Function at 0x140079890
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60bf0]
mov eax, 0x60cf0
call fcn.140216080
sub rsp, rax
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x60be0], rax
mov ebx, edx
mov dword [rbp - 0x20], edx
mov r13, rcx
xor esi, esi
mov eax, esi
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x48], eax
mov eax, dword [rcx + 0x3e4]
mov ecx, 0x20119
mov edx, 0x20219
test eax, eax
cmove ecx, edx
mov dword [rbp + 0x18], ecx
mov ecx, esi
setne cl
inc ecx
mov dword [rbp - 0x70], ecx
mov r15d, esi
mov dword [rbp - 0x28], esi
lea r12d, [rsi + 1]
cmp dword [r13 + 0x440], esi
je 0x140079922
cmp dword [r13 + 0x48], 2
cmove r15d, r12d
mov dword [rbp - 0x28], r15d
lea rcx, [rbp + 0xb8]
call fcn.1400a64e0
nop
lea rdx, [r13 + 0x1c0]
lea rcx, [rbp + 0xb8]
call fcn.1400a659c
mov qword [rbp + 0x48], 0xffffffff80000001
movups xmm0, xmmword [str.REGISTRYHKEY_CURRENT_USER_]
movaps xmmword [rbp + 0x7e0], xmm0
movups xmm1, xmmword [0x1402f6b58]
movaps xmmword [rbp + 0x7f0], xmm1
movups xmm0, xmmword [0x1402f6b68]
movaps xmmword [rbp + 0x800], xmm0
movsd xmm1, qword [0x1402f6b78]
movsd qword [rbp + 0x810], xmm1
xor edx, edx
mov r8d, 0x3c8
lea rcx, [rbp + 0x818]
call fcn.140241ba0
lea rcx, [rbp + 0x430]
call fcn.14001fb40
nop
cmp dword [r13 + 0x360], 0
jne 0x1400799e2
lea r8, [0x1402e82f0]
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x7e0]
call fcn.140057530
mov rbx, 0xffffffff80000001
cmp eax, 1
cmove rbx, qword [rbp + 0x438]
mov qword [rbp + 0x48], rbx
mov ebx, dword [rbp - 0x20]
test r15d, r15d
jne 0x1400799f5
cmp qword [rbp + 0xc8], 0
je 0x14007ee70
lea rcx, [rbp + 0x50]
call fcn.1400a64e0
nop
lea r8, [0x1402f1240]
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, [0x1402f1250]
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, str.Applications
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, [0x1402f1288]
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, [0x1402f1268]
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, str.Installer
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, str.Mime
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, str.SystemFileAssociations
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, str.Record
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, str.Media_Type
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, str.Local_Settings
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, str.ActivatableClasses
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
lea r8, str.PackagedCom
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400a6854
xor edx, edx
mov r8d, 0x20000
lea rcx, [rbp + 0xbe0]
call fcn.140241ba0
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x1a0], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1a8], rsi
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0x1c8], xmm0
mov dword [rbp - 0x80], esi
cmp ebx, 1
jne 0x14007a0df
mov qword [rsp + 0x20], 0x7ffffffe
lea r9, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClasses
xor r8d, r8d
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022750
mov ebx, dword [r13 + 0x3e4]
lea rcx, [rbp + 0x4a0]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClasses
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400584f0
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
cmp qword [r13 + 0x68], 0
je 0x140079dfc
mov dword [rbp - 0x80], esi
mov qword [rsp + 0x20], 0x7ffffffe
lea r9, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClasses
xor r8d, r8d
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022750
mov ebx, dword [r13 + 0x3e4]
lea rcx, [rbp + 0x4a0]
call fcn.14001fb40
nop
lea rsi, [r13 + 0x58]
xor r14d, r14d
mov dword [rsp + 0x78], r14d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClasses
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400584f0
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
test r15d, r15d
je 0x140079dfa
mov ebx, dword [r13 + 0x3e4]
mov rdi, qword [r13 + 0x3f0]
lea rcx, [rbp + 0x4a0]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClasses
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400578a0
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
mov ebx, dword [r13 + 0x3e4]
mov rdi, qword [r13 + 0x3f0]
lea rcx, [rbp + 0x4a0]
call fcn.14001fb40
nop
lea rax, [r13 + 0x1e8]
xor esi, esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClasses
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400578a0
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
jmp 0x140079dfc
xor esi, esi
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x570], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x588], xmm0
mov qword [rbp + 0x580], rsi
mov qword [rbp + 0x578], rsi
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0x598], xmm0
lea rcx, [rbp + 0x408]
call fcn.1400a64e0
nop
mov dword [rbp - 0x80], esi
mov qword [rsp + 0x20], 0x7ffffffe
lea r9, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesApplications
xor r8d, r8d
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022750
mov ebx, dword [r13 + 0x3e4]
lea rcx, [rbp + 0x4a0]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rax, [rbp + 0x408]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesApplications
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400584f0
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
mov rcx, qword [rbp + 0x578]
mov qword [rbp - 0x50], rcx
test rcx, rcx
je 0x14007a0b7
mov r15d, dword [rbp - 0x70]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
mov qword [rbp - 0x50], rax
mov rbx, qword [rcx + 0x10]
call fcn.1400a2364
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14000dde0
nop
lea rcx, [rbx + 0x10]
call fcn.140055e30
test al, al
cmovne esi, r12d
lea r8, [rbp - 0x68]
lea edx, [rsi + 7]
mov rcx, qword [rbx + 0x10]
call fcn.14002de30
lea rdx, str.Shell
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007a06f
lea edx, [rsi + 9]
lea r8, [rbp - 0x68]
mov rcx, qword [rbx + 0x10]
call fcn.14002de30
lea rdx, str.Command
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007a06f
call fcn.1400a2364
nop
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14000dde0
nop
lea edx, [rsi + 8]
lea r8, [rbp + 0x20]
mov rcx, qword [rbx + 0x10]
call fcn.14002de30
lea rdx, str.Open
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007a025
call fcn.1400a2364
nop
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.14000dde0
nop
lea r8, [rbp - 8]
lea edx, [rsi + 7]
mov rcx, qword [rbx + 0x10]
call fcn.14002f3b0
mov r8d, r15d
mov rdx, qword [rbp - 8]
mov rcx, qword [r13 + 0x3f0]
call fcn.140055910
test rax, rax
je 0x14007a016
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp - 8]
add rcx, 0xffffffffffffffe8
call fcn.140008170
jmp 0x14007a062
mov eax, dword [rbx + 0x30]
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x48], r15d
xor edx, edx
mov dword [rsp + 0x40], edx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbx + 0x20]
mov r8, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r13 + 0x3f0]
call fcn.140055970
nop
mov rcx, qword [rbp + 0x20]
add rcx, 0xffffffffffffffe8
call fcn.140008170
cmp dword [rbx + 0x30], 0
je 0x14007a07e
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov rcx, rbx
call fcn.14005dd30
mov edx, 0x38
mov rcx, rbx
call fcn.1400081a0
nop
mov rcx, qword [rbp - 0x68]
add rcx, 0xffffffffffffffe8
call fcn.140008170
mov rcx, qword [rbp - 0x50]
test rcx, rcx
mov esi, 0
jne 0x140079f20
mov r15d, dword [rbp - 0x28]
lea rcx, [rbp + 0x408]
call fcn.1400a6500
nop
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x570], rax
lea rcx, [rbp + 0x570]
call fcn.140094660
nop
mov dword [rbp - 0x80], esi
mov qword [rsp + 0x20], 0x7ffffffe
lea r9, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClasses
xor r8d, r8d
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022750
mov edi, dword [r13 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rbp + 0x4a0]
call fcn.14001fb40
nop
cmp dword [r13 + 0x360], 0
jne 0x14007a155
lea r8, str.SOFTWAREClasses
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0xbe0]
call fcn.140057530
test eax, eax
je 0x14007a155
mov rbx, qword [rbp + 0x4a8]
test rbx, rbx
je 0x14007a1c3
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], edi
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClasses
mov rdx, rbx
mov rcx, r13
call fcn.1400584f0
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
mov dword [rbp - 0x80], esi
mov qword [rsp + 0x20], 0x7ffffffe
lea r9, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClassesApplications
xor r8d, r8d
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022750
mov edi, dword [r13 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rbp + 0x4a0]
call fcn.14001fb40
nop
cmp dword [r13 + 0x360], 0
jne 0x14007a245
lea r8, str.SOFTWAREClassesApplications
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0xbe0]
call fcn.140057530
test eax, eax
je 0x14007a245
mov rbx, qword [rbp + 0x4a8]
test rbx, rbx
je 0x14007a2af
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesApplications
mov rdx, rbx
mov rcx, r13
call fcn.1400584f0
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
cmp qword [r13 + 0x68], 0
je 0x14007a556
mov dword [rbp - 0x80], esi
mov qword [rsp + 0x20], 0x7ffffffe
lea r9, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClasses
xor r8d, r8d
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022750
mov esi, dword [r13 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rbp + 0x4a0]
call fcn.14001fb40
nop
cmp dword [r13 + 0x360], 0
jne 0x14007a342
lea r8, str.SOFTWAREClasses
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0xbe0]
call fcn.140057530
test eax, eax
je 0x14007a342
mov rbx, qword [rbp + 0x4a8]
test rbx, rbx
jne 0x14007a342
lea rdi, [r13 + 0x58]
jmp 0x14007a3b0
lea rdi, [r13 + 0x58]
xor eax, eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], esi
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClasses
mov rdx, rbx
mov rcx, r13
call fcn.1400584f0
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
test r15d, r15d
je 0x14007a554
mov esi, dword [r13 + 0x3e4]
mov r14, qword [r13 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rbp + 0x4a0]
call fcn.14001fb40
nop
cmp dword [r13 + 0x360], 0
jne 0x14007a420
lea r8, str.SOFTWAREClasses
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0xbe0]
call fcn.140057530
test eax, eax
je 0x14007a420
mov rbx, qword [rbp + 0x4a8]
test rbx, rbx
jne 0x14007a420
xor r15d, r15d
jmp 0x14007a481
mov dword [rsp + 0x70], r12d
xor r15d, r15d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], esi
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClasses
mov rdx, rbx
mov rcx, r13
call fcn.1400578a0
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
mov edi, dword [r13 + 0x3e4]
mov rsi, qword [r13 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rbp + 0x4a0]
call fcn.14001fb40
nop
cmp dword [r13 + 0x360], 0
jne 0x14007a4e3
lea r8, str.SOFTWAREClasses
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0xbe0]
call fcn.140057530
test eax, eax
je 0x14007a4e3
mov rbx, qword [rbp + 0x4a8]
test rbx, rbx
je 0x14007a548
lea rax, [r13 + 0x1e8]
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClasses
mov rdx, rbx
mov rcx, r13
call fcn.1400578a0
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
xor esi, esi
mov r15d, dword [rbp + 0x18]
mov r9d, r15d
mov r14d, dword [rbp - 0x70]
mov r8d, r14d
lea rdx, [rbp + 0x1a0]
mov rcx, r13
call fcn.14008d710
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x238], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x250], xmm0
mov qword [rbp + 0x248], rsi
mov qword [rbp + 0x240], rsi
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0x260], xmm0
lea rcx, [rbp + 0x140]
call fcn.1400a64e0
nop
mov rcx, qword [rbp + 0x1a8]
mov qword [rbp - 0x50], rcx
test rcx, rcx
je 0x14007a96a
mov r15d, 7
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
mov qword [rbp - 0x50], rax
mov rdi, qword [rcx + 0x10]
call fcn.1400a2364
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000dde0
nop
lea rcx, [rdi + 0x10]
call fcn.140055e30
mov r14d, esi
test al, al
cmovne r14d, r12d
lea edx, [r14 + 5]
lea r8, [rbp - 0x78]
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
lea rdx, str.Applications
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov esi, 6
test eax, eax
cmove esi, r15d
add esi, r14d
lea r8, [rbp - 0x78]
mov edx, esi
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
lea rdx, str.Shell
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007a7fa
lea edx, [rsi + 2]
lea r8, [rbp - 0x78]
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
lea rdx, str.Command
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007a7b5
call fcn.1400a2364
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14000dde0
nop
lea edx, [rsi + 1]
lea r8, [rbp - 0x68]
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
lea rdx, str.Open
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007a754
call fcn.1400a2364
nop
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.14000dde0
nop
lea r8, [rbp - 8]
mov edx, esi
mov rcx, qword [rdi + 0x10]
call fcn.14002f3b0
mov r8d, dword [rbp - 0x70]
mov rdx, qword [rbp - 8]
mov rcx, qword [r13 + 0x3f0]
call fcn.140055910
test rax, rax
je 0x14007a70c
mov dword [rax + 0x24], r12d
lea edx, [rsi - 1]
lea r8, [rbp - 0x78]
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
mov r9d, r12d
lea r8, [rbp + 0x140]
mov rdx, qword [rbp - 0x78]
mov rcx, r13
call fcn.140057470
test eax, eax
jne 0x14007a74e
lea r8, [rbp - 0x78]
mov rdx, qword [rbp + 0x150]
lea rcx, [rbp + 0x140]
call fcn.1400a67e0
nop
mov rcx, qword [rbp - 8]
jmp 0x14007a799
call fcn.1400a2364
nop
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14000dde0
nop
lea edx, [r14 + 8]
lea r8, [rbp + 0x20]
mov rcx, qword [rdi + 0x10]
call fcn.14002f3b0
mov r8d, dword [rbp - 0x70]
mov rdx, qword [rbp + 0x20]
mov rcx, qword [r13 + 0x3f0]
call fcn.140055910
test rax, rax
je 0x14007a795
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x20]
add rcx, 0xffffffffffffffe8
call fcn.140008170
nop
mov rcx, qword [rbp - 0x68]
add rcx, 0xffffffffffffffe8
call fcn.140008170
jmp 0x14007a92f
mov eax, dword [rdi + 0x30]
mov rcx, qword [rdi + 0x28]
mov r14d, dword [rbp - 0x70]
mov dword [rsp + 0x48], r14d
xor esi, esi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, dword [rdi + 0x20]
mov r8, qword [rdi + 0x18]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [r13 + 0x3f0]
call fcn.140055970
jmp 0x14007a935
lea rdx, str.defaultIcon
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007a8af
lea edx, [rsi - 1]
lea r8, [rbp - 0x78]
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rdx, rax
mov r9d, r12d
lea r8, [rbp + 0x140]
mov rcx, r13
call fcn.140057470
test eax, eax
jne 0x14007a855
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x140]
call fcn.140022600
lea rcx, [rbp - 0x48]
call fcn.14000d940
nop
lea rcx, [rdi + 0x10]
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x48]
mov edx, esi
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x48]
call fcn.14000d980
mov r14d, dword [rbp - 0x70]
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007a8a1
mov dword [rax + 0x24], r12d
lea rcx, [rbp - 0x48]
call fcn.14000d850
jmp 0x14007a933
mov ecx, 0x38
call fcn.140095d1c
mov qword [rbp + 0x38], rax
test rax, rax
je 0x14007a8cf
mov rcx, rax
call fcn.140055c20
mov rsi, rax
jmp 0x14007a8d1
xor esi, esi
lea rdx, [rdi + 8]
lea rcx, [rsi + 8]
call fcn.14000d7c0
lea rcx, [rsi + 0x10]
lea rdx, [rdi + 0x10]
call fcn.14000d7c0
lea rdx, [rdi + 0x18]
lea rcx, [rsi + 0x18]
call fcn.14000d7c0
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x20], eax
mov ecx, dword [rdi + 0x30]
call fcn.1400164e0
mov qword [rsi + 0x28], rax
mov r8d, dword [rdi + 0x30]
mov rdx, qword [rdi + 0x28]
mov rcx, rax
call fcn.1402414f0
mov eax, dword [rdi + 0x30]
mov dword [rsi + 0x30], eax
mov rdx, rsi
lea rcx, [rbp + 0x238]
call fcn.1400945a0
mov r14d, dword [rbp - 0x70]
xor esi, esi
cmp dword [rdi + 0x30], 0
je 0x14007a944
mov rcx, qword [rdi + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rdi
call fcn.14005dc90
nop
lea rcx, [rbp - 0x78]
call fcn.14000d850
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x14007a5e0
mov r15d, dword [rbp + 0x18]
mov rcx, qword [r13 + 8]
call fcn.140021a70
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007eff5
xor edx, edx
mov r8d, 0x20000
lea rcx, [rbp + 0x20be0]
call fcn.140241ba0
lea rcx, [rbp + 0x3e0]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0x2e8]
call fcn.1400a64e0
nop
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x2e8]
call fcn.1400a659c
lea rcx, [rbp + 0x2e8]
call fcn.140031d90
mov edx, 0xa
lea rcx, [rbp + 0x380]
call fcn.140094570
nop
mov dword [rbp + 0x80], esi
cmp dword [rbp - 0x20], 1
jne 0x14007ab4c
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesRecord
mov edx, 0x10000
lea rcx, [rbp + 0x20be0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x380]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20be0]
lea r8, str.SOFTWAREClassesRecord
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
cmp dword [rbp + 0x80], 0
je 0x14007ab4c
lea rcx, [rbp + 0x380]
call fcn.140021a70
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14007ab4c
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x380]
call fcn.1400946a0
mov rsi, qword [rax]
lea rcx, [rsi + 0x10]
call fcn.140055e30
xor ebx, ebx
test al, al
cmovne ebx, r12d
lea rcx, [rbp - 8]
call fcn.14000d940
nop
lea rcx, [rsi + 0x10]
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 8]
lea edx, [rbx + 7]
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 8]
call fcn.14000d980
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007ab1d
mov dword [rax + 0x24], r12d
cmp dword [rsi + 0x30], 0
je 0x14007ab2c
mov rcx, qword [rsi + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rsi
call fcn.14005dc90
nop
lea rcx, [rbp - 8]
call fcn.14000d850
cmp qword [rbp - 0x50], 0
jne 0x14007aab0
lea rcx, [rbp + 0x140]
call fcn.1400225f0
test rax, rax
jle 0x14007b30d
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x4a0]
call fcn.14001fc70
nop
mov r8d, r15d
lea rdx, str.SOFTWAREClasses
lea rcx, [rbp + 0x4a0]
call fcn.1400210b0
lea rcx, [rbp + 0x4a0]
call fcn.140020bd0
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.14000d940
nop
lea rcx, [rbp - 8]
call fcn.14000d940
nop
xor edi, edi
test esi, esi
jle 0x14007ae1a
mov rcx, qword [r13 + 8]
call fcn.140021a70
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007b48f
lea r9, [rbp - 8]
lea r8, [rbp - 0x78]
mov edx, edi
lea rcx, [rbp + 0x4a0]
call fcn.140020810
mov r8d, r12d
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x78]
call fcn.140015450
mov rcx, rax
call fcn.14000d980
mov rcx, rax
lea rdx, [0x1402ed7f4]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov ebx, eax
lea rcx, [rbp + 0x28]
call fcn.14000d850
test ebx, ebx
jne 0x14007ae10
lea rcx, [rbp - 0x58]
call fcn.14000d940
nop
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x40]
call fcn.14000d910
nop
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x640]
call fcn.14001fc70
nop
lea r8, str.SOFTWAREClasses_
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140021fb0
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rdx, rax
mov r8d, r15d
lea rcx, [rbp + 0x640]
call fcn.1400210b0
lea r8, [rbp - 0x58]
xor edx, edx
lea rcx, [rbp + 0x640]
call fcn.140020ed0
lea rcx, [rbp - 0x58]
call fcn.14000d980
mov rdx, rax
mov r9d, r12d
lea r8, [rbp + 0x140]
mov rcx, r13
call fcn.140057470
test eax, eax
je 0x14007adf0
lea rdx, [rbp + 0x7e0]
lea rcx, [rbp - 0x60]
call fcn.14000d880
nop
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x60]
call fcn.14001b250
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x60]
call fcn.14000d980
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007acf4
mov dword [rax + 0x24], r12d
cmp dword [r13 + 0x48], 2
jne 0x14007ade6
lea rcx, [rbp - 0x48]
call fcn.14000d940
nop
lea r8, [rbp - 0x48]
lea rdx, str.Content_Type
lea rcx, [rbp + 0x640]
call fcn.140020ed0
test eax, eax
je 0x14007addc
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x710]
call fcn.14001fc70
nop
lea rdx, str.SOFTWAREClassesMIMEDatabaseContent_Type_
lea rcx, [rbp - 0x68]
call fcn.14000d880
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x68]
call fcn.14001b250
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov rdx, rax
mov r8d, r15d
lea rcx, [rbp + 0x710]
call fcn.1400210b0
test eax, eax
je 0x14007adc5
lea rdx, [rbp + 0x7e0]
lea rcx, [rbp + 0x20]
call fcn.14000d880
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x20]
call fcn.14001b250
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp + 0x20]
call fcn.14000d980
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007adbb
mov dword [rax + 0x24], r12d
lea rcx, [rbp + 0x20]
call fcn.14000d850
nop
lea rcx, [rbp - 0x68]
call fcn.14000d850
nop
lea rcx, [rbp + 0x710]
call fcn.14001feb0
nop
lea rcx, [rbp - 0x48]
call fcn.14000d850
nop
lea rcx, [rbp - 0x60]
call fcn.14000d850
nop
lea rcx, [rbp + 0x640]
call fcn.14001feb0
nop
lea rcx, [rbp + 0x40]
call fcn.14000d850
nop
lea rcx, [rbp - 0x58]
call fcn.14000d850
inc edi
cmp edi, esi
jl 0x14007abb4
cmp dword [rbp - 0x20], 1
jne 0x14007b2ed
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x640]
call fcn.14001fc70
nop
mov r8d, r15d
lea rdx, str.SOFTWAREClasses
lea rcx, [rbp + 0x640]
call fcn.1400210b0
lea rcx, [rbp + 0x640]
call fcn.140020bd0
mov esi, eax
mov dword [rbp - 0x48], eax
xor edi, edi
mov dword [rbp - 0x40], edi
test eax, eax
jle 0x14007b2e0
nop dword [rax]
mov rcx, qword [r13 + 8]
call fcn.140021a70
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007b482
lea r9, [rbp - 8]
lea r8, [rbp - 0x78]
mov edx, edi
lea rcx, [rbp + 0x640]
call fcn.140020810
mov r8d, r12d
lea rdx, [rbp + 0x78]
lea rcx, [rbp - 0x78]
call fcn.140015450
mov rcx, rax
call fcn.14000d980
mov rcx, rax
lea rdx, [0x1402ed7f4]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov ebx, eax
lea rcx, [rbp + 0x78]
call fcn.14000d850
test ebx, ebx
jne 0x14007b2d3
lea rcx, [rbp - 0x38]
call fcn.14000d940
nop
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x710]
call fcn.14001fc70
nop
lea r8, str.SOFTWAREClasses_
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140021fb0
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rdx, rax
mov r8d, r15d
lea rcx, [rbp + 0x710]
call fcn.1400210b0
lea r8, [rbp - 0x38]
xor edx, edx
lea rcx, [rbp + 0x710]
call fcn.140020ed0
lea rcx, [rbp - 0x38]
call fcn.14000d980
mov rdx, rax
mov r9d, r12d
lea r8, [rbp + 0x140]
mov rcx, r13
call fcn.140057470
test eax, eax
je 0x14007b0a8
lea rdx, str.REGISTRYHKEY_LOCAL_MACHINE_
lea rcx, [rbp + 8]
call fcn.14000d880
nop
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 8]
call fcn.14001b250
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp + 8]
call fcn.14000d980
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007afa5
mov dword [rax + 0x24], r12d
cmp dword [r13 + 0x48], 2
jne 0x14007b09a
lea rcx, [rbp]
call fcn.14000d940
nop
lea r8, [rbp]
lea rdx, str.Content_Type
lea rcx, [rbp + 0x710]
call fcn.140020ed0
test eax, eax
je 0x14007b090
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x570]
call fcn.14001fc70
nop
lea rdx, str.SOFTWAREClassesMIMEDatabaseContent_Type_
lea rcx, [rbp - 0x68]
call fcn.14000d880
nop
lea rdx, [rbp]
lea rcx, [rbp - 0x68]
call fcn.14001b250
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov rdx, rax
mov r8d, r15d
lea rcx, [rbp + 0x570]
call fcn.1400210b0
test eax, eax
je 0x14007b079
lea rdx, str.REGISTRYHKEY_LOCAL_MACHINE_
lea rcx, [rbp + 0x30]
call fcn.14000d880
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x30]
call fcn.14001b250
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp + 0x30]
call fcn.14000d980
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007b06f
mov dword [rax + 0x24], r12d
lea rcx, [rbp + 0x30]
call fcn.14000d850
nop
lea rcx, [rbp - 0x68]
call fcn.14000d850
nop
lea rcx, [rbp + 0x570]
call fcn.14001feb0
nop
lea rcx, [rbp]
call fcn.14000d850
nop
lea rcx, [rbp + 8]
call fcn.14000d850
jmp 0x14007b2bd
lea r8, str.OpenWithProgIds
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x28]
call fcn.140021ef0
nop
lea r8, [rbp - 0x78]
lea rdx, str.REGISTRYHKEY_LOCAL_MACHINE_
lea rcx, [rbp - 0x10]
call fcn.140029c30
nop
lea r8, str.OpenWithProgIds
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x40]
call fcn.140021ef0
nop
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x570]
call fcn.14001fc70
nop
lea rcx, [rbp + 0x28]
call fcn.14000d980
mov rdx, rax
mov r8d, r15d
lea rcx, [rbp + 0x570]
call fcn.1400210b0
test eax, eax
je 0x14007b28f
lea rcx, [rbp + 0x570]
call fcn.140020be0
mov dword [rbp - 0x60], eax
xor r15d, r15d
test eax, eax
jle 0x14007b28b
movsxd rbx, eax
mov qword [rbp + 0x10], rbx
nop
lea rcx, [rbp + 0x20]
call fcn.14000d940
nop
lea rcx, [rbp + 0x570]
call fcn.1400219b0
mov dword [rbp - 0x28], eax
mov ecx, eax
call fcn.1400164e0
mov rdi, rax
mov qword [rbp + 0x38], rax
mov r8d, dword [rbp - 0x28]
xor edx, edx
mov rcx, rax
call fcn.140241ba0
mov dword [rbp - 0x30], r15d
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x58]
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x570]
call fcn.140020940
lea rcx, [rbp + 0x20]
call fcn.14000d980
mov rdx, rax
mov r9d, r12d
lea r8, [rbp + 0x140]
mov rcx, r13
call fcn.140057470
test eax, eax
je 0x14007b262
cmp rbx, 1
jne 0x14007b208
lea rcx, [rbp + 0x710]
call fcn.140020bd0
cmp eax, ebx
jne 0x14007b208
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x10]
call fcn.14000d980
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
mov rbx, qword [rbp + 0x10]
test rax, rax
je 0x14007b262
mov dword [rax + 0x24], r12d
jmp 0x14007b262
mov r14, qword [r13 + 0x3f0]
mov edi, dword [rbp - 0x28]
mov esi, dword [rbp - 0x58]
lea rcx, [rbp + 0x20]
call fcn.14000d980
mov rbx, rax
lea rcx, [rbp + 0x40]
call fcn.14000d980
mov ecx, dword [rbp - 0x70]
mov dword [rsp + 0x48], ecx
xor ecx, ecx
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov rdi, qword [rbp + 0x38]
mov qword [rsp + 0x20], rdi
mov r9d, esi
mov r8, rbx
mov rdx, rax
mov rcx, r14
call fcn.140055970
mov rbx, qword [rbp + 0x10]
mov rcx, rdi
call fcn.140095d64
nop
lea rcx, [rbp + 0x20]
call fcn.14000d850
inc r15d
cmp r15d, dword [rbp - 0x60]
mov r14d, dword [rbp - 0x70]
jl 0x14007b140
mov edi, dword [rbp - 0x40]
mov esi, dword [rbp - 0x48]
mov r15d, dword [rbp + 0x18]
lea rcx, [rbp + 0x570]
call fcn.14001feb0
nop
lea rcx, [rbp + 0x40]
call fcn.14000d850
nop
lea rcx, [rbp - 0x10]
call fcn.14000d850
nop
lea rcx, [rbp + 0x28]
call fcn.14000d850
mov r14d, dword [rbp - 0x70]
lea rcx, [rbp + 0x710]
call fcn.14001feb0
nop
lea rcx, [rbp - 0x38]
call fcn.14000d850
inc edi
mov dword [rbp - 0x40], edi
cmp edi, esi
jl 0x14007ae70
lea rcx, [rbp + 0x640]
call fcn.14001feb0
nop
lea rcx, [rbp - 8]
call fcn.14000d850
nop
lea rcx, [rbp - 0x78]
call fcn.14000d850
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
lea rcx, [rbp + 0x238]
call fcn.140021a70
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14007b68b
nop word [rax + rax]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x238]
call fcn.1400946a0
mov r14, qword [rax]
mov qword [rbp - 0x10], r14
lea rdx, [0x1402ed690]
lea rcx, [rbp + 0x30]
call fcn.14000d880
nop
lea rcx, [rbp]
call fcn.14000d940
nop
lea rcx, [rbp + 8]
call fcn.14000d940
nop
lea rcx, [rbp + 0x10]
call fcn.14000d940
nop
lea rsi, [r14 + 0x10]
mov qword [rbp + 0x28], rsi
mov rcx, rsi
call fcn.140055e30
xor edi, edi
test al, al
cmovne edi, r12d
mov rcx, rsi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp]
lea edx, [rdi + 5]
call fcn.14002de30
mov rdx, rsi
lea rcx, [rbp + 0x30]
call fcn.14001b250
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp + 0x30]
call fcn.14000d980
mov rdx, rax
mov rcx, rbx
call fcn.1400554e0
mov rbx, rax
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x4a0]
call fcn.14001fc70
nop
lea r15d, [rdi + 6]
mov rcx, rsi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp + 8]
mov edx, r15d
call fcn.14002f3b0
lea rcx, [rbp + 8]
call fcn.14000d980
mov rcx, rax
lea rdx, [rbp + 0x10]
call fcn.140030c60
lea rcx, [rbp + 0x10]
call fcn.14000d980
mov rdx, rax
mov r8d, dword [rbp + 0x18]
lea rcx, [rbp + 0x4a0]
call fcn.1400210b0
test eax, eax
je 0x14007b5cc
mov r8d, r12d
lea rdx, [rbp + 0x38]
lea rcx, [rbp]
call fcn.140015450
nop
mov ecx, dword [rbp - 0x18]
or ecx, 1
mov dword [rbp - 0x18], ecx
mov dword [rbp - 0x48], ecx
mov rcx, rax
call fcn.14000d980
mov rcx, rax
lea rdx, [0x1402ed7f4]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007b4b4
lea rcx, [rbp + 0x4a0]
call fcn.140020bd0
test eax, eax
jne 0x14007b4b4
mov dil, 1
jmp 0x14007b4b7
lea rcx, [rbp + 0x640]
call fcn.14001feb0
nop
lea rcx, [rbp - 8]
call fcn.14000d850
nop
lea rcx, [rbp - 0x78]
call fcn.14000d850
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
jmp 0x14007efce
xor dil, dil
mov eax, dword [rbp - 0x18]
test al, 1
je 0x14007b4cd
and eax, 0xfffffffe
mov dword [rbp - 0x18], eax
lea rcx, [rbp + 0x38]
call fcn.14000d850
test dil, dil
je 0x14007b55d
test rbx, rbx
je 0x14007b4fa
cmp dword [rbx + 0x24], 1
je 0x14007b5be
mov dword [rbx + 0x24], r12d
lea rcx, [rbp + 0x4a0]
call fcn.14001ffc0
jmp 0x14007b62d
lea rcx, [rbp - 0x38]
call fcn.14000d940
nop
mov rcx, rsi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x38]
mov edx, r15d
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x38]
call fcn.14000d980
mov r8d, dword [rbp - 0x70]
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007b543
mov dword [rax + 0x24], r12d
lea rcx, [rbp - 0x38]
call fcn.14000d850
lea rcx, [rbp + 0x4a0]
call fcn.14001ffc0
jmp 0x14007b62d
test rbx, rbx
jne 0x14007b5be
mov r15, qword [r13 + 0x3f0]
mov edi, dword [r14 + 0x30]
mov rsi, qword [r14 + 0x28]
mov r14d, dword [r14 + 0x20]
mov rcx, qword [rbp - 0x10]
add rcx, 0x18
call fcn.14000d980
mov rbx, rax
mov rcx, qword [rbp + 0x28]
call fcn.14000d980
mov ecx, dword [rbp - 0x70]
mov dword [rsp + 0x48], ecx
xor ecx, ecx
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov r9d, r14d
mov r8, rbx
mov rdx, rax
mov rcx, r15
call fcn.140055970
lea rcx, [rbp + 0x4a0]
call fcn.14001ffc0
jmp 0x14007b62d
test rbx, rbx
jne 0x14007b62d
mov r15, qword [r13 + 0x3f0]
mov edi, dword [r14 + 0x30]
mov rsi, qword [r14 + 0x28]
mov r14d, dword [r14 + 0x20]
mov rcx, qword [rbp - 0x10]
add rcx, 0x18
call fcn.14000d980
mov rbx, rax
mov rcx, qword [rbp + 0x28]
call fcn.14000d980
mov ecx, dword [rbp - 0x70]
mov dword [rsp + 0x48], ecx
xor ecx, ecx
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov r9d, r14d
mov r8, rbx
mov rdx, rax
mov rcx, r15
call fcn.140055970
mov rbx, qword [rbp - 0x10]
cmp dword [rbx + 0x30], 0
je 0x14007b640
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rbx
call fcn.14005dc90
nop
lea rcx, [rbp + 0x4a0]
call fcn.14001feb0
nop
lea rcx, [rbp + 0x10]
call fcn.14000d850
nop
lea rcx, [rbp + 8]
call fcn.14000d850
nop
lea rcx, [rbp]
call fcn.14000d850
nop
lea rcx, [rbp + 0x30]
call fcn.14000d850
cmp qword [rbp - 0x50], 0
jne 0x14007b330
lea rcx, [rbp + 0x88]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0x210]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0x2c0]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0x298]
call fcn.1400a64e0
nop
mov edx, 0xa
lea rcx, [rbp + 0x108]
call fcn.140094570
nop
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClassesCLSID
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
xor ebx, ebx
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesCLSID
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
mov dword [rbp - 0x80], ebx
mov r14d, dword [rbp - 0x20]
cmp r14d, 1
jne 0x14007b809
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesCLSID
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesCLSID
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
cmp dword [r13 + 0x3e4], ebx
jne 0x14007baae
mov edx, 0xa
lea rcx, [rbp + 0x570]
call fcn.140094570
nop
mov dword [rbp - 0x80], ebx
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClassesCLSID
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesCLSID
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
mov dword [rbp - 0x80], ebx
cmp r14d, 1
jne 0x14007b944
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesCLSID
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesCLSID
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea rcx, [rbp + 0x570]
call fcn.140021a70
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14007baa2
nop dword [rax]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x570]
call fcn.1400946a0
mov rsi, qword [rax]
add rsi, 0x10
mov rcx, rsi
call fcn.140055e30
mov edi, ebx
test al, al
cmovne edi, r12d
lea rcx, [rbp - 0x10]
call fcn.14000d940
nop
mov rcx, rsi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x10]
mov edx, 2
call fcn.14002de30
lea rcx, [rbp - 0x68]
call fcn.14000d940
nop
lea rcx, [rbp - 0x38]
call fcn.14000d940
nop
mov rcx, rsi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x68]
lea edx, [rdi + 6]
call fcn.14002de30
mov rcx, rsi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x38]
lea edx, [rdi + 7]
call fcn.14002f3b0
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x88]
mov rcx, r13
call fcn.14008e930
test eax, eax
je 0x14007ba75
lea rcx, [rbp - 0x10]
call fcn.14000d980
mov rcx, rax
lea rdx, str.HKEY_LOCAL_MACHINE
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x88]
call fcn.140022600
lea r8, str.SoftwareClassesCLSID_
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.140021fb0
lea rcx, [rbp - 0x38]
call fcn.14000d980
mov r8, rax
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov r8d, 2
lea rdx, [rbp + 0xbe0]
mov rcx, qword [r13 + 0x3f0]
call fcn.140055910
nop
lea rcx, [rbp - 0x38]
call fcn.14000d850
nop
lea rcx, [rbp - 0x68]
call fcn.14000d850
nop
lea rcx, [rbp - 0x10]
call fcn.14000d850
cmp qword [rbp - 0x50], 0
mov ebx, 0
jne 0x14007b960
lea rcx, [rbp + 0x570]
call fcn.1400946b0
lea rcx, [rbp + 0x108]
call fcn.140021a70
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14007c4d4
jmp 0x14007bad2
xor ebx, ebx
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x108]
call fcn.1400946a0
mov rax, qword [rax]
mov qword [rbp + 8], rax
lea rdi, [rax + 0x10]
mov rcx, rdi
call fcn.140055e30
mov esi, ebx
test al, al
cmovne esi, r12d
lea rcx, [rbp - 0x68]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x68]
lea edx, [rsi + 7]
call fcn.14002de30
lea rcx, [rbp - 0x18]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x18]
mov edx, 2
call fcn.14002de30
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.HKEY_LOCAL_MACHINE
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007bb6b
cmp r14d, 1
mov r14, 0xffffffff80000002
je 0x14007bb6f
mov r14, qword [rbp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.14000d940
nop
lea rcx, [rbp]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x78]
lea edx, [rsi + 6]
call fcn.14002de30
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp]
lea edx, [rsi + 7]
call fcn.14002f3b0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x88]
mov rcx, r13
call fcn.14008e930
test eax, eax
je 0x14007bc20
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x88]
call fcn.140022600
lea r8, str.SoftwareClassesCLSID_
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140021fb0
lea rcx, [rbp]
call fcn.14000d980
mov r8, rax
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov r8d, dword [rbp - 0x70]
lea rdx, [rbp + 0xbe0]
mov rcx, qword [r13 + 0x3f0]
call fcn.140055910
jmp 0x14007bc32
lea r8, str.SoftwareClassesCLSID_
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140021fb0
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov rcx, rax
lea rdx, str.InprocServer32
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007be17
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov rcx, rax
lea rdx, str.InprocServer
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007be17
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov rcx, rax
lea rdx, str.LocalServer
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007be17
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov rcx, rax
lea rdx, str.InprocHandler32
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007be17
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov rcx, rax
lea rdx, str.LocalServer32
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007be17
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rcx, rax
lea rdx, str.Shell
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007bd92
lea rcx, [rbp - 0x10]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x10]
lea edx, [rsi + 9]
call fcn.14002de30
lea rcx, [rbp - 0x10]
call fcn.14000d980
mov rcx, rax
lea rdx, str.Command
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007bd89
lea rcx, [rbp - 0x38]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x38]
lea edx, [rsi + 9]
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x38]
call fcn.14000d980
mov r8d, dword [rbp - 0x70]
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007bd7f
mov dword [rax + 0x24], r12d
lea rcx, [rbp - 0x38]
call fcn.14000d850
nop
lea rcx, [rbp - 0x10]
call fcn.14000d850
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rcx, rax
lea rdx, str.DefaultIcon
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007c47f
mov r15, qword [r13 + 0x3f0]
mov rax, qword [rbp + 8]
mov edi, dword [rax + 0x30]
mov rsi, qword [rax + 0x28]
mov r14d, dword [rax + 0x20]
lea rcx, [rax + 0x18]
call fcn.14000d980
mov rbx, rax
mov rcx, qword [rbp + 8]
add rcx, 0x10
call fcn.14000d980
mov ecx, dword [rbp - 0x70]
mov dword [rsp + 0x48], ecx
xor ecx, ecx
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov r9d, r14d
mov r8, rbx
mov rdx, rax
mov rcx, r15
call fcn.140055970
jmp 0x14007c47f
lea rcx, [rbp + 0x10]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp + 0x10]
lea edx, [rsi + 7]
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp + 0x10]
call fcn.14000d980
mov edi, dword [rbp - 0x70]
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007be62
mov dword [rax + 0x24], r12d
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov esi, dword [rbp + 0x18]
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007bfdc
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x4a0]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1402f1268]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007bfd2
lea rcx, [rbp + 0x4a0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007bef0
test rax, rax
je 0x14007bfd2
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x210]
call fcn.14001aab0
lea rdx, str.SoftwareClassesAppID_
lea rcx, [rbp - 0x28]
call fcn.14000d880
nop
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp - 0x28]
call fcn.140015550
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007bfc9
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x28]
call fcn.140094300
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x28]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x28]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007bfbe
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x28]
call fcn.14000d850
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x40]
call fcn.14000d910
nop
lea rdx, str.ProgID
lea rcx, [rbp - 0x40]
call fcn.140015550
lea rcx, [rbp - 0x40]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007c161
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x640]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x640]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007c157
lea rcx, [rbp + 0x640]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007c080
test rax, rax
je 0x14007c157
lea rdx, [rbp + 0x640]
lea rcx, [rbp + 0x2c0]
call fcn.14001aab0
lea rdx, str.SoftwareClasses_
lea rcx, [rbp - 0x40]
call fcn.14000d770
lea rdx, [rbp + 0x640]
lea rcx, [rbp - 0x40]
call fcn.140015550
lea rcx, [rbp - 0x40]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007c157
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x40]
call fcn.140094300
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x40]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007c14d
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x30]
call fcn.14000d910
nop
lea rdx, str.VersionIndependentProgID
lea rcx, [rbp - 0x30]
call fcn.140015550
lea rcx, [rbp - 0x30]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007c2c3
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x570]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007c2b9
lea rdx, [rbp + 0x570]
lea rcx, [rbp + 0x298]
call fcn.14001aab0
lea rdx, str.SoftwareClasses_
lea rcx, [rbp - 0x30]
call fcn.14000d770
lea rdx, [rbp + 0x570]
lea rcx, [rbp - 0x30]
call fcn.140015550
lea rcx, [rbp - 0x30]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007c2b9
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x30]
call fcn.140094300
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x30]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007c2af
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.14000d910
nop
lea rdx, str.TypeLib
lea rcx, [rbp - 0x58]
call fcn.140015550
lea rcx, [rbp - 0x58]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007c458
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x710]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007c44d
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0x40]
call fcn.14000d880
nop
mov r8, rax
lea rdx, [rbp + 0xe0]
mov rcx, r13
call fcn.14008e930
mov ebx, eax
lea rcx, [rbp + 0x40]
call fcn.14000d850
test ebx, ebx
je 0x14007c39c
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0xe0]
call fcn.14001aab0
lea rdx, str.SoftwareClassesTypeLib_
lea rcx, [rbp - 0x58]
call fcn.14000d770
lea rdx, [rbp + 0x710]
lea rcx, [rbp - 0x58]
call fcn.140015550
lea rcx, [rbp - 0x58]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007c44d
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x58]
call fcn.140094300
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x58]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007c443
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x58]
call fcn.14000d850
nop
lea rcx, [rbp - 0x30]
call fcn.14000d850
nop
lea rcx, [rbp - 0x40]
call fcn.14000d850
nop
lea rcx, [rbp + 0x10]
call fcn.14000d850
mov rbx, qword [rbp + 8]
cmp dword [rbx + 0x30], 0
je 0x14007c492
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rbx
call fcn.14005dc90
nop
lea rcx, [rbp]
call fcn.14000d850
nop
lea rcx, [rbp - 0x78]
call fcn.14000d850
nop
lea rcx, [rbp - 0x18]
call fcn.14000d850
nop
lea rcx, [rbp - 0x68]
call fcn.14000d850
cmp qword [rbp - 0x50], 0
mov r14d, dword [rbp - 0x20]
jne 0x14007bad0
mov rcx, qword [r13 + 8]
call fcn.140021a70
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007ef80
lea rcx, [rbp + 0x108]
call fcn.140094660
xor esi, esi
mov dword [rbp - 0x80], esi
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREWOW6432NodeClassesCLSID
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREWOW6432NodeClassesCLSID
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
mov dword [rbp - 0x80], esi
cmp r14d, 1
jne 0x14007c626
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeClassesCLSID
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREWOW6432NodeClassesCLSID
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea rcx, [rbp + 0x108]
call fcn.140021a70
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14007d049
nop
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x108]
call fcn.1400946a0
mov rax, qword [rax]
mov qword [rbp + 8], rax
lea rdi, [rax + 0x10]
mov rcx, rdi
call fcn.140055e30
test al, al
cmovne esi, r12d
lea rcx, [rbp - 0x18]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x18]
lea edx, [rsi + 8]
call fcn.14002de30
lea rcx, [rbp - 0x28]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x28]
mov edx, 2
call fcn.14002de30
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov rcx, rax
lea rdx, str.HKEY_LOCAL_MACHINE
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007c6d7
cmp r14d, 1
mov r14, 0xffffffff80000002
je 0x14007c6db
mov r14, qword [rbp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.14000d940
nop
lea rcx, [rbp]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x78]
lea edx, [rsi + 7]
call fcn.14002de30
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp]
lea edx, [rsi + 8]
call fcn.14002f3b0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x88]
mov rcx, r13
call fcn.14008e930
test eax, eax
je 0x14007c78c
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x88]
call fcn.140022600
lea r8, str.SoftwareWOW6432NodeClassesCLSID_
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140021fb0
lea rcx, [rbp]
call fcn.14000d980
mov r8, rax
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov r8d, dword [rbp - 0x70]
lea rdx, [rbp + 0xbe0]
mov rcx, qword [r13 + 0x3f0]
call fcn.140055910
jmp 0x14007c79e
lea r8, str.SoftwareWOW6432NodeClassesCLSID_
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140021fb0
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.InprocServer32
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007c983
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.InprocServer
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007c983
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.LocalServer
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007c983
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.InprocHandler32
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007c983
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.LocalServer32
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007c983
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rcx, rax
lea rdx, str.Shell
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007c8fe
lea rcx, [rbp - 0x10]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x10]
lea edx, [rsi + 0xa]
call fcn.14002de30
lea rcx, [rbp - 0x10]
call fcn.14000d980
mov rcx, rax
lea rdx, str.Command
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007c8f5
lea rcx, [rbp - 0x38]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x38]
lea edx, [rsi + 0xa]
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x38]
call fcn.14000d980
mov r8d, dword [rbp - 0x70]
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007c8eb
mov dword [rax + 0x24], r12d
lea rcx, [rbp - 0x38]
call fcn.14000d850
nop
lea rcx, [rbp - 0x10]
call fcn.14000d850
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rcx, rax
lea rdx, str.DefaultIcon
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007cfef
mov r15, qword [r13 + 0x3f0]
mov rax, qword [rbp + 8]
mov edi, dword [rax + 0x30]
mov rsi, qword [rax + 0x28]
mov r14d, dword [rax + 0x20]
lea rcx, [rax + 0x18]
call fcn.14000d980
mov rbx, rax
mov rcx, qword [rbp + 8]
add rcx, 0x10
call fcn.14000d980
mov ecx, dword [rbp - 0x70]
mov dword [rsp + 0x48], ecx
xor ecx, ecx
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov r9d, r14d
mov r8, rbx
mov rdx, rax
mov rcx, r15
call fcn.140055970
jmp 0x14007cfef
lea rcx, [rbp + 0x10]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp + 0x10]
lea edx, [rsi + 8]
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp + 0x10]
call fcn.14000d980
mov edi, dword [rbp - 0x70]
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007c9ce
mov dword [rax + 0x24], r12d
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov esi, dword [rbp + 0x18]
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007cb4c
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x4a0]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1402f1268]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007cb42
lea rcx, [rbp + 0x4a0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007ca60
test rax, rax
je 0x14007cb42
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x210]
call fcn.14001aab0
lea rdx, str.SoftwareWOW6432NodeClassesAppID_
lea rcx, [rbp - 0x68]
call fcn.14000d880
nop
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp - 0x68]
call fcn.140015550
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007cb39
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x68]
call fcn.140094300
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007cb2e
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x68]
call fcn.14000d850
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x40]
call fcn.14000d910
nop
lea rdx, str.ProgID
lea rcx, [rbp - 0x40]
call fcn.140015550
lea rcx, [rbp - 0x40]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007ccd1
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x640]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x640]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007ccc7
lea rcx, [rbp + 0x640]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007cbf0
test rax, rax
je 0x14007ccc7
lea rdx, [rbp + 0x640]
lea rcx, [rbp + 0x2c0]
call fcn.14001aab0
lea rdx, str.SoftwareWOW6432NodeClasses_
lea rcx, [rbp - 0x40]
call fcn.14000d770
lea rdx, [rbp + 0x640]
lea rcx, [rbp - 0x40]
call fcn.140015550
lea rcx, [rbp - 0x40]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007ccc7
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x40]
call fcn.140094300
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x40]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007ccbd
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x30]
call fcn.14000d910
nop
lea rdx, str.VersionIndependentProgID
lea rcx, [rbp - 0x30]
call fcn.140015550
lea rcx, [rbp - 0x30]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007ce33
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x570]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007ce29
lea rdx, [rbp + 0x570]
lea rcx, [rbp + 0x298]
call fcn.14001aab0
lea rdx, str.SoftwareWOW6432NodeClasses_
lea rcx, [rbp - 0x30]
call fcn.14000d770
lea rdx, [rbp + 0x570]
lea rcx, [rbp - 0x30]
call fcn.140015550
lea rcx, [rbp - 0x30]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007ce29
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x30]
call fcn.140094300
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x30]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007ce1f
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.14000d910
nop
lea rdx, str.TypeLib
lea rcx, [rbp - 0x58]
call fcn.140015550
lea rcx, [rbp - 0x58]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007cfc8
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x710]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007cfbd
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0x40]
call fcn.14000d880
nop
mov r8, rax
lea rdx, [rbp + 0xe0]
mov rcx, r13
call fcn.14008e930
mov ebx, eax
lea rcx, [rbp + 0x40]
call fcn.14000d850
test ebx, ebx
je 0x14007cf0c
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0xe0]
call fcn.14001aab0
lea rdx, str.SoftwareWOW6432NodeClassesTypeLib_
lea rcx, [rbp - 0x58]
call fcn.14000d770
lea rdx, [rbp + 0x710]
lea rcx, [rbp - 0x58]
call fcn.140015550
lea rcx, [rbp - 0x58]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007cfbd
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x58]
call fcn.140094300
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x58]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007cfb3
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x58]
call fcn.14000d850
nop
lea rcx, [rbp - 0x30]
call fcn.14000d850
nop
lea rcx, [rbp - 0x40]
call fcn.14000d850
nop
lea rcx, [rbp + 0x10]
call fcn.14000d850
mov rbx, qword [rbp + 8]
cmp dword [rbx + 0x30], 0
je 0x14007d002
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rbx
call fcn.14005dc90
nop
lea rcx, [rbp]
call fcn.14000d850
nop
lea rcx, [rbp - 0x78]
call fcn.14000d850
nop
lea rcx, [rbp - 0x28]
call fcn.14000d850
nop
lea rcx, [rbp - 0x18]
call fcn.14000d850
cmp qword [rbp - 0x50], 0
mov r14d, dword [rbp - 0x20]
mov esi, 0
jne 0x14007c640
mov rcx, qword [r13 + 8]
call fcn.140021a70
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007ef80
lea rcx, [rbp + 0x108]
call fcn.140094660
mov dword [rbp - 0x80], esi
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClassesWOW6432NodeCLSID
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesWOW6432NodeCLSID
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
mov dword [rbp - 0x80], esi
test r14d, r14d
je 0x14007d198
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesWOW6432NodeCLSID
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesWOW6432NodeCLSID
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea rcx, [rbp + 0x108]
call fcn.140021a70
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14007dbc9
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x108]
call fcn.1400946a0
mov rax, qword [rax]
mov qword [rbp + 8], rax
lea rdi, [rax + 0x10]
mov rcx, rdi
call fcn.140055e30
test al, al
cmovne esi, r12d
lea rcx, [rbp - 0x18]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x18]
lea edx, [rsi + 8]
call fcn.14002de30
lea rcx, [rbp - 0x28]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x28]
mov edx, 2
call fcn.14002de30
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov rcx, rax
lea rdx, str.HKEY_LOCAL_MACHINE
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007d256
test r14d, r14d
mov r14, 0xffffffff80000002
jne 0x14007d25a
mov r14, qword [rbp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.14000d940
nop
lea rcx, [rbp]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x78]
lea edx, [rsi + 7]
call fcn.14002de30
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp]
lea edx, [rsi + 8]
call fcn.14002f3b0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x88]
mov rcx, r13
call fcn.14008e930
test eax, eax
je 0x14007d30b
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x88]
call fcn.140022600
lea r8, str.SoftwareClassesWOW6432NodeCLSID_
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140021fb0
lea rcx, [rbp]
call fcn.14000d980
mov r8, rax
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov r8d, dword [rbp - 0x70]
lea rdx, [rbp + 0xbe0]
mov rcx, qword [r13 + 0x3f0]
call fcn.140055910
jmp 0x14007d31d
lea r8, str.SoftwareClassesWOW6432NodeCLSID_
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140021fb0
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.InprocServer32
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007d502
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.InprocServer
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007d502
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.LocalServer
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007d502
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.InprocHandler32
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007d502
lea rcx, [rbp - 0x18]
call fcn.14000d980
mov rcx, rax
lea rdx, str.LocalServer32
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14007d502
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rcx, rax
lea rdx, str.Shell
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007d47d
lea rcx, [rbp - 0x10]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x10]
lea edx, [rsi + 0xa]
call fcn.14002de30
lea rcx, [rbp - 0x10]
call fcn.14000d980
mov rcx, rax
lea rdx, str.Command
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007d474
lea rcx, [rbp - 0x38]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x38]
lea edx, [rsi + 0xa]
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x38]
call fcn.14000d980
mov r8d, dword [rbp - 0x70]
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007d46a
mov dword [rax + 0x24], r12d
lea rcx, [rbp - 0x38]
call fcn.14000d850
nop
lea rcx, [rbp - 0x10]
call fcn.14000d850
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rcx, rax
lea rdx, str.DefaultIcon
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14007db6f
mov r15, qword [r13 + 0x3f0]
mov rax, qword [rbp + 8]
mov edi, dword [rax + 0x30]
mov rsi, qword [rax + 0x28]
mov r14d, dword [rax + 0x20]
lea rcx, [rax + 0x18]
call fcn.14000d980
mov rbx, rax
mov rcx, qword [rbp + 8]
add rcx, 0x10
call fcn.14000d980
mov ecx, dword [rbp - 0x70]
mov dword [rsp + 0x48], ecx
xor ecx, ecx
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov r9d, r14d
mov r8, rbx
mov rdx, rax
mov rcx, r15
call fcn.140055970
jmp 0x14007db6f
lea rcx, [rbp + 0x10]
call fcn.14000d940
nop
mov rcx, rdi
call fcn.14000d980
mov rcx, rax
lea r8, [rbp + 0x10]
lea edx, [rsi + 8]
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp + 0x10]
call fcn.14000d980
mov edi, dword [rbp - 0x70]
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007d54d
mov dword [rax + 0x24], r12d
lea rcx, [rbp - 0x78]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov esi, dword [rbp + 0x18]
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007d6cc
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x4a0]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1402f1268]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007d6c2
lea rcx, [rbp + 0x4a0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007d5e0
test rax, rax
je 0x14007d6c2
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x210]
call fcn.14001aab0
lea rdx, str.SoftwareClassesWOW6432NodeAppID_
lea rcx, [rbp - 0x68]
call fcn.14000d880
nop
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp - 0x68]
call fcn.140015550
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007d6b9
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x68]
call fcn.140094300
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x68]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007d6ae
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x68]
call fcn.14000d850
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x40]
call fcn.14000d910
nop
lea rdx, str.ProgID
lea rcx, [rbp - 0x40]
call fcn.140015550
lea rcx, [rbp - 0x40]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007d851
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x640]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x640]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007d847
lea rcx, [rbp + 0x640]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007d770
test rax, rax
je 0x14007d847
lea rdx, [rbp + 0x640]
lea rcx, [rbp + 0x2c0]
call fcn.14001aab0
lea rdx, str.SoftwareClassesWOW6432Node_
lea rcx, [rbp - 0x40]
call fcn.14000d770
lea rdx, [rbp + 0x640]
lea rcx, [rbp - 0x40]
call fcn.140015550
lea rcx, [rbp - 0x40]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007d847
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x40]
call fcn.140094300
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x40]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007d83d
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x30]
call fcn.14000d910
nop
lea rdx, str.VersionIndependentProgID
lea rcx, [rbp - 0x30]
call fcn.140015550
lea rcx, [rbp - 0x30]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007d9b3
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x570]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x570]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007d9a9
lea rdx, [rbp + 0x570]
lea rcx, [rbp + 0x298]
call fcn.14001aab0
lea rdx, str.SoftwareClassesWOW6432Node_
lea rcx, [rbp - 0x30]
call fcn.14000d770
lea rdx, [rbp + 0x570]
lea rcx, [rbp - 0x30]
call fcn.140015550
lea rcx, [rbp - 0x30]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007d9a9
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x30]
call fcn.140094300
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x30]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007d99f
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.14000d910
nop
lea rdx, str.TypeLib
lea rcx, [rbp - 0x58]
call fcn.140015550
lea rcx, [rbp - 0x58]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007db48
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x710]
call fcn.140241ba0
mov dword [rbp - 0x48], 0xc8
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007db3d
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0x40]
call fcn.14000d880
nop
mov r8, rax
lea rdx, [rbp + 0xe0]
mov rcx, r13
call fcn.14008e930
mov ebx, eax
lea rcx, [rbp + 0x40]
call fcn.14000d850
test ebx, ebx
je 0x14007da8c
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0xe0]
call fcn.14001aab0
lea rdx, str.SoftwareClassesWOW6432NodeTypeLib_
lea rcx, [rbp - 0x58]
call fcn.14000d770
lea rdx, [rbp + 0x710]
lea rcx, [rbp - 0x58]
call fcn.140015550
lea rcx, [rbp - 0x58]
call fcn.14000d980
mov rdx, rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007db3d
xor edx, edx
lea r8d, [rax + 0x5c]
lea rcx, [rbp - 0x58]
call fcn.140094300
lea rcx, [rbp - 0x28]
call fcn.14000d980
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140021fb0
lea r8, str.REGISTRY_
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140021fb0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x58]
call fcn.14000d980
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007db33
mov dword [rax + 0x24], r12d
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x58]
call fcn.14000d850
nop
lea rcx, [rbp - 0x30]
call fcn.14000d850
nop
lea rcx, [rbp - 0x40]
call fcn.14000d850
nop
lea rcx, [rbp + 0x10]
call fcn.14000d850
mov rbx, qword [rbp + 8]
cmp dword [rbx + 0x30], 0
je 0x14007db82
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rbx
call fcn.14005dc90
nop
lea rcx, [rbp]
call fcn.14000d850
nop
lea rcx, [rbp - 0x78]
call fcn.14000d850
nop
lea rcx, [rbp - 0x28]
call fcn.14000d850
nop
lea rcx, [rbp - 0x18]
call fcn.14000d850
cmp qword [rbp - 0x50], 0
mov r14d, dword [rbp - 0x20]
mov esi, 0
jne 0x14007d1c0
mov rcx, qword [r13 + 8]
call fcn.140021a70
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007ef80
mov edx, 0xa
lea rcx, [rbp + 0x348]
call fcn.140094570
nop
lea rcx, [rbp + 0x270]
call fcn.1400a64e0
nop
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x270]
call fcn.1400a6620
lea rdx, [rbp + 0x270]
mov rcx, r13
call fcn.14008e7e0
mov dword [rbp - 0x80], esi
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClassesTypeLib
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x348]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesTypeLib
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
test r14d, r14d
je 0x14007dd48
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesTypeLib
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x348]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesTypeLib
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea rcx, [rbp + 0x348]
call fcn.140021a70
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14007de67
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x348]
call fcn.1400946a0
mov rdi, qword [rax]
lea rcx, [rbp - 8]
call fcn.14000d940
nop
lea rcx, [rbp - 0x38]
call fcn.14000d940
nop
lea rcx, [rdi + 0x10]
call fcn.140055e30
test al, al
cmovne esi, r12d
lea rcx, [rdi + 0x10]
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 8]
lea edx, [rsi + 6]
call fcn.14002de30
lea r8, [rbp - 8]
lea rdx, [rbp + 0xe0]
mov rcx, r13
call fcn.14008e930
test eax, eax
je 0x14007de25
lea rdx, [rbp - 8]
lea rcx, [rbp + 0xe0]
call fcn.140022600
lea rcx, [rdi + 0x10]
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x38]
lea edx, [rsi + 7]
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x38]
call fcn.14000d980
mov r8d, dword [rbp - 0x70]
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007de25
mov dword [rax + 0x24], r12d
cmp dword [rdi + 0x30], 0
je 0x14007de34
mov rcx, qword [rdi + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rdi
call fcn.14005dc90
nop
lea rcx, [rbp - 0x38]
call fcn.14000d850
nop
lea rcx, [rbp - 8]
call fcn.14000d850
cmp qword [rbp - 0x50], 0
mov esi, 0
jne 0x14007dd70
mov r14d, dword [rbp - 0x20]
mov edx, 0xa
lea rcx, [rbp + 0x168]
call fcn.140094570
nop
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClasses
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClasses
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
test r14d, r14d
je 0x14007dfa6
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClasses
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClasses
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea r8, str.REGISTRYHKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExt
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExt
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
test r14d, r14d
je 0x14007e1ef
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExt
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExt
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet_ExplorerExtensions
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExtensions
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerExtensions
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExtensions
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
test r14d, r14d
je 0x14007e312
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet_ExplorerExplorer_Bars
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExplorer_Bars
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerExplorer_Bars
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExplorer_Bars
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
test r14d, r14d
je 0x14007e435
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerControlPanelNameSpace
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerControlPanelNameSpace
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea rcx, [rbp + 0x168]
call fcn.140021a70
mov qword [rbp - 0x50], rax
mov r14d, dword [rbp - 0x70]
test rax, rax
je 0x14007e4ab
nop
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x168]
call fcn.1400946a0
mov rdi, qword [rax]
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rdi + 0x10]
call fcn.14000d980
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007e48a
mov dword [rax + 0x24], r12d
cmp dword [rdi + 0x30], 0
je 0x14007e499
mov rcx, qword [rdi + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rdi
call fcn.14005dc90
cmp qword [rbp - 0x50], 0
jne 0x14007e450
mov rcx, qword [r13 + 8]
call fcn.140021a70
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007ef59
mov ebx, dword [rbp - 0x20]
test ebx, ebx
je 0x14007e5e3
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionShell_Extensions
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [r13 + 0x3f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionShell_Extensions
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.140057770
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShell_Extensions
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [r13 + 0x3f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionShell_Extensions
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.140057770
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionShell_Extensions
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [r13 + 0x3f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionShell_Extensions
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.140057770
test ebx, ebx
je 0x14007e6ff
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet_ExplorerToolbar
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [r13 + 0x3f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbar
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.140057770
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerToolbar
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [r13 + 0x3f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbar
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.140057770
mov edx, 0xa
lea rcx, [rbp + 0x310]
call fcn.140094570
nop
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClassesAppID
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x310]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesAppID
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
mov dword [rbp - 0x80], esi
test ebx, ebx
je 0x14007e8be
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesAppID
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x310]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesAppID
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea rcx, [rbp + 0x310]
call fcn.140021a70
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14007e93e
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x310]
call fcn.1400946a0
mov rdi, qword [rax]
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rdi + 0x10]
call fcn.14000d980
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007e91a
mov dword [rax + 0x24], r12d
cmp dword [rdi + 0x30], 0
je 0x14007e929
mov rcx, qword [rdi + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rdi
call fcn.14005dc90
cmp qword [rbp - 0x50], 0
jne 0x14007e8e0
mov ebx, dword [rbp - 0x20]
mov rcx, qword [r13 + 8]
call fcn.140021a70
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007ef4c
mov edx, 0xa
lea rcx, [rbp + 0x1d8]
call fcn.140094570
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0xe0]
call fcn.1400a659c
mov dword [rbp - 0x80], esi
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClassesInterface
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesInterface
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
mov dword [rbp - 0x80], esi
test ebx, ebx
je 0x14007eaa5
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesInterface
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesInterface
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea rcx, [rbp + 0x1d8]
call fcn.140021a70
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14007eb61
nop
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1d8]
call fcn.1400946a0
mov rsi, qword [rax]
lea rcx, [rsi + 0x10]
call fcn.140055e30
xor ebx, ebx
test al, al
cmovne ebx, r12d
lea rcx, [rbp - 0x38]
call fcn.14000d940
nop
lea rcx, [rsi + 0x10]
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x38]
lea edx, [rbx + 7]
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x38]
call fcn.14000d980
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007eb2d
mov dword [rax + 0x24], r12d
cmp dword [rsi + 0x30], 0
je 0x14007eb3c
mov rcx, qword [rsi + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rsi
call fcn.14005dc90
nop
lea rcx, [rbp - 0x38]
call fcn.14000d850
cmp qword [rbp - 0x50], 0
jne 0x14007eac0
mov ebx, dword [rbp - 0x20]
xor esi, esi
mov rcx, qword [r13 + 8]
call fcn.140021a70
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007ef3f
lea rcx, [rbp + 0x1d8]
call fcn.140094660
mov dword [rbp - 0x80], esi
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREClassesWOW6432NodeInterface
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesWOW6432NodeInterface
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.1400583c0
mov dword [rbp - 0x80], esi
test ebx, ebx
je 0x14007ecaf
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesWOW6432NodeInterface
mov edx, 0x10000
lea rcx, [rbp + 0xbe0]
call fcn.140022620
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0x1e
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbe0]
lea r8, str.SOFTWAREClassesWOW6432NodeInterface
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400583c0
lea rcx, [rbp + 0x1d8]
call fcn.140021a70
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14007ed6e
nop dword [rax + rax]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1d8]
call fcn.1400946a0
mov rsi, qword [rax]
lea rcx, [rsi + 0x10]
call fcn.140055e30
xor ebx, ebx
test al, al
cmovne ebx, r12d
lea rcx, [rbp - 0x38]
call fcn.14000d940
nop
lea rcx, [rsi + 0x10]
call fcn.14000d980
mov rcx, rax
lea r8, [rbp - 0x38]
lea edx, [rbx + 8]
call fcn.14002f3b0
mov rbx, qword [r13 + 0x3f0]
lea rcx, [rbp - 0x38]
call fcn.14000d980
mov r8d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.140055910
test rax, rax
je 0x14007ed3d
mov dword [rax + 0x24], r12d
cmp dword [rsi + 0x30], 0
je 0x14007ed4c
mov rcx, qword [rsi + 0x28]
call fcn.140095d64
mov edx, r12d
mov rcx, rsi
call fcn.14005dc90
nop
lea rcx, [rbp - 0x38]
call fcn.14000d850
cmp qword [rbp - 0x50], 0
jne 0x14007ecd0
xor esi, esi
mov rcx, qword [r13 + 8]
call fcn.140021a70
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007ef3f
lea rcx, [rbp + 0x1d8]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x310]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x168]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x270]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x348]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x108]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x298]
call fcn.1400a6500
nop
lea rcx, [rbp + 0xe0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x2c0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x210]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x88]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x380]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x2e8]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x3e0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x140]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x238]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x1a0]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x50]
call fcn.1400a6500
xor edx, edx
mov r8d, 0x20000
lea rcx, [rbp + 0x40be0]
call fcn.140241ba0
mov dword [rbp + 0xb0], esi
lea rcx, [rbp + 0x3b8]
call fcn.1400a64e0
nop
lea rdx, [rbp + 0x3b8]
mov rcx, r13
call fcn.14005ddc0
lea r8, str.REGISTRYHKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov edx, 0x10000
lea rcx, [rbp + 0x40be0]
call fcn.140022620
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], r12d
mov eax, dword [r13 + 0x3e4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x30], rax
mov rax, qword [r13 + 0x3f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3b8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x40be0]
lea r8, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.140057770
nop
lea rcx, [rbp + 0x3b8]
call fcn.1400a6500
jmp 0x14007f028
lea rcx, [rbp + 0x1d8]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x310]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x168]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x270]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x348]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x108]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x298]
call fcn.1400a6500
nop
lea rcx, [rbp + 0xe0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x2c0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x210]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x88]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x380]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x2e8]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x3e0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x140]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x238]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x1a0]
call fcn.1400946b0
nop
lea rcx, [rbp + 0x50]
call fcn.1400a6500
xor r12d, r12d
lea rcx, [rbp + 0x430]
call fcn.14001feb0
nop
lea rcx, [rbp + 0xb8]
call fcn.1400a6500
mov eax, r12d
mov rcx, qword [rbp + 0x60be0]
xor rcx, rsp
call fcn.1402155d0
lea r11, [rsp + 0x60cf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret