Function at 0x14003d740
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x800
mov rax, qword [0x14030a918]
xor rax, rsp
mov qword [rsp + 0x7f0], rax
xor r13d, r13d
mov qword [r11 - 0x570], r13
movdqa xmm0, xmmword [0x1402c55e0]
movdqu xmmword [rsp + 0x2b8], xmm0
mov word [r11 - 0x570], r13w
mov byte [rsp + 0x2a0], r13b
lea rdx, str.srl::Applications::Detect
lea rcx, [r11 - 0x570]
call fcn.140009b0c
nop
call fcn.14001ff80
cmp dword [rax + 8], 4
jl 0x14003d7ca
lea rcx, [rsp + 0x2a0]
call fcn.140015b20
nop
lea rsi, vtable.srl::Exists.0
mov qword [rsp + 0x118], rsi
mov byte [rsp + 0x120], 0
mov edx, 0x116f3
lea rcx, [rsp + 0x458]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x118]
mov rdx, rax
call fcn.14004dd30
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x458], rdi
mov rdx, qword [rsp + 0x478]
cmp rdx, 8
jb 0x14003d860
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x460]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d85a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003eee9
call fcn.14000410c
nop
mov qword [rsp + 0x128], rsi
mov byte [rsp + 0x130], 0
mov edx, 0x116f5
lea rcx, [rsp + 0x488]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x488], rdi
mov rdx, qword [rsp + 0x4a8]
cmp rdx, 8
jb 0x14003d8e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d8e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003eeef
call fcn.14000410c
nop
mov qword [rsp + 0x138], rsi
mov byte [rsp + 0x140], 0
mov edx, 0x116f7
lea rcx, [rsp + 0x4b8]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x4b8], rdi
mov rdx, qword [rsp + 0x4d8]
cmp rdx, 8
jb 0x14003d970
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d96a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003eef5
call fcn.14000410c
nop
mov qword [rsp + 0x148], rsi
mov byte [rsp + 0x150], 0
mov edx, 0x116f9
lea rcx, [rsp + 0x4e8]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x4e8], rdi
mov rdx, qword [rsp + 0x508]
cmp rdx, 8
jb 0x14003d9f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d9f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003eefb
call fcn.14000410c
nop
mov qword [rsp + 0x158], rsi
mov byte [rsp + 0x160], 0
mov edx, 0x116fb
lea rcx, [rsp + 0x518]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x518], rdi
mov rdx, qword [rsp + 0x538]
cmp rdx, 8
jb 0x14003da80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x520]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003da7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef01
call fcn.14000410c
nop
mov qword [rsp + 0x168], rsi
mov byte [rsp + 0x170], 0
mov edx, 0x11702
lea rcx, [rsp + 0x548]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x548], rdi
mov rdx, qword [rsp + 0x568]
cmp rdx, 8
jb 0x14003db08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x550]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003db02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef07
call fcn.14000410c
nop
mov qword [rsp + 0x100], r13
mov dword [rsp + 0x108], r13d
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMacromediaFlashPlayer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003dbca
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x100], rcx
mov dword [rsp + 0x108], r13d
mov dword [rsp + 0x48], 0x28
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6f8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.CurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003dbca
mov eax, dword [rsp + 0x50]
dec eax
cmp eax, 1
ja 0x14003dbca
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14003dc7a
test al, 1
jne 0x14003dbca
shr rax, 1
cmp word [rsp + rax*2 + 0x6f6], 0
je 0x14003dc83
mov r15, 0xffffffffffffffff
lea r12, vtable.srl::Version.0
mov qword [rsp + 0x1e0], r13
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1f8], 7
mov word [rsp + 0x1e0], r13w
lea rdx, str.wmplayer.exe
lea rcx, [rsp + 0x2c8]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2c8]
call fcn.14003cca0
movzx ebx, al
mov rdx, qword [rsp + 0x2e0]
cmp rdx, 8
jb 0x14003de36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003de31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef0d
jmp 0x14003de31
mov word [rsp + 0x6f8], r13w
mov qword [rsp + 0x178], rsi
mov byte [rsp + 0x180], 1
mov edx, 0x116f1
lea rcx, [rsp + 0x578]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x178]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x578], rdi
mov rdx, qword [rsp + 0x598]
cmp rdx, 8
jb 0x14003dd0b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x580]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dd05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef13
call fcn.14000410c
nop
lea r12, vtable.srl::Version.0
mov qword [rsp + 0x78], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ef19
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x6f8]
mov r15, 0xffffffffffffffff
mov rax, r15
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003dd50
mov r8d, eax
lea rdx, [rsp + 0x6f8]
lea rcx, [rsp + 0x80]
call fcn.140002aa8
nop
mov edx, 0x116f2
lea rcx, [rsp + 0x368]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x368], rdi
mov rdx, qword [rsp + 0x388]
cmp rdx, 8
jb 0x14003dde7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dde2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef24
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c55e0]
movdqu xmmword [rsp + 0x380], xmm0
mov word [rsp + 0x370], r13w
mov qword [rsp + 0x78], r12
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003dbd8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003dbd8
call fcn.14000410c
test bl, bl
je 0x14003e07f
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x230], r13
mov qword [rsp + 0x238], 7
mov word [rsp + 0x220], r13w
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x1e0]
call fcn.14003cae0
test al, al
je 0x14003e037
mov qword [rsp + 0x188], rsi
mov byte [rsp + 0x190], 1
mov edx, 0x116f3
lea rcx, [rsp + 0x5a8]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x188]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x5a8], rdi
mov rdx, qword [rsp + 0x5c8]
cmp rdx, 8
jb 0x14003df08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003df02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef2a
call fcn.14000410c
nop
mov qword [rsp + 0x88], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ef30
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
jb 0x14003df58
mov rdx, qword [rsp + 0x220]
test rdx, rdx
jne 0x14003df58
mov eax, r13d
jmp 0x14003df6a
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003df60
mov r8d, eax
lea rcx, [rsp + 0x90]
call fcn.140002aa8
nop
mov edx, 0x11611
lea rcx, [rsp + 0x398]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x88]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x398], rdi
mov rdx, qword [rsp + 0x3b8]
cmp rdx, 8
jb 0x14003dff2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dfed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef3b
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c55e0]
movdqu xmmword [rsp + 0x3b0], xmm0
mov word [rsp + 0x3a0], r13w
mov qword [rsp + 0x88], r12
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003e037
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x238]
cmp rdx, 8
jb 0x14003e07f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e07a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef98
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.AcroRd32.exe
lea rcx, [rsp + 0x2e8]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2e8]
call fcn.14003cca0
movzx ebx, al
mov rdx, qword [rsp + 0x300]
cmp rdx, 8
jb 0x14003e11a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e115
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef41
call fcn.14000410c
test bl, bl
je 0x14003e35f
mov qword [rsp + 0x240], r13
mov qword [rsp + 0x250], r13
mov qword [rsp + 0x258], 7
mov word [rsp + 0x240], r13w
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x1e0]
call fcn.14003cae0
test al, al
je 0x14003e317
mov qword [rsp + 0x198], rsi
mov byte [rsp + 0x1a0], 1
mov edx, 0x116f5
lea rcx, [rsp + 0x5d8]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x198]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x5d8], rdi
mov rdx, qword [rsp + 0x5f8]
cmp rdx, 8
jb 0x14003e1ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e1e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef47
call fcn.14000410c
nop
mov qword [rsp + 0x98], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ef4d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x240]
cmp qword [rsp + 0x258], 8
jb 0x14003e23c
mov rdx, qword [rsp + 0x240]
test rdx, rdx
jne 0x14003e23c
mov eax, r13d
jmp 0x14003e24a
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003e240
mov r8d, eax
lea rcx, [rsp + 0xa0]
call fcn.140002aa8
nop
mov edx, 0x116f6
lea rcx, [rsp + 0x3c8]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x98]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x3c8], rdi
mov rdx, qword [rsp + 0x3e8]
cmp rdx, 8
jb 0x14003e2d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e2cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef58
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c55e0]
movdqu xmmword [rsp + 0x3e0], xmm0
mov word [rsp + 0x3d0], r13w
mov qword [rsp + 0x98], r12
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003e317
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x258]
cmp rdx, 8
jb 0x14003e35f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e35a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef98
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.QuickTimePlayer.exe
lea rcx, [rsp + 0x308]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x308]
call fcn.14003cca0
movzx ebx, al
mov rdx, qword [rsp + 0x320]
cmp rdx, 8
jb 0x14003e3fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e3f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef5e
call fcn.14000410c
test bl, bl
je 0x14003e63f
mov qword [rsp + 0x260], r13
mov qword [rsp + 0x270], r13
mov qword [rsp + 0x278], 7
mov word [rsp + 0x260], r13w
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x1e0]
call fcn.14003cae0
test al, al
je 0x14003e5f7
mov qword [rsp + 0x1a8], rsi
mov byte [rsp + 0x1b0], 1
mov edx, 0x116f7
lea rcx, [rsp + 0x608]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x1a8]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x608], rdi
mov rdx, qword [rsp + 0x628]
cmp rdx, 8
jb 0x14003e4cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x610]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e4c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef64
call fcn.14000410c
nop
mov qword [rsp + 0xa8], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ef6a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
jb 0x14003e51c
mov rdx, qword [rsp + 0x260]
test rdx, rdx
jne 0x14003e51c
mov eax, r13d
jmp 0x14003e52a
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003e520
mov r8d, eax
lea rcx, [rsp + 0xb0]
call fcn.140002aa8
nop
mov edx, 0x116f8
lea rcx, [rsp + 0x3f8]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x3f8], rdi
mov rdx, qword [rsp + 0x418]
cmp rdx, 8
jb 0x14003e5b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e5ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef75
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c55e0]
movdqu xmmword [rsp + 0x410], xmm0
mov word [rsp + 0x400], r13w
mov qword [rsp + 0xa8], r12
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003e5f7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x278]
cmp rdx, 8
jb 0x14003e63f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e63a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef98
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.Winword.exe
lea rcx, [rsp + 0x328]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x328]
call fcn.14003cca0
movzx ebx, al
mov rdx, qword [rsp + 0x340]
cmp rdx, 8
jb 0x14003e6da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e6d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef7b
call fcn.14000410c
test bl, bl
je 0x14003e91f
mov qword [rsp + 0x280], r13
mov qword [rsp + 0x290], r13
mov qword [rsp + 0x298], 7
mov word [rsp + 0x280], r13w
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x1e0]
call fcn.14003cae0
test al, al
je 0x14003e8d7
mov qword [rsp + 0x1b8], rsi
mov byte [rsp + 0x1c0], 1
mov edx, 0x116f9
lea rcx, [rsp + 0x638]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x1b8]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x638], rdi
mov rdx, qword [rsp + 0x658]
cmp rdx, 8
jb 0x14003e7ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x640]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e7a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef81
call fcn.14000410c
nop
mov qword [rsp + 0xb8], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ef87
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x280]
cmp qword [rsp + 0x298], 8
jb 0x14003e7fc
mov rdx, qword [rsp + 0x280]
test rdx, rdx
jne 0x14003e7fc
mov eax, r13d
jmp 0x14003e80a
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003e800
mov r8d, eax
lea rcx, [rsp + 0xc0]
call fcn.140002aa8
nop
mov edx, 0x116fa
lea rcx, [rsp + 0x428]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0xb8]
mov rdx, rax
call fcn.14004dd30
nop
mov qword [rsp + 0x428], rdi
mov rdx, qword [rsp + 0x448]
cmp rdx, 8
jb 0x14003e892
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x430]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e88d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef92
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c55e0]
movdqu xmmword [rsp + 0x440], xmm0
mov word [rsp + 0x430], r13w
mov qword [rsp + 0xb8], r12
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003e8d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x298]
cmp rdx, 8
jb 0x14003e91f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e91a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef98
call fcn.14000410c
mov qword [rsp + 0x200], r13
mov qword [rsp + 0x210], r13
mov qword [rsp + 0x218], 7
mov word [rsp + 0x200], r13w
lea rdx, str.3F0FC462_CDC1_4CD9_8E84_84D89B914EAA
lea rcx, [rsp + 0x348]
call fcn.140009744
nop
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x348]
call fcn.14003d060
movzx ebx, al
mov rdx, qword [rsp + 0x360]
cmp rdx, 8
jb 0x14003e9b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x348]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e9b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ef9e
call fcn.14000410c
test bl, bl
je 0x14003eada
mov qword [rsp + 0x1c8], rsi
mov byte [rsp + 0x1d0], 1
mov edx, 0x11702
lea rcx, [rsp + 0x668]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0x1c8]
mov rdx, rax
call fcn.14004dd30
nop
lea rcx, [rsp + 0x668]
call fcn.140021910
nop
mov qword [rsp + 0xc8], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003efa4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0x200]
cmp qword [rsp + 0x218], 8
jb 0x14003ea56
mov rdx, qword [rsp + 0x200]
test rdx, rdx
jne 0x14003ea56
mov eax, r13d
jmp 0x14003ea6a
mov rax, r15
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003ea60
mov r8d, eax
lea rcx, [rsp + 0xd0]
call fcn.140002aa8
nop
mov edx, 0x11703
lea rcx, [rsp + 0x698]
call fcn.140021780
nop
xor r9d, r9d
lea r8, [rsp + 0xc8]
mov rdx, rax
call fcn.14004dd30
nop
lea rcx, [rsp + 0x698]
call fcn.140021910
nop
mov qword [rsp + 0xc8], r12
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003eada
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, r13
mov qword [rsp + 0xd8], r13
mov dword [rsp + 0xe0], r13d
mov qword [rsp + 0xe8], r13
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREJavaSoftJava_Runtime_Environment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003eb41
mov eax, r13d
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], r13d
test eax, eax
je 0x14003eba6
mov qword [rsp + 0x68], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SOFTWAREJavaSoftJava_Runtime_Environment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003edbb
mov eax, r13d
test rdi, rdi
je 0x14003eb86
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x68]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], 0x200
test eax, eax
jne 0x14003edbb
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003efaf
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [0x1402b9b30]
cmp rdx, 0x10000
jae 0x14003ebe5
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.140010ac0
jmp 0x14003ec08
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003ebf0
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140002aa8
nop
xor r14b, r14b
mov esi, r13d
mov dword [rsp + 0x4c], 0x64
test r14b, r14b
jne 0x14003ecb6
mov dword [rsp + 0x4c], 0x64
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x720]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x14003ec67
mov r14b, 1
jmp 0x14003ec16
mov rax, qword [rsp + 0x40]
mov ebx, dword [rax - 0x10]
lea rcx, [rsp + 0x720]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jle 0x14003ecaf
lea rcx, [rsp + 0x720]
mov rax, r15
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003ec90
mov r8d, eax
lea rdx, [rsp + 0x720]
lea rcx, [rsp + 0x40]
call fcn.140002aa8
inc esi
jmp 0x14003ec16
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
jle 0x14003ed95
mov edx, 0x5f
lea rcx, [rsp + 0x40]
call fcn.14003efd0
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax - 0x10]
add r9d, 0xfffffffe
mov r8d, 2
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1400128c0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call fcn.140069fb0
mov rbx, rax
mov edx, 0x1171e
lea rcx, [rsp + 0x6c8]
call fcn.140021780
nop
xor r9d, r9d
mov r8, rbx
mov rdx, rax
call fcn.14004dd30
nop
lea rcx, [rsp + 0x6c8]
call fcn.140021910
nop
mov qword [rsp + 0xf0], r12
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003ed66
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, vtable.srl::Value.0
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003ed95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14003edb3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0xd8]
test rdi, rdi
je 0x14003edca
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 8
jb 0x14003ee12
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ee0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003efba
call fcn.14000410c
mov qword [rsp + 0x210], r13
mov qword [rsp + 0x218], 7
mov word [rsp + 0x200], r13w
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 8
jb 0x14003ee77
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ee72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003efc0
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1f8], 7
mov word [rsp + 0x1e0], r13w
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x14003eea8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x2a0]
call fcn.140017440
mov al, 1
mov rcx, qword [rsp + 0x7f0]
xor rcx, rsp
call fcn.140211820
lea r11, [rsp + 0x800]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
int3
mov ecx, 0x80004005
call fcn.140002d2c
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
int3