Function at 0x1401d6c60
Capabilities:
Get common file path
Hash data using sha256
Persist via active setup registry key
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf530]
mov eax, 0xf630
call fcn.1402cb740
sub rsp, rax
mov qword [rbp + 0xab8], 0xfffffffffffffffe
mov qword [rsp + 0xf668], rbx
mov qword [rsp + 0xf670], rsi
mov qword [rsp + 0xf678], rdi
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0xf520], rax
mov r13, rcx
mov qword [rsp + 0x68], rcx
xor r14d, r14d
mov dword [rbp - 0x60], r14d
mov dword [rbp - 0x70], r14d
lea rbx, [0x140348ca0]
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], r14
mov qword [rbp + 0x2d0], rbx
mov qword [rbp + 0x2d8], r14
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x868], rax
mov dword [rbp + 0x870], r14d
mov qword [rbp + 0x878], r14
lea rcx, str.SeTakeOwnershipPrivilege
call fcn.1400ff510
lea rax, vtable.Core::Collection_class_Core::String_.0
mov qword [rbp + 0xaf0], rax
mov edi, r14d
mov dword [rbp + 0xaf8], r14d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb00], xmm0
mov eax, dword [0x14042c9e0]
lea r12, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401d6d67
or eax, 1
mov dword [0x14042c9e0], eax
mov qword [0x14042c9e8], r12
mov qword [0x14042c9f0], 0xffffffff80000002
lea rcx, [0x1403017d0]
call fcn.1402bb344
mov qword [rbp + 0x8a0], r14
lea rax, [rbp + 0x8a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x140357a88]
mov rcx, qword [0x14042c9f0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d6fae
lea ecx, [rax + 0x10]
call fcn.1402b968c
mov rsi, rax
test rax, rax
je 0x1401d6fae
mov rcx, qword [rbp + 0x8a0]
mov qword [rax], r12
mov qword [rax + 8], rcx
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0xac0], rax
mov dword [rbp + 0xac8], r14d
mov qword [rbp + 0xad0], r14
lea rdx, [rbp + 0xac0]
mov rcx, rsi
call fcn.1400ebbb0
mov r14, qword [rbp + 0xad0]
test al, al
je 0x1401d6e44
mov eax, dword [rbp + 0xac8]
test eax, eax
jle 0x1401d6e44
mov rbx, r14
mov edi, eax
nop word [rax + rax]
xor r8d, r8d
lea rdx, str.ControlSet0
mov rcx, rbx
call fcn.1402019e0
test al, al
je 0x1401d6e35
mov rdx, rbx
lea rcx, [rbp + 0xaf0]
call fcn.140118cc0
add rbx, 0x10
dec rdi
jne 0x1401d6e10
mov edi, dword [rbp + 0xaf8]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
test r14, r14
je 0x1401d6e78
lea r9, [fcn.140005eb0]
mov r8d, dword [r14 - 8]
mov edx, 0x10
mov rcx, r14
call fcn.1402ba5c4
lea rcx, [r14 - 8]
call fcn.1402b99fc
test edi, edi
je 0x1401d6fa4
mov edx, edi
lea rcx, [rbp + 0x868]
call fcn.1400c7e30
xor eax, eax
mov r14d, eax
mov r12d, dword [rbp + 0x870]
cmp r12d, edi
mov rdi, qword [rbp + 0xb00]
jl 0x1401d707d
mov rbx, rdi
test rdi, rdi
je 0x1401d707d
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x758], rax
mov rsi, qword [rbp + 0x878]
xor r15d, r15d
lea r13, [0x140348ca0]
nop word [rax + rax]
mov qword [rbp + 0x2f8], r15
mov edx, dword [rbx + 0x1c]
test edx, edx
jne 0x1401d6ef7
mov qword [rbp + 0x2f0], r13
jmp 0x1401d6f22
lea rcx, [rbp + 0x2f0]
call fcn.1401ff260
movsxd r9, dword [rbx + 0x1c]
mov eax, dword [rbp + 0x2f8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x10]
mov rcx, qword [rbp + 0x2f0]
call fcn.1402bd21c
mov edx, dword [rbx + 0x1c]
lea rcx, [rbp + 0x2f0]
call fcn.140200570
nop
cmp r14d, r12d
jge 0x1401d6f72
mov edx, dword [rbp + 0x2fc]
mov rcx, rsi
call fcn.1401ff260
movsxd r9, dword [rbp + 0x2fc]
mov eax, dword [rsi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x2f0]
mov rcx, qword [rsi]
call fcn.1402bd21c
mov edx, dword [rbp + 0x2fc]
mov rcx, rsi
call fcn.140200570
nop
cmp dword [rbp + 0x2f8], 0
jle 0x1401d6f87
mov rcx, qword [rbp + 0x2f0]
call fcn.1402b9c20
inc r14d
add rsi, 0x10
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1401d6ee0
mov r13, qword [rsp + 0x68]
jmp 0x1401d707d
xor r14d, r14d
lea rbx, [0x140348ca0]
mov qword [rbp + 0x3f0], 0
mov edx, 0x11
lea rcx, [rbp + 0x3e8]
call fcn.1401ff260
mov eax, dword [rbp + 0x3f0]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.CurrentControlSet
mov rcx, qword [rbp + 0x3e8]
call fcn.1402bd21c
mov edx, 0x11
lea rcx, [rbp + 0x3e8]
call fcn.140200570
nop
mov ecx, 0x20
call fcn.1402b968c
mov rdi, rax
test rax, rax
je 0x1401d7020
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0
jmp 0x1401d7023
mov rdi, r14
mov edx, dword [rbp + 0x3f4]
lea rcx, [rdi + 0x10]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x3f4]
mov eax, dword [rdi + 0x18]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x3e8]
mov rcx, qword [rdi + 0x10]
call fcn.1402bd21c
mov edx, dword [rbp + 0x3f4]
lea rcx, [rdi + 0x10]
call fcn.140200570
mov qword [rdi], r14
mov qword [rdi + 8], r14
cmp dword [rbp + 0x3f0], 0
jle 0x1401d707d
mov rcx, qword [rbp + 0x3e8]
call fcn.1402b9c20
nop
test rdi, rdi
je 0x1401d70a4
mov rbx, qword [rdi]
cmp dword [rdi + 0x18], 0
jle 0x1401d7094
mov rcx, qword [rdi + 0x10]
call fcn.1402b9c20
mov rcx, rdi
call fcn.1402177e0
mov rdi, rbx
test rbx, rbx
jne 0x1401d7082
mov rcx, r13
call fcn.1401d4540
mov rcx, r13
call fcn.1401d3c40
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov qword [rbp + 0x210], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersion
mov qword [rbp + 0x218], rax
xor ebx, ebx
mov r14d, ebx
mov dword [rbp - 0x78], ebx
lea r12, [rbp + 0x210]
nop
mov rsi, qword [r12]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d7180
lea edx, [rax + 5]
lea rcx, [rbp + 0x2d0]
call fcn.1401ff260
mov eax, dword [rbp + 0x2d8]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x2d0]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x2d0]
call fcn.140200570
mov rdx, rsi
lea rcx, [rbp + 0x2d0]
call fcn.1401fd8b0
xor r9d, r9d
lea r8, [rbp + 0x2d0]
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.1401d5010
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x328], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x328]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x328], 0
jbe 0x1401d7382
xor r15d, r15d
lea r14, [0x140348ca0]
nop dword [rax]
nop word [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x2920]
mov edx, edi
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401d7369
lea rax, [rbp + 0x2920]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d7221
mov qword [rbp + 0x530], r15
test ebx, ebx
jne 0x1401d723f
mov qword [rbp + 0x528], r14
jmp 0x1401d726e
mov edx, ebx
lea rcx, [rbp + 0x528]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x530]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2920]
mov rcx, qword [rbp + 0x528]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x528]
call fcn.140200570
nop
lea r8, [0x140347f58]
mov edx, 0x400
lea rcx, [rbp + 0x2920]
call fcn.1402bbbd8
mov r8, rsi
mov edx, 0x400
lea rcx, [rbp + 0x2920]
call fcn.1402bbbd8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x2920]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d7352
lea edx, [rax + 4]
lea rcx, [rbp + 0x2d0]
call fcn.1401ff260
mov eax, dword [rbp + 0x2d8]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, str.HKU_
mov rcx, qword [rbp + 0x2d0]
call fcn.1402bd21c
mov edx, 4
lea rcx, [rbp + 0x2d0]
call fcn.140200570
lea rdx, [rbp + 0x2920]
lea rcx, [rbp + 0x2d0]
call fcn.1401fd8b0
mov r9, qword [rbp + 0x528]
lea r8, [rbp + 0x2d0]
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.1401d5010
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x530], 0
jle 0x1401d7370
mov rcx, qword [rbp + 0x528]
call fcn.1402b9c20
jmp 0x1401d7370
cmp eax, 0x103
je 0x1401d737c
cmp edi, dword [rbp + 0x328]
jb 0x1401d71f0
mov r14d, dword [rbp - 0x78]
xor ebx, ebx
inc r14d
mov dword [rbp - 0x78], r14d
add r12, 8
movsxd rax, r14d
cmp rax, 2
jb 0x1401d70e0
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0x210], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0x218], rax
mov eax, ebx
mov dword [rbp - 0x58], ebx
lea r15, [rbp + 0x210]
mov qword [rbp], r15
mov rcx, qword [rsp + 0x68]
nop dword [rax + rax]
mov r14, qword [r15]
mov r13d, ebx
mov rdi, rbx
mov qword [rsp + 0x70], rbx
cmp dword [rcx + 0x18], 0
jl 0x1401d77da
mov r15, qword [rsp + 0x68]
lea r12, [0x140348ca0]
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0xf0], 0
mov rsi, rbx
test r13d, r13d
setne sil
add rsi, 0xffffffff80000002
test rdi, rdi
jne 0x1401d7481
test r14, r14
je 0x1401d7517
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x1401d7430
test ebx, ebx
jle 0x1401d7517
mov edx, ebx
lea rcx, [rbp + 0xe8]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0xf0]
inc eax
movsxd rdx, eax
mov r8, r14
mov rcx, qword [rbp + 0xe8]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0xe8]
call fcn.140200570
jmp 0x1401d7517
mov rbx, rdi
shl rbx, 4
add rbx, qword [r15 + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xe8]
call fcn.1401ff260
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0xf0]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0xe8]
call fcn.1402bd21c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xe8]
call fcn.140200570
mov edx, dword [rbp + 0xf4]
inc edx
lea rcx, [rbp + 0xe8]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0xf4]
mov rax, qword [rbp + 0xe8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0xf4]
inc edx
lea rcx, [rbp + 0xe8]
call fcn.140200570
mov rdx, r14
lea rcx, [rbp + 0xe8]
call fcn.1401fd8b0
lea rax, [rbp + 0x8b8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xe8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d779f
mov dword [rbp + 0x3f8], 0x800
lea rax, [rbp + 0x3f8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x8520]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034e058]
mov rcx, qword [rbp + 0x8b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d7791
cmp dword [rbp + 0x3f8], eax
jbe 0x1401d7791
lea rax, [rbp + 0x8520]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d75a0
xor eax, eax
mov qword [rbp + 0x4d0], rax
test ebx, ebx
jne 0x1401d75c0
mov qword [rbp + 0x4c8], r12
jmp 0x1401d75ef
mov edx, ebx
lea rcx, [rbp + 0x4c8]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x4d0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x8520]
mov rcx, qword [rbp + 0x4c8]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x4c8]
call fcn.140200570
nop
lea rdx, [rbp + 0x4c8]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x4c8]
mov rcx, qword [r15 + 8]
call fcn.1400f92f0
mov r12, rax
test rax, rax
je 0x1401d7775
lea rdi, [0x140347f70]
cmp rsi, 0xffffffff80000002
lea rax, [0x140347f78]
cmove rdi, rax
test rdi, rdi
jne 0x1401d7651
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x28], rax
jmp 0x1401d7669
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401d7655
xor eax, eax
mov qword [rbp - 0x28], rax
test ebx, ebx
jne 0x1401d7676
lea rax, [0x140348ca0]
mov qword [rbp - 0x30], rax
jmp 0x1401d7698
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rbp - 0x30]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140200570
nop
mov edx, dword [rbp - 0x24]
inc edx
lea rcx, [rbp - 0x30]
call fcn.1401ff260
movsxd rcx, dword [rbp - 0x24]
mov rax, qword [rbp - 0x30]
mov edi, 0x5c
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x24]
inc edx
lea rcx, [rbp - 0x30]
call fcn.140200570
mov ebx, dword [rbp - 0x24]
add ebx, dword [rbp + 0xf4]
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1401ff260
movsxd r9, dword [rbp + 0xf4]
mov ecx, dword [rbp - 0x28]
movsxd rax, dword [rbp - 0x24]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x30]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0xe8]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140200570
mov edx, dword [rbp - 0x24]
inc edx
lea rcx, [rbp - 0x30]
call fcn.1401ff260
movsxd rcx, dword [rbp - 0x24]
mov rax, qword [rbp - 0x30]
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x24]
inc edx
lea rcx, [rbp - 0x30]
call fcn.140200570
lea rdx, [0x14034e058]
lea rcx, [rbp - 0x30]
call fcn.1401fd8b0
lea rdx, [rbp - 0x30]
mov rcx, r12
call fcn.1400ec540
nop
cmp dword [rbp - 0x28], 0
jle 0x1401d7770
mov rcx, qword [rbp - 0x30]
call fcn.1402b9c20
mov rdi, qword [rsp + 0x70]
cmp dword [rbp + 0x4d0], 0
jle 0x1401d778a
mov rcx, qword [rbp + 0x4c8]
call fcn.1402b9c20
lea r12, [0x140348ca0]
mov rcx, qword [rbp + 0x8b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0xf0], 0
jle 0x1401d77b4
mov rcx, qword [rbp + 0xe8]
call fcn.1402b9c20
inc r13d
inc rdi
mov qword [rsp + 0x70], rdi
cmp r13d, dword [r15 + 0x18]
mov ebx, 0
jle 0x1401d73f4
mov r15, qword [rbp]
mov eax, dword [rbp - 0x58]
mov rcx, qword [rsp + 0x68]
inc eax
mov dword [rbp - 0x58], eax
add r15, 8
mov qword [rbp], r15
cdqe
cmp rax, 2
mov eax, dword [rbp - 0x58]
jb 0x1401d73d0
lea r13, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0x210], r13
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0x218], rax
mov r14d, ebx
mov dword [rbp - 0x78], ebx
lea r12, [rbp + 0x210]
mov r15d, dword [rbp - 0x60]
lea r13, [0x140348ca0]
nop word [rax + rax]
lea r9, str.Notify
lea r8, [0x140347f58]
mov rdx, qword [r12]
lea rcx, [rbp + 0x828]
call fcn.1401fed20
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x828]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d7b60
mov dword [rbp + 0x2e0], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x2e0], 0
jbe 0x1401d7b54
mov r15, qword [rsp + 0x68]
xor r14d, r14d
nop dword [rax]
mov r9d, 0x400
lea r8, [rbp + 0x9520]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401d7b37
lea rax, [rbp + 0x898]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x9520]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d7b3e
mov dword [rbp + 0x734], 0x800
lea rax, [rbp + 0x734]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xcd20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DLLName
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d7b28
lea rax, [rbp + 0xcd20]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d7982
mov qword [rbp + 0x490], r14
test ebx, ebx
jne 0x1401d79a0
mov qword [rbp + 0x488], r13
jmp 0x1401d79cf
mov edx, ebx
lea rcx, [rbp + 0x488]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x490]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xcd20]
mov rcx, qword [rbp + 0x488]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x488]
call fcn.140200570
nop
lea rdx, [rbp + 0x488]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x488]
mov rcx, qword [r15 + 8]
call fcn.1400f92f0
mov rsi, rax
test rax, rax
je 0x1401d7b13
mov qword [rbp + 0x1c8], r14
mov edx, 5
lea rcx, [rbp + 0x1c0]
call fcn.1401ff260
mov ecx, dword [rbp + 0x1c8]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x1c0]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x1c0]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x834]
add ebx, dword [rbp + 0x1cc]
mov edx, ebx
lea rcx, [rbp + 0x1c0]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x834]
mov ecx, dword [rbp + 0x1c8]
movsxd rax, dword [rbp + 0x1cc]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1c0]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x828]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x1c0]
call fcn.140200570
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x1c0]
call fcn.1401fd8b0
lea rdx, [rbp + 0x9520]
lea rcx, [rbp + 0x1c0]
call fcn.1401fd8b0
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x1c0]
call fcn.1401fd8b0
lea rdx, [rbp + 0x1c0]
mov rcx, rsi
call fcn.1400ec540
nop
cmp dword [rbp + 0x1c8], 0
jle 0x1401d7b13
mov rcx, qword [rbp + 0x1c0]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x490], 0
jle 0x1401d7b28
mov rcx, qword [rbp + 0x488]
call fcn.1402b9c20
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401d7b3e
cmp eax, 0x103
je 0x1401d7b4a
cmp edi, dword [rbp + 0x2e0]
jb 0x1401d78e0
mov r15d, dword [rbp - 0x60]
mov r14d, dword [rbp - 0x78]
xor ebx, ebx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x830], 0
jle 0x1401d7b75
mov rcx, qword [rbp + 0x828]
call fcn.1402b9c20
inc r14d
mov dword [rbp - 0x78], r14d
add r12, 8
movsxd rax, r14d
cmp rax, 2
jb 0x1401d7830
mov qword [rbp + 0x558], rbx
mov qword [rbp + 0x560], rbx
call fcn.14012bf50
mov qword [rbp + 0x558], rax
lea r13, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0x78], r13
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0x80], rax
mov ecx, ebx
mov dword [rsp + 0x70], ebx
mov rax, rbx
mov qword [rbp], rbx
mov r14, qword [rsp + 0x68]
mov r12, qword [rbp + rax*8 + 0x78]
mov qword [rbp + 0x758], r12
mov esi, ebx
mov dword [rbp - 0x78], ebx
mov r13, rbx
mov qword [rbp - 0x68], rbx
cmp dword [r14 + 0x18], 0
jl 0x1401d8664
nop word [rax + rax]
lea rax, [0x140348ca0]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], 0
test r13, r13
jne 0x1401d7c91
mov rdi, 0xffffffff80000002
mov qword [rbp + 0xd0], rdi
test r12, r12
je 0x1401d7d37
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [r12 + rbx*2], 0
jne 0x1401d7c40
test ebx, ebx
jle 0x1401d7d35
mov edx, ebx
lea rcx, [rbp + 0xb8]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0xc0]
inc eax
movsxd rdx, eax
mov r8, r12
mov rcx, qword [rbp + 0xb8]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0xb8]
call fcn.140200570
jmp 0x1401d7d35
mov rdi, 0xffffffff80000003
mov qword [rbp + 0xd0], rdi
mov rbx, r13
shl rbx, 4
add rbx, qword [r14 + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xb8]
call fcn.1401ff260
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0xc0]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0xb8]
call fcn.1402bd21c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xb8]
call fcn.140200570
mov edx, dword [rbp + 0xc4]
inc edx
lea rcx, [rbp + 0xb8]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0xc4]
mov rax, qword [rbp + 0xb8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0xc4]
inc edx
lea rcx, [rbp + 0xb8]
call fcn.140200570
mov rdx, r12
lea rcx, [rbp + 0xb8]
call fcn.1401fd8b0
xor ebx, ebx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xb8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d8631
mov r12d, ebx
mov dword [rbp - 0x58], ebx
lea rsi, str.X6_
mov qword [rbp + 0x168], rsi
mov dword [rbp + 0x72c], 0x800
lea rax, [rbp + 0x72c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc520]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d85f4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xac0], xmm0
mov qword [rbp + 0xad0], rbx
lea rax, [rbp + 0xc520]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d7dd1
xor eax, eax
mov qword [rbp + 0x5f8], rax
test ebx, ebx
jne 0x1401d7df8
lea rax, [0x140348ca0]
mov qword [rbp + 0x5f0], rax
jmp 0x1401d7e27
mov edx, ebx
lea rcx, [rbp + 0x5f0]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x5f8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xc520]
mov rcx, qword [rbp + 0x5f0]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x5f0]
call fcn.140200570
nop
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x5f0]
call fcn.1401d1d60
mov ebx, eax
cmp dword [rbp + 0x5f8], 0
jle 0x1401d7e60
mov rcx, qword [rbp + 0x5f0]
call fcn.1402b9c20
mov rdi, qword [rbp + 0xac8]
test ebx, ebx
je 0x1401d85ab
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xaf0], xmm0
xor ecx, ecx
mov r14d, ecx
mov qword [rbp + 0xb00], rcx
mov r12, rdi
mov rax, qword [rbp + 0xac0]
sub r12, rax
sar r12, 4
mov rdi, qword [rbp + 0xaf8]
mov r13, qword [rbp + 0xaf0]
test r12, r12
je 0x1401d80b4
lea rsi, [rax + 0xc]
xor r15d, r15d
nop word [rax + rax]
mov qword [rbp + 0x1d8], r15
mov edx, dword [rsi]
test edx, edx
jne 0x1401d7edd
lea rbx, [0x140348ca0]
mov qword [rbp + 0x1d0], rbx
jmp 0x1401d7f0e
lea rcx, [rbp + 0x1d0]
call fcn.1401ff260
movsxd r9, dword [rsi]
mov eax, dword [rbp + 0x1d8]
inc eax
movsxd rdx, eax
mov r8, qword [rsi - 0xc]
mov rcx, qword [rbp + 0x1d0]
call fcn.1402bd21c
lea rbx, [0x140348ca0]
mov edx, dword [rsi]
lea rcx, [rbp + 0x1d0]
call fcn.140200570
nop
mov r8d, 1
lea rdx, [0x14034f004]
lea rcx, [rbp + 0x1d0]
call fcn.1402019e0
test al, al
jne 0x1401d8087
lea rdx, [rbp + 0x1d0]
call fcn.1401d64e0
lea rax, [rbp + 0x1d0]
cmp rax, rdi
jae 0x1401d7ffb
lea rax, [rbp + 0x1d0]
cmp r13, rax
ja 0x1401d7ffb
lea rbx, [rbp + 0x1d0]
sub rbx, r13
cmp rdi, r14
jne 0x1401d7f9a
lea rcx, [rbp + 0xaf0]
call fcn.1400c8e70
mov r14, qword [rbp + 0xb00]
mov rdi, qword [rbp + 0xaf8]
mov r13, qword [rbp + 0xaf0]
and rbx, 0xfffffffffffffff0
add rbx, r13
mov qword [rbp + 0x710], rdi
mov qword [rbp + 0x210], rdi
test rdi, rdi
je 0x1401d7ff6
mov qword [rdi + 8], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d7fcb
lea rax, [0x140348ca0]
mov qword [rdi], rax
jmp 0x1401d7fea
mov rcx, rdi
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rdi]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
mov rcx, rdi
call fcn.140200570
nop
jmp 0x1401d807c
cmp rdi, r14
jne 0x1401d8021
lea rcx, [rbp + 0xaf0]
call fcn.1400c8e70
mov r14, qword [rbp + 0xb00]
mov rdi, qword [rbp + 0xaf8]
mov r13, qword [rbp + 0xaf0]
mov qword [rbp + 0x210], rdi
mov qword [rbp + 0x710], rdi
test rdi, rdi
je 0x1401d807c
mov qword [rdi + 8], r15
mov edx, dword [rbp + 0x1dc]
test edx, edx
jne 0x1401d8047
mov qword [rdi], rbx
jmp 0x1401d806d
mov rcx, rdi
call fcn.1401ff260
movsxd r9, dword [rbp + 0x1dc]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x1d0]
mov rcx, qword [rdi]
call fcn.1402bd21c
mov edx, dword [rbp + 0x1dc]
mov rcx, rdi
call fcn.140200570
nop
add rdi, 0x10
mov qword [rbp + 0xaf8], rdi
cmp dword [rbp + 0x1d8], 0
jle 0x1401d809c
mov rcx, qword [rbp + 0x1d0]
call fcn.1402b9c20
add rsi, 0x10
dec r12
jne 0x1401d7ec0
mov r15d, dword [rbp - 0x60]
mov rsi, qword [rbp + 0x168]
mov rax, rdi
sub rax, r13
sar rax, 4
test rax, rax
je 0x1401d8553
lea r12, [r13 + 0xc]
mov rbx, rax
mov qword [rbp - 0x60], rax
mov r13, rax
mov rdi, qword [rbp + 0xd0]
nop dword [rax]
mov qword [rbp + 0x3b8], 0
mov edx, dword [r12]
test edx, edx
jne 0x1401d8103
lea rax, [0x140348ca0]
mov qword [rbp + 0x3b0], rax
jmp 0x1401d812f
lea rcx, [rbp + 0x3b0]
call fcn.1401ff260
movsxd r9, dword [r12]
mov eax, dword [rbp + 0x3b8]
inc eax
movsxd rdx, eax
mov r8, qword [r12 - 0xc]
mov rcx, qword [rbp + 0x3b0]
call fcn.1402bd21c
mov edx, dword [r12]
lea rcx, [rbp + 0x3b0]
call fcn.140200570
nop
mov r8b, 1
lea rdx, [rbp + 0x3b0]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call fcn.1400f92f0
mov r14, rax
test rax, rax
je 0x1401d850f
lea rsi, [0x140347f70]
cmp rdi, 0xffffffff80000002
lea rax, [0x140347f78]
cmove rsi, rax
test rsi, rsi
jne 0x1401d818c
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x38], rax
jmp 0x1401d81a4
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1401d8190
xor eax, eax
mov qword [rbp - 0x38], rax
test ebx, ebx
jne 0x1401d81b1
lea rax, [0x140348ca0]
mov qword [rbp - 0x40], rax
jmp 0x1401d81d3
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp - 0x38]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp - 0x40]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.140200570
nop
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1401ff260
movsxd rcx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x40]
mov esi, 0x5c
mov word [rax + rcx*2], si
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.140200570
mov ebx, dword [rbp - 0x34]
add ebx, dword [rbp + 0xc4]
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1401ff260
movsxd r9, dword [rbp + 0xc4]
mov ecx, dword [rbp - 0x38]
movsxd rax, dword [rbp - 0x34]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x40]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0xb8]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.140200570
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1401ff260
movsxd rcx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x40]
mov word [rax + rcx*2], si
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.140200570
mov rsi, qword [rbp + 0x168]
mov rdx, qword [rsi]
lea rcx, [rbp - 0x40]
call fcn.1401fd8b0
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0xa18]
call fcn.1400d44f0
nop
xor r8d, r8d
lea rdx, str.cmd.exe
mov rcx, rax
call fcn.1401ff540
movzx ebx, al
cmp dword [rbp + 0xa20], 0
jle 0x1401d82d0
mov rcx, qword [rbp + 0xa18]
call fcn.1402b9c20
test bl, bl
je 0x1401d8493
cmp rdi, 0xffffffff80000002
jne 0x1401d833b
xor eax, eax
mov qword [rbp + 0x648], rax
lea edx, [rax + 4]
lea rcx, [rbp + 0x640]
call fcn.1401ff260
mov eax, dword [rbp + 0x648]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, [0x140347f78]
mov rcx, qword [rbp + 0x640]
call fcn.1402bd21c
mov edx, 4
lea rcx, [rbp + 0x640]
call fcn.140200570
lea rbx, [rbp + 0x640]
or r15d, 1
jmp 0x1401d836a
mov eax, dword [rbp - 0x78]
dec eax
movsxd r8, eax
shl r8, 4
mov rax, qword [rsp + 0x68]
add r8, qword [rax + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0x958]
call fcn.1401fddd0
mov rbx, rax
or r15d, 2
mov dword [rbp - 0x70], r15d
xor eax, eax
mov qword [rbp + 0x580], rax
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d838e
lea rax, [0x140348ca0]
mov qword [rbp + 0x578], rax
jmp 0x1401d83b8
lea rcx, [rbp + 0x578]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x580]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x578]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x578]
call fcn.140200570
nop
test r15b, 2
je 0x1401d83ec
and r15d, 0xfffffffd
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0x960], 0
jle 0x1401d83ec
mov rcx, qword [rbp + 0x958]
call fcn.1402b9c20
nop
test r15b, 1
je 0x1401d840f
and r15d, 0xfffffffe
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0x648], 0
jle 0x1401d840f
mov rcx, qword [rbp + 0x640]
call fcn.1402b9c20
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x578]
lea rcx, [rbp + 0xa98]
call fcn.1401ced30
nop
mov rdx, rax
lea rcx, [rbp + 0x558]
call fcn.14015a570
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0x558]
call fcn.1401cee90
nop
cmp dword [rbp + 0xab0], 0
jle 0x1401d8468
mov rcx, qword [rbp + 0xaa8]
call fcn.1402b9c20
cmp dword [rbp + 0xaa0], 0
jle 0x1401d847e
mov rcx, qword [rbp + 0xa98]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x580], 0
jle 0x1401d8493
mov rcx, qword [rbp + 0x578]
call fcn.1402b9c20
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.1400ec540
cmp r13, 2
jb 0x1401d84fc
lea rdx, str.shell
mov rcx, qword [rsi]
call fcn.1402b9aac
test eax, eax
jne 0x1401d84c1
lea rdx, [0x14034d958]
jmp 0x1401d84db
lea rdx, str.userinit
mov rcx, qword [rsi]
call fcn.1402b9aac
test eax, eax
jne 0x1401d84fc
lea rdx, str.userinit.exe
xor r8d, r8d
lea rcx, [rbp + 0x3b0]
call fcn.1401ff110
test al, al
jne 0x1401d84fc
movabs rax, 0x1000000000000
or qword [r14 + 0x40], rax
cmp dword [rbp - 0x38], 0
jle 0x1401d850b
mov rcx, qword [rbp - 0x40]
call fcn.1402b9c20
mov rbx, qword [rbp - 0x60]
cmp dword [rbp + 0x3b8], 0
jle 0x1401d8524
mov rcx, qword [rbp + 0x3b0]
call fcn.1402b9c20
add r12, 0x10
dec rbx
mov qword [rbp - 0x60], rbx
jne 0x1401d80e0
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov rdi, qword [rbp + 0xaf8]
mov r13, qword [rbp + 0xaf0]
test r13, r13
je 0x1401d85a0
mov rbx, r13
cmp r13, rdi
je 0x1401d8577
cmp dword [rbx + 8], 0
jle 0x1401d856e
mov rcx, qword [rbx]
call fcn.1402b9c20
add rbx, 0x10
cmp rbx, rdi
jne 0x1401d8560
mov rcx, r13
call fcn.1402177e0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xaf0], xmm0
xor ebx, ebx
mov qword [rbp + 0xb00], rbx
mov rdi, qword [rbp + 0xac8]
mov r12d, dword [rbp - 0x58]
jmp 0x1401d85ad
mov rdi, qword [rbp + 0xac8]
mov r12d, dword [rbp - 0x58]
xor ebx, ebx
mov r14, qword [rbp + 0xac0]
test r14, r14
je 0x1401d85f4
mov rbx, r14
cmp r14, rdi
je 0x1401d85d8
cmp dword [rbx + 8], 0
jle 0x1401d85cf
mov rcx, qword [rbx]
call fcn.1402b9c20
add rbx, 0x10
cmp rbx, rdi
jne 0x1401d85c1
mov rcx, r14
call fcn.1402177e0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xac0], xmm0
xor ebx, ebx
mov qword [rbp + 0xad0], rbx
inc r12d
mov dword [rbp - 0x58], r12d
add rsi, 8
mov qword [rbp + 0x168], rsi
movsxd rax, r12d
cmp rax, 4
jb 0x1401d7d76
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [rbp - 0x78]
mov r14, qword [rsp + 0x68]
mov r12, qword [rbp + 0x758]
mov r13, qword [rbp - 0x68]
cmp dword [rbp + 0xc0], 0
jle 0x1401d8646
mov rcx, qword [rbp + 0xb8]
call fcn.1402b9c20
inc esi
mov dword [rbp - 0x78], esi
inc r13
mov qword [rbp - 0x68], r13
cmp esi, dword [r14 + 0x18]
jle 0x1401d7c00
mov rax, qword [rbp]
mov ecx, dword [rsp + 0x70]
inc ecx
mov dword [rsp + 0x70], ecx
inc rax
mov qword [rbp], rax
movsxd rax, ecx
cmp rax, 2
mov rax, qword [rbp]
jb 0x1401d7bd2
lea rax, str.SOFTWAREMicrosoftCommand_Processor
mov qword [rbp + 0x78], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftCommand_Processor
mov qword [rbp + 0x80], rax
mov ecx, ebx
mov dword [rsp + 0x70], ebx
lea rax, [rbp + 0x78]
mov qword [rbp + 0x168], rax
mov rsi, qword [rsp + 0x68]
mov r12, qword [rax]
mov r13d, ebx
mov rdi, rbx
mov qword [rbp], rbx
cmp dword [rsi + 0x18], 0
jl 0x1401d8cb2
nop dword [rax + rax]
lea rax, [0x140348ca0]
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], 0
test rdi, rdi
jne 0x1401d8753
mov r14, 0xffffffff80000002
test r12, r12
je 0x1401d87f0
or rbx, 0xffffffffffffffff
inc rbx
cmp word [r12 + rbx*2], 0
jne 0x1401d8702
test ebx, ebx
jle 0x1401d87f0
mov edx, ebx
lea rcx, [rbp + 0xd8]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0xe0]
inc eax
movsxd rdx, eax
mov r8, r12
mov rcx, qword [rbp + 0xd8]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0xd8]
call fcn.140200570
jmp 0x1401d87f0
mov r14, 0xffffffff80000003
mov rbx, rdi
shl rbx, 4
add rbx, qword [rsi + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xd8]
call fcn.1401ff260
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0xe0]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0xd8]
call fcn.1402bd21c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xd8]
call fcn.140200570
mov edx, dword [rbp + 0xe4]
inc edx
lea rcx, [rbp + 0xd8]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0xe4]
mov rax, qword [rbp + 0xd8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0xe4]
inc edx
lea rcx, [rbp + 0xd8]
call fcn.140200570
mov rdx, r12
lea rcx, [rbp + 0xd8]
call fcn.1401fd8b0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xd8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d8c6c
mov dword [rbp + 0x7c0], 0x800
lea rax, [rbp + 0x7c0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa520]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AutoRun
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d8c60
lea rax, [rbp + 0xa520]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d8870
xor eax, eax
mov qword [rbp + 0x4b0], rax
test ebx, ebx
jne 0x1401d8897
lea rax, [0x140348ca0]
mov qword [rbp + 0x4a8], rax
jmp 0x1401d88c6
mov edx, ebx
lea rcx, [rbp + 0x4a8]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x4b0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xa520]
mov rcx, qword [rbp + 0x4a8]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x4a8]
call fcn.140200570
nop
lea rdx, [rbp + 0x4a8]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x4a8]
mov rcx, qword [rsi + 8]
call fcn.1400f92f0
mov rsi, rax
test rax, rax
je 0x1401d8c46
lea rdi, [0x140347f70]
cmp r14, 0xffffffff80000002
lea rax, [0x140347f78]
cmove rdi, rax
test rdi, rdi
jne 0x1401d8928
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x18], rax
jmp 0x1401d8944
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401d8930
xor eax, eax
mov qword [rbp - 0x18], rax
test ebx, ebx
jne 0x1401d8951
lea rax, [0x140348ca0]
mov qword [rbp - 0x20], rax
jmp 0x1401d8973
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp - 0x18]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rbp - 0x20]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.140200570
nop
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1401ff260
movsxd rcx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x20]
mov edi, 0x5c
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.140200570
mov ebx, dword [rbp - 0x14]
add ebx, dword [rbp + 0xe4]
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1401ff260
movsxd r9, dword [rbp + 0xe4]
mov ecx, dword [rbp - 0x18]
movsxd rax, dword [rbp - 0x14]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x20]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0xd8]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.140200570
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1401ff260
movsxd rcx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x20]
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.140200570
lea rdx, str.AutoRun
lea rcx, [rbp - 0x20]
call fcn.1401fd8b0
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.1400ec540
cmp r14, 0xffffffff80000002
jne 0x1401d8a9a
xor edi, edi
mov qword [rbp + 0x658], rdi
lea edx, [rdi + 4]
lea rcx, [rbp + 0x650]
call fcn.1401ff260
mov eax, dword [rbp + 0x658]
inc eax
movsxd rdx, eax
lea r9d, [rdi + 4]
lea r8, [0x140347f78]
mov rcx, qword [rbp + 0x650]
call fcn.1402bd21c
lea edx, [rdi + 4]
lea rcx, [rbp + 0x650]
call fcn.140200570
lea rbx, [rbp + 0x650]
or r15d, 4
jmp 0x1401d8ac8
lea eax, [r13 - 1]
movsxd r8, eax
shl r8, 4
mov rax, qword [rsp + 0x68]
add r8, qword [rax + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0xa58]
call fcn.1401fddd0
mov rbx, rax
or r15d, 8
mov dword [rbp - 0x70], r15d
mov qword [rbp + 0x510], 0
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d8aee
lea rax, [0x140348ca0]
mov qword [rbp + 0x508], rax
jmp 0x1401d8b18
lea rcx, [rbp + 0x508]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x510]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x508]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x508]
call fcn.140200570
nop
test r15b, 8
je 0x1401d8b4c
and r15d, 0xfffffff7
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0xa60], 0
jle 0x1401d8b4c
mov rcx, qword [rbp + 0xa58]
call fcn.1402b9c20
nop
test r15b, 4
je 0x1401d8b6f
and r15d, 0xfffffffb
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0x658], 0
jle 0x1401d8b6f
mov rcx, qword [rbp + 0x650]
call fcn.1402b9c20
mov rax, qword [rbp + 0x558]
mov rbx, qword [rax + 8]
mov rdi, rax
cmp byte [rbx + 0x19], 0
jne 0x1401d8bed
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbp + 0x508]
mov rcx, qword [rbx + 0x20]
call fcn.1402b9aac
test eax, eax
jns 0x1401d8baa
mov rbx, qword [rbx + 0x10]
jmp 0x1401d8bb0
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401d8b90
mov rax, qword [rbp + 0x558]
cmp rdi, rax
je 0x1401d8bed
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rbp + 0x508]
call fcn.1402b9aac
test eax, eax
mov rax, qword [rbp + 0x558]
js 0x1401d8bed
mov qword [rbp + 0x918], rdi
lea rdx, [rbp + 0x918]
jmp 0x1401d8bfb
mov qword [rbp + 0x920], rax
lea rdx, [rbp + 0x920]
mov rdx, qword [rdx]
cmp rdx, rax
je 0x1401d8c1d
add rdx, 0x30
mov rcx, rsi
call fcn.1400ec540
movabs rax, 0x1000000000000
or qword [rsi + 0x40], rax
cmp dword [rbp + 0x510], 0
jle 0x1401d8c33
mov rcx, qword [rbp + 0x508]
call fcn.1402b9c20
nop
cmp dword [rbp - 0x18], 0
jle 0x1401d8c42
mov rcx, qword [rbp - 0x20]
call fcn.1402b9c20
mov rdi, qword [rbp]
cmp dword [rbp + 0x4b0], 0
jle 0x1401d8c5b
mov rcx, qword [rbp + 0x4a8]
call fcn.1402b9c20
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0xe0], 0
jle 0x1401d8c81
mov rcx, qword [rbp + 0xd8]
call fcn.1402b9c20
inc r13d
inc rdi
mov qword [rbp], rdi
cmp r13d, dword [rsi + 0x18]
jle 0x1401d86d0
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x60], r15d
mov rax, qword [rbp + 0x168]
mov ecx, dword [rsp + 0x70]
xor ebx, ebx
inc ecx
mov dword [rsp + 0x70], ecx
add rax, 8
mov qword [rbp + 0x168], rax
movsxd rax, ecx
cmp rax, 2
mov rax, qword [rbp + 0x168]
jb 0x1401d86b1
mov edx, 0x3b
lea rcx, [rsp + 0x78]
call fcn.1401ff260
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0x3b
lea r8, str.SYSTEMCurrentControlSetControlSession_ManagerSubSystems
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, 0x3b
lea rcx, [rsp + 0x78]
call fcn.140200570
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9072
mov dword [rbp + 0x800], 0x800
lea rax, [rbp + 0x800]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x5d20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1403519a8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d9067
lea rax, [rbp + 0x5d20]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d8d90
xor r14d, r14d
mov qword [rbp + 0x398], r14
test ebx, ebx
jne 0x1401d8db8
lea r13, [0x140348ca0]
mov qword [rbp + 0x390], r13
jmp 0x1401d8dee
mov edx, ebx
lea rcx, [rbp + 0x390]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x398]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x5d20]
mov rcx, qword [rbp + 0x390]
call fcn.1402bd21c
lea r13, [0x140348ca0]
mov edx, ebx
lea rcx, [rbp + 0x390]
call fcn.140200570
nop
mov edi, r14d
movabs r12, 0x400100100000000
mov r15, qword [rsp + 0x68]
nop
mov r9d, dword [rbp + 0x39c]
sub r9d, edi
mov dword [rsp + 0x20], r14d
mov r8d, edi
lea rdx, str._ServerDll
lea rcx, [rbp + 0x390]
call fcn.1401ffd60
mov edi, eax
test eax, eax
jle 0x1401d904a
add edi, 0xb
mov rsi, qword [0x14041a158]
test rsi, rsi
jne 0x1401d8e5a
mov ebx, r14d
mov qword [rbp + 0x1b8], r14
jmp 0x1401d8e75
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1401d8e60
mov qword [rbp + 0x1b8], r14
test ebx, ebx
jne 0x1401d8e7e
mov qword [rbp + 0x1b0], r13
jmp 0x1401d8ea9
mov edx, ebx
lea rcx, [rbp + 0x1b0]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x1b8]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp + 0x1b0]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x1b0]
call fcn.140200570
nop
cmp edi, dword [rbp + 0x39c]
jge 0x1401d8f21
mov edx, edi
lea rcx, [rbp + 0x390]
call fcn.1401fd730
movzx ebx, ax
inc edi
cmp ax, 0x3a
ja 0x1401d8edf
bt r12, rbx
jb 0x1401d8f21
mov edx, dword [rbp + 0x1bc]
inc edx
lea rcx, [rbp + 0x1b0]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x1bc]
mov rax, qword [rbp + 0x1b0]
mov word [rax + rcx*2], bx
mov edx, dword [rbp + 0x1bc]
inc edx
lea rcx, [rbp + 0x1b0]
call fcn.140200570
cmp edi, dword [rbp + 0x39c]
jl 0x1401d8ec0
cmp dword [rbp + 0x1bc], 0
jle 0x1401d9035
lea rdx, [rbp + 0x1b0]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x1b0]
mov rcx, qword [r15 + 8]
call fcn.1400f92f0
mov rsi, rax
test rax, rax
je 0x1401d9035
mov qword [rbp + 0x310], r14
mov edx, 5
lea rcx, [rbp + 0x308]
call fcn.1401ff260
mov ecx, dword [rbp + 0x310]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x308]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x308]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x314]
add ebx, dword [rbp - 0x7c]
mov edx, ebx
lea rcx, [rbp + 0x308]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x310]
movsxd rax, dword [rbp + 0x314]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x308]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x308]
call fcn.140200570
lea rdx, [0x140365df0]
lea rcx, [rbp + 0x308]
call fcn.1401fd8b0
lea rdx, [rbp + 0x308]
mov rcx, rsi
call fcn.1400ec540
nop
cmp dword [rbp + 0x310], 0
jle 0x1401d9035
mov rcx, qword [rbp + 0x308]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x1b8], 0
jle 0x1401d904a
mov rcx, qword [rbp + 0x1b0]
call fcn.1402b9c20
test edi, edi
jns 0x1401d8e10
cmp dword [rbp + 0x398], 0
jle 0x1401d9067
mov rcx, qword [rbp + 0x390]
call fcn.1402b9c20
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0x78], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0x80], rax
xor esi, esi
mov r12d, esi
lea r13, [rbp + 0x78]
nop dword [rax]
nop dword [rax + rax]
mov r14, qword [r13]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d93b3
mov word [rbp + 0xd520], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0xd522]
call fcn.1402c22a0
mov dword [rbp + 0x778], 0x800
lea rax, [rbp + 0x778]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xd520]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140365dd0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d93a8
lea rdi, [rbp + 0xd520]
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14034d880]
mov rcx, rdi
call fcn.1402beca8
mov rsi, rax
mov r8, rdi
mov edx, 0x400
lea rcx, [rbp + 0x3120]
test rax, rax
je 0x1401d9199
mov rbx, rax
sub rbx, rdi
sar rbx, 1
mov r9, rbx
call fcn.1402bece0
add rbx, rbx
cmp rbx, 0x800
jae 0x1401d93c8
xor eax, eax
mov word [rbp + rbx + 0x3120], ax
lea rdi, [rsi + 2]
xor esi, esi
jmp 0x1401d91a2
call fcn.1402b96f8
xor esi, esi
mov edi, esi
lea rcx, [rbp + 0x3120]
or rdx, 0xffffffffffffffff
mov rax, rdx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401d91b0
test rax, rax
je 0x1401d939f
lea rax, [rbp + 0x3120]
mov rbx, rdx
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d91d0
mov qword [rbp + 0x5a0], 0
test ebx, ebx
jne 0x1401d91f9
lea rax, [0x140348ca0]
mov qword [rbp + 0x598], rax
jmp 0x1401d9228
mov edx, ebx
lea rcx, [rbp + 0x598]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x5a0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x3120]
mov rcx, qword [rbp + 0x598]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x598]
call fcn.140200570
nop
lea rdx, [rbp + 0x598]
call fcn.1401d64e0
lea rax, [rbp + 0x3120]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d9250
mov qword [rbp + 0x5d8], 0
test ebx, ebx
jne 0x1401d9279
lea rax, [0x140348ca0]
mov qword [rbp + 0x5d0], rax
jmp 0x1401d92a8
mov edx, ebx
lea rcx, [rbp + 0x5d0]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x5d8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x3120]
mov rcx, qword [rbp + 0x5d0]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x5d0]
call fcn.140200570
nop
mov r8b, 1
lea rdx, [rbp + 0x5d0]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call fcn.1400f92f0
mov rbx, rax
cmp dword [rbp + 0x5d8], 0
jle 0x1401d92e7
mov rcx, qword [rbp + 0x5d0]
call fcn.1402b9c20
test rbx, rbx
je 0x1401d938a
mov qword [rbp + 0x4f0], 0
mov edx, 5
lea rcx, [rbp + 0x4e8]
call fcn.1401ff260
mov eax, dword [rbp + 0x4f0]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x4e8]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x4e8]
call fcn.140200570
nop
mov rdx, r14
lea rcx, [rbp + 0x4e8]
call fcn.1401fd8b0
lea rdx, [0x140365db0]
lea rcx, [rbp + 0x4e8]
call fcn.1401fd8b0
lea rdx, [rbp + 0x4e8]
mov rcx, rbx
call fcn.1400ec540
nop
cmp dword [rbp + 0x4f0], 0
jle 0x1401d938a
mov rcx, qword [rbp + 0x4e8]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x5a0], 0
jle 0x1401d939f
mov rcx, qword [rbp + 0x598]
call fcn.1402b9c20
test rdi, rdi
jne 0x1401d9140
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r12d
add r13, 8
movsxd rax, r12d
cmp rax, 2
jae 0x1401d93ce
jmp 0x1401d90a0
call fcn.1402bb5f0
int3
mov eax, dword [rbp + 0x870]
test eax, eax
jle 0x1401d96e6
mov r14, qword [rbp + 0x878]
mov r12d, eax
mov r15, qword [rsp + 0x68]
nop dword [rax + rax]
mov r8, qword [r14]
lea rdx, str.SYSTEM_sControlSession_ManagerAppCertDlls
lea rcx, [rbp + 0x978]
call fcn.1401ff700
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x80]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x78]
call fcn.140200570
nop
cmp dword [rbp + 0x980], 0
jle 0x1401d9452
mov rcx, qword [rbp + 0x978]
call fcn.1402b9c20
mov eax, dword [0x14042c9e0]
lea rbx, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401d948a
or eax, 1
mov dword [0x14042c9e0], eax
mov qword [0x14042c9e8], rbx
mov qword [0x14042c9f0], 0xffffffff80000002
lea rcx, [0x1403017d0]
call fcn.1402bb344
mov qword [rbp + 0x8a8], rsi
lea rax, [rbp + 0x8a8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x14042c9f0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d96d9
lea ecx, [rax + 0x10]
call fcn.1402b968c
mov rdi, rax
test rax, rax
je 0x1401d94e0
mov rax, qword [rbp + 0x8a8]
mov qword [rdi], rbx
mov qword [rdi + 8], rax
jmp 0x1401d94e3
mov rdi, rsi
test rdi, rdi
je 0x1401d96d9
lea rbx, [0x140348ca0]
mov qword [rbp + 0x610], rbx
mov qword [rbp + 0x618], 0
lea r8, [rbp + 0x610]
lea rdx, str.AppSecDll
mov rcx, rdi
call fcn.1400d8b50
test al, al
je 0x1401d96b6
mov qword [rbp + 0x470], 0
mov edx, dword [rbp + 0x61c]
test edx, edx
jne 0x1401d9541
mov qword [rbp + 0x468], rbx
jmp 0x1401d9578
lea rcx, [rbp + 0x468]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x61c]
mov eax, dword [rbp + 0x470]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x610]
mov rcx, qword [rbp + 0x468]
call fcn.1402bd21c
mov edx, dword [rbp + 0x61c]
lea rcx, [rbp + 0x468]
call fcn.140200570
nop
lea rdx, [rbp + 0x468]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x468]
mov rcx, qword [r15 + 8]
call fcn.1400f92f0
mov rsi, rax
test rax, rax
je 0x1401d969f
xor eax, eax
mov qword [rbp + 0x278], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x270]
call fcn.1401ff260
mov ecx, dword [rbp + 0x278]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x270]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x270]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x27c]
add ebx, dword [rbp - 0x7c]
mov edx, ebx
lea rcx, [rbp + 0x270]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x278]
movsxd rax, dword [rbp + 0x27c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x270]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x270]
call fcn.140200570
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x270]
call fcn.1401fd8b0
lea rdx, str.AppSecDll
lea rcx, [rbp + 0x270]
call fcn.1401fd8b0
lea rdx, [rbp + 0x270]
mov rcx, rsi
call fcn.1400ec540
nop
cmp dword [rbp + 0x278], 0
jle 0x1401d969f
mov rcx, qword [rbp + 0x270]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x470], 0
jle 0x1401d96b4
mov rcx, qword [rbp + 0x468]
call fcn.1402b9c20
xor esi, esi
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x618], 0
jle 0x1401d96d9
mov rcx, qword [rbp + 0x610]
call fcn.1402b9c20
add r14, 0x10
dec r12
jne 0x1401d93f0
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov qword [rbp + 0x78], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov qword [rbp + 0x80], rax
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x70], ebx
lea rdi, [rbp + 0x78]
mov qword [rbp - 0x68], rdi
mov r13, qword [rdi]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9c31
mov dword [rbp + 0x320], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x320]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r12d, r14d
cmp dword [rbp + 0x320], 0
jbe 0x1401d9c26
mov r15, qword [rsp + 0x68]
nop dword [rax]
mov r9d, 0x400
lea r8, [rbp + 0x4520]
mov edx, r12d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc r12d
test eax, eax
jne 0x1401d9c0a
lea edx, [rax + 0x2e]
lea rcx, [rbp + 0x4520]
call fcn.1402bcdb4
test rax, rax
je 0x1401d9c11
lea rax, [rbp + 0x888]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x4520]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9bfb
mov dword [rbp + 0x7e0], 0x800
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6d20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140362eb8]
mov rcx, qword [rbp + 0x888]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d9bfb
lea rax, [rbp + 0x6d20]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d9860
mov qword [rbp + 0x480], 0
test ebx, ebx
jne 0x1401d9889
lea rax, [0x140348ca0]
mov qword [rbp + 0x478], rax
jmp 0x1401d98b8
mov edx, ebx
lea rcx, [rbp + 0x478]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x480]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x6d20]
mov rcx, qword [rbp + 0x478]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x478]
call fcn.140200570
nop
lea rdx, [rbp + 0x478]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x478]
mov rcx, qword [r15 + 8]
call fcn.1400f92f0
mov rbx, rax
test rax, rax
je 0x1401d9be6
mov qword [rbp + 0x388], 0
mov edx, 5
lea rcx, [rbp + 0x380]
call fcn.1401ff260
mov ecx, dword [rbp + 0x388]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x380]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x380]
call fcn.140200570
nop
mov rdx, r13
lea rcx, [rbp + 0x380]
call fcn.1401fd8b0
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x380]
call fcn.1401fd8b0
lea rdx, [rbp + 0x4520]
lea rcx, [rbp + 0x380]
call fcn.1401fd8b0
lea rdx, str.Debugger
lea rcx, [rbp + 0x380]
call fcn.1401fd8b0
lea rdx, [rbp + 0x380]
mov rcx, rbx
call fcn.1400ec540
mov rbx, qword [r15 + 8]
mov eax, dword [0x14041c4a0]
cmp eax, 0xffffffff
jne 0x1401d99e1
call fcn.140113300
test al, al
je 0x1401d99bf
mov dword [0x14041c4a0], 1
jmp 0x1401d99ea
cmp qword [rbx + 0x2f0], 0
je 0x1401d99d5
mov dword [0x14041c4a0], 1
jmp 0x1401d99ea
mov dword [0x14041c4a0], r14d
jmp 0x1401d9bd0
cmp eax, 1
jne 0x1401d9bd0
lea r8, str.ImageFileExecutionOptions
lea rdx, str.Policies__s_Title
lea rcx, [rbp + 0xa38]
call fcn.1401ff700
nop
mov rdx, rax
lea rcx, [rbp + 0x908]
call fcn.1400f57b0
nop
cmp dword [rbp + 0xa40], 0
jle 0x1401d9a2a
mov rcx, qword [rbp + 0xa38]
call fcn.1402b9c20
lea r8, [rbp + 0x4520]
mov rdx, qword [rbp + 0x908]
lea rcx, [rbp + 0x928]
call fcn.1401ff700
nop
mov ecx, 0x90
call fcn.1402b968c
mov qword [rbp + 0x210], rax
test rax, rax
je 0x1401d9a76
lea r9, [rbp + 0x928]
lea rdx, [rbp + 0x380]
mov rcx, rax
call fcn.1401f8000
mov rbx, rax
jmp 0x1401d9a79
mov rbx, r14
lea rdx, [rbx + 8]
mov rcx, qword [r15 + 8]
call fcn.140111ef0
movzx edi, al
test al, al
sete r14b
movzx edx, r14b
mov rcx, rbx
call fcn.1400d7a70
mov rdx, rbx
mov rcx, qword [r15 + 8]
call fcn.1400f9530
mov rcx, rbx
call fcn.1400d9610
mov rsi, rax
mov rcx, rax
call fcn.1400e3880
mov dword [rbp - 0x78], 7
movzx edx, byte [0x14042c169]
mov byte [rsp + 0x20], dl
lea r9, [rbp - 0x78]
lea rdx, [rbp + 0xba0]
lea rcx, [rsi + 0x18]
call fcn.1400e3ae0
mov dword [rbp - 0x78], 8
movzx edx, byte [0x14042c169]
mov byte [rsp + 0x20], dl
lea r9, [rbp - 0x78]
lea rdx, [rbp + 0x758]
lea rcx, [rsi + 0x18]
call fcn.1400e3ae0
xor eax, eax
mov edx, eax
test dil, dil
setne dl
add edx, 7
mov rcx, rsi
call fcn.1400e37a0
cmp byte [rsi + 0xa], 1
je 0x1401d9b59
mov byte [rsi + 0xa], 1
cmp byte [rsi + 8], 0
je 0x1401d9b59
mov rax, qword [rsi]
mov rdx, qword [0x14042bb58]
mov qword [rbp + 0x998], rax
mov dword [rbp + 0x9a0], 1
lea rcx, [rdx + 0x388]
lea r8, [rbp + 0x998]
call fcn.140119b60
cmp byte [rsi + 9], r14b
je 0x1401d9b97
mov byte [rsi + 9], r14b
cmp byte [rsi + 8], 0
je 0x1401d9b97
mov rax, qword [rsi]
mov rdx, qword [0x14042bb58]
mov qword [rbp + 0xa78], rax
mov dword [rbp + 0xa80], 2
lea rcx, [rdx + 0x388]
lea r8, [rbp + 0xa78]
call fcn.140119b60
mov dl, 1
mov rcx, rsi
call fcn.1400e3810
nop
cmp dword [rbp + 0x930], 0
jle 0x1401d9bb8
mov rcx, qword [rbp + 0x928]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x910], 0
jle 0x1401d9bcd
mov rcx, qword [rbp + 0x908]
call fcn.1402b9c20
xor r14d, r14d
cmp dword [rbp + 0x388], 0
jle 0x1401d9be6
mov rcx, qword [rbp + 0x380]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x480], 0
jle 0x1401d9bfb
mov rcx, qword [rbp + 0x478]
call fcn.1402b9c20
mov rcx, qword [rbp + 0x888]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401d9c11
cmp eax, 0x103
je 0x1401d9c1e
cmp r12d, dword [rbp + 0x320]
jb 0x1401d97a0
mov ebx, dword [rsp + 0x70]
mov rdi, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
mov dword [rsp + 0x70], ebx
add rdi, 8
mov qword [rbp - 0x68], rdi
movsxd rax, ebx
cmp rax, 2
jb 0x1401d9711
lea rax, str.SOFTWARE_
mov qword [rbp + 0x78], rax
lea rax, str.SOFTWAREWow6432Node_
mov qword [rbp + 0x80], rax
mov dword [rbp - 0x58], r14d
lea rax, str.ShellServiceObjectDelayLoad
mov qword [rbp + 0x210], rax
lea rax, str.SharedTaskScheduler
mov qword [rbp + 0x218], rax
lea rcx, [rbp + 0x78]
mov qword [rbp + 0x168], rcx
mov rsi, qword [rcx]
mov qword [rbp], rsi
lea r8, str.MicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
mov rdx, rsi
lea rcx, [rbp - 0x10]
call fcn.1401fe110
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9f1d
mov dword [rbp + 0x2c8], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, r14d
cmp dword [rbp + 0x2c8], 0
jbe 0x1401d9f12
mov rsi, qword [rsp + 0x68]
nop word [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x6520]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401d9efb
mov qword [rbp + 0x1e8], 0
lea edx, [rax + 5]
lea rcx, [rbp + 0x1e0]
call fcn.1401ff260
mov eax, dword [rbp + 0x1e8]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x1e0]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x1e0]
call fcn.140200570
nop
mov ebx, dword [rbp - 4]
add ebx, dword [rbp + 0x1ec]
mov edx, ebx
lea rcx, [rbp + 0x1e0]
call fcn.1401ff260
movsxd r9, dword [rbp - 4]
mov ecx, dword [rbp + 0x1e8]
movsxd rax, dword [rbp + 0x1ec]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1e0]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x10]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x1e0]
call fcn.140200570
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x1e0]
call fcn.1401fd8b0
lea rdx, [rbp + 0x6520]
lea rcx, [rbp + 0x1e0]
call fcn.1401fd8b0
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x1e0]
call fcn.1401fd8b0
lea rax, [rbp + 0x6520]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d9e50
mov qword [rbp + 0x540], 0
test ebx, ebx
jne 0x1401d9e79
lea rax, [0x140348ca0]
mov qword [rbp + 0x538], rax
jmp 0x1401d9ea8
mov edx, ebx
lea rcx, [rbp + 0x538]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x540]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x6520]
mov rcx, qword [rbp + 0x538]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x538]
call fcn.140200570
nop
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x538]
mov rcx, rsi
call fcn.1401d3040
nop
cmp dword [rbp + 0x540], 0
jle 0x1401d9ee4
mov rcx, qword [rbp + 0x538]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x1e8], 0
jle 0x1401d9f02
mov rcx, qword [rbp + 0x1e0]
call fcn.1402b9c20
jmp 0x1401d9f02
cmp eax, 0x103
je 0x1401d9f0e
cmp edi, dword [rbp + 0x2c8]
jb 0x1401d9d40
mov rsi, qword [rbp]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.MicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, rsi
lea rcx, [rbp + 0x9b8]
call fcn.1401fe110
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x10]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x10]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x10]
call fcn.140200570
nop
cmp dword [rbp + 0x9c0], 0
jle 0x1401d9f7c
mov rcx, qword [rbp + 0x9b8]
call fcn.1402b9c20
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401da1fd
mov dword [rbp + 0x318], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x318]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, r14d
cmp dword [rbp + 0x318], 0
jbe 0x1401da1f2
mov rsi, qword [rsp + 0x68]
nop word [rax + rax]
mov dword [rbp + 0x790], 0x400
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x790]
lea r8, [rbp + 0x5520]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401da1db
mov qword [rbp + 0x238], 0
lea edx, [rax + 5]
lea rcx, [rbp + 0x230]
call fcn.1401ff260
mov eax, dword [rbp + 0x238]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x230]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x230]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x23c]
add ebx, dword [rbp - 4]
mov edx, ebx
lea rcx, [rbp + 0x230]
call fcn.1401ff260
movsxd r9, dword [rbp - 4]
mov ecx, dword [rbp + 0x238]
movsxd rax, dword [rbp + 0x23c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x230]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x10]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x230]
call fcn.140200570
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x230]
call fcn.1401fd8b0
lea rdx, [rbp + 0x5520]
lea rcx, [rbp + 0x230]
call fcn.1401fd8b0
lea rax, [rbp + 0x5520]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401da130
mov qword [rbp + 0x550], 0
test ebx, ebx
jne 0x1401da159
lea rax, [0x140348ca0]
mov qword [rbp + 0x548], rax
jmp 0x1401da188
mov edx, ebx
lea rcx, [rbp + 0x548]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x550]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x5520]
mov rcx, qword [rbp + 0x548]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x548]
call fcn.140200570
nop
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x548]
mov rcx, rsi
call fcn.1401d3040
nop
cmp dword [rbp + 0x550], 0
jle 0x1401da1c4
mov rcx, qword [rbp + 0x548]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x238], 0
jle 0x1401da1e2
mov rcx, qword [rbp + 0x230]
call fcn.1402b9c20
jmp 0x1401da1e2
cmp eax, 0x103
je 0x1401da1ee
cmp edi, dword [rbp + 0x318]
jb 0x1401da010
mov rsi, qword [rbp]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13d, r14d
mov dword [rbp - 0x78], r14d
lea r15, [rbp + 0x210]
mov qword [rbp + 0xd0], r15
mov rdi, qword [rsp + 0x68]
nop word [rax + rax]
mov r8, qword [r15]
lea rdx, str.MicrosoftWindowsCurrentVersion_s
lea rcx, [rbp + 0x9f8]
call fcn.1401ff700
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x10]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x10]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x10]
call fcn.140200570
nop
cmp dword [rbp + 0xa00], 0
jle 0x1401da27f
mov rcx, qword [rbp + 0x9f8]
call fcn.1402b9c20
lea r8, [rbp - 0x10]
mov rdx, rsi
lea rcx, [rbp + 0x9d8]
call fcn.1401fddd0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x10]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x10]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x10]
call fcn.140200570
nop
cmp dword [rbp + 0x9e0], 0
jle 0x1401da2db
mov rcx, qword [rbp + 0x9d8]
call fcn.1402b9c20
xor ebx, ebx
mov r12d, ebx
mov dword [rsp + 0x70], ebx
mov r14d, ebx
mov qword [rbp - 0x68], rbx
cmp dword [rdi + 0x18], ebx
jl 0x1401da703
lea rax, [0x140348ca0]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], 0
lea rcx, [rbp + 0x38]
test r14, r14
jne 0x1401da34d
mov rsi, 0xffffffff80000002
mov edx, dword [rbp - 4]
call fcn.1401ff260
movsxd r9, dword [rbp - 4]
mov eax, dword [rbp + 0x40]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x38]
call fcn.1402bd21c
mov edx, dword [rbp - 4]
lea rcx, [rbp + 0x38]
call fcn.140200570
lea r15d, [r14 + 0x5c]
jmp 0x1401da3ff
mov rsi, 0xffffffff80000003
mov rbx, r14
shl rbx, 4
add rbx, qword [rdi + 0x20]
mov edx, dword [rbx - 4]
call fcn.1401ff260
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x40]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x38]
call fcn.1402bd21c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x38]
call fcn.140200570
mov edx, dword [rbp + 0x44]
inc edx
lea rcx, [rbp + 0x38]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x44]
mov rax, qword [rbp + 0x38]
mov r15d, 0x5c
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x44]
inc edx
lea rcx, [rbp + 0x38]
call fcn.140200570
mov ebx, dword [rbp + 0x44]
add ebx, dword [rbp - 4]
mov edx, ebx
lea rcx, [rbp + 0x38]
call fcn.1401ff260
movsxd r9, dword [rbp - 4]
mov ecx, dword [rbp + 0x40]
movsxd rax, dword [rbp + 0x44]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x38]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x10]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x38]
call fcn.140200570
xor ebx, ebx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x38]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401da6cc
mov dword [rbp + 0x2e8], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbp + 0x2e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x2e8], 0
jbe 0x1401da6bc
mov r13, qword [rsp + 0x68]
lea r12, [0x140348ca0]
lea r14, [0x140347f78]
mov dword [rbp + 0x718], 0x400
mov dword [rbp + 0x7d8], 0x800
lea rax, [rbp + 0x7d8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x7d20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x718]
lea r8, [rbp + 0xdd20]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401da696
lea rdx, [0x140347f70]
cmp rsi, 0xffffffff80000002
cmove rdx, r14
lea rcx, [rbp + 0x128]
call fcn.1401fd200
nop
mov edx, dword [rbp + 0x134]
inc edx
lea rcx, [rbp + 0x128]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x134]
mov rax, qword [rbp + 0x128]
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x134]
inc edx
lea rcx, [rbp + 0x128]
call fcn.140200570
mov ebx, dword [rbp + 0x134]
add ebx, dword [rbp + 0x44]
mov edx, ebx
lea rcx, [rbp + 0x128]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x44]
mov ecx, dword [rbp + 0x130]
movsxd rax, dword [rbp + 0x134]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x128]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x38]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x128]
call fcn.140200570
mov edx, dword [rbp + 0x134]
inc edx
lea rcx, [rbp + 0x128]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x134]
mov rax, qword [rbp + 0x128]
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x134]
inc edx
lea rcx, [rbp + 0x128]
call fcn.140200570
lea rdx, [rbp + 0xdd20]
lea rcx, [rbp + 0x128]
call fcn.1401fd8b0
lea rax, [rbp + 0x7d20]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401da5f3
xor r15d, r15d
mov qword [rbp + 0x570], r15
test ebx, ebx
jne 0x1401da614
mov qword [rbp + 0x568], r12
jmp 0x1401da643
mov edx, ebx
lea rcx, [rbp + 0x568]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x570]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x7d20]
mov rcx, qword [rbp + 0x568]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x568]
call fcn.140200570
nop
lea r8, [rbp + 0x128]
lea rdx, [rbp + 0x568]
mov rcx, r13
call fcn.1401d3040
nop
cmp dword [rbp + 0x570], 0
jle 0x1401da67f
mov rcx, qword [rbp + 0x568]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x130], 0
jle 0x1401da69f
mov rcx, qword [rbp + 0x128]
call fcn.1402b9c20
jmp 0x1401da69f
cmp eax, 0x103
je 0x1401da6b3
jmp 0x1401da6a1
xor ebx, ebx
cmp edi, dword [rbp + 0x2e8]
mov r15d, 0x5c
jb 0x1401da491
mov r14, qword [rbp - 0x68]
mov r12d, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x68]
cmp dword [rbp + 0x40], 0
jle 0x1401da6db
mov rcx, qword [rbp + 0x38]
call fcn.1402b9c20
inc r12d
mov dword [rsp + 0x70], r12d
inc r14
mov qword [rbp - 0x68], r14
cmp r12d, dword [rdi + 0x18]
jle 0x1401da2f4
mov r13d, dword [rbp - 0x78]
mov r15, qword [rbp + 0xd0]
mov rsi, qword [rbp]
inc r13d
mov dword [rbp - 0x78], r13d
add r15, 8
mov qword [rbp + 0xd0], r15
movsxd rax, r13d
cmp rax, 2
jb 0x1401da220
cmp dword [rbp - 8], 0
jle 0x1401da731
mov rcx, qword [rbp - 0x10]
call fcn.1402b9c20
mov ebx, dword [rbp - 0x58]
inc ebx
mov dword [rbp - 0x58], ebx
mov rcx, qword [rbp + 0x168]
add rcx, 8
mov qword [rbp + 0x168], rcx
movsxd rax, ebx
cmp rax, 2
mov r14d, 0
jb 0x1401d9c90
lea rax, str.F3130CDB_AA52_4C3A_AB32_85FFC23AF9C1
mov qword [rbp + 0xb10], rax
lea rax, str._SystemRoot__system32wbemwbemess.dll
mov qword [rbp + 0xb18], rax
mov byte [rbp + 0xb20], r14b
lea rax, str.42AEDC87_2188_41FD_B9A3_0C966FEABEC1
mov qword [rbp + 0xb28], rax
lea rcx, str._SystemRoot__system32_shell32.dll
mov qword [rbp + 0xb30], rcx
mov byte [rbp + 0xb38], 1
lea rax, str.5839FCA9_774D_42A1_ACDA_D6A79037F57F
mov qword [rbp + 0xb40], rax
lea rax, str._SystemRoot__system32wbem_fastprox.dll
mov qword [rbp + 0xb48], rax
mov byte [rbp + 0xb50], r14b
lea rax, str.FBEB8A05_BEEE_4442_804E_409D6C4515E9
mov qword [rbp + 0xb58], rax
mov qword [rbp + 0xb60], rcx
mov byte [rbp + 0xb68], r14b
lea rax, [0x140366330]
mov qword [rbp + 0xb70], rax
lea rax, str._SystemRoot__system32_thumbcache.dll
mov qword [rbp + 0xb78], rax
mov byte [rbp + 0xb80], r14b
lea rax, [0x1403664d0]
mov qword [rbp + 0xb88], rax
lea rax, str._systemroot__system32wbemwmiprvse.exe
mov qword [rbp + 0xb90], rax
mov byte [rbp + 0xb98], r14b
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x70], esi
cmp dword [rdi + 0x18], esi
mov r15d, dword [rbp - 0x60]
jl 0x1401daf2c
nop
test r13d, r13d
jne 0x1401da89f
mov qword [rbp + 0x668], 0
lea edx, [r13 + 4]
lea rcx, [rbp + 0x660]
call fcn.1401ff260
mov eax, dword [rbp + 0x668]
inc eax
movsxd rdx, eax
lea r9d, [r13 + 4]
lea r8, [0x140347f78]
mov rcx, qword [rbp + 0x660]
call fcn.1402bd21c
lea edx, [r13 + 4]
lea rcx, [rbp + 0x660]
call fcn.140200570
lea rbx, [rbp + 0x660]
or r15d, 0x10
jmp 0x1401da8c8
lea eax, [r13 - 1]
movsxd r8, eax
shl r8, 4
add r8, qword [rdi + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0xa28]
call fcn.1401fddd0
mov rbx, rax
or r15d, 0x20
mov dword [rbp - 0x70], r15d
mov dword [rbp - 0x60], r15d
mov qword [rbp + 0x408], 0
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401da8f2
lea rax, [0x140348ca0]
mov qword [rbp + 0x400], rax
jmp 0x1401da91c
lea rcx, [rbp + 0x400]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x408]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x400]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x400]
call fcn.140200570
nop
test r15b, 0x20
je 0x1401da954
and r15d, 0xffffffdf
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0xa30], 0
jle 0x1401da954
mov rcx, qword [rbp + 0xa28]
call fcn.1402b9c20
nop
test r15b, 0x10
je 0x1401da97b
and r15d, 0xffffffef
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x70], r15d
cmp dword [rbp + 0x668], 0
jle 0x1401da97b
mov rcx, qword [rbp + 0x660]
call fcn.1402b9c20
lea rdx, str.SOFTWAREClassesCLSID_
lea rcx, [rbp + 0x400]
call fcn.1401fd8b0
mov r8b, 1
xor edx, edx
lea rcx, [rbp + 0x400]
call fcn.1400ec370
mov r12, rax
test rax, rax
je 0x1401daf05
mov r14d, esi
lea rsi, [rbp + 0xb10]
mov r13, qword [rsp + 0x68]
xor r15d, r15d
nop dword [rax]
mov rbx, qword [rsi]
lea r8, str.LocalServer32_
mov rdx, rbx
lea rcx, [rbp + 0x588]
call fcn.1401fe110
nop
mov qword [rbp + 0x8b0], r15
lea rax, [rbp + 0x8b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x588]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401daa33
lea ecx, [rax + 0x10]
call fcn.1402b968c
mov rdi, rax
test rax, rax
je 0x1401daa33
mov rax, qword [rbp + 0x8b0]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rdi], rcx
mov qword [rdi + 8], rax
jmp 0x1401daa36
mov rdi, r15
test rdi, rdi
jne 0x1401dab0e
lea r8, str.InprocServer32_
mov rdx, rbx
lea rcx, [rbp + 0x938]
call fcn.1401fe110
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x588]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x590]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x588]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x588]
call fcn.140200570
nop
cmp dword [rbp + 0x940], edi
jle 0x1401daaa9
mov rcx, qword [rbp + 0x938]
call fcn.1402b9c20
mov qword [rbp + 0x880], r15
lea rax, [rbp + 0x880]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x588]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dab02
lea ecx, [rax + 0x10]
call fcn.1402b968c
mov rdi, rax
test rax, rax
je 0x1401dab02
mov rax, qword [rbp + 0x880]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rdi], rcx
mov qword [rdi + 8], rax
jmp 0x1401dab05
mov rdi, r15
test rdi, rdi
je 0x1401daebe
lea rax, [0x140348ca0]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], r15
lea r8, [rbp + 0xf8]
xor edx, edx
mov rcx, rdi
call fcn.1400d8b50
test al, al
je 0x1401dae95
cmp dword [rbp + 0x104], 0
jle 0x1401dae95
mov r8d, 0x104
lea rdx, [rbp + 0x10e0]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rbp + 0x10e0]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dab70
mov qword [rbp + 0x208], r15
test ebx, ebx
jne 0x1401dab95
lea rax, [0x140348ca0]
mov qword [rbp + 0x200], rax
jmp 0x1401dabc4
mov edx, ebx
lea rcx, [rbp + 0x200]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x208]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x10e0]
mov rcx, qword [rbp + 0x200]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x200]
call fcn.140200570
nop
mov edx, 0x25
mov rcx, qword [rbp + 0xf8]
call fcn.1402bcdb4
test rax, rax
je 0x1401dac66
mov r8d, 0x104
lea rdx, [rbp + 0x1500]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rbp + 0x1500]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dac10
test ebx, ebx
jle 0x1401dac4f
mov edx, ebx
lea rcx, [rbp + 0xf8]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x100]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1500]
mov rcx, qword [rbp + 0xf8]
call fcn.1402bd21c
jmp 0x1401dac58
cmp dword [rbp + 0x104], 0
jle 0x1401dac66
mov edx, ebx
lea rcx, [rbp + 0xf8]
call fcn.140200570
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x20c], eax
jne 0x1401dac94
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0x200]
call fcn.1402b9aac
test eax, eax
sete al
test al, al
jne 0x1401dae80
cmp byte [rsi + 0x10], 0
je 0x1401dadda
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 6]
call fcn.1400ce2e0
test al, al
jne 0x1401dadda
mov qword [rbp + 0x698], r15
mov edx, 0xb
lea rcx, [rbp + 0x690]
call fcn.1401ff260
mov eax, dword [rbp + 0x698]
inc eax
movsxd rdx, eax
mov r9d, 0xb
lea r8, str.shdocvw.dll
mov rcx, qword [rbp + 0x690]
call fcn.1402bd21c
mov edx, 0xb
lea rcx, [rbp + 0x690]
call fcn.140200570
nop
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0xa08]
call fcn.1400d2ff0
nop
lea r8, [rbp + 0x690]
mov rdx, rax
lea rcx, [rbp + 0xa48]
call fcn.1400d2bd0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x200]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x208]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x200]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x200]
call fcn.140200570
nop
cmp dword [rbp + 0xa50], 0
jle 0x1401dad81
mov rcx, qword [rbp + 0xa48]
call fcn.1402b9c20
nop
cmp dword [rbp + 0xa10], 0
jle 0x1401dad97
mov rcx, qword [rbp + 0xa08]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x698], 0
jle 0x1401dadac
mov rcx, qword [rbp + 0x690]
call fcn.1402b9c20
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x20c], eax
jne 0x1401dadda
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0x200]
call fcn.1402b9aac
test eax, eax
sete al
test al, al
jne 0x1401dae80
lea r8, [rbp + 0x588]
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x8d8]
call fcn.1401fdd20
nop
mov eax, dword [rbp + 0x104]
add eax, eax
lea rcx, [rbp + 0x10e0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0xf8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x140348ca0]
lea rdx, [rbp + 0x8d8]
mov rcx, r13
call fcn.1401d2130
test al, al
jne 0x1401dae6a
lea rdx, [rbp + 0xf8]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0xf8]
mov rcx, qword [r13 + 8]
call fcn.1400f92f0
test rax, rax
je 0x1401dae6a
lea rdx, [rbp + 0x8d8]
mov rcx, rax
call fcn.1400ec540
nop
cmp dword [rbp + 0x8e0], 0
jle 0x1401dae80
mov rcx, qword [rbp + 0x8d8]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x208], 0
jle 0x1401dae95
mov rcx, qword [rbp + 0x200]
call fcn.1402b9c20
test rdi, rdi
je 0x1401daea8
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x100], 0
jle 0x1401daebe
mov rcx, qword [rbp + 0xf8]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x590], 0
jle 0x1401daed3
mov rcx, qword [rbp + 0x588]
call fcn.1402b9c20
inc r14d
add rsi, 0x18
movsxd rax, r14d
cmp rax, 6
jb 0x1401da9c0
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
mov r15d, dword [rbp - 0x60]
mov r13d, dword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
xor esi, esi
cmp dword [rbp + 0x408], 0
jle 0x1401daf1a
mov rcx, qword [rbp + 0x400]
call fcn.1402b9c20
inc r13d
mov dword [rsp + 0x70], r13d
cmp r13d, dword [rdi + 0x18]
jle 0x1401da840
mov edx, 0x34
lea rcx, [rsp + 0x78]
call fcn.1401ff260
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0x34
lea r8, str.SOFTWAREMicrosoftActive_SetupInstalled_Components
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, 0x34
lea rcx, [rsp + 0x78]
call fcn.140200570
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401db330
mov dword [rbp + 0x32c], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x32c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r14d, esi
cmp dword [rbp + 0x32c], 0
jbe 0x1401db325
nop
mov r9d, 0x400
lea r8, [rbp + 0x8d20]
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc r14d
test eax, eax
jne 0x1401db311
lea rax, [rbp + 0x890]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x8d20]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401db302
mov dword [rbp + 0x720], 0x800
lea rax, [rbp + 0x720]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xe520]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.StubPath
mov rcx, qword [rbp + 0x890]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401db302
lea rbx, [rbp + 0xe520]
cmp word [rbx], 0x22
jne 0x1401db0a9
add rbx, 2
mov edx, 0x22
mov rcx, rbx
call fcn.1402bcdb4
jmp 0x1401db0b8
lea rdx, [0x140366520]
mov rcx, rbx
call fcn.1402beca8
mov rdi, rax
test rax, rax
je 0x1401db0d2
cmp word [rax], 0x2c
mov word [rax], si
jne 0x1401db0ce
mov rdi, rsi
jmp 0x1401db0d2
add rdi, 2
mov rdx, rbx
lea rcx, [rbp + 0x6d0]
call fcn.1401fd200
nop
lea rdx, [rbp + 0x6d0]
call fcn.1401d64e0
cmp dword [rbp + 0x6dc], 3
jl 0x1401db247
mov rcx, qword [rbp + 0x6d0]
add rcx, 2
mov r8d, 2
lea rdx, [0x140362e18]
call fcn.1402bec7c
test eax, eax
jne 0x1401db247
mov r8b, 1
lea rdx, [rbp + 0x6d0]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call fcn.1400f92f0
mov rsi, rax
test rax, rax
je 0x1401db245
xor eax, eax
mov qword [rbp + 0x228], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x220]
call fcn.1401ff260
mov ecx, dword [rbp + 0x228]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x220]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x220]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x22c]
add ebx, dword [rbp - 0x7c]
mov edx, ebx
lea rcx, [rbp + 0x220]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x228]
movsxd rax, dword [rbp + 0x22c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x220]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x220]
call fcn.140200570
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x220]
call fcn.1401fd8b0
lea rdx, [rbp + 0x8d20]
lea rcx, [rbp + 0x220]
call fcn.1401fd8b0
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x220]
call fcn.1401fd8b0
lea rdx, [rbp + 0x220]
mov rcx, rsi
call fcn.1400ec540
nop
cmp dword [rbp + 0x228], 0
jle 0x1401db245
mov rcx, qword [rbp + 0x220]
call fcn.1402b9c20
xor esi, esi
test rdi, rdi
je 0x1401db2ed
lea rdx, [0x1403667ec]
mov rcx, rdi
call fcn.1402beca8
mov rbx, rax
test rax, rax
jne 0x1401db2cd
lea edx, [rax + 0x3a]
mov rcx, rdi
call fcn.1402bcbec
mov rbx, rax
test rax, rax
jne 0x1401db288
movzx ecx, word [rdi]
call fcn.1402be588
test eax, eax
je 0x1401db2cd
jmp 0x1401db2ca
cmp word [rax], 0x3a
jne 0x1401db2ca
movzx eax, word [rax - 4]
test ax, ax
jne 0x1401db29d
sub rbx, 2
jmp 0x1401db2cd
cmp ax, 0x20
jne 0x1401db2a9
add rbx, 0xfffffffffffffffc
jmp 0x1401db2cd
cmp ax, 0x2f
jne 0x1401db2cd
mov edx, 0x20
mov rcx, rbx
call fcn.1402bcbec
mov rbx, rax
test rax, rax
je 0x1401db2cd
add rbx, 2
jmp 0x1401db2cd
mov rbx, rdi
cmp dword [rbp + 0x6d8], 0
jle 0x1401db2e2
mov rcx, qword [rbp + 0x6d0]
call fcn.1402b9c20
test rbx, rbx
jne 0x1401db090
jmp 0x1401db302
cmp dword [rbp + 0x6d8], 0
jle 0x1401db302
mov rcx, qword [rbp + 0x6d0]
call fcn.1402b9c20
mov rcx, qword [rbp + 0x890]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401db318
cmp eax, 0x103
je 0x1401db325
cmp r14d, dword [rbp + 0x32c]
jb 0x1401daff0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x74
lea rcx, [rsp + 0x78]
call fcn.1401ff260
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0x74
lea r8, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, 0x74
lea rcx, [rsp + 0x78]
call fcn.140200570
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401db60e
mov dword [rbp + 0x31c], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x31c]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, esi
cmp dword [rbp + 0x31c], 0
jbe 0x1401db603
mov r15, qword [rsp + 0x68]
nop word [rax + rax]
mov dword [rbp + 0x728], 0x400
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x728]
lea r8, [rbp + 0x7520]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401db5e8
lea rax, [rbp + 0x7520]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401db450
mov qword [rbp + 0x4a0], 0
test ebx, ebx
jne 0x1401db479
lea rax, [0x140348ca0]
mov qword [rbp + 0x498], rax
jmp 0x1401db4a8
mov edx, ebx
lea rcx, [rbp + 0x498]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x4a0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x7520]
mov rcx, qword [rbp + 0x498]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x498]
call fcn.140200570
nop
lea rdx, [rbp + 0x498]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x498]
mov rcx, qword [r15 + 8]
call fcn.1400f92f0
mov rsi, rax
test rax, rax
je 0x1401db5d1
xor eax, eax
mov qword [rbp + 0x258], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x250]
call fcn.1401ff260
mov ecx, dword [rbp + 0x258]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x250]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x250]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x25c]
add ebx, dword [rbp - 0x7c]
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x258]
movsxd rax, dword [rbp + 0x25c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x250]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.140200570
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x250]
call fcn.1401fd8b0
lea rdx, [rbp + 0x7520]
lea rcx, [rbp + 0x250]
call fcn.1401fd8b0
lea rdx, [rbp + 0x250]
mov rcx, rsi
call fcn.1400ec540
nop
cmp dword [rbp + 0x258], 0
jle 0x1401db5d1
mov rcx, qword [rbp + 0x250]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x4a0], 0
jle 0x1401db5f1
mov rcx, qword [rbp + 0x498]
call fcn.1402b9c20
jmp 0x1401db5f1
cmp eax, 0x103
je 0x1401db5ff
jmp 0x1401db5f3
xor esi, esi
cmp edi, dword [rbp + 0x31c]
jb 0x1401db400
mov r15d, dword [rbp - 0x60]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xa]
call fcn.1400ce2e0
test al, al
je 0x1401dc214
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionScheduleTaskCache
mov qword [rbp + 0x78], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionScheduleTaskCache
mov qword [rbp + 0x80], rax
mov r14d, esi
mov dword [rsp + 0x70], esi
lea r12, [rbp + 0x78]
mov qword [rbp - 0x68], r12
movabs r13, 0x2000000000
nop word [rax + rax]
lea r9, str.Tree
lea r8, [0x140347f58]
mov rdx, qword [r12]
lea rcx, [rbp + 0x848]
call fcn.1401fed20
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x848]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dc1e2
mov dword [rbp + 0x2e4], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x2e4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x2e4], 0
jbe 0x1401dc1d5
mov r14, qword [rsp + 0x68]
xor r12d, r12d
nop dword [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x1920]
mov edx, esi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc esi
test eax, eax
jne 0x1401dc1b9
lea rax, [rbp + 0x7e8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1920]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dc1c0
mov dword [rbp + 0x430], 0x800
lea rax, [rbp + 0x430]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x9d20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140366898]
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1401dc1aa
mov qword [rbp + 0x150], r12
mov edx, 5
lea rcx, [rbp + 0x148]
call fcn.1401ff260
mov eax, dword [rbp + 0x150]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x148]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x148]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x854]
add ebx, dword [rbp + 0x154]
mov edx, ebx
lea rcx, [rbp + 0x148]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x854]
mov ecx, dword [rbp + 0x150]
movsxd rax, dword [rbp + 0x154]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x148]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x848]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x148]
call fcn.140200570
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x148]
call fcn.1401fd8b0
lea rax, [rbp + 0x1920]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401db870
mov qword [rbp + 0x428], r12
test ebx, ebx
jne 0x1401db895
lea rax, [0x140348ca0]
mov qword [rbp + 0x420], rax
jmp 0x1401db8c4
mov edx, ebx
lea rcx, [rbp + 0x420]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x428]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1920]
mov rcx, qword [rbp + 0x420]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x420]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x42c]
add ebx, dword [rbp + 0x154]
mov edx, ebx
lea rcx, [rbp + 0x148]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x42c]
mov ecx, dword [rbp + 0x150]
movsxd rax, dword [rbp + 0x154]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x148]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x420]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x148]
call fcn.140200570
nop
cmp dword [rbp + 0x428], 0
jle 0x1401db946
mov rcx, qword [rbp + 0x420]
call fcn.1402b9c20
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x148]
call fcn.1401fd8b0
mov ecx, 0xb8
call fcn.1402b968c
mov rdi, rax
mov qword [rbp + 0x210], rax
test rax, rax
je 0x1401dba0a
lea rax, [rbp + 0x1920]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401db981
mov qword [rbp + 0x5b0], r12
test ebx, ebx
jne 0x1401db9a6
lea rax, [0x140348ca0]
mov qword [rbp + 0x5a8], rax
jmp 0x1401db9d5
mov edx, ebx
lea rcx, [rbp + 0x5a8]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x5b0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1920]
mov rcx, qword [rbp + 0x5a8]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x5a8]
call fcn.140200570
nop
or r15d, 0x40
mov dword [rbp - 0x70], r15d
mov r9b, 1
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x148]
mov rcx, rdi
call fcn.1401503b0
mov rbx, rax
jmp 0x1401dba0d
mov rbx, r12
test r15b, 0x40
je 0x1401dba2c
and r15d, 0xffffffbf
cmp dword [rbp + 0x5b0], 0
jle 0x1401dba2c
mov rcx, qword [rbp + 0x5a8]
call fcn.1402b9c20
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + 0xc0]
or qword [rbx + 0x40], r13
mov rax, qword [rbx]
mov rdx, qword [r14 + 8]
mov rcx, rbx
call qword [rax + 0x70]
mov dl, 1
mov rcx, rbx
call fcn.1400d7a70
mov rdx, rbx
mov rcx, qword [r14 + 8]
call fcn.1400f9530
lea rax, [rbp + 0x430]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x9d20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140366890]
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dbf35
mov dword [rbp + 0x300], 0x800
mov qword [rbp + 0x3c8], r12
lea edx, [rax + 0x46]
lea rcx, [rbp + 0x3c0]
call fcn.1401ff260
mov eax, dword [rbp + 0x3c8]
inc eax
movsxd rdx, eax
mov r9d, 0x46
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionScheduleTaskCacheTasks_
mov rcx, qword [rbp + 0x3c0]
call fcn.1402bd21c
mov edx, 0x46
lea rcx, [rbp + 0x3c0]
call fcn.140200570
nop
lea rdx, [rbp + 0x9d20]
lea rcx, [rbp + 0x3c0]
call fcn.1401fd8b0
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x3c0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dbf20
mov qword [rbp + 0x268], r12
lea edx, [rax + 5]
lea rcx, [rbp + 0x260]
call fcn.1401ff260
mov eax, dword [rbp + 0x268]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x260]
call fcn.1402bd21c
mov edx, 5
lea rcx, [rbp + 0x260]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x26c]
add ebx, dword [rbp + 0x3cc]
mov edx, ebx
lea rcx, [rbp + 0x260]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x3cc]
mov ecx, dword [rbp + 0x268]
movsxd rax, dword [rbp + 0x26c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x260]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x3c0]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x260]
call fcn.140200570
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x260]
call fcn.1401fd8b0
mov ecx, 0xb8
call fcn.1402b968c
mov rdi, rax
mov qword [rbp + 0x210], rax
test rax, rax
je 0x1401dbcaa
lea rax, [rbp + 0x1920]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dbc20
mov qword [rbp + 0x5c8], r12
test ebx, ebx
jne 0x1401dbc45
lea rax, [0x140348ca0]
mov qword [rbp + 0x5c0], rax
jmp 0x1401dbc74
mov edx, ebx
lea rcx, [rbp + 0x5c0]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x5c8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1920]
mov rcx, qword [rbp + 0x5c0]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x5c0]
call fcn.140200570
nop
bts r15d, 7
mov dword [rbp - 0x70], r15d
mov r9b, 1
lea r8, [rbp + 0x5c0]
lea rdx, [rbp + 0x260]
mov rcx, rdi
call fcn.1401503b0
mov rbx, rax
jmp 0x1401dbcad
mov rbx, r12
test r15b, r15b
jns 0x1401dbccc
btr r15d, 7
cmp dword [rbp + 0x5c8], 0
jle 0x1401dbccc
mov rcx, qword [rbp + 0x5c0]
call fcn.1402b9c20
or qword [rbx + 0x40], r13
mov rax, qword [rbx]
mov rdx, qword [r14 + 8]
mov rcx, rbx
call qword [rax + 0x70]
mov dl, 1
mov rcx, rbx
call fcn.1400d7a70
mov rdx, rbx
mov rcx, qword [r14 + 8]
call fcn.1400f9530
lea rax, [rbp + 0x300]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xad20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Actions
mov rcx, qword [rbp + 0x8d0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dbefc
mov r8d, dword [rbp + 0x300]
add r8d, 0xffffffe4
lea rdx, [rbp + 0xad3c]
lea rcx, [rbp + 0xb520]
call fcn.1402b9d30
lea rax, [rbp + 0xb520]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dbd56
mov qword [rbp + 0x198], r12
test ebx, ebx
jne 0x1401dbd7b
lea rax, [0x140348ca0]
mov qword [rbp + 0x190], rax
jmp 0x1401dbdaa
mov edx, ebx
lea rcx, [rbp + 0x190]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x198]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xb520]
mov rcx, qword [rbp + 0x190]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x190]
call fcn.140200570
nop
lea rdx, [0x14034de00]
lea rcx, [rbp + 0x190]
call fcn.1401ffa00
mov r8d, dword [rbp + 0x19c]
lea ecx, [r8 - 4]
cmp eax, ecx
je 0x1401dbe30
sub r8d, eax
sub r8d, 4
lea edx, [rax + 4]
lea rcx, [rbp + 0x190]
call fcn.140200670
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x190]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x198]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x190]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x190]
call fcn.140200570
mov r8d, 1
lea rdx, [0x140366958]
lea rcx, [rbp + 0x190]
call fcn.1401ff110
test al, al
je 0x1401dbe92
mov ebx, dword [rbp + 0x19c]
lea ecx, [rbx + rbx]
mov r8d, dword [rbp + 0x300]
sub r8d, ecx
sub r8d, 0x1e
movsxd rax, ecx
lea rdx, [rbp + 0xad3e]
add rdx, rax
lea rcx, [rbp + 0xb520]
call fcn.1402b9d30
lea edx, [rbx - 1]
mov r8d, 1
lea rcx, [rbp + 0x190]
call fcn.140200670
lea rdx, [rbp + 0x190]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x190]
mov rcx, qword [r14 + 8]
call fcn.1400f92f0
mov rbx, rax
test rax, rax
je 0x1401dbee7
or qword [rax + 0x40], r13
mov r8, qword [rax]
mov rdx, qword [r14 + 8]
mov rcx, rax
call qword [r8 + 0x70]
lea rdx, [rbp + 0x260]
mov rcx, rbx
call fcn.1400ec540
mov rdx, rbx
mov rcx, qword [r14 + 8]
call fcn.1400f9530
nop
cmp dword [rbp + 0x198], 0
jle 0x1401dbefc
mov rcx, qword [rbp + 0x190]
call fcn.1402b9c20
mov rcx, qword [rbp + 0x8d0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x268], 0
jle 0x1401dbf20
mov rcx, qword [rbp + 0x260]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x3c8], 0
jle 0x1401dbf35
mov rcx, qword [rbp + 0x3c0]
call fcn.1402b9c20
mov edx, 0x104
lea rcx, [rbp + 0x12f0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rbp + 0x6b8], r12
mov edx, 6
lea rcx, [rbp + 0x6b0]
call fcn.1401ff260
mov eax, dword [rbp + 0x6b8]
inc eax
movsxd rdx, eax
mov r9d, 6
lea r8, str.Tasks_
mov rcx, qword [rbp + 0x6b0]
call fcn.1402bd21c
mov edx, 6
lea rcx, [rbp + 0x6b0]
call fcn.140200570
nop
lea rax, [rbp + 0x12f0]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dbfa0
mov qword [rbp + 0x5e8], r12
test ebx, ebx
jne 0x1401dbfc5
lea rdi, [0x140348ca0]
mov qword [rbp + 0x5e0], rdi
jmp 0x1401dbffb
mov edx, ebx
lea rcx, [rbp + 0x5e0]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x5e8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x12f0]
mov rcx, qword [rbp + 0x5e0]
call fcn.1402bd21c
lea rdi, [0x140348ca0]
mov edx, ebx
lea rcx, [rbp + 0x5e0]
call fcn.140200570
nop
lea r8, [rbp + 0x6b0]
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x4b8]
call fcn.1400d2bd0
nop
cmp dword [rbp + 0x5e8], 0
jle 0x1401dc03b
mov rcx, qword [rbp + 0x5e0]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x6b8], 0
jle 0x1401dc050
mov rcx, qword [rbp + 0x6b0]
call fcn.1402b9c20
lea rax, [rbp + 0x1920]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dc060
mov qword [rbp + 0x440], r12
test ebx, ebx
jne 0x1401dc07e
mov qword [rbp + 0x438], rdi
jmp 0x1401dc0ad
mov edx, ebx
lea rcx, [rbp + 0x438]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x440]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1920]
mov rcx, qword [rbp + 0x438]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x438]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x4c4]
add ebx, dword [rbp + 0x444]
mov edx, ebx
lea rcx, [rbp + 0x4b8]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x444]
mov ecx, dword [rbp + 0x4c0]
movsxd rax, dword [rbp + 0x4c4]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x4b8]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x438]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x4b8]
call fcn.140200570
nop
cmp dword [rbp + 0x440], 0
jle 0x1401dc12f
mov rcx, qword [rbp + 0x438]
call fcn.1402b9c20
lea rdx, [rbp + 0x4b8]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x4b8]
mov rcx, qword [r14 + 8]
call fcn.1400f92f0
mov rbx, rax
test rax, rax
je 0x1401dc17f
or qword [rax + 0x40], r13
mov r8, qword [rax]
mov rdx, qword [r14 + 8]
mov rcx, rax
call qword [r8 + 0x70]
mov dl, 1
mov rcx, rbx
call fcn.1400d7a70
mov rdx, rbx
mov rcx, qword [r14 + 8]
call fcn.1400f9530
nop
cmp dword [rbp + 0x4c0], 0
jle 0x1401dc195
mov rcx, qword [rbp + 0x4b8]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x150], 0
jle 0x1401dc1aa
mov rcx, qword [rbp + 0x148]
call fcn.1402b9c20
mov rcx, qword [rbp + 0x7e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401dc1c0
cmp eax, 0x103
je 0x1401dc1cc
cmp esi, dword [rbp + 0x2e4]
jb 0x1401db710
mov r14d, dword [rsp + 0x70]
mov r12, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [rbp + 0x850], 0
jle 0x1401dc1f7
mov rcx, qword [rbp + 0x848]
call fcn.1402b9c20
inc r14d
mov dword [rsp + 0x70], r14d
add r12, 8
mov qword [rbp - 0x68], r12
movsxd rax, r14d
cmp rax, 2
jb 0x1401db660
mov edx, 0x32
lea rcx, [rsp + 0x78]
call fcn.1401ff260
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SYSTEMCurrentControlSetControlSecurityProviders
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, 0x32
lea rcx, [rsp + 0x78]
call fcn.140200570
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dc3b9
mov dword [rbp + 0x730], 0x800
lea rax, [rbp + 0x730]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xed20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SecurityProviders
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dc3ae
lea rdi, [rbp + 0xed20]
nop word [rax + rax]
mov edx, 0x20
mov rcx, rdi
call fcn.1402bcdb4
mov rbx, rax
test rax, rax
je 0x1401dc2fc
mov rcx, rsi
cmp word [rax - 2], 0x2c
mov rax, 0xffffffffffffffff
cmove rcx, rax
mov word [rbx + rcx*2], si
mov rdx, rdi
lea rcx, [rbp + 0x818]
call fcn.1401fd200
nop
lea rdx, [rbp + 0x818]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x818]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call fcn.1400f92f0
mov rdi, rax
test rax, rax
je 0x1401dc372
mov r8, qword [rsp + 0x78]
lea rdx, str.HKLM_wsSecurityProviders
lea rcx, [rbp + 0x948]
call fcn.1401ff700
nop
mov rdx, rax
mov rcx, rdi
call fcn.1400ec540
nop
cmp dword [rbp + 0x950], 0
jle 0x1401dc372
mov rcx, qword [rbp + 0x948]
call fcn.1402b9c20
test rbx, rbx
je 0x1401dc399
lea rdi, [rbx + 2]
cmp dword [rbp + 0x820], 0
jle 0x1401dc2d0
mov rcx, qword [rbp + 0x818]
call fcn.1402b9c20
jmp 0x1401dc2d0
cmp dword [rbp + 0x820], 0
jle 0x1401dc3ae
mov rcx, qword [rbp + 0x818]
call fcn.1402b9c20
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], rsi
call fcn.14000a340
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x678], 0
mov edx, 0x2c
lea rcx, [rbp + 0x670]
call fcn.1401ff260
mov eax, dword [rbp + 0x678]
inc eax
movsxd rdx, eax
mov r9d, 0x2c
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbar
mov rcx, qword [rbp + 0x670]
call fcn.1402bd21c
mov edx, 0x2c
lea rcx, [rbp + 0x670]
call fcn.140200570
nop
movzx eax, byte [0x14042c16a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x670]
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0x170]
call fcn.1400e97f0
nop
cmp dword [rbp + 0x678], 0
jle 0x1401dc460
mov rcx, qword [rbp + 0x670]
call fcn.1402b9c20
mov qword [rbp + 0x688], 0
mov edx, 0x35
lea rcx, [rbp + 0x680]
call fcn.1401ff260
mov eax, dword [rbp + 0x688]
inc eax
movsxd rdx, eax
mov r9d, 0x35
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarExplorer
mov rcx, qword [rbp + 0x680]
call fcn.1402bd21c
mov edx, 0x35
lea rcx, [rbp + 0x680]
call fcn.140200570
nop
movzx eax, byte [0x14042c16a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x680]
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0x170]
call fcn.1400e97f0
nop
cmp dword [rbp + 0x688], 0
jle 0x1401dc4ed
mov rcx, qword [rbp + 0x680]
call fcn.1402b9c20
mov qword [rbp + 0x6a8], 0
mov edx, 0x39
lea rcx, [rbp + 0x6a0]
call fcn.1401ff260
mov eax, dword [rbp + 0x6a8]
inc eax
movsxd rdx, eax
mov r9d, 0x39
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarShellBrowser
mov rcx, qword [rbp + 0x6a0]
call fcn.1402bd21c
mov edx, 0x39
lea rcx, [rbp + 0x6a0]
call fcn.140200570
nop
movzx eax, byte [0x14042c16a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x6a0]
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0x170]
call fcn.1400e97f0
nop
cmp dword [rbp + 0x6a8], 0
jle 0x1401dc57a
mov rcx, qword [rbp + 0x6a0]
call fcn.1402b9c20
mov qword [rbp + 0x6c8], 0
mov edx, 0x37
lea rcx, [rbp + 0x6c0]
call fcn.1401ff260
mov eax, dword [rbp + 0x6c8]
inc eax
movsxd rdx, eax
mov r9d, 0x37
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarWebBrowser
mov rcx, qword [rbp + 0x6c0]
call fcn.1402bd21c
mov edx, 0x37
lea rcx, [rbp + 0x6c0]
call fcn.140200570
nop
movzx eax, byte [0x14042c16a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x6c0]
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0x170]
call fcn.1400e97f0
nop
cmp dword [rbp + 0x6c8], 0
jle 0x1401dc607
mov rcx, qword [rbp + 0x6c0]
call fcn.1402b9c20
mov qword [rbp + 0x6e8], 0
mov edx, 0x33
lea rcx, [rbp + 0x6e0]
call fcn.1401ff260
mov eax, dword [rbp + 0x6e8]
inc eax
movsxd rdx, eax
mov r9d, 0x33
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerUrlSearchHooks
mov rcx, qword [rbp + 0x6e0]
call fcn.1402bd21c
mov edx, 0x33
lea rcx, [rbp + 0x6e0]
call fcn.140200570
nop
movzx eax, byte [0x14042c16a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x6e0]
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0x170]
call fcn.1400e97f0
nop
cmp dword [rbp + 0x6e8], 0
jle 0x1401dc694
mov rcx, qword [rbp + 0x6e0]
call fcn.1402b9c20
mov r12d, esi
mov dword [rsp + 0x70], esi
mov r13, qword [rsp + 0x68]
cmp dword [r13 + 0x18], 0
jl 0x1401dcb58
mov r15, rsi
mov qword [rbp - 0x68], rsi
mov rax, qword [rbp + 0x170]
nop dword [rax]
mov r14, rsi
test r12d, r12d
setne r14b
add r14, 0xffffffff80000002
mov rbx, qword [rax]
mov qword [rbp - 0x78], rbx
cmp rbx, rax
je 0x1401dcb3f
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.1401ff260
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.140200570
lea rax, [0x140348ca0]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], 0
lea rcx, [rbp + 0x28]
test r15, r15
jne 0x1401dc75b
mov edx, dword [rbp - 0x7c]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7c]
mov eax, dword [rbp + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x28]
call fcn.1402bd21c
mov edx, dword [rbp - 0x7c]
jmp 0x1401dc7fa
mov rdi, r15
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1401ff260
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.1402bd21c
mov edx, dword [rdi - 4]
lea rcx, [rbp + 0x28]
call fcn.140200570
mov edx, dword [rbp + 0x34]
inc edx
lea rcx, [rbp + 0x28]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x34]
mov rax, qword [rbp + 0x28]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x34]
inc edx
lea rcx, [rbp + 0x28]
call fcn.140200570
mov edi, dword [rbp + 0x34]
add edi, dword [rbp - 0x7c]
mov edx, edi
lea rcx, [rbp + 0x28]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x30]
movsxd rax, dword [rbp + 0x34]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x28]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, edi
lea rcx, [rbp + 0x28]
call fcn.140200570
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dcabe
mov dword [rbp + 0x2b0], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x2b0], 0
jbe 0x1401dcab1
xor r12d, r12d
lea r15, [0x140348ca0]
or rbx, 0xffffffffffffffff
nop
mov dword [rbp + 0x738], 0x400
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x738]
lea r8, [rbp + 0x3d20]
mov edx, esi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc esi
test eax, eax
jne 0x1401dca96
cmp word [rbp + 0x3d20], 0x7b
jne 0x1401dca9d
lea rdx, [0x140347f70]
cmp r14, 0xffffffff80000002
lea rax, [0x140347f78]
cmove rdx, rax
lea rcx, [rbp + 0x108]
call fcn.1401fd200
nop
mov edx, dword [rbp + 0x114]
inc edx
lea rcx, [rbp + 0x108]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x114]
mov rax, qword [rbp + 0x108]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x114]
inc edx
lea rcx, [rbp + 0x108]
call fcn.140200570
mov edi, dword [rbp + 0x114]
add edi, dword [rbp + 0x34]
mov edx, edi
lea rcx, [rbp + 0x108]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x34]
mov ecx, dword [rbp + 0x110]
movsxd rax, dword [rbp + 0x114]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x108]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x28]
call fcn.1402bd21c
mov edx, edi
lea rcx, [rbp + 0x108]
call fcn.140200570
mov edx, dword [rbp + 0x114]
inc edx
lea rcx, [rbp + 0x108]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x114]
mov rax, qword [rbp + 0x108]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x114]
inc edx
lea rcx, [rbp + 0x108]
call fcn.140200570
lea rdx, [rbp + 0x3d20]
lea rcx, [rbp + 0x108]
call fcn.1401fd8b0
lea rax, [rbp + 0x3d20]
mov rdi, rbx
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401dc9f6
mov qword [rbp + 0x608], r12
test edi, edi
jne 0x1401dca14
mov qword [rbp + 0x600], r15
jmp 0x1401dca43
mov edx, edi
lea rcx, [rbp + 0x600]
call fcn.1401ff260
movsxd r9, edi
mov eax, dword [rbp + 0x608]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x3d20]
mov rcx, qword [rbp + 0x600]
call fcn.1402bd21c
mov edx, edi
lea rcx, [rbp + 0x600]
call fcn.140200570
nop
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x600]
mov rcx, r13
call fcn.1401d3040
nop
cmp dword [rbp + 0x608], 0
jle 0x1401dca7f
mov rcx, qword [rbp + 0x600]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x110], 0
jle 0x1401dca9d
mov rcx, qword [rbp + 0x108]
call fcn.1402b9c20
jmp 0x1401dca9d
cmp eax, 0x103
je 0x1401dcaa9
cmp esi, dword [rbp + 0x2b0]
jb 0x1401dc890
mov rbx, qword [rbp - 0x78]
mov r15, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [rbp + 0x30], 0
jle 0x1401dcacd
mov rcx, qword [rbp + 0x28]
call fcn.1402b9c20
cmp byte [rbx + 0x19], 0
jne 0x1401dcb2a
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401dcb02
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401dcb2a
nop dword [rax]
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401dcaf0
jmp 0x1401dcb2a
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401dcb23
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401dcb23
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401dcb10
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x170]
cmp rbx, rax
jne 0x1401dc6e1
mov r12d, dword [rsp + 0x70]
inc r12d
mov dword [rsp + 0x70], r12d
inc r15
mov qword [rbp - 0x68], r15
cmp r12d, dword [r13 + 0x18]
jle 0x1401dc6c0
lea rcx, [rbp + 0x170]
call fcn.140009e30
mov qword [rbp + 0x638], 0
mov edx, 0x32
lea rcx, [rbp + 0x630]
call fcn.1401ff260
mov eax, dword [rbp + 0x638]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExplorer_Bars
mov rcx, qword [rbp + 0x630]
call fcn.1402bd21c
mov edx, 0x32
lea rcx, [rbp + 0x630]
call fcn.140200570
nop
movzx eax, byte [0x14042c16a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x630]
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0x170]
call fcn.1400e97f0
nop
cmp dword [rbp + 0x638], 0
jle 0x1401dcbf1
mov rcx, qword [rbp + 0x630]
call fcn.1402b9c20
mov qword [rbp + 0x708], 0
mov edx, 0x2f
lea rcx, [rbp + 0x700]
call fcn.1401ff260
mov eax, dword [rbp + 0x708]
inc eax
movsxd rdx, eax
mov r9d, 0x2f
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExtensions
mov rcx, qword [rbp + 0x700]
call fcn.1402bd21c
mov edx, 0x2f
lea rcx, [rbp + 0x700]
call fcn.140200570
nop
movzx eax, byte [0x14042c16a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x700]
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0x170]
call fcn.1400e97f0
nop
cmp dword [rbp + 0x708], 0
jle 0x1401dcc7e
mov rcx, qword [rbp + 0x700]
call fcn.1402b9c20
mov r12d, esi
mov dword [rsp + 0x70], esi
cmp dword [r13 + 0x18], 0
jl 0x1401dd138
mov r15, rsi
mov qword [rbp - 0x68], rsi
mov rax, qword [rbp + 0x170]
nop
mov r14, rsi
test r12d, r12d
setne r14b
add r14, 0xffffffff80000002
mov rbx, qword [rax]
mov qword [rbp - 0x78], rbx
cmp rbx, rax
je 0x1401dd11f
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.1401ff260
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.140200570
lea rax, [0x140348ca0]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], 0
lea rcx, [rbp + 0x18]
test r15, r15
jne 0x1401dcd3b
mov edx, dword [rbp - 0x7c]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7c]
mov eax, dword [rbp + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x18]
call fcn.1402bd21c
mov edx, dword [rbp - 0x7c]
jmp 0x1401dcdda
mov rdi, r15
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1401ff260
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 0x18]
call fcn.1402bd21c
mov edx, dword [rdi - 4]
lea rcx, [rbp + 0x18]
call fcn.140200570
mov edx, dword [rbp + 0x24]
inc edx
lea rcx, [rbp + 0x18]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x24]
mov rax, qword [rbp + 0x18]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x24]
inc edx
lea rcx, [rbp + 0x18]
call fcn.140200570
mov edi, dword [rbp + 0x24]
add edi, dword [rbp - 0x7c]
mov edx, edi
lea rcx, [rbp + 0x18]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x20]
movsxd rax, dword [rbp + 0x24]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x18]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, edi
lea rcx, [rbp + 0x18]
call fcn.140200570
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x18]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dd09e
mov dword [rbp + 0x324], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x324]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x324], 0
jbe 0x1401dd091
xor r12d, r12d
lea r15, [0x140348ca0]
or rbx, 0xffffffffffffffff
nop
mov dword [rbp + 0x71c], 0x800
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x71c]
lea r8, [rbp + 0x4d20]
mov edx, esi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
test eax, eax
jne 0x1401dd076
cmp word [rbp + 0x4d20], 0x7b
jne 0x1401dd07d
lea rdx, [0x140347f70]
cmp r14, 0xffffffff80000002
lea rax, [0x140347f78]
cmove rdx, rax
lea rcx, [rbp + 0x118]
call fcn.1401fd200
nop
mov edx, dword [rbp + 0x124]
inc edx
lea rcx, [rbp + 0x118]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x124]
mov rax, qword [rbp + 0x118]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x124]
inc edx
lea rcx, [rbp + 0x118]
call fcn.140200570
mov edi, dword [rbp + 0x124]
add edi, dword [rbp + 0x24]
mov edx, edi
lea rcx, [rbp + 0x118]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x120]
movsxd rax, dword [rbp + 0x124]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x118]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x18]
call fcn.1402bd21c
mov edx, edi
lea rcx, [rbp + 0x118]
call fcn.140200570
mov edx, dword [rbp + 0x124]
inc edx
lea rcx, [rbp + 0x118]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x124]
mov rax, qword [rbp + 0x118]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x124]
inc edx
lea rcx, [rbp + 0x118]
call fcn.140200570
lea rdx, [rbp + 0x4d20]
lea rcx, [rbp + 0x118]
call fcn.1401fd8b0
lea rax, [rbp + 0x4d20]
mov rdi, rbx
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401dcfd6
mov qword [rbp + 0x628], r12
test edi, edi
jne 0x1401dcff4
mov qword [rbp + 0x620], r15
jmp 0x1401dd023
mov edx, edi
lea rcx, [rbp + 0x620]
call fcn.1401ff260
movsxd r9, edi
mov eax, dword [rbp + 0x628]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x4d20]
mov rcx, qword [rbp + 0x620]
call fcn.1402bd21c
mov edx, edi
lea rcx, [rbp + 0x620]
call fcn.140200570
nop
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x620]
mov rcx, r13
call fcn.1401d3040
nop
cmp dword [rbp + 0x628], 0
jle 0x1401dd05f
mov rcx, qword [rbp + 0x620]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x120], 0
jle 0x1401dd07d
mov rcx, qword [rbp + 0x118]
call fcn.1402b9c20
jmp 0x1401dd07d
cmp eax, 0x103
je 0x1401dd089
cmp esi, dword [rbp + 0x324]
jb 0x1401dce70
mov rbx, qword [rbp - 0x78]
mov r15, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [rbp + 0x20], 0
jle 0x1401dd0ad
mov rcx, qword [rbp + 0x18]
call fcn.1402b9c20
cmp byte [rbx + 0x19], 0
jne 0x1401dd10a
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401dd0e2
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401dd10a
nop dword [rax]
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401dd0d0
jmp 0x1401dd10a
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401dd103
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401dd103
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401dd0f0
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x170]
cmp rbx, rax
jne 0x1401dccc1
mov r12d, dword [rsp + 0x70]
inc r12d
mov dword [rsp + 0x70], r12d
inc r15
mov qword [rbp - 0x68], r15
cmp r12d, dword [r13 + 0x18]
jle 0x1401dcca0
lea rax, str.ControlPanel
mov qword [rbp + 0xaf0], rax
lea rax, str.Desktop
mov qword [rbp + 0xaf8], rax
lea rax, str.MyComputer
mov qword [rbp + 0xb00], rax
lea rax, str.NetworkNeighborhood
mov qword [rbp + 0xb08], rax
mov ebx, esi
mov dword [rsp + 0x70], ebx
lea rdi, [rbp + 0xaf0]
mov qword [rbp + 0xd0], rdi
mov r14d, 0x5c
nop word [rax + rax]
mov qword [rbp + 0x90], 0
mov edx, 0x32
lea rcx, [rbp + 0x88]
call fcn.1401ff260
mov eax, dword [rbp + 0x90]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
mov rcx, qword [rbp + 0x88]
call fcn.1402bd21c
mov edx, 0x32
lea rcx, [rbp + 0x88]
call fcn.140200570
nop
mov edx, dword [rbp + 0x94]
inc edx
lea rcx, [rbp + 0x88]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x94]
mov rax, qword [rbp + 0x88]
mov word [rax + rcx*2], r14w
mov edx, dword [rbp + 0x94]
inc edx
lea rcx, [rbp + 0x88]
call fcn.140200570
mov rdx, qword [rdi]
lea rcx, [rbp + 0x88]
call fcn.1401fd8b0
mov edx, dword [rbp + 0x94]
inc edx
lea rcx, [rbp + 0x88]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x94]
mov rax, qword [rbp + 0x88]
mov word [rax + rcx*2], r14w
mov edx, dword [rbp + 0x94]
inc edx
lea rcx, [rbp + 0x88]
call fcn.140200570
lea rdx, str.NameSpace
lea rcx, [rbp + 0x88]
call fcn.1401fd8b0
mov eax, dword [0x14042c9e0]
lea r15, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401dd2b2
or eax, 1
mov dword [0x14042c9e0], eax
mov qword [0x14042c9e8], r15
mov qword [0x14042c9f0], 0xffffffff80000002
lea rcx, [0x1403017d0]
call fcn.1402bb344
mov qword [rbp + 0x8c0], rsi
lea rax, [rbp + 0x8c0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x88]
mov rcx, qword [0x14042c9f0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dd763
lea ecx, [rax + 0x10]
call fcn.1402b968c
mov r13, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1401dd30f
mov rax, qword [rbp + 0x8c0]
mov qword [r13], r15
mov qword [r13 + 8], rax
jmp 0x1401dd316
mov r13, rsi
mov qword [rbp - 0x68], rsi
lea r15, vtable.Core::Array_class_Core::String_.0
test r13, r13
je 0x1401dd76a
mov qword [rbp + 0xac0], r15
mov dword [rbp + 0xac8], esi
mov qword [rbp + 0xad0], rsi
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xac0]
mov rcx, r13
call fcn.1400ebbb0
test al, al
je 0x1401dd73d
mov eax, dword [rbp + 0xac8]
test eax, eax
jle 0x1401dd73d
mov rsi, qword [rbp + 0xad0]
mov r15, rsi
mov r12d, eax
mov r13, qword [rsp + 0x68]
mov r8d, 1
lea rdx, [0x14035203c]
mov rcx, r15
call fcn.1402019e0
test al, al
je 0x1401dd70f
mov r8, qword [rsi]
lea rdx, str.HKLMSOFTWAREClassesCLSID_s_
lea rcx, [rbp + 0x748]
call fcn.1401ff700
nop
xor ebx, ebx
mov qword [rbp + 0x450], rbx
mov edx, dword [rbp + 0x754]
test edx, edx
jne 0x1401dd3d7
lea r14, [0x140348ca0]
mov qword [rbp + 0x448], r14
jmp 0x1401dd415
lea rcx, [rbp + 0x448]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x754]
mov eax, dword [rbp + 0x450]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x748]
mov rcx, qword [rbp + 0x448]
call fcn.1402bd21c
mov edx, dword [rbp + 0x754]
lea r14, [0x140348ca0]
lea rcx, [rbp + 0x448]
call fcn.140200570
nop
lea rdx, str.ShellOpenCommand
lea rcx, [rbp + 0x448]
call fcn.1401fd8b0
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x448]
call fcn.1400ec370
mov rdi, rax
test rax, rax
je 0x1401dd6e4
mov qword [rbp + 0x330], r14
mov qword [rbp + 0x338], rbx
lea r8, [rbp + 0x330]
mov rdx, qword [0x14041a158]
mov rcx, rax
call fcn.1400d8b50
test al, al
je 0x1401dd6c0
lea rdx, [rbp + 0x330]
call fcn.1401d64e0
cmp dword [rbp + 0x33c], 2
jle 0x1401dd6c0
mov r8d, 2
lea rdx, [0x140348ac8]
lea rcx, [rbp + 0x330]
call fcn.1401ffb20
test eax, eax
jle 0x1401dd520
lea r8d, [rax - 1]
lea rdx, [rbp + 0x968]
lea rcx, [rbp + 0x330]
call fcn.1402011d0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x330]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x338]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x330]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x330]
call fcn.140200570
nop
cmp dword [rbp + 0x970], 0
jle 0x1401dd520
mov rcx, qword [rbp + 0x968]
call fcn.1402b9c20
mov r8b, 1
lea rdx, [rbp + 0x330]
mov rcx, qword [r13 + 8]
call fcn.1400f92f0
mov r14, rax
test rax, rax
je 0x1401dd6c0
lea rdx, [rbp + 0x748]
mov rcx, rax
call fcn.1400e41d0
mov qword [rbp - 0x48], 0
mov edx, 4
lea rcx, [rbp - 0x50]
call fcn.1401ff260
mov ecx, dword [rbp - 0x48]
inc ecx
movsxd rdx, ecx
mov r9d, 4
lea r8, [0x140347f78]
mov rcx, qword [rbp - 0x50]
call fcn.1402bd21c
mov edx, 4
lea rcx, [rbp - 0x50]
call fcn.140200570
nop
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.1401ff260
movsxd rcx, dword [rbp - 0x44]
mov rax, qword [rbp - 0x50]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.140200570
mov ebx, dword [rbp - 0x44]
add ebx, dword [rbp + 0x94]
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x94]
mov ecx, dword [rbp - 0x48]
movsxd rax, dword [rbp - 0x44]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x50]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x88]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.140200570
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.1401ff260
movsxd rcx, dword [rbp - 0x44]
mov rax, qword [rbp - 0x50]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.140200570
mov ebx, dword [rbp - 0x44]
add ebx, dword [rsi + 0xc]
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.1401ff260
movsxd r9, dword [rsi + 0xc]
mov ecx, dword [rbp - 0x48]
movsxd rax, dword [rbp - 0x44]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x50]
lea rcx, [rax + rcx*2]
mov r8, qword [rsi]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.140200570
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.1401ff260
movsxd rcx, dword [rbp - 0x44]
mov rax, qword [rbp - 0x50]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x44]
inc edx
lea rcx, [rbp - 0x50]
call fcn.140200570
lea rdx, [rbp - 0x50]
mov rcx, r14
call fcn.1400e41d0
nop
cmp dword [rbp - 0x48], 0
jle 0x1401dd6c0
mov rcx, qword [rbp - 0x50]
call fcn.1402b9c20
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x338], 0
jle 0x1401dd6e4
mov rcx, qword [rbp + 0x330]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x450], 0
jle 0x1401dd6fa
mov rcx, qword [rbp + 0x448]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x750], 0
jle 0x1401dd70f
mov rcx, qword [rbp + 0x748]
call fcn.1402b9c20
add r15, 0x10
add rsi, 0x10
dec r12
jne 0x1401dd380
mov r13, qword [rbp - 0x68]
mov ebx, dword [rsp + 0x70]
mov rdi, qword [rbp + 0xd0]
xor esi, esi
lea r14d, [r12 + 0x5c]
lea r15, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r13]
mov edx, 1
mov rcx, r13
call qword [rax]
nop
mov qword [rbp + 0xac0], r15
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
jmp 0x1401dd76a
lea r15, vtable.Core::Array_class_Core::String_.0
cmp dword [rbp + 0x90], 0
jle 0x1401dd77f
mov rcx, qword [rbp + 0x88]
call fcn.1402b9c20
inc ebx
mov dword [rsp + 0x70], ebx
add rdi, 8
mov qword [rbp + 0xd0], rdi
movsxd rax, ebx
cmp rax, 4
jb 0x1401dd190
mov qword [rbp + 0x288], 0
mov edx, 0x54
lea rcx, [rbp + 0x280]
call fcn.1401ff260
mov eax, dword [rbp + 0x288]
inc eax
movsxd rdx, eax
mov r9d, 0x54
lea r8, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerShellIconOverlayIdentifiers_
mov rcx, qword [rbp + 0x280]
call fcn.1402bd21c
mov edx, 0x54
lea rcx, [rbp + 0x280]
call fcn.140200570
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x280]
call fcn.1400ec370
mov r12, rax
test rax, rax
je 0x1401ddba7
mov qword [rbp + 0xac0], r15
mov dword [rbp + 0xac8], esi
mov qword [rbp + 0xad0], rsi
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xac0]
mov rcx, r12
call fcn.1400ebbb0
mov r13, qword [rsp + 0x68]
test al, al
je 0x1401ddb81
mov eax, dword [rbp + 0xac8]
test eax, eax
jle 0x1401ddb81
mov r14, qword [rbp + 0xad0]
lea rdi, [r14 + 0xc]
mov r15d, eax
nop word [rax + rax]
mov r8d, 1
lea rdx, [0x14035203c]
mov rcx, r14
call fcn.1402019e0
test al, al
je 0x1401dd9b8
mov qword [rbp + 0x160], 0
mov edx, dword [rbp + 0x28c]
test edx, edx
jne 0x1401dd8b2
lea rax, [0x140348ca0]
mov qword [rbp + 0x158], rax
jmp 0x1401dd8e9
lea rcx, [rbp + 0x158]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x28c]
mov eax, dword [rbp + 0x160]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x280]
mov rcx, qword [rbp + 0x158]
call fcn.1402bd21c
mov edx, dword [rbp + 0x28c]
lea rcx, [rbp + 0x158]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x164]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x158]
call fcn.1401ff260
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x160]
movsxd rax, dword [rbp + 0x164]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x158]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x158]
call fcn.140200570
mov edx, dword [rbp + 0x164]
inc edx
lea rcx, [rbp + 0x158]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x164]
mov rax, qword [rbp + 0x158]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x164]
inc edx
lea rcx, [rbp + 0x158]
call fcn.140200570
lea r8, [rbp + 0x158]
mov rdx, r14
mov rcx, r13
call fcn.1401d3040
nop
cmp dword [rbp + 0x160], 0
jle 0x1401ddb69
mov rcx, qword [rbp + 0x158]
call fcn.1402b9c20
jmp 0x1401ddb69
xor r8d, r8d
mov rdx, qword [rdi - 0xc]
mov rcx, r12
call fcn.1400ebff0
mov rsi, rax
test rax, rax
je 0x1401ddb67
lea rax, [0x140348ca0]
mov qword [rbp + 0x768], rax
xor ebx, ebx
mov qword [rbp + 0x770], rbx
lea r8, [rbp + 0x768]
xor edx, edx
mov rcx, rsi
call fcn.1400d8b50
test al, al
je 0x1401ddb44
lea r8d, [rbx + 1]
lea rdx, [0x14035203c]
lea rcx, [rbp + 0x768]
call fcn.1402019e0
test al, al
je 0x1401ddb44
mov qword [rbp + 0x188], rbx
mov edx, dword [rbp + 0x28c]
test edx, edx
jne 0x1401dda43
lea rax, [0x140348ca0]
mov qword [rbp + 0x180], rax
jmp 0x1401dda7a
lea rcx, [rbp + 0x180]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x28c]
mov eax, dword [rbp + 0x188]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x280]
mov rcx, qword [rbp + 0x180]
call fcn.1402bd21c
mov edx, dword [rbp + 0x28c]
lea rcx, [rbp + 0x180]
call fcn.140200570
nop
mov ebx, dword [rbp + 0x18c]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x180]
call fcn.1401ff260
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x188]
movsxd rax, dword [rbp + 0x18c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x180]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x180]
call fcn.140200570
mov edx, dword [rbp + 0x18c]
inc edx
lea rcx, [rbp + 0x180]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x18c]
mov rax, qword [rbp + 0x180]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x18c]
inc edx
lea rcx, [rbp + 0x180]
call fcn.140200570
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x768]
mov rcx, r13
call fcn.1401d3040
nop
cmp dword [rbp + 0x188], 0
jle 0x1401ddb44
mov rcx, qword [rbp + 0x180]
call fcn.1402b9c20
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp + 0x770], 0
jle 0x1401ddb67
mov rcx, qword [rbp + 0x768]
call fcn.1402b9c20
xor esi, esi
add r14, 0x10
add rdi, 0x10
dec r15
jne 0x1401dd870
lea r15, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp + 0xac0], r15
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
jmp 0x1401ddbac
mov r13, qword [rsp + 0x68]
cmp dword [rbp + 0x288], 0
jle 0x1401ddbc1
mov rcx, qword [rbp + 0x280]
call fcn.1402b9c20
lea rcx, [rbp + 0x170]
call fcn.140009e30
mov qword [rbp + 0x6f8], 0
mov edx, 0x35
lea rcx, [rbp + 0x6f0]
call fcn.1401ff260
mov eax, dword [rbp + 0x6f8]
inc eax
movsxd rdx, eax
mov r9d, 0x35
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_
mov rcx, qword [rbp + 0x6f0]
call fcn.1402bd21c
mov edx, 0x35
lea rcx, [rbp + 0x6f0]
call fcn.140200570
nop
movzx eax, byte [0x14042c16a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x6f0]
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0x170]
call fcn.1400e97f0
nop
cmp dword [rbp + 0x6f8], 0
jle 0x1401ddc5a
mov rcx, qword [rbp + 0x6f0]
call fcn.1402b9c20
mov r15d, esi
mov dword [rsp + 0x70], esi
cmp dword [r13 + 0x18], 0
jl 0x1401de07d
mov r14, rsi
mov rax, qword [rbp + 0x170]
nop word [rax + rax]
test r15d, r15d
setne sil
add rsi, 0xffffffff80000002
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401de063
xor r12d, r12d
lea r15, [0x140348ca0]
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.1401ff260
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.140200570
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r12
lea rcx, [rbp + 8]
test r14, r14
jne 0x1401ddd1f
mov edx, dword [rbp - 0x7c]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7c]
mov eax, dword [rbp + 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rbp + 8]
call fcn.1402bd21c
mov edx, dword [rbp - 0x7c]
jmp 0x1401dddbe
mov rdi, r14
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1401ff260
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 8]
call fcn.1402bd21c
mov edx, dword [rdi - 4]
lea rcx, [rbp + 8]
call fcn.140200570
mov edx, dword [rbp + 0x14]
inc edx
lea rcx, [rbp + 8]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x14]
mov rax, qword [rbp + 8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x14]
inc edx
lea rcx, [rbp + 8]
call fcn.140200570
mov edi, dword [rbp + 0x14]
add edi, dword [rbp - 0x7c]
mov edx, edi
lea rcx, [rbp + 8]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7c]
mov ecx, dword [rbp + 0x10]
movsxd rax, dword [rbp + 0x14]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 8]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, edi
lea rcx, [rbp + 8]
call fcn.140200570
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401ddff0
mov dword [rbp + 0x3e0], 0x800
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xbd20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.load
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ddfe4
cmp dword [rbp + 0x3e0], eax
jbe 0x1401ddfe4
lea rax, [rbp + 0xbd20]
or rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401dde50
mov qword [rbp + 0x3d8], r12
test edi, edi
jne 0x1401dde6e
mov qword [rbp + 0x3d0], r15
jmp 0x1401dde9d
mov edx, edi
lea rcx, [rbp + 0x3d0]
call fcn.1401ff260
movsxd r9, edi
mov eax, dword [rbp + 0x3d8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xbd20]
mov rcx, qword [rbp + 0x3d0]
call fcn.1402bd21c
mov edx, edi
lea rcx, [rbp + 0x3d0]
call fcn.140200570
nop
cmp dword [rbp + 0x3dc], 0
jle 0x1401ddfcf
lea rdx, [rbp + 0x3d0]
call fcn.1401d64e0
lea rdx, [0x140347f70]
cmp rsi, 0xffffffff80000002
lea rax, [0x140347f78]
cmove rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.1401fd200
nop
mov edx, dword [rbp + 0x2ac]
inc edx
lea rcx, [rbp + 0x2a0]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x2ac]
mov rax, qword [rbp + 0x2a0]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x2ac]
inc edx
lea rcx, [rbp + 0x2a0]
call fcn.140200570
mov edi, dword [rbp + 0x2ac]
add edi, dword [rbp + 0x14]
mov edx, edi
lea rcx, [rbp + 0x2a0]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x14]
mov ecx, dword [rbp + 0x2a8]
movsxd rax, dword [rbp + 0x2ac]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x2a0]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 8]
call fcn.1402bd21c
mov edx, edi
lea rcx, [rbp + 0x2a0]
call fcn.140200570
lea rdx, str.load
lea rcx, [rbp + 0x2a0]
call fcn.1401fd8b0
mov r8b, 1
lea rdx, [rbp + 0x3d0]
mov rcx, qword [r13 + 8]
call fcn.1400f92f0
test rax, rax
je 0x1401ddfb9
lea rdx, [rbp + 0x2a0]
mov rcx, rax
call fcn.1400ec540
nop
cmp dword [rbp + 0x2a8], 0
jle 0x1401ddfcf
mov rcx, qword [rbp + 0x2a0]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x3d8], 0
jle 0x1401ddfe4
mov rcx, qword [rbp + 0x3d0]
call fcn.1402b9c20
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x10], 0
jle 0x1401ddfff
mov rcx, qword [rbp + 8]
call fcn.1402b9c20
cmp byte [rbx + 0x19], 0
jne 0x1401de04e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401de02e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401de04e
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401de020
jmp 0x1401de04e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401de04b
cmp rbx, qword [rax + 0x10]
jne 0x1401de04b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401de038
mov rbx, rax
mov rax, qword [rbp + 0x170]
cmp rbx, rax
jne 0x1401ddcb0
mov r15d, dword [rsp + 0x70]
inc r15d
mov dword [rsp + 0x70], r15d
inc r14
cmp r15d, dword [r13 + 0x18]
mov esi, 0
jle 0x1401ddc80
lea rax, [0x14034de00]
mov qword [rbp + 0xac0], rax
lea rax, str.exefile
mov qword [rbp + 0xac8], rax
lea rax, str..pif
mov qword [rbp + 0xad0], rax
lea rax, str.piffile
mov qword [rbp + 0xad8], rax
lea rax, str..com
mov qword [rbp + 0xae0], rax
lea rax, str.comfile
mov qword [rbp + 0xae8], rax
mov eax, esi
mov dword [rbp - 0x78], eax
lea r13, [rbp + 0xac0]
lea r15, str.Wow6432Node
mov rdi, qword [rsp + 0x68]
nop dword [rax]
mov dword [rsp + 0x70], esi
mov rbx, rsi
mov qword [rbp - 0x68], rbx
cmp dword [rdi + 0x18], 0
jl 0x1401dea5a
lea rax, [0x140348ca0]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], r15
jmp 0x1401de127
lea rax, [0x140348ca0]
mov qword [rbp + 0x340], rax
mov qword [rbp + 0x348], 0
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], 0
lea rcx, [rbp + 0x340]
test rbx, rbx
jne 0x1401de1ac
lea edx, [rbx + 4]
mov r12, 0xffffffff80000002
call fcn.1401ff260
mov eax, dword [rbp + 0x348]
inc eax
movsxd rdx, eax
lea r9d, [rbx + 4]
lea r8, [0x140347f78]
mov rcx, qword [rbp + 0x340]
call fcn.1402bd21c
lea edx, [rbx + 4]
lea rcx, [rbp + 0x340]
call fcn.140200570
mov edx, dword [rbp + 0x144]
test edx, edx
jle 0x1401de27c
xor edx, edx
jmp 0x1401de26a
mov edx, 3
mov r12, 0xffffffff80000003
call fcn.1401ff260
mov eax, dword [rbp + 0x348]
inc eax
movsxd rdx, eax
mov r9d, 3
lea r8, [0x140347f70]
mov rcx, qword [rbp + 0x340]
call fcn.1402bd21c
mov edx, 3
lea rcx, [rbp + 0x340]
call fcn.140200570
shl rbx, 4
add rbx, qword [rdi + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x138]
call fcn.1401ff260
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x140]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x138]
call fcn.1402bd21c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x138]
call fcn.140200570
mov edx, dword [rbp + 0x144]
inc edx
lea rcx, [rbp + 0x138]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x144]
mov rax, qword [rbp + 0x138]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x144]
inc edx
lea rcx, [rbp + 0x138]
call fcn.140200570
mov edx, dword [rbp + 0x144]
mov r14d, esi
lea r15, [rbp + 0x78]
nop dword [rax]
nop word [rax + rax]
mov qword [rbp + 0x2c0], 0
test edx, edx
jne 0x1401de2af
lea rbx, [0x140348ca0]
mov qword [rbp + 0x2b8], rbx
jmp 0x1401de2ed
lea rcx, [rbp + 0x2b8]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x144]
mov eax, dword [rbp + 0x2c0]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x2b8]
call fcn.1402bd21c
mov edx, dword [rbp + 0x144]
lea rbx, [0x140348ca0]
lea rcx, [rbp + 0x2b8]
call fcn.140200570
nop
lea rdx, str.SOFTWARE
lea rcx, [rbp + 0x2b8]
call fcn.1401fd8b0
mov rdx, qword [r15]
lea rcx, [rbp + 0x2b8]
call fcn.1401fd8b0
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x2b8]
call fcn.1401fd8b0
lea rdx, str.Classes
lea rcx, [rbp + 0x2b8]
call fcn.1401fd8b0
lea rax, [rbp + 0x5b8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x2b8]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401de9d7
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xb0], 0
mov rdx, qword [0x14041a158]
lea rcx, [rbp + 0x518]
call fcn.1401fd200
nop
mov rdx, qword [0x14041a158]
lea rcx, [rbp + 0x370]
call fcn.1401fd200
nop
mov rdx, qword [0x14041a158]
lea rcx, [rbp + 0x360]
call fcn.1401fd200
nop
mov dword [rbp + 0xc8], 0x800
mov rsi, qword [r13]
lea r9, [rbp + 0xc8]
lea r8, [rbp + 0x2120]
mov rdx, rsi
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401de556
lea rax, [rbp + 0x2120]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401de400
test ebx, ebx
jle 0x1401de43f
mov edx, ebx
lea rcx, [rbp + 0x518]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x520]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2120]
mov rcx, qword [rbp + 0x518]
call fcn.1402bd21c
jmp 0x1401de448
cmp dword [rbp + 0x524], 0
jle 0x1401de456
mov edx, ebx
lea rcx, [rbp + 0x518]
call fcn.140200570
mov r8, qword [rbp + 0x518]
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x988]
call fcn.1401ff700
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xb0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa8]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.140200570
nop
cmp dword [rbp + 0x990], 0
jle 0x1401de4c5
mov rcx, qword [rbp + 0x988]
call fcn.1402b9c20
mov dword [rbp + 0xc8], 0x800
lea r9, [rbp + 0xc8]
lea r8, [rbp + 0x2120]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401de556
lea rax, [rbp + 0x2120]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401de500
test ebx, ebx
jle 0x1401de53f
mov edx, ebx
lea rcx, [rbp + 0x370]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x378]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2120]
mov rcx, qword [rbp + 0x370]
call fcn.1402bd21c
jmp 0x1401de548
cmp dword [rbp + 0x37c], 0
jle 0x1401de556
mov edx, ebx
lea rcx, [rbp + 0x370]
call fcn.140200570
mov r8, rsi
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x9a8]
call fcn.1401ff700
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xb0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa8]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.140200570
nop
cmp dword [rbp + 0x9b0], 0
jle 0x1401de5c1
mov rcx, qword [rbp + 0x9a8]
call fcn.1402b9c20
mov dword [rbp + 0xc8], 0x800
lea r9, [rbp + 0xc8]
lea r8, [rbp + 0x2120]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
or rdx, 0xffffffffffffffff
test eax, eax
jne 0x1401de65a
lea rax, [rbp + 0x2120]
mov rbx, rdx
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401de600
test ebx, ebx
jle 0x1401de63f
mov edx, ebx
lea rcx, [rbp + 0x360]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x368]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2120]
mov rcx, qword [rbp + 0x360]
call fcn.1402bd21c
jmp 0x1401de648
cmp dword [rbp + 0x36c], 0
jle 0x1401de65a
mov edx, ebx
lea rcx, [rbp + 0x360]
call fcn.140200570
or rdx, 0xffffffffffffffff
mov rcx, qword [rbp + 0x370]
test rcx, rcx
je 0x1401de7e7
mov rax, rdx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401de670
test rax, rax
sete al
test al, al
jne 0x1401de7e7
mov r8d, 1
lea rdx, [0x140366f90]
lea rcx, [rbp + 0x370]
call fcn.1402019e0
test al, al
jne 0x1401de7e7
xor eax, eax
mov qword [rbp + 0x4e0], rax
mov edx, dword [rbp + 0x37c]
test edx, edx
jne 0x1401de6cc
lea rax, [0x140348ca0]
mov qword [rbp + 0x4d8], rax
jmp 0x1401de703
lea rcx, [rbp + 0x4d8]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x37c]
mov eax, dword [rbp + 0x4e0]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x370]
mov rcx, qword [rbp + 0x4d8]
call fcn.1402bd21c
mov edx, dword [rbp + 0x37c]
lea rcx, [rbp + 0x4d8]
call fcn.140200570
nop
lea rdx, [rbp + 0x4d8]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x4d8]
mov rcx, qword [rdi + 8]
call fcn.1400f92f0
mov rdi, rax
test rax, rax
je 0x1401de7cd
mov rcx, qword [rbp + 0x518]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x2b8]
mov r8, qword [rbp + 0x340]
lea rdx, str._s_s_s_shellopencommand_
lea rcx, [rbp + 0x9c8]
call fcn.1401ff700
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xb0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa8]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.140200570
nop
cmp dword [rbp + 0x9d0], 0
jle 0x1401de7bd
mov rcx, qword [rbp + 0x9c8]
call fcn.1402b9c20
lea rdx, [rbp + 0xa8]
mov rcx, rdi
call fcn.1400ec540
nop
cmp dword [rbp + 0x4e0], 0
jle 0x1401de7e2
mov rcx, qword [rbp + 0x4d8]
call fcn.1402b9c20
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rbp + 0x360]
test rcx, rcx
je 0x1401de96b
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401de800
test rax, rax
sete al
test al, al
jne 0x1401de96b
mov r8d, 1
lea rdx, [0x140366f90]
lea rcx, [rbp + 0x360]
call fcn.1402019e0
test al, al
jne 0x1401de96b
xor eax, eax
mov qword [rbp + 0x500], rax
mov edx, dword [rbp + 0x36c]
test edx, edx
jne 0x1401de85c
lea rax, [0x140348ca0]
mov qword [rbp + 0x4f8], rax
jmp 0x1401de893
lea rcx, [rbp + 0x4f8]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x36c]
mov eax, dword [rbp + 0x500]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x360]
mov rcx, qword [rbp + 0x4f8]
call fcn.1402bd21c
mov edx, dword [rbp + 0x36c]
lea rcx, [rbp + 0x4f8]
call fcn.140200570
nop
lea rdx, [rbp + 0x4f8]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x4f8]
mov rcx, qword [rdi + 8]
call fcn.1400f92f0
mov rdi, rax
test rax, rax
je 0x1401de956
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp + 0x2b8]
mov r8, qword [rbp + 0x340]
lea rdx, str._s_s_s_shellopencommand_
lea rcx, [rbp + 0x9e8]
call fcn.1401ff700
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xb0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa8]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa8]
call fcn.140200570
nop
cmp dword [rbp + 0x9f0], 0
jle 0x1401de946
mov rcx, qword [rbp + 0x9e8]
call fcn.1402b9c20
lea rdx, [rbp + 0xa8]
mov rcx, rdi
call fcn.1400ec540
nop
cmp dword [rbp + 0x500], 0
jle 0x1401de96b
mov rcx, qword [rbp + 0x4f8]
call fcn.1402b9c20
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x368], 0
jle 0x1401de98f
mov rcx, qword [rbp + 0x360]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x378], 0
jle 0x1401de9a5
mov rcx, qword [rbp + 0x370]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x520], 0
jle 0x1401de9bb
mov rcx, qword [rbp + 0x518]
call fcn.1402b9c20
nop
cmp dword [rbp + 0xb0], 0
jle 0x1401de9d0
mov rcx, qword [rbp + 0xa8]
call fcn.1402b9c20
xor esi, esi
mov rdi, qword [rsp + 0x68]
cmp dword [rbp + 0x2c0], 0
jle 0x1401de9ec
mov rcx, qword [rbp + 0x2b8]
call fcn.1402b9c20
inc r14d
add r15, 8
movsxd rax, r14d
cmp rax, 2
jae 0x1401dea07
mov edx, dword [rbp + 0x144]
jmp 0x1401de290
cmp dword [rbp + 0x140], 0
jle 0x1401dea1d
mov rcx, qword [rbp + 0x138]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x348], 0
jle 0x1401dea32
mov rcx, qword [rbp + 0x340]
call fcn.1402b9c20
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rbx, qword [rbp - 0x68]
inc rbx
mov qword [rbp - 0x68], rbx
cmp eax, dword [rdi + 0x18]
jle 0x1401de120
mov eax, dword [rbp - 0x78]
lea r15, str.Wow6432Node
inc eax
mov dword [rbp - 0x78], eax
add r13, 0x10
cdqe
cmp rax, 3
mov eax, dword [rbp - 0x78]
jb 0x1401de0f0
mov r14d, esi
mov r13, qword [rsp + 0x68]
lea r12, [0x140348ca0]
cmp dword [rdi + 0x18], 0
jl 0x1401dee45
mov rdi, rsi
lea r15, [0x14034de00]
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], 0
test rdi, rdi
jne 0x1401deab8
mov rsi, 0xffffffff80000002
jmp 0x1401deb46
mov rsi, 0xffffffff80000003
mov rbx, rdi
shl rbx, 4
add rbx, qword [r13 + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x1a0]
call fcn.1401ff260
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x1a8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x1a0]
call fcn.1402bd21c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x1a0]
call fcn.140200570
mov edx, dword [rbp + 0x1ac]
inc edx
lea rcx, [rbp + 0x1a0]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x1ac]
mov rax, qword [rbp + 0x1a0]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x1ac]
inc edx
lea rcx, [rbp + 0x1a0]
call fcn.140200570
lea rdx, str.SOFTWAREClasses
lea rcx, [rbp + 0x1a0]
call fcn.1401fd8b0
lea rax, [rbp + 0x740]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x1a0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dee17
mov dword [rbp + 0x7a8], 0x100
lea r9, [rbp + 0x7a8]
lea r8, [rbp + 0xfe0]
mov rdx, r15
mov rcx, qword [rbp + 0x740]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401dee09
lea r8, [rbp + 0xfe0]
lea rdx, str._s_shellopencommand_
lea rcx, [rbp + 0x838]
call fcn.1401ff700
nop
mov dword [rbp + 0x724], 0x400
lea r9, [rbp + 0x724]
lea r8, [rbp + 0x3920]
mov rdx, qword [rbp + 0x838]
mov rcx, qword [rbp + 0x740]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401dedf4
lea rax, [rbp + 0x3920]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dec10
xor eax, eax
mov qword [rbp + 0x418], rax
test ebx, ebx
jne 0x1401dec30
mov qword [rbp + 0x410], r12
jmp 0x1401dec5f
mov edx, ebx
lea rcx, [rbp + 0x410]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0x418]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x3920]
mov rcx, qword [rbp + 0x410]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x410]
call fcn.140200570
nop
mov r8d, 1
lea rdx, [0x140366f90]
lea rcx, [rbp + 0x410]
call fcn.1402019e0
test al, al
jne 0x1401dedde
lea rdx, [rbp + 0x410]
call fcn.1401d64e0
lea rdx, [0x140347f70]
cmp rsi, 0xffffffff80000002
lea rax, [0x140347f78]
cmove rdx, rax
lea rcx, [rbp + 0x58]
call fcn.1401fd200
nop
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x58]
mov esi, 0x5c
mov word [rax + rcx*2], si
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.140200570
mov ebx, dword [rbp + 0x64]
add ebx, dword [rbp + 0x1ac]
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x1ac]
mov ecx, dword [rbp + 0x60]
movsxd rax, dword [rbp + 0x64]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x58]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x1a0]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.140200570
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x58]
mov word [rax + rcx*2], si
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.140200570
mov ebx, dword [rbp + 0x844]
add ebx, dword [rbp + 0x64]
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x844]
mov ecx, dword [rbp + 0x60]
movsxd rax, dword [rbp + 0x64]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x58]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x838]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.140200570
mov r8b, 1
lea rdx, [rbp + 0x410]
mov rcx, qword [r13 + 8]
call fcn.1400f92f0
test rax, rax
je 0x1401dedce
lea rdx, [rbp + 0x58]
mov rcx, rax
call fcn.1400ec540
nop
cmp dword [rbp + 0x60], 0
jle 0x1401dedde
mov rcx, qword [rbp + 0x58]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x418], 0
jle 0x1401dedf4
mov rcx, qword [rbp + 0x410]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x840], 0
jle 0x1401dee09
mov rcx, qword [rbp + 0x838]
call fcn.1402b9c20
mov rcx, qword [rbp + 0x740]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x1a8], 0
jle 0x1401dee2c
mov rcx, qword [rbp + 0x1a0]
call fcn.1402b9c20
inc r14d
inc rdi
cmp r14d, dword [r13 + 0x18]
jle 0x1401dea95
xor esi, esi
lea r15, str.Wow6432Node
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], r15
mov r15d, esi
mov dword [rsp + 0x70], esi
lea r12, [rbp + 0x78]
mov qword [rbp - 0x68], r12
nop
lea r8, str.SOFTWARE
mov edx, 0x104
lea rcx, [rbp + 0xbc0]
call fcn.1402b96f8
mov r8, qword [r12]
mov edx, 0x104
lea rcx, [rbp + 0xbc0]
call fcn.1402bbbd8
lea r8, str.ClientsStartMenuInternet_
mov edx, 0x104
lea rcx, [rbp + 0xbc0]
call fcn.1402bbbd8
call fcn.1400ec320
mov qword [rbp + 0x8c8], rsi
lea rcx, [rbp + 0x8c8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0xbc0]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401df297
lea ecx, [rax + 0x10]
call fcn.1402b968c
mov r14, rax
mov qword [rbp + 0x758], rax
lea rbx, vtable.Core::Array_class_Core::String_.0
test rax, rax
je 0x1401df29e
mov rcx, qword [rbp + 0x8c8]
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [r14], rax
mov qword [r14 + 8], rcx
mov qword [rbp + 0xac0], rbx
mov dword [rbp + 0xac8], esi
mov qword [rbp + 0xad0], rsi
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xac0]
mov rcx, r14
call fcn.1400ebbb0
test al, al
je 0x1401df272
mov eax, dword [rbp + 0xac8]
test eax, eax
jle 0x1401df272
mov rdi, qword [rbp + 0xad0]
mov esi, eax
xor r14d, r14d
lea r15, [0x140348ca0]
or r12, 0xffffffffffffffff
nop word [rax + rax]
lea r8, [rbp + 0xbc0]
mov edx, 0x104
lea rcx, [rbp + 0xdd0]
call fcn.1402b96f8
mov r8, qword [rdi]
mov edx, 0x104
lea rcx, [rbp + 0xdd0]
call fcn.1402bbbd8
lea r8, str._shellopencommand
mov edx, 0x104
lea rcx, [rbp + 0xdd0]
call fcn.1402bbbd8
mov dword [rbp + 0x7dc], 0x208
lea r9, [rbp + 0x7dc]
lea r8, [rbp + 0x1710]
lea rdx, [rbp + 0xdd0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401df24e
lea rax, [rbp + 0x1710]
mov rbx, r12
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401df002
mov qword [rbp + 0xa0], r14
test ebx, ebx
jne 0x1401df020
mov qword [rbp + 0x98], r15
jmp 0x1401df04f
mov edx, ebx
lea rcx, [rbp + 0x98]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp + 0xa0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1710]
mov rcx, qword [rbp + 0x98]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x98]
call fcn.140200570
nop
mov r8d, 1
lea rdx, [0x1403512cc]
lea rcx, [rbp + 0x98]
call fcn.1402019e0
lea rcx, [rbp + 0x98]
test al, al
je 0x1401df113
mov r8d, 1
lea rdx, [0x1403512cc]
call fcn.1401ffb20
test eax, eax
jle 0x1401df192
lea r9d, [rax - 1]
mov r8d, 1
lea rdx, [rbp + 0xa68]
lea rcx, [rbp + 0x98]
call fcn.140201490
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x98]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xa0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x98]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x98]
call fcn.140200570
nop
cmp dword [rbp + 0xa70], 0
jle 0x1401df192
mov rcx, qword [rbp + 0xa68]
jmp 0x1401df18d
lea rdx, str..exe
call fcn.1401ffa00
test eax, eax
js 0x1401df192
lea r9d, [rax + 4]
xor r8d, r8d
lea rdx, [rbp + 0xa88]
lea rcx, [rbp + 0x98]
call fcn.140201490
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x98]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xa0]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x98]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x98]
call fcn.140200570
nop
cmp dword [rbp + 0xa90], 0
jle 0x1401df192
mov rcx, qword [rbp + 0xa88]
call fcn.1402b9c20
lea rdx, [rbp + 0x98]
call fcn.1401d64e0
cmp dword [rbp + 0xa4], 0
jle 0x1401df239
mov r8b, 1
lea rdx, [rbp + 0x98]
mov rcx, qword [r13 + 8]
call fcn.1400f92f0
mov rbx, rax
test rax, rax
je 0x1401df239
lea rdx, [0x140347f78]
lea rcx, [rbp + 0x858]
call fcn.1401fd200
nop
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x858]
call fcn.1401fd8b0
lea rdx, [rbp + 0xdd0]
lea rcx, [rbp + 0x858]
call fcn.1401fd8b0
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x858]
call fcn.1401fd8b0
lea rdx, [rbp + 0x858]
mov rcx, rbx
call fcn.1400ec540
nop
cmp dword [rbp + 0x860], 0
jle 0x1401df239
mov rcx, qword [rbp + 0x858]
call fcn.1402b9c20
nop
cmp dword [rbp + 0xa0], 0
jle 0x1401df24e
mov rcx, qword [rbp + 0x98]
call fcn.1402b9c20
add rdi, 0x10
dec rsi
jne 0x1401def80
mov r14, qword [rbp + 0x758]
mov r15d, dword [rsp + 0x70]
mov r12, qword [rbp - 0x68]
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
nop
mov qword [rbp + 0xac0], rbx
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
jmp 0x1401df29e
lea rbx, vtable.Core::Array_class_Core::String_.0
inc r15d
mov dword [rsp + 0x70], r15d
add r12, 8
mov qword [rbp - 0x68], r12
movsxd rax, r15d
cmp rax, 2
jb 0x1401dee60
lea rdx, str.HKLMSOFTWAREMozillaPlugins
lea rcx, [rbp + 0x798]
call fcn.1401fd200
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x798]
call fcn.1400ec370
mov r12, rax
test rax, rax
je 0x1401df58a
mov qword [rbp + 0xac0], rbx
mov dword [rbp + 0xac8], esi
mov qword [rbp + 0xad0], rsi
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xac0]
mov rcx, r12
call fcn.1400ebbb0
test al, al
je 0x1401df565
mov eax, dword [rbp + 0xac8]
test eax, eax
jle 0x1401df565
mov rsi, qword [rbp + 0xad0]
mov r15d, eax
lea r14, [0x140348ca0]
nop word [rax + rax]
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, r12
call fcn.1400ebff0
mov rdi, rax
test rax, rax
je 0x1401df54f
mov qword [rbp + 0x780], r14
xor ebx, ebx
mov qword [rbp + 0x788], rbx
mov qword [rbp + 0x808], r14
mov qword [rbp + 0x810], rbx
lea r8, [rbp + 0x780]
lea rdx, str.Path
mov rcx, rax
call fcn.1400d8b50
test al, al
je 0x1401df516
xor r8d, r8d
lea rdx, str.disabled
lea rcx, [rbp + 0x780]
call fcn.1401ff540
test al, al
jne 0x1401df516
mov r8b, 1
lea rdx, [rbp + 0x780]
mov rcx, qword [r13 + 8]
call fcn.1400f92f0
mov r14, rax
test rax, rax
je 0x1401df50f
mov qword [rbp + 0x1f8], rbx
mov edx, dword [rbp + 0x7a4]
test edx, edx
jne 0x1401df404
lea rax, [0x140348ca0]
mov qword [rbp + 0x1f0], rax
jmp 0x1401df43b
lea rcx, [rbp + 0x1f0]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x7a4]
mov eax, dword [rbp + 0x1f8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x798]
mov rcx, qword [rbp + 0x1f0]
call fcn.1402bd21c
mov edx, dword [rbp + 0x7a4]
lea rcx, [rbp + 0x1f0]
call fcn.140200570
nop
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x1f0]
call fcn.1401fd8b0
mov ebx, dword [rbp + 0x1fc]
add ebx, dword [rsi + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x1f0]
call fcn.1401ff260
movsxd r9, dword [rsi + 0xc]
mov ecx, dword [rbp + 0x1f8]
movsxd rax, dword [rbp + 0x1fc]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1f0]
lea rcx, [rax + rcx*2]
mov r8, qword [rsi]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x1f0]
call fcn.140200570
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x1f0]
call fcn.1401fd8b0
lea rdx, [rbp + 0x1f0]
mov rcx, r14
call fcn.1400ec540
lea r8, [rbp + 0x808]
lea rdx, str.XPTPath
mov rcx, rdi
call fcn.1400d8b50
test al, al
je 0x1401df4fa
lea rdx, [rbp + 0x808]
mov rcx, r14
call fcn.1400e41d0
nop
cmp dword [rbp + 0x1f8], 0
jle 0x1401df50f
mov rcx, qword [rbp + 0x1f0]
call fcn.1402b9c20
lea r14, [0x140348ca0]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x810], 0
jle 0x1401df53a
mov rcx, qword [rbp + 0x808]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x788], 0
jle 0x1401df54f
mov rcx, qword [rbp + 0x780]
call fcn.1402b9c20
add rsi, 0x10
dec r15
jne 0x1401df350
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp + 0xac0], rbx
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x7a0], 0
jle 0x1401df59f
mov rcx, qword [rbp + 0x798]
call fcn.1402b9c20
lea rdx, str.HKLMSOFTWAREClassesDirectoryShellexCopyHookHandlers
lea rcx, [rbp + 0x7c8]
call fcn.1401fd200
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x7c8]
call fcn.1400ec370
mov r15, rax
test rax, rax
je 0x1401df7f0
mov qword [rbp + 0xac0], rbx
mov dword [rbp + 0xac8], esi
mov qword [rbp + 0xad0], rsi
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xac0]
mov rcx, r15
call fcn.1400ebbb0
test al, al
je 0x1401df7cc
mov eax, dword [rbp + 0xac8]
test eax, eax
jle 0x1401df7cc
mov rdi, qword [rbp + 0xad0]
mov r14d, eax
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, r15
call fcn.1400ebff0
mov rsi, rax
test rax, rax
je 0x1401df7b6
lea r12, [0x140348ca0]
mov qword [rbp + 0x7b0], r12
xor ebx, ebx
mov qword [rbp + 0x7b8], rbx
lea r8, [rbp + 0x7b0]
xor edx, edx
mov rcx, rax
call fcn.1400d8b50
test al, al
je 0x1401df793
lea r8d, [rbx + 1]
lea rdx, [0x14035203c]
lea rcx, [rbp + 0x7b0]
call fcn.1402019e0
test al, al
je 0x1401df793
mov qword [rbp + 0x50], rbx
mov edx, dword [rbp + 0x7d4]
test edx, edx
jne 0x1401df69f
mov qword [rbp + 0x48], r12
jmp 0x1401df6cd
lea rcx, [rbp + 0x48]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x7d4]
mov eax, dword [rbp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x7c8]
mov rcx, qword [rbp + 0x48]
call fcn.1402bd21c
mov edx, dword [rbp + 0x7d4]
lea rcx, [rbp + 0x48]
call fcn.140200570
nop
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x54]
mov rax, qword [rbp + 0x48]
mov r12d, 0x5c
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.140200570
mov ebx, dword [rbp + 0x54]
add ebx, dword [rdi + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.1401ff260
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rbp + 0x50]
movsxd rax, dword [rbp + 0x54]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x48]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.140200570
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x54]
mov rax, qword [rbp + 0x48]
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.140200570
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x7b0]
mov rcx, r13
call fcn.1401d3040
nop
cmp dword [rbp + 0x50], 0
jle 0x1401df793
mov rcx, qword [rbp + 0x48]
call fcn.1402b9c20
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp + 0x7b8], 0
jle 0x1401df7b6
mov rcx, qword [rbp + 0x7b0]
call fcn.1402b9c20
add rdi, 0x10
dec r14
jne 0x1401df622
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r15]
mov edx, 1
mov rcx, r15
call qword [rax]
nop
mov qword [rbp + 0xac0], rbx
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x7d0], 0
jle 0x1401df805
mov rcx, qword [rbp + 0x7c8]
call fcn.1402b9c20
lea rdx, str.HKLMSOFTWAREWow6432NodeMozillaFirefoxExtensions
lea rcx, [rbp + 0x7f0]
call fcn.1401fd200
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x7f0]
call fcn.1400ec370
mov r12, rax
test rax, rax
je 0x1401dfc97
mov qword [rbp + 0xac0], rbx
mov dword [rbp + 0xac8], esi
mov qword [rbp + 0xad0], rsi
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xac0]
mov rcx, r12
call fcn.1400ebe90
test al, al
je 0x1401dfc81
mov ecx, dword [rbp + 0xac8]
test ecx, ecx
jle 0x1401dfc81
mov rsi, qword [rbp + 0xad0]
add rsi, 0xc
mov r15d, ecx
lea r14, vtable.Core::ByteArray.0
xor ebx, ebx
nop word [rax + rax]
mov qword [rbp + 0x3a8], 0
mov edx, dword [rsi]
test edx, edx
jne 0x1401df8c1
lea rdi, [0x140348ca0]
mov qword [rbp + 0x3a0], rdi
jmp 0x1401df8f2
lea rcx, [rbp + 0x3a0]
call fcn.1401ff260
movsxd r9, dword [rsi]
mov eax, dword [rbp + 0x3a8]
inc eax
movsxd rdx, eax
mov r8, qword [rsi - 0xc]
mov rcx, qword [rbp + 0x3a0]
call fcn.1402bd21c
lea rdi, [0x140348ca0]
mov edx, dword [rsi]
lea rcx, [rbp + 0x3a0]
call fcn.140200570
nop
mov r8d, 1
lea rdx, [0x14035203c]
lea rcx, [rbp + 0x3a0]
call fcn.1402019e0
test al, al
je 0x1401dfc56
mov qword [rbp + 0x350], rdi
mov qword [rbp + 0x358], 0
lea r8, [rbp + 0x350]
mov rdx, qword [rbp + 0x3a0]
mov rcx, r12
call fcn.1400d8b50
test al, al
je 0x1401dfc40
lea rdx, str.chromecontentoverlay.xul
lea rcx, [rbp + 0x8f8]
call fcn.1401fd200
nop
lea r8, [rbp + 0x8f8]
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x8e8]
call fcn.1400d2bd0
nop
cmp dword [rbp + 0x900], 0
jle 0x1401df996
mov rcx, qword [rbp + 0x8f8]
call fcn.1402b9c20
mov qword [rbp + 0xaf0], r14
mov dword [rbp + 0xaf8], ebx
mov qword [rbp + 0xb00], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp + 0xb08], rax
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0x8e8]
call fcn.140208850
mov r14, qword [rbp + 0xb00]
test al, al
je 0x1401dfbf2
mov qword [rbp + 0xb10], 0
movups xmm0, xmmword [0x14032a958]
movups xmmword [rbp + 0xb18], xmm0
movups xmm1, xmmword [0x14032a968]
movups xmmword [rbp + 0xb28], xmm1
lea r8, [rbp + 0xb10]
mov edx, dword [rbp + 0xaf8]
mov rcx, r14
call fcn.14018d6c0
lea rdx, [rbp + 0xb10]
lea rcx, [rbp + 0xba0]
call fcn.14018d7b0
mov r8b, 1
lea rdx, [rbp + 0x8e8]
mov rcx, qword [r13 + 8]
call fcn.1400f92f0
mov rdi, rax
test rax, rax
je 0x1401dfbf2
mov qword [rbp + 0x248], 0
mov edx, dword [rbp + 0x7fc]
test edx, edx
jne 0x1401dfa6c
lea rax, [0x140348ca0]
mov qword [rbp + 0x240], rax
jmp 0x1401dfaa3
lea rcx, [rbp + 0x240]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x7fc]
mov eax, dword [rbp + 0x248]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x7f0]
mov rcx, qword [rbp + 0x240]
call fcn.1402bd21c
mov edx, dword [rbp + 0x7fc]
lea rcx, [rbp + 0x240]
call fcn.140200570
nop
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x240]
call fcn.1401fd8b0
mov ebx, dword [rbp + 0x24c]
add ebx, dword [rbp + 0x3ac]
mov edx, ebx
lea rcx, [rbp + 0x240]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x3ac]
mov ecx, dword [rbp + 0x248]
movsxd rax, dword [rbp + 0x24c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x240]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x3a0]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x240]
call fcn.140200570
lea rdx, [rbp + 0x240]
mov rcx, rdi
call fcn.1400ec540
mov r8d, 1
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x350]
call fcn.1401ff110
test al, al
jne 0x1401dfb8b
mov edx, dword [rbp + 0x35c]
inc edx
lea rcx, [rbp + 0x350]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x35c]
mov rax, qword [rbp + 0x350]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x35c]
inc edx
lea rcx, [rbp + 0x350]
call fcn.140200570
lea rdx, [rbp + 0x350]
mov rcx, rdi
call fcn.1400e41d0
lea rdx, [rbp + 0xba0]
mov rcx, rdi
call fcn.140169730
mov rbx, qword [r13 + 8]
cmp qword [rbx + 0x430], 0
je 0x1401dfbdb
mov eax, dword [rdi + 0x40]
shr rax, 0x14
test al, 1
jne 0x1401dfbcb
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rdx, rdi
mov rcx, qword [rbx + 0x430]
call fcn.1401cf6d0
nop
cmp dword [rbp + 0x248], 0
jle 0x1401dfbf0
mov rcx, qword [rbp + 0x240]
call fcn.1402b9c20
xor ebx, ebx
lea rax, vtable.Core::ByteArray.0
mov qword [rbp + 0xaf0], rax
test r14, r14
je 0x1401dfc24
mov r8, r14
xor edx, edx
mov rcx, qword [rbp + 0xb08]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0xb00], rbx
mov dword [rbp + 0xaf8], ebx
cmp dword [rbp + 0x8f0], 0
jle 0x1401dfc39
mov rcx, qword [rbp + 0x8e8]
call fcn.1402b9c20
lea r14, vtable.Core::ByteArray.0
cmp dword [rbp + 0x358], 0
jle 0x1401dfc56
mov rcx, qword [rbp + 0x350]
call fcn.1402b9c20
nop
cmp dword [rbp + 0x3a8], 0
jle 0x1401dfc6b
mov rcx, qword [rbp + 0x3a0]
call fcn.1402b9c20
add rsi, 0x10
dec r15
jne 0x1401df8a0
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0xac0], rbx
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x7f8], 0
jle 0x1401dfcac
mov rcx, qword [rbp + 0x7f0]
call fcn.1402b9c20
mov rcx, r13
call fcn.1401e0130
mov rcx, r13
call fcn.1401e1ae0
mov rax, qword [r13 + 8]
cmp dword [rax + 0x10], 1
je 0x1401e009d
lea rax, str.SoftwareMicrosoftWindowsShellNoRoamMUICache
mov qword [rbp + 0x78], rax
lea rax, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov qword [rbp + 0x80], rax
mov dword [rbp - 0x78], esi
cmp dword [r13 + 0x18], 0
jle 0x1401e009d
mov r14, rsi
mov qword [rbp + 0xd0], rsi
mov r15, qword [rsp + 0x68]
mov r13d, esi
mov dword [rsp + 0x70], esi
lea rsi, [rbp + 0x78]
mov qword [rbp - 0x68], rsi
nop
lea rdx, [0x140347f70]
lea rcx, [rbp + 0x68]
call fcn.1401fd200
nop
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
mov r12d, 0x5c
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.140200570
mov rdi, qword [r15 + 0x20]
mov ebx, dword [rbp + 0x74]
add ebx, dword [rdi + r14 + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x68]
call fcn.1401ff260
movsxd r9, dword [rdi + r14 + 0xc]
mov ecx, dword [rbp + 0x70]
movsxd rax, dword [rbp + 0x74]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x68]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi + r14]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x68]
call fcn.140200570
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1401ff260
movsxd rcx, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.140200570
mov rdx, qword [rsi]
lea rcx, [rbp + 0x68]
call fcn.1401fd8b0
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x68]
call fcn.1400ec370
mov r12, rax
mov qword [rbp + 0x758], rax
test rax, rax
je 0x1401e004f
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0xac0], rax
xor ebx, ebx
mov dword [rbp + 0xac8], ebx
mov qword [rbp + 0xad0], rbx
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0xac0]
mov rcx, r12
call fcn.1400ebe90
test al, al
je 0x1401e0023
mov eax, dword [rbp + 0xac8]
test eax, eax
jle 0x1401e0023
mov rsi, qword [rbp + 0xad0]
lea rdi, [rsi + 0xc]
mov r15d, eax
mov r12, qword [rsp + 0x68]
lea r13, [0x140348ca0]
nop word [rax + rax]
cmp dword [rdi], 2
jl 0x1401dfff6
mov edx, 1
mov rcx, rsi
call fcn.1401fd730
cmp ax, 0x3a
jne 0x1401dfff6
mov qword [rbp + 0x460], 0
mov edx, dword [rdi]
test edx, edx
jne 0x1401dfe9a
mov qword [rbp + 0x458], r13
jmp 0x1401dfec4
lea rcx, [rbp + 0x458]
call fcn.1401ff260
movsxd r9, dword [rdi]
mov eax, dword [rbp + 0x460]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0xc]
mov rcx, qword [rbp + 0x458]
call fcn.1402bd21c
mov edx, dword [rdi]
lea rcx, [rbp + 0x458]
call fcn.140200570
nop
lea rdx, [rbp + 0x458]
call fcn.1401d64e0
mov r8b, 1
lea rdx, [rbp + 0x458]
mov rcx, qword [r12 + 8]
call fcn.1400f92f0
mov r14, rax
test rax, rax
je 0x1401dffe1
mov qword [rbp + 0x298], 0
mov edx, dword [rbp + 0x74]
test edx, edx
jne 0x1401dff1a
mov qword [rbp + 0x290], r13
jmp 0x1401dff48
lea rcx, [rbp + 0x290]
call fcn.1401ff260
movsxd r9, dword [rbp + 0x74]
mov eax, dword [rbp + 0x298]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x290]
call fcn.1402bd21c
mov edx, dword [rbp + 0x74]
lea rcx, [rbp + 0x290]
call fcn.140200570
nop
lea rdx, [0x140347f58]
lea rcx, [rbp + 0x290]
call fcn.1401fd8b0
mov ebx, dword [rbp + 0x29c]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x290]
call fcn.1401ff260
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x298]
movsxd rax, dword [rbp + 0x29c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x290]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp + 0x290]
call fcn.140200570
lea rdx, [rbp + 0x290]
mov rcx, r14
call fcn.1400e41d0
nop
cmp dword [rbp + 0x298], 0
jle 0x1401dffdf
mov rcx, qword [rbp + 0x290]
call fcn.1402b9c20
xor ebx, ebx
cmp dword [rbp + 0x460], 0
jle 0x1401dfff6
mov rcx, qword [rbp + 0x458]
call fcn.1402b9c20
add rsi, 0x10
add rdi, 0x10
dec r15
jne 0x1401dfe60
mov r12, qword [rbp + 0x758]
mov r13d, dword [rsp + 0x70]
mov rsi, qword [rbp - 0x68]
mov r14, qword [rbp + 0xd0]
mov r15, qword [rsp + 0x68]
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
lea rbx, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0xac0], rbx
xor edx, edx
lea rcx, [rbp + 0xac0]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x70], 0
jle 0x1401e005e
mov rcx, qword [rbp + 0x68]
call fcn.1402b9c20
inc r13d
mov dword [rsp + 0x70], r13d
add rsi, 8
mov qword [rbp - 0x68], rsi
movsxd rax, r13d
cmp rax, 2
jb 0x1401dfd10
mov eax, dword [rbp - 0x78]
inc eax
mov dword [rbp - 0x78], eax
add r14, 0x10
mov qword [rbp + 0xd0], r14
cmp eax, dword [r15 + 0x18]
mov esi, 0
jl 0x1401dfd00
mov r8, qword [rbp + 0x170]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x170]
call fcn.140009b50
lea rcx, [rbp + 0x170]
call fcn.140009260
nop
lea rcx, [rbp + 0x558]
call fcn.140159c00
nop
lea rcx, [rbp + 0x868]
call fcn.1400c7d10
nop
lea rcx, [rbp + 0x2d0]
call fcn.140005eb0
nop
lea rcx, [rsp + 0x78]
call fcn.140005eb0
mov al, 1
mov rcx, qword [rbp + 0xf520]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0xf630]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret