Function at 0x1400124e0
Capabilities:
Check os version
Query or enumerate registry value
Set thread local storage value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x38
mov edi, edx
mov r15, rcx
mov dword [0x140178168], edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rax, qword [0x140178828]
test rax, rax
je 0x14001252b
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r12d, 0x20
bt r15d, 8
jae 0x14001261d
mov dword [0x140177708], 0x100
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001256f
lea r9, str.BootExecute
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140017b40
cmp edi, 2
je 0x140012574
cmp edi, 1
jne 0x1400125dc
lea r9, str.SetupExecute
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140017b40
cmp edi, 2
je 0x14001259a
cmp edi, 1
jne 0x1400125dc
lea r9, str.Execute
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140017b40
cmp edi, 2
je 0x1400125c0
cmp edi, 1
jne 0x1400125dc
lea r9, str.S0InitialCommand
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140017b40
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, ax
shr cx, 8
cmp al, 6
jne 0x14001261d
cmp cx, 1
jb 0x14001261d
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001261d
mov word [rsp + 0x20], r12w
lea r9, str.ServiceControlManagerExtension
lea r8, str.SystemCurrentControlSetControl
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
bt r15d, 0x12
jae 0x140012635
mov dword [0x140177708], 0x40000
xor ecx, ecx
call fcn.140029590
xor r13d, r13d
bt r15d, 0x13
jae 0x140012f36
mov dword [0x140177708], 0x80000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012692
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficeOutlookAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140012696
test edi, edi
jne 0x1400126ce
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficeOutlookAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400126f2
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012737
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeOutlookAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x14001273b
test edi, edi
jne 0x140012773
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeOutlookAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012794
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400127d9
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficeExcelAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x1400127dd
test edi, edi
jne 0x140012815
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficeExcelAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012839
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001287e
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeExcelAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140012882
test edi, edi
jne 0x1400128ba
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeExcelAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400128db
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012920
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficePowerPointAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140012924
test edi, edi
jne 0x14001295c
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficePowerPointAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012980
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400129c5
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficePowerPointAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x1400129c9
test edi, edi
jne 0x140012a01
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficePowerPointAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012a22
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012a67
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficeWordAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140012a6b
test edi, edi
jne 0x140012aa3
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficeWordAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012ac7
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012b0c
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeWordAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140012b10
test edi, edi
jne 0x140012b48
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeWordAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012b69
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012bae
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficeAccessAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140012bb2
test edi, edi
jne 0x140012bea
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficeAccessAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012c0e
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012c53
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeAccessAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140012c57
test edi, edi
jne 0x140012c8f
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeAccessAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012cb0
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012cf5
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficeOnenoteAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140012cf9
test edi, edi
jne 0x140012d31
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftOfficeOnenoteAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012d55
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012d9a
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeOnenoteAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140012d9e
test edi, edi
jne 0x140012dd6
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeOnenoteAddins
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140022120
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012df7
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012e3a
lea rcx, str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000dc40
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140012e3e
test edi, edi
jne 0x140012e74
lea rcx, str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000dc40
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012e98
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012edb
lea rcx, str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000dc40
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140012edf
test edi, edi
jne 0x140012f15
lea rcx, str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000dc40
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140012f36
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r14d, 0x2c
bt r15d, 9
jae 0x140013211
mov dword [0x140177708], 0x200
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012f71
mov r9b, 1
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14001dcf0
mov rax, qword [0x140178828]
test rax, rax
je 0x140012f95
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012fb5
mov r9b, 1
lea r8, str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14001dcf0
mov rax, qword [0x140178828]
test rax, rax
je 0x140012fd6
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140013000
mov word [rsp + 0x20], r14w
lea r9, str.Autorun
lea r8, str.SoftwareMicrosoftCommand_Processor
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
mov rax, qword [0x140178828]
test rax, rax
je 0x140013024
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001304e
mov word [rsp + 0x20], r14w
lea r9, str.Autorun
lea r8, str.SoftwareWow6432NodeMicrosoftCommand_Processor
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
mov rax, qword [0x140178828]
test rax, rax
je 0x14001306f
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14001309e
mov word [rsp + 0x20], r14w
lea r9, str.Autorun
lea r8, str.SoftwareMicrosoftCommand_Processor
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x1400130a2
test edi, edi
jne 0x1400130dd
lea rcx, str.SOFTWAREClassesExefileShellOpenCommand
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000dc40
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x1400130e2
cmp edi, 1
jne 0x14001313c
lea rcx, str.SOFTWAREClassesExefileShellOpenCommand
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000dc40
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140013122
cmp edi, 1
jne 0x14001313c
lea r8, str.SoftwareClasses.exe
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14001f200
cmp edi, 2
je 0x140013140
test edi, edi
jne 0x14001315a
lea r8, str.SoftwareClasses.exe
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14001f200
cmp edi, 2
je 0x14001315f
cmp edi, 1
jne 0x140013179
lea r8, str.SoftwareClasses.cmd
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14001f200
cmp edi, 2
je 0x14001317d
test edi, edi
jne 0x1400131d6
lea r8, str.SoftwareClasses.cmd
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14001f200
cmp edi, 2
je 0x14001319b
test edi, edi
jne 0x1400131d6
lea rcx, str.SOFTWAREClassesHtmlfileShellOpenCommand
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000dc40
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x1400131db
cmp edi, 1
jne 0x140013211
lea rcx, str.SOFTWAREClassesHtmlfileShellOpenCommand
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000dc40
nop
mov rcx, rbx
call fcn.1400e825c
mov esi, r15d
and esi, 0x1000
je 0x1400132b6
mov dword [0x140177708], 0x1000
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x14001328a
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140013263
mov word [rsp + 0x20], r12w
lea r9, str.ServiceControllerStart
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013268
cmp edi, 1
jne 0x1400132b6
mov word [rsp + 0x20], r12w
lea r9, str.LsaStart
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013294
cmp edi, 1
jne 0x1400132b6
mov word [rsp + 0x20], r14w
lea r9, str.CmdLine
lea r8, str.SYSTEMSetup
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
bt r15d, 0x11
jae 0x1400132f5
mov dword [0x140177708], 0x20000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400132e2
lea rdx, str.ROOT_subscription
xor ecx, ecx
call fcn.140034060
cmp edi, 2
je 0x1400132e7
cmp edi, 1
jne 0x1400132f5
lea rdx, str.ROOTdefault
xor ecx, ecx
call fcn.140034060
test r15b, 0x20
je 0x14001331f
mov dword [0x140177708], r12d
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001331f
lea r8, str.SystemCurrentControlSetServices
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.1400242d0
test r15b, 0x40
je 0x140013394
mov dword [0x140177708], 0x40
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140013351
lea r8, str.SystemCurrentControlSetServices
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140019420
cmp edi, 2
je 0x140013356
cmp edi, 1
jne 0x140013394
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFont_Drivers
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
test esi, esi
je 0x140013668
mov dword [0x140177708], 0x1000
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
lea eax, [rdi - 1]
jb 0x14001347f
cmp eax, 1
ja 0x1400133f7
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCredential_Providers
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140013400
cmp edi, 1
jne 0x140013578
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCredential_Provider_Filters
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140013444
cmp edi, 1
jne 0x140013578
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationPLAP_Providers
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
jmp 0x140013578
cmp eax, 1
ja 0x1400134ab
mov word [rsp + 0x20], r14w
lea r9, str.GinaDLL
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x1400134b4
cmp edi, 1
jne 0x1400135a9
mov word [rsp + 0x20], r14w
lea r9, str.UIHost
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x1400134e4
cmp edi, 1
jne 0x1400135a9
mov word [rsp + 0x20], r14w
lea r9, str.System
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013514
cmp edi, 1
jne 0x1400135a9
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14002fb10
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013556
cmp edi, 1
jne 0x1400135a9
mov word [rsp + 0x20], r12w
lea r9, str.SaveDumpStart
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013582
cmp edi, 1
jne 0x1400135a9
mov word [rsp + 0x20], r12w
lea r9, str.Taskman
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x1400135ad
test edi, edi
jne 0x1400135ff
mov word [rsp + 0x20], r14w
lea r9, str.Scrnsave.exe
lea r8, str.SOFTWAREPoliciesMicrosoftWindowsControl_PanelDesktop
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x1400135d8
test edi, edi
jne 0x1400135ff
mov word [rsp + 0x20], r14w
lea r9, str.Scrnsave.exe
lea r8, str.Control_PanelDesktop
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013604
cmp edi, 1
jne 0x140013668
mov word [rsp + 0x20], r14w
lea r9, str.ImagePath
lea r8, str.SystemCurrentControlSetControlBootVerificationProgram
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013630
cmp edi, 1
jne 0x140013668
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonGpExtensions
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14002fb10
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
bt r15d, 0xe
jae 0x14001370b
mov dword [0x140177708], 0x4000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400136c8
mov qword [rbp + 0x48], r13
lea rcx, str.SYSTEMCurrentControlSetControlPrintMonitors
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9d, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140023150
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x1400136cd
cmp edi, 1
jne 0x14001370b
mov qword [rbp + 0x48], r13
lea rcx, str.SYSTEMCurrentControlSetControlPrintProviders
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9d, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140023150
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
bt r15d, 0xf
jae 0x1400137e6
mov dword [0x140177708], 0x8000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001374f
mov word [rsp + 0x20], r14w
lea r9, str.SecurityProviders
lea r8, str.SYSTEMCurrentControlSetControlSecurityProviders
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013758
cmp edi, 1
jne 0x1400137e6
lea r9, str.Authentication_Packages
lea r8, str.SYSTEMCurrentControlSetControlLsa
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.1400206c0
cmp edi, 2
je 0x14001377e
cmp edi, 1
jne 0x1400137e6
lea r9, str.Notification_Packages
lea r8, str.SYSTEMCurrentControlSetControlLsa
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.1400206c0
cmp edi, 2
je 0x1400137a4
cmp edi, 1
jne 0x1400137e6
lea r9, str.Security_Packages
lea r8, str.SYSTEMCurrentControlSetControlLsa
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.1400206c0
cmp edi, 2
je 0x1400137ca
cmp edi, 1
jne 0x1400137e6
lea r9, str.Security_Packages
lea r8, str.SYSTEMCurrentControlSetControlLsaOSConfig
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.1400206c0
bt r15d, 0x10
jae 0x140013837
mov dword [0x140177708], 0x10000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140013837
mov qword [rbp + 0x48], r13
lea rcx, str.SYSTEMCurrentControlSetControlNetworkProviderOrder
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.1400213c0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
bt r15d, 0xd
jae 0x14001390e
mov dword [0x140177708], 0x10000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001387f
mov qword [rbp + 0x48], r13
lea rcx, str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
lea rdx, [rbp + 0x48]
xor ecx, ecx
call fcn.1400310b0
cmp edi, 2
je 0x140013888
cmp edi, 1
jne 0x14001390e
mov qword [rbp + 0x48], r13
lea rcx, str.SystemCurrentControlSetServicesWinSock2ParametersNameSpace_Catalog5Catalog_Entries
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
lea rdx, [rbp + 0x48]
xor ecx, ecx
call fcn.140030660
cmp edi, 2
je 0x1400138b8
cmp edi, 1
jne 0x14001390e
mov qword [rbp + 0x48], r13
lea rcx, str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries64
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
lea rdx, [rbp + 0x48]
xor ecx, ecx
call fcn.1400310b0
cmp edi, 2
je 0x1400138e8
cmp edi, 1
jne 0x14001390e
mov qword [rbp + 0x48], r13
lea rcx, str.SystemCurrentControlSetServicesWinSock2ParametersNameSpace_Catalog5Catalog_Entries64
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
lea rdx, [rbp + 0x48]
xor ecx, ecx
call fcn.140030660
mov r12d, r15d
and r12d, 2
je 0x140013df5
mov dword [0x140177708], 2
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140013954
mov word [rsp + 0x20], r14w
lea r9, str.StartupPrograms
lea r8, str.SystemCurrentControlSetControlTerminal_ServerWds_rdpwd
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013959
cmp edi, 1
jne 0x14001397b
mov word [rsp + 0x20], r14w
lea r9, str.AppSetup
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
mov dword [0x140177708], 2
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400139cd
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsStartup
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x1400139d1
test edi, edi
jne 0x140013a11
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogon
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013a16
cmp edi, 1
jne 0x140013a56
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogon
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013a5a
test edi, edi
jne 0x140013aac
mov word [rsp + 0x20], r14w
lea r9, str.UserInitMprLogonScript
lea r8, str.Environment
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013a85
test edi, edi
jne 0x140013aac
mov word [rsp + 0x20], r14w
lea r9, str.UserInitMprLogonScript
lea r8, str.Environment
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013ab5
cmp edi, 1
jne 0x140013b4d
mov word [rsp + 0x20], r14w
lea r9, str.Userinit
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013ae1
cmp edi, 1
jne 0x140013b4d
mov word [rsp + 0x20], r13w
lea r9, str.VmApplet
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013b0d
cmp edi, 1
jne 0x140013b4d
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsShutdown
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013b51
test edi, edi
jne 0x140013b91
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013b96
cmp edi, 1
jne 0x140013bd6
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013bda
test edi, edi
jne 0x140013c1a
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013c1f
cmp edi, 1
jne 0x140013c5f
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013c63
test edi, edi
jne 0x140013ca3
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogon
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013ca8
cmp edi, 1
jne 0x140013ce8
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogon
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013cec
test edi, edi
jne 0x140013d2c
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogoff
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013d31
cmp edi, 1
jne 0x140013d71
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogoff
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013d75
test edi, edi
jne 0x140013db5
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsShutdown
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140013dba
cmp edi, 1
jne 0x140013df5
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsShutdown
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
bt r15d, 0xa
jae 0x140013f23
mov dword [0x140177708], 0x400
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140013e51
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, str.Appinit_Dlls
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140003a50
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140013e75
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140013ebc
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, str.Appinit_Dlls
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140003a50
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140013edd
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140013f23
lea rcx, str.SystemCurrentControlSetControlSession_ManagerAppCertDlls
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
test r12d, r12d
je 0x1400146ea
mov dword [0x140177708], 2
test edi, 0xfffffffd
jne 0x140013f65
mov word [rsp + 0x20], r14w
lea r9, str.Shell
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013f69
test edi, edi
jne 0x140013f90
mov word [rsp + 0x20], r14w
lea r9, str.Shell
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013f95
cmp edi, 1
jne 0x140014013
mov word [rsp + 0x20], r14w
lea r9, str.Shell
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013fc1
cmp edi, 1
jne 0x140014013
mov word [rsp + 0x20], r14w
lea r9, str.Shell
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140013fed
cmp edi, 1
jne 0x140014013
mov eax, 0x20
mov word [rsp + 0x20], ax
lea r9, str.Taskman
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlSafeBootOption
mov rcx, qword [0x14016aa18]
call fcn.140009290
test eax, eax
jne 0x1400140ac
mov dword [rbp + 0x50], 4
mov dword [rbp + 0x48], 4
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x48]
xor r8d, r8d
lea rdx, str.UseAlternateShell
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400140a2
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400140a2
mov word [rsp + 0x20], r14w
lea r9, str.AlternateShell
lea r8, str.SystemCurrentControlSetControlSafeBoot
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400140f7
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonAlternateShellsAvailableShells
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140014100
cmp edi, 1
jne 0x14001424a
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonce
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x14001414c
cmp edi, 1
jne 0x14001424a
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonceEx
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140016d90
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140014198
cmp edi, 1
jne 0x14001424a
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x1400141e0
cmp edi, 1
jne 0x14001424a
mov word [rsp + 0x20], r14w
lea r9, str.InitialProgram
lea r8, str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x14001420c
cmp edi, 1
jne 0x14001424a
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x14001426e
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400142b4
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400142d5
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14001431b
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x14001433f
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140014385
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400143a6
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400143ec
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140016d90
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014410
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140014456
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140016d90
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014477
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400144bd
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140016d90
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400144e1
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140014527
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140016d90
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014548
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001458e
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400145b2
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400145f8
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014619
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14001465f
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014683
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400146c9
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400146ea
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, r15d
and esi, 4
je 0x140014846
mov dword [0x140177708], 4
test edi, 0xfffffffd
jne 0x140014745
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREClassesProtocolsFilter
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14001b5b0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x14001474a
cmp edi, 1
jne 0x140014787
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREClassesProtocolsFilter
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14001b5b0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x14001478b
test edi, edi
jne 0x1400147c8
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREClassesProtocolsHandler
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14001b5b0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x1400147cd
cmp edi, 1
jne 0x14001480a
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREClassesProtocolsHandler
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14001b5b0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x14001480e
test edi, edi
jne 0x140014846
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREMicrosoftInternet_ExplorerDesktopComponents
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14001c310
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
test r12d, r12d
je 0x140014af3
mov dword [0x140177708], 2
test edi, 0xfffffffd
jne 0x140014882
lea r9, str.AltStartup
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14002b3e0
cmp edi, 2
je 0x140014887
cmp edi, 1
jne 0x1400148ce
lea r9, str.Common_AltStartup
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14002b3e0
cmp edi, 2
je 0x1400148ad
cmp edi, 1
jne 0x1400148ce
lea r9, str.Common_Startup
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14002b3e0
cmp edi, 2
je 0x1400148d2
test edi, edi
jne 0x140014949
lea r9, str.Startup
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14002b3e0
cmp edi, 2
je 0x1400148f7
test edi, edi
jne 0x140014949
lea r9, str.Startup
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14002b3e0
cmp edi, 2
je 0x14001491c
test edi, edi
jne 0x140014949
mov ebx, 0x20
mov word [rsp + 0x20], bx
lea r9, str.Load
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x140014952
jmp 0x14001494e
mov ebx, 0x20
test edi, edi
jne 0x140014978
mov word [rsp + 0x20], bx
lea r9, [0x1401223c0]
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x14001497d
cmp edi, 1
jne 0x1400149c0
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x1400149c4
test edi, edi
jne 0x140014a07
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140014a0c
cmp edi, 1
jne 0x140014a44
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREMicrosoftActive_SetupInstalled_Components
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140002d40
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014a68
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140014aa8
mov qword [rbp + 0x48], r13
lea rcx, str.SOFTWAREWow6432NodeMicrosoftActive_SetupInstalled_Components
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140002d40
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014ac9
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140014af3
mov word [rsp + 0x20], r14w
lea r9, str.IconServiceLib
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140010fe0
test esi, esi
je 0x140014dee
mov dword [0x140177708], 4
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140014b4b
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014b6f
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140014bb5
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014bd6
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140014c14
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellServiceObjects
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014c38
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140014c76
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellServiceObjects
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014c97
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140014cda
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellServiceObjects
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140014cdf
cmp edi, 1
jne 0x140014d1d
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014d41
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140014d87
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014da8
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140014dee
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
test r12d, r12d
je 0x1400150c8
mov dword [0x140177708], 2
test edi, 0xfffffffd
jne 0x140014e4c
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140014e54
test edi, edi
jne 0x140014f29
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonce
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140014e9f
test edi, edi
jne 0x140014f29
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonceEx
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140016d90
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140014ee6
test edi, edi
jne 0x140014f29
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140014f2e
cmp edi, 1
jne 0x140014f6c
lea rcx, str.SOFTWAREMicrosoftWindows_CE_ServicesAutoStartOnConnect
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014f90
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140014fd6
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindows_CE_ServicesAutoStartOnConnect
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140014ff7
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001503d
lea rcx, str.SOFTWAREMicrosoftWindows_CE_ServicesAutoStartOnDisconnect
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015061
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400150a7
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindows_CE_ServicesAutoStartOnDisconnect
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400150c8
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test r15b, 0x10
je 0x1400150e7
mov dword [0x140177708], 0x10
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400150e7
xor ecx, ecx
call fcn.14002df60
mov r14d, r15d
and r14d, 8
je 0x1400151bf
mov dword [0x140177708], 8
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001513c
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015160
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001519e
lea rcx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400151bf
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x140016543
mov dword [0x140177708], 4
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140015217
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x14001523b
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140015281
lea rcx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400152a2
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400152e7
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x1400152ec
cmp edi, 1
jne 0x140015324
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015348
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140015388
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400153a9
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400153ee
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDriveShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x1400153f3
cmp edi, 1
jne 0x14001542b
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDriveShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x14001544f
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001548f
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesDriveShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400154b0
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400154f5
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesShellExPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x1400154fa
cmp edi, 1
jne 0x140015532
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesShellExPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015556
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140015596
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesShellExPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400155b7
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400155fc
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140015601
cmp edi, 1
jne 0x140015639
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x14001565d
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001569d
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesAllFileSystemObjectsShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400156be
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140015703
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExDragDropHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140015708
cmp edi, 1
jne 0x140015740
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExDragDropHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015764
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400157a4
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesAllFileSystemObjectsShellExDragDropHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400157c5
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14001580a
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x14001580f
cmp edi, 1
jne 0x140015847
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x14001586b
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400158ab
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesAllFileSystemObjectsShellExPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400158cc
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140015911
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDirectoryShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140015916
cmp edi, 1
jne 0x14001594e
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDirectoryShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015972
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400159b2
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesDirectoryShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400159d3
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140015a18
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDirectoryShellexDragDropHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140015a1d
cmp edi, 1
jne 0x140015a55
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDirectoryShellexDragDropHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015a79
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140015ab9
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesDirectoryShellexDragDropHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015ada
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140015b1f
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDirectoryShellexPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140015b24
cmp edi, 1
jne 0x140015b5c
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDirectoryShellexPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015b80
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140015bc0
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesDirectoryShellexPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015be1
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140015c26
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDirectoryShellexCopyHookHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140015c2b
cmp edi, 1
jne 0x140015c63
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDirectoryShellexCopyHookHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015c87
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140015cc7
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesDirectoryShellexCopyHookHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015ce8
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140015d2d
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140015d32
cmp edi, 1
jne 0x140015d6a
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015d8e
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140015dce
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesDirectoryBackgroundShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015def
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140015e32
lea rcx, str.SoftwareClassesFolderShellexColumnHandlers
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140015e37
cmp edi, 1
jne 0x140015e6d
lea rcx, str.SoftwareClassesFolderShellexColumnHandlers
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015e91
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140015ecf
lea rcx, str.SoftwareWow6432NodeClassesFolderShellexColumnHandlers
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015ef0
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140015f35
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesFolderShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140015f3a
cmp edi, 1
jne 0x140015f72
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesFolderShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015f96
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140015fd6
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesFolderShellExContextMenuHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140015ff7
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14001603c
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesFolderShellExDragDropHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140016041
cmp edi, 1
jne 0x140016079
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesFolderShellExDragDropHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x14001609d
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400160dd
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesFolderShellExDragDropHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400160fe
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140016143
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesFolderShellExExtShellFolderViews
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140016148
cmp edi, 1
jne 0x140016180
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesFolderShellExExtShellFolderViews
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400161a4
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400161e4
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesFolderShellExExtShellFolderViews
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140016205
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14001624a
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesFolderShellExPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x14001624f
cmp edi, 1
jne 0x140016287
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareClassesFolderShellExPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400162ab
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400162eb
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeClassesFolderShellExPropertySheetHandlers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x14001630c
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140016351
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140016356
cmp edi, 1
jne 0x14001638e
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400163b2
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400163f2
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140025420
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140016413
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140016446
mov eax, 0x20
mov word [rsp + 0x20], ax
lea r9, str.Inprocserver32
lea r8, str.SoftwareClassesClsidAB8902B4_09CA_4bb6_B78D_A8F59079A8D5
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140010fe0
cmp edi, 2
je 0x14001644a
test edi, edi
jne 0x140016485
lea rcx, str.SoftwareMicrosoftCtfLangBarAddin
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x14001648a
cmp edi, 1
jne 0x1400164c0
lea rcx, str.SoftwareMicrosoftCtfLangBarAddin
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400164e4
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140016522
lea rcx, str.SoftwareMicrosoftCtfLangBarAddin
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140016543
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test r14d, r14d
je 0x140016901
mov dword [0x140177708], 8
test edi, 0xfffffffd
jne 0x1400165a1
lea rcx, str.SoftwareMicrosoftInternet_ExplorerUrlSearchHooks
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x1400165a6
cmp edi, 1
jne 0x1400165e4
lea rcx, str.SoftwareMicrosoftInternet_ExplorerToolbar
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140016608
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001664e
lea rcx, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerToolbar
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x14001666f
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400166b4
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14001cdf0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x1400166b9
cmp edi, 1
jne 0x1400166f1
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14001cdf0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140016715
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14001675a
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14001cdf0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x14001675f
cmp edi, 1
jne 0x140016797
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14001cdf0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x1400167b8
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400167fd
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftInternet_ExplorerExtensions
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14001cdf0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140016802
cmp edi, 1
jne 0x14001683a
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareMicrosoftInternet_ExplorerExtensions
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14001cdf0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x14001685e
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400168a3
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14001cdf0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x1400168a8
cmp edi, 1
jne 0x1400168e0
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14001cdf0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140016901
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test r15b, r15b
jns 0x140016cdb
mov dword [0x140177708], 0x80
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
mov rcx, qword [0x14016aa18]
call fcn.140009290
test eax, eax
je 0x14001696e
cmp dword [0x140178824], 0
je 0x140016cdb
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140016cdb
lea rdx, str._nNo_entry_to_display_for_codecs._Codecs_are_not_supported_on_Nano_Server._n
mov rcx, qword [0x140178c50]
call fcn.140017a00
jmp 0x140016cdb
test edi, 0xfffffffd
jne 0x1400169b9
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x1400169be
cmp edi, 1
jne 0x1400169fc
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140016a20
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140016a6b
lea rcx, str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140016a70
cmp edi, 1
jne 0x140016aae
lea rcx, str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000e8d0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140016acf
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140016b12
lea rcx, str.SoftwareClassesFilter
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
cmp edi, 2
je 0x140016b17
cmp edi, 1
jne 0x140016b4d
lea rcx, str.SoftwareClassesFilter
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140016b71
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140016baf
lea rcx, str.SoftwareClassesFilter
call fcn.1400e81d8
mov rbx, rax
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.14000c5c0
nop
mov rcx, rbx
call fcn.1400e825c
mov rax, qword [0x140178828]
test rax, rax
je 0x140016bd0
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140016bf5
lea r9, str.083863F1_70DE_11d0_BD40_00A0C911CE86
mov r8, qword [0x14016aa20]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.14000d9a0
cmp edi, 2
je 0x140016bf9
test edi, edi
jne 0x140016c58
lea r9, str.AC757296_3522_4E11_9862_C17BE5A1767E
mov r8, qword [0x14016aa20]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.14000d9a0
cmp edi, 2
je 0x140016c1a
test edi, edi
jne 0x140016c58
lea r9, str.7ED96837_96F0_4812_B211_F13C24117ED3
mov r8, qword [0x14016aa20]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.14000d9a0
cmp edi, 2
je 0x140016c3b
test edi, edi
jne 0x140016c58
lea r9, str.ABE3B9A4_257D_4B97_BD1A_294AF496222E
mov r8, qword [0x14016aa20]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.14000d9a0
cmp edi, 2
je 0x140016c5d
cmp edi, 1
jne 0x140016cdb
lea r9, str.083863F1_70DE_11d0_BD40_00A0C911CE86
mov r8, qword [0x14016aa18]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.14000d9a0
cmp edi, 2
je 0x140016c7f
cmp edi, 1
jne 0x140016cdb
lea r9, str.AC757296_3522_4E11_9862_C17BE5A1767E
mov r8, qword [0x14016aa18]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.14000d9a0
cmp edi, 2
je 0x140016ca1
cmp edi, 1
jne 0x140016cdb
lea r9, str.7ED96837_96F0_4812_B211_F13C24117ED3
mov r8, qword [0x14016aa18]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.14000d9a0
cmp edi, 2
je 0x140016cc3
cmp edi, 1
jne 0x140016cdb
lea r9, str.ABE3B9A4_257D_4B97_BD1A_294AF496222E
mov r8, qword [0x14016aa18]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.14000d9a0
test r12d, r12d
je 0x140016d76
mov dword [0x140177708], 2
test edi, 0xfffffffd
jne 0x140016d36
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa20]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
cmp edi, 2
je 0x140016d3b
cmp edi, 1
jne 0x140016d76
mov qword [rbp + 0x48], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsShutdown
call fcn.1400e81d8
mov qword [rbp + 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov r9b, 1
lea r8, [rbp + 0x48]
mov rdx, qword [0x14016aa18]
xor ecx, ecx
call fcn.140019f90
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400e825c
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret