Function at 0x180049e08
Capabilities:
Delete registry value
References logon banner
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1a8
xor r15d, r15d
mov r12, r9
mov edi, r8d
mov rbx, rdx
mov rax, rcx
test rdx, rdx
je 0x18004aacf
test r8d, r8d
je 0x18004aacf
mov r14d, r15d
mov dword [rbp + 0xf8], r15d
mov esi, r15d
mov dword [rsp + 0x54], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x180049eae
test byte [rcx + 0x1c], 8
je 0x180049eae
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0xa]
lea r8, [0x1800739c8]
call fcn.18001171c
mov rcx, qword [section..data]
mov rax, qword [rbp + 0xf0]
mov edx, dword [rbp + 0x110]
and edx, 0x10000
mov dword [rsp + 0x6c], edx
je 0x180049ee5
test rax, rax
je 0x180049ee5
lea r9, [rsp + 0x78]
mov rcx, rax
lea r8, [rsp + 0x70]
lea rdx, [0x180073998]
call fcn.180045460
mov rcx, qword [section..data]
mov dword [rsp + 0x50], r15d
mov r13d, 1
test edi, edi
je 0x18004a13d
mov eax, dword [rbp + 0x100]
mov r9, r15
mov qword [rbp - 0x70], r15
mov ecx, esi
lea rdi, [r9 + r9*2]
mov dword [rbp + 0x118], r15d
mov r9, qword [rbx + rdi*8]
test r9, r9
je 0x18004a11c
cmp qword [rbx + rdi*8 + 8], r15
je 0x18004a11c
xor edx, edx
mov r8d, 0x1be7
lea ecx, [rdx + 2]
call fcn.180038d90
mov rcx, qword [rbx + rdi*8]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov rdx, qword [rbx + rdi*8]
mov rsi, rax
test rax, rax
jne 0x180049fbc
mov r9, rdx
mov eax, 3
mov r8d, 0x1beb
mov dword [rsp + 0x54], eax
mov esi, eax
test r12, r12
je 0x180049f80
mov rdx, r12
mov ecx, eax
call fcn.18000dc90
jmp 0x180049f8a
mov edx, eax
mov ecx, r13d
call fcn.180038d90
test dword [rbp + 0x110], 0x2000000
je 0x18004a112
mov dword [rsp + 0x28], r15d
mov edx, esi
mov r8, qword [rbx + rdi*8]
xor r9d, r9d
mov ecx, 0x4000
mov dword [rsp + 0x20], r15d
call fcn.1800578e8
jmp 0x18004a112
sub rax, rdx
and rax, 0xfffffffffffffffe
cmp rax, 0xe
jne 0x180049fed
lea r8d, [rax - 7]
lea rcx, str.MACHINE
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x180049fed
mov r14, 0xffffffff80000002
jmp 0x18004a063
mov rdx, qword [rbx + rdi*8]
mov rax, rsi
sub rax, rdx
and rax, 0xfffffffffffffffe
cmp rax, 0xa
jne 0x18004a025
lea r8d, [rax - 5]
lea rcx, str.USERS
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x18004a025
mov r14, 0xffffffff80000003
jmp 0x18004a063
mov rdx, qword [rbx + rdi*8]
mov rax, rsi
sub rax, rdx
and rax, 0xfffffffffffffffe
cmp rax, 0x18
jne 0x18004aac6
lea r8d, [rax - 0xc]
lea rcx, str.CLASSES_ROOT
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x18004aac6
mov r14, 0xffffffff80000000
lea r15, [rsi + 2]
mov esi, 0x5c
mov qword [rbp - 0x78], r15
mov r13, r15
mov edx, esi
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x18004a08f
lea r13, [rax + 2]
jmp 0x18004a073
mov r12, qword [rbp + 0x108]
cmp r13, r15
jne 0x18004a1a4
mov r9, qword [rbx + rdi*8]
mov r14d, 3
xor r15d, r15d
mov dword [rsp + 0x54], r14d
mov esi, r14d
mov r8d, 0x1beb
test r12, r12
je 0x18004a0d0
mov rdx, r12
mov ecx, r14d
call fcn.18000dc90
lea r13d, [r14 - 2]
jmp 0x18004a0e1
mov r13d, 1
mov edx, r14d
mov ecx, r13d
call fcn.180038d90
test dword [rbp + 0x110], 0x2000000
je 0x18004a10b
mov r8, qword [rbx + rdi*8]
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov edx, r14d
mov ecx, 0x4000
mov dword [rsp + 0x20], r15d
call fcn.1800578e8
mov r14d, dword [rbp + 0xf8]
mov eax, dword [rbp + 0x100]
mov ecx, dword [rsp + 0x50]
mov r9, qword [rbp - 0x70]
add ecx, r13d
add r9, r13
mov dword [rsp + 0x50], ecx
mov qword [rbp - 0x70], r9
cmp ecx, eax
jb 0x180049f07
mov rcx, qword [section..data]
cmp qword [rsp + 0x70], r15
je 0x18004a158
mov edx, r13d
lea rcx, [rsp + 0x70]
call fcn.18004cd24
mov rcx, qword [section..data]
cmp qword [rsp + 0x78], r15
je 0x18004a173
mov edx, r13d
lea rcx, [rsp + 0x78]
call fcn.18004cd24
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x18004a19d
test byte [rcx + 0x1c], 8
je 0x18004a19d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1800739c8]
mov edx, 0xb
mov r9d, r14d
call fcn.180011748
mov eax, esi
jmp 0x18004aad1
xor ecx, ecx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov rdx, r15
mov word [r13 - 2], cx
mov dword [rsp + 0x28], 0x2001b
mov dword [rsp + 0x20], ecx
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
xor r8d, r8d
mov dword [rbp + 0xf8], eax
mov r14d, eax
test eax, eax
je 0x18004a1fe
cmp eax, 0xb7
jne 0x18004aa12
mov word [r13 - 2], si
xorps xmm0, xmm0
cmp dword [rbx + rdi*8 + 0x10], 4
mov esi, r8d
movdqu xmmword [rbp - 0x68], xmm0
jne 0x18004a28d
mov rdx, qword [rbx + rdi*8]
lea rcx, str.MACHINESystemCurrentControlSetControlLsaLmCompatibilityLevel
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
xor r8d, r8d
test eax, eax
jne 0x18004a28d
mov dword [rsp + 0x60], r8d
lea r9, [rsp + 0x60]
lea r8, str.PromoteUpgradeInProgress
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionSeCEdit
call fcn.180010b50
xor r8d, r8d
cmp dword [rsp + 0x60], r8d
je 0x18004a267
lea esi, [r8 + 1]
jmp 0x18004a28d
lea rdx, [rsp + 0x64]
mov dword [rbp - 0x80], r8d
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x64], r8d
call fcn.1800133f8
xor r8d, r8d
cmp dword [rsp + 0x64], r8d
lea eax, [r8 + 1]
cmovne esi, eax
cmp dword [rsp + 0x6c], r8d
je 0x18004a29d
cmp qword [rbp + 0xf0], r8
jne 0x18004a2a1
test esi, esi
je 0x18004a314
mov rax, qword [rbx + rdi*8]
mov r9d, 4
mov rcx, qword [rsp + 0x58]
mov rdx, r13
mov qword [rbp - 0x68], rax
mov eax, dword [rbx + rdi*8 + 0x10]
mov dword [rbp - 0x58], eax
lea rax, [rbp - 0x68]
mov dword [rbp - 0x54], r8d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.180048c94
xor r8d, r8d
mov r9d, eax
test eax, eax
je 0x18004a314
test esi, esi
jne 0x18004a2f2
mov rcx, qword [rbx + rdi*8]
mov r8d, 0x1cf2
mov qword [rsp + 0x20], rcx
jmp 0x18004a307
cmp r9d, 2
je 0x18004a314
mov rax, qword [rbx + rdi*8]
mov r8d, 0x1d54
mov qword [rsp + 0x20], rax
xor edx, edx
lea ecx, [rdx + 1]
call fcn.180038d90
xor r8d, r8d
mov ecx, dword [rbx + rdi*8 + 0x10]
cmp ecx, 4
jne 0x18004a400
mov rcx, qword [rbx + rdi*8 + 8]
call qword [sym.imp.msvcrt.dll__wtol]
nop dword [rax + rax]
mov edx, eax
mov dword [rsp + 0x68], eax
xor eax, eax
test esi, esi
je 0x18004a376
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x18004a376
call qword [sym.imp.msvcrt.dll__wtol]
nop dword [rax + rax]
mov edx, dword [rsp + 0x68]
cmp eax, edx
jle 0x18004a374
mov r9, qword [rbx + rdi*8]
xor edx, edx
mov r8d, 0x1d55
lea ecx, [rdx + 2]
call fcn.180038d90
jmp 0x18004a684
xor eax, eax
xorps xmm0, xmm0
mov dword [rbp + 0xf8], eax
movups xmmword [rbp + 0x40], xmm0
mov r14d, eax
mov word [r13 - 2], ax
mov eax, 1
lea r9, [rbp + 0x118]
movups xmmword [rbp + 0x60], xmm0
mov dword [rbp + 0x60], edx
lea r8, [rbp + 0x40]
mov rdx, r13
mov dword [rbp + 0x48], eax
mov rcx, r15
mov dword [rbp + 0x40], eax
movups xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x44], eax
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_2.dll_MDMWinsOverGP_IsGPPolicySetByMDMEx]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x118]
xor r15d, r15d
test eax, eax
cmovs ecx, r15d
mov dword [rbp + 0x118], ecx
lea eax, [r15 + 0x5c]
mov word [r13 - 2], ax
cmp dword [rbp + 0x118], r15d
jne 0x18004a9b9
lea ecx, [rax - 0x58]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x68]
mov r9d, ecx
jmp 0x18004a741
cmp ecx, 0xffffffff
jne 0x18004a4bb
xorps xmm0, xmm0
mov dword [rbp + 0xf8], r8d
mov eax, 1
mov word [r13 - 2], r8w
movups xmmword [rbp + 0x70], xmm0
mov r14d, r8d
mov dword [rbp + 0x70], eax
movups xmmword [rbp + 0x80], xmm0
lea r9, [rbp + 0x118]
mov dword [rbp + 0x74], eax
lea r8, [rbp + 0x70]
mov dword [rbp + 0x80], eax
mov rdx, r13
mov rcx, r15
movups xmmword [rbp + 0x90], xmm0
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_2.dll_MDMWinsOverGP_IsGPPolicySetByMDMEx]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x118]
xor r15d, r15d
test eax, eax
cmovs ecx, r15d
mov dword [rbp + 0x118], ecx
lea eax, [r15 + 0x5c]
mov word [r13 - 2], ax
cmp dword [rbp + 0x118], r15d
jne 0x18004a9b9
mov rcx, qword [rsp + 0x58]
mov rdx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov dword [rbp + 0xf8], eax
mov r14d, eax
cmp eax, 2
jne 0x18004a9b9
mov r14d, r15d
mov dword [rbp + 0xf8], r15d
jmp 0x18004a9b9
mov rdx, qword [rbx + rdi*8 + 8]
or r14, 0xffffffffffffffff
inc r14
cmp word [rdx + r14*2], r8w
jne 0x18004a4c4
lea eax, [rcx - 7]
test eax, 0xfffffffb
je 0x18004a76b
cmp ecx, 3
jne 0x18004a68c
xor r15d, r15d
test r14d, r14d
je 0x18004a99f
mov ecx, r14d
shr ecx, 1
and r14d, 1
lea eax, [rcx + 1]
cmove eax, ecx
xor ecx, ecx
mov edx, eax
mov r15d, eax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
xor eax, eax
test rsi, rsi
je 0x18004a677
lea ecx, [r15 - 1]
movsxd rdx, ecx
test ecx, ecx
js 0x18004a59d
lea r9d, [rax + 1]
mov r10d, 0x8000000f
mov r8, qword [rbx + rdi*8 + 8]
movzx ecx, word [r8 + rdx*4]
sub ecx, 0x30
and ecx, r10d
jge 0x18004a551
sub ecx, r9d
or ecx, 0xfffffff0
add ecx, r9d
test r14d, r14d
je 0x18004a577
test rdx, rdx
je 0x18004a595
movzx eax, word [r8 + rdx*4 - 2]
sub eax, 0x30
and eax, r10d
jge 0x18004a572
sub eax, r9d
or eax, 0xfffffff0
add eax, r9d
shl al, 4
jmp 0x18004a591
movzx eax, word [r8 + rdx*4 + 2]
sub eax, 0x30
and eax, r10d
jge 0x18004a58e
sub eax, r9d
or eax, 0xfffffff0
add eax, r9d
shl cl, 4
add cl, al
xor eax, eax
mov byte [rdx + rsi], cl
sub rdx, r9
jns 0x18004a536
mov rdx, qword [rbx + rdi*8]
lea rcx, str.MACHINESoftwareMicrosoftDriver_SigningPolicy
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
je 0x18004a65f
mov rcx, qword [rbp - 0x78]
lea eax, [r14 + 1]
xorps xmm0, xmm0
mov dword [rbp - 0x20], eax
lea r9, [rbp + 0x118]
mov dword [rbp - 0x1c], eax
lea r8, [rbp - 0x20]
mov dword [rbp - 4], r14d
mov rdx, r13
mov dword [rbp + 0xc], r14d
movdqu xmmword [rbp - 0x14], xmm0
mov dword [rbp - 0x18], 3
mov qword [rbp], rsi
mov dword [rbp + 8], r15d
mov word [r13 - 2], r14w
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_2.dll_MDMWinsOverGP_IsGPPolicySetByMDMEx]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x118]
test eax, eax
lea eax, [r14 + 0x5c]
cmovs ecx, r14d
mov dword [rbp + 0x118], ecx
mov word [r13 - 2], ax
cmp dword [rbp + 0x118], r14d
jne 0x18004a65f
mov rcx, qword [rsp + 0x58]
lea r9d, [r14 + 3]
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov r14d, eax
mov dword [rbp + 0xf8], eax
jmp 0x18004a666
mov r14d, dword [rbp + 0xf8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18004a684
mov r14d, 8
mov dword [rbp + 0xf8], r14d
xor r15d, r15d
jmp 0x18004a9b9
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
sub ecx, 1
je 0x18004a6c5
cmp ecx, 1
jne 0x18004a993
lea rcx, [0x18008b720]
call fcn.180009a24
xor r8d, r8d
test al, al
je 0x18004a993
mov rdx, qword [rbx + rdi*8 + 8]
mov eax, 1
mov qword [rbp + 0x30], rdx
mov word [r13 - 2], r8w
lea esi, [r14*2 + 2]
lea r8, [rbp + 0x10]
mov dword [rbp + 0x38], esi
mov rdx, r13
mov dword [rbp + 0x10], eax
lea r9, [rbp + 0x118]
mov dword [rbp + 0x14], eax
mov rcx, r15
mov dword [rbp + 0x18], 2
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_2.dll_MDMWinsOverGP_IsGPPolicySetByMDMEx]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x118]
xor r15d, r15d
test eax, eax
cmovs ecx, r15d
mov dword [rbp + 0x118], ecx
lea eax, [r15 + 0x5c]
mov word [r13 - 2], ax
cmp dword [rbp + 0x118], r15d
jne 0x18004a99f
mov rax, qword [rbx + rdi*8 + 8]
mov r9d, dword [rbx + rdi*8 + 0x10]
mov dword [rsp + 0x28], esi
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov r14d, eax
mov dword [rbp + 0xf8], eax
jmp 0x18004a9b9
mov r12d, r8d
cmp ecx, 7
jne 0x18004a822
mov rdx, qword [rbx + rdi*8]
lea rcx, str.MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystemLegalNoticeText
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x18004a822
mov rdx, qword [rbx + rdi*8 + 8]
lea r9d, [rax + 1]
mov r12d, r9d
lea r8d, [r14 + 1]
xor ecx, ecx
lea r10d, [rax + 0x2c]
cmp word [rdx], r10w
lea eax, [rcx + 1]
lea rdx, [rdx + 2]
cmovne eax, ecx
mov ecx, eax
sub r8, r9
jne 0x18004a7ac
add eax, r14d
xor ecx, ecx
lea eax, [rax*2 + 4]
mov edx, eax
mov r14d, eax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x18004a810
mov r8d, r14d
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + rdi*8 + 8]
mov rdx, rsi
call fcn.180049934
mov r14d, eax
xor ecx, ecx
mov eax, dword [rbp + 0xf8]
jmp 0x18004a895
mov r14d, 8
mov dword [rbp + 0xf8], r14d
jmp 0x18004a9af
lea eax, [r14 + 2]
xor ecx, ecx
lea rdx, [rax + rax]
mov r15d, eax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
xor ecx, ecx
mov rsi, rax
test rax, rax
je 0x18004a886
mov r8, qword [rbx + rdi*8 + 8]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
xor ecx, ecx
mov eax, r14d
lea edx, [r14 + 1]
xor r9d, r9d
mov word [rsi + rdx*2], cx
mov word [rsi + rax*2], cx
lea r8d, [rcx + 0x2c]
mov rcx, rsi
call fcn.180012b44
mov eax, dword [rbp + 0xf8]
xor ecx, ecx
jmp 0x18004a891
mov eax, 8
mov dword [rbp + 0xf8], eax
mov r15, qword [rbp - 0x78]
test eax, eax
jne 0x18004a9a8
lea edx, [rax + 1]
xorps xmm0, xmm0
mov eax, edx
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
test r12d, r12d
jne 0x18004a8ba
mov eax, dword [rbx + rdi*8 + 0x10]
sub eax, 1
je 0x18004a8d1
cmp eax, 6
jne 0x18004a973
mov dword [rbp - 0x48], 4
jmp 0x18004a8d8
mov dword [rbp - 0x48], 2
mov dword [rbp - 0x50], edx
lea r14d, [r14*2 + 4]
mov dword [rbp - 0x4c], edx
lea r9, [rbp + 0x118]
mov word [r13 - 2], cx
lea r8, [rbp - 0x50]
mov rdx, r13
mov dword [rbp - 0x28], r14d
mov rcx, r15
mov qword [rbp - 0x30], rsi
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_2.dll_MDMWinsOverGP_IsGPPolicySetByMDMEx]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x118]
xor r15d, r15d
test eax, eax
cmovs ecx, r15d
mov dword [rbp + 0x118], ecx
lea eax, [r15 + 0x5c]
mov word [r13 - 2], ax
cmp dword [rbp + 0x118], r15d
jne 0x18004a976
test r12d, r12d
je 0x18004a942
lea r9d, [r15 + 1]
jmp 0x18004a947
mov r9d, dword [rbx + rdi*8 + 0x10]
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov rdx, r13
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov r14d, eax
mov dword [rbp + 0xf8], eax
jmp 0x18004a97d
xor r15d, r15d
mov r14d, dword [rbp + 0xf8]
test rsi, rsi
je 0x18004a9b2
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18004a9b2
mov r14d, dword [rbp + 0xf8]
jmp 0x18004a684
mov r14d, dword [rbp + 0xf8]
jmp 0x18004a9b9
mov r14d, dword [rbp + 0xf8]
xor r15d, r15d
mov r12, qword [rbp + 0x108]
cmp dword [rsp + 0x6c], r15d
je 0x18004a9ea
cmp qword [rbp + 0xf0], r15
je 0x18004a9ea
mov r8, qword [rbx + rdi*8]
lea rax, [rbp - 0x68]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call fcn.180044e48
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x18004a9ff
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x18004aa15
xor r15d, r15d
test r14d, r14d
je 0x18004aa68
test r12, r12
je 0x18004aa34
mov r9, qword [rbx + rdi*8]
mov r8d, 0x1c76
mov rdx, r12
mov ecx, r14d
call fcn.18000dc90
lea eax, [r14 - 2]
mov r13d, 1
cmp eax, r13d
jbe 0x18004aa6e
mov r9, qword [rbx + rdi*8]
mov r8d, 0x1c76
mov edx, r14d
mov ecx, r13d
call fcn.180038d90
mov ecx, r14d
call fcn.18000ec90
mov esi, eax
mov dword [rsp + 0x54], eax
jmp 0x18004aa72
mov r13d, 1
mov esi, dword [rsp + 0x54]
test dword [rbp + 0x110], 0x2000000
je 0x18004a112
mov ecx, dword [rbp + 0x118]
test ecx, ecx
jne 0x18004aab0
mov r8, qword [rbx + rdi*8]
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov edx, r14d
mov ecx, 0x4000
mov dword [rsp + 0x20], r15d
call fcn.1800578e8
mov ecx, dword [rbp + 0x118]
cmp ecx, r13d
jne 0x18004a112
mov dword [rsp + 0x28], r13d
mov edx, r14d
jmp 0x180049fa1
mov r9, qword [rbx + rdi*8]
jmp 0x180049f5e
xor eax, eax
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret