Function at 0x140043620
Capabilities:
Check os version
Encode data using xor
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x568]
sub rsp, 0x640
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
mov byte [rsp + 0x54], dl
mov rbx, rcx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x38], rcx
xor r13d, r13d
mov dword [rsp + 0x74], r13d
mov eax, dword [0x1401b6078]
test al, 1
jne 0x1400436ca
or eax, 1
mov dword [0x1401b6078], eax
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401b6080], rax
lea rcx, [0x140112ee0]
call fcn.1400c82f0
nop
mov eax, dword [0x1401b6078]
test al, 2
jne 0x140043706
or eax, 2
mov dword [0x1401b6078], eax
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401b6070], rax
lea rcx, [0x140112ea0]
call fcn.1400c82f0
nop
mov eax, dword [0x1401b6078]
test al, 4
jne 0x140043742
or eax, 4
mov dword [0x1401b6078], eax
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401b6068], rax
lea rcx, [0x140112e60]
call fcn.1400c82f0
nop
mov eax, dword [0x1401b6078]
test al, 8
jne 0x140043778
or eax, 8
mov dword [0x1401b6078], eax
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401b6088], rax
lea rcx, [0x140112e20]
call fcn.1400c82f0
nop
mov rax, qword [0x1401b6070]
mov ecx, dword [rax - 0x10]
mov r14d, 1
mov rax, qword [0x1401b6088]
mov rdx, qword [0x1401b5898]
test ecx, ecx
je 0x1400437ec
mov ecx, r13d
test rdx, rdx
setne cl
test ecx, ecx
jne 0x1400437b2
mov ecx, 0x80004005
call fcn.140001920
int3
mov rcx, rax
mov r9, rdx
sub r9, rax
nop dword [rax + rax]
movzx r8d, word [rcx]
cmp r8w, word [rcx + r9]
jne 0x1400437da
add rcx, 2
test r8w, r8w
jne 0x1400437c0
mov ecx, r13d
jmp 0x1400437df
sbb ecx, ecx
or ecx, r14d
test ecx, ecx
setne cl
test cl, cl
je 0x140044d81
lea rcx, [rdx - 0x18]
lea rbx, [rax - 0x18]
cmp rcx, rbx
je 0x140043840
cmp dword [rbx + 0x10], 0
jl 0x140043830
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140043830
call fcn.140002520
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140043823
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401b6088], rax
jmp 0x140043840
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401b6088]
call fcn.1400023d0
mov rax, qword [0x1401b6080]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400438a0
cmp dword [rdx + 0x10], 0
jge 0x14004387c
cmp dword [rax - 0xc], 0
jge 0x14004386b
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], r13d
mov rax, qword [0x1401b6080]
mov word [rax], r13w
jmp 0x1400438a0
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004388c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401b6080], rax
mov rax, qword [0x1401b6070]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140043907
cmp dword [rdx + 0x10], 0
jge 0x1400438e3
cmp dword [rax - 0xc], 0
jge 0x1400438cb
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401b6070]
mov dword [rax - 0x10], r13d
mov rax, qword [0x1401b6070]
mov word [rax], r13w
jmp 0x140043907
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400438f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401b6070], rax
mov rax, qword [0x1401b6068]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140043967
cmp dword [rdx + 0x10], 0
jge 0x140043943
cmp dword [rax - 0xc], 0
jge 0x140043932
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], r13d
mov rax, qword [0x1401b6068]
mov word [rax], r13w
jmp 0x140043967
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140043953
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401b6068], rax
mov r15d, r13d
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Volatile_Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140043d47
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140043ce6
mov dword [rsp + 0x50], 0x104
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140043a35
mov edx, 0x82
lea rcx, [rsp + 0x68]
call fcn.1400024c0
mov rbx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140043a8e
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400c8708
test eax, eax
js 0x140043a83
cmp eax, dword [rbx - 0xc]
jg 0x140043a83
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
jmp 0x140043ade
mov ecx, 0x80070057
call fcn.140001920
int3
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140043ade
cmp dword [rdx + 0x10], 0
jge 0x140043abc
cmp dword [rbx - 0xc], 0
jge 0x140043ab2
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x140043ade
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140043acc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x50], 0x104
mov rax, qword [0x1401b6080]
mov edx, r14d
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x82
or ecx, edx
jge 0x140043b18
mov edx, 0x82
lea rcx, [0x1401b6080]
call fcn.1400024c0
mov rax, qword [0x1401b6080]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.Local_AppData
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140043b87
mov rcx, qword [0x1401b6080]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400c8708
mov rcx, rax
test eax, eax
js 0x140043b7c
mov rax, qword [0x1401b6080]
cmp ecx, dword [rax - 0xc]
jg 0x140043b7c
mov dword [rax - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [0x1401b6080]
mov word [rax + rcx*2], r13w
jmp 0x140043bec
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401b6080]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140043bec
cmp dword [rdx + 0x10], 0
jge 0x140043bc3
cmp dword [rax - 0xc], 0
jge 0x140043bb2
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], r13d
mov rax, qword [0x1401b6080]
mov word [rax], r13w
jmp 0x140043bec
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140043bd3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401b6080], rax
mov rbx, qword [rsp + 0x68]
mov dword [rsp + 0x50], 0x104
mov rax, qword [rsp + 0x58]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140043c1a
mov edx, 0x82
lea rcx, [rsp + 0x58]
call fcn.1400024c0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140043c78
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400c8708
test eax, eax
js 0x140043c6d
cmp eax, dword [rdi - 0xc]
jg 0x140043c6d
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r13w
jmp 0x140043cd9
mov ecx, 0x80070057
call fcn.140001920
int3
mov rdx, qword [0x1401b6080]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x58]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140043cd9
cmp dword [rdi + 0x10], 0
jl 0x140043ccb
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140043ccb
call fcn.140002520
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140043cbb
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x68]
jmp 0x140043cd9
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400023d0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140043d47
mov rdx, qword [0x1401b6080]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x58]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140043d47
cmp dword [rdi + 0x10], 0
jl 0x140043d39
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140043d39
call fcn.140002520
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140043d29
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x68]
jmp 0x140043d47
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400023d0
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr ax, 8
movzx edx, al
cmp ecx, 6
ja 0x140043d6b
jne 0x1400441f4
cmp edx, 1
jbe 0x1400441f4
mov r12b, 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140044113
mov dword [rsp + 0x50], 0x104
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140043dcb
mov edx, 0x82
lea rcx, [rsp + 0x68]
call fcn.1400024c0
mov rbx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140043fbc
mov r8d, dword [0x1401b4d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xe
jne 0x140043e68
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xd
jne 0x140043e60
test r8d, r8d
cmove r8d, r14d
mov dword [0x1401b4d80], r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400c8708
test eax, eax
js 0x140043fb1
cmp eax, dword [rbx - 0xc]
jg 0x140043fb1
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
mov r8d, dword [0x1401b4d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
movsd xmm7, qword [0x140144ec8]
xorps xmm6, xmm6
movsd xmm8, qword [0x140144ef0]
movsd xmm9, qword [0x140144ec0]
cmp ecx, 0x13
jne 0x140043f1f
movaps xmm3, xmm7
movaps xmm2, xmm6
movd xmm4, r8d
cvtdq2pd xmm4, xmm4
nop
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x140043f0a
subsd xmm2, xmm3
divsd xmm3, xmm8
movaps xmm1, xmm2
mulsd xmm1, xmm2
movaps xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm9
ja 0x140043ef0
xor r12b, r12b
cmp dword [rbx - 0x10], 0
jl 0x140043f4f
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400c88d8
mov r8d, dword [0x1401b4d80]
test rax, rax
je 0x140043f4f
sub rax, rbx
sar rax, 1
test eax, eax
cmove r15d, r14d
mov ecx, r8d
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x140043fbc
movd xmm2, r8d
cvtdq2pd xmm2, xmm2
nop dword [rax]
addsd xmm6, xmm7
movaps xmm0, xmm6
mulsd xmm0, xmm6
comisd xmm0, xmm2
jbe 0x140043f9a
subsd xmm6, xmm7
divsd xmm7, xmm8
movaps xmm1, xmm6
mulsd xmm1, xmm6
movaps xmm0, xmm2
subsd xmm0, xmm1
comisd xmm0, xmm9
ja 0x140043f80
jmp 0x140043fbc
mov ecx, 0x80070057
call fcn.140001920
int3
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, dword [0x1401b4d80]
lea ecx, [r9 + 2]
lea eax, [r9 + 1]
imul ecx, eax
imul ecx, r9d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 8
jne 0x14004403e
mov ecx, 0x28
call fcn.1400c7228
mov r14, rax
mov rdi, r13
call fcn.1400c84d4
add eax, dword [0x1401b4d80]
mov dword [r14 + rdi*4], eax
inc rdi
cmp rdi, 0xa
jl 0x140044007
mov eax, dword [r14 + 0x24]
mov dword [0x1401b4d80], eax
mov rcx, r14
call fcn.1400c8c8c
mov r9d, dword [0x1401b4d80]
mov r14d, 1
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 6
jne 0x14004410a
mov edx, r13d
nop word [rax + rax]
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r9d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
add r9d, eax
inc edx
cmp edx, 0x100
jl 0x140044070
mov dword [0x1401b4d80], r9d
test r12b, r12b
je 0x1400441fe
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400441f4
mov dword [rsp + 0x50], 0x104
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140044170
mov edx, 0x82
lea rcx, [rsp + 0x68]
call fcn.1400024c0
mov rbx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.DefaultValue
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400c8708
test eax, eax
js 0x1400441e9
cmp eax, dword [rbx - 0xc]
jg 0x1400441e9
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx - 0x10], 0
jl 0x1400441f7
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400c88d8
test rax, rax
je 0x1400441f7
sub rax, rbx
sar rax, 1
test eax, eax
je 0x1400441f4
jmp 0x1400441f7
mov ecx, 0x80070057
call fcn.140001920
int3
mov r15d, r14d
mov r9d, dword [0x1401b4d80]
lea rdi, str.Software_
lea r12, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
cmp qword [0x1401afd58], 0xffffffff80000002
jne 0x1400442dc
mov rdx, qword [0x1401b5898]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401b6070]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004427e
cmp dword [rbx + 0x10], 0
jl 0x14004426e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004426e
call fcn.140002520
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140044261
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [0x1401b6070], rax
jmp 0x14004427e
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401b6070]
call fcn.1400023d0
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov rbx, qword [0x1401b6080]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140044794
cmp dword [rbx + 0x10], 0
jl 0x1400443d6
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400443d6
call fcn.140002520
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x1400442cc
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [0x1401b6080], rax
jmp 0x140044794
test r15d, r15d
je 0x1400443f3
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x14004421d
cmp byte [0x1401b4ea4], 0
jne 0x14004421d
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x70], rbx
test rdi, 0xffffffffffff0000
jne 0x140044342
movzx edi, di
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140044358
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400026c0
jmp 0x140044354
mov r8d, 9
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.1400023d0
mov rbx, qword [rbp - 0x70]
lea r14, [rbx - 0x18]
mov rdi, qword [0x1401b6070]
add rdi, 0xffffffffffffffe8
cmp r14, rdi
je 0x1400443b9
cmp dword [rdi + 0x10], 0
jl 0x1400443a5
mov rax, qword [rdi]
cmp qword [r14], rax
jne 0x1400443a5
mov rcx, r14
call fcn.140002520
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140044398
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [0x1401b6070], rax
jmp 0x1400443b9
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401b6070]
call fcn.1400023d0
nop
lock add dword [r14 + 0x10], 0xffffffff
jg 0x14004427e
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004427e
mov rdi, qword [rsp + 0x58]
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [0x1401b6080]
call fcn.1400023d0
jmp 0x140044794
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 7
jne 0x140044547
mov rbx, r13
mov edi, 0xa3
nop dword [rax]
call fcn.1400c84d4
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rbp + rbx*8 - 0x30], xmm0
inc rbx
cmp rbx, rdi
jb 0x140044430
mov r9, r13
mov r10d, reloc.OLEAUT32.dll_RegisterTypeLib
nop word [rax + rax]
mov edx, reloc.OLEAUT32.dll_RegisterTypeLib
cmp r9, rdx
jge 0x140044538
cmp r10, 4
jl 0x14004450d
lea rcx, [rbp + 0x4d0]
mov r8d, RegisterTypeLib
sub r8, r9
shr r8, 2
inc r8
lea rax, [r8*4]
sub rdx, rax
nop word [rax + rax]
movsd xmm0, qword [rcx + 0x10]
movsd xmm1, qword [rcx + 8]
comisd xmm0, xmm1
jbe 0x1400444ba
movsd qword [rcx + 0x10], xmm1
movsd qword [rcx + 8], xmm0
movsd xmm0, qword [rcx + 8]
movsd xmm1, qword [rcx]
comisd xmm0, xmm1
jbe 0x1400444d2
movsd qword [rcx + 8], xmm1
movsd qword [rcx], xmm0
movsd xmm0, qword [rcx]
movsd xmm1, qword [rcx - 8]
comisd xmm0, xmm1
jbe 0x1400444ea
movsd qword [rcx], xmm1
movsd qword [rcx - 8], xmm0
movsd xmm0, qword [rcx - 8]
movsd xmm1, qword [rcx - 0x10]
comisd xmm0, xmm1
jbe 0x140044504
movsd qword [rcx - 8], xmm1
movsd qword [rcx - 0x10], xmm0
sub rcx, 0x20
dec r8
jne 0x1400444a0
cmp rdx, r9
jle 0x140044538
movsd xmm0, qword [rbp + rdx*8 - 0x30]
movsd xmm1, qword [rbp + rdx*8 - 0x38]
comisd xmm0, xmm1
jbe 0x140044530
movsd qword [rbp + rdx*8 - 0x30], xmm1
movsd qword [rbp + rdx*8 - 0x38], xmm0
dec rdx
cmp rdx, r9
jg 0x140044512
inc r9
dec r10
dec rdi
jne 0x140044460
call fcn.1400431e0
test al, al
jne 0x140044569
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x1401b6080]
call fcn.140010100
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x78], rbx
test r12, 0xffffffffffff0000
jne 0x1400445b4
movzx edi, r12w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140044626
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.1400026c0
mov rbx, qword [rbp - 0x78]
jmp 0x140044626
mov r14d, dword [rbx - 0x10]
mov rdi, r12
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7a
or eax, ecx
jge 0x1400445e5
mov edx, 0x7a
lea rcx, [rbp - 0x78]
call fcn.1400024c0
mov rbx, qword [rbp - 0x78]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xf4
mov rcx, rbx
add rdx, rdx
cmp rdi, r14
ja 0x140044605
lea r8, [rbx + rdi*2]
call fcn.1400c8404
jmp 0x14004460d
mov r8, r12
call fcn.1400c8500
cmp dword [rbx - 0xc], 0x7a
jl 0x140044dba
mov dword [rbx - 0x10], 0x7a
mov word [rbx + 0xf4], r13w
lea r15, [rbx - 0x18]
mov rcx, qword [0x1401b6070]
lea rdi, [rcx - 0x18]
cmp r15, rdi
je 0x140044780
cmp dword [rdi + 0x10], 0
jl 0x140044674
mov rax, qword [rdi]
cmp qword [r15], rax
jne 0x140044674
mov rcx, r15
call fcn.140002520
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004466b
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
jmp 0x140044779
movsxd r14, dword [rbx - 0x10]
test r14d, r14d
jne 0x1400446da
mov rbx, qword [rdi]
cmp dword [rdi + 8], r14d
je 0x140044780
cmp dword [rdi + 0x10], r14d
jge 0x1400446b5
cmp dword [rcx - 0xc], r14d
jge 0x1400446a1
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rcx - 0x10], r13d
mov rax, qword [0x1401b6070]
mov word [rax], r13w
jmp 0x140044780
lock add dword [rdi + 0x10], 0xffffffff
jg 0x1400446c8
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
jmp 0x140044779
mov r13d, dword [rcx - 0x10]
mov r12, rbx
sub r12, rcx
sar r12, 1
test r14d, r14d
jns 0x1400446f7
mov ecx, 0x80070057
call fcn.140001920
int3
mov edx, 1
sub edx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, r14d
or eax, edx
jge 0x14004471f
mov edx, r14d
lea rcx, [0x1401b6070]
call fcn.1400024c0
mov rcx, qword [0x1401b6070]
lea rdi, [r14 + r14]
movsxd rdx, dword [rcx - 0xc]
mov r9, rdi
add rdx, rdx
cmp r12, r13
ja 0x14004473d
lea r8, [rcx + r12*2]
call fcn.1400c8404
jmp 0x140044745
mov r8, rbx
call fcn.1400c8500
mov rax, qword [0x1401b6070]
cmp r14d, dword [rax - 0xc]
jg 0x14004476e
mov dword [rax - 0x10], r14d
mov rax, qword [0x1401b6070]
xor r13d, r13d
mov word [rdi + rax], r13w
lea r12, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
jmp 0x140044780
mov ecx, 0x80070057
call fcn.140001920
int3
mov qword [0x1401b6070], rax
lock add dword [r15 + 0x10], 0xffffffff
jg 0x140044794
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x1401b6070]
cmp dword [rcx - 0x10], 0
jl 0x140044927
lea rdx, str.windows_ie_ac_001
call fcn.1400c88d8
test rax, rax
je 0x140044927
sub rax, qword [0x1401b6070]
sar rax, 1
test eax, eax
jle 0x140044927
mov r15, qword [0x1401b5898]
lea rdx, [r15 - 0x18]
mov rcx, qword [0x1401b6068]
lea rbx, [rcx - 0x18]
cmp rdx, rbx
je 0x140044bdc
cmp dword [rbx + 0x10], 0
jl 0x140044828
mov rax, qword [rbx]
cmp qword [rdx], rax
jne 0x140044828
mov rcx, rdx
call fcn.140002520
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140044818
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401b6068], rax
jmp 0x140044bdc
movsxd rdi, dword [r15 - 0x10]
test edi, edi
jne 0x140044894
mov rdi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x140044bdc
cmp dword [rbx + 0x10], 0
jge 0x140044868
cmp dword [rcx - 0xc], 0
jge 0x140044854
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rcx - 0x10], r13d
mov rax, qword [0x1401b6068]
mov word [rax], r13w
jmp 0x140044bdc
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004487b
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401b6068], rax
jmp 0x140044bdc
mov r12d, dword [rcx - 0x10]
mov r14, r15
sub r14, rcx
sar r14, 1
test edi, edi
jns 0x1400448b0
mov ecx, 0x80070057
call fcn.140001920
int3
mov edx, 1
sub edx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, edi
or eax, edx
jge 0x1400448d6
mov edx, edi
lea rcx, [0x1401b6068]
call fcn.1400024c0
mov rcx, qword [0x1401b6068]
lea rbx, [rdi + rdi]
movsxd rdx, dword [rcx - 0xc]
mov r9, rbx
add rdx, rdx
cmp r14, r12
ja 0x1400448f4
lea r8, [rcx + r14*2]
call fcn.1400c8404
jmp 0x1400448fc
mov r8, r15
call fcn.1400c8500
mov rax, qword [0x1401b6068]
cmp edi, dword [rax - 0xc]
jg 0x14004491c
mov dword [rax - 0x10], edi
mov rax, qword [0x1401b6068]
mov word [rbx + rax], r13w
jmp 0x140044bdc
mov ecx, 0x80070057
call fcn.140001920
int3
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x140044a1c
cmp byte [0x1401b4ea4], 0
jne 0x140044a1c
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
lea rdx, str.Software_
test rdx, 0xffffffffffff0000
jne 0x14004498d
movzx edi, dx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x1400449a2
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400026c0
jmp 0x14004499d
mov r8d, 9
lea rcx, [rsp + 0x78]
call fcn.1400023d0
mov rbx, qword [rsp + 0x78]
lea rdi, [rbx - 0x18]
mov r14, qword [0x1401b6068]
add r14, 0xffffffffffffffe8
cmp rdi, r14
je 0x140044a06
cmp dword [r14 + 0x10], 0
jl 0x1400449f2
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x1400449f2
mov rcx, rdi
call fcn.140002520
mov rbx, rax
lock add dword [r14 + 0x10], 0xffffffff
jg 0x1400449e5
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401b6068], rax
jmp 0x140044a06
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401b6068]
call fcn.1400023d0
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140044bdc
mov rcx, qword [rdi]
mov rdx, rdi
jmp 0x140044bd6
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x80], rbx
test r12, 0xffffffffffff0000
jne 0x140044a5f
movzx edi, r12w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140044a75
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400026c0
jmp 0x140044a71
mov r8d, 0x7a
mov rdx, r12
lea rcx, [rbp - 0x80]
call fcn.1400023d0
mov rbx, qword [rbp - 0x80]
lea r15, [rbx - 0x18]
mov rcx, qword [0x1401b6068]
lea rdi, [rcx - 0x18]
cmp r15, rdi
je 0x140044bc8
cmp dword [rdi + 0x10], 0
jl 0x140044ac3
mov rax, qword [rdi]
cmp qword [r15], rax
jne 0x140044ac3
mov rcx, r15
call fcn.140002520
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140044aba
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
jmp 0x140044bc1
movsxd r14, dword [rbx - 0x10]
test r14d, r14d
jne 0x140044b29
mov rbx, qword [rdi]
cmp dword [rdi + 8], r14d
je 0x140044bc8
cmp dword [rdi + 0x10], r14d
jge 0x140044b04
cmp dword [rcx - 0xc], r14d
jge 0x140044af0
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rcx - 0x10], r13d
mov rax, qword [0x1401b6068]
mov word [rax], r13w
jmp 0x140044bc8
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140044b17
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
jmp 0x140044bc1
mov r13d, dword [rcx - 0x10]
mov r12, rbx
sub r12, rcx
sar r12, 1
test r14d, r14d
jns 0x140044b46
mov ecx, 0x80070057
call fcn.140001920
int3
mov edx, 1
sub edx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, r14d
or eax, edx
jge 0x140044b6e
mov edx, r14d
lea rcx, [0x1401b6068]
call fcn.1400024c0
mov rcx, qword [0x1401b6068]
lea rdi, [r14 + r14]
movsxd rdx, dword [rcx - 0xc]
mov r9, rdi
add rdx, rdx
cmp r12, r13
ja 0x140044b8c
lea r8, [rcx + r12*2]
call fcn.1400c8404
jmp 0x140044b94
mov r8, rbx
call fcn.1400c8500
mov rax, qword [0x1401b6068]
cmp r14d, dword [rax - 0xc]
jg 0x140044bb6
mov dword [rax - 0x10], r14d
mov rax, qword [0x1401b6068]
xor r13d, r13d
mov word [rdi + rax], r13w
jmp 0x140044bc8
mov ecx, 0x80070057
call fcn.140001920
int3
mov qword [0x1401b6068], rax
lock add dword [r15 + 0x10], 0xffffffff
jg 0x140044bdc
mov rcx, qword [r15]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [0x1401afd58]
cmp rbx, 0xffffffff80000002
je 0x140044c68
cmp byte [0x1401afc22], 0
je 0x140044c68
lea rcx, [rbp - 0x50]
call fcn.140043070
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401b6070]
call fcn.140010100
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044c2b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x48]
call fcn.140043070
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401b6068]
call fcn.140010100
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044c61
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [0x1401afd58]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [0x1401b6070]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140044cc8
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1401b6070]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140044cd2
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [0x1401afd58]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [0x1401b6068]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140044d39
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1401b6068]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140044d44
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044d5e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044d77
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14d, 1
mov rbx, qword [rbp - 0x58]
cmp byte [rsp + 0x54], 0
je 0x140044da1
mov rcx, qword [0x1401b6068]
add rcx, 0xffffffffffffffe8
call fcn.140002520
add rax, 0x18
mov qword [rbx], rax
jmp 0x140044dc5
mov rcx, qword [0x1401b6070]
add rcx, 0xffffffffffffffe8
call fcn.140002520
add rax, 0x18
mov qword [rbx], rax
jmp 0x140044dc5
mov ecx, 0x80070057
call fcn.140001920
nop
mov dword [rsp + 0x74], r14d
mov rax, rbx
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.1400c7be0
lea r11, [rsp + 0x640]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret