Function at 0x140003ee0
Capabilities:
Query environment variable
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x558
movabs r13, 0x8000000000000000
lea rdx, [0x14018cc88]
lea rcx, [rsp + 0x60]
mov r8d, 7
call section..text
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x158]
call fcn.1400080f0
mov rax, qword [rsp + 0x158]
cmp rax, r13
jne 0x140003fa3
mov rax, qword [rsp + 0x160]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x140003f9b
test rcx, rcx
je 0x140003f9b
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x140003f89
cmp qword [rbx + 0x10], 0x11
jb 0x140003f77
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, r13
jmp 0x1400045af
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 2
mov qword [rsp + 0xd8], 0
mov r12d, 0x200
mov eax, 2
mov qword [rsp + 0x90], rax
xor edi, edi
xor r15d, r15d
xor r13d, r13d
cmp r12, 0x201
jb 0x14000401f
jmp 0x140004040
jae 0x140004116
cmp r12, 0x201
jae 0x140004040
mov ebx, 0x200
lea r14, [rsp + 0x158]
mov rsi, r12
jmp 0x14000407a
sub r12, r13
sub r15, r13
cmp r15, r12
jb 0x1400040e6
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rsp + 0xd8], r13
mov r15, rdi
mov rbx, r13
mov r14, qword [rsp + 0x90]
mov rsi, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rsp + 0x58]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov ebp, eax
test eax, eax
jne 0x1400040a7
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140004167
mov r12d, ebp
cmp rsi, r12
jne 0x140004010
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000615c
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov r12, rsi
cmp r12, 0x201
jb 0x14000401f
jmp 0x140004040
lea rcx, [rsp + 0xc8]
mov rdx, r13
mov r8, r12
call fcn.140009df0
mov rdi, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x90], rax
jmp 0x14000404f
cmp rbx, r12
jb 0x14000615c
test ebp, ebp
je 0x140004193
movzx eax, byte [0x140190110]
mov rcx, qword [0x1401900f0]
test rcx, rcx
jne 0x14000414f
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14000615c
mov rcx, rax
mov qword [0x1401900f0], rax
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r13, rax
test rax, rax
jne 0x140004199
jmp 0x14000615c
call qword [sym.imp.kernel32.dll_GetLastError]
mov r14d, eax
shl r14, 0x20
or r14, 2
movabs r13, 0x8000000000000000
mov rsi, r13
test rdi, rdi
jne 0x1400044d6
jmp 0x1400044ed
mov r13d, 1
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xa8], 0
mov byte [rsp + 0xb0], 1
lea rbp, [r14 + r12*2]
xor ebx, ebx
lea rdi, [rsp + 0x98]
lea r12, [rsp + 0x40]
xor esi, esi
test si, si
je 0x140004200
nop word [rax + rax]
mov eax, r15d
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
jne 0x140004300
jmp 0x140004225
cmp r14, rbp
je 0x140004483
movzx eax, word [r14]
add r14, 2
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
jne 0x140004300
movzx ecx, ax
cmp ecx, 0xdbff
ja 0x140004261
cmp r14, rbp
je 0x140004265
movzx edx, word [r14]
add r14, 2
mov r8d, edx
add r8d, 0x2000
movzx r8d, r8w
cmp r8d, 0xfc00
jae 0x140004310
mov si, 1
mov r15d, edx
jmp 0x14000426a
xor esi, esi
jmp 0x14000426a
xor esi, esi
mov r14, rbp
mov byte [rsp + 0xb0], 0
mov dword [rsp + 0x40], 0
mov edx, ecx
shr edx, 0xc
or dl, 0xe0
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x41], cl
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x42], al
mov byte [rsp + 0x40], dl
mov rax, qword [rsp + 0x98]
sub rax, rbx
cmp rax, 2
jbe 0x1400042e3
mov r13, qword [rsp + 0xa0]
movzx eax, byte [rsp + 0x42]
mov byte [r13 + rbx + 2], al
movzx eax, word [rsp + 0x40]
mov word [r13 + rbx], ax
add rbx, 3
mov qword [rsp + 0xa8], rbx
test si, si
jne 0x1400041e0
jmp 0x140004200
mov r8d, 3
mov rcx, rdi
mov rdx, rbx
call fcn.140009f40
mov rbx, qword [rsp + 0xa8]
jmp 0x1400042ac
movzx ecx, ax
shl rcx, 0x10
jmp 0x140004336
movzx ecx, dx
and eax, 0x3ff
and ecx, 0x3ff
shl rax, 0x1a
shl rcx, 0x10
or rcx, rax
movabs rax, 0x100000000
add rcx, rax
mov rax, rcx
shr rax, 0x10
mov dword [rsp + 0x40], 0
cmp eax, 0x80
jae 0x140004370
mov byte [rsp + 0x40], al
mov esi, 1
mov rax, qword [rsp + 0x98]
sub rax, rbx
cmp rax, rsi
jae 0x1400043f0
jmp 0x140004460
cmp eax, 0x800
jae 0x1400043b0
shr ecx, 0x16
or cl, 0xc0
mov byte [rsp + 0x40], cl
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x41], al
mov esi, 2
mov rax, qword [rsp + 0x98]
sub rax, rbx
cmp rax, rsi
jae 0x1400043f0
jmp 0x140004460
mov rdx, rcx
cmp eax, 0xffff
ja 0x14000441a
shr rdx, 0x1c
or dl, 0xe0
mov byte [rsp + 0x40], dl
shr ecx, 0x16
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x41], cl
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x42], al
mov esi, 3
mov rax, qword [rsp + 0x98]
sub rax, rbx
cmp rax, rsi
jb 0x140004460
nop
lea rcx, [rbx + r13]
mov rdx, r12
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rbx, rsi
mov qword [rsp + 0xa8], rbx
xor esi, esi
test si, si
jne 0x1400041e0
jmp 0x140004200
shr rdx, 0x22
or dl, 0xf0
mov byte [rsp + 0x40], dl
mov rdx, rcx
shr rdx, 0x1c
and dl, 0x3f
or dl, 0x80
mov byte [rsp + 0x41], dl
shr ecx, 0x16
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x42], cl
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x43], al
mov esi, 4
mov rax, qword [rsp + 0x98]
sub rax, rbx
cmp rax, rsi
jae 0x1400043f0
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.140009f40
mov r13, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
jmp 0x1400043f0
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0xa0]
movzx ebp, byte [rsp + 0xb0]
movzx eax, byte [rsp + 0xb7]
shl eax, 0x10
movzx ecx, word [rsp + 0xb5]
or ecx, eax
shl rcx, 0x20
mov r12d, dword [rsp + 0xb1]
or r12, rcx
mov rdi, qword [rsp + 0xc8]
movabs r13, 0x8000000000000000
test rdi, rdi
je 0x1400044ed
mov r8, qword [rsp + 0xd0]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp rsi, r13
jne 0x140004557
mov eax, r14d
and eax, 3
lea rcx, [rax - 2]
mov rsi, r13
cmp rcx, 2
jb 0x140004557
mov rsi, r13
test rax, rax
je 0x140004557
lea rsi, [r14 - 1]
mov r15, qword [r14 - 1]
mov rdi, qword [r14 + 7]
mov rcx, r15
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x140004542
cmp qword [rdi + 0x10], 0x11
jb 0x140004530
mov r15, qword [r15 - 8]
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rsi, r13
cmp qword [rsp + 0xf0], 0
je 0x140004576
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, qword [rsp + 0x58]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, r13
cmp rsi, r13
je 0x1400045af
test bpl, bpl
je 0x140004827
lea rax, [rsp + 0xd0]
mov r12, rbx
mov rbx, r14
mov r14, rsi
lea rsi, [r13 + 1]
mov qword [rsp + 0xd0], r14
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r12
mov rax, rsi
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0x60], 0
je 0x1400045db
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0xc8]
lea r14, [r13 + 1]
cmp rax, r14
jne 0x140004643
mov rdi, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xe0]
test rsi, rsi
je 0x14000465e
js 0x14000615c
movzx eax, byte [0x140190110]
mov rcx, qword [0x1401900f0]
test rcx, rcx
jne 0x14000462b
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14000615c
mov rcx, rax
mov qword [0x1401900f0], rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140004663
jmp 0x14000615c
xor r12d, r12d
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x1400060c2
jmp 0x140006108
mov ebx, 1
mov qword [rsp + 0xf0], r14
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
lea rdx, str._:8f
mov r8d, 0xe
lea rsi, [rsp + 0x60]
mov rcx, rsi
call section..text
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x98], rbp
lea r12, [0x1400061d0]
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], r12
lea rax, str.__UNC_
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], 2
mov qword [rsp + 0x178], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x170], 2
lea rcx, [rsp + 0xf8]
lea rdx, [rsp + 0x158]
call fcn.140001480
cmp qword [rsp + 0x60], 0
je 0x140004742
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x40], 0
je 0x14000475e
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x108]
lea rcx, [rsp + 0x158]
call fcn.1400080f0
mov rbx, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x160]
cmp rbx, r13
je 0x140004f4e
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rax
cmp rax, 4
jae 0x1400047e4
cmp rax, 3
je 0x1400048c7
cmp rax, 2
je 0x140004908
cmp rax, 1
jne 0x14000492f
cmp word [rsi], 0
jne 0x14000492f
jmp 0x140004d32
movabs rcx, 0x5c003f003f005c
lea rdx, [rcx + 0x1d0000]
cmp rdx, qword [rsi]
je 0x140004d32
cmp rcx, qword [rsi]
je 0x140004d32
cmp rax, 0xf8
jae 0x14000492f
cmp word [rsi + 2], 0x3a
jne 0x140004908
movzx eax, word [rsi + 4]
jmp 0x1400048d7
test rbx, rbx
je 0x140004587
lea rax, [r14 + rbx]
mov rdx, r14
jmp 0x14000485c
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop word cs:[rax + rax]
mov rdx, rcx
cmp rcx, rax
je 0x140004587
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140004850
cmp r8b, 0xe0
jb 0x140004839
cmp r8b, 0xed
jne 0x14000489e
cmp rcx, rax
je 0x140004587
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140004587
cmp byte [rdx + 1], 0x9f
ja 0x1400053ae
add rdx, 3
mov rcx, rdx
jmp 0x140004850
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140004850
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140004850
cmp word [rsi + 2], 0x3a
jne 0x140004908
movzx eax, word [rsi + 4]
test ax, ax
je 0x1400048f7
cmp ax, 0x2f
je 0x1400048e5
movzx eax, ax
cmp eax, 0x5c
jne 0x140004908
movzx eax, word [rsi]
cmp eax, 0x2f
je 0x14000490b
cmp eax, 0x5c
je 0x14000490b
jmp 0x140004d32
movzx eax, word [rsi]
cmp eax, 0x2f
je 0x140004908
cmp eax, 0x5c
jne 0x140004d32
movzx eax, word [rsi]
cmp ax, 0x5c
je 0x140004919
movzx eax, ax
cmp eax, 0x2f
jne 0x14000492f
movzx eax, word [rsi + 2]
cmp eax, 0x2f
je 0x140004d32
cmp eax, 0x5c
je 0x140004d32
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x50], 0
mov esi, 0x200
mov eax, 2
mov qword [rsp + 0x90], rax
xor ebx, ebx
xor r14d, r14d
xor edi, edi
cmp rsi, 0x201
jb 0x14000498f
jmp 0x1400049b0
jae 0x140004a7b
cmp rsi, 0x201
jae 0x1400049b0
mov r13d, 0x200
lea r12, [rsp + 0x158]
mov r15, rsi
jmp 0x1400049e6
sub rsi, rdi
sub r14, rdi
cmp r14, rsi
jb 0x140004a54
mov eax, 0xffffffff
cmp rbx, rax
mov edi, 0xffffffff
cmovb rdi, rbx
mov qword [rsp + 0x50], rdi
mov r14, rbx
mov r13, rdi
mov r12, qword [rsp + 0x90]
mov r15, rdi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rsp + 0x58]
mov edx, r15d
mov r8, r12
xor r9d, r9d
call qword [sym.imp.kernel32.dll_GetFullPathNameW]
mov ebp, eax
test eax, eax
jne 0x140004a16
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140004ac2
mov esi, ebp
cmp r15, rsi
jne 0x140004980
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000615c
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov rsi, r15
cmp rsi, 0x201
jae 0x1400049b0
jmp 0x14000498f
lea rcx, [rsp + 0x40]
mov rdx, rdi
mov r8, rsi
call fcn.140009df0
mov rbx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x90], rax
jmp 0x1400049bf
cmp r13, rsi
jb 0x14000615c
mov qword [rsp + 0x88], 0
cmp ebp, 2
mov rbx, qword [rsp + 0xe8]
jbe 0x140004aed
movzx eax, word [r12 + 2]
cmp eax, 0x3a
jne 0x140004af6
cmp word [r12 + 4], 0x5c
jne 0x140004af6
lea r13, str.__UNC_
mov ebp, 4
jmp 0x140004b72
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
movabs r14, 0x8000000000000000
lea r12, [0x1400061d0]
lea rbp, [rsp + 0x40]
jmp 0x140004cd6
jne 0x140004b69
movzx ecx, word [r12]
jmp 0x140004b41
movzx ecx, word [r12]
cmp ebp, 3
jbe 0x140004b41
lea r13, str.__UNC_
cmp cx, 0x5c
jne 0x140004b70
cmp eax, 0x3f
je 0x140004b70
cmp eax, 0x5c
jne 0x140004b4d
movzx eax, word [r12 + 4]
cmp eax, 0x3f
je 0x14000613b
cmp eax, 0x2e
jne 0x140004b53
cmp word [r12 + 6], 0x5c
jne 0x140004b53
add rsi, 0xfffffffffffffffc
add r12, 8
jmp 0x140004ab1
cmp cx, 0x5c
jne 0x140004b69
movzx eax, word [r12 + 2]
cmp ax, 0x5c
jne 0x140004b69
add rsi, 0xfffffffffffffffe
add r12, 4
lea r13, [0x14018d068]
mov ebp, 8
jmp 0x140004b72
lea r13, str.__UNC_
xor ebp, ebp
mov rdi, rbp
or rdi, 1
add rdi, rsi
cmp rbx, rdi
jae 0x140004c22
movabs rax, 0x3ffffffffffffffe
or rax, 1
xor edx, edx
cmp rdi, rax
setbe dl
lea r8, [rdi + rdi]
add rdx, rdx
test rbx, rbx
je 0x140004bce
lea rax, [rbx + rbx]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], 2
mov qword [rsp + 0xa8], rax
jmp 0x140004bda
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x60]
lea r9, [rsp + 0x98]
call fcn.140008480
cmp qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x68]
je 0x140004c0d
movabs rcx, 0x8000000000000001
cmp rax, rcx
je 0x140004c22
test rax, rax
ud2
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x58], rax
mov rbx, rdi
cmp rbx, rbp
jb 0x140005ca9
xor edi, edi
lea r8, [rbp*2]
mov rax, qword [rsp + 0x58]
lea rcx, [rax + rdi*2]
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbp
mov qword [rsp + 0x88], rdi
mov rax, rbx
sub rax, rdi
cmp rax, rsi
jb 0x140005cd7
mov r15, rbx
movabs r14, 0x8000000000000000
lea rbp, [rsp + 0x40]
lea r8, [rsi + rsi]
mov rbx, qword [rsp + 0x58]
lea rcx, [rbx + rdi*2]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
mov rax, rbx
mov qword [rsp + 0x88], rdi
cmp rdi, r15
jne 0x140004cb7
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.140008530
mov rax, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov word [rax + rdi*2], 0
inc rdi
mov qword [rsp + 0x88], rdi
xor esi, esi
mov rbx, qword [rsp + 0x40]
lea r12, [0x1400061d0]
test rbx, rbx
je 0x140004cef
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
test rsi, rsi
je 0x140004d1c
cmp qword [rsp + 0x78], 0
je 0x140004f4e
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140004f4e
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
cmp rbx, r14
je 0x140004f4e
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov rcx, rsi
mov edx, 0x40000000
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.kernel32.dll_GetLastError]
mov r15d, eax
cmp rdi, 0xffffffffffffffff
je 0x140004edb
cmp r15d, 0xb7
jne 0x140004db1
mov qword [rsp + 0x158], 0
lea r8, [rsp + 0x158]
mov rcx, rdi
mov edx, 6
mov r9d, 8
call qword [sym.imp.kernel32.dll_SetFileInformationByHandle]
test eax, eax
je 0x140004efa
mov r15, rdi
test rbx, rbx
je 0x140004dcb
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp rdi, 0xffffffffffffffff
je 0x140004ef1
mov r14d, 0x180e00
lea r12, [0x14000be88]
lea r13, [rsp + 0x158]
lea rbx, [0x14018da7c]
jmp 0x140004e19
test r14, r14
je 0x140004ef6
mov rcx, r13
mov rdx, r15
mov r8, r12
mov r9, r14
call fcn.140008a80
cmp qword [rsp + 0x158], 0
je case.default.0x140004e49
mov rsi, qword [rsp + 0x160]
mov eax, esi
and eax, 3
movsxd rax, dword [rbx + rax*4]
add rax, rbx
jmp rax
cmp byte [rsi + 0x10], 0x23
je 0x140004e10
jmp 0x140004f39
mov rax, qword [rsp + 0x160]
test rax, rax
je 0x140004f32
sub r14, rax
jb 0x14000615c
add r12, rax
jmp 0x140004e10
shl r15, 0x20
or r15, 2
test rbx, rbx
jne 0x140004db9
jmp 0x140004dcb
mov rsi, r15
jmp 0x140004f42
xor esi, esi
jmp 0x140004f39
mov r14, rbx
mov rbx, rsi
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
test r14, r14
je 0x140004f4e
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140004f4e
lea rsi, [0x14018d540]
mov rcx, r15
call qword [sym.imp.kernel32.dll_CloseHandle]
lea r12, [0x1400061d0]
lea rbp, [rsp + 0x40]
cmp qword [rsp + 0xf8], 0
je 0x140004f70
mov r8, qword [rsp + 0x100]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
test rsi, rsi
je 0x140004fe0
mov eax, esi
and eax, 3
xor r12d, r12d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400060ab
test rax, rax
je 0x1400060ab
lea rdi, [rsi - 1]
mov rax, rsi
mov rsi, qword [rsi - 1]
mov rbx, qword [rax + 7]
mov rcx, rsi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x140004fcc
cmp qword [rbx + 0x10], 0x11
jb 0x140004fba
mov rsi, qword [rsi - 8]
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1401900f0]
xor r12d, r12d
xor edx, edx
mov r8, rdi
jmp 0x1400060a5
lea rdx, str.v__0o1__
lea rdi, [rsp + 0x140]
mov r8d, 8
mov rcx, rdi
call section..text
mov rax, qword [rsp + 0xc8]
movabs rcx, 0x8000000000000001
cmp rax, rcx
jne 0x14000614d
mov rbx, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xe0]
test rsi, rsi
je 0x140005077
js 0x14000615c
movzx eax, byte [0x140190110]
mov rcx, qword [0x1401900f0]
test rcx, rcx
jne 0x14000505f
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14000615c
mov rcx, rax
mov qword [0x1401900f0], rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x14000507d
jmp 0x14000615c
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], rsi
lea rdx, str._:8f
mov r8d, 0xe
mov rcx, rbp
call section..text
lea rdx, [0x14018cd10]
mov r8d, 0x14
lea rsi, [rsp + 0x60]
mov rcx, rsi
call section..text
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x170], r12
mov qword [rsp + 0x178], rbp
mov qword [rsp + 0x180], r12
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x190], r12
lea rax, str.__UNC_
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 4
mov qword [rsp + 0xb8], 0
lea rax, [rsp + 0x158]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 4
lea rcx, [rsp + 0x128]
lea rdx, [rsp + 0x98]
call fcn.140001480
cmp qword [rsp + 0x60], 0
je 0x140005188
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x40], 0
je 0x1400051a4
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x78], 0
je 0x1400051c3
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x140], 0
je 0x1400051e5
mov r8, qword [rsp + 0x148]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov r15, qword [rsp + 0x128]
mov r13, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x138]
lea rdx, [0x14018cd24]
lea rcx, [rsp + 0x60]
mov r8d, 0x31
call section..text
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
add rax, rsi
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], rax
mov word [rsp + 0x168], 0
mov dword [rsp + 0x170], 1
lea rcx, [rsp + 0x98]
lea r14, [rsp + 0x158]
mov rdx, r14
call fcn.140003730
cmp qword [rsp + 0x60], 0
je 0x140005278
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0x158], 0
mov rdi, qword [rsp + 0xa0]
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov r14d, eax
test eax, eax
jne 0x1400052c6
mov r12, qword [rsp + 0x158]
cmp qword [rsp + 0x98], 0
jne 0x1400052dc
jmp 0x1400052ee
mov r12, r14
shl r12, 0x20
or r12, 2
cmp qword [rsp + 0x98], 0
je 0x1400052ee
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
test r14d, r14d
je 0x140005308
test r15, r15
je 0x1400060ab
mov rcx, qword [0x1401900f0]
jmp 0x1400060a0
lea rdx, [0x14018cd55]
lea rcx, [rsp + 0x60]
mov r8d, 0xd
call section..text
lea rdi, [rbx + r13]
test rbx, rbx
mov qword [rsp + 0x90], r15
mov qword [rsp + 0xe8], r13
je 0x14000534d
movzx eax, byte [r13]
test al, al
js 0x14000535f
lea rbp, [r13 + 1]
mov r15d, eax
jmp 0x1400053fe
xor ebp, ebp
xor r13d, r13d
xor r14d, r14d
xor r15d, r15d
xor eax, eax
jmp 0x140005427
mov r15d, eax
and r15d, 0x1f
movzx edx, byte [r13 + 1]
and edx, 0x3f
cmp al, 0xdf
jbe 0x1400053a1
movzx ecx, byte [r13 + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp al, 0xf0
jb 0x1400053bf
lea rbp, [r13 + 4]
movzx eax, byte [r13 + 3]
and r15d, 7
shl r15d, 0x12
shl ecx, 6
and eax, 0x3f
or eax, ecx
or r15d, eax
jmp 0x1400053ca
lea rbp, [r13 + 2]
shl r15d, 6
or r15d, edx
jmp 0x1400053fe
shl r12, 8
lea rax, [rsp + 0xd0]
jmp 0x14000459c
lea rbp, [r13 + 3]
shl r15d, 0xc
or r15d, ecx
cmp r15d, 0xffff
jbe 0x1400053fe
lea ecx, [r15 + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and r15d, 0x3ff
or r15d, 0xdc00
mov eax, 1
mov r13d, r15d
mov r15d, ecx
jmp 0x140005403
xor r13d, r13d
xor eax, eax
mov rcx, rdi
sub rcx, rbp
add rcx, 3
mov rdx, 0xffffffffffffffff
cmovae rdx, rcx
shr rdx, 2
add rax, rdx
inc rax
mov r14w, 1
cmp rax, 4
mov esi, 3
cmovae rsi, rax
movabs rax, 0x3ffffffffffffffe
cmp rsi, rax
ja 0x14000615c
mov qword [rsp + 0x58], r12
movzx eax, byte [0x140190110]
mov rcx, qword [0x1401900f0]
test rcx, rcx
jne 0x140005478
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14000615c
mov rcx, rax
mov qword [0x1401900f0], rax
lea r8, [rsi*2 + 2]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14000615c
mov r12, rax
inc rsi
mov word [rax], r15w
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
mov r15d, 1
jmp 0x1400054e6
xor eax, eax
mov ebx, r13d
cmp r15, qword [rsp + 0x158]
je 0x14000558c
mov r13d, eax
mov word [r12 + r15*2], bx
inc r15
mov qword [rsp + 0x168], r15
test rbp, rbp
je 0x140005510
test r13w, r13w
jne 0x1400054c0
cmp rbp, rdi
je 0x140005510
movzx eax, byte [rbp]
test al, al
js 0x14000553d
inc rbp
mov ebx, eax
xor eax, eax
jmp 0x1400054c5
mov rsi, qword [rsp + 0x158]
cmp r14w, 1
jne 0x14000561e
xor r14d, r14d
mov ebp, 0
mov ebx, 0
mov r8d, 0
cmp r15, rsi
jne 0x1400054d6
jmp 0x1400055b9
mov ebx, eax
and ebx, 0x1f
movzx edx, byte [rbp + 1]
and edx, 0x3f
cmp al, 0xdf
jbe 0x1400055d9
movzx ecx, byte [rbp + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp al, 0xf0
jb 0x1400055e9
movzx eax, byte [rbp + 3]
add rbp, 4
and ebx, 7
shl ebx, 0x12
shl ecx, 6
and eax, 0x3f
or eax, ecx
or ebx, eax
cmp ebx, 0xffff
ja 0x1400055fa
xor eax, eax
jmp 0x1400054c5
mov r8, rdi
sub r8, rbp
add r8, 3
mov rcx, 0xffffffffffffffff
cmovb r8, rcx
shr r8, 2
cmp ax, 1
sbb r8, 0xffffffffffffffff
cmp r14w, 1
sbb r8, 0xffffffffffffffff
mov r13d, eax
inc r8
lea rcx, [rsp + 0x158]
mov rdx, r15
call fcn.140009df0
mov r12, qword [rsp + 0x160]
jmp 0x1400054d6
add rbp, 2
shl ebx, 6
or ebx, edx
xor eax, eax
jmp 0x1400054c5
add rbp, 3
shl ebx, 0xc
or ebx, ecx
cmp ebx, 0xffff
jbe 0x140005585
lea ecx, [rbx + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and ebx, 0x3ff
or ebx, 0xdc00
mov eax, ebx
mov ebx, ecx
jmp 0x1400054c5
add r15, r15
test r15, r15
je 0x14000567d
lea rbx, [rsp + 0x40]
mov r14, qword [rsp + 0xf0]
js 0x14000615c
movzx eax, byte [0x140190110]
mov rcx, qword [0x1401900f0]
test rcx, rcx
jne 0x140005665
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14000615c
mov rcx, rax
mov qword [0x1401900f0], rax
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14000568f
jmp 0x14000615c
mov edi, 1
lea rbx, [rsp + 0x40]
mov r14, qword [rsp + 0xf0]
mov rcx, rdi
mov rdx, r12
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
test rsi, rsi
je 0x1400056b4
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
mov r13, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
add rax, r13
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x160], rax
mov word [rsp + 0x168], 0
mov dword [rsp + 0x170], 1
lea r12, [rsp + 0x98]
lea rdx, [rsp + 0x158]
mov rcx, r12
call fcn.140003730
cmp qword [rsp + 0x60], 0
je 0x140005718
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, r13
call qword [sym.imp.kernel32.dll_HeapFree]
mov r13, qword [rsp + 0xa0]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
mov rcx, qword [rsp + 0x58]
mov rdx, r13
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.advapi32.dll_RegSetValueExW]
cmp qword [rsp + 0x98], 0
je 0x14000575e
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, r13
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x140005775
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0xc8]
cmp rax, r14
movabs rsi, 0x8000000000000000
jne 0x1400057ef
mov r15, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
test rdi, rdi
je 0x14000584c
js 0x14000615c
movzx eax, byte [0x140190110]
mov rcx, qword [0x1401900f0]
test rcx, rcx
jne 0x1400057d7
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14000615c
mov rcx, rax
mov qword [0x1401900f0], rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r13, rax
test rax, rax
jne 0x140005852
jmp 0x14000615c
cmp rax, rsi
je 0x14000615c
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xd8]
lea rcx, [rsp + 0x158]
call fcn.1400036b0
movzx eax, byte [rsp + 0xe0]
mov byte [rsp + 0x170], al
cmp qword [rsp + 0x158], r14
jne 0x14000615c
mov rax, qword [rsp + 0x160]
mov r13, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x170]
jmp 0x140005863
mov r13d, 1
mov rcx, r13
mov rdx, r15
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], rdi
lea rdx, str._:8f
mov r8d, 0xe
lea rdi, [rsp + 0x60]
mov rcx, rdi
call section..text
mov qword [rsp + 0x98], rbx
lea rax, [0x1400061d0]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rax
lea rax, str.__UNC_
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], 2
mov qword [rsp + 0x178], 0
mov qword [rsp + 0x168], r12
mov qword [rsp + 0x170], 2
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x158]
call fcn.140001480
cmp qword [rsp + 0x60], 0
je 0x14000591f
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x40], 0
mov r12, rsi
je 0x14000593e
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x120]
add rcx, rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov word [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x98]
call fcn.140003730
mov dword [rsp + 0x158], 0
lea rdx, [rsp + 0x158]
mov ecx, 1
call qword [sym.imp.kernel32.dll_SetThreadErrorMode]
test eax, eax
setne sil
mov ebp, dword [rsp + 0x158]
cmp ebp, 1
setne r15b
mov r14, qword [rsp + 0x68]
mov rcx, r14
xor edx, edx
xor r8d, r8d
call qword [sym.imp.kernel32.dll_LoadLibraryExW]
test rax, rax
je 0x140005bc7
mov rdi, rax
lea rbx, [r12 + 0x11]
and sil, r15b
cmp qword [rsp + 0x60], 0
je 0x1400059fb
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
test sil, sil
je 0x140005a0a
mov ecx, ebp
xor edx, edx
call qword [sym.imp.kernel32.dll_SetThreadErrorMode]
cmp qword [rsp + 0x110], 0
je 0x140005a2c
mov r8, qword [rsp + 0x118]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea r13, [r12 + 0x11]
cmp rbx, r13
mov rbp, qword [rsp + 0x90]
jne 0x140005b28
lea rdx, [0x14018cd10]
lea rcx, [rsp + 0x78]
mov r8d, 0x14
call section..text
mov r14, qword [rsp + 0x88]
test r14, r14
je 0x140005c0f
mov r15, qword [rsp + 0x80]
cmp byte [r14 + r15 - 1], 0
je 0x140005c29
mov r12, r14
inc r12
sete bl
je 0x14000615c
js 0x14000615c
movzx eax, byte [0x140190110]
mov rcx, qword [0x1401900f0]
test rcx, rcx
jne 0x140005abf
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14000615c
mov rcx, rax
mov qword [0x1401900f0], rax
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14000615c
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
test bl, bl
jne 0x140005d86
mov rcx, rax
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x50], r14
mov r12, r14
cmp r14, 0xf
ja 0x140005db5
xor ebx, ebx
cmp byte [r15 + rbx], 0
je 0x140005d1d
inc rbx
cmp r14, rbx
jne 0x140005b10
jmp 0x140005e48
xor rbx, r12
cmp rbx, 0x11
mov eax, 0xf
cmovb rax, rbx
cmp rax, 0xf
mov rbx, qword [rsp + 0x58]
mov r13, qword [rsp + 0xe8]
ja case.0x140005b5d.1
lea rcx, [0x14018da8c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov eax, edi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb case.0x140005b5d.1
test rax, rax
je case.0x140005b5d.1
lea r14, [rdi - 1]
mov r15, qword [rdi - 1]
mov rsi, qword [rdi + 7]
mov rcx, r15
call qword [rsi]
cmp qword [rsi + 8], 0
je 0x140005bb0
cmp qword [rsi + 0x10], 0x11
jb 0x140005b9e
mov r15, qword [r15 - 8]
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
jmp case.0x140005b5d.1
call qword [sym.imp.kernel32.dll_GetLastError]
mov rdi, rax
shl rdi, 0x20
lea rbx, [r12 + 7]
mov qword [rsp + 0x158], rbx
test eax, eax
je 0x140005bf7
lea rcx, [rsp + 0x158]
call fcn.1400061f0
lea rbx, [r12 + 6]
or rdi, 2
and sil, r15b
cmp qword [rsp + 0x60], 0
jne 0x1400059e9
jmp 0x1400059fb
lea r15, [0x14018cd72]
mov r14d, 1
jmp 0x140005d7f
mov byte [rdi], 0
jmp case.0x140005b5d.1
cmp r14, 0xf
ja 0x140005c49
xor ecx, ecx
cmp byte [r15 + rcx], 0
je 0x140005d73
inc rcx
cmp r14, rcx
jne 0x140005c31
jmp 0x14000615c
lea rax, [r15 + 7]
and rax, 0xfffffffffffffff8
sub rax, r15
jne 0x140005d25
lea rcx, [r14 - 0x10]
xor eax, eax
movabs rdx, 0x8080808080808080
movdqa xmm0, xmmword [0x14000b3c0]
movdqu xmm1, xmmword [r15 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x140005d4a
add rax, 0x10
cmp rax, rcx
jbe 0x140005c72
jmp 0x140005d4a
lea rcx, [rsp + 0x78]
xor edx, edx
mov r8, rbp
call fcn.140009df0
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
jmp 0x140004c2d
lea rcx, [rsp + 0x78]
mov rdx, rdi
mov r8, rsi
call fcn.140009df0
mov rdi, qword [rsp + 0x88]
mov r15, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
jmp 0x140004c63
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp case.0x140005b5d.1
mov r12, r14
jmp 0x140005ead
cmp rax, r14
cmovae rax, r14
xor ecx, ecx
cmp byte [r15 + rcx], 0
je 0x140005d73
inc rcx
cmp rax, rcx
jne 0x140005d2e
lea rcx, [r14 - 0x10]
cmp rax, rcx
jbe 0x140005c60
mov rdx, r14
sub rdx, rax
je 0x14000615c
lea r8, [r15 + rax]
xor ecx, ecx
cmp byte [r8 + rcx], 0
je 0x140005d70
inc rcx
cmp rdx, rcx
jne 0x140005d5c
jmp 0x14000615c
add rcx, rax
inc rcx
cmp rcx, r14
jne 0x14000615c
xor ebp, ebp
jmp 0x140005fa7
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8, r14
call fcn.140009d50
mov r12, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, r12
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add r12, r14
mov qword [rsp + 0x50], r12
lea rax, [r15 + 7]
and rax, 0xfffffffffffffff8
sub rax, r15
jne 0x140005e0a
lea rcx, [r14 - 0x10]
xor eax, eax
movabs rdx, 0x8080808080808080
movdqa xmm0, xmmword [0x14000b3c0]
movdqu xmm1, xmmword [r15 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x140005e2f
add rax, 0x10
cmp rax, rcx
jbe 0x140005dda
jmp 0x140005e2f
cmp rax, r14
cmovae rax, r14
xor ebx, ebx
cmp byte [r15 + rbx], 0
je 0x140005ead
inc rbx
cmp rax, rbx
jne 0x140005e13
lea rcx, [r14 - 0x10]
cmp rax, rcx
jbe 0x140005dc8
sub r14, rax
je 0x140005e48
add r15, rax
xor ebx, ebx
cmp byte [r15 + rbx], 0
je 0x140005eaa
inc rbx
cmp r14, rbx
jne 0x140005e39
movdqu xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
mov r14, qword [rsp + 0x50]
mov qword [rsp + 0x70], r14
mov rsi, qword [rsp + 0x60]
cmp rsi, r14
jne 0x140005f3c
mov r15, r14
inc r15
je 0x14000615c
mov rdx, r15
not rdx
shr rdx, 0x3f
test rsi, rsi
je 0x140005ee4
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], 1
mov qword [rsp + 0x168], rsi
jmp 0x140005ef0
add rbx, rax
mov rax, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov ebp, 1
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140005ed3
mov r14, r12
jmp 0x140005fa7
mov rbp, r15
cmp rax, r13
je 0x140005fad
jmp 0x14000615c
mov qword [rsp + 0x160], 0
lea rcx, [rsp + 0x98]
lea r9, [rsp + 0x158]
mov r8, r15
call fcn.140001330
cmp qword [rsp + 0x98], 0
mov rax, qword [rsp + 0xa0]
je 0x140005f2f
movabs rcx, 0x8000000000000001
cmp rax, rcx
je 0x140005f3c
jmp 0x140004c08
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r15
mov rsi, r15
cmp r14, rsi
jne 0x140005f58
lea rcx, [rsp + 0x60]
mov rdx, r14
call fcn.1400013e0
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
mov byte [r15 + r14], 0
inc r14
mov qword [rsp + 0x70], r14
cmp rsi, r14
jbe 0x140005fa2
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, r15
test r14, r14
je 0x140005f96
mov r9, r14
call qword [sym.imp.kernel32.dll_HeapReAlloc]
mov r15, rax
test rax, rax
jne 0x140005fa2
jmp 0x14000615c
call qword [sym.imp.kernel32.dll_HeapFree]
mov r15d, 1
mov ebp, 1
mov r12, r15
mov rbx, r14
mov rcx, rdi
mov rdx, r12
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x140005ffd
call qword [sym.imp.kernel32.dll_GetLastError]
mov r14, rax
shl r14, 0x20
movabs rsi, 0x8000000000000000
lea r13, [rsi + 0xb]
mov qword [rsp + 0x158], r13
test eax, eax
je 0x140005ff9
lea rcx, [rsp + 0x158]
call fcn.1400061f0
lea r13, [rsi + 0xa]
or r14, 2
test rbp, rbp
je 0x14000601e
mov byte [r12], 0
test rbx, rbx
je 0x14000601e
mov rcx, qword [0x1401900f0]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
movabs rax, 0x8000000000000000
add rax, 0x11
cmp r13, rax
jne 0x14000615c
cmp qword [rsp + 0x78], 0
je 0x140006054
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
call r14
mov rcx, rdi
call qword [sym.imp.kernel32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x58]
mov r13, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0x90]
movabs rax, 0xffffffff7fffffff
cmp rbx, rax
ja 0x14000608d
mov rcx, rbx
call qword [sym.imp.advapi32.dll_RegCloseKey]
test rbp, rbp
je 0x14000611f
mov rcx, qword [0x1401900f0]
xor r12d, r12d
xor edx, edx
mov r8, r13
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0xc8]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140006108
movabs rcx, 0x8000000000000001
cmp rax, rcx
jne 0x1400060e8
lea rcx, [rsp + 0xd0]
mov rax, qword [rsp + 0xd0]
test rax, rax
jne 0x1400060f5
jmp 0x140006108
lea rcx, [rsp + 0xc8]
test rax, rax
je 0x140006108
mov r8, qword [rcx + 8]
mov rcx, qword [0x1401900f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, r12
add rsp, 0x558
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r12d, r12d
mov rax, qword [rsp + 0xc8]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x1400060c2
jmp 0x140006108
cmp word [r12 + 6], 0x5c
je 0x140004b70
jmp 0x140004b53
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x14000615e
ud2
mov rsi, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov ecx, 1
test rdi, rdi
jne 0x140006185
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
ud2
js 0x14000615c
movzx eax, byte [0x140190110]
mov rcx, qword [0x1401900f0]
test rcx, rcx
jne 0x1400061af
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14000615c
mov rcx, rax
mov qword [0x1401900f0], rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rcx, rax
test rax, rax
jne 0x140006178
jmp 0x14000615c