Function at 0x180010490
Capabilities:
Delete registry key
Query or enumerate registry key
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x1800312f8]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
movzx r10d, byte [rsp + 0x31]
xor eax, eax
imul esi, r8d, 0x7c5
mov r14, r9
mov qword [rsp + 0x58], r9
mov r15, rcx
mov r9, qword [rbp + 0x510]
mov r13d, eax
mov qword [rsp + 0x68], rcx
mov r12d, r8d
mov dword [rsp + 0x38], r8d
lea rcx, [0x180000000]
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], esi
mov byte [rsp + 0x30], r10b
cmp r8d, esi
ja 0x180010f05
mov edi, dword [rsp + 0x40]
mov ecx, 0x7453
mov rbx, qword [rsp + 0x78]
mov eax, 0x77
cmp r12d, 0xd7e0
ja 0x180010cd1
je 0x180010cbb
cmp r12d, 0x485e
ja 0x180010be4
je 0x180010bd5
mov eax, r12d
sub eax, 0x51
je 0x180010bad
sub eax, 0x4c
je 0x180010b94
sub eax, 0x73
je 0x180010ab3
cmp eax, 0x2446
jne 0x180010ea2
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x1a4
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rsp + 0x48]
cmp qword [rdi + 0x10], 0x35
jb 0x180010777
xor edx, edx
mov r15d, edx
cmp r15d, 6
ja case.default.0x1800105bf
lea r8, [0x180000000]
mov eax, r15d
mov ecx, dword [r8 + rax*4 + 0x11474]
add rcx, r8
jmp rcx
mov dword [rbp + 0x30a], 0x4d002d
mov dword [rbp + 0x30e], 0x62006f
mov dword [rbp + 0x312], 0x6c0069
jmp case.default.0x1800105bf
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x2f8], 0xf
mov byte [rbp + 0x2e0], 0
cmp rax, 0xb
jb 0x18001145f
add rax, 0xfffffffffffffff5
mov esi, 6
cmp rax, rsi
cmovb rsi, rax
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
jb 0x180010621
mov rax, qword [rdi]
lea r14, [rax + 0xb]
cmp rsi, 0xf
ja 0x180010651
mov r8, rsi
mov qword [rbp + 0x2f0], rsi
mov rdx, r14
lea rcx, [rbp + 0x2e0]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi + 0x2e0], 0
jmp 0x1800106f9
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x18001146b
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x180010675
mov rdi, rax
jmp 0x180010682
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800106bb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180011465
mov rcx, rax
call fcn.180023dfc
test rax, rax
je 0x180010ebd
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800106cd
test rcx, rcx
je 0x1800106ca
call fcn.180023dfc
mov rbx, rax
jmp 0x1800106cd
mov rbx, rdx
mov r8, rsi
mov qword [rbp + 0x2f0], rsi
mov rdx, r14
mov qword [rbp + 0x2f8], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rsp + 0x48]
mov byte [rbx + rsi], 0
mov qword [rbp + 0x2e0], rbx
or r13d, 1
lea rcx, [0x180031288]
lea rdx, [rbp + 0x2e0]
call fcn.180008fb0
mov rax, qword [rbp + 0x2f8]
cmp rax, 0x10
jb 0x180010752
mov rcx, qword [rbp + 0x2e0]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001074d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180010ebd
call fcn.180023e38
xor edx, edx
inc r15d
lea eax, [r15 + 0xdb]
cmp eax, 0xe2
jb 0x1800105a0
mov esi, dword [rsp + 0x44]
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x68]
xor eax, eax
lea rcx, [rbp - 0x70]
mov edi, eax
call qword [sym.imp.GDI32.dll_CreateFontIndirectExW]
mov r8d, dword [rsp + 0x38]
mov ecx, 0x7453
movzx r10d, byte [rsp + 0x30]
mov rbx, rax
jmp 0x180010ea2
mov esi, 0xb
mov dword [rbp + 0x320], 0x31
cmp qword [rdi + 0x10], rsi
mov r14, rdi
mov byte [rsp + 0x31], 1
cmovb rsi, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
mov qword [rbp + 0x2f8], 0xf
mov byte [rbp + 0x2e0], 0
jb 0x1800107d9
mov r14, qword [rdi]
cmp rsi, 0xf
ja 0x180010810
mov r8, rsi
mov qword [rbp + 0x2f0], rsi
mov rdx, r14
lea rcx, [rbp + 0x2e0]
call sub.VCRUNTIME140.dll_memmove
or r13d, 2
mov byte [rbp + rsi + 0x2e0], 0
lea rcx, [0x180031268]
jmp 0x180010704
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x18001146b
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x180010834
mov rdi, rax
jmp 0x180010841
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18001087a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180011465
mov rcx, rax
call fcn.180023dfc
test rax, rax
je 0x180010ebd
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18001088c
test rcx, rcx
je 0x180010889
call fcn.180023dfc
mov rbx, rax
jmp 0x18001088c
mov rbx, rdx
mov r8, rsi
mov qword [rbp + 0x2f0], rsi
mov rdx, r14
mov qword [rbp + 0x2f8], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rsp + 0x48]
lea rcx, [0x180031268]
or r13d, 2
mov byte [rbx + rsi], 0
mov qword [rbp + 0x2e0], rbx
jmp 0x180010704
mov eax, 0x54
mov word [rbp + 0x308], ax
jmp case.default.0x1800105bf
xor r9d, r9d
lea rax, [rbp + 0x308]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rdi + 0x10]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x2f8], 0xf
mov byte [rbp + 0x2e0], 0
cmp rcx, 0x11
jb 0x18001145f
add rcx, 0xffffffffffffffef
mov esi, 0x24
cmp rcx, rsi
cmovb rsi, rcx
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x180010945
mov rcx, qword [rdi]
lea r14, [rcx + 0x11]
cmp rsi, 0xf
ja 0x180010975
mov r8, rsi
mov qword [rbp + 0x2f0], rsi
mov rdx, r14
lea rcx, [rbp + 0x2e0]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi + 0x2e0], 0
jmp 0x180010a21
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x18001146b
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x180010999
mov rdi, rax
jmp 0x1800109a6
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800109df
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180011465
mov rcx, rax
call fcn.180023dfc
test rax, rax
je 0x180010ebd
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800109f0
test rcx, rcx
je 0x1800109ee
call fcn.180023dfc
mov rbx, rax
jmp 0x1800109f0
xor ebx, ebx
mov r8, rsi
mov qword [rbp + 0x2f0], rsi
mov rdx, r14
mov qword [rbp + 0x2f8], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rsp + 0x48]
mov byte [rbx + rsi], 0
mov qword [rbp + 0x2e0], rbx
mov rbx, qword [rsp + 0x50]
lea rdx, [rbp + 0x2e0]
or r13d, 4
lea rcx, [0x180031248]
call fcn.180008fb0
mov rax, qword [rbp + 0x2f8]
cmp rax, 0x10
jb 0x180010a7a
mov rcx, qword [rbp + 0x2e0]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180010a75
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180010ebd
call fcn.180023e38
xor edx, edx
test rbx, rbx
jne case.default.0x1800105bf
mov byte [rsp + 0x31], bl
jmp case.default.0x1800105bf
mov eax, 0x65
mov dword [rbp + 0x318], 0x43005f
mov word [rbp + 0x316], ax
mov dword [rbp + 0x31c], 0x320031
jmp case.default.0x1800105bf
mov eax, dword [r9]
cmp eax, 1
jne 0x180010ae1
lea rcx, str.D:drmemory_packagedynamoriocorewin32_syscall.c:4136
call fcn.180023d20
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strupr]
mov rdx, rax
lea rcx, str.typeof_holder_Phx::Symbols::AttributeSymbolListExtensionObject_
call fcn.180023d20
jmp 0x180010b4f
cmp eax, 2
jne 0x180010b3e
mov eax, dword [rdx]
cmp eax, 2
jne 0x180010b13
lea rcx, str.browser_renderer_hostgamepad_browser_message_filter.cc
call fcn.180023d20
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strupr]
mov rdx, rax
lea rcx, str.std._Builder_char_const__char_std::regex_traits_char___.ctor
call fcn.180023d20
jmp 0x180010b4f
cmp eax, 1
jne 0x180010b73
lea rcx, str.CTU.CarrierSwitchFinishedCb:_carrier_switch_failed
call fcn.180023d20
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strupr]
mov rdx, rax
lea rcx, str.DrawElements:_type_must_be_UNSIGNED_SHORT_or_UNSIGNED_BYTE
call fcn.180023d20
jmp 0x180010b4f
cmp eax, 3
jne 0x180010b73
lea rcx, str._p_Below_is_a_simple__Hello_World__issue_description_in_Python.__p_
call fcn.180023d20
xor edx, edx
xor ecx, ecx
mov r8d, 0xae
call fcn.18000e360
mov r8d, dword [rsp + 0x38]
mov ecx, 0x7453
movzx r10d, byte [rsp + 0x30]
jmp 0x180010ea2
lea rcx, str.VPCMPEQDZrmk
call fcn.180023d20
mov r8d, dword [rsp + 0x38]
mov ecx, 0x7453
movzx r10d, byte [rsp + 0x30]
jmp 0x180010ea2
mov dword [rbp + 0x3d0], 0x780045
mov dword [rbp + 0x3d4], 0x650063
jmp 0x180010ea2
movups xmm0, xmmword [str.Int_VUCOMISSZrm]
mov r10b, 1
mov dword [rsp + 0x3c], 0xf003f
mov byte [rsp + 0x30], r10b
movups xmmword [rbp + 0x3c0], xmm0
mov byte [rsp + 0x32], r10b
jmp 0x180010ea2
mov dword [rbp + 0x3d8], 0x740070
jmp 0x180010ea2
cmp r12d, 0x4a5b
je 0x180010c72
cmp r12d, 0x6f60
je 0x180010c36
cmp r12d, 0x901f
jne 0x180010ea2
mov eax, 0x68
mov dword [rbp + 0x3dc], 0x6f0069
mov word [rbp + 0x3e8], ax
mov dword [rbp + 0x3e0], 0x43006e
mov dword [rbp + 0x3e4], 0x630061
jmp 0x180010ea2
xor eax, eax
mov ecx, eax
movzx eax, r10b
cmp dword [rsp + 0x34], ecx
cmove ecx, eax
cmp byte [rsp + 0x32], 0
movzx r10d, cl
mov byte [rsp + 0x30], cl
je 0x180010c68
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r8d, dword [rsp + 0x38]
movzx r10d, byte [rsp + 0x30]
mov ecx, 0x7453
jmp 0x180010ea2
mov edx, dword [rsp + 0x3c]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x20], edi
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyA]
movzx ecx, byte [rsp + 0x32]
mov r8d, dword [rsp + 0x38]
movzx r10d, byte [rsp + 0x30]
mov dword [rsp + 0x34], eax
xor eax, eax
test rbx, rbx
mov edx, eax
cmovne edx, ecx
mov ecx, 0x7453
mov byte [rsp + 0x32], dl
jmp 0x180010ea2
mov dword [rbp + 0x3ea], 0x65
mov byte [rbp + 0x328], 0
jmp 0x180010ea2
cmp r12d, 0x23ea5
ja 0x180010dd2
je 0x180010daf
cmp r12d, 0x11fa1
je 0x180010d80
cmp r12d, 0x16762
je 0x180010d6d
cmp r12d, 0x1af23
je 0x180010d1c
cmp r12d, 0x1f6e4
jne 0x180010ea2
mov word [rbp + 0x360], ax
jmp 0x180010ea2
mov r8d, 2
lea rdx, [0x180028714]
lea rcx, [rbp + 0x32d]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x180028722]
mov ecx, 0x7453
mov r8d, dword [rsp + 0x38]
movzx r10d, byte [rsp + 0x30]
mov word [rbp + 0x32f], ax
movzx eax, byte [0x180028724]
mov byte [rbp + 0x331], al
mov byte [rbp + 0x332], 0
jmp 0x180010ea2
mov word [rbp + 0x32b], cx
mov byte [rbp + 0x32d], 0
jmp 0x180010ea2
mov r8d, 3
lea rdx, [0x180028793]
lea rcx, [rbp + 0x328]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, dword [rsp + 0x38]
mov ecx, 0x7453
movzx r10d, byte [rsp + 0x30]
jmp 0x180010ea2
mov dword [rbp + 0x362], 0x320073
mov dword [rbp + 0x366], 0x33005f
mov dword [rbp + 0x36a], 0x2e0032
jmp 0x180010ea2
cmp r12d, 0x28666
je 0x180010e8e
cmp r12d, 0x2ce27
je 0x180010e14
cmp r12d, 0x315e8
jne 0x180010ea2
mov eax, dword [0x180028998]
mov dword [rbp + 0x3b4], eax
movzx eax, word [0x18002899c]
mov word [rbp + 0x3b8], ax
jmp 0x180010ea2
movups xmm0, xmmword [str.V761_bNei]
mov eax, dword [0x180028758]
lea rdx, str.ghbo
mov r8d, 5
mov dword [rbp + 0x3a0], eax
lea rcx, [rbp + 0x3a2]
movups xmmword [rbp + 0x390], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x18002876c]
lea rdx, [0x180028778]
mov dword [rbp + 0x3aa], eax
lea rcx, [rbp + 0x390]
movzx eax, word [0x180028770]
mov r8d, 3
mov word [rbp + 0x3ae], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, dword [rsp + 0x38]
mov ecx, 0x7453
movzx r10d, byte [rsp + 0x30]
jmp 0x180010ea2
mov dword [rbp + 0x36e], 0x6c0064
mov dword [rbp + 0x372], 0x6c
mov r9, qword [rsp + 0x48]
imul eax, r8d, 0x75
add r12d, eax
cmp r12d, esi
ja 0x180010efe
mov rdx, qword [rsp + 0x70]
jmp 0x180010526
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp byte [rsp + 0x31], 0
je 0x180010ee8
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_SetFileShortNameW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_EnumSystemLanguageGroupsA]
mov al, 1
jmp 0x180011435
lea rcx, [0x180000000]
movzx ebx, byte [rsp + 0x31]
lea edx, [r8 - 0x11]
mov dword [rsp + 0x34], edx
cmp r8d, edx
jbe case.0x180010f63.0
mov r14d, dword [rsp + 0x40]
lea edx, [r8 - 0x50]
movzx esi, byte [rsp + 0x31]
mov r12d, dword [rsp + 0x40]
mov r15, qword [rsp + 0x78]
movzx r13d, byte [rsp + 0x31]
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x3c], edx
cmp edx, 0x4d
ja case.default.0x180010f63
movzx eax, byte [rcx + rdx + 0x114d4]
mov ecx, dword [rcx + rax*4 + 0x11490]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
lea r9, [rbp - 0x80]
mov edx, r14d
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0x378]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rsp + 0x44], eax
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
jmp case.0x180010f63.16
mov eax, 0x61
mov word [rbp + 0x352], ax
jmp case.0x180010f63.16
movups xmm0, xmmword [str.NewRasIncomingCall]
xor eax, eax
mov byte [rsp + 0x32], 1
mov word [rbp + 0x35a], ax
movzx eax, word [0x1800289b0]
mov word [rbp + 0x388], ax
movzx eax, byte [0x1800289b2]
mov byte [rbp + 0x38a], al
mov qword [rsp + 0x70], 0xffffffff80000001
movups xmmword [rbp + 0x378], xmm0
jmp case.0x180010f63.16
xor eax, eax
lea rdx, [rbp + 0x140]
mov ecx, 0x202
mov dword [rsp + 0x60], eax
mov qword [rbp - 0x80], rax
call qword [rbp - 0x78]
test eax, eax
je 0x180010f81
xor edx, edx
mov edi, edx
nop word [rax + rax]
cmp edi, 0xb
ja case.0x18001102d.8
lea r8, [0x180000000]
mov eax, edi
mov ecx, dword [r8 + rax*4 + 0x11524]
add rcx, r8
jmp rcx
mov eax, 0x30
mov dword [rbp + 0x2fa], 0x590042
mov word [rbp + 0x2fe], ax
jmp case.0x18001102d.8
mov r8d, 1
lea rdx, [0x1800289b4]
lea rcx, [rbp + 0x308]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, 0x62
mov dword [rbp + 0x310], eax
lea rax, [rbp + 0x308]
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x180011080
mov ecx, dword [0x1800289c0]
xor edx, edx
movsd xmm0, qword [0x1800289b8]
movsd qword [rax], xmm0
mov dword [rax + 8], ecx
movzx ecx, word [0x1800289c4]
mov word [rax + 0xc], cx
mov eax, 0x6f
mov dword [rbp + 0x31e], 0x69
mov word [rbp + 0x320], ax
jmp case.0x18001102d.8
mov dword [rbp + 0x2e4], 0x720072
jmp case.0x18001102d.8
mov word [rbp + 0x322], dx
jmp case.0x18001102d.8
mov eax, 0x70
mov dword [rbp + 0x2f2], 0x240065
mov word [rbp + 0x2f0], ax
mov dword [rbp + 0x2f6], 0x240024
jmp case.0x18001102d.8
mov dword [rbp + 0x2e0], 0x410024
jmp case.0x18001102d.8
mov r8d, 8
lea rdx, [rbp + 0x308]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_StrCmpNW]
xor bl, bl
xor edx, edx
jmp case.0x18001102d.8
mov dword [rbp + 0x2e8], 0x790061
mov dword [rbp + 0x2ec], 0x790054
jmp case.0x18001102d.8
mov eax, dword [0x1800289c8]
mov dword [rbp + 0x308], 0x64
mov dword [rbp + 0x30a], eax
movzx eax, word [0x1800289cc]
mov word [rbp + 0x30e], ax
mov dword [rbp + 0x300], 0x5f0031
mov dword [rbp + 0x304], 0x4a
inc edi
lea eax, [rdi + 0xd4]
cmp eax, 0xe0
jb 0x180011010
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
jmp case.0x180010f63.16
mov eax, 0x6f
mov dword [rbp + 0x340], 0x630065
mov word [rbp + 0x348], ax
mov dword [rbp + 0x344], 0x690074
jmp case.0x180010f63.16
mov edx, dword [rsp + 0x50]
lea r9, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0x390]
call qword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
cmp byte [rsp + 0x32], 0
je 0x180011223
xor eax, eax
lea r8, [rsp + 0x58]
mov edx, r14d
mov qword [rsp + 0x58], rax
lea rcx, [rbp + 0x378]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rbp - 0x80]
mov dword [rsp + 0x44], eax
test rcx, rcx
je 0x180011214
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180011223
call sub.RPCRT4.dll_MesHandleFree
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf9
call fcn.180017170
mov edx, dword [rsp + 0x3c]
movzx ebx, al
mov r8d, dword [rsp + 0x38]
jmp case.0x180010f63.16
mov dword [rbp + 0x338], 0x6f0063
mov dword [rbp + 0x33c], 0x6e006e
jmp case.0x180010f63.16
xor edx, edx
mov rcx, r9
lea r8d, [rdx + 0x55]
call fcn.1800132f0
test al, al
jne 0x180011300
mov edi, 0xae
nop word [rax + rax]
mov eax, edi
sub eax, 0xaa
je 0x180011424
sub eax, 1
je 0x1800112e8
sub eax, 1
je 0x1800112c8
sub eax, 1
je 0x1800112bd
cmp eax, 1
jne 0x1800112f6
movzx esi, al
xor eax, eax
mov qword [rsp + 0x68], rax
jmp 0x1800112f6
mov r12d, 2
mov r13b, 0x41
jmp 0x1800112f6
mov r9d, r12d
lea rcx, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.GDI32.dll_CreatePolyPolygonRgn]
mov r15, rax
test rax, rax
jne 0x1800112f6
xor sil, sil
jmp 0x1800112f6
test sil, sil
je 0x1800112f6
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
dec edi
cmp edi, 0xa9
ja 0x180011290
mov edx, dword [rsp + 0x3c]
xor eax, eax
mov r8d, dword [rsp + 0x38]
mov ecx, eax
movzx eax, byte [rsp + 0x32]
cmp dword [rsp + 0x44], ecx
cmove ecx, eax
mov byte [rsp + 0x32], cl
jmp case.0x180010f63.16
mov dword [rbp + 0x34e], 0x6c005f
jmp case.0x180010f63.16
xor eax, eax
lea rdx, [rbp + 0x360]
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x328]
mov eax, 0x70
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.18000a1b0
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
mov qword [rbp - 0x78], rax
jmp case.0x180010f63.16
mov dword [rbp + 0x34a], 0x73006e
jmp case.0x180010f63.16
xor eax, eax
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x50], eax
lea rax, [rbp + 0x378]
nop
inc r14
cmp byte [rax + r14], 0
jne 0x180011390
jmp case.0x180010f63.16
test r10b, r10b
je 0x1800113ba
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegDeleteEmptyUSKeyA]
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
xor bl, bl
jmp case.0x180010f63.16
lea rcx, [rbp + 0x390]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800113d0
mov dword [rsp + 0x40], eax
jmp case.0x180010f63.16
mov eax, 0x6c
mov dword [rbp + 0x354], 0x650062
mov word [rbp + 0x358], ax
mov eax, dword [rsp + 0x34]
dec r8d
dec edx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x3c], edx
cmp r8d, eax
jbe case.0x180010f63.0
mov r9, qword [rsp + 0x48]
lea rcx, [0x180000000]
movzx r10d, byte [rsp + 0x30]
jmp 0x180010f41
movzx ecx, r13b
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor al, al
jmp 0x180011435
movzx eax, bl
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.1800245e0
mov rbx, qword [rsp + 0x5f8]
add rsp, 0x5b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180020220
int3
call fcn.1800200a0
int3
call fcn.1800201e0
int3