Function at 0x10010beac
Capabilities:
Check if file exists
Delete registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x500
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x100175150]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov r14d, r9d
mov r15, r8
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor ebx, ebx
mov ebp, ebx
lea r12d, [rbx + 1]
lea rcx, [0x1000408f8]
call fcn.10011c52c
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x2d0], rbx
xor edx, edx
mov r8d, 0x220
lea rcx, [rsp + 0xb0]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x2e0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2e2]
call sub.msvcrt.dll_memset
cmp rdi, rbx
jne 0x10010bfe1
mov r12d, ebx
lea ebp, [rbx + 0x57]
lea rbx, [0x100176368]
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c90d
test byte [rcx + 0x1c], 8
je 0x10010c908
lea edx, [rbp - 0x46]
lea rax, [0x100040920]
mov qword [rsp + 0x20], rax
mov r9d, ebp
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
lea rcx, [0x100044490]
call fcn.10011c52c
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
xor edx, edx
lea rcx, [0x100044390]
call fcn.100121ba4
mov rsi, qword [rsp + 0x38]
lea rbx, [0x100176368]
xor edi, edi
cmp eax, edi
jne 0x10010c07b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10010c0d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010c0d0
test byte [rax + 0x1c], 8
je 0x10010c0d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x20
lea rax, [0x10003f980]
mov qword [rsp + 0x20], rax
lea r8, [0x100002e10]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
jmp 0x10010c0d0
lea rdx, [0x1000444b8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test eax, eax
je 0x10010c0ce
cmp eax, 2
je 0x10010c0ce
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c0d0
test byte [rcx + 0x1c], 8
je 0x10010c0d0
mov edx, 0x21
lea rax, [0x1000444d8]
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, [0x100002e10]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
jmp 0x10010c0d0
xor edi, edi
test rsi, rsi
je 0x10010c0de
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x100044490]
call fcn.10011c56c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [0x100040930]
call fcn.10011c614
xor ecx, ecx
cmp eax, ecx
jne 0x10010c162
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c903
test byte [rcx + 0x1c], 8
je 0x10010c8fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x12
lea rcx, [0x10003fe78]
mov qword [rsp + 0x20], rcx
lea r8, [0x1000040d0]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
lea rcx, [rsp + 0x40]
call fcn.10011f948
xor edx, edx
cmp eax, edx
jne 0x10010c1d0
mov r12d, edx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010c1c8
test byte [rax + 0x1c], 8
je 0x10010c1c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x13
lea rcx, [0x10003fe78]
mov qword [rsp + 0x20], rcx
lea r8, [0x1000040d0]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
xor eax, eax
or rcx, 0xffffffffffffffff
mov r8, qword [rsp + 0x40]
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
lea esi, [rax + 1]
sub rcx, rsi
cmp rcx, 2
ja 0x10010c23b
mov r12d, edx
lea r9d, [rax + 0xb]
mov ebp, r9d
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c8f9
test byte [rcx + 0x1c], 8
je 0x10010c8f4
lea edx, [rax + 0x14]
lea rax, [0x100040970]
mov qword [rsp + 0x20], rax
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
cmp word [r8 + rcx*2 - 2], 0x5c
jne 0x10010c24a
mov word [r8 + rcx*2 - 2], dx
mov eax, 0x3f
mov word [r8 + 2], ax
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c281
test byte [rcx + 0x1c], 2
je 0x10010c281
lea edx, [rax - 0x2a]
mov r9, r8
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.100106460
mov r8, qword [rsp + 0x40]
mov rdx, r8
mov rcx, r13
call fcn.10011cd98
xor ecx, ecx
cmp eax, ecx
jne 0x10010c2f0
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010c8ef
test byte [rax + 0x1c], 8
je 0x10010c8ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x16
lea rax, [0x100040990]
mov qword [rsp + 0x20], rax
lea r8, [0x1000040d0]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
lea rcx, [rsp + 0x50]
call fcn.10011fb0c
xor edx, edx
cmp eax, edx
jne 0x10010c36b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.100117234
cmp eax, 2
je 0x10010c488
xor eax, eax
mov r12d, eax
mov ebp, 0x80042416
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c363
test byte [rcx + 0x1c], 8
je 0x10010c363
lea edx, [rax + 0x17]
mov dword [rsp + 0x28], edi
lea rax, [0x1000409d8]
mov qword [rsp + 0x20], rax
mov r9d, 0x80042416
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.10010ce44
mov rcx, r12
jmp 0x10010c910
mov rcx, rax
jmp 0x10010c910
xor eax, eax
or rcx, 0xffffffffffffffff
mov r8, qword [rsp + 0x50]
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
cmp rcx, 2
ja 0x10010c3d3
mov r12d, edx
lea r9d, [rax + 0xb]
mov ebp, r9d
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c8e5
test byte [rcx + 0x1c], 8
je 0x10010c8e0
lea edx, [rax + 0x18]
lea rax, [0x100040970]
mov qword [rsp + 0x20], rax
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
cmp word [r8 + rcx*2 - 2], 0x5c
jne 0x10010c3e2
mov word [r8 + rcx*2 - 2], dx
mov eax, 0x3f
mov word [r8 + 2], ax
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c419
test byte [rcx + 0x1c], 2
je 0x10010c419
lea edx, [rax - 0x26]
mov r9, r8
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.100106460
mov r8, qword [rsp + 0x50]
mov rdx, r8
mov rcx, r13
call fcn.10011cd98
xor ecx, ecx
cmp eax, ecx
jne 0x10010c488
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010c8db
test byte [rax + 0x1c], 8
je 0x10010c8d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x1a
lea rax, [0x100040a00]
mov qword [rsp + 0x20], rax
lea r8, [0x1000040d0]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
mov edx, 0x104
lea rcx, [rsp + 0x2e0]
call fcn.10011e6f4
mov edi, eax
xor edx, edx
cmp eax, edx
je 0x10010c5e3
cmp word [rsp + 0x2e0], dx
je 0x10010c5e3
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2e0]
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
cmp ecx, 2
ja 0x10010c51b
mov r12d, edx
lea r9d, [rdx + 0xb]
mov ebp, r9d
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c8d1
test byte [rcx + 0x1c], 8
je 0x10010c8cc
lea edx, [rax + 0x1b]
lea rax, [0x100040970]
mov qword [rsp + 0x20], rax
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
lea eax, [rcx - 1]
cmp word [rsp + rax*2 + 0x2e0], 0x5c
jne 0x10010c531
mov word [rsp + rax*2 + 0x2e0], dx
mov eax, 0x3f
mov word [rsp + 0x2e2], ax
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c56b
test byte [rcx + 0x1c], 2
je 0x10010c56b
lea edx, [rax - 0x23]
lea r9, [rsp + 0x2e0]
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.100106460
lea rdx, [rsp + 0x2e0]
mov rcx, r13
call fcn.10011cd98
xor ecx, ecx
cmp eax, ecx
jne 0x10010c67a
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010c8c7
test byte [rax + 0x1c], 8
je 0x10010c8c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x1d
lea rax, [0x100040a50]
mov qword [rsp + 0x20], rax
lea r8, [0x1000040d0]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010c61c
test byte [rax + 0x1c], 2
je 0x10010c61c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x1e
lea r8, [0x1000040d0]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.10010ced8
xor edx, edx
cmp edi, edx
jne 0x10010c67a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0xe
cmp eax, r9d
jne 0x10010c67a
xor eax, eax
mov r12d, eax
mov ebp, r9d
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c8bd
test byte [rcx + 0x1c], 8
je 0x10010c8b8
lea edx, [rax + 0x1f]
lea rax, [0x100040a98]
mov qword [rsp + 0x20], rax
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
mov dword [rsp + 0x20], r14d
mov r9, r15
mov r8, r13
mov edx, esi
lea rcx, [rsp + 0x90]
call fcn.10011be20
xor ecx, ecx
cmp eax, ecx
jne 0x10010c6f8
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010c8b3
test byte [rax + 0x1c], 8
je 0x10010c8ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x20
lea rcx, [0x10003fe78]
mov qword [rsp + 0x20], rcx
lea r8, [0x1000040d0]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
lea rcx, [rsp + 0x48]
call fcn.10012eab4
xor ecx, ecx
cmp eax, ecx
jne 0x10010c766
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010c75e
test byte [rax + 0x1c], 8
je 0x10010c75e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x21
lea rcx, [0x10003fe78]
mov qword [rsp + 0x20], rcx
lea r8, [0x1000040d0]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov dword [rsp + 0x20], r14d
mov r9, r15
mov r8, qword [r13]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x68]
call fcn.10010cfc4
xor ecx, ecx
cmp eax, ecx
jne 0x10010c7e8
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010c7e0
test byte [rax + 0x1c], 8
je 0x10010c7e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x22
lea rax, [0x100040ab0]
mov qword [rsp + 0x20], rax
lea r8, [0x1000040d0]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, r12
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x90]
call fcn.10010b96c
xor ecx, ecx
cmp eax, ecx
jne 0x10010c86c
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010c862
test byte [rax + 0x1c], 8
je 0x10010c862
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x23
lea rcx, [0x10003fe78]
mov qword [rsp + 0x20], rcx
lea r8, [0x1000040d0]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
mov rcx, qword [rsp + 0x58]
jmp 0x10010c910
mov rcx, qword [rsp + 0x58]
jmp 0x10010c910
call fcn.10011e5bc
xor edi, edi
cmp eax, edi
jne 0x10010c89c
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010c89c
test byte [rcx + 0x1c], 4
je 0x10010c89c
lea edx, [rdi + 0x24]
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.1001062c8
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rcx, rdi
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, rax
jmp 0x10010c910
mov rcx, rax
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, rax
jmp 0x10010c910
mov rcx, rax
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, rax
jmp 0x10010c910
mov rcx, rax
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, rax
jmp 0x10010c910
mov rcx, rax
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, r12
jmp 0x10010c910
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov esi, eax
lea rcx, [0x1000444f0]
call fcn.10011c52c
xor eax, eax
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea r13d, [rax + 1]
mov edx, r13d
lea rcx, [0x100044390]
call fcn.100121ba4
mov rdi, qword [rsp + 0x38]
xor ecx, ecx
cmp eax, ecx
jne 0x10010c9be
mov r13d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010ca36
test byte [rcx + 0x1c], 8
je 0x10010ca36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x22
lea rax, [0x10003f980]
mov qword [rsp + 0x20], rax
lea r8, [0x100002e10]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
jmp 0x10010ca36
mov dword [rsp + 0x30], ebp
mov eax, 4
mov dword [rsp + 0x20], eax
mov r9d, eax
lea r8, [rsp + 0x30]
lea rdx, [0x1000444b8]
mov rcx, rdi
call fcn.100122120
xor ecx, ecx
cmp eax, ecx
jne 0x10010ca36
mov r13d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [0x100176368]
cmp rax, rbx
je 0x10010ca36
test byte [rax + 0x1c], 8
je 0x10010ca36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov edx, 0x23
lea rax, [0x10003f980]
mov qword [rsp + 0x20], rax
lea r8, [0x100002e10]
mov rcx, qword [0x100176368]
mov rcx, qword [rcx + 0x10]
call fcn.1001062ec
xor eax, eax
cmp rdi, rax
je 0x10010ca46
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1000444f0]
call fcn.10011c56c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
cmp r13d, esi
jne 0x10010ca89
mov rcx, qword [0x100176368]
cmp rcx, rbx
je 0x10010ca89
test byte [rcx + 0x1c], 8
je 0x10010ca89
lea edx, [rsi + 0x25]
mov r9d, ebp
lea r8, [0x1000040d0]
mov rcx, qword [rcx + 0x10]
call fcn.10010ced8
lea rcx, [0x1000408f8]
call fcn.10011c56c
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov ebx, 0x88
mov rcx, qword [rsp + 0x70]
cmp rcx, rsi
je 0x10010cacb
lea rdi, [rcx - 8]
lea r9, [0x10010ddd0]
mov r8d, dword [rdi]
mov rdx, rbx
call fcn.10013043c
mov rcx, rdi
call fcn.10012fea8
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x10010caf7
lea rdi, [rcx - 8]
lea r9, [0x10010ddd0]
mov r8d, dword [rdi]
mov rdx, rbx
call fcn.10013043c
mov rcx, rdi
call fcn.10012fea8
nop
cmp qword [rsp + 0x48], rsi
je 0x10010cb09
lea rcx, [rsp + 0x48]
call fcn.1001098c8
nop
lea rcx, [rsp + 0xa0]
call fcn.100115ce8
lea rcx, [rsp + 0xa8]
call fcn.100115ce8
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0xb0], rsi
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0xb8], rsi
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0xc0], rsi
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0xc8], rsi
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0xd8], rsi
mov rcx, qword [rsp + 0x2d0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x2d0], rsi
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x90], rsi
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, r12d
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1001303c0
mov rbx, qword [rsp + 0x558]
add rsp, 0x500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret