Function at 0x1400abea0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov rdi, rcx
lea rcx, [rax - 0x68]
mov r15, rdx
mov qword [rsp + 0x108], rdx
call fcn.140058038
xor esi, esi
lea rcx, [rsp + 0x188]
mov r14b, 0xff
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], rsi
mov byte [rsp + 0x63], sil
mov byte [rsp + 0x64], sil
mov byte [rsp + 0xb8], r14b
mov qword [rsp + 0xe8], rsi
call fcn.1400503f4
lea r8d, [rsi + 0xa]
lea rdx, [rsp + 0x188]
lea rcx, str.___initram
call fcn.14005a810
cmp al, sil
jne 0x1400ac71b
mov rdi, rsi
mov qword [rsp + 0xa8], rsi
lea edx, [rsi + 0x2a]
lea ecx, [rsi + 0x2d]
lea r8d, [rsi + 9]
lea r9d, [rsi + 0xd]
lea r12d, [rsi + 2]
mov rbp, qword [rsp + 0x188]
movabs rax, 0xfffffff000000000
mov byte [rsp + 0x198], sil
cmp cx, word [rbp]
mov qword [rsp + 0xf0], rax
movzx eax, dl
cmove eax, ecx
mov byte [rsp + 0x70], sil
mov byte [rsp + 0x61], sil
movsx ebx, al
movzx eax, word [rbp]
mov byte [rsp + 0x60], sil
mov byte [rsp + 0xba], sil
mov byte [rsp + 0x62], sil
mov byte [rsp + 0xb0], sil
mov byte [rsp + 0xb9], sil
mov r13d, esi
mov dword [rsp + 0xd0], esi
cmp ebx, eax
jne 0x1400ac3b0
mov r15b, byte [rsp + 0x64]
mov dil, byte [rsp + 0x63]
mov r14d, 0x20
jmp 0x1400abfe0
mov r8d, 9
lea r9d, [r8 + 4]
movzx eax, word [rbp + 2]
cmp ebx, eax
jne 0x1400ac38b
mov ecx, 0xffdf
lea r11, [rbp + 4]
movzx eax, word [r11]
and ax, cx
mov ecx, 0x48
cmp cx, ax
je 0x1400ac38b
cmp r8w, word [r11]
ja 0x1400ac01a
cmp word [r11], r9w
jbe 0x1400ac38b
cmp r14w, word [r11]
je 0x1400ac38b
mov ebp, 1
lea rcx, [0x1400fc270]
mov rdx, r11
mov r8d, ebp
mov qword [rsp + 0x188], r11
call fcn.140051938
cmp al, sil
je 0x1400ac0e2
movzx eax, word [r11]
lea r8, [r11 + 2]
cmp ax, si
je 0x1400ac085
lea ecx, [rbp + 8]
lea r9d, [rbp + 0xc]
cmp cx, ax
ja 0x1400ac06b
cmp ax, r9w
jbe 0x1400ac085
cmp r14w, ax
je 0x1400ac085
add r11, r12
mov qword [rsp + 0x188], r11
mov ax, word [r11]
cmp ax, si
jne 0x1400ac060
lea rcx, [rsp + 0x188]
call fcn.1400503f4
mov ecx, 0x3a
cmp cx, word [r8]
je 0x1400ac0a6
or r13d, 7
jmp 0x1400ac377
add r8, r12
lea rdx, [rsp + 0xb4]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0xb4], esi
mov qword [rsp + 0x90], r8
call fcn.1400ab4bc
cmp eax, esi
jle 0x1400ac377
or r13d, dword [rsp + 0xb4]
jmp 0x1400ac377
lea rcx, [0x1400fc5cc]
mov r8d, r12d
mov rdx, r11
call fcn.140051938
cmp al, sil
je 0x1400ac185
lea rax, [r11 + 4]
mov qword [rsp + 0x90], rax
movzx eax, word [r11]
cmp ax, si
je 0x1400ac140
mov ecx, 9
lea r9d, [rcx + 4]
cmp cx, ax
ja 0x1400ac126
cmp ax, r9w
jbe 0x1400ac140
cmp r14w, ax
je 0x1400ac140
add r11, r12
mov qword [rsp + 0x188], r11
mov ax, word [r11]
cmp ax, si
jne 0x1400ac11b
lea rcx, [rsp + 0x188]
call fcn.1400503f4
lea rdx, [rsp + 0xb4]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0xb4], esi
call fcn.14006648c
cmp eax, esi
jle 0x1400ac377
mov eax, dword [rsp + 0xb4]
mov qword [rsp + 0xf0], rax
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, [0x1400f60f4]
mov r8d, r12d
call fcn.14005a810
cmp al, sil
je 0x1400ac1ab
mov byte [rsp + 0x61], bpl
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, str.byte
mov r8d, 4
call fcn.14005a810
cmp al, sil
je 0x1400ac1d4
mov byte [rsp + 0x62], bpl
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, [0x1400f4460]
mov r8d, ebp
call fcn.14005a810
cmp al, sil
je 0x1400ac1fa
mov byte [rsp + 0x60], 3
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fc5c0]
mov r8d, r12d
call fcn.14005a810
cmp al, sil
je 0x1400ac220
or byte [rsp + 0x60], bpl
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fc5bc]
mov r8d, r12d
call fcn.14005a810
cmp al, sil
je 0x1400ac246
or byte [rsp + 0x60], r12b
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, str.name
mov r8d, 4
call fcn.14005a810
cmp al, sil
je 0x1400ac272
mov byte [rsp + 0xba], bpl
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fbc34]
mov r8d, ebp
call fcn.14005a810
cmp al, sil
je 0x1400ac296
add dil, bpl
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fc5b0]
mov r8d, r12d
call fcn.14005a810
cmp al, sil
je 0x1400ac2ba
dec dil
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fc5ac]
mov r8d, ebp
call fcn.14005a810
cmp al, sil
je 0x1400ac2de
add r15b, bpl
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fc5a8]
mov r8d, r12d
call fcn.14005a810
cmp al, sil
je 0x1400ac304
mov byte [rsp + 0xb0], bpl
jmp 0x1400ac377
lea rdx, [rsp + 0x188]
lea rcx, str.init
mov r8d, 4
call fcn.14005a810
cmp al, sil
je 0x1400ac32d
mov byte [rsp + 0xb9], bpl
jmp 0x1400ac377
mov rcx, qword [rsp + 0x188]
movzx eax, word [rcx]
cmp ax, si
je 0x1400ac36a
mov edx, 9
lea r9d, [rdx + 4]
cmp dx, ax
ja 0x1400ac351
cmp ax, r9w
jbe 0x1400ac362
cmp r14w, ax
je 0x1400ac362
add rcx, r12
mov ax, word [rcx]
cmp ax, si
jne 0x1400ac346
mov qword [rsp + 0x188], rcx
lea rcx, [rsp + 0x188]
call fcn.1400503f4
mov rbp, qword [rsp + 0x188]
movzx eax, word [rbp]
cmp ebx, eax
je 0x1400abfd6
mov r14b, byte [rsp + 0xb8]
mov byte [rsp + 0x63], dil
mov byte [rsp + 0x64], r15b
mov r15, qword [rsp + 0x108]
mov rdi, rsi
mov dword [rsp + 0xd0], r13d
lea rcx, [rsp + 0x88]
call fcn.140058038
lea rcx, [rsp + 0xc8]
call fcn.140058038
lea rcx, [rsp + 0x80]
call fcn.140058038
lea rcx, [rsp + 0xa0]
call fcn.140058038
lea rcx, [rsp + 0x98]
call fcn.140058038
movzx eax, word [rbp]
mov ecx, 0x6e
or ax, 0x20
cmp cx, ax
je 0x1400ac471
mov ecx, 0x75
cmp cx, ax
je 0x1400ac471
mov ecx, 0x62
cmp cx, ax
je 0x1400ac471
lea eax, [rcx - 4]
cmp ax, word [rbp]
je 0x1400ac471
lea eax, [rcx - 0x37]
cmp ax, word [rbp]
je 0x1400ac471
lea eax, [rcx - 0x3f]
lea r13d, [rcx - 0x3e]
cmp ax, word [rbp]
je 0x1400ac477
lea eax, [rcx - 0x22]
cmp ax, word [rbp]
je 0x1400ac477
cmp r13w, word [rbp]
je 0x1400ac477
lea eax, [rcx - 0x38]
cmp ax, word [rbp]
je 0x1400ac477
lea eax, [rcx + 0x1c]
cmp ax, word [rbp]
je 0x1400ac477
cmp word [rbp], 0x2e
je 0x1400ac477
lea eax, [rcx - 0x23]
cmp ax, word [rbp]
je 0x1400ac477
mov bl, byte [rsp + 0x198]
jmp 0x1400ac48c
mov r13d, 0x24
mov bl, byte [rbp]
add rbp, r12
mov byte [rsp + 0x198], bl
mov qword [rsp + 0x188], rbp
cmp bl, sil
je 0x1400ac4a9
lea rcx, [rsp + 0x198]
call fcn.140057b84
movsx ecx, byte [rax]
movzx eax, word [rbp]
cmp ecx, eax
je 0x1400ac4b0
cmp r13w, word [rbp]
jne 0x1400ac4c2
mov al, byte [rbp]
add rbp, r12
mov byte [rsp + 0x70], al
mov qword [rsp + 0x188], rbp
lea eax, [rbx - 0x41]
cmp al, 0x19
ja 0x1400ac4d3
or bl, 0x20
mov byte [rsp + 0x198], bl
lea rcx, [rsp + 0x188]
call fcn.1400503f4
mov r13, qword [rsp + 0x188]
lea rdx, [0x1400fc5a0]
mov rcx, r13
mov qword [rsp + 0x90], r13
mov rbp, r13
call qword [sym.imp.SHLWAPI.dll_StrStrW]
mov rbx, rax
cmp rax, rsi
je 0x1400ac50f
lea rbp, [rax + 4]
mov qword [rsp + 0xd8], rbp
mov r8, rbp
mov r9d, 0x3d
cmp word [rbp], si
je 0x1400ac612
lea r10d, [r9 - 0x11]
cmp r10w, word [r8]
je 0x1400ac58d
cmp r9w, word [r8]
je 0x1400ac612
mov eax, 0x21
cmp ax, word [r8]
jne 0x1400ac577
lea rax, [r8 + 2]
lea rcx, [rsp + 0x188]
mov qword [rsp + 0x188], rax
call fcn.1400503f4
mov rcx, qword [rsp + 0x188]
cmp word [rcx], si
je 0x1400ac612
lea r8, [rcx - 2]
add r8, r12
mov qword [rsp + 0xd8], r8
cmp word [r8], si
jne 0x1400ac52e
jmp 0x1400ac612
lea rcx, [r8 + 2]
mov edx, r9d
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r8, rax
cmp rax, rsi
je 0x1400ac5ac
mov qword [rsp + 0xd8], rax
jmp 0x1400ac60c
mov rcx, qword [rsp + 0xd8]
mov edx, 0x21
add rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r11, rax
cmp rax, rsi
je 0x1400ac604
lea rcx, [rax + 2]
mov qword [rsp + 0x188], rcx
lea rcx, [rsp + 0x188]
call fcn.1400503f4
mov r8, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x188]
cmp word [rcx], si
cmove r8, r11
mov qword [rsp + 0xd8], r8
jmp 0x1400ac60c
mov r8, qword [rsp + 0xd8]
mov r9d, 0x3d
mov eax, 0x2c
cmp ax, word [r8]
je 0x1400ac62e
cmp r9w, word [r8]
je 0x1400ac62e
mov eax, 0x21
cmp ax, word [r8]
jne 0x1400ac656
mov r15b, byte [r8]
mov word [r8], si
add qword [rsp + 0xd8], r12
mov byte [rsp + 0x188], r15b
cmp r15b, sil
jne 0x1400ac7a0
mov r15, qword [rsp + 0x108]
inc r14b
cmp r14b, sil
mov byte [rsp + 0xb8], r14b
jg 0x1400ac756
mov rcx, qword [rsp + 0x180]
lea r8, [rsp + 0xe8]
xor r9d, r9d
mov rdx, r15
mov byte [rsp + 0x20], 1
call fcn.14006b814
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x188], rdx
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x80]
call fcn.140050424
lea rcx, [rsp + 0xc8]
call fcn.140050424
lea rcx, [rsp + 0x88]
call fcn.140050424
lea rcx, [rsp + 0x188]
call fcn.1400503f4
lea rdx, [rsp + 0x188]
lea rcx, str.___initram
mov r8d, 0xa
call fcn.14005a810
mov ecx, 0x2d
lea edx, [rcx - 3]
lea r8d, [rcx - 0x24]
lea r9d, [rcx - 0x20]
cmp al, sil
je 0x1400abf53
mov ecx, 3
call fcn.140018acc
lea rcx, [rsp + 0xe8]
call fcn.140050424
lea rcx, [rsp + 0x110]
call fcn.140050424
mov rax, rsi
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x98]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x80]
call fcn.140050424
lea rcx, [rsp + 0xc8]
call fcn.140050424
lea rcx, [rsp + 0x88]
call fcn.140050424
mov rsi, 0xffffffff80070057
jmp 0x1400ac725
mov qword [rsp + 0xc0], rsi
mov r14d, 0x5c
cmp rbx, rsi
jne 0x1400ac8ad
mov r8d, r14d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbx, rax
cmp rax, rsi
jne 0x1400ac8ad
lea r8d, [r14 - 0x30]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x110]
mov r9b, 1
call fcn.14006ece4
lea rdx, [rsp + 0x88]
xor r8d, r8d
mov rcx, rax
call fcn.14005b95c
mov rbp, qword [rsp + 0x88]
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r14, rax
cmp rax, rsi
je 0x1400ac8ef
add r14, r12
lea rdx, [0x1400fc5a0]
mov word [rax], si
mov rcx, r14
mov qword [rsp + 0x108], r14
call qword [sym.imp.SHLWAPI.dll_StrStrW]
mov rbx, rax
mov qword [rsp + 0x100], rax
cmp byte [rsp + 0x60], sil
je 0x1400ac86d
cmp rax, rsi
jne 0x1400ac891
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [r14 + rcx*2]
mov qword [rsp + 0x100], rbx
cmp rbx, rsi
jne 0x1400ac891
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbx, rax
mov qword [rsp + 0x100], rax
cmp rax, rsi
je 0x1400ac8ef
mov r13, qword [rsp + 0x180]
cmp word [rbx], si
je 0x1400ac93b
mov word [rbx], si
add rbx, r12
jmp 0x1400ac933
mov rdx, r13
mov r13, qword [rsp + 0x180]
lea r8, [rsp + 0x88]
xor r9d, r9d
mov rcx, r13
mov word [rbx], si
mov byte [rsp + 0x20], 1
call fcn.14006b814
mov rbp, qword [rsp + 0x88]
mov rcx, rbp
mov edx, r14d
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r14, rax
cmp rax, rsi
jne 0x1400ac901
lea rcx, [rsp + 0xc0]
call fcn.140050424
jmp 0x1400ac756
add r14, r12
lea rdx, [rbx + 2]
lea r8, [rsp + 0xc0]
xor r9d, r9d
mov rcx, r13
mov word [rax], si
mov qword [rsp + 0x108], r14
mov byte [rsp + 0x20], 1
call fcn.14006b814
mov rbx, qword [rsp + 0xc0]
mov qword [rsp + 0x100], rbx
mov eax, 0x5c
cmp ax, word [rbx]
jne 0x1400ac950
add rbx, r12
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xe0], rsi
cmp byte [rsp + 0xba], sil
je 0x1400ac98c
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xd8]
mov rcx, r13
call fcn.140069c88
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0xd8], rdx
jmp 0x1400ac994
mov rdx, qword [rsp + 0xd8]
mov eax, 0x2c
cmp r15b, al
jne 0x1400aca74
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x110]
mov r8d, eax
mov r9b, 1
mov r15d, eax
call fcn.14006ece4
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, rax
call fcn.14005b95c
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, r13
call fcn.140003720
cmp byte [rsp + 0x198], 0x2e
jne 0x1400aca4a
mov rax, qword [rsp + 0xd8]
cmp r15w, word [rax]
jne 0x1400aca4a
add rax, r12
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x110]
mov r8d, r15d
mov r9b, 1
mov qword [rsp + 0xd8], rax
call fcn.14006ece4
lea rdx, [rsp + 0x98]
xor r8d, r8d
mov rcx, rax
call fcn.14005b95c
lea rdx, [rsp + 0x98]
xor r8d, r8d
mov rcx, r13
call fcn.140003720
mov rax, qword [rsp + 0x80]
cmp word [rax], si
jne 0x1400acbee
lea rdx, str.RegDat
lea rcx, [rsp + 0x80]
call fcn.1400625ac
jmp 0x1400acbee
mov eax, 0x21
cmp r15b, al
je 0x1400acbee
mov al, byte [rsp + 0x198]
cmp word [rdx], si
jne 0x1400acac0
cmp al, 0x24
je 0x1400acaeb
mov r8d, 0x2a
lea ecx, [r8 + 0x54]
cmp al, r8b
je 0x1400acac9
cmp al, cl
je 0x1400acac9
cmp byte [rsp + 0x64], sil
je 0x1400acbee
mov rdi, rdx
mov qword [rsp + 0xa8], rdx
jmp 0x1400acbee
mov ecx, 0x7e
lea r8d, [rcx - 0x54]
cmp al, 0x24
je 0x1400acaeb
cmp al, r8b
je 0x1400acaeb
cmp al, cl
je 0x1400acaeb
lea rcx, [rsp + 0xd8]
call fcn.1400503f4
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x78]
call fcn.14006252c
mov rdi, qword [rsp + 0x78]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], rdi
call fcn.1400503f4
mov rdx, rdi
cmp byte [rsp + 0x190], sil
je 0x1400acb25
lea rcx, [rsp + 0xa0]
call fcn.1400625ac
jmp 0x1400acb3d
lea r8, [rsp + 0xa0]
xor r9d, r9d
mov rcx, r13
mov byte [rsp + 0x20], 1
call fcn.14006a438
mov rdi, qword [rsp + 0xa0]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0x90], rdi
call fcn.1400503f4
mov cl, byte [rsp + 0x198]
cmp cl, sil
jne 0x1400acbb6
mov rdx, qword [rsp + 0x68]
lea rcx, [0x1400fc584]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, esi
jne 0x1400acb8d
lea rdi, [0x1400f04f4]
jmp 0x1400acbdc
mov rax, qword [rsp + 0x90]
mov ecx, 0x23
cmp cx, word [rax]
je 0x1400acba9
mov ecx, 0x40
cmp cx, word [rax]
jne 0x1400acbe4
mov rdi, rax
mov qword [rsp + 0xa8], rax
jmp 0x1400acbe4
mov eax, 0x23
cmp cl, al
je 0x1400acbc8
mov eax, 0x40
cmp cl, al
jne 0x1400acbe4
mov rcx, qword [rsp + 0x90]
movzx eax, word [rcx]
neg ax
sbb rdi, rdi
and rdi, rcx
mov qword [rsp + 0xa8], rdi
lea rcx, [rsp + 0x78]
call fcn.140050424
lea rdx, str.HKLM
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400acd00
lea rdx, str.HKEY_LOCAL_MACHINE
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400acd00
lea rdx, str.HKCU
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400accf7
lea rdx, str.HKEY_CURRENT_USER
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400accf7
lea rdx, str.HKCR
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400accee
lea rdx, str.HKEY_CLASSES_ROOT
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400accee
lea rdx, [0x1400fc4d8]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400acce5
lea rdx, str.HKEY_USERS
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400acce5
lea rdx, str.HKCC
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400accdc
lea rdx, str.HKEY_CURRENT_CONFIG
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400accdc
lea rcx, [rsp + 0xe0]
call fcn.140050424
jmp 0x1400ac8ef
mov r15, 0xffffffff80000005
jmp 0x1400acd07
mov r15, 0xffffffff80000003
jmp 0x1400acd07
mov r15, 0xffffffff80000000
jmp 0x1400acd07
mov r15, 0xffffffff80000001
jmp 0x1400acd07
mov r15, 0xffffffff80000002
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x90], r15
cmp word [rax], si
je 0x1400ad82e
mov cl, byte [rsp + 0x198]
mov edx, 0x3f
cmp cl, 0x2e
je 0x1400acd38
mov r13d, esi
cmp cl, dl
jne 0x1400acd42
mov r13d, 1
cmp cl, dl
je 0x1400acd50
cmp r13d, esi
je 0x1400acd4c
cmp word [rax], si
je 0x1400acd50
mov ebp, esi
jmp 0x1400acd55
mov ebp, 1
xor ecx, ecx
mov dword [rsp + 0xf8], ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x78]
mov edx, 0x64
mov dword [rsp + 0x12c], esi
call fcn.1400580ac
lea rcx, [rsp + 0xa8]
call fcn.140058038
cmp byte [rsp + 0x198], 0x2e
lea rax, [rsp + 0x78]
lea r14, [rsp + 0xa8]
lea rcx, [rsp + 0x68]
mov edx, 0x1000
cmovne r14, rax
call fcn.140057dc0
mov rdx, qword [rsp + 0x108]
mov dword [rsp + 0xb4], 0xfff
mov dword [rsp + 0x188], esi
mov dword [rsp + 0x128], esi
mov rcx, r15
cmp byte [rsp + 0x60], sil
je 0x1400ad067
lea rax, [rsp + 0x90]
mov r9d, 9
xor r8d, r8d
mov dword [rsp + 0x100], esi
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0x188], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xf8], esi
mov dword [rsp + 0xf0], esi
mov qword [rsp + 0x90], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x188]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0xf0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xf8]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x188]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [rsp + 0x188]
cmp ecx, dword [rsp + 0xf0]
mov ebx, eax
cmovb ecx, dword [rsp + 0xf0]
mov dword [rsp + 0x188], ecx
lea r15d, [rcx*4 + 0x20]
lea rcx, [rsp + 0x108]
movsxd rdx, r15d
shr rdx, 1
add rdx, 8
call fcn.1400580ac
mov rdi, qword [rsp + 0x108]
mov eax, 0xd
mov word [rdi], ax
mov eax, 0xa
mov ecx, 0x76
mov word [rdi + 2], ax
lea rax, [rdi + 4]
lea r13, [rdi + 8]
mov word [rax], cx
mov ecx, 0x20
mov rbp, rax
mov word [rdi + 6], cx
mov cl, byte [rsp + 0x60]
mov word [r13], si
cmp cl, 3
cmovne r13, rax
cmp ebx, esi
jne 0x1400ad042
test cl, 1
je 0x1400acfcf
cmp dword [rsp + 0xf8], esi
mov ebx, esi
jle 0x1400acfcf
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x100], r15d
mov word [r13], si
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x100]
mov r8, r13
mov edx, ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x1400acfbc
lea rcx, [rsp + 0x78]
mov rdx, rbp
call fcn.140058174
mov rbp, rdi
inc ebx
cmp ebx, dword [rsp + 0xf8]
jl 0x1400acf6c
mov cl, byte [rsp + 0x60]
lea rax, [rdi + 4]
mov edx, 0x6b
mov word [rax], dx
test r12b, cl
je 0x1400ad042
cmp dword [rsp + 0xd0], esi
mov ebx, esi
jle 0x1400ad042
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x100], r15d
mov word [r13], si
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x100]
mov r8, r13
mov edx, ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x1400ad037
lea rcx, [rsp + 0x78]
mov rdx, rbp
call fcn.140058174
mov rbp, rdi
inc ebx
cmp ebx, dword [rsp + 0xd0]
jl 0x1400acfe7
mov rcx, qword [rsp + 0x90]
cmp rcx, rsi
je 0x1400ad055
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x108]
call fcn.140050424
jmp 0x1400ad745
lea rax, [rsp + 0x188]
lea r9, [rsp + 0x68]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x20], rax
call fcn.14005cec0
movsxd rdi, dword [rsp + 0x188]
mov ebx, eax
cmp edi, esi
je 0x1400ad19f
mov rax, qword [rsp + 0x100]
cmp word [rax], si
jne 0x1400ad0de
cmp edi, r12d
jne 0x1400ad0de
cmp ebx, 0xfffffffe
jne 0x1400ad0de
cmp r13d, esi
je 0x1400ad745
lea rdx, [0x1400fc484]
or rax, 0xffffffffffffffff
mov rcx, r14
mov r8, rax
mov r9, rax
call fcn.1400581f4
jmp 0x1400ad745
mov dword [rsp + 0x12c], edi
cmp r13d, esi
je 0x1400ad0f3
lea rdx, str.ERROR
jmp 0x1400ad0c7
cmp byte [rsp + 0xb9], sil
jne 0x1400ad745
lea rcx, [rsp + 0x68]
call fcn.140050424
lea rcx, [rsp + 0xa8]
call fcn.140050424
lea rcx, [rsp + 0x78]
call fcn.140050424
lea rcx, [rsp + 0xe0]
call fcn.140050424
lea rcx, [rsp + 0xc0]
call fcn.140050424
lea rcx, [rsp + 0x98]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x80]
call fcn.140050424
lea rcx, [rsp + 0xc8]
call fcn.140050424
lea rcx, [rsp + 0x88]
call fcn.140050424
lea rcx, [rsp + 0xe8]
call fcn.140050424
lea rcx, [rsp + 0x110]
call fcn.140050424
mov rax, rdi
jmp 0x1400ac742
mov r8, qword [rsp + 0xf0]
cmp r8, rsi
jl 0x1400ad1b7
mov r15d, 1
cmp r8, rbx
jne 0x1400ad1ba
mov r15d, esi
or rax, 0xffffffffffffffff
mov cl, sil
lea rdx, str.REG_SZ
mov dil, al
cmp ebx, 1
jne 0x1400ad1d8
mov dil, sil
lea ebx, [rax + 0x25]
jmp 0x1400ad1fa
cmp ebx, 6
jne 0x1400ad1e8
lea rdx, str.REG_LINK
mov bl, 0x5e
jmp 0x1400ad1fa
cmp ebx, 0x15
jne 0x1400ad2ed
lea rdx, str.REG_MUI_SZ
mov bl, 0x75
cmp r13d, esi
je 0x1400ad21d
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.1400581f4
cmp ebp, esi
jne 0x1400ad745
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad24b
cmp r8, rsi
jge 0x1400ad4d2
mov al, byte [rsp + 0x198]
cmp bl, al
je 0x1400ad4d2
cmp al, 0x2e
je 0x1400ad4d2
cmp dil, al
je 0x1400ad4d2
lea rcx, [rsp + 0x68]
call fcn.140050424
lea rcx, [rsp + 0xa8]
call fcn.140050424
lea rcx, [rsp + 0x78]
call fcn.140050424
lea rcx, [rsp + 0xe0]
call fcn.140050424
lea rcx, [rsp + 0xc0]
call fcn.140050424
lea rcx, [rsp + 0x98]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x80]
call fcn.140050424
lea rcx, [rsp + 0xc8]
call fcn.140050424
lea rcx, [rsp + 0x88]
call fcn.140050424
lea rcx, [rsp + 0xe8]
call fcn.140050424
lea rcx, [rsp + 0x110]
call fcn.140050424
mov rax, 0xffffffff80070057
jmp 0x1400ac742
cmp ebx, 0xb
jne 0x1400ad35b
cmp r13d, esi
je 0x1400ad31c
lea rdx, str.REG_QWORD
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.1400581f4
cmp ebp, esi
jne 0x1400ad745
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad24b
cmp r8, rsi
jge 0x1400ad33d
mov al, byte [rsp + 0x198]
cmp al, 0x2b
je 0x1400ad33d
cmp al, 0x2e
jne 0x1400ad24b
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
lea r8, str.0x_I64x
mov rdx, qword [rdx]
call fcn.1400c38b4
jmp 0x1400ad745
mov rdi, qword [rsp + 0x68]
cmp ebx, 4
jne 0x1400ad3ba
cmp r13d, esi
je 0x1400ad38f
lea rdx, str.REG_DWORD
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.1400581f4
cmp ebp, esi
jne 0x1400ad745
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad24b
cmp r8, rsi
jge 0x1400ad429
mov al, byte [rsp + 0x198]
mov ecx, 0x23
cmp al, cl
je 0x1400ad429
cmp al, 0x2e
je 0x1400ad429
jmp 0x1400ad24b
cmp ebx, 5
jne 0x1400ad443
cmp r13d, esi
je 0x1400ad3ed
lea rdx, str.REG_DWORD_BIG_ENDIAN
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.1400581f4
cmp ebp, esi
jne 0x1400ad745
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad24b
cmp r8, rsi
jge 0x1400ad413
mov al, byte [rsp + 0x198]
mov ecx, 0x62
cmp al, cl
je 0x1400ad413
cmp al, 0x2e
jne 0x1400ad24b
mov al, byte [rdi + 3]
mov cl, byte [rdi]
mov byte [rdi], al
mov byte [rdi + 3], cl
mov al, byte [rdi + 2]
mov cl, byte [rdi + 1]
mov byte [rdi + 1], al
mov byte [rdi + 2], cl
mov r8d, dword [rdi]
mov rcx, qword [rsp + 0x78]
lea rdx, str.0x_x
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1400ad745
cmp ebx, r12d
jne 0x1400ad4eb
cmp r13d, esi
je 0x1400ad476
lea rdx, str.REG_EXPAND_SZ
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.1400581f4
cmp ebp, esi
jne 0x1400ad745
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad24b
cmp r8, rsi
jge 0x1400ad49c
mov al, byte [rsp + 0x198]
mov ecx, 0x7e
cmp al, cl
je 0x1400ad49c
cmp al, 0x2e
jne 0x1400ad24b
mov r8b, byte [rsp + 0x70]
cmp r8b, sil
je 0x1400ad4d2
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x180]
lea r8, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0xd8], rdx
mov byte [rsp + 0x20], 1
call fcn.14006b814
jmp 0x1400ad745
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x68], rcx
jmp 0x1400ad745
cmp ebx, 7
jne 0x1400ad60a
cmp r13d, esi
je 0x1400ad51e
lea rdx, str.REG_MULTI_SZ
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.1400581f4
cmp ebp, esi
jne 0x1400ad745
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad24b
cmp r8, rsi
mov ebx, 0x2a
jge 0x1400ad544
mov al, byte [rsp + 0x198]
cmp al, bl
je 0x1400ad544
cmp al, 0x2e
jne 0x1400ad24b
movsxd rdi, dword [rsp + 0xb4]
lea rcx, [rsp + 0x78]
shr rdi, 1
lea edx, [rdi*4 + 6]
call fcn.140058138
mov rcx, qword [rsp + 0x68]
mov r11, qword [rsp + 0x78]
mov eax, edi
lea rdi, [rcx + rax*2]
cmp rcx, rdi
jae 0x1400ad601
mov r8b, byte [rsp + 0x70]
mov edx, 0x30
mov r9d, 0x5c
cmp r8b, bl
jne 0x1400ad5bc
cmp r9w, word [rcx]
jne 0x1400ad5bc
lea rax, [rcx + 2]
cmp dx, word [rax]
je 0x1400ad5a8
cmp r9w, word [rax]
je 0x1400ad5a8
cmp word [rax], si
jne 0x1400ad5bc
lea rcx, [r12 + rax]
mov word [r11], r9w
movzx eax, word [rax]
add r11, r12
mov word [r11], ax
jmp 0x1400ad5f9
movzx eax, word [rcx]
cmp ax, si
je 0x1400ad5d0
mov word [r11], ax
add r11, r12
add rcx, r12
jmp 0x1400ad5fc
add rcx, r12
cmp r8b, 0x24
jne 0x1400ad5ee
cmp rcx, rdi
jae 0x1400ad601
mov eax, 0xd
mov word [r11], ax
mov eax, 0xa
jmp 0x1400ad5b3
mov word [r11], r9w
add r11, r12
mov word [r11], dx
add r11, r12
cmp rcx, rdi
jb 0x1400ad583
mov word [r11], si
jmp 0x1400ad745
cmp ebx, 3
jne 0x1400ad618
lea rdx, str.REG_BINARY
jmp 0x1400ad623
cmp ebx, esi
jne 0x1400ad62b
lea rdx, str.REG_NONE
mov r12d, 0xa
jmp 0x1400ad65f
mov ebp, 8
cmp ebx, ebp
jne 0x1400ad63d
lea rdx, str.REG_RESOURCE_LIST
jmp 0x1400ad623
mov edx, 9
lea r12d, [rdx + 1]
cmp ebx, edx
jne 0x1400ad653
lea rdx, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x1400ad65f
cmp ebx, r12d
jne 0x1400ad683
lea rdx, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp r13d, esi
je 0x1400ad67f
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.1400581f4
cmp dword [rsp + 0xf8], esi
jne 0x1400ad745
mov cl, 0x40
jmp 0x1400ad6b8
cmp r13d, esi
je 0x1400ad6b8
mov edx, 0x32
mov rcx, r14
call fcn.140058138
mov rcx, qword [r14]
lea rdx, str.0x_lx
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfW]
cmp dword [rsp + 0xf8], esi
jne 0x1400ad745
mov cl, sil
mov rax, qword [rsp + 0xf0]
cmp rax, rsi
jge 0x1400ad6d8
mov al, byte [rsp + 0x198]
cmp cl, al
je 0x1400ad6d8
cmp al, 0x2e
jne 0x1400ad24b
cmp r15d, esi
jne 0x1400ad24b
mov eax, dword [rsp + 0xb4]
lea ecx, [rax + rax*4 + 7]
movsxd rdx, ecx
lea rcx, [rsp + 0x78]
call fcn.140058138
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
mov word [rdi], si
mov word [rdi + 2], si
cmp dword [rsp + 0xb4], esi
mov dword [rsp + 0x128], 1
mov ebp, esi
jle 0x1400ad745
movzx r8d, byte [rbx]
lea rdx, str._0x_02X
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
inc ebp
inc rbx
add rdi, r12
cmp ebp, dword [rsp + 0xb4]
jl 0x1400ad720
mov rdx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x180]
cmp word [rdx], si
je 0x1400ad773
movsxd rcx, dword [rsp + 0x128]
mov rax, qword [rsp + 0x78]
lea r8, [rax + rcx*2]
mov rcx, rdi
call fcn.140057714
mov rdx, qword [rsp + 0x98]
cmp word [rdx], si
je 0x1400ad78b
mov r8, qword [r14]
mov rcx, rdi
call fcn.140057714
lea rcx, [rsp + 0x68]
call fcn.140050424
lea rcx, [rsp + 0xa8]
call fcn.140050424
lea rcx, [rsp + 0x78]
call fcn.140050424
lea rcx, [rsp + 0xe0]
call fcn.140050424
lea rcx, [rsp + 0xc0]
call fcn.140050424
lea rcx, [rsp + 0x98]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x80]
call fcn.140050424
lea rcx, [rsp + 0xc8]
call fcn.140050424
lea rcx, [rsp + 0x88]
call fcn.140050424
lea rcx, [rsp + 0xe8]
call fcn.140050424
lea rcx, [rsp + 0x110]
call fcn.140050424
movsxd rax, dword [rsp + 0x12c]
jmp 0x1400ac742
cmp rdi, rsi
je 0x1400adfdb
mov al, byte [rsp + 0x63]
mov qword [rsp + 0x180], rsi
mov ebp, 8
cmp al, sil
mov qword [rsp + 0x68], rsi
lea r13, [rsp + 0x68]
jg 0x1400ad85e
cmp byte [rsp + 0x64], sil
je 0x1400ad886
movsx r8d, al
mov rdx, r14
mov rcx, r15
call fcn.14005483c
cmp byte [rsp + 0x63], r12b
movsxd rbx, eax
jge 0x1400adf51
cmp byte [rsp + 0x64], sil
jne 0x1400adf51
mov al, byte [rsp + 0x198]
mov ecx, 0x2b
cmp al, cl
je 0x1400ad8af
cmp al, sil
jne 0x1400ada06
cmp cx, word [rdi]
jne 0x1400ad8e3
add rdi, r12
mov qword [rsp + 0xa8], rdi
mov r14d, 0xb
cmp byte [rsp + 0x62], sil
je 0x1400adddf
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x180]
mov rcx, rdi
call fcn.1400abda4
mov r13, qword [rsp + 0x180]
jmp 0x1400ade60
mov ecx, 0x23
cmp cx, word [rdi]
jne 0x1400ad931
add rdi, r12
mov qword [rsp + 0xa8], rdi
mov ebx, 4
mov r14, rbx
cmp byte [rsp + 0x62], sil
je 0x1400adceb
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x180]
mov rcx, rdi
call fcn.1400abda4
mov r13, qword [rsp + 0x180]
mov rbp, rbx
jmp 0x1400ade60
mov ecx, 0x2a
cmp cx, word [rdi]
jne 0x1400ad975
add rdi, r12
mov r14d, 7
mov qword [rsp + 0xf0], r14
cmp byte [rsp + 0x62], sil
je 0x1400adbb5
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x180]
mov rcx, rdi
call fcn.1400abda4
movsxd rbp, eax
jmp 0x1400ad8d6
mov ecx, 0x7e
cmp cx, word [rdi]
jne 0x1400ad9ea
add rdi, r12
mov r14, r12
cmp byte [rsp + 0x62], sil
jne 0x1400ad957
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x180]
add eax, r12d
movsxd rdx, eax
call fcn.140058138
mov r13, qword [rsp + 0x180]
mov rbp, r13
cmp word [rdi], si
je 0x1400adba6
mov edx, 0x30
lea ecx, [rdx + 0x2c]
movzx eax, word [rdi]
cmp cx, ax
jne 0x1400adb93
cmp dx, word [rdi + 2]
jne 0x1400adb93
mov word [rbp], si
add rbp, r12
add rdi, 4
jmp 0x1400adb9d
mov ecx, 0x40
cmp cx, word [rdi]
jne 0x1400adb32
add rdi, r12
mov r14d, 3
jmp 0x1400ad957
mov ecx, 0x23
cmp al, cl
je 0x1400ad8f8
mov ecx, 0x62
cmp al, cl
jne 0x1400adafa
lea r14d, [rcx - 0x5d]
cmp byte [rsp + 0x62], sil
je 0x1400ada4e
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x180]
mov rcx, rdi
call fcn.1400abda4
mov r13, qword [rsp + 0x180]
jmp 0x1400adaf0
cmp byte [rsp + 0x61], sil
je 0x1400adab5
mov edx, 0x30
cmp word [rdi], dx
jb 0x1400ada65
cmp word [rdi], 0x39
jbe 0x1400ada88
movzx eax, word [rdi]
mov ecx, 0x20
or ax, cx
cmp ax, 0x61
jb 0x1400ada7c
cmp ax, 0x66
jbe 0x1400ada8d
mov rsi, 0xffffffff80070057
jmp 0x1400add72
mov ecx, 0x20
cmp dx, word [rdi]
jne 0x1400adaa7
movzx eax, word [rdi + 2]
or ax, cx
mov ecx, 0x78
cmp cx, ax
jne 0x1400adaa7
add rdi, 4
mov rcx, rdi
call fcn.14005924c
mov dword [rsp + 0x68], eax
jmp 0x1400adad0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa8]
call fcn.14006648c
cmp eax, 1
jl 0x1400add6d
mov cl, byte [rsp + 0x68]
mov al, byte [rsp + 0x6b]
mov byte [rsp + 0x68], al
mov al, byte [rsp + 0x6a]
mov byte [rsp + 0x6b], cl
mov cl, byte [rsp + 0x69]
mov byte [rsp + 0x69], al
mov byte [rsp + 0x6a], cl
mov ebp, 4
jmp 0x1400ade60
mov ecx, 0x2a
cmp al, cl
je 0x1400ad93e
mov ecx, 0x7e
cmp al, cl
je 0x1400ad982
mov ecx, 0x40
cmp al, cl
je 0x1400ad9fb
mov ecx, 0x6e
cmp al, cl
jne 0x1400adb32
mov r14, rsi
jmp 0x1400ad957
mov r14, qword [rsp + 0xf0]
cmp r14, rsi
jge 0x1400ad957
cmp al, 0x5e
jne 0x1400adb4f
mov r14d, 6
jmp 0x1400adb71
mov ecx, 0x75
cmp al, cl
jne 0x1400adb5e
lea r14d, [rcx - 0x60]
jmp 0x1400adb71
cmp al, sil
je 0x1400adb6b
cmp al, 0x24
jne 0x1400ada7c
mov r14d, 1
cmp byte [rsp + 0x62], sil
jne 0x1400ad957
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13, rdi
movsxd rbp, eax
add rbp, rbp
jmp 0x1400ade60
mov word [rbp], ax
add rbp, r12
add rdi, r12
cmp word [rdi], si
jne 0x1400ad9c4
mov word [rbp], si
sub rbp, r13
add rbp, r12
jmp 0x1400ade60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, esi
movsxd r14, eax
lea ecx, [r14 + 0x10]
movsxd rdx, ecx
lea rcx, [rsp + 0x180]
call fcn.140058138
mov r13, qword [rsp + 0x180]
lea r8, [rdi + r14*2]
mov qword [rsp + 0xa8], r13
mov rbp, r13
cmp rdi, r8
jae 0x1400adcb0
mov r13b, byte [rsp + 0x70]
mov edx, 0x30
lea r15d, [rdx + 0x2c]
lea r9d, [rdx - 0x26]
mov eax, 0x2a
mov word [rbp], si
cmp r13b, al
jne 0x1400adc37
cmp r15w, word [rdi]
jne 0x1400adc68
lea rax, [rdi + 2]
cmp r15w, word [rax]
jne 0x1400adc68
lea rdi, [r12 + rax]
movzx eax, word [rax]
mov word [rbp], ax
add rbp, r12
jmp 0x1400adc90
cmp r13b, 0x24
jne 0x1400adc68
movzx eax, word [rdi]
mov ecx, 0xd
cmp cx, ax
jne 0x1400adc56
cmp r9w, word [rdi + 2]
jne 0x1400adc56
add rdi, r12
jmp 0x1400adc5c
cmp r9w, ax
jne 0x1400adc86
add rdi, r12
mov word [rbp], si
add rbp, r12
jmp 0x1400adc82
mov ax, word [rdi]
cmp r15w, ax
jne 0x1400adc86
cmp dx, word [rdi + 2]
jne 0x1400adc86
mov word [rbp], si
add rbp, r12
add rdi, 4
inc ebx
jmp 0x1400adc92
mov word [rbp], ax
add rbp, r12
add rdi, r12
mov ebx, esi
cmp rdi, r8
jb 0x1400adc09
cmp ebx, 1
mov r13, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x90]
jge 0x1400adcb9
inc ebx
mov word [rbp], si
add rbp, r12
cmp r14d, esi
jle 0x1400adcd7
cmp ebx, r12d
jge 0x1400adcd7
sub r12d, ebx
mov rdi, rbp
movzx eax, si
mov ecx, r12d
lea rbp, [rbp + r12*2]
rep stosw word [rdi], ax
mov r14, qword [rsp + 0xf0]
mov word [rbp], si
sub rbp, r13
jmp 0x1400ade60
cmp byte [rsp + 0x61], sil
je 0x1400add52
mov edx, 0x30
cmp word [rdi], dx
jb 0x1400add02
cmp word [rdi], 0x39
jbe 0x1400add23
movzx eax, word [rdi]
mov ecx, 0x20
or ax, cx
cmp ax, 0x61
jb 0x1400ada7c
cmp ax, 0x66
ja 0x1400ada7c
jmp 0x1400add28
mov ecx, 0x20
cmp dx, word [rdi]
jne 0x1400add41
movzx eax, word [rdi + 2]
or ax, cx
mov ecx, 0x78
cmp cx, ax
jne 0x1400add41
add rdi, rbx
mov rcx, rdi
call fcn.14005924c
mov dword [rsp + 0x68], eax
jmp 0x1400ad929
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa8]
call fcn.14006648c
cmp eax, 1
jge 0x1400ad929
mov esi, 1
lea rcx, [rsp + 0x180]
call fcn.140050424
lea rcx, [rsp + 0xe0]
call fcn.140050424
lea rcx, [rsp + 0xc0]
call fcn.140050424
lea rcx, [rsp + 0x98]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x80]
call fcn.140050424
lea rcx, [rsp + 0xc8]
call fcn.140050424
lea rcx, [rsp + 0x88]
call fcn.140050424
jmp 0x1400ac725
cmp byte [rsp + 0x61], sil
je 0x1400ade45
mov edx, 0x30
cmp word [rdi], dx
jb 0x1400addf6
cmp word [rdi], 0x39
jbe 0x1400ade17
movzx eax, word [rdi]
mov ecx, 0x20
or ax, cx
cmp ax, 0x61
jb 0x1400ada7c
cmp ax, 0x66
ja 0x1400ada7c
jmp 0x1400ade1c
mov ecx, 0x20
cmp dx, word [rdi]
jne 0x1400ade36
movzx eax, word [rdi + 2]
or ax, cx
mov ecx, 0x78
cmp cx, ax
jne 0x1400ade36
add rdi, 4
mov rcx, rdi
call fcn.14005924c
mov qword [rsp + 0x68], rax
jmp 0x1400ade60
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa8]
call fcn.1400662b4
cmp eax, 1
jl 0x1400add6d
mov rbx, qword [rsp + 0x108]
mov r12b, byte [rsp + 0xb0]
mov r8, qword [rsp + 0x100]
mov dword [rsp + 0x28], ebp
mov edi, esi
mov qword [rsp + 0x20], r13
mov r9d, r14d
mov rdx, rbx
mov rcx, r15
cmp r12b, sil
je 0x1400ade9b
call qword [0x14010e198]
mov edi, eax
jmp 0x1400adea0
call fcn.140051760
cmp edi, 0x3fd
jne 0x1400adec7
cmp byte [rsp + 0x63], sil
jne 0x1400adec7
mov r8d, 1
mov rdx, rbx
mov rcx, r15
mov byte [rsp + 0x63], 1
call fcn.14005483c
jmp 0x1400ade70
lea rcx, [rsp + 0x180]
call fcn.140050424
lea rcx, [rsp + 0xe0]
call fcn.140050424
lea rcx, [rsp + 0xc0]
call fcn.140050424
lea rcx, [rsp + 0x98]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x80]
call fcn.140050424
lea rcx, [rsp + 0xc8]
call fcn.140050424
lea rcx, [rsp + 0x88]
call fcn.140050424
lea rcx, [rsp + 0xe8]
call fcn.140050424
lea rcx, [rsp + 0x110]
call fcn.140050424
movsxd rax, edi
jmp 0x1400ac742
lea rcx, [rsp + 0x180]
call fcn.140050424
lea rcx, [rsp + 0xe0]
call fcn.140050424
lea rcx, [rsp + 0xc0]
call fcn.140050424
lea rcx, [rsp + 0x98]
call fcn.140050424
lea rcx, [rsp + 0xa0]
call fcn.140050424
lea rcx, [rsp + 0x80]
call fcn.140050424
lea rcx, [rsp + 0xc8]
call fcn.140050424
lea rcx, [rsp + 0x88]
call fcn.140050424
lea rcx, [rsp + 0xe8]
call fcn.140050424
lea rcx, [rsp + 0x110]
call fcn.140050424
mov rax, rbx
jmp 0x1400ac742
mov eax, 0x21
cmp byte [rsp + 0x188], al
jne 0x1400ae010
cmp word [rbx], si
jne 0x1400ae010
mov eax, dword [rsp + 0xd0]
mov rdx, r14
mov rcx, r15
cmp eax, esi
je 0x1400ae009
mov r8d, eax
call fcn.140063df4
jmp 0x1400ae077
call fcn.140063afc
jmp 0x1400ae077
mov eax, dword [rsp + 0xd0]
mov rdx, r14
mov rcx, r15
cmp eax, esi
je 0x1400ae06f
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x188]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001b
mov qword [rsp + 0x188], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x188]
mov edi, eax
cmp rcx, rsi
je 0x1400ae079
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400ae079
mov r8, rbx
call fcn.1400517d4
mov edi, eax
cmp edi, r12d
cmove edi, esi
jmp 0x1400aded4