Function at 0x140004910
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x190
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14002a528]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r12, rcx
mov qword [rsp + 0x50], rcx
lea rbp, [rcx + 8]
mov qword [rsp + 0x60], rbp
xor edx, edx
mov rcx, rbp
call fcn.140003200
mov rbx, qword [0x14002bc20]
mov ecx, 0xc
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
mov ecx, 0xb
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r9d, eax
xor r14d, r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edi
mov edx, 0x80
lea r8d, [r14 + 1]
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadImageA]
mov r9, rax
mov edx, 0x80
lea r8d, [r14 + 1]
mov rcx, qword [rbp]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rbx, qword [0x14002bc20]
lea ecx, [r14 + 0x32]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
lea ecx, [r14 + 0x31]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r9d, eax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edi
mov edx, 0x80
lea r8d, [r14 + 1]
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadImageA]
mov r9, rax
xor r8d, r8d
mov edx, 0x80
mov rcx, qword [rbp]
call qword [sym.imp.USER32.dll_SendMessageA]
nop
mov qword [rsp + 0x68], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareQDFV
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
or rsi, 0xffffffffffffffff
test eax, eax
jne 0x14000524c
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0xa8], 0xf
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], al
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], r14
mov byte [rsp + 0xb8], al
mov qword [rsp + 0xf8], 0xf
mov qword [rsp + 0xf0], r14
mov byte [rsp + 0xe0], al
mov byte [rsp + 0x100], al
mov dword [rsp + 0x58], 0x40
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x100]
lea rdx, str.QDFXZ
mov rcx, rbx
call fcn.14000ca80
test eax, eax
je 0x140004b9b
cmp qword [rsp + 0xf8], 0x10
jb 0x140004b01
mov rcx, qword [rsp + 0xe0]
call fcn.14000f480
mov qword [rsp + 0xf8], 0xf
mov qword [rsp + 0xf0], r14
mov byte [rsp + 0xe0], 0
cmp qword [rsp + 0xd0], 0x10
jb 0x140004b35
mov rcx, qword [rsp + 0xb8]
call fcn.14000f480
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], r14
mov byte [rsp + 0xb8], 0
cmp qword [rsp + 0xa8], 0x10
jb 0x140004b69
mov rcx, qword [rsp + 0x90]
call fcn.14000f480
mov qword [rsp + 0xa8], 0xf
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], 0
test rbx, rbx
je 0x140004b93
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r14d
jmp 0x14000524f
mov byte [rsp + 0x13f], 0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x100]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea rax, [rsp + 0x90]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
cmovae rax, r8
lea r9, [rsp + 0x100]
mov rcx, qword [rsp + 0xa0]
cmp r9, rax
jb 0x140004c46
lea rax, [rsp + 0x90]
cmp rdx, 0x10
cmovae rax, r8
add rax, rcx
lea r9, [rsp + 0x100]
cmp rax, r9
jbe 0x140004c46
lea rax, [rsp + 0x90]
cmp rdx, 0x10
cmovae rax, r8
lea r8, [rsp + 0x100]
sub r8, rax
mov r9, rdi
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x88]
call fcn.140003d90
jmp 0x140004d00
cmp rdi, 0xfffffffffffffffe
jbe 0x140004c69
call fcn.14000f120
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x90]
cmp rdx, rdi
jae 0x140004c93
mov r8, rcx
mov rdx, rdi
lea rcx, [rsp + 0x88]
call fcn.140003630
mov rdx, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x90]
jmp 0x140004cb5
test rdi, rdi
jne 0x140004cb5
mov qword [rsp + 0xa0], r14
lea rax, [rsp + 0x90]
cmp rdx, 0x10
cmovae rax, r8
mov byte [rax], dil
jmp 0x140004d00
test rdi, rdi
je 0x140004d00
lea rcx, [rsp + 0x90]
cmp rdx, 0x10
cmovae rcx, r8
mov r9, rdi
lea r8, [rsp + 0x100]
call fcn.14000f800
mov qword [rsp + 0xa0], rdi
lea rax, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rax, qword [rsp + 0x90]
mov byte [rax + rdi], 0
mov byte [rsp + 0x100], 0
mov dword [rsp + 0x58], 0x14
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x100]
lea rdx, str.QDFXZA
mov rcx, rbx
call fcn.14000ca80
test eax, eax
je 0x140004de6
cmp qword [rsp + 0xf8], 0x10
jb 0x140004d4c
mov rcx, qword [rsp + 0xe0]
call fcn.14000f480
mov qword [rsp + 0xf8], 0xf
mov qword [rsp + 0xf0], r14
mov byte [rsp + 0xe0], 0
cmp qword [rsp + 0xd0], 0x10
jb 0x140004d80
mov rcx, qword [rsp + 0xb8]
call fcn.14000f480
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], r14
mov byte [rsp + 0xb8], 0
cmp qword [rsp + 0xa8], 0x10
jb 0x140004db4
mov rcx, qword [rsp + 0x90]
call fcn.14000f480
mov qword [rsp + 0xa8], 0xf
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], 0
test rbx, rbx
je 0x140004dde
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r14d
jmp 0x14000524f
mov byte [rsp + 0x113], 0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x100]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea rax, [rsp + 0xb8]
mov r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0x10
cmovae rax, r8
lea r9, [rsp + 0x100]
mov rcx, qword [rsp + 0xc8]
cmp r9, rax
jb 0x140004e91
lea rax, [rsp + 0xb8]
cmp rdx, 0x10
cmovae rax, r8
add rax, rcx
lea r9, [rsp + 0x100]
cmp rax, r9
jbe 0x140004e91
lea rax, [rsp + 0xb8]
cmp rdx, 0x10
cmovae rax, r8
lea r8, [rsp + 0x100]
sub r8, rax
mov r9, rdi
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xb0]
call fcn.140003d90
jmp 0x140004f4b
cmp rdi, 0xfffffffffffffffe
jbe 0x140004eb4
call fcn.14000f120
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [rsp + 0xb8]
cmp rdx, rdi
jae 0x140004ede
mov r8, rcx
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call fcn.140003630
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xb8]
jmp 0x140004f00
test rdi, rdi
jne 0x140004f00
mov qword [rsp + 0xc8], r14
lea rax, [rsp + 0xb8]
cmp rdx, 0x10
cmovae rax, r8
mov byte [rax], dil
jmp 0x140004f4b
test rdi, rdi
je 0x140004f4b
lea rcx, [rsp + 0xb8]
cmp rdx, 0x10
cmovae rcx, r8
mov r9, rdi
lea r8, [rsp + 0x100]
call fcn.14000f800
mov qword [rsp + 0xc8], rdi
lea rax, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0x10
cmovae rax, qword [rsp + 0xb8]
mov byte [rax + rdi], 0
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x88]
lea rcx, str.PACHA
call fcn.14000d1c0
lea rdx, [rsp + 0xb8]
mov r13, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xd0]
cmp r12, 0x10
cmovae rdx, r13
lea rcx, [rsp + 0xe0]
mov r14, qword [rsp + 0xf8]
cmp r14, 0x10
cmovae rcx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xc8]
mov r8, rdi
mov rbp, qword [rsp + 0xf0]
cmp rbp, rdi
cmovb r8, rbp
call fcn.14000f730
movsxd rcx, eax
test eax, eax
jne 0x140004fdb
cmp rbp, rdi
jb 0x14000518f
cmp rbp, rdi
setne al
mov ecx, eax
test ecx, ecx
jne 0x14000518f
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rcx, qword [rsp + 0x90]
mov edx, 0x40
call fcn.140010570
test rax, rax
jne 0x1400050d1
cmp qword [rsp + 0xf8], 0x10
jb 0x140005028
mov rcx, qword [rsp + 0xe0]
call fcn.14000f480
cmp qword [rsp + 0xf8], 0x10
jb 0x1400050e9
mov rcx, qword [rsp + 0xe0]
call fcn.14000f480
mov qword [rsp + 0xf8], 0xf
xor edi, edi
mov qword [rsp + 0xf0], rdi
mov byte [rsp + 0xe0], dil
cmp qword [rsp + 0xd0], 0x10
jb 0x14000511f
mov rcx, qword [rsp + 0xb8]
call fcn.14000f480
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], rdi
mov byte [rsp + 0xb8], 0
cmp qword [rsp + 0xa8], 0x10
jb 0x140005153
mov rcx, qword [rsp + 0x90]
call fcn.14000f480
invalid
add byte [rax], al
mov qword [rsp + 0xa8], 0xf
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0x90], 0
cmp r14, 0x10
jb 0x1400051b2
mov rcx, qword [rsp + 0xe0]
call fcn.14000f480
mov r12, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xb8]
mov qword [rsp + 0xf8], 0xf
xor r14d, r14d
mov qword [rsp + 0xf0], r14
mov byte [rsp + 0xe0], r14b
cmp r12, 0x10
jb 0x1400051df
mov rcx, r13
call fcn.14000f480
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xc8], r14
mov byte [rsp + 0xb8], 0
cmp qword [rsp + 0xa8], 0x10
jb 0x140005213
mov rcx, qword [rsp + 0x90]
call fcn.14000f480
mov qword [rsp + 0xa8], 0xf
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], 0
test rbx, rbx
je 0x14000523d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r14d
mov rbp, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
jmp 0x14000524f
mov edi, r14d