Function at 0x14009a0a0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2f8
movaps xmmword [rsp + 0x2e0], xmm7
movaps xmmword [rsp + 0x2d0], xmm6
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x2c8], rax
lea rsi, [rdx + 8]
mov rdx, qword [rdx + 8]
mov rcx, rdi
call fcn.1400fc840
mov qword [rdi], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x40], rdi
movups xmmword [rdi + 8], xmm0
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x1c0], r12
movaps xmm6, xmmword [0x14026f080]
movaps xmmword [rsp + 0x1b0], xmm6
lea rax, [rsp + 0x252]
mov byte [rax + 0x15], 2
lea rcx, [0x1402779f0]
lea rsi, [rsp + 0x250]
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c4fc
mov word [rsp + 0x250], 0x7670
mov byte [rsp + 0x252], 0
mov qword [rsp + 0x1f0], r12
movaps xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], 0
cmp byte [rbx + 0x5f], 0
js 0x14009a184
lea rdx, [rbx + 0x48]
jmp 0x14009a188
mov rdx, qword [rbx + 0x48]
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov qword [rsp + 0x38], rbx
jne 0x14009a224
mov dword [rsp + 0x1d0], 0
mov dword [rsp + 0x230], 0xaaaaaaaa
cmp byte [rsp + 0x267], 0
mov rdx, rsi
jns 0x14009a1df
mov rdx, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x1f0]
lea rdi, [rsp + 0x1d0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x230]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14009b7ee
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rsp + 0x267], 0
jns 0x14009a23b
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
movsx rax, byte [rsp + 0x1c7]
test rax, rax
jns 0x14009a251
mov rax, qword [rsp + 0x1b8]
test rax, rax
je 0x14009c2df
lea rdx, [rbx + 0x60]
mov rcx, rbx
call fcn.14009c550
test al, al
jne 0x14009a27e
lea rdx, [rbx + 0x78]
mov rcx, rbx
call fcn.14009c550
test al, al
je 0x14009afa8
movabs rcx, 0x8000000000000000
movsx rdi, byte [rbx + 0xbf]
mov rsi, rdi
test rdi, rdi
jns 0x14009a29f
mov rsi, qword [rbx + 0xb0]
lea rbx, [rsi + 0xc]
lea rax, [rcx - 9]
mov qword [rsp + 0x1a0], r12
movaps xmmword [rsp + 0x190], xmm6
cmp rbx, rax
ja 0x14009c4ff
cmp rbx, 0xa
mov qword [rsp + 0x80], rax
jbe 0x14009a3cb
lea rax, [rcx - 4]
and rax, rbx
add rax, 4
mov r14, rbx
or r14, 3
cmp r14, 0xb
cmove r14, rax
inc r14
js 0x14009c508
mov r15, rcx
lea rcx, [r14 + r14]
call fcn.14018f5a8
or r14, r15
mov qword [rsp + 0x1a0], r14
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], rbx
mov rbx, qword [rsp + 0x38]
lea rcx, [rbx + 0xa8]
mov rdx, rcx
test dil, dil
jns 0x14009a333
mov rdx, qword [rcx]
mov qword [rsp + 0x70], rcx
lea rdi, [rax + rsi*2]
cmp rdx, rax
setb cl
cmp rdi, rdx
setbe r8b
or r8b, cl
je 0x14009c502
test rsi, rsi
je 0x14009a365
add rsi, rsi
mov rcx, rax
mov r8, rsi
call fcn.1401cd6e0
lea rax, [rdi + 0x18]
lea rcx, [0x1402779fa]
cmp rdi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c505
movups xmm0, xmmword [0x1402779fa]
movups xmmword [rdi], xmm0
movabs rax, 0x7400610064002e
mov qword [rdi + 0x10], rax
mov word [rdi + 0x18], 0
lea rcx, [rsp + 0xd0]
mov r8d, 0xc0
xor edx, edx
call fcn.1401cdd80
cmp byte [rsp + 0x1a7], 0
js 0x14009a3e9
lea r9, [rsp + 0x190]
jmp 0x14009a3f1
xorps xmm0, xmm0
lea rax, [rsp + 0x190]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov byte [rax + 0x17], bl
jmp 0x14009a31c
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a3fd
mov rdx, qword [rbx]
lea r8, str.Name
lea rcx, [rsp + 0x250]
call fcn.14009cc30
cmp byte [rsp + 0xe7], 0
jns 0x14009a428
mov rcx, qword [rsp + 0xd0]
call fcn.14018f5a0
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0xe0], rax
movups xmm0, xmmword [rsp + 0x250]
movaps xmmword [rsp + 0xd0], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a45c
lea r9, [rsp + 0x190]
jmp 0x14009a464
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a470
mov rdx, qword [rbx]
lea rsi, [rsp + 0xe8]
lea r8, [0x140277a1e]
lea rcx, [rsp + 0x250]
call fcn.14009cc30
cmp byte [rsi + 0x17], 0
jns 0x14009a49f
mov rcx, qword [rsp + 0xe8]
call fcn.14018f5a0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a4ca
lea r9, [rsp + 0x190]
jmp 0x14009a4d2
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a4de
mov rdx, qword [rbx]
lea rsi, [rsp + 0x100]
lea r8, [0x140277a2e]
lea rcx, [rsp + 0x250]
call fcn.14009cc30
cmp byte [rsi + 0x17], 0
jns 0x14009a50d
mov rcx, qword [rsp + 0x100]
call fcn.14018f5a0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a538
lea r9, [rsp + 0x190]
jmp 0x14009a540
mov r9, qword [rsp + 0x190]
mov qword [rsp + 0x78], rsi
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a551
mov rdx, qword [rbx]
lea rsi, [rsp + 0x118]
lea r8, str.URL1
lea rcx, [rsp + 0x250]
call fcn.14009cc30
cmp byte [rsi + 0x17], 0
jns 0x14009a580
mov rcx, qword [rsp + 0x118]
call fcn.14018f5a0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a5ab
lea r9, [rsp + 0x190]
jmp 0x14009a5b3
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a5bf
mov rdx, qword [rbx]
lea rsi, [rsp + 0x130]
lea r8, [0x140277a40]
lea rcx, [rsp + 0x250]
call fcn.14009cc30
cmp byte [rsi + 0x17], 0
jns 0x14009a5ee
mov rcx, qword [rsp + 0x130]
call fcn.14018f5a0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a619
lea r9, [rsp + 0x190]
jmp 0x14009a621
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a62d
mov rdx, qword [rbx]
lea rsi, [rsp + 0x148]
lea r8, str.ServerFileName
lea rcx, [rsp + 0x250]
call fcn.14009cc30
cmp byte [rsi + 0x17], 0
jns 0x14009a65c
mov rcx, qword [rsp + 0x148]
call fcn.14018f5a0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a687
lea r9, [rsp + 0x190]
jmp 0x14009a68f
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a69b
mov rdx, qword [rbx]
lea rdi, [rsp + 0x160]
lea r8, str.UpdatedApplications
lea rcx, [rsp + 0x250]
call fcn.14009cc30
cmp byte [rdi + 0x17], 0
jns 0x14009a6ca
mov rcx, qword [rsp + 0x160]
call fcn.14018f5a0
mov rax, qword [rsp + 0x260]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rdi], xmm0
lea rsi, [rsp + 0xb0]
mov qword [rsi + 0x10], r12
movaps xmmword [rsi], xmm6
mov rcx, rsi
mov qword [rsp + 0x68], rdi
mov rdx, rdi
mov r8b, 0x3b
call fcn.14009cdc0
mov rbx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x88], rax
cmp rbx, rax
je 0x14009a71f
xorps xmm7, xmm7
jmp 0x14009b449
movsx rax, byte [rsp + 0xe7]
test rax, rax
mov rdi, qword [rsp + 0x38]
jns 0x14009a73a
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x14009aeb4
movsx rax, byte [rsp + 0xff]
test rax, rax
jns 0x14009a759
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x14009aeb4
movsx rax, byte [rsp + 0x117]
test rax, rax
jns 0x14009a778
mov rax, qword [rsp + 0x108]
test rax, rax
je 0x14009aeb4
movsx rax, byte [rsp + 0x147]
test rax, rax
jns 0x14009a797
mov rax, qword [rsp + 0x138]
test rax, rax
je 0x14009aeb4
movsx rax, byte [rsp + 0x15f]
test rax, rax
jns 0x14009a7b6
mov rax, qword [rsp + 0x150]
test rax, rax
je 0x14009aeb4
movsx rax, byte [rsp + 0x177]
test rax, rax
jns 0x14009a7d5
mov rax, qword [rsp + 0x168]
test rax, rax
je 0x14009aeb4
lea r12, [rsp + 0x1b0]
mov rcx, r12
call fcn.14009d300
mov rcx, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x180]
jmp 0x14009a809
cmp r8, rax
jb 0x14009a821
add rcx, 0x38
cmp rcx, rdx
je 0x14009aa5c
mov r8, qword [rcx + 0x18]
cmp byte [rcx + 0x20], 1
jne 0x14009a800
cmp r8, rax
ja 0x14009a805
mov r8, qword [rcx + 0x28]
cmp byte [rcx + 0x30], 1
je 0x14009a832
cmp r8, rax
jbe 0x14009a805
jmp 0x14009a837
cmp r8, rax
jb 0x14009a805
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
call fcn.1400a2030
mov rsi, rax
mov dword [rdi + 0xc0], 0
mov rax, qword [rdi + 0xe0]
mov rcx, qword [rdi + 0xe8]
mov rdx, rcx
sub rdx, rax
dec rcx
cmp rdx, rcx
ja 0x14009c517
mov qword [rdi + 0xe8], rax
cmp byte [rsp + 0x117], 0
jns 0x14009a89e
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x78], rax
mov rcx, rsi
mov edx, 0x2712
mov r8, qword [rsp + 0x78]
call fcn.1400a1fe0
mov rcx, rsi
mov edx, 0x40
xor r8d, r8d
call fcn.1400a1fe0
mov rcx, rsi
mov edx, 0x51
xor r8d, r8d
call fcn.1400a1fe0
lea r8, [0x14009d4a0]
mov rcx, rsi
mov edx, 0x4e2b
call fcn.1400a1fe0
mov rcx, rsi
mov edx, 0x2711
mov r8, rdi
call fcn.1400a1fe0
mov rcx, rsi
mov edx, Ordinal_14
mov r8d, 0xb4
call fcn.1400a1fe0
mov rcx, rsi
call fcn.1400a2140
mov qword [rsp + 0x250], rsi
test rsi, rsi
je 0x14009a929
lea rcx, [rsp + 0x250]
call fcn.1400a9910
mov rdx, qword [rdi + 0xe0]
mov r8, qword [rdi + 0xe8]
cmp rdx, r8
je 0x14009c1a3
sub r8d, edx
lea rsi, [rsp + 0x1f0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm6
lea r15, [rsp + 0x250]
movaps xmmword [r15], xmm6
movaps xmmword [r15 + 0x40], xmm6
movaps xmmword [r15 + 0x50], xmm6
movups xmmword [r15 + 0x5c], xmm6
movaps xmmword [r15 + 0x30], xmm6
movaps xmmword [r15 + 0x20], xmm6
movaps xmmword [r15 + 0x10], xmm6
mov byte [r15], 0
mov qword [r15 + 0x44], 0
mov dword [r15 + 0x4c], 0x67452301
movabs rax, 0x98badcfeefcdab89
mov qword [r15 + 0x50], rax
mov dword [r15 + 0x58], 0x10325476
mov rcx, r15
call fcn.140093ab0
mov rcx, r15
call fcn.140093b70
mov rcx, r15
mov rdx, rsi
call fcn.1400946b0
mov bl, byte [rsi + 0x17]
test bl, bl
mov r8, qword [rsi + 8]
movzx eax, bl
mov rdx, rax
cmovs rdx, r8
movsx rcx, byte [rsp + 0x147]
mov r9, rcx
test rcx, rcx
jns 0x14009a9f7
mov r9, qword [rsp + 0x138]
cmp rdx, r9
lea rsi, [rsp + 0x148]
lea rdx, [rsp + 0x130]
jne 0x14009bd94
test cl, cl
jns 0x14009aa1c
mov rdx, qword [rsp + 0x130]
test bl, bl
js 0x14009bd7f
je 0x14009b923
xor ecx, ecx
mov r8b, byte [rsp + rcx + 0x1f0]
cmp r8b, byte [rdx + rcx]
jne 0x14009bd94
inc rcx
cmp rax, rcx
jne 0x14009aa2c
jmp 0x14009b923
mov qword [rax + 0x40], Ordinal_26
mov rax, qword [rax + 0x38]
jmp 0x14009aaf7
lea r14, [rsp + 0x256]
mov byte [r14 + 0x11], 6
lea rax, str.status
lea r8, [rsp + 0x250]
cmp r8, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009c50b
mov word [rsp + 0x254], 0x7375
mov dword [rsp + 0x250], 0x74617473
mov byte [rsp + 0x256], 0
lea rdi, [rsp + 0x1d0]
mov qword [rdi], r8
lea rbx, [rsp + 0x230]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275aab]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182950
mov rax, qword [rsi]
cmp byte [rax + 0x4f], 0
js 0x14009aa4b
mov byte [rax + 0x4f], 0x13
add rax, 0x38
movups xmm0, xmmword [str.no_update_available]
movups xmmword [rax], xmm0
mov dword [rax + 0xf], 0x656c6261
mov byte [rax + 0x13], 0
cmp byte [rsp + 0x267], 0
lea r8, [rsp + 0x250]
jns 0x14009ab33
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
lea r8, [rsp + 0x250]
mov byte [rsp + 0x267], 6
lea rax, str.ver_pv
cmp r8, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009c50e
mov word [rsp + 0x254], 0x7670
mov dword [rsp + 0x250], 0x5f726576
mov byte [rsp + 0x256], 0
mov qword [rsp + 0x1d0], r8
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275aab]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182950
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
cmp rcx, r12
je 0x14009abe0
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x1c7]
js 0x14009c413
test r8b, r8b
js 0x14009ae9a
mov rax, qword [rsp + 0x1c0]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009abf7
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
lea rax, [rsp + 0x25e]
mov byte [rax + 9], reloc.WLDAP32.dll_Ordinal_14
lea rcx, str.verToBeUpdated
lea r8, [rsp + 0x250]
cmp r8, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c511
movabs rax, 0x6465746164705565
mov qword [rsp + 0x256], rax
movabs rax, 0x5565426f54726576
mov qword [rsp + 0x250], rax
mov byte [rsp + 0x25e], 0
mov qword [rsp + 0x1d0], r8
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275aab]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182950
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
lea rdx, [rsp + 0x160]
cmp rcx, rdx
je 0x14009acbe
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x177]
js 0x14009c3f4
test r8b, r8b
js 0x14009ae80
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009acd5
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
mov rsi, qword [rsp + 0xb0]
test rsi, rsi
je 0x14009ad16
mov rdi, qword [rsp + 0xb8]
cmp rdi, rsi
je 0x14009ad0e
add rdi, 0xffffffffffffffe8
test rdi, rdi
je 0x14009c4f9
cmp byte [rdi + 0x17], 0
js 0x14009ad39
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
jne 0x14009acf3
mov rcx, rsi
call fcn.14018f5a0
mov rsi, qword [rsp + 0x178]
test rsi, rsi
je 0x14009ad7d
mov rdi, qword [rsp + 0x180]
mov rcx, rsi
cmp rdi, rsi
je 0x14009ad70
add rdi, 0xffffffffffffffc8
jmp 0x14009ad57
mov rcx, qword [rdi]
call fcn.14018f5a0
jmp 0x14009ad02
mov rcx, qword [rdi]
call fcn.14018f5a0
lea rax, [rdi - 0x38]
cmp rdi, rsi
mov rdi, rax
je 0x14009ad68
test rdi, rdi
je 0x14009c4db
cmp byte [rdi + 0x17], 0
jns 0x14009ad4b
jmp 0x14009ad43
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x180], rsi
call fcn.14018f5a0
cmp byte [rsp + 0x177], 0
jns 0x14009ad94
mov rcx, qword [rsp + 0x160]
call fcn.14018f5a0
cmp byte [rsp + 0x15f], 0
jns 0x14009adab
mov rcx, qword [rsp + 0x148]
call fcn.14018f5a0
cmp byte [rsp + 0x147], 0
jns 0x14009adc2
mov rcx, qword [rsp + 0x130]
call fcn.14018f5a0
cmp byte [rsp + 0x12f], 0
jns 0x14009add9
mov rcx, qword [rsp + 0x118]
call fcn.14018f5a0
cmp byte [rsp + 0x117], 0
jns 0x14009adf0
mov rcx, qword [rsp + 0x100]
call fcn.14018f5a0
cmp byte [rsp + 0xff], 0
jns 0x14009ae07
mov rcx, qword [rsp + 0xe8]
call fcn.14018f5a0
cmp byte [rsp + 0xe7], 0
jns 0x14009ae1e
mov rcx, qword [rsp + 0xd0]
call fcn.14018f5a0
cmp byte [rsp + 0x1a7], 0
jns 0x14009ae35
mov rcx, qword [rsp + 0x190]
call fcn.14018f5a0
cmp byte [rsp + 0x1c7], 0
jns 0x14009ae4c
mov rcx, qword [rsp + 0x1b0]
call fcn.14018f5a0
mov rcx, qword [rsp + 0x2c8]
xor rcx, rsp
call fcn.140191d70
movaps xmm6, xmmword [rsp + 0x2d0]
movaps xmm7, xmmword [rsp + 0x2e0]
add rsp, 0x2f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
call fcn.14011d120
jmp 0x14009acbe
mov rdx, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1b8]
call fcn.14011d120
jmp 0x14009abe0
mov dword [rdi + 0xc0], 0x67
lea rcx, [rsp + 0x250]
mov edx, 0x67
call fcn.1401f31b0
lea rax, [rsp + 0x1f5]
mov byte [rax + 0x12], 5
lea rcx, str.error
lea r8, [rsp + 0x1f0]
cmp r8, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c514
mov dword [rsp + 0x1f0], 0x6f727265
mov word [rsp + 0x1f4], Ordinal_117
lea rax, [rsp + 0x230]
mov qword [rax], r8
lea rcx, [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140275aab]
lea rsi, [rsp + 0x1d0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182950
mov rax, qword [rsi]
lea rsi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009af62
mov rcx, qword [rsi]
call fcn.14018f5a0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
xor eax, eax
mov byte [rsp + 0x267], al
mov byte [rsp + 0x250], al
cmp byte [rsp + 0x207], al
jns 0x14009acd5
mov rcx, qword [rsp + 0x1f0]
call fcn.14018f5a0
jmp 0x14009acbe
mov edx, dword [rbx + 0xc0]
lea rcx, [rsp + 0xd0]
call fcn.1401f31b0
lea rax, [rsp + 0x255]
mov byte [rax + 0x12], 5
lea rcx, str.error
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c529
mov dword [rsp + 0x250], 0x6f727265
mov word [rsp + 0x254], Ordinal_117
lea rax, [rsp + 0x1d0]
mov qword [rax], rsi
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140275aab]
lea rdi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
mov r8, rsi
call fcn.140182950
mov rax, qword [rdi]
lea rsi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009b048
mov rcx, qword [rsi]
call fcn.14018f5a0
mov rax, qword [rsp + 0xe0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rsi], xmm0
xor eax, eax
mov byte [rsp + 0xe7], al
mov byte [rsp + 0xd0], al
cmp byte [rsp + 0x267], al
jns 0x14009ae35
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
cmp byte [rsp + 0xe7], 0
jns 0x14009ae35
mov rcx, qword [rsp + 0xd0]
jmp 0x14009ae30
mov rcx, r15
mov rdx, qword [rsp + 0x48]
mov r8, rbp
call fcn.14011ed20
jmp 0x14009b176
xor esi, esi
jmp 0x14009b13a
mov r12, r14
mov rcx, qword [rsp + 0x178]
sub r15, rcx
sar r15, 3
movabs r8, 0x6db6db6db6db6db7
imul r15, r8
lea r14, [r15 + 1]
movabs rdx, 0x492492492492492
cmp r14, rdx
ja 0x14009c4e7
sub rax, rcx
sar rax, 3
imul rax, r8
lea rcx, [rax + rax]
cmp rcx, r14
cmova r14, rcx
movabs rcx, 0x249249249249249
cmp rax, rcx
cmovae r14, rdx
test r14, r14
mov qword [rsp + 0x48], rsi
je 0x14009b0b9
cmp r14, rdx
ja 0x14009c4f3
imul rcx, r14, 0x38
call fcn.14018f5a8
mov rsi, rax
imul r15, r15, 0x38
add r15, rsi
je 0x14009c4ea
test dil, dil
js 0x14009b0a4
mov rax, qword [rsp + 0x48]
mov qword [r15], rax
mov qword [r15 + 8], rbp
mov eax, dword [rsp + 0x230]
mov ecx, dword [rsp + 0x233]
mov dword [r15 + 0x10], eax
mov dword [r15 + 0x13], ecx
mov byte [r15 + 0x17], dil
mov qword [r15 + 0x18], r13
mov rax, qword [rsp + 0x60]
mov byte [r15 + 0x20], al
mov eax, dword [rsp + 0x210]
mov ecx, dword [rsp + 0x213]
mov dword [r15 + 0x21], eax
mov dword [r15 + 0x24], ecx
mov qword [r15 + 0x28], r12
mov rax, qword [rsp + 0x58]
mov byte [r15 + 0x30], al
mov r12, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
mov rax, r12
sub rax, rbp
lea r13, [r15 + rax]
je 0x14009b2cd
mov rax, r12
mov rcx, r13
test rcx, rcx
je 0x14009c4d5
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
movups xmm0, xmmword [rax + 0x18]
movups xmm1, xmmword [rax + 0x21]
movups xmmword [rcx + 0x21], xmm1
movups xmmword [rcx + 0x18], xmm0
add rax, 0x38
add rcx, 0x38
cmp rax, rbp
jne 0x14009b1cc
jmp 0x14009b223
mov rcx, qword [r12]
call fcn.14018f5a0
add r12, 0x38
cmp r12, rbp
je 0x14009b2c5
test r12, r12
je 0x14009c4d2
cmp byte [r12 + 0x17], 0
jns 0x14009b216
jmp 0x14009b20d
mov rcx, qword [r12]
call fcn.14018f5a0
jmp 0x14009b280
mov rcx, rsi
call fcn.14009d300
mov r13, rax
lea rcx, [rsi + 0x18]
call fcn.14009d300
jmp 0x14009b25c
xor r13d, r13d
xor eax, eax
mov qword [rsp + 0x50], rax
test rsi, rsi
je 0x14009b295
cmp r12, rsi
je 0x14009b28d
add r12, 0xffffffffffffffe8
test r12, r12
je 0x14009c4e1
cmp byte [r12 + 0x17], 0
js 0x14009b236
lea rax, [r12 - 0x18]
cmp r12, rsi
mov r12, rax
jne 0x14009b26f
mov rcx, rsi
call fcn.14018f5a0
mov al, byte [rsp + 0x207]
movabs r12, 0xaaaaaaaaaaaaaaaa
mov rsi, qword [rsp + 0x48]
test al, al
jns 0x14009b345
mov rcx, qword [rsp + 0x1f0]
call fcn.14018f5a0
jmp 0x14009b345
mov r12, qword [rsp + 0x178]
imul rax, r14, 0x38
add rsi, rax
add r15, 0x38
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x188], rsi
test r12, r12
je 0x14009b2fd
mov rcx, r12
call fcn.14018f5a0
movabs r12, 0xaaaaaaaaaaaaaaaa
mov rsi, qword [rsp + 0x48]
jmp 0x14009b422
mov rcx, r15
mov rdx, rsi
mov r8, rbp
call fcn.14011ed20
jmp 0x14009b3ee
mov rcx, qword [r14]
call fcn.14018f5a0
jmp 0x14009b363
xor esi, esi
xor ebp, ebp
xor edi, edi
xor r13d, r13d
xor eax, eax
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
test r15, r15
je 0x14009b377
cmp r14, r15
je 0x14009b36f
add r14, 0xffffffffffffffe8
test r14, r14
je 0x14009c4d8
cmp byte [r14 + 0x17], 0
js 0x14009b324
lea rax, [r14 - 0x18]
cmp r14, r15
mov r14, rax
jne 0x14009b353
mov rcx, r15
call fcn.14018f5a0
mov r14, qword [rsp + 0x50]
test dil, dil
movzx eax, dil
cmovs rax, rbp
test r13, r13
je 0x14009b42a
test rax, rax
je 0x14009b42a
test r14, r14
je 0x14009b42a
mov r15, qword [rsp + 0x180]
mov rax, qword [rsp + 0x188]
cmp r15, rax
jae 0x14009b0bd
test r15, r15
je 0x14009c4e4
test dil, dil
js 0x14009b311
mov qword [r15], rsi
mov qword [r15 + 8], rbp
mov eax, dword [rsp + 0x230]
mov ecx, dword [rsp + 0x233]
mov dword [r15 + 0x10], eax
mov dword [r15 + 0x13], ecx
mov byte [r15 + 0x17], dil
mov qword [r15 + 0x18], r13
mov rax, qword [rsp + 0x60]
mov byte [r15 + 0x20], al
mov eax, dword [rsp + 0x210]
mov ecx, dword [rsp + 0x213]
mov dword [r15 + 0x21], eax
mov dword [r15 + 0x24], ecx
mov qword [r15 + 0x28], r14
mov rax, qword [rsp + 0x58]
mov byte [r15 + 0x30], al
add r15, 0x38
mov qword [rsp + 0x180], r15
test dil, dil
jns 0x14009b437
mov rcx, rsi
call fcn.14018f5a0
add rbx, 0x18
cmp rbx, qword [rsp + 0x88]
je 0x14009a71f
mov eax, 0xaaaaaaaa
mov dword [rsp + 0x213], eax
mov dword [rsp + 0x210], eax
xor eax, eax
mov dword [rsp + 0x230], eax
mov dword [rsp + 0x233], eax
movsx rax, byte [rbx + 0x17]
test rax, rax
jns 0x14009b47a
mov rax, qword [rbx + 8]
test rax, rax
je 0x14009b50a
mov qword [rsp + 0x260], r12
movaps xmmword [rsp + 0x250], xmm6
lea rcx, [rsp + 0x250]
mov rdx, rbx
mov r8b, Ordinal_41
call fcn.14009cdc0
mov r15, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x258]
mov rax, rsi
sub rax, r15
cmp rax, 0x30
je 0x14009b54a
lea rcx, [rsp + 0x1f0]
mov rdx, rbx
mov r8b, 0x5b
call fcn.14009cdc0
test r15, r15
jne 0x14009b7b3
mov r15, qword [rsp + 0x1f0]
mov r14, qword [rsp + 0x1f8]
mov qword [rsp + 0x250], r15
mov qword [rsp + 0x258], r14
mov r13b, 1
mov rsi, r14
jmp 0x14009b550
xor esi, esi
xor ebp, ebp
xor edi, edi
xor r13d, r13d
xor eax, eax
mov qword [rsp + 0x60], rax
xor r14d, r14d
xor eax, eax
mov qword [rsp + 0x58], rax
jmp 0x14009b37c
mov rdx, qword [r15 + 0x18]
mov r8, qword [r15 + 0x20]
lea rcx, [rsp + 0x1f0]
call fcn.14011ed20
jmp 0x14009b594
cmp rdx, rcx
ja 0x14009b5c0
jmp 0x14009c4de
xor r13d, r13d
mov r14, rsi
sub rsi, r15
cmp rsi, 0x30
mov qword [rsp + 0x60], r13
jne 0x14009b32e
mov qword [rsp + 0x200], r12
movaps xmmword [rsp + 0x1f0], xmm6
cmp byte [r15 + 0x2f], 0
js 0x14009b529
lea rax, [r15 + 0x18]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x200], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1f0], xmm0
movsx rax, byte [rsp + 0x207]
test rax, rax
mov rdx, qword [rsp + 0x1f8]
mov rcx, rax
cmovs rcx, rdx
dec rcx
test rax, rax
js 0x14009b540
cmp rcx, rax
jae 0x14009c4de
test al, al
mov r8, qword [rsp + 0x1f0]
lea r9, [rsp + 0x1f0]
cmovs r9, r8
movzx r9d, byte [r9 + rcx]
xor r10d, r10d
cmp r9d, 0x29
je 0x14009b609
cmp r9d, 0x5d
je 0x14009b606
xor ecx, ecx
mov qword [rsp + 0x58], rcx
xor esi, esi
xor ebp, ebp
xor edi, edi
xor r13d, r13d
xor ecx, ecx
mov qword [rsp + 0x50], rcx
jmp 0x14009b2ab
mov r10b, 1
test al, al
jns 0x14009b792
cmp rdx, rcx
jb 0x14009c4f0
mov qword [rsp + 0x1f8], rcx
mov byte [r8 + rcx], 0
cmp r14, r15
je 0x14009c4ed
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x1e0], r12
movaps xmmword [rsp + 0x1d0], xmm6
cmp byte [r15 + 0x17], 0
js 0x14009b776
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x1e0], rax
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x1d0], xmm0
lea rsi, [rsp + 0x1d0]
movsx rdi, byte [rsp + 0x1e7]
test rdi, rdi
mov rax, qword [rsp + 0x1d0]
mov rbp, qword [rsp + 0x1d8]
cmovs rsi, rax
mov r12, rdi
cmovs r12, rbp
test r12, r12
je 0x14009b76c
xor edi, edi
movsx ecx, byte [rsi + rdi]
call fcn.14018faa4
mov byte [rsi + rdi], al
inc rdi
cmp r12, rdi
jne 0x14009b6a2
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x1d8]
mov dil, byte [rsp + 0x1e7]
lea rcx, [rsp + 0x1e0]
mov eax, dword [rcx]
mov ecx, dword [rcx + 3]
mov dword [rsp + 0x233], ecx
mov dword [rsp + 0x230], eax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x1e0], rax
movaps xmmword [rsp + 0x1d0], xmm6
lea rcx, [rsp + 0x1d0]
lea rdx, [rsp + 0x1f0]
mov r8b, Ordinal_46
call fcn.14009cdc0
mov rsi, qword [rsp + 0x1d0]
mov r12, qword [rsp + 0x1d8]
mov rax, r12
sub rax, rsi
sar rax, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rax, rcx
cmp rax, 2
je 0x14009b241
cmp rax, 1
jne 0x14009b257
mov rcx, rsi
call fcn.14009d300
mov r13, rax
jmp 0x14009b25c
mov qword [rsp + 0x48], rax
jmp 0x14009b6d3
mov rdx, qword [r15]
mov r8, qword [r15 + 8]
lea rsi, [rsp + 0x1d0]
mov rcx, rsi
call fcn.14011ed20
jmp 0x14009b670
cmp rcx, rax
ja 0x14009c4f0
mov eax, ecx
and al, 0x7f
mov byte [rsp + 0x207], al
lea r8, [rsp + 0x1f0]
jmp 0x14009b622
cmp rsi, r15
je 0x14009b7d7
add rsi, 0xffffffffffffffe8
test rsi, rsi
je 0x14009c4f6
cmp byte [rsi + 0x17], 0
js 0x14009b7e4
lea rax, [rsi - 0x18]
cmp rsi, r15
mov rsi, rax
jne 0x14009b7bc
mov rcx, r15
call fcn.14018f5a0
jmp 0x14009b4e2
mov rcx, qword [rsi]
call fcn.14018f5a0
jmp 0x14009b7cb
mov eax, dword [rsp + 0x230]
dec eax
cmp eax, 1
ja 0x14009a216
mov qword [rsp + 0xe0], r12
movaps xmmword [rsp + 0xd0], xmm6
mov ebx, dword [rsp + 0x1d0]
cmp rbx, 0x17
jae 0x14009c435
lea r14, [rsp + 0xd0]
mov byte [r14 + 0x17], bl
test rbx, rbx
je 0x14009b83f
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.1401cdd80
mov byte [r14 + rbx], 0
cmp byte [rsp + 0xe7], 0
js 0x14009b858
lea rax, [rsp + 0xd0]
jmp 0x14009b860
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x38]
cmp byte [rsp + 0x267], 0
js 0x14009b879
lea rdx, [rsp + 0x250]
jmp 0x14009b881
mov rdx, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x1f0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14009b8c3
cmp byte [rsp + 0xe7], 0
jns 0x14009a216
mov rcx, qword [rsp + 0xd0]
call fcn.14018f5a0
jmp 0x14009a216
cmp byte [rsp + 0x1c7], 0
movzx r8d, byte [rsp + 0xe7]
js 0x14009c486
test r8b, r8b
js 0x14009b904
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x1c0], rax
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x1b0], xmm0
jmp 0x14009a216
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xd8]
lea rcx, [rsp + 0x1b0]
call fcn.14011d120
jmp 0x14009b8a3
lea rax, [rsp + 0x258]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rax + 8], rcx
movaps xmmword [rax - 8], xmm6
mov byte [rax + 0xf], 4
lea rcx, str..msi
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c52f
movabs rax, 0x690073006d002e
mov qword [rsp + 0x250], rax
mov word [rsp + 0x258], 0
movsx rcx, byte [rsp + 0x15f]
mov rax, rsi
test rcx, rcx
mov rdi, qword [rsp + 0x38]
jns 0x14009b99e
mov rax, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x150]
inc rcx
cmp rcx, 1
je 0x14009b9e6
lea r8, [rcx - 1]
cmp byte [rax + rcx - 2], 0x2e
mov rcx, r8
jne 0x14009b9a1
test r8, r8
je 0x14009b9e6
lea rax, [rsp + 0x230]
mov qword [rsp + 0x20], rax
mov rdx, rsi
lea rsi, [rsp + 0x1d0]
mov rcx, rsi
mov r9, 0xffffffffffffffff
call fcn.140119dd0
mov al, byte [rsi + 0x17]
jmp 0x14009b9f6
xor eax, eax
mov byte [rsp + 0x1e7], al
mov byte [rsp + 0x1d0], al
test al, al
movzx r8d, al
lea rdx, [rsp + 0x1d0]
cmovs r8, qword [rdx + 8]
mov rcx, qword [rdx]
cmovs rdx, rcx
test r8, r8
js 0x14009c532
sete r9b
test rdx, rdx
setne r10b
or r10b, r9b
je 0x14009c535
cmp r8, 3
je 0x14009ba37
xor esi, esi
jmp 0x14009ba51
movzx r8d, word [rdx]
xor r8d, 0x7865
movzx edx, byte [rdx + 2]
xor edx, 0x65
or dx, r8w
sete sil
test al, al
jns 0x14009ba5a
call fcn.14018f5a0
test sil, sil
je 0x14009babc
cmp byte [rsp + 0x267], 0
jns 0x14009ba9e
mov qword [rsp + 0x258], 4
mov rax, qword [rsp + 0x250]
jmp 0x14009baa9
xorps xmm0, xmm0
lea rax, [rsp + 0x210]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov byte [rax + 0x17], r14b
jmp 0x14009bb7f
mov byte [rsp + 0x267], 4
mov rax, r15
movabs rcx, 0x6500780065002e
mov qword [rax], rcx
mov word [rax + 8], 0
lea rsi, [rsp + 0x1d0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm6
lea r8, [rsp + 0x250]
mov rcx, rsi
mov rdx, rdi
call fcn.1401dc320
movsx rdi, byte [rdi + 0xbf]
mov rbx, rdi
test rdi, rdi
jns 0x14009bb04
mov rax, qword [rsp + 0x38]
mov rbx, qword [rax + 0xb0]
lea r14, [rbx + 1]
cmp r14, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
ja 0x14009c538
cmp r14, 0xa
jbe 0x14009ba7f
movabs rbp, 0x8000000000000000
lea rax, [rbp - 4]
and rax, r14
add rax, 4
mov r13, r14
or r13, 3
cmp r13, 0xb
cmove r13, rax
inc r13
js 0x14009c541
lea rcx, [r13*2]
call fcn.14018f5a8
or rbp, r13
mov qword [rsp + 0x220], rbp
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r14
mov rdx, qword [rsp + 0x70]
test dil, dil
jns 0x14009bb87
mov rdx, qword [rdx]
lea rdi, [rax + rbx*2]
cmp rdx, rax
setb cl
cmp rdi, rdx
setbe r8b
or r8b, cl
je 0x14009c53b
test rbx, rbx
je 0x14009bbb4
add rbx, rbx
mov rcx, rax
mov r8, rbx
call fcn.1401cd6e0
lea rax, [rdi + 2]
lea rcx, [0x1402779c8]
cmp rdi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c53e
movsx r8, byte [rsp + 0x1e7]
test r8, r8
cmovs r8, qword [rsp + 0x1d8]
mov dword [rdi], 0x5c
cmovs rsi, qword [rsp + 0x1d0]
lea rbx, [rsp + 0x210]
mov rcx, rbx
mov rdx, rsi
call fcn.14016ee30
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x240], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x230], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
cmp byte [rbx + 0x17], 0
jns 0x14009bc42
mov rcx, qword [rsp + 0x210]
call fcn.14018f5a0
cmp byte [rsp + 0x247], 0
mov rbx, qword [rsp + 0x38]
js 0x14009bc5b
lea rcx, [rsp + 0x230]
jmp 0x14009bc63
mov rcx, qword [rsp + 0x230]
lea rdx, [0x1402746e6]
call fcn.1401ada10
test rax, rax
setne dil
je 0x14009bd1b
mov rsi, rax
mov rcx, qword [rbx + 0xe0]
mov r8, qword [rbx + 0xe8]
sub r8, rcx
mov edx, 1
mov r9, rax
call fcn.1401b1220
mov rcx, rsi
call fcn.1401af6c4
cmp byte [rsp + 0xa7], 0
movzx r8d, byte [rsp + 0x247]
js 0x14009c4ac
test r8b, r8b
js 0x14009bd3e
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [rsp + 0x230]
movaps xmmword [rsp + 0x90], xmm0
cmp byte [rsp + 0x1e7], 0
jns 0x14009bcf8
mov rcx, qword [rsp + 0x1d0]
call fcn.14018f5a0
cmp byte [rsp + 0x267], 0
jns 0x14009bd0f
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
mov bl, byte [rsp + 0x207]
jmp 0x14009bda5
mov dword [rbx + 0xc0], 0x6b
cmp byte [rsp + 0x247], 0
jns 0x14009bce1
mov rcx, qword [rsp + 0x230]
call fcn.14018f5a0
jmp 0x14009bce1
mov rdx, qword [rsp + 0x230]
mov r8, qword [rsp + 0x238]
lea rcx, [rsp + 0x90]
call fcn.14000ae50
jmp 0x14009bd25
test r8b, r8b
cmovs r8, qword [rsp + 0x1b8]
cmovs r12, qword [rsp + 0x1b0]
mov rdx, r12
call fcn.14011d210
jmp 0x14009bf9d
mov rcx, qword [rsp + 0x1f0]
call fcn.1401cd530
test eax, eax
je 0x14009b923
mov rax, qword [rsp + 0x38]
mov dword [rax + 0xc0], 0x6a
xor edi, edi
test bl, bl
jns 0x14009bdb6
mov rcx, qword [rsp + 0x1f0]
call fcn.14018f5a0
test dil, dil
mov rax, qword [rsp + 0x38]
je 0x14009c19b
cmp byte [rsp + 0xa7], 0
js 0x14009be03
lea r8, [rsp + 0x90]
jmp 0x14009be0b
mov rdx, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1b8]
call fcn.14011d120
jmp 0x14009bf9d
mov qword [rax + 0x40], 0x10
mov rax, qword [rax + 0x38]
jmp 0x14009bec8
mov r8, qword [rsp + 0x90]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.open
lea r9, [0x140277ac0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea r14, [rsp + 0x256]
mov byte [r14 + 0x11], 6
lea rax, str.status
cmp r15, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009c51a
mov word [rsp + 0x254], 0x7375
mov dword [rsp + 0x250], 0x74617473
mov byte [rsp + 0x256], 0
lea rdi, [rsp + 0x1d0]
mov qword [rdi], r15
lea rbx, [rsp + 0x230]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275aab]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182950
mov rax, qword [rsi]
cmp byte [rax + 0x4f], 0
js 0x14009bdf2
mov byte [rax + 0x4f], 0x10
add rax, 0x38
movups xmm0, xmmword [str.Update_initiated]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
cmp byte [rsp + 0x267], 0
jns 0x14009beed
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
mov byte [rsp + 0x267], 6
lea rax, str.ver_pv
cmp r15, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009c51d
mov word [rsp + 0x254], 0x7670
mov dword [rsp + 0x250], 0x5f726576
mov byte [rsp + 0x256], 0
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275aab]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182950
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
cmp rcx, r12
je 0x14009bf9d
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x1c7]
js 0x14009bd5d
test r8b, r8b
js 0x14009bdd8
mov rax, qword [rsp + 0x1c0]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009bfb4
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
lea rax, [rsp + 0x25e]
mov byte [rax + 9], reloc.WLDAP32.dll_Ordinal_14
lea rcx, str.verToBeUpdated
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c520
movabs rax, 0x6465746164705565
mov qword [rsp + 0x256], rax
movabs rax, 0x5565426f54726576
mov qword [rsp + 0x250], rax
mov byte [rsp + 0x25e], 0
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275aab]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182950
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
lea rdx, [rsp + 0x160]
cmp rcx, rdx
je 0x14009c076
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x177]
js 0x14009c2b6
test r8b, r8b
js 0x14009c16a
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009c08d
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
lea rax, [rsp + 0x261]
mov byte [rax + 6], 0x11
lea rcx, str.newVerToInstalled
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c523
movups xmm0, xmmword [str.newVerToInstalled]
movaps xmmword [rsp + 0x250], xmm0
mov word [rsp + 0x260], 0x64
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275aab]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182950
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
lea rdx, [rsp + 0xe8]
cmp rcx, rdx
je 0x14009c138
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0xff]
js 0x14009c297
test r8b, r8b
js 0x14009c184
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009c14f
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
cmp byte [rsp + 0xa7], 0
jns 0x14009acd5
mov rcx, qword [rsp + 0x90]
jmp 0x14009acd0
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
call fcn.14011d120
jmp 0x14009c076
mov rdx, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xf0]
call fcn.14011d120
jmp 0x14009c138
mov edx, dword [rax + 0xc0]
jmp 0x14009c1b2
mov dword [rdi + 0xc0], 0x69
mov edx, 0x69
lea rcx, [rsp + 0x250]
call fcn.1401f31b0
lea rax, [rsp + 0x1f5]
mov byte [rax + 0x12], 5
lea rcx, str.error
lea r8, [rsp + 0x1f0]
cmp r8, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c52c
mov dword [rsp + 0x1f0], 0x6f727265
mov word [rsp + 0x1f4], Ordinal_117
lea rax, [rsp + 0x230]
mov qword [rax], r8
lea rcx, [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140275aab]
lea rsi, [rsp + 0x1d0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182950
mov rax, qword [rsi]
lea rsi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009c251
mov rcx, qword [rsi]
call fcn.14018f5a0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
xor eax, eax
mov byte [rsp + 0x267], al
mov byte [rsp + 0x250], al
cmp byte [rsp + 0x207], al
jns 0x14009c14f
mov rcx, qword [rsp + 0x1f0]
call fcn.14018f5a0
jmp 0x14009c138
test r8b, r8b
jns 0x14009c2ac
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xe8]
call fcn.14011d210
jmp 0x14009c138
test r8b, r8b
jns 0x14009c2d0
mov r8, qword [rsp + 0x168]
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
call fcn.14011d210
jmp 0x14009c076
mov dword [rbx + 0xc0], Ordinal_117
lea rcx, [rsp + 0xd0]
mov edx, 0x6c
call fcn.1401f31b0
lea rax, [rsp + 0x255]
mov byte [rax + 0x12], 5
lea rcx, str.error
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c526
mov dword [rsp + 0x250], 0x6f727265
mov word [rsp + 0x254], Ordinal_117
lea rax, [rsp + 0x1d0]
mov qword [rax], rsi
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140275aab]
lea rbx, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
mov r8, rsi
call fcn.140182950
mov rax, qword [rbx]
lea rdi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009c388
mov rcx, qword [rdi]
call fcn.14018f5a0
mov rax, qword [rsp + 0xe0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdi], xmm0
xor eax, eax
mov byte [rsp + 0xe7], al
mov byte [rsp + 0xd0], al
cmp byte [rsp + 0x267], al
js 0x14009c3c2
mov rbx, qword [rsp + 0x38]
jmp 0x14009a25a
mov rcx, qword [rsp + 0x250]
call fcn.14018f5a0
cmp byte [rsp + 0xe7], 0
mov rbx, qword [rsp + 0x38]
jns 0x14009a25a
mov rcx, qword [rsp + 0xd0]
call fcn.14018f5a0
jmp 0x14009a25a
test r8b, r8b
jns 0x14009c409
mov r8, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x160]
call fcn.14011d210
jmp 0x14009acbe
test r8b, r8b
cmovs r8, qword [rsp + 0x1b8]
cmovs r12, qword [rsp + 0x1b0]
mov rdx, r12
call fcn.14011d210
jmp 0x14009abe0
mov eax, ebx
and eax, 0xfffffff8
add rax, 8
mov r15, rbx
or r15, 7
cmp r15, 0x17
cmove r15, rax
lea rcx, [r15 + 1]
call fcn.14018f5a8
mov r14, rax
mov qword [rsp + 0xd0], rax
movabs rax, 0x8000000000000000
add rax, r15
inc rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xd8], rbx
jmp 0x14009b832
test r8b, r8b
lea rdx, [rsp + 0xd0]
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
lea rcx, [rsp + 0x1b0]
call fcn.14011d210
jmp 0x14009b8a3
test r8b, r8b
lea rdx, [rsp + 0x230]
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
lea rcx, [rsp + 0x90]
call fcn.14000af50
jmp 0x14009bd25
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3