.7ff668c40090
mov rsi, rax
lea rax, [rbp + 0x3e0]
mov qword [rbp + 0x380], rax
lea rax, [rbp + 0x400]
mov qword [rbp + 0x388], rax
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x4b8]
call fcn.7ff668c404e0
mov rdi, rax
movabs rax, 0xcc6e1c3e41050b87
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r15
mov qword [rbp + 0xcb0], r13
mov qword [rbp + 0xcb8], r15
movdqa xmm0, xmmword [rbp + 0x10]
pxor xmm0, xmmword [rbp + 0xcb0]
movdqa xmmword [rbp + 0x10], xmm0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x5d0]
call fcn.7ff668bf3e90
mov rbx, rax
movabs rax, 0xa80f73523b3f34b6
mov qword [rbp + 0x80], rax
movabs rax, 0xb2c6ae66829495d1
mov qword [rbp + 0x88], rax
movabs rax, 0x6be5a7758af6ec1f
mov qword [rbp + 0x90], rax
movabs rax, 0xf90b44357332d48e
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xcd0], r13
mov qword [rbp + 0xcd8], r15
movabs rcx, 0x6b8bc81cf9848969
mov qword [rbp + 0xce0], rcx
mov qword [rbp + 0xce8], rax
movdqa xmm0, xmmword [rbp + 0x80]
pxor xmm0, xmmword [rbp + 0xcd0]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [rbp + 0x90]
pxor xmm1, xmmword [rbp + 0xce0]
movdqa xmmword [rbp + 0x90], xmm1
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x690]
call fcn.7ff668bf3e90
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xa00]
call fcn.7ff668bf4590
nop
lea r9, [fcn.7ff668bf3e00]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x3e0]
call fcn.7ff668cb8f80
cmp byte [rbp + 0xa40], 0
je 0x7ff668c3bf1e
lea rdx, str.1.2.2
lea rcx, [rbp + 0xa20]
call fcn.7ff668bf5260
test al, al
je 0x7ff668c3befc
cmp dword [rbp + 0x980], 0xc8
jne 0x7ff668c3bef5
lea rdx, [0x7ff668cd1cd8]
lea rcx, [rbp + 0x960]
call fcn.7ff668bf3e90
nop
lea rdx, [rbp + 0x9a0]
test r12b, r12b
je 0x7ff668c3b2e9
lea rcx, [rbp + 0x670]
call fcn.7ff668c39b60
mov rdx, rax
lea rcx, [rbp + 0x960]
call fcn.7ff668c40740
lea rcx, [rbp + 0x670]
call fcn.7ff668bf3e00
lea rcx, str.APPDATA
call qword [sym.imp.ucrtbase.dll_getenv]
mov qword [rbp + 0x830], rax
test rax, rax
je 0x7ff668c3bedc
lea rdx, str.auth_token
lea rcx, [rbp + 0x480]
call fcn.7ff668c436a0
nop
lea rcx, [rbp + 0x440]
call fcn.7ff668c43660
nop
lea rdx, [rbp + 0x830]
lea rcx, [rbp + 0x460]
call fcn.7ff668c43600
nop
lea r8, [rbp + 0x440]
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.7ff668c2c8a0
nop
lea r8, [rbp + 0x480]
mov rdx, rax
lea rcx, [rbp + 0x8a0]
call fcn.7ff668c2c8a0
nop
lea rcx, [rbp + 0x650]
call fcn.7ff668c2c930
nop
lea rcx, [rbp + 0x460]
call fcn.7ff668c2c930
nop
lea rcx, [rbp + 0x440]
call fcn.7ff668c2c930
nop
lea rcx, [rbp + 0x480]
call fcn.7ff668c2c930
lea rcx, [rbp + 0x860]
call fcn.7ff668c2da80
mov dword [rbp + 0x860], r14d
lea rax, [0x7ff668cf3b40]
mov qword [rbp + 0x868], rax
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x8a0]
call fcn.7ff668c2c7d0
nop
lea rdx, [rbp + 0x860]
mov rcx, rax
call fcn.7ff668c2da90
nop
lea rcx, [rbp + 0x3a0]
call fcn.7ff668c2c930
cmp dword [rbp + 0x860], 0
je 0x7ff668c3b252
mov edx, 0x17
call fcn.7ff668c3f2b0
jmp 0x7ff668c3b29a
lea rcx, [rbp + 0xa50]
call fcn.7ff668c2ecd0
mov r8d, 0x12
lea rdx, [rbp + 0x8a0]
lea rcx, [rbp + 0xa50]
call fcn.7ff668c430e0
nop
cmp qword [rbp + 0xad8], 0
jne 0x7ff668c3b2ab
mov edx, 0x17
call fcn.7ff668c3f2b0
nop
lea rcx, [rbp + 0xa50]
call fcn.7ff668c2ec60
nop
lea rcx, [rbp + 0x8a0]
call fcn.7ff668c2c930
jmp 0x7ff668c3bee7
lea rdx, [rbp + 0x928]
lea rcx, [rbp + 0xa50]
call fcn.7ff668c1d9a0
lea rcx, [rbp + 0xa50]
call fcn.7ff668c3fe90
nop
lea rcx, [rbp + 0xa50]
call fcn.7ff668c2ec60
nop
lea rcx, [rbp + 0x8a0]
call fcn.7ff668c2c930
jmp 0x7ff668c3b3e2
lea rcx, [rbp + 0x3a0]
call fcn.7ff668c55780
mov rdx, rax
lea rcx, [rbp + 0x960]
call fcn.7ff668c40740
lea rcx, [rbp + 0x3a0]
call fcn.7ff668bf3e00
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x830]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWARELodEnv
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x7ff668c3bedc
movabs rax, 0xcc6e1c3e152f219c
mov qword [rbp + 0x860], rax
mov qword [rbp + 0x868], r15
mov qword [rbp + 0x8a0], r13
mov qword [rbp + 0x8a8], r15
movdqa xmm0, xmmword [rbp + 0x860]
pxor xmm0, xmmword [rbp + 0x8a0]
movdqa xmmword [rbp + 0x860], xmm0
mov edx, dword [rbp + 0x938]
inc edx
lea rcx, [rbp + 0x928]
call fcn.7ff668bf4050
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x860]
mov rcx, qword [rbp + 0x830]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
test eax, eax
jne 0x7ff668c3bedc
mov rcx, qword [rbp + 0x830]
call qword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x7ff668ef15bb
mov edx, 0x17
call fcn.7ff668c3f2b0
nop
lea rcx, [rbp + 0x960]
call fcn.7ff668bf3e00
jmp 0x7ff668c3bf07
mov edx, 0x21
jmp 0x7ff668c3bf01
mov edx, 0x19
call fcn.7ff668c3f2b0
nop
cmp byte [rbp + 0xa40], 0
je 0x7ff668c3bf4a
lea rcx, [rbp + 0xa00]
call fcn.7ff668bf4b30
jmp 0x7ff668c3bf4a
cmp byte [rbp + 0x9c0], 0
je 0x7ff668c3bf33
lea rcx, [rbp + 0x980]
call fcn.7ff668bf4b30
mov edx, 0x1f
call fcn.7ff668c3f2b0
jmp 0x7ff668c3bf60
mov edx, 0x1f
call fcn.7ff668c3f2b0
nop
cmp byte [rbp + 0x9c0], 0
je 0x7ff668c3bf60
lea rcx, [rbp + 0x980]
call fcn.7ff668bf4b30
nop
movzx edx, byte [rbp + 0x888]
lea rcx, [rbp + 0x890]
call fcn.7ff668c41850
nop
lea rcx, [rbp + 0x8d0]
call fcn.7ff668bf3e00
nop
lea rcx, [rbp + 0x9d0]
call fcn.7ff668c3fed0
nop
movzx edx, byte [rbp + 0x8c0]
lea rcx, [rbp + 0x8c8]
call fcn.7ff668c41850
nop
lea rcx, [rbp + 0x928]
call fcn.7ff668c3fed0
mov rcx, qword [rbp + 0xdf0]
xor rcx, rsp
call fcn.7ff668cb8ee0
lea r11, [rsp + 0xf00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rax
call fcn.7ff668c41f00
mov rdx, rax
lea rcx, [rbp + 0x3a0]
call fcn.7ff668bf3e90
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x460]
call fcn.7ff668c42e40
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0xb60]
call fcn.7ff668c2b4e0
lea rdx, [0x7ff668ce95f8]
lea rcx, [rbp + 0xb60]
call sub.vcruntime140.dll__CxxThrowException
nop
mov edx, eax
call fcn.7ff668c2d170
int3