Function at 0x140026ba0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9d0]
sub rsp, 0xad0
mov rax, qword [0x14004d2c0]
xor rax, rsp
mov qword [rbp + 0x9c0], rax
mov r15, r9
movsxd r12, r8d
xor r14d, r14d
mov dword [rbp - 0x68], r14d
mov qword [rbp - 0x18], r14
lea rcx, [rbp - 0x18]
call fcn.14002aea0
lea r13, [r14 - 1]
mov rdi, qword [rbp - 0x18]
mov qword [rbp - 0x60], rdi
test al, al
jne 0x140026c0b
lea r15d, [r14 + 1]
jmp 0x140028241
test rdi, rdi
je 0x140026c15
mov rsi, qword [rdi]
jmp 0x140026c18
mov rsi, r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], r14
mov qword [rbp + 0x188], r14
mov r8, r13
inc r8
cmp word [rsi + r8*2], r14w
jne 0x140026c33
mov rdx, rsi
lea rcx, [rbp + 0x170]
call fcn.14001e6b0
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
je 0x140026c7a
mov rbx, rsi
mov r14d, eax
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rbx], ax
lea rbx, [rbx + 2]
sub r14, 1
jne 0x140026c64
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], r14
mov r8, r13
inc r8
cmp word [rsi + r8*2], 0
jne 0x140026c95
mov rdx, rsi
lea rcx, [rbp + 0xd0]
call fcn.14001e6b0
lea rdx, [rbp + 0xd0]
mov r8, qword [rbp + 0xd0]
mov r10, qword [rbp + 0xe8]
cmp r10, 7
cmova rdx, r8
mov rbx, qword [rbp + 0xe0]
test rbx, rbx
je 0x140026d09
lea rcx, [rbx - 1]
mov rax, r13
cmp rcx, r13
cmovb rax, rcx
lea r9, [rdx + rax*2]
cmp word [r9], 0x2e
je 0x140026d01
cmp r9, rdx
je 0x140026d09
sub r9, 2
cmp word [r9], 0x2e
jne 0x140026cf1
sub r9, rdx
sar r9, 1
jmp 0x140026d0c
mov r9, r13
cmp rbx, r9
jb 0x1400282bf
mov rax, rbx
sub rax, r9
mov rdx, r13
cmp rax, r13
cmovb rdx, rax
lea rax, [rbp + 0xd0]
cmp r10, 7
cmova rax, r8
lea rcx, [rax + r9*2]
sub rbx, rdx
mov r8, rbx
sub r8, r9
lea r8, [r8*2 + 2]
lea rdx, [rcx + rdx*2]
call fcn.14003a816
mov qword [rbp + 0xe0], rbx
lea r8, [rbp + 0xd0]
mov r9, qword [rbp + 0xd0]
mov r10, qword [rbp + 0xe8]
cmp r10, 7
cmova r8, r9
test rbx, rbx
je 0x140026daa
lea rcx, [rbx - 1]
mov rax, r13
cmp rcx, r13
cmovb rax, rcx
lea rdx, [r8 + rax*2]
cmp word [rdx], 0x5c
je 0x140026da2
cmp rdx, r8
je 0x140026daa
sub rdx, 2
cmp word [rdx], 0x5c
jne 0x140026d93
sub rdx, r8
sar rdx, 1
jmp 0x140026dad
mov rdx, r13
cmp rbx, rdx
cmovb rdx, rbx
lea rcx, [rbp + 0xd0]
cmp r10, 7
cmova rcx, r9
sub rbx, rdx
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rdx*2]
call fcn.14003a816
mov qword [rbp + 0xe0], rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r14
mov qword [rbp + 0x108], r14
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, str._acroiefavclient
lea rcx, [rbp + 0xf0]
call fcn.14001e6b0
mov qword [rbp - 0x78], r14
mov ecx, 0x48
call fcn.1400395d4
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x80], rax
mov rax, r12
mov qword [rbp - 0x58], rax
mov r12d, 1
test rax, rax
jle 0x140027102
mov qword [rsp + 0x60], r14
lea r12, [r15 + 0x10]
mov qword [rsp + 0x58], r12
xor r15d, r15d
nop dword [rax]
mov rdx, qword [r12 - 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], r15
mov r8, r13
inc r8
cmp word [rdx + r8*2], 0
jne 0x140026e80
lea rcx, [rbp + 0x110]
call fcn.14001e6b0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1400395d4
mov qword [rbp - 0x50], rax
mov rcx, qword [r12 - 8]
mov qword [rax], rcx
mov ecx, dword [r12]
mov dword [rax + 8], ecx
mov r13, qword [rbp - 0x80]
mov qword [rbp - 0x48], r13
mov r10, qword [r13 + 8]
mov qword [rbp - 0x40], r10
mov dword [rbp - 0x38], r15d
mov rsi, r13
mov r14, qword [rbp + 0x128]
mov rbx, qword [rbp + 0x120]
mov r15, qword [rbp + 0x110]
cmp byte [r10 + 0x19], 0
jne 0x140026f9d
mov rdi, 0xffffffffffffffff
lea r13d, [rdi + 2]
xor r12d, r12d
nop dword [rax]
mov qword [rbp - 0x40], r10
lea rdx, [r10 + 0x20]
lea rax, [rbp + 0x110]
cmp r14, 7
cmova rax, r15
mov r11, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140026f25
mov rdx, qword [rdx]
mov rcx, r11
cmp rbx, r11
cmovb rcx, rbx
test rcx, rcx
je 0x140026f54
sub rdx, rax
nop word [rax + rax]
movzx r8d, word [rax + rdx]
cmp r8w, word [rax]
jne 0x140026f5d
add rax, 2
sub rcx, r13
jne 0x140026f40
cmp r11, rbx
jae 0x140026f65
mov eax, edi
jmp 0x140026f6b
mov eax, r13d
cmovb eax, edi
jmp 0x140026f6b
mov eax, r12d
seta al
shr eax, 0x1f
test al, al
je 0x140026f7c
mov dword [rbp - 0x38], r12d
mov r10, qword [r10 + 0x10]
jmp 0x140026f86
mov dword [rbp - 0x38], r13d
mov rsi, r10
mov r10, qword [r10]
cmp byte [r10 + 0x19], r12b
je 0x140026f00
mov rdi, qword [rbp - 0x60]
mov r12, qword [rsp + 0x58]
mov r13, qword [rbp - 0x48]
cmp byte [rsi + 0x19], 0
jne 0x14002701c
lea rax, [rsi + 0x20]
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140026fb5
mov rax, qword [rax]
lea r9, [rbp + 0x110]
cmp r14, 7
cmova r9, r15
mov rcx, rbx
cmp r10, rbx
cmovb rcx, r10
test rcx, rcx
je 0x140026fea
sub r9, rax
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x140026ff8
add rax, 2
sub rcx, 1
jne 0x140026fd6
xor r15d, r15d
cmp rbx, r10
jae 0x14002700c
lea eax, [r15 - 1]
jmp 0x140027015
mov eax, 1
mov rcx, 0xffffffffffffffff
cmovb eax, ecx
xor r15d, r15d
jmp 0x140027015
mov eax, r15d
cmp rbx, r10
seta al
shr eax, 0x1f
test al, al
je 0x140027083
movabs rax, 0x38e38e38e38e38e
cmp qword [rbp - 0x78], rax
je 0x1400282c5
mov edx, 1
lea rcx, [rbp - 0x80]
call fcn.14002b9a0
mov rsi, rax
lea rdx, [rbp + 0x110]
lea rcx, [rax + 0x20]
call fcn.14001ebd0
xor r15d, r15d
mov qword [rsi + 0x40], r15
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], r13
mov word [rsi + 0x18], r15w
movups xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp + 0x40], xmm0
mov r8, rsi
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.14001f490
mov rsi, rax
mov rax, qword [rbp - 0x50]
mov qword [rsi + 0x40], rax
mov rdx, qword [rbp + 0x128]
cmp rdx, 7
jbe 0x1400270ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400270c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400270fb
call fcn.140039610
nop
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x60], rax
add r12, 0x18
mov qword [rsp + 0x58], r12
mov r13, 0xffffffffffffffff
cmp rax, qword [rbp - 0x58]
jl 0x140026e60
lea r12d, [r13 + 2]
jmp 0x140027105
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor r15d, r15d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov r14, r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x78], r15
mov qword [rbp + 0x20], r15
mov dword [rbp + 0x28], r15d
mov qword [rbp + 0x30], r15
mov r9d, 0xf003f
mov r8, qword [str.SoftwareMicrosoftInternet_Explorer_]
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x20]
call fcn.14002b3c0
test eax, eax
jne 0x140027fe8
mov qword [rbp - 0x10], r15
mov dword [rbp - 8], r15d
mov qword [rbp], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, qword [str.MenuExt]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x10]
call fcn.14002b230
test eax, eax
jne 0x140027fb7
mov ebx, r15d
mov dword [rsp + 0x50], ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.14003a810
mov dword [rbp - 0x6c], 0x104
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x6c]
lea r8, [rbp + 0x3a0]
mov edx, ebx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop
test eax, eax
jne 0x140027a64
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], r15
lea rax, [rbp + 0x3a0]
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140027210
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0xb0]
call fcn.14001e6b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r15
mov rdx, qword [str.SoftwareMicrosoftInternet_Explorer_]
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140027250
lea rcx, [rbp + 0x50]
call fcn.14001e6b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r15
mov qword [rbp + 0x148], r15
mov rdx, qword [str.MenuExt]
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140027290
lea rcx, [rbp + 0x130]
call fcn.14001e6b0
lea r9, [rbp + 0x130]
mov rsi, qword [rbp + 0x130]
mov r15, qword [rbp + 0x148]
cmp r15, 7
cmova r9, rsi
mov r12, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
sub rax, r12
mov r14, qword [rbp + 0x140]
cmp r14, rax
ja 0x14002730f
lea rax, [r14 + r12]
mov qword [rbp + 0x60], rax
lea rbx, [rbp + 0x50]
cmp rcx, 7
cmova rbx, qword [rbp + 0x50]
lea rcx, [rbx + r12*2]
lea r8, [r14 + r14]
mov rdx, r9
call fcn.14003a816
lea rax, [r12 + r14]
xor ecx, ecx
mov word [rbx + rax*2], cx
jmp 0x140027331
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x50]
call fcn.14001f720
mov r15, qword [rbp + 0x148]
mov rsi, qword [rbp + 0x130]
cmp r15, 7
jbe 0x14002736d
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140027364
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027a4f
mov rcx, rsi
call fcn.140039610
nop
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
mov r12d, 1
cmp rcx, rdx
jae 0x14002739e
lea rax, [rcx + 1]
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x50]
cmp rdx, 7
cmova rax, qword [rbp + 0x50]
mov dword [rax + rcx*2], 0x5c
jmp 0x1400273b3
mov r9d, 0x5c
xor r8d, r8d
mov rdx, r12
lea rcx, [rbp + 0x50]
call fcn.14002a9d0
xor r15d, r15d
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova r9, qword [rbp + 0xb0]
mov r14, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
sub rax, r14
mov rsi, qword [rbp + 0xc0]
cmp rsi, rax
ja 0x140027417
lea rax, [rsi + r14]
mov qword [rbp + 0x60], rax
lea rbx, [rbp + 0x50]
cmp rcx, 7
cmova rbx, qword [rbp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rsi + rsi]
mov rdx, r9
call fcn.14003a816
lea rax, [r14 + rsi]
mov word [rbx + rax*2], r15w
jmp 0x140027432
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x50]
call fcn.14001f720
mov rsi, qword [rbp + 0xc0]
mov r14, qword [rbp - 0x80]
mov r10, qword [r14 + 8]
mov rbx, r14
cmp byte [r10 + 0x19], 0
jne 0x1400274dc
nop dword [rax + rax]
lea rdx, [r10 + 0x20]
lea rax, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rax, qword [rbp + 0xb0]
mov r11, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140027479
mov rdx, qword [rdx]
mov rcx, r11
cmp rsi, r11
cmovb rcx, rsi
test rcx, rcx
je 0x1400274a5
sub rdx, rax
nop dword [rax + rax]
movzx r8d, word [rdx + rax]
cmp r8w, word [rax]
jne 0x1400274af
add rax, 2
sub rcx, 1
jne 0x140027490
cmp r11, rsi
jae 0x1400274b8
mov eax, r13d
jmp 0x1400274be
mov eax, r12d
cmovb eax, r13d
jmp 0x1400274be
mov eax, r15d
seta al
shr eax, 0x1f
test al, al
je 0x1400274cb
mov r10, qword [r10 + 0x10]
jmp 0x1400274d1
mov rbx, r10
mov r10, qword [r10]
cmp byte [r10 + 0x19], 0
je 0x140027450
cmp byte [rbx + 0x19], 0
jne 0x1400275a6
lea rax, [rbx + 0x20]
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1400274f8
mov rax, qword [rax]
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova r9, qword [rbp + 0xb0]
mov rcx, rsi
cmp r10, rsi
cmovb rcx, r10
test rcx, rcx
je 0x140027535
sub r9, rax
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x14002753f
add rax, 2
sub rcx, 1
jne 0x140027521
cmp rsi, r10
jae 0x140027548
mov eax, r13d
jmp 0x14002754e
mov eax, r12d
cmovb eax, r13d
jmp 0x14002754e
mov eax, r15d
seta al
shr eax, 0x1f
test al, al
jne 0x1400275a6
cmp rbx, r14
je 0x1400275a6
mov rbx, qword [rsp + 0x70]
cmp rbx, qword [rsp + 0x58]
je 0x140027583
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call fcn.14001ebd0
add rbx, 0x20
mov qword [rsp + 0x70], rbx
jmp 0x1400279a4
lea r8, [rbp + 0xb0]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002a750
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
jmp 0x1400279a4
mov r14, r15
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rdx, qword [rbp + 0x50]
mov qword [rbp + 8], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400275e5
mov eax, r15d
mov r14, qword [rbp + 8]
test eax, eax
jne 0x140027995
mov dword [rbp - 0x70], 0x208
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002765b
mov eax, dword [rbp - 0x28]
dec eax
cmp eax, 1
jbe 0x140027630
mov eax, SafeArrayGetDim
jmp 0x14002765b
mov eax, dword [rbp - 0x70]
test eax, eax
je 0x140027650
test al, 1
jne 0x140027649
shr rax, 1
cmp word [rbp + rax*2 + 0x18e], 0
je 0x140027658
mov eax, SafeArrayGetDim
jmp 0x14002765b
mov word [rbp + 0x190], r15w
mov eax, r15d
test eax, eax
jne 0x140027995
lea rbx, [rbp + 0x190]
mov esi, 0x104
nop
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rbx], ax
lea rbx, [rbx + 2]
sub rsi, 1
jne 0x140027670
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
lea rax, [rbp + 0x190]
mov r8, r13
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400276b0
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x90]
call fcn.14001e6b0
lea r10, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
seta sil
cmova r10, qword [rbp + 0x90]
mov rbx, qword [rbp + 0xa0]
cmp rbx, 6
jb 0x140027974
lea r11, [rbx - 5]
lea r11, [r10 + r11*2]
mov rcx, r10
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, r15
je 0x14002773a
cmp word [rcx], 0x72
je 0x140027737
cmp rax, 1
je 0x14002773a
dec rax
add rcx, 2
cmp word [rcx], 0x72
jne 0x140027724
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140027974
mov r8d, 6
lea rax, str.res:__
mov rdx, rax
mov r9, rcx
sub r9, rax
nop dword [rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140027817
add rdx, 2
sub r8, 1
jne 0x140027760
sub rcx, r10
sar rcx, 1
jne 0x140027974
mov eax, 6
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x90]
test sil, sil
cmovne rcx, qword [rbp + 0x90]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.14003a816
mov qword [rbp + 0xa0], rbx
lea r8, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
seta r10b
mov r9, qword [rbp + 0x90]
cmova r8, r9
test rbx, rbx
je 0x140027820
lea rcx, [rbx - 1]
mov rax, r13
cmp rcx, 0xffffffffffffffff
cmovb rax, rcx
lea rdx, [r8 + rax*2]
cmp word [rdx], 0x2f
je 0x14002780f
nop dword [rax]
cmp rdx, r8
je 0x140027820
sub rdx, 2
cmp word [rdx], 0x2f
jne 0x140027800
sub rdx, r8
sar rdx, 1
jmp 0x140027823
add rcx, 2
jmp 0x140027710
mov rdx, r13
mov r8, rbx
sub r8, rdx
cmp rbx, rdx
jb 0x1400282b9
lea rax, [rbp + 0x90]
test r10b, r10b
cmovne rax, r9
lea rcx, [rax + rdx*2]
movzx eax, word [rcx + r8*2]
mov word [rcx], ax
mov qword [rbp + 0xa0], rdx
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova rcx, qword [rbp + 0x90]
mov r8d, 0x104
lea rdx, [rbp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1400278ee
lea rbx, [rbp + 0x5b0]
mov esi, 0x104
nop dword [rax]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rbx], ax
lea rbx, [rbx + 2]
sub rsi, 1
jne 0x140027890
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 7
cmova rdx, qword [rbp + 0xd0]
lea rcx, [rbp + 0x5b0]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
jne 0x140027930
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 7
cmova rdx, qword [rbp + 0xf0]
lea rcx, [rbp + 0x5b0]
jmp 0x140027926
cmp qword [rbp + 0xa0], 0
jbe 0x140027974
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 7
cmova rdx, qword [rbp + 0xf0]
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova rcx, qword [rbp + 0x90]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x140027974
mov rbx, qword [rsp + 0x70]
cmp rbx, qword [rsp + 0x58]
je 0x140027956
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call fcn.14001ebd0
add rbx, 0x20
mov qword [rsp + 0x70], rbx
jmp 0x140027974
lea r8, [rbp + 0xb0]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14002a750
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov r8, qword [rbp + 0xa8]
cmp r8, 7
jbe 0x140027995
mov rdx, qword [rbp + 0x90]
lea rcx, [rbp + 0x90]
call fcn.14002b8c0
nop
test r14, r14
je 0x1400279a4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov dword [rbp - 0x6c], 0x104
mov ebx, dword [rsp + 0x50]
inc ebx
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x1400279f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400279ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027a56
call fcn.140039610
nop
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r15w
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x1400271b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027a44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027a5d
call fcn.140039610
nop
jmp 0x1400271b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r12, qword [rsp + 0x68]
mov rbx, r12
mov r13, qword [rsp + 0x70]
cmp r12, r13
je 0x140027be0
mov r15d, dword [rbp - 8]
or r15d, 0x2001f
xor edi, edi
nop word [rax + rax]
mov r14, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140027a9d
mov r14, qword [rbx]
mov rsi, rdi
mov qword [rbp - 0x40], rdi
mov dword [rbp - 0x38], edi
mov qword [rbp - 0x30], rdi
mov qword [rbp + 0x10], rdi
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x140027ae6
mov ecx, edi
mov rsi, qword [rbp + 0x10]
mov qword [rbp - 0x40], rsi
mov eax, r15d
and eax, 0x300
mov dword [rbp - 0x38], eax
test ecx, ecx
je 0x140027b01
test rsi, rsi
je 0x140027bcf
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140027bcf
mov dword [rsp + 0x50], 0x100
lea rax, [rbp + 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x7c0]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140027b97
nop dword [rax]
lea rdx, [rbp + 0x7c0]
lea rcx, [rbp - 0x40]
call fcn.140022f70
test eax, eax
jne 0x140027bbe
mov dword [rsp + 0x50], 0x100
lea rax, [rbp + 0x18]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x7c0]
xor edx, edx
mov rsi, qword [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140027b40
xor edi, edi
test rsi, rsi
je 0x140027bac
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rdi
mov qword [rbp - 0x40], rdi
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.140021e00
nop
jmp 0x140027aea
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140027bcd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
add rbx, 0x20
cmp rbx, r13
jne 0x140027a90
mov rdi, qword [rbp - 0x60]
mov r15, qword [rbp - 0x80]
mov qword [rbp - 0x48], r15
mov rbx, qword [r15]
cmp rbx, r15
je 0x140027fbc
mov r13d, 0x2f
xor r12d, r12d
nop dword [rax]
mov rsi, qword [rbx + 0x40]
mov qword [rbp - 0x50], rsi
mov r14, r12
mov qword [rsp + 0x60], r12
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 7
jbe 0x140027c1e
mov rdx, qword [rdx]
mov qword [rbp - 0x58], r12
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140027c66
mov eax, r12d
mov r14, qword [rbp - 0x58]
mov qword [rsp + 0x60], r14
test eax, eax
jne 0x140027f79
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], r12
lea r8d, [rax + 6]
lea rdx, str.res:__
lea rcx, [rbp + 0x70]
call fcn.14001e6b0
lea r9, [rbp + 0x170]
cmp qword [rbp + 0x188], 7
cmova r9, qword [rbp + 0x170]
mov r14, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
sub rax, r14
mov r15, qword [rbp + 0x180]
cmp r15, rax
ja 0x140027d05
lea rax, [r15 + r14]
mov qword [rbp + 0x80], rax
lea rsi, [rbp + 0x70]
cmp rcx, 7
cmova rsi, qword [rbp + 0x70]
lea rcx, [rsi + r14*2]
lea r8, [r15 + r15]
mov rdx, r9
call fcn.14003a816
lea rax, [r14 + r15]
mov word [rsi + rax*2], r12w
mov rsi, qword [rbp - 0x50]
jmp 0x140027d19
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp + 0x70]
call fcn.14001f720
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x88]
cmp rcx, rdx
jae 0x140027d4d
lea rax, [rcx + 1]
mov qword [rbp + 0x80], rax
lea rax, [rbp + 0x70]
cmp rdx, 7
cmova rax, qword [rbp + 0x70]
mov dword [rax + rcx*2], 0x2f
jmp 0x140027d60
mov r9d, r13d
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x70]
call fcn.14002a9d0
mov rdx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x168], r12
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140027d82
lea rcx, [rbp + 0x150]
call fcn.14001e6b0
lea r9, [rbp + 0x150]
mov r14, qword [rbp + 0x150]
mov r12, qword [rbp + 0x168]
cmp r12, 7
cmova r9, r14
mov r13, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
sub rax, r13
mov r15, qword [rbp + 0x160]
cmp r15, rax
ja 0x140027e0e
lea rax, [r15 + r13]
mov qword [rbp + 0x80], rax
lea rsi, [rbp + 0x70]
cmp rcx, 7
cmova rsi, qword [rbp + 0x70]
lea rcx, [rsi + r13*2]
lea r8, [r15 + r15]
mov rdx, r9
call fcn.14003a816
lea rax, [r15 + r13]
xor ecx, ecx
mov word [rsi + rax*2], cx
mov rsi, qword [rbp - 0x50]
jmp 0x140027e30
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp + 0x70]
call fcn.14001f720
mov r12, qword [rbp + 0x168]
mov r14, qword [rbp + 0x150]
cmp r12, 7
jbe 0x140027e6c
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140027e63
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027fda
mov rcx, r14
call fcn.140039610
nop
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x140027ec6
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140027e90
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov r14, qword [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140027ecb
mov r14, qword [rsp + 0x60]
mov eax, dword [rsi + 8]
mov dword [rbp - 0x20], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Contexts
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140027f40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027f3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027fe1
call fcn.140039610
nop
mov r13d, 0x2f
xor r12d, r12d
mov r15, qword [rbp - 0x48]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140027f82
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140027f74
cmp rbx, qword [rax + 0x10]
jne 0x140027f74
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140027f61
mov rbx, rax
jmp 0x140027f9f
mov dword [rbp - 0x68], 1
jmp 0x140027f4d
mov rbx, rax
mov rdx, qword [rax]
cmp byte [rdx + 0x19], 0
jne 0x140027f9f
nop
mov rbx, rdx
mov rax, qword [rdx]
mov rdx, rax
cmp byte [rax + 0x19], 0
je 0x140027f90
test r14, r14
je 0x140027fae
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rbx, r15
jne 0x140027c00
mov r12, qword [rsp + 0x68]
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140027fcf
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov r14, qword [rsp + 0x58]
mov r15d, dword [rbp - 0x68]
jmp 0x140027ff0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r15d, r12d
mov r12, qword [rsp + 0x68]
mov rsi, qword [rbp - 0x80]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x140028064
nop dword [rax]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, qword [rbx + 0x40]
call fcn.140039610
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14002803a
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140028035
cmp rbx, qword [rax + 0x10]
jne 0x140028035
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140028022
mov rbx, rax
jmp 0x14002805f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14002805f
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140028050
cmp rbx, rsi
jne 0x140028000
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140028074
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test r12, r12
je 0x1400280d3
mov rbx, r12
mov rsi, qword [rsp + 0x70]
cmp r12, rsi
je 0x140028097
mov rcx, rbx
call fcn.14001ed20
add rbx, 0x20
cmp rbx, rsi
jne 0x140028086
sub r14, r12
and r14, 0xffffffffffffffe0
mov rax, r12
cmp r14, 0x1000
jb 0x1400280c7
add r14, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400280c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, r12
call fcn.140039610
nop
mov rax, qword [rbp - 0x80]
mov rsi, qword [rax + 8]
cmp byte [rsi + 0x19], 0
jne 0x140028116
mov r8, qword [rsi + 0x10]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.14002a950
mov rbx, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x20]
call fcn.14001ed20
nop
mov edx, 0x48
mov rcx, rbx
call fcn.140039610
nop
cmp byte [rsi + 0x19], 0
je 0x1400280e1
mov edx, 0x48
mov rcx, qword [rbp - 0x80]
call fcn.140039610
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 7
jbe 0x14002816f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028169
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028169
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140039610
nop
xor r14d, r14d
mov qword [rbp + 0x100], r14
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], r14w
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x1400281d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400281d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400281d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140039610
nop
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r14w
mov rdx, qword [rbp + 0x188]
cmp rdx, 7
jbe 0x14002823a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028234
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028234
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140039610
nop
mov r13, 0xffffffffffffffff
test rdi, rdi
je 0x140028286
lock xadd dword [rdi + 0x10], r13d
cmp r13d, 1
jne 0x140028286
mov rbx, qword [rbp - 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140028267
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140028279
call fcn.140039610
mov qword [rbx + 8], r14
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.140039610
mov eax, r15d
mov rcx, qword [rbp + 0x9c0]
xor rcx, rsp
call fcn.140039850
lea r11, [rsp + 0xad0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140020430
int3
call fcn.140020430
int3
call fcn.14001f6f0
int3