Function at 0x14004b0e0
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp + 0x2f], rax
movzx r13d, dl
mov r12, rcx
mov qword [rbp - 9], rcx
xor esi, esi
mov dword [rbp - 0x45], esi
mov eax, dword [0x1401d7ae8]
test al, 1
jne 0x14004b16b
or eax, 1
mov dword [0x1401d7ae8], eax
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d7af0], rax
lea rcx, [0x140127650]
call fcn.1400d3ef0
nop
mov eax, dword [0x1401d7ae8]
test al, 2
jne 0x14004b1a7
or eax, 2
mov dword [0x1401d7ae8], eax
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d7ae0], rax
lea rcx, [0x140127610]
call fcn.1400d3ef0
nop
mov eax, dword [0x1401d7ae8]
test al, 4
jne 0x14004b1e3
or eax, 4
mov dword [0x1401d7ae8], eax
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d7ad8], rax
lea rcx, [0x1401275d0]
call fcn.1400d3ef0
nop
mov eax, dword [0x1401d7ae8]
test al, 8
jne 0x14004b219
or eax, 8
mov dword [0x1401d7ae8], eax
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d7af8], rax
lea rcx, [0x140127590]
call fcn.1400d3ef0
nop
mov rax, qword [0x1401d7ae0]
mov ecx, dword [rax - 0x10]
mov rax, qword [0x1401d7af8]
mov rdx, qword [0x1401d6eb0]
test ecx, ecx
je 0x14004b280
mov ecx, esi
test rdx, rdx
setne cl
test ecx, ecx
jne 0x14004b24c
mov ecx, 0x80004005
call fcn.140001920
int3
mov rcx, rax
mov r9, rdx
sub r9, rax
movzx r8d, word [rcx]
cmp r8w, word [rcx + r9]
jne 0x14004b26e
add rcx, 2
test r8w, r8w
jne 0x14004b255
mov ecx, esi
jmp 0x14004b273
sbb ecx, ecx
or ecx, 1
test ecx, ecx
setne cl
test cl, cl
je 0x14004c25b
lea rcx, [rdx - 0x18]
lea rbx, [rax - 0x18]
cmp rcx, rbx
je 0x14004b2d4
cmp dword [rbx + 0x10], 0
jl 0x14004b2c4
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004b2c4
call fcn.1400025c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004b2b7
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401d7af8], rax
jmp 0x14004b2d4
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d7af8]
call fcn.140002470
mov rax, qword [0x1401d7af0]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004b332
cmp dword [rdx + 0x10], 0
jge 0x14004b30e
cmp dword [rax - 0xc], 0
jge 0x14004b2ff
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401d7af0]
mov word [rax], si
jmp 0x14004b332
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b31e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d7af0], rax
mov rax, qword [0x1401d7ae0]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004b397
cmp dword [rdx + 0x10], 0
jge 0x14004b373
cmp dword [rax - 0xc], 0
jge 0x14004b35d
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401d7ae0]
mov dword [rax - 0x10], esi
mov rax, qword [0x1401d7ae0]
mov word [rax], si
jmp 0x14004b397
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b383
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d7ae0], rax
mov rax, qword [0x1401d7ad8]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004b3f5
cmp dword [rdx + 0x10], 0
jge 0x14004b3d1
cmp dword [rax - 0xc], 0
jge 0x14004b3c2
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401d7ad8]
mov word [rax], si
jmp 0x14004b3f5
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b3e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d7ad8], rax
mov r15d, esi
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x51], rbx
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x61], rax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x14015dff8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004b7b3
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004b756
mov dword [rbp - 0x69], 0x104
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004b4bd
mov edx, 0x82
lea rcx, [rbp - 0x51]
call fcn.140002560
mov rbx, qword [rbp - 0x51]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [0x14015df48]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004b512
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4464
test eax, eax
js 0x14004b507
cmp eax, dword [rbx - 0xc]
jg 0x14004b507
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
jmp 0x14004b55f
mov ecx, 0x80070057
call fcn.140001920
int3
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004b55f
cmp dword [rdx + 0x10], 0
jge 0x14004b53e
cmp dword [rbx - 0xc], 0
jge 0x14004b536
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x14004b55f
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b54e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x51], rbx
mov dword [rbp - 0x69], 0x104
mov rax, qword [0x1401d7af0]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x82
or ecx, edx
jge 0x14004b59a
mov edx, 0x82
lea rcx, [0x1401d7af0]
call fcn.140002560
mov rax, qword [0x1401d7af0]
lea rcx, [rbp - 0x69]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, str.Local_AppData
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004b605
mov rcx, qword [0x1401d7af0]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d4464
mov rcx, rax
test eax, eax
js 0x14004b5fa
mov rax, qword [0x1401d7af0]
cmp ecx, dword [rax - 0xc]
jg 0x14004b5fa
mov dword [rax - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [0x1401d7af0]
mov word [rax + rcx*2], si
jmp 0x14004b667
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401d7af0]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004b667
cmp dword [rdx + 0x10], 0
jge 0x14004b63f
cmp dword [rax - 0xc], 0
jge 0x14004b630
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401d7af0]
mov word [rax], si
jmp 0x14004b667
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b64f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d7af0], rax
mov rbx, qword [rbp - 0x51]
mov dword [rbp - 0x69], 0x104
mov rax, qword [rbp - 0x61]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004b694
mov edx, 0x82
lea rcx, [rbp - 0x61]
call fcn.140002560
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbp - 0x61]
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004b6ed
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d4464
test eax, eax
js 0x14004b6e2
cmp eax, dword [rdi - 0xc]
jg 0x14004b6e2
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
jmp 0x14004b74a
mov ecx, 0x80070057
call fcn.140001920
int3
mov rdx, qword [0x1401d7af0]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp - 0x61]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004b74a
cmp dword [rdi + 0x10], 0
jl 0x14004b73d
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004b73d
call fcn.1400025c0
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004b72f
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x61], rax
mov rbx, qword [rbp - 0x51]
jmp 0x14004b74a
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x61]
call fcn.140002470
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004b7b3
mov rdx, qword [0x1401d7af0]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp - 0x61]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004b7b3
cmp dword [rdi + 0x10], 0
jl 0x14004b7a6
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004b7a6
call fcn.1400025c0
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004b798
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x61], rax
mov rbx, qword [rbp - 0x51]
jmp 0x14004b7b3
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x61]
call fcn.140002470
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr ax, 8
movzx edx, al
cmp ecx, 6
ja 0x14004b7d7
jne 0x14004ba74
cmp edx, 1
jbe 0x14004ba74
mov sil, 1
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004b91c
mov dword [rbp - 0x69], 0x104
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004b835
mov edx, 0x82
lea rcx, [rbp - 0x51]
call fcn.140002560
mov rbx, qword [rbp - 0x51]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004b8b6
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4464
test eax, eax
js 0x14004b8ab
cmp eax, dword [rbx - 0xc]
jg 0x14004b8ab
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
xor sil, sil
cmp dword [rbx - 0x10], ecx
jl 0x14004b8b6
lea rdx, [0x14015e1f8]
mov rcx, rbx
call fcn.1400d4634
test rax, rax
je 0x14004b8b6
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x14004b8b6
lea r15d, [rax + 1]
jmp 0x14004b8b6
mov ecx, 0x80070057
call fcn.140001920
int3
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [0x1401d5d60]
lea ecx, [rdi + 1]
imul ecx, edi
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 3
jne 0x14004b913
xor eax, eax
mov r8d, eax
lea r10, [rbp - 1]
mov r11d, edi
lea ecx, [rdi + r8]
mov eax, r11d
cdq
idiv ecx
mov dword [r10], edx
inc r8d
dec r11d
lea r10, [r10 + 4]
movsxd rax, r8d
cmp rax, 0xb
jb 0x14004b8f3
test sil, sil
je 0x14004ba7a
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004ba74
mov dword [rbp - 0x69], 0x104
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004b977
mov edx, 0x82
lea rcx, [rbp - 0x51]
call fcn.140002560
mov rbx, qword [rbp - 0x51]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, str.DefaultValue
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [0x1401d5d60]
lea ecx, [rdx + 2]
lea eax, [rdx + 1]
imul ecx, eax
imul ecx, edx
and ecx, 0x80000007
jge 0x14004b9be
dec ecx
or ecx, 0xfffffff8
inc ecx
cmp ecx, 3
jne 0x14004b9cb
dec edx
mov dword [0x1401d5d60], edx
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4464
test eax, eax
js 0x14004ba69
cmp eax, dword [rbx - 0xc]
jg 0x14004ba69
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1401d5d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 1
jne 0x14004ba43
mov eax, ecx
mov edx, 0xb5
mov r8d, ecx
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
dec edx
jns 0x14004ba30
mov dword [0x1401d5d60], ecx
cmp dword [rbx - 0x10], 0
jl 0x14004ba7a
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400d4634
test rax, rax
je 0x14004ba7a
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x14004ba7a
jmp 0x14004ba74
mov ecx, 0x80070057
call fcn.140001920
int3
mov r15d, 1
cmp qword [0x1401d0d48], 0xffffffff80000002
jne 0x14004bb49
mov rdx, qword [0x1401d6eb0]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401d7ae0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004baec
cmp dword [rbx + 0x10], 0
jl 0x14004badc
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004badc
call fcn.1400025c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004bacf
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [0x1401d7ae0], rax
jmp 0x14004baec
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d7ae0]
call fcn.140002470
mov rcx, qword [rbp - 0x61]
add rcx, 0xffffffffffffffe8
mov rbx, qword [0x1401d7af0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004bea0
cmp dword [rbx + 0x10], 0
jl 0x14004bcb5
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004bcb5
call fcn.1400025c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004bb39
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [0x1401d7af0], rax
jmp 0x14004bea0
test r15d, r15d
je 0x14004bcd1
call fcn.14004ad90
test al, al
je 0x14004ba8b
cmp byte [0x1401d5e84], 0
jne 0x14004ba8b
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x39], rbx
lea r15, [0x14015e248]
test r15, 0xffffffffffff0000
jne 0x14004bbbe
movzx edi, r15w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004bc2d
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.140002760
mov rbx, qword [rbp - 0x39]
jmp 0x14004bc2d
mov esi, dword [rbx - 0x10]
mov rdi, r15
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 9
or eax, ecx
jge 0x14004bbee
mov edx, 9
lea rcx, [rbp - 0x39]
call fcn.140002560
mov rbx, qword [rbp - 0x39]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x12
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004bc0e
lea r8, [rbx + rdi*2]
call fcn.1400d400c
jmp 0x14004bc16
mov r8, r15
call fcn.1400d41cc
cmp dword [rbx - 0xc], 9
jl 0x14004bcaa
mov dword [rbx - 0x10], 9
xor eax, eax
mov word [rbx + 0x12], ax
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401d7ae0]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004bc8e
cmp dword [rsi + 0x10], 0
jl 0x14004bc7a
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004bc7a
mov rcx, rdi
call fcn.1400025c0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14004bc6d
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [0x1401d7ae0], rax
jmp 0x14004bc8e
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401d7ae0]
call fcn.140002470
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004baec
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004baec
mov ecx, 0x80070057
call fcn.140001920
nop
mov rdi, qword [rbp - 0x61]
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [0x1401d7af0]
call fcn.140002470
jmp 0x14004bea0
call fcn.14004ae40
test al, al
jne 0x14004bcf3
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x1401d7af0]
call fcn.1400109d0
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x31], rbx
lea r15, [0x14015e260]
test r15, 0xffffffffffff0000
jne 0x14004bd45
movzx edi, r15w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004bdbb
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.140002760
mov rbx, qword [rbp - 0x31]
jmp 0x14004bdbb
mov esi, dword [rbx - 0x10]
mov rdi, r15
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7a
or eax, ecx
jge 0x14004bd75
mov edx, 0x7a
lea rcx, [rbp - 0x31]
call fcn.140002560
mov rbx, qword [rbp - 0x31]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xf4
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004bd95
lea r8, [rbx + rdi*2]
call fcn.1400d400c
jmp 0x14004bd9d
mov r8, r15
call fcn.1400d41cc
cmp dword [rbx - 0xc], 0x7a
jl 0x14004c29f
mov dword [rbx - 0x10], 0x7a
xor r15d, r15d
mov word [rbx + 0xf4], r15w
jmp 0x14004bdbe
xor r15d, r15d
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401d7ae0]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004be1f
cmp dword [rsi + 0x10], 0
jl 0x14004be0b
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004be0b
mov rcx, rdi
call fcn.1400025c0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14004bdfe
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [0x1401d7ae0], rax
jmp 0x14004be1f
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401d7ae0]
call fcn.140002470
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004be33
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov edx, dword [0x1401d5d60]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 0xd
jne 0x14004bea0
lea ecx, [r8 + 0x1b]
call fcn.1400d2e28
mov rdi, rax
mov rbx, r15
call fcn.1400d41a0
add eax, dword [0x1401d5d60]
mov dword [rdi + rbx*4], eax
inc rbx
cmp rbx, 0xa
jl 0x14004be78
mov ecx, dword [rdi + 0x24]
mov dword [0x1401d5d60], ecx
mov rcx, rdi
call fcn.1400d3f08
mov rcx, qword [0x1401d7ae0]
cmp dword [rcx - 0x10], 0
jl 0x14004bf3e
lea rdx, str.windows_ie_ac_001
call fcn.1400d4634
test rax, rax
je 0x14004bf3e
sub rax, qword [0x1401d7ae0]
sar rax, 1
test eax, eax
jle 0x14004bf3e
mov rdx, qword [0x1401d6eb0]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401d7ad8]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004c181
cmp dword [rbx + 0x10], 0
jl 0x14004bf29
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004bf29
call fcn.1400025c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004bf19
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401d7ad8], rax
jmp 0x14004c181
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d7ad8]
call fcn.140002470
jmp 0x14004c181
call fcn.14004ad90
test al, al
je 0x14004c048
cmp byte [0x1401d5e84], 0
jne 0x14004c048
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x41], rbx
lea r15, [0x14015e378]
test r15, 0xffffffffffff0000
jne 0x14004bfaa
movzx edi, r15w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004c015
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.140002760
mov rbx, qword [rbp - 0x41]
jmp 0x14004c015
mov esi, dword [rbx - 0x10]
mov rdi, r15
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 9
or eax, ecx
jge 0x14004bfda
mov edx, 9
lea rcx, [rbp - 0x41]
call fcn.140002560
mov rbx, qword [rbp - 0x41]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x12
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004bffa
lea r8, [rbx + rdi*2]
call fcn.1400d400c
jmp 0x14004c002
mov r8, r15
call fcn.1400d41cc
cmp dword [rbx - 0xc], 9
jl 0x14004c03d
mov dword [rbx - 0x10], 9
xor eax, eax
mov word [rbx + 0x12], ax
lea rdx, [rbp - 0x41]
lea rcx, [0x1401d7ad8]
call fcn.1400023d0
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004c181
mov rcx, qword [rdx]
jmp 0x14004c17b
mov ecx, 0x80070057
call fcn.140001920
nop
lea rcx, str.__r_
mov rax, qword [str.__r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x29], rbx
lea r15, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
test r15, 0xffffffffffff0000
jne 0x14004c09a
movzx edi, r15w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004c10c
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.140002760
mov rbx, qword [rbp - 0x29]
jmp 0x14004c10c
mov esi, dword [rbx - 0x10]
mov rdi, r15
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7a
or eax, ecx
jge 0x14004c0ca
mov edx, 0x7a
lea rcx, [rbp - 0x29]
call fcn.140002560
mov rbx, qword [rbp - 0x29]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xf4
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004c0ea
lea r8, [rbx + rdi*2]
call fcn.1400d400c
jmp 0x14004c0f2
mov r8, r15
call fcn.1400d41cc
cmp dword [rbx - 0xc], 0x7a
jl 0x14004c294
mov dword [rbx - 0x10], 0x7a
xor eax, eax
mov word [rbx + 0xf4], ax
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401d7ad8]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004c16e
cmp dword [rsi + 0x10], 0
jl 0x14004c15a
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004c15a
mov rcx, rdi
call fcn.1400025c0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14004c14d
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401d7ad8], rax
jmp 0x14004c16e
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401d7ad8]
call fcn.140002470
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004c181
mov rcx, qword [rdi]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x1401d0d48], 0xffffffff80000002
je 0x14004c203
cmp byte [0x1401d0c12], 0
je 0x14004c203
lea rcx, [rbp - 0x19]
call fcn.14004ac20
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d7ae0]
call fcn.1400109d0
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004c1cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x21]
call fcn.14004ac20
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d7ad8]
call fcn.1400109d0
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004c203
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x1401d0d48]
lea rcx, [0x1401d7ae0]
call fcn.14004c2f0
mov rdx, qword [0x1401d0d48]
lea rcx, [0x1401d7ad8]
call fcn.14004c2f0
nop
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004c243
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004c25b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r13b, r13b
je 0x14004c27a
mov rcx, qword [0x1401d7ad8]
add rcx, 0xffffffffffffffe8
call fcn.1400025c0
add rax, 0x18
mov qword [r12], rax
jmp 0x14004c2aa
mov rcx, qword [0x1401d7ae0]
add rcx, 0xffffffffffffffe8
call fcn.1400025c0
add rax, 0x18
mov qword [r12], rax
jmp 0x14004c2aa
mov ecx, 0x80070057
call fcn.140001920
nop
mov ecx, 0x80070057
call fcn.140001920
nop
mov dword [rbp - 0x45], 1
mov rax, r12
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400d37e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret