Function at 0x14007f2d0
Capabilities:
Get session user name
Impersonate user
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x200
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rsi, r8
mov r12, rdx
mov r15d, 0x80004005
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
xor r13d, r13d
or r14, 0xffffffffffffffff
test r12, r12
je 0x14007f377
test r12, 0xffffffffffff0000
jne 0x14007f364
movzx edi, r12w
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x14007f38f
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140001f70
jmp 0x14007f38a
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14007f37a
mov ecx, r13d
mov r8d, ecx
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.140001e80
mov rbx, qword [rsp + 0x68]
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x78], rdi
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
cmp dword [rbx - 0x10], 0
jle 0x1400809f4
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcschr]
mov r14, rax
test rax, rax
je 0x1400809f0
sub r14, rbx
sar r14, 1
cmp r14d, 0xffffffff
je 0x1400809f0
mov r8d, r14d
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.140001d30
nop
mov r8, qword [rax]
mov qword [rbp - 0x70], r8
lea rcx, [r8 - 0x18]
lea r12, [rdi - 0x18]
cmp rcx, r12
je 0x14007f588
cmp dword [r12 + 0x10], 0
jl 0x14007f463
mov rax, qword [r12]
cmp qword [rcx], rax
jne 0x14007f463
call fcn.140001b90
mov rdi, rax
or ecx, 0xffffffff
lock xadd dword [r12 + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14007f456
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x78], rax
jmp 0x14007f588
movsxd r13, dword [r8 - 0x10]
test r13d, r13d
jne 0x14007f4d9
mov r13, qword [r12]
cmp dword [r12 + 8], 0
je 0x14007f585
cmp dword [r12 + 0x10], 0
jge 0x14007f4a5
cmp dword [rdi - 0xc], 0
jge 0x14007f495
mov ecx, 0x80070057
call fcn.140001000
int3
xor r13d, r13d
mov dword [rdi - 0x10], r13d
mov word [rdi], r13w
jmp 0x14007f588
or eax, 0xffffffff
lock xadd dword [r12 + 0x10], eax
dec eax
test eax, eax
jg 0x14007f4c2
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 8]
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
jmp 0x14007f585
test r8, r8
jne 0x14007f4e9
mov ecx, 0x80070057
call fcn.140001000
int3
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x60], eax
mov r15, r8
sub r15, rdi
sar r15, 1
test r13d, r13d
jns 0x14007f509
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [r12 + 0x10]
mov eax, dword [r12 + 0xc]
sub eax, r13d
or eax, ecx
jge 0x14007f533
mov edx, r13d
lea rcx, [rbp - 0x78]
call fcn.140001c20
mov rdi, qword [rbp - 0x78]
mov r8, qword [rbp - 0x70]
mov eax, dword [rsp + 0x60]
lea r12, [r13 + r13]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
mov r9, r12
add rdx, rdx
cmp r15, rax
ja 0x14007f55a
lea r8, [rdi + r15*2]
call qword [sym.imp.MSVCR100.dll_memmove_s]
jmp 0x14007f560
call qword [sym.imp.MSVCR100.dll_memcpy_s]
cmp r13d, dword [rdi - 0xc]
jg 0x14007f57a
mov dword [rdi - 0x10], r13d
xor r13d, r13d
mov word [r12 + rdi], r13w
mov r15d, 0x80004005
jmp 0x14007f588
mov ecx, 0x80070057
call fcn.140001000
int3
xor r13d, r13d
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007f5a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r8d, dword [rbx - 0x10]
sub r8d, r14d
dec r8d
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.140001c80
nop
mov r14, qword [rax]
lea rcx, [r14 - 0x18]
mov rdi, qword [rsp + 0x70]
lea rbx, [rdi - 0x18]
cmp rcx, rbx
je 0x14007f730
cmp dword [rbx + 0x10], 0
jl 0x14007f61e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007f61e
call fcn.140001b90
mov rdi, rax
or r14, 0xffffffffffffffff
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14007f610
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14007f734
movsxd r12, dword [r14 - 0x10]
test r12d, r12d
jne 0x14007f68e
mov r12, qword [rbx]
cmp dword [rbx + 8], 0
je 0x14007f730
cmp dword [rbx + 0x10], 0
jge 0x14007f658
cmp dword [rdi - 0xc], 0
jge 0x14007f64b
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rdi - 0x10], r13d
mov word [rdi], r13w
jmp 0x14007f730
or r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x14007f676
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
jmp 0x14007f734
test r14, r14
jne 0x14007f69e
mov ecx, 0x80070057
call fcn.140001000
int3
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x78], eax
mov r13, r14
sub r13, rdi
sar r13, 1
test r12d, r12d
jns 0x14007f6be
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, r12d
or eax, ecx
jge 0x14007f6e2
mov edx, r12d
lea rcx, [rsp + 0x70]
call fcn.140001c20
mov rdi, qword [rsp + 0x70]
mov eax, dword [rsp + 0x78]
lea rbx, [r12 + r12]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
mov r9, rbx
add rdx, rdx
cmp r13, rax
ja 0x14007f708
lea r8, [rdi + r13*2]
call qword [sym.imp.MSVCR100.dll_memmove_s]
jmp 0x14007f711
mov r8, r14
call qword [sym.imp.MSVCR100.dll_memcpy_s]
cmp r12d, dword [rdi - 0xc]
jg 0x14007f725
mov dword [rdi - 0x10], r12d
xor r13d, r13d
mov word [rbx + rdi], r13w
jmp 0x14007f730
mov ecx, 0x80070057
call fcn.140001000
int3
or r14, 0xffffffffffffffff
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007f756
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rdx, str.HKEY_CLASSES_ROOT
mov rdi, qword [rbp - 0x78]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14007f77f
mov rbx, 0xffffffff80000000
jmp 0x14007f7d8
lea rdx, str.HKEY_CURRENT_USER
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14007f79c
mov rbx, 0xffffffff80000001
jmp 0x14007f7d8
lea rdx, str.HKEY_LOCAL_MACHINE
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14007f7b9
mov rbx, 0xffffffff80000002
jmp 0x14007f7d8
lea rdx, str.HKEY_USERS
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x1400809e1
mov rbx, 0xffffffff80000003
mov qword [rsp + 0x78], r13
lea rdi, [rbp + 0xc0]
xor eax, eax
mov ecx, reloc.ATL100.DLL_Ordinal_56
rep stosb byte [rdi], al
mov qword [rsp + 0x58], r13
cmp rbx, 0xffffffff80000001
jne 0x14007f913
mov qword [rbp - 0x70], rbx
mov dword [rbp - 0x80], r13d
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, dword [rbp - 0x80]
test eax, eax
jne 0x14007f822
test ecx, ecx
je 0x140080a11
mov eax, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400ca8e8
mov r12, rax
mov qword [rsp + 0x78], rax
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x14007f85c
mov rcx, r12
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
jmp 0x140080a11
mov dword [rbp + 0xc0], reloc.ATL100.DLL_Ordinal_56
mov qword [rbp + 0xc8], r12
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x58]
call sub.WTSAPI32.dll_WTSQueryUserToken
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x14007f896
mov rcx, r12
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
jmp 0x140080a11
lea rdx, [rbp + 0xc0]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x14007f8cc
mov rcx, r12
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov r12, r13
mov qword [rsp + 0x78], r13
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
mov qword [rsp + 0x58], rcx
jmp 0x14007f8d1
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x14007f901
mov rcx, r12
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rsp + 0x78], r13
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], r13
jmp 0x14007f913
test r12, r12
je 0x14007f913
mov rcx, r12
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rsp + 0x78], r13
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008097d
lea r8d, [rax + 6]
lea rdx, [0x1400e8ad8]
mov r12, qword [rbp + 0x150]
mov rcx, r12
call fcn.140001e80
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x400
mov r15d, r13d
mov edx, 0x400
nop dword [rax]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, edx
or eax, ecx
jge 0x14007f9c0
lea rcx, [rsp + 0x40]
call fcn.140001c20
mov rdi, qword [rsp + 0x40]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x50]
mov r8, rdi
mov edx, r15d
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x14007fdd0
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x14007fdc5
cmp eax, dword [rdi - 0xc]
jg 0x14007fdc5
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r13w
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rbp + 0xa8]
call fcn.140008ad0
nop
lea r8, [0x1400e8ad4]
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.140002ce0
nop
mov rdx, qword [rax]
lea rbx, [rdx - 0x18]
mov r12, qword [r12]
sub r12, 0x18
cmp rbx, r12
je 0x14007fb14
cmp dword [r12 + 0x10], 0
jl 0x14007fb03
mov rcx, qword [rbx]
cmp rcx, qword [r12]
jne 0x14007fb03
mov rax, qword [rcx]
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x14007fa96
cmp rax, qword [rbx]
jne 0x14007fa96
mov r13, rbx
lock inc dword [rbx + 0x10]
jmp 0x14007fad3
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx + 8]
call qword [rax]
mov r13, rax
test rax, rax
je 0x14007fd8c
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 8]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
lea r8, [rbx + 0x18]
add rdx, rdx
lea rcx, [rax + 0x18]
call qword [sym.imp.MSVCR100.dll_memcpy_s]
mov eax, r14d
lock xadd dword [r12 + 0x10], eax
dec eax
test eax, eax
jg 0x14007faf0
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 8]
lea rax, [r13 + 0x18]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
xor r13d, r13d
jmp 0x14007fb14
mov r8d, dword [rdx - 0x10]
mov rcx, qword [rbp + 0x150]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007fb37
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007fb59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dword [rsp + 0x50], 0x400
inc r15d
cmp dword [rdi - 0x10], 0
je 0x14007fd70
mov rcx, qword [rsi + 8]
lea rax, [rsp + 0x40]
cmp rax, rcx
jae 0x14007fc87
mov rax, qword [rsi]
lea rdx, [rsp + 0x40]
cmp rax, rdx
ja 0x14007fc87
lea rdi, [rsp + 0x40]
sub rdi, rax
sar rdi, 3
mov rdx, qword [rsi + 0x10]
cmp rcx, rdx
jne 0x14007fbfe
sub rcx, rax
sar rcx, 3
movabs r8, 0x1ffffffffffffffe
cmp rcx, r8
ja 0x14007fd92
inc rcx
sub rdx, rax
sar rdx, 3
cmp rcx, rdx
jbe 0x14007fbfe
mov r8, rdx
shr r8, 1
movabs rax, 0x1fffffffffffffff
sub rax, r8
cmp rax, rdx
jae 0x14007fbec
mov rdx, r13
jmp 0x14007fbef
add rdx, r8
cmp rdx, rcx
cmovb rdx, rcx
mov rcx, rsi
call fcn.14000dcf0
mov rax, qword [rsi]
mov r12, qword [rsi + 8]
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x60], r12
test r12, r12
je 0x14007fc7d
mov rdi, qword [rax + rdi*8]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x14007fc39
cmp rax, qword [rdi - 0x18]
jne 0x14007fc39
lea rbx, [rdi - 0x18]
lock inc dword [rdi - 8]
jmp 0x14007fc75
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x14007fda0
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rax + 0x18]
call qword [sym.imp.MSVCR100.dll_memcpy_s]
lea rax, [rbx + 0x18]
mov qword [r12], rax
add qword [rsi + 8], 8
jmp 0x14007fd70
mov rdx, qword [rsi + 0x10]
cmp rcx, rdx
jne 0x14007fceb
mov rax, qword [rsi]
sub rcx, rax
sar rcx, 3
movabs rdi, 0x1ffffffffffffffe
cmp rcx, rdi
ja 0x14007fda6
inc rcx
sub rdx, rax
sar rdx, 3
cmp rcx, rdx
jbe 0x14007fceb
mov rdi, rdx
shr rdi, 1
movabs rax, 0x1fffffffffffffff
sub rax, rdi
cmp rax, rdx
jae 0x14007fcd9
mov rdx, r13
jmp 0x14007fcdc
add rdx, rdi
cmp rdx, rcx
cmovb rdx, rcx
mov rcx, rsi
call fcn.14000dcf0
mov r12, qword [rsi + 8]
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov rdi, qword [rsp + 0x40]
test r12, r12
je 0x14007fd69
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x14007fd29
cmp rax, qword [rdi - 0x18]
jne 0x14007fd29
lea r13, [rdi - 0x18]
lock inc dword [rdi - 8]
mov rdi, qword [rsp + 0x40]
jmp 0x14007fd61
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov r13, rax
test rax, rax
je 0x14007fdb4
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rax + 0x18]
call qword [sym.imp.MSVCR100.dll_memcpy_s]
lea rax, [r13 + 0x18]
mov qword [r12], rax
add qword [rsi + 8], 8
jmp 0x14007fd75
mov rdi, qword [rsp + 0x40]
mov edx, dword [rsp + 0x50]
test edx, edx
js 0x14007fdba
mov r12, qword [rbp + 0x150]
xor r13d, r13d
jmp 0x14007f9a0
call fcn.140001920
nop
lea rcx, str.vector_T__too_long
call qword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop
call fcn.140001920
nop
lea rcx, str.vector_T__too_long
call qword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop
call fcn.140001920
nop
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
lea r8, str._nVALUES:_n
mov rdx, r12
lea rcx, [rbp - 0x38]
call fcn.140002ce0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [r12]
sub rdi, 0x18
cmp rcx, rdi
je 0x14007fe3f
cmp dword [rdi + 0x10], 0
jl 0x14007fe32
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14007fe32
call fcn.140001b90
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14007fe28
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [r12], rax
jmp 0x14007fe3f
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.140001e80
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007fe5e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dword [rsp + 0x50], 0x400
mov dword [rsp + 0x60], 3
nop
mov edx, dword [rsp + 0x50]
test edx, edx
js 0x140080972
mov rax, qword [rsp + 0x40]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or ecx, eax
jge 0x14007fe9c
lea rcx, [rsp + 0x40]
call fcn.140001c20
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov r8, rbx
mov edx, r13d
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r15d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x140080967
cmp eax, dword [rbx - 0xc]
jg 0x140080967
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
mov rdi, qword [rsp + 0x48]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x14008095c
cmp eax, dword [rdi - 0xc]
jg 0x14008095c
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
mov eax, dword [rsp + 0x60]
cmp eax, 0xb
ja case.0x14007ff45.6
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x80a98]
add rcx, rdx
jmp rcx
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rbp + 0x88]
call fcn.140008ad0
nop
lea r8, str._BINARY_
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140002ce0
nop
lea r8, [0x1400e8ad4]
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140002ce0
nop
mov rdx, rax
mov rcx, r12
call fcn.140002250
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007ffb0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007ffd0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007fff2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, str._BINARY_
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x18]
call fcn.140002ce0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140080069
cmp dword [rdi + 0x10], 0
jl 0x14008005a
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14008005a
call fcn.140001b90
mov rsi, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14008004d
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x48], rax
xor esi, esi
jmp 0x140080069
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001e80
nop
mov rdx, qword [rbp - 0x18]
jmp 0x14008075d
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rbp + 0x90]
call fcn.140008ad0
nop
lea r8, str._DWORD_
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.140002ce0
nop
lea r8, [0x1400e8ad4]
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.140002ce0
nop
mov rdx, rax
mov rcx, r12
call fcn.140002250
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400800db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400800fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008011d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, str._DWORD_
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.140002ce0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140080194
cmp dword [rdi + 0x10], 0
jl 0x140080185
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140080185
call fcn.140001b90
mov rsi, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140080178
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x48], rax
xor esi, esi
jmp 0x140080194
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001e80
nop
mov rdx, qword [rbp - 0x50]
jmp 0x14008075d
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rbp + 0xa0]
call fcn.140008ad0
nop
lea r8, str._QWORD_
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140002ce0
nop
lea r8, [0x1400e8ad4]
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140002ce0
nop
mov rdx, rax
mov rcx, r12
call fcn.140002250
nop
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140080206
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140080226
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140080248
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, str._QWORD_
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.140002ce0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400802bf
cmp dword [rdi + 0x10], 0
jl 0x1400802b0
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400802b0
call fcn.140001b90
mov rsi, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400802a3
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x48], rax
xor esi, esi
jmp 0x1400802bf
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x28]
jmp 0x14008075d
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rbp - 0x48]
call fcn.140008ad0
nop
lea r8, str._STRING_
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140002ce0
nop
lea r8, [0x1400e8ad4]
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.140002ce0
nop
mov rdx, rax
mov rcx, r12
call fcn.140002250
nop
mov rdx, qword [rbp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008032e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008034e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008036d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, str._STRING_
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.140002ce0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400803e4
cmp dword [rdi + 0x10], 0
jl 0x1400803d5
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400803d5
call fcn.140001b90
mov rsi, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400803c8
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x48], rax
xor esi, esi
jmp 0x1400803e4
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001e80
nop
mov rdx, qword [rbp - 0x40]
jmp 0x14008075d
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rbp - 0x10]
call fcn.140008ad0
nop
lea r8, str._EXPAND_STRING_
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140002ce0
nop
lea r8, [0x1400e8ad4]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140002ce0
nop
mov rdx, rax
mov rcx, r12
call fcn.140002250
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140080453
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140080473
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140080492
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, str._EXPAND_STRING_
lea rdx, [rsp + 0x40]
lea rcx, [rbp]
call fcn.140002ce0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140080509
cmp dword [rdi + 0x10], 0
jl 0x1400804fa
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400804fa
call fcn.140001b90
mov rsi, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400804ed
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x48], rax
xor esi, esi
jmp 0x140080509
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001e80
nop
mov rdx, qword [rbp]
jmp 0x14008075d
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rbp + 0x30]
call fcn.140008ad0
nop
lea r8, str._MULTI_STRING_
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140002ce0
nop
lea r8, [0x1400e8ad4]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140002ce0
nop
mov rdx, rax
mov rcx, r12
call fcn.140002250
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140080578
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140080598
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400805b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, str._MULTI_STRING_
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.140002ce0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14008062e
cmp dword [rdi + 0x10], 0
jl 0x14008061f
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14008061f
call fcn.140001b90
mov rsi, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140080612
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x48], rax
xor esi, esi
jmp 0x14008062e
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x40]
jmp 0x14008075d
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rbp + 0x70]
call fcn.140008ad0
nop
lea r8, str._No_defined_
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140002ce0
nop
lea r8, [0x1400e8ad4]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.140002ce0
nop
mov rdx, rax
mov rcx, r12
call fcn.140002250
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008069d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400806bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400806dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, str._No_defined_
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.140002ce0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140080756
cmp dword [rdi + 0x10], 0
jl 0x140080747
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140080747
call fcn.140001b90
mov rsi, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14008073a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x48], rax
xor esi, esi
jmp 0x140080756
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg case.0x14007ff45.6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dword [rsp + 0x50], 0x400
inc r13d
cmp dword [rbx - 0x10], 0
je 0x1400808f1
mov r12, qword [rbp + 0x148]
mov rcx, qword [r12 + 8]
lea rax, [rsp + 0x40]
cmp rax, rcx
jae 0x1400808a9
mov rax, qword [r12]
lea rdx, [rsp + 0x40]
cmp rax, rdx
ja 0x1400808a9
lea rbx, [rsp + 0x40]
sub rbx, rax
sar rbx, 3
mov rdx, qword [r12 + 0x10]
cmp rcx, rdx
jne 0x140080827
sub rcx, rax
sar rcx, 3
movabs rdi, 0x1ffffffffffffffe
cmp rcx, rdi
ja 0x1400808ff
inc rcx
sub rdx, rax
sar rdx, 3
cmp rcx, rdx
jbe 0x140080827
mov rdi, rdx
shr rdi, 1
movabs rax, 0x1fffffffffffffff
sub rax, rdi
cmp rax, rdx
jae 0x140080815
mov rdx, rsi
jmp 0x140080818
add rdx, rdi
cmp rdx, rcx
cmovb rdx, rcx
mov rcx, r12
call fcn.14000dcf0
mov rdi, qword [r12]
mov rsi, qword [r12 + 8]
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
test rsi, rsi
je 0x1400808a7
mov rdi, qword [rdi + rbx*8]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140080864
cmp rax, qword [rdi - 0x18]
jne 0x140080864
lea rbx, [rdi - 0x18]
lock inc dword [rdi - 8]
jmp 0x1400808a0
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x14008090d
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rax + 0x18]
call qword [sym.imp.MSVCR100.dll_memcpy_s]
lea rax, [rbx + 0x18]
mov qword [rsi], rax
jmp 0x1400808e4
cmp rcx, qword [r12 + 0x10]
jne 0x1400808bd
mov edx, 1
mov rcx, r12
call fcn.14000de60
mov rdi, qword [r12 + 8]
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x1400808e4
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
call fcn.140001b90
add rax, 0x18
mov qword [rdi], rax
add qword [r12 + 8], 8
mov r12, qword [rbp + 0x150]
cmp r15d, 0x103
je 0x140080913
jmp 0x14007fe70
lea rcx, str.vector_T__too_long
call qword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop
call fcn.140001920
nop
xor r13d, r13d
mov r15d, r13d
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008093a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008097d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14008097d
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14008098c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp - 0x70], 0xffffffff80000001
jne 0x140080a11
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400809a8
mov rcx, rax
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rdx, qword [rbp + 0xf0]
test rdx, rdx
je 0x1400809c4
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400809d9
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400809d9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], r13
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x140080a11
mov r8d, Ordinal_17
lea rdx, str.Invalid_Path
jmp 0x140080a04
or r14, 0xffffffffffffffff
mov r15d, 0x20000015
xor r8d, r8d
lea rdx, [0x1400de328]
mov rcx, qword [rbp + 0x150]
call fcn.140001e80
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140080a32
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140080a52
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x140080a72
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, r15d
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret