Function at 0x140046760
Capabilities:
Create http request
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x6110
call fcn.1400b5d40
sub rsp, rax
mov qword [rsp + 0xa08], 0xfffffffffffffffe
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rsp + 0x6100], rax
mov r14, r8
mov rbx, rdx
mov r13, rcx
mov qword [rsp + 0x2d8], rcx
mov qword [rsp + 0x318], rdx
mov qword [rsp + 0x308], r8
xor edi, edi
mov byte [rsp + 0x40], dil
mov eax, dword [rsp + 0x60]
and eax, 0xffffff00
mov dword [rsp + 0x60], eax
btr eax, 8
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x68], rdi
lea rcx, [rsp + 0x3160]
call fcn.140026c84
nop
mov rdx, qword [rbx]
mov qword [rsp + 0xeb0], rdx
lea rcx, [rsp + 0x70]
call fcn.14001674c
nop
mov rdx, qword [rsp + 0x70]
lea rax, [rdx - 0x18]
mov qword [rsp + 0xec0], rax
lea r12d, [rdi + 1]
cmp dword [rax + 0x10], r12d
jle 0x14004682a
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x70]
call fcn.140017148
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x3060], rdi
mov qword [rsp + 0x3068], rdi
mov r15d, 0xf
mov qword [rsp + 0x3068], r15
mov qword [rsp + 0x3060], rdi
mov byte [rsp + 0x3050], dil
or rsi, 0xffffffffffffffff
cmp byte [rdx], dil
jne 0x140046866
mov r8, rdi
jmp 0x140046872
mov r8, rsi
inc r8
cmp byte [rdx + r8], dil
jne 0x140046869
lea rcx, [rsp + 0x3050]
call fcn.1400013c8
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x3050]
lea rcx, [rsp + 0x3160]
call fcn.140026d7c
test al, al
jne 0x14004697e
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x338]
call fcn.1400029e4
nop
lea rdx, [rsp + 0x338]
mov rcx, qword [r13 + 0x40]
call fcn.1400424e0
nop
mov rcx, qword [rsp + 0x338]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x480], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400468fc
mov rdx, qword [rsp + 0x480]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3068], 0x10
jb 0x140046914
mov rcx, qword [rsp + 0x3050]
call fcn.1400b0c74
mov qword [rsp + 0x3068], r15
mov qword [rsp + 0x3060], rdi
mov byte [rsp + 0x3050], dil
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004695c
mov rdx, qword [rsp + 0x8b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
cmp byte [rsp + 0x60], dil
jne 0x140046a65
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x328]
call fcn.1400029e4
nop
lea rdx, [rsp + 0x328]
mov rcx, qword [r13 + 0x40]
call fcn.1400424e0
nop
mov rcx, qword [rsp + 0x328]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x490], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400469e3
mov rdx, qword [rsp + 0x490]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3068], 0x10
jb 0x1400469fb
mov rcx, qword [rsp + 0x3050]
call fcn.1400b0c74
mov qword [rsp + 0x3068], r15
mov qword [rsp + 0x3060], rdi
mov byte [rsp + 0x3050], dil
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140046a43
mov rdx, qword [rsp + 0x6c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
lea rdx, str.action
lea rcx, [rsp + 0x58]
call fcn.14002abf4
mov qword [rsp + 0xed0], rax
lea rcx, [0x14018d368]
cmp rax, rcx
je 0x14004b3d1
lea rdx, str.action
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xee0], rax
cmp byte [rax + 8], 4
jne 0x14004b3d1
lea rbx, str.param
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002abf4
lea rdx, str.action
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xef0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe98], rdx
lea rcx, [rsp + 0x48]
call fcn.1400029e4
nop
lea rdx, str.injectScript
mov rcx, qword [rsp + 0x48]
call fcn.1400c4c70
mov dword [rsp + 0x7c8], eax
test eax, eax
jne 0x1400474bb
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0x918], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xcc8], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0x928], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xfe8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x938], rdx
lea rcx, [rsp + 0x98]
call fcn.1400029e4
nop
mov rax, qword [rsp + 0x98]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x430], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400b17cc
mov qword [rsp + 0x190], rax
test rax, rax
je 0x1400473bc
mov r8, rax
lea rdx, [rsp + 0x98]
call fcn.14004b518
test al, al
je 0x1400473bc
mov r15, qword [r13 + 0x40]
mov ebx, 0x1b0
add r15, rbx
mov qword [rsp + 0xcd8], r15
mov rcx, qword [r15]
mov qword [rsp + 0x948], rcx
mov edx, 0x5c
call fcn.1400b3578
mov rcx, rax
mov qword [rsp + 0xea8], rax
test rax, rax
jne 0x140046c14
mov ecx, esi
jmp 0x140046c25
mov rax, qword [r15]
mov qword [rsp + 0x958], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, rbx
lea rdx, [rsp + 0xf0]
call fcn.14001f244
nop
mov rdx, qword [r13 + 0x40]
add rdx, rbx
lea rcx, [rsp + 0x1c8]
call fcn.140002948
nop
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x1c8]
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x170], eax
test eax, eax
je 0x140046ded
test r14, r14
je 0x140046c9e
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x1c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140046cd1
mov rdx, qword [rsp + 0x4a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xf0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140046d04
mov rdx, qword [rsp + 0x7e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140046d37
mov rdx, qword [rsp + 0x4b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140046d67
mov rdx, qword [rsp + 0x6d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3068], 0x10
jb 0x140046d7f
mov rcx, qword [rsp + 0x3050]
call fcn.1400b0c74
mov qword [rsp + 0x3068], 0xf
mov qword [rsp + 0x3060], rdi
mov byte [rsp + 0x3050], dil
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140046dcb
mov rdx, qword [rsp + 0x4c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
mov rbx, qword [r13 + 0x40]
add rbx, 0x2c8
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x208], rbx
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xce8], rax
lea rdx, str.forceOverwrite
mov rcx, rax
call fcn.14002abf4
mov qword [rsp + 0x968], rax
lea rcx, [0x14018d368]
cmp rax, rcx
je 0x1400470c7
lea rcx, [0x1401849a8]
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
mov qword [rsp + 0x1018], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x110], rbx
mov eax, edi
mov dword [rsp + 0xfc], eax
mov edx, edi
mov dword [rsp + 0x7c], edx
mov r15d, 0x7ffe
test eax, eax
jne 0x14004708d
mov dword [rsp + 0x1c0], r15d
lea rax, [rbx - 0x18]
mov qword [rsp + 0x978], rax
mov ecx, r12d
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x698], ecx
mov eax, dword [rax + 0xc]
sub eax, r15d
mov dword [rsp + 0x440], eax
or eax, ecx
jge 0x140046ed8
mov edx, r15d
lea rcx, [rsp + 0x110]
call fcn.140001f54
mov rbx, qword [rsp + 0x110]
mov edx, dword [rsp + 0x7c]
cmp dword [rbx - 0xc], r15d
jge 0x140046ee8
mov ecx, 0x80070057
call fcn.140001874
mov dword [rbx - 0x10], r15d
mov word [rbx + 0xfffc], di
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x1c0]
mov r8, rbx
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0xfc], eax
movsxd rax, dword [rbx - 0xc]
mov dword [rsp + 0x868], eax
mov rdx, rax
mov rcx, rbx
call fcn.1400b1884
mov dword [rsp + 0x450], eax
test eax, eax
js 0x140047083
cmp eax, dword [rbx - 0xc]
jg 0x140047083
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
mov rax, qword [rsp + 0x100]
mov dword [rax], edi
lea r8, str._data
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x878]
call fcn.140016a58
mov qword [rsp + 0xcf8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x988], rdx
test rdx, rdx
jne 0x140046fa0
mov eax, esi
jmp 0x140046fc9
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x6a8], eax
test eax, eax
js 0x140046f9c
mov rcx, rbx
call fcn.1400b1a54
mov qword [rsp + 0xeb8], rax
test rax, rax
je 0x140046f9c
sub rax, rbx
sar rax, 1
mov dword [rsp + 0x94], eax
cmp eax, esi
setne byte [rsp + 0x78]
mov rcx, qword [rsp + 0x878]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047009
mov rdx, qword [rsp + 0x4d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x78], dil
je 0x14004704e
mov dword [rsp + 0x7c], edi
mov rbx, qword [rsp + 0x110]
mov rdx, rbx
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x170], eax
test eax, eax
je 0x140047063
test r14, r14
je 0x14004708d
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], di
jmp 0x140047093
mov edx, dword [rsp + 0x7c]
add edx, r12d
mov dword [rsp + 0x7c], edx
mov rbx, qword [rsp + 0x110]
jmp 0x140047067
mov edx, dword [rsp + 0x7c]
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x100], rax
mov eax, dword [rsp + 0xfc]
jmp 0x140046e82
mov ecx, 0x80070057
call fcn.140001874
mov r15d, 0xb
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x6e8], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400470bd
mov rdx, qword [rsp + 0x6e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x208]
jmp 0x1400470cd
mov r15d, 0xb
mov rax, qword [rsp + 0x98]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x460], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rcx, qword [rsp + 0x190]
mov rdx, rcx
call fcn.140046700
mov edx, dword [rbx]
lea eax, [rdx + 1]
mov dword [rbx], eax
lea rcx, [rsp + 0x3140]
call fcn.140046540
mov qword [rsp + 0x998], rax
cmp qword [rax + 0x18], 0x10
jb 0x14004711d
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x4f0]
call fcn.1400029e4
mov rbx, rax
lea r8, str._data
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x4e0]
call fcn.140016a58
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x350]
call fcn.14000cfa0
nop
mov rcx, qword [rsp + 0x4e0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047194
mov rdx, qword [rsp + 0x7f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x4f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400471c7
mov rdx, qword [rsp + 0x6f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3158], 0x10
jb 0x1400471df
mov rcx, qword [rsp + 0x3140]
call fcn.1400b0c74
mov qword [rsp + 0x3158], 0xf
mov qword [rsp + 0x3150], rdi
mov byte [rsp + 0x3140], dil
mov rbx, qword [rsp + 0x190]
cmp byte [rsp + 0x40], dil
jne 0x140047249
mov rax, qword [rsp + 0x98]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x7d8], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x350]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0xf0]
mov rcx, r13
call fcn.14004b630
mov rcx, rbx
call fcn.1400b1748
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x140047285
mov word [r14], r15w
mov word [r14 + 8], si
mov rax, qword [r13 + 0x40]
cmp dword [rax + 0x2d0], 3
jne 0x14004729c
mov dword [rax + 0x2d0], 4
mov ecx, dword [0x14018cd80]
imul ecx, ecx
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0x11
jne 0x1400472f1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
add r8d, r12d
mov dword [rsp + 0x470], r8d
mov dword [0x14018cd80], r8d
mov rcx, qword [rsp + 0x350]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x500], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047324
mov rdx, qword [rsp + 0x500]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047357
mov rdx, qword [rsp + 0x8f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xf0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x510], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004738a
mov rdx, qword [rsp + 0x510]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x708], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b38c
mov rdx, qword [rsp + 0x708]
jmp 0x14004b382
test r14, r14
je 0x1400473d6
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], di
mov r15d, 0xf
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x520], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047409
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x808], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047439
mov rdx, qword [rsp + 0x808]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3068], 0x10
jb 0x140047451
mov rcx, qword [rsp + 0x3050]
call fcn.1400b0c74
mov qword [rsp + 0x3068], r15
mov qword [rsp + 0x3060], rdi
mov byte [rsp + 0x3050], dil
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x530], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047499
mov rdx, qword [rsp + 0x530]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
lea rdx, str.setDLLBinaryReplacment
mov rcx, qword [rsp + 0x48]
call fcn.1400c4c70
mov dword [rsp + 0x6b8], eax
test eax, eax
jne 0x140048127
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xd08], rax
lea rdx, str.from
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x9a8], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xff8], rax
lea rdx, [0x14012126c]
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x9b8], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xd18], rax
lea rdx, str.offset
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x9c8], rax
cmp byte [rax + 8], r12b
jne 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xec8], rax
lea rdx, str.from
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x9d8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd28], rdx
lea rcx, [rsp + 0x88]
call fcn.1400029e4
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0x9e8], rax
lea rdx, [0x14012126c]
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x1038], rax
mov rdx, qword [rax]
mov qword [rsp + 0x9f8], rdx
lea rcx, [rsp + 0xa0]
call fcn.1400029e4
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xd38], rax
lea rdx, str.offset
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x900], rax
mov rcx, rax
call fcn.14002a474
mov dword [rsp + 0x1bc], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x674], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400b17cc
mov r15, rax
mov qword [rsp + 0x748], rax
mov rcx, qword [rsp + 0xa0]
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x7a0], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400b17cc
mov rbx, rax
mov qword [rsp + 0x5a0], rax
test r15, r15
je 0x140047ff7
test rax, rax
je 0x140047ff7
mov r8, r15
lea rdx, [rsp + 0x88]
call fcn.14004b518
test al, al
je 0x140047ff7
mov r8, rbx
lea rdx, [rsp + 0xa0]
call fcn.14004b518
test al, al
je 0x140047ff7
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x8d0], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, r15
mov rcx, r15
call fcn.140046700
mov r8, qword [rsp + 0xa0]
mov eax, dword [r8 - 0x10]
mov dword [rsp + 0x8d8], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, rbx
mov rcx, rbx
call fcn.140046700
mov r15, qword [r13 + 0x40]
mov ebx, 0x1b0
add r15, rbx
mov qword [rsp + 0xed8], r15
mov rcx, qword [r15]
mov qword [rsp + 0xa18], rcx
mov edx, 0x5c
call fcn.1400b3578
mov rcx, rax
mov qword [rsp + 0xd48], rax
test rax, rax
jne 0x140047760
mov ecx, esi
jmp 0x140047771
mov rax, qword [r15]
mov qword [rsp + 0xa28], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, rbx
lea rdx, [rsp + 0xb0]
call fcn.14001f244
nop
mov rdx, qword [r13 + 0x40]
add rdx, rbx
lea rcx, [rsp + 0x160]
call fcn.140002948
nop
mov rax, qword [r13 + 0x40]
add rax, 0x2cc
mov qword [rsp + 0x370], rax
mov edx, dword [rax]
lea rcx, [rsp + 0x3120]
call fcn.140046540
mov qword [rsp + 0x1008], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400477d2
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x888]
call fcn.1400029e4
mov rbx, rax
lea r8, str._from
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x718]
call fcn.140016a58
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.14000cfa0
nop
mov rcx, qword [rsp + 0x718]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x540], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047849
mov rdx, qword [rsp + 0x540]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x888]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x550], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004787c
mov rdx, qword [rsp + 0x550]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3138], 0x10
jb 0x140047894
mov rcx, qword [rsp + 0x3120]
call fcn.1400b0c74
mov r15d, 0xf
mov qword [rsp + 0x3138], r15
mov qword [rsp + 0x3130], rdi
mov byte [rsp + 0x3120], dil
mov rax, qword [rsp + 0x370]
mov edx, dword [rax]
lea rcx, [rsp + 0x30e0]
call fcn.140046540
mov qword [rsp + 0xa38], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400478db
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x818]
call fcn.1400029e4
mov rbx, rax
lea r8, [0x1401212b0]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x728]
call fcn.140016a58
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1f8]
call fcn.14000cfa0
nop
mov rcx, qword [rsp + 0x728]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x560], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047952
mov rdx, qword [rsp + 0x560]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x818]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x570], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047985
mov rdx, qword [rsp + 0x570]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x30f8], 0x10
jb 0x14004799d
mov rcx, qword [rsp + 0x30e0]
call fcn.1400b0c74
mov qword [rsp + 0x30f8], r15
mov qword [rsp + 0x30f0], rdi
mov byte [rsp + 0x30e0], dil
mov rcx, qword [rsp + 0x370]
mov edx, dword [rcx]
lea eax, [rdx + 1]
mov dword [rcx], eax
lea rcx, [rsp + 0x3100]
call fcn.140046540
mov qword [rsp + 0xd58], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400479e3
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x8c8]
call fcn.1400029e4
mov rbx, rax
lea r8, [0x1401212c0]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x738]
call fcn.140016a58
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1a0]
call fcn.14000cfa0
nop
mov rcx, qword [rsp + 0x738]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x580], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047a5a
mov rdx, qword [rsp + 0x580]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x8c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x590], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047a8d
mov rdx, qword [rsp + 0x590]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3118], 0x10
jb 0x140047aa5
mov rcx, qword [rsp + 0x3100]
call fcn.1400b0c74
mov qword [rsp + 0x3118], r15
mov qword [rsp + 0x3110], rdi
mov byte [rsp + 0x3100], dil
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x160]
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140047dc8
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x8e8], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov rbx, qword [rsp + 0x748]
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140047dc8
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x1bc]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140047dc8
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x8f8], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov r15, qword [rsp + 0x5a0]
mov qword [rsp + 0x20], r15
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140047dc8
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xb0]
mov rcx, r13
call fcn.14004b630
mov rcx, r15
call fcn.1400b1748
mov eax, dword [0x14018cd80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x12
jne 0x140047c3a
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rcx, rbx
call fcn.1400b1748
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x140047c64
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], si
mov rcx, qword [rsp + 0x1a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x828], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047c97
mov rdx, qword [rsp + 0x828]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047cca
mov rdx, qword [rsp + 0x5b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x758], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047cfd
mov rdx, qword [rsp + 0x758]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x160]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047d30
mov rdx, qword [rsp + 0x5c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x898], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047d63
mov rdx, qword [rsp + 0x898]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047d96
mov rdx, qword [rsp + 0x5d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x768], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b38c
mov rdx, qword [rsp + 0x768]
jmp 0x14004b382
test r14, r14
je 0x140047ddc
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x1a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047e0f
mov rdx, qword [rsp + 0x5e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x838], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047e42
mov rdx, qword [rsp + 0x838]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047e75
mov rdx, qword [rsp + 0x5f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x160]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x778], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047ea8
mov rdx, qword [rsp + 0x778]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x600], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047edb
mov rdx, qword [rsp + 0x600]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047f0e
mov rdx, qword [rsp + 0x8e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x610], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047f41
mov rdx, qword [rsp + 0x610]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x788], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047f71
mov rdx, qword [rsp + 0x788]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3068], 0x10
jb 0x140047f89
mov rcx, qword [rsp + 0x3050]
call fcn.1400b0c74
mov qword [rsp + 0x3068], 0xf
mov qword [rsp + 0x3060], rdi
mov byte [rsp + 0x3050], dil
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x620], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140047fd5
mov rdx, qword [rsp + 0x620]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
test r14, r14
je 0x14004800b
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x848], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004803e
mov rdx, qword [rsp + 0x848]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x630], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048071
mov rdx, qword [rsp + 0x630]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x798], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400480a1
mov rdx, qword [rsp + 0x798]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3068], 0x10
jb 0x1400480b9
mov rcx, qword [rsp + 0x3050]
call fcn.1400b0c74
mov qword [rsp + 0x3068], 0xf
mov qword [rsp + 0x3060], rdi
mov byte [rsp + 0x3050], dil
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x640], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048105
mov rdx, qword [rsp + 0x640]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
lea rdx, str.getCurrentCppTime
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x1400482d1
test r14, r14
je 0x14004b38c
lea rcx, [rsp + 0x8a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov qword [rsp + 0x158], rdi
mov rcx, qword [rsp + 0x8a8]
mov qword [rsp + 0x158], rcx
movabs rax, 0xcccccccccccccccd
mul rcx
shr rdx, 3
mov qword [rsp + 0x158], rdx
lea rcx, [0x1401849a8]
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
mov qword [rsp + 0xa48], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x2d0], rbx
mov r13d, edi
mov dword [rsp + 0xf8], edi
mov r15d, 8
cmp r13d, r15d
jge 0x14004827a
lea rcx, [0x1401849a8]
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
mov qword [rsp + 0xee8], rax
add rax, 0x18
mov qword [rsp + 0x380], rax
movsxd rax, r13d
movzx r8d, byte [rsp + rax + 0x158]
lea rdx, str._.2x
lea rcx, [rsp + 0x380]
call fcn.14000f338
mov rbx, qword [rsp + 0x380]
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x3b0], r8d
mov rdx, rbx
lea rcx, [rsp + 0x2d0]
call fcn.14000d9c4
nop
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x650], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004825a
mov rdx, qword [rsp + 0x650]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r13d, dword [rsp + 0xf8]
add r13d, r12d
mov dword [rsp + 0xf8], r13d
mov rbx, qword [rsp + 0x2d0]
jmp 0x1400481bd
mov edx, dword [rbx - 0x10]
mov dword [rsp + 0x8c0], edx
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xa58], rax
test rax, rax
jne 0x14004829f
call fcn.140001fb4
mov qword [r14 + 8], rax
mov word [r14], r15w
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x7a8], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b38c
mov rdx, qword [rsp + 0x7a8]
jmp 0x14004b382
lea rdx, str.getChromeVersion
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x14004836b
lea rdx, [rsp + 0x230]
mov rcx, qword [r13 + 0x40]
call fcn.1400465f4
nop
test r14, r14
je 0x140048339
mov rcx, qword [rsp + 0x230]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x660], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xd68], rax
test rax, rax
jne 0x14004832b
call fcn.140001fb4
mov qword [r14 + 8], rax
mov r15d, 8
mov word [r14], r15w
mov rcx, qword [rsp + 0x230]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b38c
mov rdx, qword [rsp + 0x3a8]
jmp 0x14004b382
lea rdx, str.getDLLVersion
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x140048405
lea rdx, [rsp + 0x378]
mov rcx, qword [r13 + 0x40]
call fcn.140046634
nop
test r14, r14
je 0x1400483d3
mov rcx, qword [rsp + 0x378]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x3c0], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xa68], rax
test rax, rax
jne 0x1400483c5
call fcn.140001fb4
mov qword [r14 + 8], rax
mov r15d, 8
mov word [r14], r15w
mov rcx, qword [rsp + 0x378]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b38c
mov rdx, qword [rsp + 0x3b8]
jmp 0x14004b382
lea rdx, str.getCharPref
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
je 0x14004ade7
lea rdx, str.getIntPref
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
je 0x14004ade7
lea rdx, str.setCharPref
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x140048952
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xfc8], rax
lea r15, str.keyPath
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xa78], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xd78], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xa88], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xef8], rax
lea rdx, [0x1401213c0]
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xa98], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
mov byte [rsp + 0x51], dil
mov qword [rsp + 0x140], rdi
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xd88], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002abf4
mov qword [rsp + 0xaa8], rax
lea rcx, [0x14018d368]
cmp rax, rcx
je 0x14004878b
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xfc0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xab8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd98], rdx
lea rcx, [rsp + 0x240]
call fcn.1400029e4
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x140], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x240]
call fcn.140002c80
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x140], rbx
mov rcx, qword [rsp + 0x240]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400485ea
mov rdx, qword [rsp + 0x3c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rbx, str.param
cmp qword [rsp + 0x140], rdi
je 0x14004878b
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xac8], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xf18], rax
mov rdx, qword [rax]
mov qword [rsp + 0xad8], rdx
lea rcx, [rsp + 0x330]
call fcn.1400029e4
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xda8], rax
lea rdx, [0x1401213c0]
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xae8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xff0], rdx
lea rcx, [rsp + 0x250]
call fcn.1400029e4
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xaf8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xdb8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb08], rdx
lea rcx, [rsp + 0x2e0]
call fcn.1400029e4
nop
mov r9, qword [rsp + 0x140]
lea r8, [rsp + 0x330]
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x2e0]
call fcn.1400368a8
mov byte [rsp + 0x51], al
mov rcx, qword [rsp + 0x2e0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048726
mov rdx, qword [rsp + 0x3d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x250]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048759
mov rdx, qword [rsp + 0x3e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x330]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048940
mov rdx, qword [rsp + 0x3f8]
jmp 0x140048937
lea rax, [rsp + 0x408]
mov qword [rsp + 0xf38], rax
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xb18], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xdc8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb28], rdx
lea rcx, [rsp + 0x270]
call fcn.1400029e4
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0x1000], rax
lea rdx, [0x1401213c0]
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xb38], rax
mov rdx, qword [rax]
mov qword [rsp + 0xdd8], rdx
lea rcx, [rsp + 0x2f0]
call fcn.1400029e4
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xb48], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xf58], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb58], rdx
lea rcx, [rsp + 0x260]
call fcn.1400029e4
nop
lea rdx, [0x14011b5e8]
lea rcx, [rsp + 0x408]
call fcn.140001cb0
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x140187d58]
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x260]
call fcn.140036638
mov byte [rsp + 0x51], al
mov rcx, qword [rsp + 0x260]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x418], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400488db
mov rdx, qword [rsp + 0x418]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x2f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x428], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004890e
mov rdx, qword [rsp + 0x428]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x270]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x438], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048940
mov rdx, qword [rsp + 0x438]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x14004b38c
mov al, byte [rsp + 0x51]
jmp 0x1400495a1
lea rdx, str.setIntPref
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x140048e4c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xde8], rax
lea r15, str.keyPath
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xb68], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0x1010], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xb78], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xdf8], rax
lea rdx, [0x1401213c0]
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xb88], rax
mov cl, byte [rax + 8]
mov al, cl
sub al, r12b
cmp al, 2
jbe 0x140048a1b
cmp cl, 5
jne 0x14004b38c
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x150], rdi
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xf78], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002abf4
mov qword [rsp + 0xb98], rax
lea rcx, [0x14018d368]
cmp rax, rcx
je 0x140048cc9
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xe08], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xba8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1020], rdx
lea rcx, [rsp + 0x218]
call fcn.1400029e4
nop
mov r13, qword [r13 + 0x50]
mov qword [rsp + 0x150], r13
mov eax, dword [0x14018cd80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 3
jne 0x140048b11
mov ecx, 4
call fcn.1400b1450
mov rbx, rax
mov qword [rsp + 0xbb8], rax
call fcn.1400b1650
mov dword [rbx], eax
mov dword [0x14018cd80], eax
mov rcx, rbx
call fcn.1400b0c74
lea rbx, str.param
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x218]
call fcn.140002c80
mov rcx, 0xffffffff80000003
test eax, eax
cmove r13, rcx
mov qword [rsp + 0x150], r13
mov rcx, qword [rsp + 0x218]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x448], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048b6c
mov rdx, qword [rsp + 0x448]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [rsp + 0x150], rdi
je 0x140048cc9
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xe18], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xbc8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf98], rdx
lea rcx, [rsp + 0x300]
call fcn.1400029e4
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xbd8], rax
lea rdx, [0x1401213c0]
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xe28], rax
mov rcx, rax
call fcn.14002a5a4
mov dword [rsp + 0x180], eax
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xbe8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x1030], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbf8], rdx
lea rcx, [rsp + 0x280]
call fcn.1400029e4
nop
mov r9, qword [rsp + 0x150]
lea r8, [rsp + 0x300]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x280]
call fcn.1400369d0
mov byte [rsp + 0x50], al
mov rcx, qword [rsp + 0x280]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x458], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048c97
mov rdx, qword [rsp + 0x458]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x300]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x468], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048e3a
mov rdx, qword [rsp + 0x468]
jmp 0x140048e31
lea rax, [rsp + 0x478]
mov qword [rsp + 0xe38], rax
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xc08], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xfb8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc18], rdx
lea rcx, [rsp + 0x340]
call fcn.1400029e4
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xe48], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xc28], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1040], rdx
lea rcx, [rsp + 0x290]
call fcn.1400029e4
nop
lea rdx, [0x14011b5e8]
lea rcx, [rsp + 0x478]
call fcn.140001cb0
mov rbx, rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xc38], rax
lea rdx, [0x1401213c0]
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xe58], rax
mov rcx, rax
call fcn.14002a5a4
mov edx, eax
mov qword [rsp + 0x20], rbx
mov r9, qword [0x140187d58]
lea r8, [rsp + 0x340]
lea rcx, [rsp + 0x290]
call fcn.140037148
mov byte [rsp + 0x50], al
mov rcx, qword [rsp + 0x290]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x488], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048e08
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x340]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x498], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048e3a
mov rdx, qword [rsp + 0x498]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x14004b38c
mov al, byte [rsp + 0x50]
jmp 0x1400495a1
lea rdx, str.removePref
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x1400495b0
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xc48], rax
lea r15, str.keyPath
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xfd8], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
mov byte [rsp + 0x52], dil
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xc58], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002abf4
mov qword [rsp + 0xe68], rax
lea rcx, [0x14018d368]
mov rdx, rbx
cmp rax, rcx
lea rcx, [rsp + 0x58]
je 0x1400492ee
call fcn.14002aa80
mov qword [rsp + 0xc68], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xfe0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc78], rdx
lea rcx, [rsp + 0x178]
call fcn.1400029e4
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x178]
call fcn.140002c80
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xe78], rbx
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xc88], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xfd0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc98], rdx
lea rax, [rsp + 0x168]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0xe0], eax
test eax, eax
je 0x1400490b1
test r14, r14
je 0x140048fc8
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
mov rcx, qword [rsp + 0x178]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048ffb
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004902b
mov rdx, qword [rsp + 0x4b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3068], 0x10
jb 0x140049043
mov rcx, qword [rsp + 0x3050]
call fcn.1400b0c74
mov qword [rsp + 0x3068], 0xf
mov qword [rsp + 0x3060], rdi
mov byte [rsp + 0x3050], dil
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004908f
mov rdx, qword [rsp + 0x4c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xe88], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xca8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1028], rdx
lea rcx, [rsp + 0x2a0]
call fcn.1400029e4
nop
mov rdx, qword [rsp + 0x2a0]
mov eax, dword [rdx - 0x10]
mov dword [rsp + 0x858], eax
mov rcx, qword [rsp + 0x168]
test eax, eax
jne 0x14004913f
lea rdx, [0x14011b5e8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0xe0], eax
test eax, eax
je 0x1400491af
test r14, r14
je 0x1400491c3
mov dword [r14 + 8], eax
jmp 0x1400491a4
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
mov dword [rsp + 0xe0], eax
test eax, eax
je 0x1400491af
mov ecx, dword [0x14018cd80]
lea r8d, [rcx + 1]
imul r8d, ecx
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
mov r15d, 0xb
cmp r8d, r15d
jne 0x14004919b
mov edx, 0xdb
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400b15a4
test r14, r14
je 0x1400491c3
mov dword [r14 + 8], ebx
mov eax, 0x16
mov word [r14], ax
jmp 0x1400491c3
test r14, r14
je 0x1400491c3
mov word [r14 + 8], si
mov r15d, 0xb
mov word [r14], r15w
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x2a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049205
mov rdx, qword [rsp + 0x4d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x178]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049238
mov rdx, qword [rsp + 0x4e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049268
mov rdx, qword [rsp + 0x4f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3068], 0x10
jb 0x140049280
mov rcx, qword [rsp + 0x3050]
call fcn.1400b0c74
mov qword [rsp + 0x3068], 0xf
mov qword [rsp + 0x3060], rdi
mov byte [rsp + 0x3050], dil
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x508], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400492cc
mov rdx, qword [rsp + 0x508]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
call fcn.14002aa80
mov qword [rsp + 0xcb8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x908], rax
cmp byte [rax + 8], 4
jne 0x140049470
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0x910], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x920], rax
mov rdx, qword [rax]
mov qword [rsp + 0x930], rdx
lea rcx, [rsp + 0x348]
call fcn.1400029e4
nop
lea rdx, [0x14011b5e8]
lea rcx, [rsp + 0x2b0]
call fcn.140001cb0
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0x940], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x950], rax
mov rdx, qword [rax]
mov qword [rsp + 0x960], rdx
lea rcx, [rsp + 0x310]
call fcn.1400029e4
nop
lea r8, [rsp + 0x348]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x310]
call fcn.140035f44
mov byte [rsp + 0x52], al
mov rcx, qword [rsp + 0x310]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x518], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004940b
mov rdx, qword [rsp + 0x518]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x2b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x528], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004943e
mov rdx, qword [rsp + 0x528]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x348]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x538], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049594
mov rdx, qword [rsp + 0x538]
jmp 0x14004958b
lea rdx, [0x14011b5e8]
lea rcx, [rsp + 0x220]
call fcn.140001cb0
nop
lea rdx, [0x14011b5e8]
lea rcx, [rsp + 0x320]
call fcn.140001cb0
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0x970], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x980], rax
mov rdx, qword [rax]
mov qword [rsp + 0x990], rdx
lea rcx, [rsp + 0x2c0]
call fcn.1400029e4
nop
lea r8, [rsp + 0x220]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x2c0]
call fcn.140035f44
mov byte [rsp + 0x52], al
mov rcx, qword [rsp + 0x2c0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x548], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004952f
mov rdx, qword [rsp + 0x548]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x320]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x558], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049562
mov rdx, qword [rsp + 0x558]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x220]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x568], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049594
mov rdx, qword [rsp + 0x568]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x14004b38c
mov al, byte [rsp + 0x52]
neg al
sbb cx, cx
mov word [r14 + 8], cx
jmp 0x14004a534
lea rdx, str.getChildValues
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
je 0x14004a543
lea rdx, str.getChildKeys
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
je 0x14004a543
lea rdx, str.requestGet
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x140049c03
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
lea rcx, [0x14011b5e8]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
mov qword [rsp + 0x238], rax
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0x9a0], rax
lea r13, [0x14011ec4c]
mov rdx, r13
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x9b0], rax
cmp byte [rax + 8], 4
jne 0x140049b59
test r15, r15
je 0x140049b59
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0x9c0], rax
mov rdx, r13
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0x9d0], rax
lea rdx, [rsp + 0x3280]
mov rcx, rax
call fcn.14002a324
mov qword [rsp + 0x9e0], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400496ac
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400029e4
nop
xor r8d, r8d
mov dl, r12b
lea rcx, [rsp + 0x3280]
call fcn.14000136c
xor r8d, r8d
lea rdx, str.error
lea rcx, [rsp + 0x80]
call fcn.14000ce7c
mov ebx, eax
mov dword [rsp + 0x1b8], eax
test eax, eax
jle 0x1400497f6
add ebx, 6
mov dword [rsp + 0x1b8], ebx
mov edx, 0x26
mov rcx, qword [rsp + 0x80]
call fcn.1400b3578
mov qword [rsp + 0x9f0], rax
test rax, rax
jne 0x140049725
mov eax, esi
jmp 0x140049730
sub rax, qword [rsp + 0x80]
sar rax, 1
sub eax, ebx
mov r9d, eax
mov r8d, ebx
lea rdx, [rsp + 0x578]
lea rcx, [rsp + 0x80]
call fcn.14000cebc
nop
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140001d7c
nop
mov rcx, qword [rsp + 0x578]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x588], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049791
mov rdx, qword [rsp + 0x588]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.js_code
lea rcx, [rsp + 0x228]
call fcn.1400029e4
nop
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x80]
call fcn.14001876c
nop
mov rcx, qword [rsp + 0x228]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x598], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400497ee
mov rdx, qword [rsp + 0x598]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x238]
xor edx, edx
lea rcx, [rsp + 0x388]
call fcn.140029f98
nop
lea rdx, [0x14011ecb4]
lea rcx, [rsp + 0xf00]
call fcn.14002a010
nop
lea rdx, [0x14011ec88]
lea rcx, [rsp + 0x388]
call fcn.14002aa80
mov rcx, rax
lea rdx, [rsp + 0xf00]
call fcn.14002a29c
nop
lea rcx, [rsp + 0xf00]
call fcn.14002a1f0
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xa00], rax
mov rdx, r13
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xa10], rax
lea rdx, [rsp + 0x3260]
mov rcx, rax
call fcn.14002a324
nop
mov rdx, rax
lea rcx, [rsp + 0xf20]
call fcn.14002a054
nop
mov rdx, r13
lea rcx, [rsp + 0x388]
call fcn.14002aa80
mov rcx, rax
lea rdx, [rsp + 0xf20]
call fcn.14002a29c
nop
lea rcx, [rsp + 0xf20]
call fcn.14002a1f0
nop
xor r8d, r8d
mov dl, r12b
lea rcx, [rsp + 0x3260]
call fcn.14000136c
lea rdx, [0x14011ecc4]
lea rcx, [rsp + 0xf40]
call fcn.14002a010
nop
lea rdx, str.acceptedStatusCodes
lea rcx, [rsp + 0x388]
call fcn.14002aa80
mov rcx, rax
lea rdx, [rsp + 0xf40]
call fcn.14002ac68
nop
lea rcx, [rsp + 0xf40]
call fcn.14002a1f0
lea rdx, [0x14011ece4]
lea rcx, [rsp + 0xf60]
call fcn.14002a010
nop
lea rdx, str.acceptTypes
lea rcx, [rsp + 0x388]
call fcn.14002aa80
mov rcx, rax
lea rdx, [rsp + 0xf60]
call fcn.14002a29c
nop
lea rcx, [rsp + 0xf60]
call fcn.14002a1f0
lea rdx, str.Accept_Encoding:_gzip__deflate_r_n
lea rcx, [rsp + 0xf80]
call fcn.14002a010
nop
lea rdx, str.additionalRequestHeaders
lea rcx, [rsp + 0x388]
call fcn.14002aa80
mov rcx, rax
lea rdx, [rsp + 0xf80]
call fcn.14002a29c
nop
lea rcx, [rsp + 0xf80]
call fcn.14002a1f0
mov qword [rsp + 0x5a8], rdi
lea r9, [rsp + 0x388]
lea r8, [rsp + 0x5a8]
mov rdx, r15
lea rcx, [rsp + 0xfa0]
call fcn.140022028
nop
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r14, r14
je 0x140049b0b
lea rax, vtable.Json::Writer.0
mov qword [rsp + 0x30b0], rax
lea rax, vtable.Json::FastWriter.0
mov qword [rsp + 0x30b0], rax
mov qword [rsp + 0x30c8], rdi
mov qword [rsp + 0x30d0], rdi
mov qword [rsp + 0x30d0], 0xf
mov qword [rsp + 0x30c8], rdi
mov byte [rsp + 0x30b8], dil
mov byte [rsp + 0x30d8], dil
lea r8, [rsp + 0xfa0]
lea rdx, [rsp + 0x3220]
lea rcx, [rsp + 0x30b0]
call fcn.14002cc34
mov qword [rsp + 0xa20], rax
cmp qword [rax + 0x18], 0x10
jb 0x140049a6e
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x248]
call fcn.1400029e4
nop
xor r8d, r8d
mov dl, r12b
lea rcx, [rsp + 0x3220]
call fcn.14000136c
mov rcx, qword [rsp + 0x248]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x3d0], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xa30], rax
test rax, rax
jne 0x140049abc
call fcn.140001fb4
mov qword [r14 + 8], rax
mov r15d, 8
mov word [r14], r15w
mov rcx, qword [rsp + 0x248]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049afd
mov rdx, qword [rsp + 0x5b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x30b0]
call fcn.1400096a0
nop
lea rcx, [rsp + 0xfa0]
call fcn.14002a1f0
nop
lea rcx, [rsp + 0x388]
call fcn.14002a1f0
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b38c
mov rdx, qword [rsp + 0x5c8]
jmp 0x14004b382
test r14, r14
je 0x140049b6d
mov word [r14 + 8], di
mov r15d, 0xb
mov word [r14], r15w
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049b9d
mov rdx, qword [rsp + 0x5d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor r8d, r8d
mov dl, r12b
lea rcx, [rsp + 0x3050]
call fcn.14000136c
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049be1
mov rdx, qword [rsp + 0x5e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
lea rdx, str.NVP_IsSupported
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x140049c67
test r14, r14
je 0x140049c2a
mov word [r14 + 8], si
lea r15d, [rax + 0xb]
mov word [r14], r15w
mov eax, dword [0x14018cd80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
mov r15d, 8
cmp ecx, r15d
jne 0x14004b38c
mov dword [rsp + 0x1050], edi
jmp 0x14004b38c
lea rdx, str.NVP_Inject
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x14004a1a8
test r14, r14
je 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xa40], rax
lea rdx, str.match
mov rcx, rax
call fcn.14002abf4
mov qword [rsp + 0xa50], rax
lea r15, [0x14018d368]
cmp rax, r15
je 0x14004a112
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xa60], rax
lea rdx, str.inject
mov rcx, rax
call fcn.14002abf4
mov qword [rsp + 0xa70], rax
cmp rax, r15
je 0x14004a112
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xa80], rax
lea rbx, str.message
mov rdx, rbx
mov rcx, rax
call fcn.14002abf4
mov qword [rsp + 0xa90], rax
cmp rax, r15
je 0x14004a112
lea r15, str.param
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xaa0], rax
lea rdx, str.match
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xab0], rax
cmp byte [rax + 8], r12b
jne 0x14004a112
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xac0], rax
lea rdx, str.inject
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xad0], rax
cmp byte [rax + 8], r12b
jne 0x14004a112
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xae0], rax
mov rdx, rbx
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xaf0], rax
cmp byte [rax + 8], 4
jne 0x14004a112
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xb00], rax
mov rdx, rbx
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xb10], rax
lea rdx, [rsp + 0x3070]
mov rcx, rax
call fcn.14002a324
nop
mov qword [rsp + 0x188], rdi
lea rcx, [rsp + 0x3070]
cmp qword [rsp + 0x3088], 0x10
cmovae rcx, qword [rsp + 0x3070]
mov qword [rsp + 0xb20], rcx
mov rdx, qword [rsp + 0x3080]
test dl, 3
jne 0x14004a068
lea r8, [rsp + 0x188]
call fcn.14001a210
mov byte [rsp + 0xac], al
test al, al
je 0x14004a068
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], rdi
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x120]
call fcn.140020840
nop
mov rdx, rdi
mov qword [rsp + 0x258], rdx
lea rcx, [rsp + 0x3070]
cmp qword [rsp + 0x3088], 0x10
cmovae rcx, qword [rsp + 0x3070]
mov qword [rsp + 0xb30], rcx
mov rbx, qword [rsp + 0x120]
test rcx, rcx
je 0x140049efe
lea rax, [rsp + 0x258]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x188]
mov r8, rbx
mov rdx, qword [rsp + 0x3080]
call fcn.14001a238
mov rdx, qword [rsp + 0x258]
jmp 0x140049f01
mov al, dil
mov byte [rsp + 0x7b], al
test al, al
jne 0x140049f82
test rbx, rbx
je 0x140049f2e
mov rcx, rbx
call fcn.1400b0c74
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], rdi
lea rcx, [rsp + 0x3070]
call fcn.14000133c
nop
lea rcx, [rsp + 0x48]
call fcn.140001d4c
nop
lea rcx, [rsp + 0x3050]
call fcn.14000133c
nop
lea rcx, [rsp + 0x70]
call fcn.140001d4c
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
lea rcx, [rsp + 0x120]
call fcn.140020840
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xb40], rax
lea rdx, str.match
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xb50], rax
mov rcx, rax
call fcn.14002a5a4
mov ebx, eax
mov dword [rsp + 0x670], eax
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xb60], rax
lea rdx, str.inject
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xb70], rax
mov rcx, rax
call fcn.14002a5a4
mov dword [rsp + 0x3e0], eax
lea r9, [rsp + 0x120]
mov r8d, eax
mov edx, ebx
mov rcx, qword [r13 + 0x40]
call fcn.1400426c4
mov word [r14 + 8], si
mov r15d, 0xb
mov word [r14], r15w
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x14004a056
call fcn.1400b0c74
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], rdi
lea rcx, [rsp + 0x3070]
call fcn.14000133c
jmp 0x14004b38c
xor r8d, r8d
mov dl, r12b
lea rcx, [rsp + 0x3070]
call fcn.14000136c
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a0ac
mov rdx, qword [rsp + 0x5f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor r8d, r8d
mov dl, r12b
lea rcx, [rsp + 0x3050]
call fcn.14000136c
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x608], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a0f0
mov rdx, qword [rsp + 0x608]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x618], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a142
mov rdx, qword [rsp + 0x618]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor r8d, r8d
mov dl, r12b
lea rcx, [rsp + 0x3050]
call fcn.14000136c
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x628], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a186
mov rdx, qword [rsp + 0x628]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
lea rdx, str.NVP_UTF8ToUTF16
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x14004a3fd
test r14, r14
je 0x14004b38c
mov r15b, dil
mov byte [rsp + 0x79], dil
lea rcx, [rsp + 0x198]
call fcn.140001c78
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xb80], rax
lea rdx, [0x140121560]
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xb90], rax
cmp byte [rax + 8], 4
jne 0x14004a3dc
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xba0], rax
lea rdx, [0x140121560]
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xbb0], rax
lea rdx, [rsp + 0x3090]
mov rcx, rax
call fcn.14002a324
nop
mov rax, qword [rsp + 0x30a0]
mov qword [rsp + 0xbc0], rax
lea r8, [rsp + 0x3090]
cmp qword [rsp + 0x30a8], 0x10
cmovae r8, qword [rsp + 0x3090]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, eax
xor edx, edx
mov r13d, 0xfde9
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov dword [rsp + 0x7b8], ebx
test eax, eax
je 0x14004a394
mov qword [rsp + 0x358], rdi
mov qword [rsp + 0x360], rdi
mov qword [rsp + 0x368], rdi
mov rdx, rbx
add rdx, rdx
lea rcx, [rsp + 0x358]
call fcn.140020840
nop
mov rax, qword [rsp + 0x30a0]
mov qword [rsp + 0xbd0], rax
lea r8, [rsp + 0x3090]
cmp qword [rsp + 0x30a8], 0x10
cmovae r8, qword [rsp + 0x3090]
mov dword [rsp + 0x28], ebx
mov rbx, qword [rsp + 0x358]
mov qword [rsp + 0x20], rbx
mov r9d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14004a36f
mov r8, qword [rsp + 0x360]
sub r8, rbx
mov qword [rsp + 0xbe0], r8
mov rdx, rbx
lea rcx, [rsp + 0x638]
call fcn.14001a3dc
nop
mov rdx, rax
lea rcx, [rsp + 0x198]
call fcn.140001d7c
nop
lea rcx, [rsp + 0x638]
call fcn.140001d4c
mov r15b, r12b
mov byte [rsp + 0x79], r12b
test rbx, rbx
je 0x14004a394
mov rcx, rbx
call fcn.1400b0c74
mov qword [rsp + 0x358], rdi
mov qword [rsp + 0x360], rdi
mov qword [rsp + 0x368], rdi
lea rcx, [rsp + 0x3090]
call fcn.14000133c
test r15b, r15b
je 0x14004a3dc
mov rcx, qword [rsp + 0x198]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x3f0], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xbf0], rax
test rax, rax
jne 0x14004a3d0
call fcn.140001fb4
mov qword [r14 + 8], rax
mov r15d, 8
jmp 0x14004a3e7
mov word [r14 + 8], di
mov r15d, 0xb
mov word [r14], r15w
lea rcx, [rsp + 0x198]
call fcn.140001d4c
jmp 0x14004b38c
lea rdx, str.reloadBackground
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x14004a434
mov rcx, qword [r13 + 0x40]
add rcx, 0x1f0
call fcn.14004f368
test r14, r14
je 0x14004b38c
mov word [r14], r12w
jmp 0x14004b38c
lea rdx, str.debugMessage
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x14004a526
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xc00], rax
lea rbx, str.message
mov rdx, rbx
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xc10], rax
cmp byte [rax + 8], 4
jne 0x14004a526
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xc20], rax
mov rdx, rbx
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xc30], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc40], rdx
lea rcx, [rsp + 0x648]
call fcn.1400029e4
nop
test r14, r14
je 0x14004a4df
mov word [r14 + 8], si
mov r15d, 0xb
mov word [r14], r15w
mov r8d, dword [0x14018cd80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x12
jne 0x14004a519
sub r8d, r12d
mov dword [0x14018cd80], r8d
lea rcx, [rsp + 0x648]
jmp 0x14004a3f3
test r14, r14
je 0x14004b38c
mov word [r14 + 8], di
mov r15d, 0xb
mov word [r14], r15w
jmp 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xc50], rax
lea r15, str.keyPath
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xc60], rax
cmp byte [rax + 8], 4
jne 0x14004ad4f
test r14, r14
je 0x14004ad4f
mov qword [rsp + 0x1d8], rdi
mov rax, rdi
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rdi
mov byte [rsp + 0x41], dil
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xc70], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002abf4
mov qword [rsp + 0xc80], rax
lea rcx, [0x14018d368]
cmp rax, rcx
je 0x14004a94d
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xc90], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xca0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcb0], rdx
lea rcx, [rsp + 0x1a8]
call fcn.1400029e4
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x1a8]
call fcn.140002c80
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xcc0], rbx
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xcd0], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xce0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcf0], rdx
lea rax, [rsp + 0x680]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x678], eax
test eax, eax
je 0x14004a7a4
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
mov rcx, qword [rsp + 0x1a8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x658], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a700
mov rdx, qword [rsp + 0x658]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x1d8]
call fcn.140016e74
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x668], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a73e
mov rdx, qword [rsp + 0x668]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor r8d, r8d
mov dl, r12b
lea rcx, [rsp + 0x3050]
call fcn.14000136c
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a782
mov rdx, qword [rsp + 0x1d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
mov r13d, edi
mov dword [rsp + 0x108], edi
mov r15d, 0x7ffe
mov dword [rsp + 0x10c], r15d
lea rdx, str.getChildValues
lea rcx, [rsp + 0x48]
call fcn.140002c80
mov rcx, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
cmove rcx, qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov qword [rsp + 0x1d0], rcx
mov qword [rsp + 0x6c0], rcx
mov ecx, r15d
call fcn.1400b0308
mov rbx, rax
mov qword [rsp + 0x6b0], rax
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.1400b60d0
mov rax, qword [rsp + 0x1d0]
mov edx, r13d
add r13d, r12d
mov dword [rsp + 0x108], r13d
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x10c]
mov r8, rbx
mov rcx, qword [rsp + 0x680]
call rax
mov dword [rsp + 0x400], eax
test eax, eax
jne 0x14004a8f2
mov rdx, rbx
lea rcx, [rsp + 0x690]
call fcn.1400029e4
nop
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.14001886c
nop
mov rcx, qword [rsp + 0x690]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a8b0
mov rdx, qword [rsp + 0x6a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, r15
xor edx, edx
mov rbx, qword [rsp + 0x6b0]
mov rcx, rbx
call fcn.1400b60d0
mov dword [rsp + 0x10c], r15d
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x100], rax
mov r13d, dword [rsp + 0x108]
mov rax, qword [rsp + 0x6c0]
jmp 0x14004a816
cmp eax, 0x103
je 0x14004a916
mov rax, qword [rsp + 0x100]
sub rax, qword [rsp + 0x1d8]
test rax, 0xfffffffffffffff8
mov byte [rsp + 0x41], dil
je 0x14004a91b
mov byte [rsp + 0x41], r12b
mov rcx, qword [rsp + 0x1a8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004aa73
mov rdx, qword [rsp + 0x6d0]
jmp 0x14004aa6a
lea rdx, str.getChildValues
lea rcx, [rsp + 0x48]
call fcn.140002c80
mov rdx, rbx
lea rcx, [rsp + 0x58]
test eax, eax
jne 0x14004a9ef
call fcn.14002aa80
mov qword [rsp + 0xd00], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xd10], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd20], rdx
lea rcx, [rsp + 0x268]
call fcn.1400029e4
nop
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x268]
call fcn.140037610
mov byte [rsp + 0x41], al
mov rcx, qword [rsp + 0x268]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004aa73
mov rdx, qword [rsp + 0x6e0]
jmp 0x14004aa6a
call fcn.14002aa80
mov qword [rsp + 0xd30], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xd40], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd50], rdx
lea rcx, [rsp + 0x278]
call fcn.1400029e4
nop
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x278]
call fcn.140037434
mov byte [rsp + 0x41], al
mov rcx, qword [rsp + 0x278]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004aa73
mov rdx, qword [rsp + 0x6f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x41], dil
je 0x14004ad33
lea rdx, [0x140121468]
lea rcx, [rsp + 0xb8]
call fcn.140001cb0
nop
mov rbx, qword [rsp + 0x1d8]
mov r15d, 8
mov qword [rsp + 0x760], rbx
cmp rbx, qword [rsp + 0x1e0]
je 0x14004ac12
lea rdx, [0x140121470]
lea rcx, [rsp + 0x298]
call fcn.1400029e4
nop
lea rdx, [0x140121460]
lea rcx, [rsp + 0x288]
call fcn.1400029e4
nop
mov r8, rbx
lea rdx, [rsp + 0x288]
lea rcx, [rsp + 0x720]
call fcn.14000cfa0
nop
lea r8, [rsp + 0x298]
mov rdx, rax
lea rcx, [rsp + 0x700]
call fcn.14000cfa0
mov qword [rsp + 0xd60], rax
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x8d4], r8d
mov qword [rsp + 0xd70], rdx
lea rcx, [rsp + 0xb8]
call fcn.14000d9c4
nop
mov rcx, qword [rsp + 0x700]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x710], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004ab72
mov rdx, qword [rsp + 0x710]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x720]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x730], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004aba5
mov rdx, qword [rsp + 0x730]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x288]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x740], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004abd8
mov rdx, qword [rsp + 0x740]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x298]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x750], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004ac0a
mov rdx, qword [rsp + 0x750]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, r15
jmp 0x14004aaa1
mov rax, qword [rsp + 0xb8]
mov r8d, dword [rax - 0x10]
mov dword [rsp + 0x410], r8d
dec r8d
lea rdx, [rsp + 0x790]
lea rcx, [rsp + 0xb8]
call fcn.1400169b0
nop
lea r8, [0x140121464]
mov rdx, rax
lea rcx, [rsp + 0x770]
call fcn.140016a58
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.140001d7c
nop
mov rcx, qword [rsp + 0x770]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x780], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004ac9b
mov rdx, qword [rsp + 0x780]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x790]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004accd
mov rdx, qword [rsp + 0x3a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0xb8]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x688], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xd80], rax
test rax, rax
jne 0x14004acf7
call fcn.140001fb4
mov qword [r14 + 8], rax
mov word [r14], r15w
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004ad42
mov rdx, qword [rsp + 0x7b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004ad42
mov word [r14 + 8], di
mov r15d, 0xb
mov word [r14], r15w
lea rcx, [rsp + 0x1d8]
call fcn.140016e74
mov r8d, dword [0x14018cd80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xd
jne 0x14004b38c
mov ecx, edi
mov dword [rsp + 0x1f0], ecx
mov eax, 0x97012e03
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd9
mov eax, r8d
sub eax, edx
cmp eax, 0x76
je 0x14004addc
mov eax, r8d
or eax, 0xffffffa8
add r8d, eax
mov dword [0x14018cd80], r8d
add ecx, r12d
mov dword [rsp + 0x1f0], ecx
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x14004addc
jmp 0x14004ad90
mov dword [0x14018cd80], ecx
jmp 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xd90], rax
lea r15, str.keyPath
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xda0], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
test r14, r14
je 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xdb0], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xdc0], rax
cmp byte [rax + 8], 4
jne 0x14004b38c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xdd0], rax
mov rdx, r15
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xde0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xdf0], rdx
lea rcx, [rsp + 0xe8]
call fcn.1400029e4
nop
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xe00], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xe10], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe20], rdx
lea rcx, [rsp + 0xd8]
call fcn.1400029e4
nop
mov r15, rdi
mov qword [rsp + 0x148], rdi
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xe30], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002abf4
mov qword [rsp + 0xe40], rax
lea rcx, [0x14018d368]
cmp rax, rcx
je 0x14004b0e4
mov ecx, dword [0x14018cd80]
imul ecx, ecx
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x13
jne 0x14004affd
mov word [rsp + 0x32a0], di
xor edx, edx
mov r8d, 0x2e50
lea rcx, [rsp + 0x32a2]
call fcn.1400b60d0
mov dword [0x14018cd80], edi
mov r10d, edi
mov dword [rsp + 0x210], edi
cmp r10d, 0x4d
jge 0x14004afef
mov r9d, edi
mov dword [rsp + 0x200], edi
cmp r9d, 0x4d
jge 0x14004afe2
test r10d, r10d
je 0x14004afd5
test r9d, r9d
je 0x14004afd5
movsxd r8, r10d
movsxd rcx, r9d
mov rdx, r8
imul rdx, rdx, 0x4d
add rdx, rcx
imul r8, r8, 0x4d
add r8, rcx
movsx ecx, word [rsp + r8*2 + 0x3206]
movsx eax, word [rsp + rdx*2 + 0x329e]
inc ecx
add ecx, eax
mov word [rsp + rdx*2 + 0x32a0], cx
add r9d, r12d
mov dword [rsp + 0x200], r9d
jmp 0x14004af91
add r10d, r12d
mov dword [rsp + 0x210], r10d
jmp 0x14004af81
movsx eax, word [rsp + 0x60f0]
mov dword [0x14018cd80], eax
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14002aa80
mov qword [rsp + 0xe50], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14002aa80
mov qword [rsp + 0xe60], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe70], rdx
lea rcx, [rsp + 0x2a8]
call fcn.1400029e4
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x148], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x2a8]
call fcn.140002c80
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x148], rbx
mov eax, dword [0x14018cd80]
imul eax, eax
and eax, 0x8000000f
jge 0x14004b090
sub eax, r12d
or eax, 0xfffffff0
add eax, r12d
cmp eax, 0xc
jne 0x14004b0aa
mov dword [rsp + 0x2480], edi
mov dword [rsp + 0x1fa0], edi
mov dword [rsp + 0x1350], edi
mov rcx, qword [rsp + 0x2a8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b0dc
mov rdx, qword [rsp + 0x7c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x148]
lea rdx, str.getCharPref
lea rcx, [rsp + 0x48]
call fcn.140002c80
test eax, eax
jne 0x14004b24f
lea rcx, [rsp + 0x138]
call fcn.140001c78
nop
test r15, r15
je 0x14004b135
mov r9, r15
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x138]
call fcn.140036ad0
jmp 0x14004b1dc
lea rax, [rsp + 0x7d0]
mov qword [rsp + 0xe80], rax
lea rdx, [0x14011b5e8]
lea rcx, [rsp + 0x7d0]
call fcn.140001cb0
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x140187d58]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x7e0]
call fcn.140036580
nop
mov rdx, rax
lea rcx, [rsp + 0x138]
call fcn.140001d7c
nop
mov rcx, qword [rsp + 0x7e0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b1c8
mov rdx, qword [rsp + 0x7f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14004b1dc
mov rcx, qword [rsp + 0x138]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x420], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xe90], rax
test rax, rax
jne 0x14004b206
call fcn.140001fb4
mov qword [r14 + 8], rax
mov r15d, 8
mov word [r14], r15w
mov rcx, qword [rsp + 0x138]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x810], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b326
mov rdx, qword [rsp + 0x810]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004b326
mov ebx, esi
mov dword [rsp + 0x90], ebx
or r13d, 0xffffffff
mov dword [rsp + 0xa8], r13d
test r15, r15
je 0x14004b2a7
mov r9, r15
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xa8]
call fcn.140036c14
mov byte [rsp + 0x7a], al
cmp dword [rsp + 0xa8], r13d
je 0x14004b304
mov ebx, dword [rsp + 0xa8]
mov dword [rsp + 0x90], ebx
jmp 0x14004b300
lea rax, [rsp + 0x820]
mov qword [rsp + 0xea0], rax
lea rdx, [0x14011b5e8]
lea rcx, [rsp + 0x820]
call fcn.140001cb0
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x140187d58]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x90]
call fcn.140036e58
mov byte [rsp + 0x7a], al
mov ebx, dword [rsp + 0x90]
cmp ebx, esi
jne 0x14004b319
test al, al
jne 0x14004b319
mov word [r14 + 8], di
mov r15d, 0xb
mov word [r14], r15w
jmp 0x14004b326
mov dword [r14 + 8], ebx
mov eax, 0x16
mov word [r14], ax
mov rcx, qword [rsp + 0xd8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x830], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b359
mov rdx, qword [rsp + 0x830]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xe8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x840], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b38c
mov rdx, qword [rsp + 0x840]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x48]
call fcn.140001d4c
nop
lea rcx, [rsp + 0x3050]
call fcn.14000133c
nop
lea rcx, [rsp + 0x70]
call fcn.140001d4c
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, r12b
jmp 0x14004b4cb
lea rdx, str.json_parse_action_not_found
lea rcx, [rsp + 0x2c8]
call fcn.1400029e4
nop
lea rdx, [rsp + 0x2c8]
mov rcx, qword [r13 + 0x40]
call fcn.1400424e0
nop
mov rcx, qword [rsp + 0x2c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x850], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b42b
mov rdx, qword [rsp + 0x850]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3068], 0x10
jb 0x14004b443
mov rcx, qword [rsp + 0x3050]
call fcn.1400b0c74
mov qword [rsp + 0x3068], r15
mov qword [rsp + 0x3060], rdi
mov byte [rsp + 0x3050], dil
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x860], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004b48b
mov rdx, qword [rsp + 0x860]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3160]
call fcn.140015968
nop
lea rcx, [rsp + 0x58]
call fcn.14002a1f0
nop
mov bl, byte [rsp + 0x40]
jmp 0x14004b4c2
test r14, r14
je 0x14004b4cb
mov word [r14], r12w
mov rax, qword [rsp + 0x318]
mov rdx, qword [rax]
sub rdx, 0x18
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x14004b4f1
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
mov rcx, qword [rsp + 0x6100]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x6110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret