Function at 0x18005dfc0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [0x18007b358]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov r13d, dword [rsp + 0x50]
mov r10, rdx
imul r15d, r8d, 0x12c
mov r12, r9
mov qword [rbp - 0x70], rdx
mov r14d, r8d
xor edx, edx
mov dword [rsp + 0x78], r8d
mov rsi, rcx
mov dword [rsp + 0x70], edx
mov edi, r8d
cmp r8d, r15d
ja 0x18005e4db
mov r14, qword [rbp - 0x40]
mov r8d, 0x7bc
mov eax, 0x315a
cmp edi, 0x344a
ja 0x18005e372
je 0x18005e369
cmp edi, 0x1059
ja 0x18005e1cf
je 0x18005e54c
mov eax, edi
sub eax, 0x87
je 0x18005e1bf
sub eax, 0x6a
je 0x18005e18b
sub eax, 0x32
je 0x18005e182
sub eax, 0x74d
je 0x18005e14b
cmp eax, 0x6a0
jne 0x18005e4c4
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x50]
xor edx, edx
mov dword [rsp + 0x50], r13d
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea ecx, [rdx + 0x19]
call fcn.180020d80
mov dword [0x18007bc70], eax
test eax, eax
je 0x18005e10b
mov ebx, 0x3e
nop
mov eax, ebx
sub eax, 0x3e
je 0x18005e0d2
cmp eax, 1
je 0x18005e659
jmp 0x18005e104
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x38], rax
mov r9d, SHSetInstanceExplorer
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.18000ee30
inc ebx
cmp ebx, 0x40
jb 0x18005e0c0
mov r9, r14
mov dword [rsp + 0x58], 1
lea r8, [rbp - 0x64]
mov dword [rsp + 0x50], r13d
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 0x10d
lea rcx, [rsp + 0x58]
call fcn.180020900
mov r10, qword [rbp - 0x70]
mov r8d, 0x7bc
mov dword [0x18007bc70], eax
jmp 0x18005e4c4
add dword [rsi], 0xffffffff
je 0x18005e4c4
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
cmp byte [r12], al
jne 0x18005e4c4
inc r10
inc r12
add dword [rsi], 0xffffffff
mov qword [rbp - 0x70], r10
jne 0x18005e160
jmp 0x18005e4c4
mov byte [rbp + 0x10], 0x5f
jmp 0x18005e4c4
xor r9d, r9d
mov qword [rsp + 0x20], rdx
xor edx, edx
mov rcx, r12
mov r14, r12
lea r8d, [r9 + 0x2a]
call fcn.180047d20
mov r13d, eax
cmp eax, 1
jae 0x18005e542
mov r10, qword [rbp - 0x70]
mov r8d, 0x7bc
jmp 0x18005e4c4
cmp dword [rsi], 0
jne 0x18005e4c4
mov eax, edx
jmp 0x18005edd5
cmp edi, 0x1230
je 0x18005e360
cmp edi, 0x1d2f
je 0x18005e2f4
cmp edi, 0x233d
je 0x18005e2eb
cmp edi, 0x2b4e
jne 0x18005e4c4
mov r8d, 0x2b
lea rdx, [rbp + 0x180]
mov rcx, r14
call fcn.18005a5c0
lea rax, [rbp + 0x180]
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x60], eax
lea r8, [rbp - 0x60]
mov eax, dword [rbp - 0x64]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x68]
xor eax, eax
mov r9d, 0x30
mov dword [rsp + 0x50], eax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.18004c360
mov dword [0x18007bc70], eax
test eax, eax
je 0x18005e1b0
mov ebx, ILRemoveLastID
mov eax, ebx
sub eax, 0xd
je case.0x18005e540.242
sub eax, 1
je 0x18005e2cc
cmp eax, 1
jne 0x18005e2d5
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x38], rax
mov r9d, SHSetInstanceExplorer
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.18000ee30
jmp 0x18005e2d5
mov eax, dword [0x18007bc70]
mov dword [rbp - 0x78], eax
dec ebx
cmp ebx, 0xc
ja 0x18005e283
mov r10, qword [rbp - 0x70]
mov r8d, 0x7bc
jmp 0x18005e4c4
mov word [rbp + 0x11], ax
jmp 0x18005e4c4
cmp dword [0x18007bc70], 0
je 0x18005e4c4
mov ebx, 0x5c
mov eax, ebx
sub eax, 0x5c
je 0x18005e318
cmp eax, 1
je 0x18005e659
jmp 0x18005e34a
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x38], rax
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x30], rdx
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor ecx, ecx
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.18000ee30
xor edx, edx
inc ebx
cmp ebx, 0x5e
jb 0x18005e306
mov r10, qword [rbp - 0x70]
mov r8d, 0x7bc
jmp 0x18005e4c4
mov byte [rbp + 0x11], 0
jmp 0x18005e4c4
mov byte [rbp + 0x13], 0
jmp 0x18005e4c4
cmp edi, 0x5664
ja 0x18005e457
je 0x18005e421
cmp edi, 0x396d
je 0x18005e405
cmp edi, 0x4557
je 0x18005e3fa
cmp edi, 0x478c
je 0x18005e3d3
cmp edi, 0x55ab
jne 0x18005e4c4
movzx edx, byte [rbp + 0x61]
movzx eax, dl
and dl, 1
shr al, 1
movzx ecx, al
movzx eax, byte [rbp + 0x60]
add cx, r8w
shr al, 5
shl dl, 3
or dl, al
mov word [rbp + 4], cx
mov byte [rbp + 6], dl
jmp 0x18005e4c4
movzx eax, byte [rbp + 0x66]
movzx ecx, byte [rbp + 0x67]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp + 0x65]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp + 0x64]
shl ecx, 8
or ecx, eax
mov dword [rbp], ecx
jmp 0x18005e4c4
mov word [rbp + 0x13], 0x38
jmp 0x18005e4c4
movzx eax, byte [rbp + 0x53]
movzx ecx, byte [rbp + 0x63]
mov dword [rbp - 8], eax
movzx eax, byte [rbp + 0x62]
shl ecx, 8
or ecx, eax
mov dword [rbp - 4], ecx
jmp 0x18005e4c4
mov r8d, 5
lea rdx, [0x1800729e5]
lea rcx, [rbp + 0x14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [0x180072a19]
mov r8d, 0x7bc
mov r10, qword [rbp - 0x70]
mov dword [rbp + 0x19], eax
movzx eax, byte [0x180072a1d]
mov byte [rbp + 0x1d], al
jmp 0x18005e4c4
cmp edi, 0x63ca
je 0x18005e4b1
cmp edi, 0x6771
je 0x18005e4ab
cmp edi, 0x787e
je 0x18005e484
cmp edi, 0x898b
jne 0x18005e4c4
mov dword [rbp + 0x20], 0x725f3367
mov byte [rbp + 0x24], 0
jmp 0x18005e4c4
mov r8d, 1
mov byte [rbp + 0x1f], 0
lea rdx, [0x1800729c6]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r10, qword [rbp - 0x70]
mov r8d, 0x7bc
jmp 0x18005e4c4
mov byte [rbp + 0x1e], 0x6f
jmp 0x18005e4c4
movzx eax, byte [rbp + 0x60]
and al, 0x1f
mov byte [rbp + 7], al
movzx eax, byte [rbp + 0x5f]
shr al, 3
mov byte [rbp + 8], al
imul eax, dword [rsp + 0x78], 0xf
xor edx, edx
add edi, eax
cmp edi, r15d
jbe 0x18005e02d
mov r14d, dword [rsp + 0x78]
lea eax, [r14 - 0x13]
mov dword [rbp - 0x80], eax
cmp r14d, eax
jbe case.0x18005e540.242
movzx ebx, byte [rbp - 0x68]
lea r15, [0x180000000]
mov edi, dword [rsp + 0x60]
mov esi, dword [rsp + 0x58]
mov dword [rsp + 0x68], ebx
lea eax, [r14 - 0xee]
mov r9d, 0x16
movabs r8, 0x7fffffffffffffff
movabs r11, 0x47004200440058
cmp eax, 0x35
ja case.0x18005e540.257
movzx eax, byte [r15 + rax + 0x5efd0]
mov ecx, dword [r15 + rax*4 + 0x5ef80]
add rcx, r15
jmp rcx
mov eax, 0xb
jmp 0x18005edd5
movzx eax, byte [r12]
movzx ecx, byte [r10]
sub eax, ecx
jmp 0x18005edd5
test bl, bl
je case.0x18005e540.257
mov ebx, 0xf0
nop dword [rax]
cmp ebx, 0xf0
je 0x18005e58c
cmp ebx, 0x1ae
jne 0x18005e5b3
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
jmp 0x18005e5b3
mov rcx, qword [rbp - 0x40]
lea rax, [rbp - 0x38]
mov dword [rsp + 0x28], edx
lea r9, [rbp - 0x34]
lea rdx, [rbp - 0x2c]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x30]
call qword [sym.imp.SHLWAPI.dll_SHRegQueryInfoUSKeyA]
mov dword [rsp + 0x50], eax
add ebx, 0xbe
mov edx, 0
cmp ebx, 0x26c
jb 0x18005e570
mov ebx, dword [rsp + 0x68]
jmp case.0x18005e540.257
mov byte [rbp + 0x28], 0x33
jmp case.0x18005e540.257
mov byte [rbp + 0x2b], 0
jmp case.0x18005e540.257
mov eax, 0x645f
mov word [rbp + 0x29], ax
jmp case.0x18005e540.257
mov eax, dword [rbp - 0x64]
lea r9, [rbp + 0x180]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x58]
mov edx, StrCmpNICW
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x58], r13d
call fcn.180009c40
xor edx, edx
mov dword [0x18007bc70], eax
test eax, eax
je case.0x18005e540.257
lea rax, [rbp - 0x80]
mov dword [rbp - 0x80], r13d
mov qword [rsp + 0x38], rax
mov r9d, SHSetInstanceExplorer
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.18000ee30
mov eax, dword [0x18007bc70]
jmp 0x18005edd5
mov bl, 1
mov dword [rsp + 0x68], ebx
jmp case.0x18005e540.257
mov word [rbp + 0x24], 0x6e74
jmp case.0x18005e540.257
mov byte [rbp + 0x29], 0
jmp case.0x18005e540.257
mov byte [rbp + 0x28], 0
jmp case.0x18005e540.257
mov ebx, 0x114
mov eax, ebx
sub eax, 0x113
je 0x18005e1c8
cmp eax, 1
jne 0x18005e6d3
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x38], rax
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x30], rdx
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor ecx, ecx
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.18000ee30
dec ebx
mov edx, 0
cmp ebx, 0x112
ja 0x18005e691
mov ebx, dword [rsp + 0x68]
jmp case.0x18005e540.257
mov dword [rbp - 0x50], edx
jmp case.0x18005e540.257
cmp qword [r12 + 0x10], 0x35
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x58], 0xf003f
jb 0x18005ef43
mov r15d, 0xcb
cmp r15d, 0x7d0a9
ja 0x18005e8e6
je 0x18005e8dd
cmp r15d, 0x39bcf
ja 0x18005e806
je 0x18005e7fb
cmp r15d, 0x1ce4d
ja 0x18005e7a5
je 0x18005e79a
cmp r15d, 0xcb
je 0x18005e77a
cmp r15d, 0x9aa1
je 0x18005e76a
cmp r15d, 0x13477
jne 0x18005ee34
mov byte [rbp + 0x39], 0
jmp 0x18005ee34
mov dword [rbp + 0x34], 0x67305569
mov byte [rbp + 0x38], 0x78
jmp 0x18005ee34
mov r8d, 4
lea rdx, str.n_Tx5c0xiox10
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x34], 0
jmp 0x18005ee18
mov word [rbp + 0x39], 0x31
jmp 0x18005ee34
cmp r15d, 0x26823
je 0x18005e7c4
cmp r15d, 0x301f9
jne 0x18005ee34
mov byte [rbp + 0x41], 0
jmp 0x18005ee34
mov r8d, 2
lea rdx, str.0x_08x_is_at_code_begin_d_in_an_Interpreter_codelet
lea rcx, [rbp + 0x3a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 5
mov byte [rbp + 0x3c], 0
lea rdx, [0x180072b1c]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18005ee18
mov word [rbp + 0x41], 0x55
jmp 0x18005ee34
cmp r15d, 0x60327
ja 0x18005e885
je 0x18005e879
cmp r15d, 0x435a5
je 0x18005e868
cmp r15d, 0x4cf7b
je 0x18005e84b
cmp r15d, 0x56951
jne 0x18005ee34
mov eax, 0x47
mov dword [rbp + 0xbc], 0x410055
mov word [rbp + 0xba], ax
jmp 0x18005ee34
movabs rax, 0x47004e00200043
mov word [rbp + 0xba], dx
mov qword [rbp + 0xb2], rax
jmp 0x18005ee34
mov eax, 0x22
mov word [rbp + 0xb0], ax
jmp 0x18005ee34
mov word [rbp + 0xc0], dx
jmp 0x18005ee34
cmp r15d, 0x69cfd
je 0x18005e8be
cmp r15d, 0x736d3
jne 0x18005ee34
mov word [rbp + 0xc6], dx
lea rcx, [rbp + 0x68]
lea rdx, [0x180072ab4]
mov r8d, 3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18005ee18
mov eax, dword [0x180072c3e]
mov dword [rbp + 0xc0], eax
movzx eax, word [0x180072c42]
mov word [rbp + 0xc4], ax
jmp 0x18005ee34
mov qword [rbp + 0x6e], r11
jmp 0x18005ee34
cmp r15d, 0xc0583
ja 0x18005e9f7
je 0x18005e9b6
cmp r15d, 0xa3801
ja 0x18005e96b
je 0x18005e948
cmp r15d, 0x86a7f
je 0x18005e93f
cmp r15d, 0x90455
je 0x18005e92c
cmp r15d, 0x99e2b
jne 0x18005ee34
mov word [rbp + 0x7e], dx
jmp 0x18005ee34
movabs rax, 0x5300490044005f
mov qword [rbp + 0x76], rax
jmp 0x18005ee34
mov word [rbp + 0x76], dx
jmp 0x18005ee34
mov eax, dword [0x180072b6a]
mov dword [rbp + 0x7e], eax
movzx eax, word [0x180072b6e]
mov word [rbp + 0x82], ax
mov word [rbp + 0x84], dx
jmp 0x18005ee34
cmp r15d, 0xad1d7
je 0x18005e9a7
cmp r15d, 0xb6bad
jne 0x18005ee34
mov eax, dword [0x180072c6e]
mov dword [rbp + 0x88], eax
movzx eax, word [0x180072c72]
mov word [rbp + 0x8c], ax
mov word [rbp + 0x8e], dx
jmp 0x18005ee34
mov dword [rbp + 0x84], 0x5f0045
jmp 0x18005ee34
movsd xmm0, qword [0x180072b9a]
lea rcx, [rbp + 0x68]
movzx eax, word [0x180072ba2]
mov r8d, 4
mov word [rbp + 0x98], dx
lea rdx, [0x180072bc2]
movsd qword [rbp + 0x8e], xmm0
mov word [rbp + 0x96], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18005ee18
cmp r15d, 0xf06b1
ja 0x18005edbc
je 0x18005eda2
cmp r15d, 0xc9f59
je 0x18005ec87
cmp r15d, 0xd392f
je 0x18005eb7e
cmp r15d, 0xe6cdb
jne 0x18005ee34
mov rax, qword [r12 + 0x10]
mov dword [rbp - 0x54], 0x104
mov qword [rbp - 0x10], ILRemoveLastID
mov byte [rbp - 0x28], 0
cmp rax, 0x11
jb 0x18005ef77
add rax, 0xffffffffffffffef
mov esi, 0x24
cmp rax, rsi
cmovb rsi, rax
cmp qword [r12 + 0x18], 0x10
mov rax, r12
jb 0x18005ea72
mov rax, qword [r12]
lea r14, [rax + 0x11]
cmp rsi, 0xf
ja 0x18005ea99
mov r8, rsi
mov qword [rbp - 0x18], rsi
mov rdx, r14
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x28], 0
jmp 0x18005eb24
cmp rsi, r8
ja 0x18005ef71
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x18005eab3
mov rdi, r8
jmp 0x18005eabb
cmp rdi, 0x16
cmovb rdi, r9
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18005eaf4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18005ef6b
mov rcx, rax
call fcn.180069534
test rax, rax
je 0x18005ef64
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18005eb06
test rcx, rcx
je 0x18005eb03
call fcn.180069534
mov rbx, rax
jmp 0x18005eb06
mov rbx, rdx
mov r8, rsi
mov qword [rbp - 0x18], rsi
mov rdx, r14
mov qword [rbp - 0x10], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 0x28], rbx
or dword [rsp + 0x70], 1
lea rcx, [0x18007b0a8]
lea rdx, [rbp - 0x28]
call fcn.1800098b0
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x18005ee18
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005eb74
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005ef64
call fcn.180069570
jmp 0x18005ee18
mov rax, qword [r12 + 0x10]
mov qword [rbp - 0x10], ILRemoveLastID
mov byte [rbp - 0x28], 0
cmp rax, 0xb
jb 0x18005ef77
add rax, 0xfffffffffffffff5
mov esi, 6
cmp rax, rsi
cmovb rsi, rax
cmp qword [r12 + 0x18], 0x10
mov rax, r12
jb 0x18005ebb8
mov rax, qword [r12]
lea r14, [rax + 0xb]
cmp rsi, 0xf
ja 0x18005ebeb
mov r8, rsi
mov qword [rbp - 0x18], rsi
mov rdx, r14
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memmove
or dword [rsp + 0x70], 4
lea rcx, [0x18007b0e8]
mov byte [rbp + rsi - 0x28], 0
jmp 0x18005eb30
cmp rsi, r8
ja 0x18005ef71
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x18005ec05
mov rdi, r8
jmp 0x18005ec0d
cmp rdi, 0x16
cmovb rdi, r9
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18005ec46
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18005ef6b
mov rcx, rax
call fcn.180069534
test rax, rax
je 0x18005ef64
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18005ec58
test rcx, rcx
je 0x18005ec55
call fcn.180069534
mov rbx, rax
jmp 0x18005ec58
mov rbx, rdx
mov r8, rsi
mov qword [rbp - 0x18], rsi
mov rdx, r14
mov qword [rbp - 0x10], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
or dword [rsp + 0x70], 4
lea rcx, [0x18007b0e8]
mov byte [rbx + rsi], 0
mov qword [rbp - 0x28], rbx
jmp 0x18005eb30
mov r8d, 1
lea rdx, str.GVADDSUBPS
lea rcx, [rbp + 0x68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov esi, 0xb
mov qword [rbp - 0x10], ILRemoveLastID
cmp qword [r12 + 0x10], rsi
mov r14, r12
mov byte [rbp - 0x28], 0
cmovb rsi, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 0x10
jb 0x18005ecc9
mov r14, qword [r12]
cmp rsi, 0xf
ja 0x18005ecf8
mov r8, rsi
mov qword [rbp - 0x18], rsi
mov rdx, r14
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memmove
or dword [rsp + 0x70], 2
lea rcx, [0x18007b0c8]
mov byte [rbp + rsi - 0x28], 0
jmp 0x18005eb30
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x18005ef71
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x18005ed1c
mov rdi, rax
jmp 0x18005ed29
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18005ed62
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18005ef6b
mov rcx, rax
call fcn.180069534
test rax, rax
je 0x18005ef64
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18005ed73
test rcx, rcx
je 0x18005ed6e
call fcn.180069534
jmp 0x18005ed70
xor eax, eax
mov rbx, rax
mov r8, rsi
mov qword [rbp - 0x18], rsi
mov rdx, r14
mov qword [rbp - 0x10], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
or dword [rsp + 0x70], 2
lea rcx, [0x18007b0c8]
mov byte [rbx + rsi], 0
mov qword [rbp - 0x28], rbx
jmp 0x18005eb30
lea rdx, [rbp + 0x68]
mov dword [rbp - 0x58], 0x10000000
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x18005ee18
cmp r15d, 0xfa087
je 0x18005edff
cmp r15d, 0x103a5d
jne 0x18005ee34
mov byte [rbp - 0x78], 1
mov eax, dword [rbp - 0x78]
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.180069d20
mov rbx, qword [rsp + 0x450]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, dword [rbp - 0x58]
lea r8, [rbp - 0x54]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x30]
call qword [sym.imp.SHLWAPI.dll_UrlCanonicalizeA]
movabs r11, 0x47004200440058
mov r9d, 0x16
movabs r8, 0x7fffffffffffffff
xor edx, edx
add r15d, 0x99d6
cmp r15d, 0x10d368
jbe 0x18005e711
mov ebx, dword [rsp + 0x68]
lea r15, [0x180000000]
mov edi, dword [rsp + 0x60]
mov r14d, dword [rsp + 0x78]
jmp 0x18005ef45
mov byte [rbp - 0x78], 0
jmp case.0x18005e540.257
mov eax, dword [rbp - 0x50]
lea r9, [rbp - 0x40]
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov edx, esi
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyA]
mov dword [rsp + 0x50], eax
xor edx, edx
jmp case.0x18005e540.257
mov eax, dword [rbp - 0x64]
lea r8, [rbp - 0x60]
mov dword [rsp + 0x58], eax
mov r9d, 0xff
lea rax, [rsp + 0x58]
mov dword [rbp - 0x60], edx
mov qword [rsp + 0x40], rax
mov rcx, r10
lea rax, [rsp + 0x60]
mov dword [rsp + 0x78], edx
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x48]
mov dword [rsp + 0x60], edx
lea rdx, [rbp - 8]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x48], r13d
call fcn.1800558c0
jmp 0x18005e61b
mov eax, 0x7644
mov word [rbp + 0x26], ax
jmp case.0x18005e540.257
movzx edx, byte [rbp + 0x5f]
movzx ecx, byte [rbp + 0x5e]
and dl, 7
movzx eax, cl
shl dl, 3
shr al, 5
and cl, 0x1f
or dl, al
mov byte [rbp + 0xa], cl
mov byte [rbp + 9], dl
xor edx, edx
mov byte [rbp + 0xb], 0
jmp case.0x18005e540.257
mov ecx, edi
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
cmp dword [rsp + 0x50], 0
mov edx, 0
movzx ebx, bl
cmovne ebx, edx
mov dword [rsp + 0x68], ebx
jmp case.0x18005e540.257
mov edi, edx
mov esi, dword [rsp + 0x58]
dec r14d
mov dword [rsp + 0x78], r14d
cmp r14d, dword [rbp - 0x80]
jbe case.0x18005e540.242
mov r10, qword [rbp - 0x70]
jmp 0x18005e502
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180030c70
int3
call fcn.180030db0
int3
call fcn.180030df0
int3