Function at 0x1400847b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9d0]
sub rsp, 0xad0
mov rax, qword [0x14036aa00]
xor rax, rsp
mov qword [rbp + 0x9c0], rax
mov r15, r9
movsxd r12, r8d
xor r14d, r14d
mov dword [rbp - 0x68], r14d
mov qword [rbp - 0x18], r14
lea rcx, [rbp - 0x18]
call fcn.140088ad0
lea r13, [r14 - 1]
mov rdi, qword [rbp - 0x18]
mov qword [rbp - 0x60], rdi
test al, al
jne 0x14008481b
lea r15d, [r14 + 1]
jmp 0x140085e51
test rdi, rdi
je 0x140084825
mov rsi, qword [rdi]
jmp 0x140084828
mov rsi, r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], r14
mov qword [rbp + 0x188], r14
mov r8, r13
inc r8
cmp word [rsi + r8*2], r14w
jne 0x140084843
mov rdx, rsi
lea rcx, [rbp + 0x170]
call fcn.14007c2c0
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
je 0x14008488a
mov rbx, rsi
mov r14d, eax
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rbx], ax
lea rbx, [rbx + 2]
sub r14, 1
jne 0x140084874
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], r14
mov r8, r13
inc r8
cmp word [rsi + r8*2], 0
jne 0x1400848a5
mov rdx, rsi
lea rcx, [rbp + 0xd0]
call fcn.14007c2c0
lea rdx, [rbp + 0xd0]
mov r8, qword [rbp + 0xd0]
mov r10, qword [rbp + 0xe8]
cmp r10, 7
cmova rdx, r8
mov rbx, qword [rbp + 0xe0]
test rbx, rbx
je 0x140084919
lea rcx, [rbx - 1]
mov rax, r13
cmp rcx, r13
cmovb rax, rcx
lea r9, [rdx + rax*2]
cmp word [r9], 0x2e
je 0x140084911
cmp r9, rdx
je 0x140084919
sub r9, 2
cmp word [r9], 0x2e
jne 0x140084901
sub r9, rdx
sar r9, 1
jmp 0x14008491c
mov r9, r13
cmp rbx, r9
jb 0x140085ecf
mov rax, rbx
sub rax, r9
mov rdx, r13
cmp rax, r13
cmovb rdx, rax
lea rax, [rbp + 0xd0]
cmp r10, 7
cmova rax, r8
lea rcx, [rax + r9*2]
sub rbx, rdx
mov r8, rbx
sub r8, r9
lea r8, [r8*2 + 2]
lea rdx, [rcx + rdx*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0xe0], rbx
lea r8, [rbp + 0xd0]
mov r9, qword [rbp + 0xd0]
mov r10, qword [rbp + 0xe8]
cmp r10, 7
cmova r8, r9
test rbx, rbx
je 0x1400849ba
lea rcx, [rbx - 1]
mov rax, r13
cmp rcx, r13
cmovb rax, rcx
lea rdx, [r8 + rax*2]
cmp word [rdx], 0x5c
je 0x1400849b2
cmp rdx, r8
je 0x1400849ba
sub rdx, 2
cmp word [rdx], 0x5c
jne 0x1400849a3
sub rdx, r8
sar rdx, 1
jmp 0x1400849bd
mov rdx, r13
cmp rbx, rdx
cmovb rdx, rbx
lea rcx, [rbp + 0xd0]
cmp r10, 7
cmova rcx, r9
sub rbx, rdx
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rdx*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0xe0], rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r14
mov qword [rbp + 0x108], r14
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str._acroiefavclient
lea rcx, [rbp + 0xf0]
call fcn.14007c2c0
mov qword [rbp - 0x78], r14
mov ecx, 0x48
call fcn.1402b4664
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x80], rax
mov rax, r12
mov qword [rbp - 0x58], rax
mov r12d, 1
test rax, rax
jle 0x140084d12
mov qword [rsp + 0x60], r14
lea r12, [r15 + 0x10]
mov qword [rsp + 0x58], r12
xor r15d, r15d
nop dword [rax]
mov rdx, qword [r12 - 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], r15
mov r8, r13
inc r8
cmp word [rdx + r8*2], 0
jne 0x140084a90
lea rcx, [rbp + 0x110]
call fcn.14007c2c0
mov ecx, reloc.WS2_32.dll_recv
call fcn.1402b4664
mov qword [rbp - 0x50], rax
mov rcx, qword [r12 - 8]
mov qword [rax], rcx
mov ecx, dword [r12]
mov dword [rax + 8], ecx
mov r13, qword [rbp - 0x80]
mov qword [rbp - 0x48], r13
mov r10, qword [r13 + 8]
mov qword [rbp - 0x40], r10
mov dword [rbp - 0x38], r15d
mov rsi, r13
mov r14, qword [rbp + 0x128]
mov rbx, qword [rbp + 0x120]
mov r15, qword [rbp + 0x110]
cmp byte [r10 + 0x19], 0
jne 0x140084bad
mov rdi, 0xffffffffffffffff
lea r13d, [rdi + 2]
xor r12d, r12d
nop dword [rax]
mov qword [rbp - 0x40], r10
lea rdx, [r10 + 0x20]
lea rax, [rbp + 0x110]
cmp r14, 7
cmova rax, r15
mov r11, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140084b35
mov rdx, qword [rdx]
mov rcx, r11
cmp rbx, r11
cmovb rcx, rbx
test rcx, rcx
je 0x140084b64
sub rdx, rax
nop word [rax + rax]
movzx r8d, word [rax + rdx]
cmp r8w, word [rax]
jne 0x140084b6d
add rax, 2
sub rcx, r13
jne 0x140084b50
cmp r11, rbx
jae 0x140084b75
mov eax, edi
jmp 0x140084b7b
mov eax, r13d
cmovb eax, edi
jmp 0x140084b7b
mov eax, r12d
seta al
shr eax, 0x1f
test al, al
je 0x140084b8c
mov dword [rbp - 0x38], r12d
mov r10, qword [r10 + 0x10]
jmp 0x140084b96
mov dword [rbp - 0x38], r13d
mov rsi, r10
mov r10, qword [r10]
cmp byte [r10 + 0x19], r12b
je 0x140084b10
mov rdi, qword [rbp - 0x60]
mov r12, qword [rsp + 0x58]
mov r13, qword [rbp - 0x48]
cmp byte [rsi + 0x19], 0
jne 0x140084c2c
lea rax, [rsi + 0x20]
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140084bc5
mov rax, qword [rax]
lea r9, [rbp + 0x110]
cmp r14, 7
cmova r9, r15
mov rcx, rbx
cmp r10, rbx
cmovb rcx, r10
test rcx, rcx
je 0x140084bfa
sub r9, rax
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x140084c08
add rax, 2
sub rcx, 1
jne 0x140084be6
xor r15d, r15d
cmp rbx, r10
jae 0x140084c1c
lea eax, [r15 - 1]
jmp 0x140084c25
mov eax, 1
mov rcx, 0xffffffffffffffff
cmovb eax, ecx
xor r15d, r15d
jmp 0x140084c25
mov eax, r15d
cmp rbx, r10
seta al
shr eax, 0x1f
test al, al
je 0x140084c93
movabs rax, 0x38e38e38e38e38e
cmp qword [rbp - 0x78], rax
je 0x140085ed5
mov edx, 1
lea rcx, [rbp - 0x80]
call fcn.1400895d0
mov rsi, rax
lea rdx, [rbp + 0x110]
lea rcx, [rax + 0x20]
call fcn.14007c7e0
xor r15d, r15d
mov qword [rsi + 0x40], r15
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], r13
mov word [rsi + 0x18], r15w
movups xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp + 0x40], xmm0
mov r8, rsi
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.14007d0a0
mov rsi, rax
mov rax, qword [rbp - 0x50]
mov qword [rsi + 0x40], rax
mov rdx, qword [rbp + 0x128]
cmp rdx, 7
jbe 0x140084cde
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084cd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140084d0b
call fcn.1402b46a0
nop
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x60], rax
add r12, 0x18
mov qword [rsp + 0x58], r12
mov r13, 0xffffffffffffffff
cmp rax, qword [rbp - 0x58]
jl 0x140084a70
lea r12d, [r13 + 2]
jmp 0x140084d15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor r15d, r15d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov r14, r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x78], r15
mov qword [rbp + 0x20], r15
mov dword [rbp + 0x28], r15d
mov qword [rbp + 0x30], r15
mov r9d, 0xf003f
mov r8, qword [str.SoftwareMicrosoftInternet_Explorer_]
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x20]
call fcn.140088ff0
test eax, eax
jne 0x140085bf8
mov qword [rbp - 0x10], r15
mov dword [rbp - 8], r15d
mov qword [rbp], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, qword [str.MenuExt]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x10]
call fcn.140088e60
test eax, eax
jne 0x140085bc7
mov ebx, r15d
mov dword [rsp + 0x50], ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3a0]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x6c], 0x104
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x6c]
lea r8, [rbp + 0x3a0]
mov edx, ebx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop
test eax, eax
jne 0x140085674
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], r15
lea rax, [rbp + 0x3a0]
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140084e20
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0xb0]
call fcn.14007c2c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r15
mov rdx, qword [str.SoftwareMicrosoftInternet_Explorer_]
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140084e60
lea rcx, [rbp + 0x50]
call fcn.14007c2c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r15
mov qword [rbp + 0x148], r15
mov rdx, qword [str.MenuExt]
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140084ea0
lea rcx, [rbp + 0x130]
call fcn.14007c2c0
lea r9, [rbp + 0x130]
mov rsi, qword [rbp + 0x130]
mov r15, qword [rbp + 0x148]
cmp r15, 7
cmova r9, rsi
mov r12, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
sub rax, r12
mov r14, qword [rbp + 0x140]
cmp r14, rax
ja 0x140084f1f
lea rax, [r14 + r12]
mov qword [rbp + 0x60], rax
lea rbx, [rbp + 0x50]
cmp rcx, 7
cmova rbx, qword [rbp + 0x50]
lea rcx, [rbx + r12*2]
lea r8, [r14 + r14]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r12 + r14]
xor ecx, ecx
mov word [rbx + rax*2], cx
jmp 0x140084f41
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x50]
call fcn.14007d330
mov r15, qword [rbp + 0x148]
mov rsi, qword [rbp + 0x130]
cmp r15, 7
jbe 0x140084f7d
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140084f74
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008565f
mov rcx, rsi
call fcn.1402b46a0
nop
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
mov r12d, 1
cmp rcx, rdx
jae 0x140084fae
lea rax, [rcx + 1]
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x50]
cmp rdx, 7
cmova rax, qword [rbp + 0x50]
mov dword [rax + rcx*2], 0x5c
jmp 0x140084fc3
mov r9d, 0x5c
xor r8d, r8d
mov rdx, r12
lea rcx, [rbp + 0x50]
call fcn.140088600
xor r15d, r15d
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova r9, qword [rbp + 0xb0]
mov r14, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
sub rax, r14
mov rsi, qword [rbp + 0xc0]
cmp rsi, rax
ja 0x140085027
lea rax, [rsi + r14]
mov qword [rbp + 0x60], rax
lea rbx, [rbp + 0x50]
cmp rcx, 7
cmova rbx, qword [rbp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rsi + rsi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rsi]
mov word [rbx + rax*2], r15w
jmp 0x140085042
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x50]
call fcn.14007d330
mov rsi, qword [rbp + 0xc0]
mov r14, qword [rbp - 0x80]
mov r10, qword [r14 + 8]
mov rbx, r14
cmp byte [r10 + 0x19], 0
jne 0x1400850ec
nop dword [rax + rax]
lea rdx, [r10 + 0x20]
lea rax, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rax, qword [rbp + 0xb0]
mov r11, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140085089
mov rdx, qword [rdx]
mov rcx, r11
cmp rsi, r11
cmovb rcx, rsi
test rcx, rcx
je 0x1400850b5
sub rdx, rax
nop dword [rax + rax]
movzx r8d, word [rdx + rax]
cmp r8w, word [rax]
jne 0x1400850bf
add rax, 2
sub rcx, 1
jne 0x1400850a0
cmp r11, rsi
jae 0x1400850c8
mov eax, r13d
jmp 0x1400850ce
mov eax, r12d
cmovb eax, r13d
jmp 0x1400850ce
mov eax, r15d
seta al
shr eax, 0x1f
test al, al
je 0x1400850db
mov r10, qword [r10 + 0x10]
jmp 0x1400850e1
mov rbx, r10
mov r10, qword [r10]
cmp byte [r10 + 0x19], 0
je 0x140085060
cmp byte [rbx + 0x19], 0
jne 0x1400851b6
lea rax, [rbx + 0x20]
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140085108
mov rax, qword [rax]
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova r9, qword [rbp + 0xb0]
mov rcx, rsi
cmp r10, rsi
cmovb rcx, r10
test rcx, rcx
je 0x140085145
sub r9, rax
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x14008514f
add rax, 2
sub rcx, 1
jne 0x140085131
cmp rsi, r10
jae 0x140085158
mov eax, r13d
jmp 0x14008515e
mov eax, r12d
cmovb eax, r13d
jmp 0x14008515e
mov eax, r15d
seta al
shr eax, 0x1f
test al, al
jne 0x1400851b6
cmp rbx, r14
je 0x1400851b6
mov rbx, qword [rsp + 0x70]
cmp rbx, qword [rsp + 0x58]
je 0x140085193
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call fcn.14007c7e0
add rbx, 0x20
mov qword [rsp + 0x70], rbx
jmp 0x1400855b4
lea r8, [rbp + 0xb0]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140088380
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
jmp 0x1400855b4
mov r14, r15
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rdx, qword [rbp + 0x50]
mov qword [rbp + 8], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400851f5
mov eax, r15d
mov r14, qword [rbp + 8]
test eax, eax
jne 0x1400855a5
mov dword [rbp - 0x70], 0x208
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008526b
mov eax, dword [rbp - 0x28]
dec eax
cmp eax, 1
jbe 0x140085240
mov eax, ntohs
jmp 0x14008526b
mov eax, dword [rbp - 0x70]
test eax, eax
je 0x140085260
test al, 1
jne 0x140085259
shr rax, 1
cmp word [rbp + rax*2 + 0x18e], 0
je 0x140085268
mov eax, ntohs
jmp 0x14008526b
mov word [rbp + 0x190], r15w
mov eax, r15d
test eax, eax
jne 0x1400855a5
lea rbx, [rbp + 0x190]
mov esi, 0x104
nop
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rbx], ax
lea rbx, [rbx + 2]
sub rsi, 1
jne 0x140085280
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
lea rax, [rbp + 0x190]
mov r8, r13
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400852c0
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x90]
call fcn.14007c2c0
lea r10, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
seta sil
cmova r10, qword [rbp + 0x90]
mov rbx, qword [rbp + 0xa0]
cmp rbx, 6
jb 0x140085584
lea r11, [rbx - 5]
lea r11, [r10 + r11*2]
mov rcx, r10
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, r15
je 0x14008534a
cmp word [rcx], 0x72
je 0x140085347
cmp rax, 1
je 0x14008534a
dec rax
add rcx, 2
cmp word [rcx], 0x72
jne 0x140085334
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140085584
mov r8d, 6
lea rax, str.res:__
mov rdx, rax
mov r9, rcx
sub r9, rax
nop dword [rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140085427
add rdx, 2
sub r8, 1
jne 0x140085370
sub rcx, r10
sar rcx, 1
jne 0x140085584
mov eax, 6
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp + 0x90]
test sil, sil
cmovne rcx, qword [rbp + 0x90]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0xa0], rbx
lea r8, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
seta r10b
mov r9, qword [rbp + 0x90]
cmova r8, r9
test rbx, rbx
je 0x140085430
lea rcx, [rbx - 1]
mov rax, r13
cmp rcx, 0xffffffffffffffff
cmovb rax, rcx
lea rdx, [r8 + rax*2]
cmp word [rdx], 0x2f
je 0x14008541f
nop dword [rax]
cmp rdx, r8
je 0x140085430
sub rdx, 2
cmp word [rdx], 0x2f
jne 0x140085410
sub rdx, r8
sar rdx, 1
jmp 0x140085433
add rcx, 2
jmp 0x140085320
mov rdx, r13
mov r8, rbx
sub r8, rdx
cmp rbx, rdx
jb 0x140085ec9
lea rax, [rbp + 0x90]
test r10b, r10b
cmovne rax, r9
lea rcx, [rax + rdx*2]
movzx eax, word [rcx + r8*2]
mov word [rcx], ax
mov qword [rbp + 0xa0], rdx
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova rcx, qword [rbp + 0x90]
mov r8d, 0x104
lea rdx, [rbp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1400854fe
lea rbx, [rbp + 0x5b0]
mov esi, 0x104
nop dword [rax]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rbx], ax
lea rbx, [rbx + 2]
sub rsi, 1
jne 0x1400854a0
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 7
cmova rdx, qword [rbp + 0xd0]
lea rcx, [rbp + 0x5b0]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
jne 0x140085540
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 7
cmova rdx, qword [rbp + 0xf0]
lea rcx, [rbp + 0x5b0]
jmp 0x140085536
cmp qword [rbp + 0xa0], 0
jbe 0x140085584
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 7
cmova rdx, qword [rbp + 0xf0]
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova rcx, qword [rbp + 0x90]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x140085584
mov rbx, qword [rsp + 0x70]
cmp rbx, qword [rsp + 0x58]
je 0x140085566
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call fcn.14007c7e0
add rbx, 0x20
mov qword [rsp + 0x70], rbx
jmp 0x140085584
lea r8, [rbp + 0xb0]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140088380
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov r8, qword [rbp + 0xa8]
cmp r8, 7
jbe 0x1400855a5
mov rdx, qword [rbp + 0x90]
lea rcx, [rbp + 0x90]
call fcn.1400894f0
nop
test r14, r14
je 0x1400855b4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov dword [rbp - 0x6c], 0x104
mov ebx, dword [rsp + 0x50]
inc ebx
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x140085602
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400855fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140085666
call fcn.1402b46a0
nop
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r15w
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x140084dc0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140085654
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008566d
call fcn.1402b46a0
nop
jmp 0x140084dc0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r12, qword [rsp + 0x68]
mov rbx, r12
mov r13, qword [rsp + 0x70]
cmp r12, r13
je 0x1400857f0
mov r15d, dword [rbp - 8]
or r15d, 0x2001f
xor edi, edi
nop word [rax + rax]
mov r14, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400856ad
mov r14, qword [rbx]
mov rsi, rdi
mov qword [rbp - 0x40], rdi
mov dword [rbp - 0x38], edi
mov qword [rbp - 0x30], rdi
mov qword [rbp + 0x10], rdi
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x1400856f6
mov ecx, edi
mov rsi, qword [rbp + 0x10]
mov qword [rbp - 0x40], rsi
mov eax, r15d
and eax, 0x300
mov dword [rbp - 0x38], eax
test ecx, ecx
je 0x140085711
test rsi, rsi
je 0x1400857df
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400857df
mov dword [rsp + 0x50], 0x100
lea rax, [rbp + 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x7c0]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400857a7
nop dword [rax]
lea rdx, [rbp + 0x7c0]
lea rcx, [rbp - 0x40]
call fcn.140080b80
test eax, eax
jne 0x1400857ce
mov dword [rsp + 0x50], 0x100
lea rax, [rbp + 0x18]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x7c0]
xor edx, edx
mov rsi, qword [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140085750
xor edi, edi
test rsi, rsi
je 0x1400857bc
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rdi
mov qword [rbp - 0x40], rdi
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.14007fa10
nop
jmp 0x1400856fa
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400857dd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
add rbx, 0x20
cmp rbx, r13
jne 0x1400856a0
mov rdi, qword [rbp - 0x60]
mov r15, qword [rbp - 0x80]
mov qword [rbp - 0x48], r15
mov rbx, qword [r15]
cmp rbx, r15
je 0x140085bcc
mov r13d, gethostbyname
xor r12d, r12d
nop dword [rax]
mov rsi, qword [rbx + 0x40]
mov qword [rbp - 0x50], rsi
mov r14, r12
mov qword [rsp + 0x60], r12
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 7
jbe 0x14008582e
mov rdx, qword [rdx]
mov qword [rbp - 0x58], r12
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140085876
mov eax, r12d
mov r14, qword [rbp - 0x58]
mov qword [rsp + 0x60], r14
test eax, eax
jne 0x140085b89
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], r12
lea r8d, [rax + 6]
lea rdx, str.res:__
lea rcx, [rbp + 0x70]
call fcn.14007c2c0
lea r9, [rbp + 0x170]
cmp qword [rbp + 0x188], 7
cmova r9, qword [rbp + 0x170]
mov r14, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
sub rax, r14
mov r15, qword [rbp + 0x180]
cmp r15, rax
ja 0x140085915
lea rax, [r15 + r14]
mov qword [rbp + 0x80], rax
lea rsi, [rbp + 0x70]
cmp rcx, 7
cmova rsi, qword [rbp + 0x70]
lea rcx, [rsi + r14*2]
lea r8, [r15 + r15]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + r15]
mov word [rsi + rax*2], r12w
mov rsi, qword [rbp - 0x50]
jmp 0x140085929
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp + 0x70]
call fcn.14007d330
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x88]
cmp rcx, rdx
jae 0x14008595d
lea rax, [rcx + 1]
mov qword [rbp + 0x80], rax
lea rax, [rbp + 0x70]
cmp rdx, 7
cmova rax, qword [rbp + 0x70]
mov dword [rax + rcx*2], gethostbyname
jmp 0x140085970
mov r9d, r13d
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x70]
call fcn.140088600
mov rdx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x168], r12
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140085992
lea rcx, [rbp + 0x150]
call fcn.14007c2c0
lea r9, [rbp + 0x150]
mov r14, qword [rbp + 0x150]
mov r12, qword [rbp + 0x168]
cmp r12, 7
cmova r9, r14
mov r13, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
sub rax, r13
mov r15, qword [rbp + 0x160]
cmp r15, rax
ja 0x140085a1e
lea rax, [r15 + r13]
mov qword [rbp + 0x80], rax
lea rsi, [rbp + 0x70]
cmp rcx, 7
cmova rsi, qword [rbp + 0x70]
lea rcx, [rsi + r13*2]
lea r8, [r15 + r15]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r15 + r13]
xor ecx, ecx
mov word [rsi + rax*2], cx
mov rsi, qword [rbp - 0x50]
jmp 0x140085a40
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp + 0x70]
call fcn.14007d330
mov r12, qword [rbp + 0x168]
mov r14, qword [rbp + 0x150]
cmp r12, 7
jbe 0x140085a7c
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140085a73
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140085bea
mov rcx, r14
call fcn.1402b46a0
nop
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x140085ad6
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140085aa0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov r14, qword [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140085adb
mov r14, qword [rsp + 0x60]
mov eax, dword [rsi + 8]
mov dword [rbp - 0x20], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Contexts
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140085b50
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140085b4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140085bf1
call fcn.1402b46a0
nop
mov r13d, gethostbyname
xor r12d, r12d
mov r15, qword [rbp - 0x48]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140085b92
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140085b84
cmp rbx, qword [rax + 0x10]
jne 0x140085b84
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140085b71
mov rbx, rax
jmp 0x140085baf
mov dword [rbp - 0x68], 1
jmp 0x140085b5d
mov rbx, rax
mov rdx, qword [rax]
cmp byte [rdx + 0x19], 0
jne 0x140085baf
nop
mov rbx, rdx
mov rax, qword [rdx]
mov rdx, rax
cmp byte [rax + 0x19], 0
je 0x140085ba0
test r14, r14
je 0x140085bbe
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rbx, r15
jne 0x140085810
mov r12, qword [rsp + 0x68]
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140085bdf
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov r14, qword [rsp + 0x58]
mov r15d, dword [rbp - 0x68]
jmp 0x140085c00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r15d, r12d
mov r12, qword [rsp + 0x68]
mov rsi, qword [rbp - 0x80]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x140085c74
nop dword [rax]
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rbx + 0x40]
call fcn.1402b46a0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140085c4a
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140085c45
cmp rbx, qword [rax + 0x10]
jne 0x140085c45
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140085c32
mov rbx, rax
jmp 0x140085c6f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140085c6f
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140085c60
cmp rbx, rsi
jne 0x140085c10
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140085c84
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test r12, r12
je 0x140085ce3
mov rbx, r12
mov rsi, qword [rsp + 0x70]
cmp r12, rsi
je 0x140085ca7
mov rcx, rbx
call fcn.14007c930
add rbx, 0x20
cmp rbx, rsi
jne 0x140085c96
sub r14, r12
and r14, 0xffffffffffffffe0
mov rax, r12
cmp r14, 0x1000
jb 0x140085cd7
add r14, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140085cd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, r12
call fcn.1402b46a0
nop
mov rax, qword [rbp - 0x80]
mov rsi, qword [rax + 8]
cmp byte [rsi + 0x19], 0
jne 0x140085d26
mov r8, qword [rsi + 0x10]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.140088580
mov rbx, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x20]
call fcn.14007c930
nop
mov edx, 0x48
mov rcx, rbx
call fcn.1402b46a0
nop
cmp byte [rsi + 0x19], 0
je 0x140085cf1
mov edx, 0x48
mov rcx, qword [rbp - 0x80]
call fcn.1402b46a0
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 7
jbe 0x140085d7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140085d79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140085d79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b46a0
nop
xor r14d, r14d
mov qword [rbp + 0x100], r14
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], r14w
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x140085de6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140085de0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140085de0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b46a0
nop
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r14w
mov rdx, qword [rbp + 0x188]
cmp rdx, 7
jbe 0x140085e4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140085e44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140085e44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b46a0
nop
mov r13, 0xffffffffffffffff
test rdi, rdi
je 0x140085e96
lock xadd dword [rdi + 0x10], r13d
cmp r13d, 1
jne 0x140085e96
mov rbx, qword [rbp - 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140085e77
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140085e89
call fcn.1402b46a0
mov qword [rbx + 8], r14
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1402b46a0
mov eax, r15d
mov rcx, qword [rbp + 0x9c0]
xor rcx, rsp
call fcn.1402b48e0
lea r11, [rsp + 0xad0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14007e040
int3
call fcn.14007e040
int3
call fcn.14007d300
int3