Function at 0x140031d10
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x98
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov rax, qword [0x14009a750]
xor rax, rsp
mov qword [rbp - 1], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov r13, qword [rbp + 0x7f]
xor edi, edi
mov dword [rbp - 0x59], edi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x41], xmm0
movdqa xmm1, xmmword [0x140080000]
movdqu xmmword [rbp - 0x41], xmm1
mov word [rbp - 0x51], di
lea r8d, [rdi + 0x1f]
lea rdx, str.SoftwareRegisteredApplications
lea rcx, [rbp - 0x51]
call fcn.140004360
nop
mov ebx, 1
mov dword [rbp - 0x59], ebx
mov qword [rbp - 0x29], rdi
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140031de7
lea rdx, [0x14007d910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140031de7
test r14, r14
je 0x140031de7
mov rcx, qword [rsi]
mov r9d, dword [rcx]
or r9d, 0x20019
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rdx, qword [rbp - 0x51]
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r14
call rax
test eax, eax
jne 0x140031de7
cmp qword [rbp - 0x29], rdi
jne 0x140031dea
movzx edi, bl
and ebx, 0xfffffffe
mov dword [rbp - 0x59], ebx
mov rdx, qword [rbp - 0x39]
cmp rdx, 8
jb 0x140031e30
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031e2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032072
call fcn.140049020
movdqa xmm0, xmmword [0x140080000]
movdqu xmmword [rbp - 0x41], xmm0
xor eax, eax
mov word [rbp - 0x51], ax
test dil, dil
jne 0x14003204c
xor edi, edi
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], rdi
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], 7
mov word [rbp - 0x21], di
lea r9, [rbp - 0x21]
mov r8, r15
mov rdx, qword [rbp - 0x29]
mov rcx, rsi
call fcn.14002ee00
test al, al
je 0x140031fce
mov rdx, qword [rbp - 0x11]
test rdx, rdx
je 0x140031fce
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140031ebf
lea rdx, [0x14007d948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140031ebb
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140031ebb
call rax
mov qword [rbp - 0x29], rdi
mov rdx, qword [rbp - 0x11]
mov rcx, qword [rbp - 9]
mov rax, rcx
sub rax, rdx
cmp rax, 0x11
jb 0x140031f04
lea rdi, [rdx + 0x11]
mov qword [rbp - 0x11], rdi
lea rbx, [rbp - 0x21]
cmp rcx, 8
cmovae rbx, qword [rbp - 0x21]
lea rcx, [rbx + rdx*2]
mov r8d, 0x22
lea rdx, str.FileAssociations
call fcn.14004aa10
xor eax, eax
mov word [rbx + rdi*2], ax
xor edi, edi
jmp 0x140031f22
mov qword [rsp + 0x20], 0x11
lea r9, str.FileAssociations
mov edx, 0x11
lea rcx, [rbp - 0x21]
call fcn.140006780
mov qword [rbp - 0x29], rdi
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140031ffb
lea rdx, [0x14007d910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140031ffb
test r14, r14
je 0x140031ffb
mov rdx, qword [rsi]
mov r9d, dword [rdx]
or r9d, 0x20019
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r14
call rax
test eax, eax
jne 0x140031ffb
mov rdx, qword [rbp - 0x29]
test rdx, rdx
je 0x140031ffb
mov r9, r13
mov r8, r12
mov rcx, rsi
call fcn.14002ee00
movzx ebx, al
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140031ffd
lea rdx, [0x14007d948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140031ffd
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140031ffd
call rax
mov qword [rbp - 0x29], rdi
jmp 0x140031ffd
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140031ffb
lea rdx, [0x14007d948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140031ffb
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140031ffb
call rax
mov qword [rbp - 0x29], rdi
xor bl, bl
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x140032039
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032034
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003206c
call fcn.140049020
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], 7
mov word [rbp - 0x21], di
movzx eax, bl
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140048fc0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14004d324
int3
call fcn.14004d324
int3