Function at 0x1400402a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x690
mov rax, qword [0x14030c918]
xor rax, rsp
mov qword [rsp + 0x688], rax
xor r14d, r14d
mov qword [rsp + 0x240], r14
movdqa xmm0, xmmword [0x1402c75d0]
movdqu xmmword [rsp + 0x250], xmm0
mov word [rsp + 0x240], r14w
mov byte [rsp + 0x238], r14b
lea rdx, str.srl::Applications::Detect
lea rcx, [rsp + 0x240]
call fcn.140009b0c
nop
call fcn.14001fcc0
cmp dword [rax + 8], 4
jl 0x140040329
lea rcx, [rsp + 0x238]
call fcn.140015ae0
nop
lea r12, vtable.srl::Exists.0
mov qword [rsp + 0xb8], r12
mov byte [rsp + 0xc0], 0
mov edx, 0x116f3
lea rcx, [rsp + 0x3f0]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0xb8]
mov rdx, rax
call fcn.14004ecb0
nop
lea r15, vtable.srl::GroupID.0
mov qword [rsp + 0x3f0], r15
mov rdx, qword [rsp + 0x410]
cmp rdx, 8
jb 0x1400403bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400403b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041713
call fcn.14000410c
nop
mov qword [rsp + 0xc8], r12
mov byte [rsp + 0xd0], 0
mov edx, 0x116f5
lea rcx, [rsp + 0x420]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0xc8]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x420], r15
mov rdx, qword [rsp + 0x440]
cmp rdx, 8
jb 0x140040447
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x428]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040441
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041719
call fcn.14000410c
nop
mov qword [rsp + 0xd8], r12
mov byte [rsp + 0xe0], 0
mov edx, 0x116f7
lea rcx, [rsp + 0x450]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0xd8]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x450], r15
mov rdx, qword [rsp + 0x470]
cmp rdx, 8
jb 0x1400404cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x458]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400404c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004171f
call fcn.14000410c
nop
mov qword [rsp + 0xe8], r12
mov byte [rsp + 0xf0], 0
mov edx, 0x116f9
lea rcx, [rsp + 0x480]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0xe8]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x480], r15
mov rdx, qword [rsp + 0x4a0]
cmp rdx, 8
jb 0x140040557
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x488]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040551
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041725
call fcn.14000410c
nop
mov qword [rsp + 0xf8], r12
mov byte [rsp + 0x100], 0
mov edx, 0x116fb
lea rcx, [rsp + 0x4b0]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0xf8]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x4b0], r15
mov rdx, qword [rsp + 0x4d0]
cmp rdx, 8
jb 0x1400405df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400405d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004172b
call fcn.14000410c
nop
mov qword [rsp + 0x108], r12
mov byte [rsp + 0x110], 0
mov edx, 0x11702
lea rcx, [rsp + 0x4e0]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x108]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x4e0], r15
mov rdx, qword [rsp + 0x500]
cmp rdx, 8
jb 0x140040667
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040661
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041731
call fcn.14000410c
nop
mov qword [rsp + 0xa0], r14
mov dword [rsp + 0xa8], r14d
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMacromediaFlashPlayer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140040729
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0xa0], rcx
mov dword [rsp + 0xa8], r14d
mov dword [rsp + 0x30], 0x28
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x660]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.CurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140040729
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x140040729
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400407d9
test al, 1
jne 0x140040729
shr rax, 1
cmp word [rsp + rax*2 + 0x65e], 0
je 0x1400407e2
mov rdi, 0xffffffffffffffff
lea rsi, vtable.srl::Version.0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], 7
mov word [rsp + 0x178], r14w
lea rdx, str.wmplayer.exe
lea rcx, [rsp + 0x260]
call fcn.140009744
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x260]
call fcn.14003f800
movzx ebx, al
mov rdx, qword [rsp + 0x278]
cmp rdx, 8
jb 0x14004098f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004098a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041737
jmp 0x14004098a
mov word [rsp + 0x660], r14w
mov qword [rsp + 0x118], r12
mov byte [rsp + 0x120], 1
mov edx, 0x116f1
lea rcx, [rsp + 0x510]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x118]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x510], r15
mov rdx, qword [rsp + 0x530]
cmp rdx, 8
jb 0x14004086a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040864
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004173d
call fcn.14000410c
nop
lea rsi, vtable.srl::Version.0
mov qword [rsp + 0x40], rsi
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x140041743
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x660]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400408b0
mov r8d, eax
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0x48]
call fcn.140002aa8
nop
mov edx, 0x116f2
lea rcx, [rsp + 0x300]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x40]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x300], r15
mov rdx, qword [rsp + 0x320]
cmp rdx, 8
jb 0x140040944
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004093f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004174e
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c75d0]
movdqu xmmword [rsp + 0x318], xmm0
mov word [rsp + 0x308], r14w
mov qword [rsp + 0x40], rsi
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040737
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140040737
call fcn.14000410c
test bl, bl
je 0x140040bc2
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1c8], r14
mov qword [rsp + 0x1d0], 7
mov word [rsp + 0x1b8], r14w
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x178]
call fcn.14003f640
test al, al
je 0x140040b7a
mov qword [rsp + 0x128], r12
mov byte [rsp + 0x130], 1
mov edx, 0x116f3
lea rcx, [rsp + 0x540]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x540], r15
mov rdx, qword [rsp + 0x560]
cmp rdx, 8
jb 0x140040a61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041754
call fcn.14000410c
nop
mov qword [rsp + 0x50], rsi
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14004175a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
jb 0x140040aab
mov rdx, qword [rsp + 0x1b8]
test rdx, rdx
jne 0x140040aab
mov eax, r14d
jmp 0x140040aba
mov rax, rdi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140040ab0
mov r8d, eax
lea rcx, [rsp + 0x58]
call fcn.140002aa8
nop
mov edx, 0x11611
lea rcx, [rsp + 0x330]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x330], r15
mov rdx, qword [rsp + 0x350]
cmp rdx, 8
jb 0x140040b3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x338]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040b37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041765
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c75d0]
movdqu xmmword [rsp + 0x348], xmm0
mov word [rsp + 0x338], r14w
mov qword [rsp + 0x50], rsi
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040b7a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x1d0]
cmp rdx, 8
jb 0x140040bc2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040bbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400417d3
call fcn.14000410c
mov qword [rsp + 0x188], r14
lea rax, [rsp + 0x178]
cmp qword [rsp + 0x190], 8
cmovae rax, qword [rsp + 0x178]
mov word [rax], r14w
lea rdx, str.AcroRd32.exe
lea rcx, [rsp + 0x280]
call fcn.140009744
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x280]
call fcn.14003f800
movzx ebx, al
mov rdx, qword [rsp + 0x298]
cmp rdx, 8
jb 0x140040c5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040c58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004176b
call fcn.14000410c
test bl, bl
je 0x140040e92
mov qword [rsp + 0x1d8], r14
mov qword [rsp + 0x1e8], r14
mov qword [rsp + 0x1f0], 7
mov word [rsp + 0x1d8], r14w
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x178]
call fcn.14003f640
test al, al
je 0x140040e4a
mov qword [rsp + 0x138], r12
mov byte [rsp + 0x140], 1
mov edx, 0x116f5
lea rcx, [rsp + 0x570]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x570], r15
mov rdx, qword [rsp + 0x590]
cmp rdx, 8
jb 0x140040d2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x578]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041771
call fcn.14000410c
nop
mov qword [rsp + 0x60], rsi
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x140041777
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x1d8]
cmp qword [rsp + 0x1f0], 8
jb 0x140040d79
mov rdx, qword [rsp + 0x1d8]
test rdx, rdx
jne 0x140040d79
mov eax, r14d
jmp 0x140040d8a
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140040d80
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.140002aa8
nop
mov edx, 0x116f6
lea rcx, [rsp + 0x360]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x360], r15
mov rdx, qword [rsp + 0x380]
cmp rdx, 8
jb 0x140040e0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x368]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040e07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041782
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c75d0]
movdqu xmmword [rsp + 0x378], xmm0
mov word [rsp + 0x368], r14w
mov qword [rsp + 0x60], rsi
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040e4a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x1f0]
cmp rdx, 8
jb 0x140040e92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040e8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400417d3
call fcn.14000410c
mov qword [rsp + 0x188], r14
lea rax, [rsp + 0x178]
cmp qword [rsp + 0x190], 8
cmovae rax, qword [rsp + 0x178]
mov word [rax], r14w
lea rdx, str.QuickTimePlayer.exe
lea rcx, [rsp + 0x2a0]
call fcn.140009744
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x2a0]
call fcn.14003f800
movzx ebx, al
mov rdx, qword [rsp + 0x2b8]
cmp rdx, 8
jb 0x140040f2d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040f28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041788
call fcn.14000410c
test bl, bl
je 0x140041162
mov qword [rsp + 0x1f8], r14
mov qword [rsp + 0x208], r14
mov qword [rsp + 0x210], 7
mov word [rsp + 0x1f8], r14w
lea rdx, [rsp + 0x1f8]
lea rcx, [rsp + 0x178]
call fcn.14003f640
test al, al
je 0x14004111a
mov qword [rsp + 0x148], r12
mov byte [rsp + 0x150], 1
mov edx, 0x116f7
lea rcx, [rsp + 0x5a0]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x5a0], r15
mov rdx, qword [rsp + 0x5c0]
cmp rdx, 8
jb 0x140040fff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040ff9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004178e
call fcn.14000410c
nop
mov qword [rsp + 0x70], rsi
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x140041794
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x1f8]
cmp qword [rsp + 0x210], 8
jb 0x140041049
mov rdx, qword [rsp + 0x1f8]
test rdx, rdx
jne 0x140041049
mov eax, r14d
jmp 0x14004105a
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140041050
mov r8d, eax
lea rcx, [rsp + 0x78]
call fcn.140002aa8
nop
mov edx, 0x116f8
lea rcx, [rsp + 0x390]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x70]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x390], r15
mov rdx, qword [rsp + 0x3b0]
cmp rdx, 8
jb 0x1400410dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x398]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400410d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004179f
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c75d0]
movdqu xmmword [rsp + 0x3a8], xmm0
mov word [rsp + 0x398], r14w
mov qword [rsp + 0x70], rsi
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004111a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x210]
cmp rdx, 8
jb 0x140041162
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004115d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400417d3
call fcn.14000410c
mov qword [rsp + 0x188], r14
lea rax, [rsp + 0x178]
cmp qword [rsp + 0x190], 8
cmovae rax, qword [rsp + 0x178]
mov word [rax], r14w
lea rdx, str.Winword.exe
lea rcx, [rsp + 0x2c0]
call fcn.140009744
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x2c0]
call fcn.14003f800
movzx ebx, al
mov rdx, qword [rsp + 0x2d8]
cmp rdx, 8
jb 0x1400411fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400411f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400417a5
call fcn.14000410c
test bl, bl
je 0x140041440
mov qword [rsp + 0x218], r14
mov qword [rsp + 0x228], r14
mov qword [rsp + 0x230], 7
mov word [rsp + 0x218], r14w
lea rdx, [rsp + 0x218]
lea rcx, [rsp + 0x178]
call fcn.14003f640
test al, al
je 0x1400413f8
mov qword [rsp + 0x158], r12
mov byte [rsp + 0x160], 1
mov edx, 0x116f9
lea rcx, [rsp + 0x5d0]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x5d0], r15
mov rdx, qword [rsp + 0x5f0]
cmp rdx, 8
jb 0x1400412cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400412c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400417ab
call fcn.14000410c
nop
mov qword [rsp + 0x80], rsi
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x1400417b1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x218]
cmp qword [rsp + 0x230], 8
jb 0x14004131f
mov rdx, qword [rsp + 0x218]
test rdx, rdx
jne 0x14004131f
mov eax, r14d
jmp 0x14004132c
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140041322
mov r8d, eax
lea rcx, [rsp + 0x88]
call fcn.140002aa8
nop
mov edx, 0x116fa
lea rcx, [rsp + 0x3c0]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x80]
mov rdx, rax
call fcn.14004ecb0
nop
mov qword [rsp + 0x3c0], r15
mov rdx, qword [rsp + 0x3e0]
cmp rdx, 8
jb 0x1400413b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400413af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400417bc
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c75d0]
movdqu xmmword [rsp + 0x3d8], xmm0
mov word [rsp + 0x3c8], r14w
mov qword [rsp + 0x80], rsi
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400413f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x230]
cmp rdx, 8
jb 0x140041440
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004143b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400417d3
call fcn.14000410c
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x1a8], r14
mov qword [rsp + 0x1b0], 7
mov word [rsp + 0x198], r14w
lea rdx, str.3F0FC462_CDC1_4CD9_8E84_84D89B914EAA
lea rcx, [rsp + 0x2e0]
call fcn.140009744
nop
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x2e0]
call fcn.14003fbc0
movzx ebx, al
mov rdx, qword [rsp + 0x2f8]
cmp rdx, 8
jb 0x1400414da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400414d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400417c2
call fcn.14000410c
test bl, bl
je 0x1400415f8
mov qword [rsp + 0x168], r12
mov byte [rsp + 0x170], 1
mov edx, 0x11702
lea rcx, [rsp + 0x600]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.14004ecb0
nop
lea rcx, [rsp + 0x600]
call fcn.140021650
nop
mov qword [rsp + 0x90], rsi
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x1400417c8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x198]
cmp qword [rsp + 0x1b0], 8
jb 0x140041577
mov rdx, qword [rsp + 0x198]
test rdx, rdx
jne 0x140041577
mov eax, r14d
jmp 0x14004158a
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140041580
mov r8d, eax
lea rcx, [rsp + 0x98]
call fcn.140002aa8
nop
mov edx, 0x11703
lea rcx, [rsp + 0x630]
call fcn.1400214c0
nop
xor r9d, r9d
lea r8, [rsp + 0x90]
mov rdx, rax
call fcn.14004ecb0
nop
lea rcx, [rsp + 0x630]
call fcn.140021650
nop
mov qword [rsp + 0x90], rsi
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400415f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x1b0]
cmp rdx, 8
jb 0x140041640
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004163b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400417d3
call fcn.14000410c
mov qword [rsp + 0x1a8], r14
mov qword [rsp + 0x1b0], 7
mov word [rsp + 0x198], r14w
mov rdx, qword [rsp + 0x190]
cmp rdx, 8
jb 0x1400416a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400416a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400417d9
call fcn.14000410c
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], 7
mov word [rsp + 0x178], r14w
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x1400416d6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x238]
call fcn.140017400
mov al, 1
mov rcx, qword [rsp + 0x688]
xor rcx, rsp
call fcn.140212f90
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
int3
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
int3