Function at 0x140042430
Capabilities:
Get graphical window text
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xaa8]
sub rsp, 0xba8
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rbp + 0xa90], rax
mov qword [rsp + 0x58], r9
mov rbx, r8
mov rdi, rdx
mov r12, rcx
xor sil, sil
mov byte [rsp + 0x40], sil
xor r13d, r13d
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], 7
mov word [rbp], r13w
lea rdx, str.winword
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea r14d, [r13 + 0xa]
test eax, eax
jne 0x1400424ac
lea r8d, [r13 + 4]
lea rdx, str.Word
jmp 0x1400424eb
lea rdx, str.excel
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400424cd
lea r8d, [rax + 5]
lea rdx, str.Excel
jmp 0x1400424eb
lea rdx, str.powerpnt
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400424f4
mov r8, r14
lea rdx, str.PowerPoint
lea rcx, [rbp]
call fcn.14000d6c0
cmp qword [rbp + 0x10], 0
je 0x14004341b
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140042520
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14000d6c0
nop
lea r11, [rbp - 0x40]
mov r14, qword [rbp - 0x40]
mov r15, qword [rbp - 0x28]
cmp r15, 8
cmovae r11, r14
lea rbx, [0x1400a0340]
mov rdi, qword [rbp - 0x30]
cmp rdi, 1
jb 0x1400425fd
lea r10, [r11 + rdi*2]
mov rdx, r11
nop dword [rax + rax]
mov rax, r10
sub rax, rdx
sar rax, 1
je 0x1400425fd
cmp word [rdx], 0x2e
je 0x14004258f
add rdx, 2
sub rax, 1
jmp 0x140042579
mov r8d, 1
mov rcx, rbx
mov r9, rdx
sub r9, rbx
nop
movzx eax, word [rcx]
cmp word [r9 + rcx], ax
jne 0x1400425dc
add rcx, 2
sub r8, 1
jne 0x1400425a0
sub rdx, r11
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x1400425fd
cmp rdx, rdi
ja 0x1400425e2
mov qword [rbp - 0x30], rdx
lea rax, [rbp - 0x40]
cmp r15, 8
cmovae rax, r14
mov word [rax + rdx*2], r13w
jmp 0x1400425f1
add rdx, 2
jmp 0x140042570
xor r8d, r8d
sub rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.1400444f0
mov r14, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x28]
mov r8, rsi
lea rdx, [0x1400b9f10]
lea rcx, [rbp - 0x40]
call fcn.140044cc0
cmp rax, 0xffffffffffffffff
je 0x14004264c
lea rcx, [rbp - 0x40]
cmp rax, rdi
ja 0x140042632
mov qword [rbp - 0x30], rax
cmp r15, 8
cmovae rcx, r14
mov word [rcx + rax*2], r13w
jmp 0x140042640
xor r8d, r8d
sub rax, rdi
mov rdx, rax
call fcn.1400444f0
mov r14, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x28]
mov esi, r13d
lea rbx, [rbp - 0x40]
cmp r15, 8
cmovae rbx, r14
movabs r13, 0x7ffffffffffffffe
test rdi, rdi
je 0x14004288d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x40]
call fcn.1400725e0
lea rcx, str.Office
lea r8, [0x1400a25e4]
mov edx, 0x100
movzx eax, word [rcx]
cmp ax, dx
jae 0x1400426e2
movzx eax, al
mov byte [rbp + rax + 0x40], 1
add rcx, 2
cmp rcx, r8
jne 0x140042692
lea rcx, [rdi - 1]
mov r9, 0xffffffffffffffff
mov rax, r9
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rbx + rax*2]
movzx eax, word [rcx]
cmp ax, dx
jae 0x1400426d3
cmp byte [rbp + rax + 0x40], sil
jne 0x140042730
cmp rcx, rbx
je 0x14004288d
sub rcx, 2
jmp 0x1400426c4
lea rcx, [rdi - 1]
mov r9, 0xffffffffffffffff
mov rax, r9
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rbx + rax*2]
nop dword [rax + rax]
mov edx, 6
lea rax, str.Office
movzx r8d, word [rcx]
cmp word [rax], r8w
je 0x140042730
add rax, 2
sub rdx, 1
jne 0x140042710
cmp rcx, rbx
je 0x14004272b
sub rcx, 2
jmp 0x140042700
mov rcx, r9
jmp 0x140042736
sub rcx, rbx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x14004288d
inc rcx
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], ax
cmp rdi, rcx
jb 0x140043484
sub rdi, rcx
mov rsi, r9
cmp rdi, 0xffffffffffffffff
cmovb rsi, rdi
lea rax, [rbp - 0x40]
cmp r15, 8
cmovae rax, r14
lea r14, [rax + rcx*2]
cmp rsi, 7
ja 0x1400427a8
mov qword [rbp - 0x50], rsi
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x60]
call fcn.1400721b0
xor r15d, r15d
mov word [rbp + rbx - 0x60], r15w
lea r13d, [r15 + 0xa]
jmp 0x14004280c
cmp rsi, r13
ja 0x14004348a
mov rbx, rsi
or rbx, 7
cmp rbx, r13
jbe 0x1400427c8
mov rbx, r13
mov r13d, 0xa
jmp 0x1400427d6
cmp rbx, 0xa
mov r13d, 0xa
cmovb rbx, r13
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x60]
call fcn.14000d860
mov rdi, rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.1400721b0
xor r15d, r15d
mov word [rbx + rdi], r15w
mov qword [rbp - 0x60], rdi
call fcn.14007c9f0
mov rdi, rax
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rbx, qword [rbp - 0x60]
mov dword [rax], r15d
mov r8d, r13d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14007dbe8
mov esi, eax
cmp rbx, qword [rsp + 0x48]
je 0x140043490
cmp dword [rdi], 0x22
je 0x1400434a3
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140042890
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042886
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004349d
call fcn.14006fc78
jmp 0x140042890
xor r15d, r15d
lea r9, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r9, qword [rbp]
mov r8d, esi
lea rdx, str.SoftwareMicrosoftOffice_d.0_sUser_MRU
lea rcx, [rbp + 0x880]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x50], r15
mov r9d, 0xf003f
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x880]
mov rcx, 0xffffffff80000001
call fcn.14005a990
test eax, eax
jne 0x1400433d6
mov dword [rsp + 0x44], 0x208
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x44]
lea r8, [rbp + 0x460]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400433ca
mov qword [rsp + 0x48], r15
lea rdx, str.File_MRU
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9d, 0xf003f
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x460]
mov rcx, qword [rsp + 0x50]
call fcn.14005a990
test eax, eax
jne 0x1400433ca
mov qword [rbp - 0x70], r15
mov r13d, 7
mov qword [rbp - 0x68], r13
mov word [rbp - 0x80], r15w
mov r8d, 0x104
lea rdx, [rbp + 0x670]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r13
mov word [rbp - 0x60], r15w
lea rax, [rbp + 0x670]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400429a0
lea rdx, [rbp + 0x670]
lea rcx, [rbp - 0x60]
call fcn.14000d6c0
nop
lea r10, [rbp - 0x60]
mov rbx, qword [rbp - 0x60]
mov r14, qword [rbp - 0x48]
cmp r14, 8
cmovae r10, rbx
mov r12, qword [rbp - 0x50]
cmp r12, 1
jb 0x140042d21
lea r9, [r10 + r12*2]
mov rdi, r10
nop word [rax + rax]
mov rax, r9
sub rax, rdi
sar rax, 1
je 0x140042d21
cmp word [rdi], 0x2e
je 0x140042a0f
add rdi, 2
sub rax, 1
jmp 0x1400429f9
mov edx, 1
lea rax, [0x1400a0340]
mov rcx, rax
mov r8, rdi
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140042a92
add rcx, 2
sub rdx, 1
jne 0x140042a24
sub rdi, r10
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x140042d21
lea r15, [rbp - 0x60]
cmp r14, 8
cmovae r15, rbx
cmp r12, 7
ja 0x140042a9b
mov qword [rbp - 0x70], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.1400721b0
xor r15d, r15d
mov word [rbp + rbx - 0x80], r15w
mov rsi, qword [rbp - 0x68]
mov r12, qword [rbp - 0x70]
mov r14, qword [rbp - 0x80]
movabs r13, 0x7ffffffffffffffe
jmp 0x140042b02
add rdi, 2
jmp 0x1400429f0
movabs r13, 0x7ffffffffffffffe
cmp r12, r13
ja 0x1400434bc
mov rsi, r12
or rsi, 7
cmp rsi, r13
jbe 0x140042abf
mov rsi, r13
jmp 0x140042acc
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x80]
call fcn.14000d860
mov r14, rax
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rsi
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.1400721b0
xor r15d, r15d
mov word [rbx + r14], r15w
mov qword [rbp - 0x80], r14
lea rbx, [rdi + 1]
cmp rbx, r12
ja 0x140042b22
mov qword [rbp - 0x70], rbx
lea rax, [rbp - 0x80]
cmp rsi, 8
cmovae rax, r14
mov word [rax + rbx*2], r15w
jmp 0x140042b34
xor r8d, r8d
mov rdx, rbx
sub rdx, r12
lea rcx, [rbp - 0x80]
call fcn.1400444f0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rax, qword [rbp - 0x50]
cmp rax, rbx
jb 0x1400434b0
sub rax, rbx
mov rdi, 0xffffffffffffffff
cmp rax, rdi
cmovb rdi, rax
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rax, qword [rbp - 0x60]
lea rsi, [rax + rbx*2]
cmp rdi, 7
ja 0x140042ba4
mov qword [rsp + 0x70], rdi
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1400721b0
mov word [rsp + rbx + 0x60], r15w
mov r14, qword [rsp + 0x60]
jmp 0x140042c02
cmp rdi, r13
ja 0x1400434bc
mov rbx, rdi
or rbx, 7
cmp rbx, r13
jbe 0x140042bbe
mov rbx, r13
jmp 0x140042bcb
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x60]
call fcn.14000d860
mov r14, rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400721b0
mov word [r14 + rbx], r15w
mov qword [rsp + 0x60], r14
lea r10, [rsp + 0x60]
mov r11, qword [rsp + 0x78]
cmp r11, 8
cmovae r10, r14
mov rbx, qword [rsp + 0x70]
cmp rbx, 1
jb 0x140042cdd
lea rdi, [r10 + rbx*2]
mov rdx, r10
lea rsi, [0x1400bad70]
mov rax, rdi
sub rax, rdx
sar rax, 1
je 0x140042cdd
cmp word [rdx], 0x20
je 0x140042c50
add rdx, 2
sub rax, 1
jmp 0x140042c3a
mov r8d, 1
mov rcx, rsi
mov r9, rdx
sub r9, rsi
nop
movzx eax, word [rcx]
cmp word [rcx + r9], ax
jne 0x140042c9e
add rcx, 2
sub r8, 1
jne 0x140042c60
sub rdx, r10
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x140042cdd
cmp rdx, rbx
ja 0x140042ca4
mov qword [rsp + 0x70], rdx
lea rax, [rsp + 0x60]
cmp r11, 8
cmovae rax, r14
mov word [rax + rdx*2], r15w
jmp 0x140042cb4
add rdx, 2
jmp 0x140042c31
xor r8d, r8d
sub rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400444f0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.14000edd0
mov r11, qword [rsp + 0x78]
mov r14, qword [rsp + 0x60]
cmp r11, 8
jb 0x140042e2c
lea rdx, [r11*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140042d14
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434b6
mov rcx, r14
call fcn.14006fc78
jmp 0x140042e2c
xor r8d, r8d
lea rdx, [0x1400bad68]
lea rcx, [rbp - 0x60]
call fcn.140044b60
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400432c8
lea r15, [rbp - 0x60]
cmp r14, 8
cmovae r15, rbx
cmp r12, 7
ja 0x140042d81
mov qword [rbp - 0x70], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.1400721b0
xor r15d, r15d
mov word [rbp + rbx - 0x80], r15w
mov rdi, qword [rbp - 0x68]
mov r12, qword [rbp - 0x70]
mov r14, qword [rbp - 0x80]
jmp 0x140042de8
movabs rax, 0x7ffffffffffffffe
cmp r12, rax
ja 0x1400434c2
mov rdi, r12
or rdi, 7
cmp rdi, rax
jbe 0x140042da5
mov rdi, rax
jmp 0x140042db2
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x80]
call fcn.14000d860
mov r14, rax
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rdi
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.1400721b0
xor r15d, r15d
mov word [rbx + r14], r15w
mov qword [rbp - 0x80], r14
cmp rsi, r12
ja 0x140042e04
mov qword [rbp - 0x70], rsi
lea rax, [rbp - 0x80]
cmp rdi, 8
cmovae rax, r14
mov word [rax + rsi*2], r15w
jmp 0x140042e16
xor r8d, r8d
sub rsi, r12
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.1400444f0
mov r8d, 1
lea rdx, [0x1400a0340]
lea rcx, [rbp - 0x80]
call fcn.14000edd0
mov rsi, qword [rbp - 0x70]
test rsi, rsi
je 0x1400432c4
mov r12d, 1
mov r8d, r12d
lea rdx, str.Item__d
lea rcx, [rbp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x250]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r13, qword [rbp - 0x68]
test eax, eax
jne 0x14004332e
lea rbx, [r12 - 2]
nop word [rax + rax]
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r15w
lea rax, [rbp + 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140042ec0
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.14000d6c0
nop
lea r10, [rbp - 0x80]
cmp r13, 8
cmovae r10, qword [rbp - 0x80]
lea rdi, [rbp - 0x20]
mov r11, qword [rbp - 0x20]
mov r14, qword [rbp - 8]
cmp r14, 8
cmovae rdi, r11
mov r15, qword [rbp - 0x10]
cmp rsi, r15
ja 0x140042f3c
mov rbx, r15
sub rbx, rsi
inc rbx
lea rbx, [rdi + rbx*2]
mov rdx, rdi
mov rax, rbx
sub rax, rdx
sar rax, 1
je 0x140042f35
movzx ecx, word [r10]
cmp word [rdx], cx
je 0x140042fe4
add rdx, 2
sub rax, 1
jne 0x140042f22
mov rbx, 0xffffffffffffffff
mov rdx, rbx
cmp rdx, 0xffffffffffffffff
jne 0x140043024
inc r12d
cmp r14, 8
jb 0x140042f87
lea rdx, [r14*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x140042f7f
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434e0
mov rcx, r11
call fcn.14006fc78
mov r8d, r12d
lea rdx, str.Item__d
lea rcx, [rbp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x250]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov r15d, 0
je 0x140042ea0
jmp 0x14004332e
mov r8, rsi
mov rcx, r10
test rsi, rsi
je 0x140043009
mov r9, rdx
sub r9, r10
movzx eax, word [rcx]
cmp word [rcx + r9], ax
jne 0x14004301b
add rcx, 2
sub r8, 1
jne 0x140042ff5
sub rdx, rdi
sar rdx, 1
mov rbx, 0xffffffffffffffff
jmp 0x140042f3f
add rdx, 2
jmp 0x140042f13
lea r9, [rbp - 0x20]
cmp r14, 8
cmovae r9, r11
cmp r15, 1
jb 0x140043096
lea r10, [r9 + r15*2]
mov rbx, r9
lea r11, [0x1400a2670]
mov rax, r10
sub rax, rbx
sar rax, 1
je 0x140043096
cmp word [rbx], 0x2a
je 0x14004305f
add rbx, 2
sub rax, 1
jmp 0x14004304d
mov edx, 1
mov rcx, r11
mov r8, rbx
sub r8, r11
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140043090
add rcx, 2
sub rdx, 1
jne 0x140043070
sub rbx, r9
sar rbx, 1
lea r15, [rdx - 1]
jmp 0x1400430a0
add rbx, 2
jmp 0x140043044
mov r15, 0xffffffffffffffff
mov rbx, r15
xor r12d, r12d
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r12w
lea r8d, [r12 + 1]
lea rdx, [0x1400a0830]
lea rcx, [rbp + 0x20]
call fcn.14000d6c0
nop
inc rbx
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
mov rax, qword [rbp - 0x10]
cmp rax, rbx
jb 0x1400434c8
sub rax, rbx
cmp rax, 0xffffffffffffffff
cmovb r15, rax
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
lea rsi, [rax + rbx*2]
cmp r15, 7
ja 0x140043141
mov qword [rsp + 0x70], r15
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1400721b0
mov word [rsp + rbx + 0x60], r12w
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x60]
jmp 0x1400431a7
movabs r14, 0x7ffffffffffffffe
cmp r15, r14
ja 0x1400434ce
mov rax, r15
or rax, 7
cmp rax, r14
ja 0x140043170
mov r14, rax
cmp rax, 0xa
mov eax, 0xa
cmovb r14, rax
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x60]
call fcn.14000d860
mov rdi, rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r14
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400721b0
mov word [rdi + rbx], r12w
mov qword [rsp + 0x60], rdi
lea rdx, [rsp + 0x60]
cmp r14, 8
cmovae rdx, rdi
mov r8, r15
lea rcx, [rbp + 0x20]
call fcn.14000edd0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140043203
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400431fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434d4
call fcn.14006fc78
mov r8d, 1
lea rdx, [0x1400a0830]
lea rcx, [rbp + 0x20]
call fcn.14000edd0
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r8, qword [rbp + 0x20]
mov rdx, qword [rbp + 0xb10]
mov rcx, qword [rsp + 0x58]
call fcn.140004c90
mov byte [rsp + 0x40], 1
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14004327e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043278
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434da
call fcn.14006fc78
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140043331
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400432bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434e0
call fcn.14006fc78
jmp 0x140043331
mov r13, qword [rbp - 0x68]
mov rcx, qword [rbp + 0xb10]
shr rcx, 1
lea rax, [rcx - 1]
mov edx, 0x7ffffffe
cmp rax, rdx
ja 0x140043320
sub rdx, rcx
lea r8, [0x14009ee90]
mov r9, qword [rsp + 0x58]
sub r8, r9
lea rax, [rdx + rcx]
test rax, rax
je 0x140043313
movzx eax, word [r8 + r9]
test ax, ax
je 0x140043313
mov word [r9], ax
add r9, 2
sub rcx, 1
jne 0x1400432f2
lea rax, [r9 - 2]
test rcx, rcx
cmovne rax, r9
jmp 0x14004332a
test rcx, rcx
je 0x14004332e
mov rax, qword [rsp + 0x58]
mov word [rax], r15w
xor r12d, r12d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14004337d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043378
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434e6
call fcn.14006fc78
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
cmp r13, 8
jb 0x1400433ca
lea rdx, [r13*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400433c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434ec
call fcn.14006fc78
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140043416
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043411
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434f2
call fcn.14006fc78
movzx esi, byte [rsp + 0x40]
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x140043457
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043452
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004347e
call fcn.14006fc78
movzx eax, sil
mov rcx, qword [rbp + 0xa90]
xor rcx, rsp
call fcn.14006fd90
add rsp, 0xba8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14007698c
nop
call fcn.14000eeb0
nop
call fcn.140008330
nop
lea rcx, str.InternetOpenA
call fcn.14006e7c4
nop
call fcn.14007698c
nop
lea rcx, str.stoi_argument_out_of_range
call fcn.14006e80c
nop
call fcn.14000eeb0
int3
call fcn.14007698c
int3
call fcn.140008330
int3
call fcn.140008330
nop
call fcn.14000eeb0
int3
call fcn.140008330
int3
call fcn.14007698c
nop
call fcn.14007698c
nop
call fcn.14007698c
nop
call fcn.14007698c
nop
call fcn.14007698c
nop
call fcn.14007698c
int3