Function at 0x1400403a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x690
mov rax, qword [0x14030b930]
xor rax, rsp
mov qword [rsp + 0x688], rax
xor r14d, r14d
mov qword [rsp + 0x240], r14
movdqa xmm0, xmmword [0x1402c6510]
movdqu xmmword [rsp + 0x250], xmm0
mov word [rsp + 0x240], r14w
mov byte [rsp + 0x238], r14b
lea rdx, str.srl::Applications::Detect
lea rcx, [rsp + 0x240]
call fcn.140009944
nop
call fcn.14001fe60
cmp dword [rax + 8], 4
jl 0x140040429
lea rcx, [rsp + 0x238]
call fcn.140015c90
nop
lea r12, vtable.srl::Exists.0
mov qword [rsp + 0xb8], r12
mov byte [rsp + 0xc0], 0
mov edx, 0x116f3
lea rcx, [rsp + 0x3f0]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0xb8]
mov rdx, rax
call fcn.14004e8b0
nop
lea r15, vtable.srl::GroupID.0
mov qword [rsp + 0x3f0], r15
mov rdx, qword [rsp + 0x410]
cmp rdx, 8
jb 0x1400404bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400404b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041813
call fcn.140004104
nop
mov qword [rsp + 0xc8], r12
mov byte [rsp + 0xd0], 0
mov edx, 0x116f5
lea rcx, [rsp + 0x420]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0xc8]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x420], r15
mov rdx, qword [rsp + 0x440]
cmp rdx, 8
jb 0x140040547
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x428]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040541
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041819
call fcn.140004104
nop
mov qword [rsp + 0xd8], r12
mov byte [rsp + 0xe0], 0
mov edx, 0x116f7
lea rcx, [rsp + 0x450]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0xd8]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x450], r15
mov rdx, qword [rsp + 0x470]
cmp rdx, 8
jb 0x1400405cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x458]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400405c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004181f
call fcn.140004104
nop
mov qword [rsp + 0xe8], r12
mov byte [rsp + 0xf0], 0
mov edx, 0x116f9
lea rcx, [rsp + 0x480]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0xe8]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x480], r15
mov rdx, qword [rsp + 0x4a0]
cmp rdx, 8
jb 0x140040657
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x488]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040651
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041825
call fcn.140004104
nop
mov qword [rsp + 0xf8], r12
mov byte [rsp + 0x100], 0
mov edx, 0x116fb
lea rcx, [rsp + 0x4b0]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0xf8]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x4b0], r15
mov rdx, qword [rsp + 0x4d0]
cmp rdx, 8
jb 0x1400406df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400406d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004182b
call fcn.140004104
nop
mov qword [rsp + 0x108], r12
mov byte [rsp + 0x110], 0
mov edx, 0x11702
lea rcx, [rsp + 0x4e0]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x108]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x4e0], r15
mov rdx, qword [rsp + 0x500]
cmp rdx, 8
jb 0x140040767
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040761
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041831
call fcn.140004104
nop
mov qword [rsp + 0xa0], r14
mov dword [rsp + 0xa8], r14d
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMacromediaFlashPlayer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140040829
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0xa0], rcx
mov dword [rsp + 0xa8], r14d
mov dword [rsp + 0x30], 0x28
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x660]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.CurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140040829
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x140040829
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400408d9
test al, 1
jne 0x140040829
shr rax, 1
cmp word [rsp + rax*2 + 0x65e], 0
je 0x1400408e2
mov rdi, 0xffffffffffffffff
lea rsi, vtable.srl::Version.0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], 7
mov word [rsp + 0x178], r14w
lea rdx, str.wmplayer.exe
lea rcx, [rsp + 0x260]
call fcn.14000957c
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x260]
call fcn.14003f910
movzx ebx, al
mov rdx, qword [rsp + 0x278]
cmp rdx, 8
jb 0x140040a8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041837
jmp 0x140040a8a
mov word [rsp + 0x660], r14w
mov qword [rsp + 0x118], r12
mov byte [rsp + 0x120], 1
mov edx, 0x116f1
lea rcx, [rsp + 0x510]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x118]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x510], r15
mov rdx, qword [rsp + 0x530]
cmp rdx, 8
jb 0x14004096a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040964
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004183d
call fcn.140004104
nop
lea rsi, vtable.srl::Version.0
mov qword [rsp + 0x40], rsi
call fcn.140010400
mov rcx, rax
test rax, rax
je 0x140041843
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x660]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400409b0
mov r8d, eax
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0x48]
call fcn.140002a88
nop
mov edx, 0x116f2
lea rcx, [rsp + 0x300]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x40]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x300], r15
mov rdx, qword [rsp + 0x320]
cmp rdx, 8
jb 0x140040a44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004184e
call fcn.140004104
movdqa xmm0, xmmword [0x1402c6510]
movdqu xmmword [rsp + 0x318], xmm0
mov word [rsp + 0x308], r14w
mov qword [rsp + 0x40], rsi
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040837
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140040837
call fcn.140004104
test bl, bl
je 0x140040cc2
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1c8], r14
mov qword [rsp + 0x1d0], 7
mov word [rsp + 0x1b8], r14w
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x178]
call fcn.14003f750
test al, al
je 0x140040c7a
mov qword [rsp + 0x128], r12
mov byte [rsp + 0x130], 1
mov edx, 0x116f3
lea rcx, [rsp + 0x540]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x540], r15
mov rdx, qword [rsp + 0x560]
cmp rdx, 8
jb 0x140040b61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040b5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041854
call fcn.140004104
nop
mov qword [rsp + 0x50], rsi
call fcn.140010400
mov rcx, rax
test rax, rax
je 0x14004185a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
jb 0x140040bab
mov rdx, qword [rsp + 0x1b8]
test rdx, rdx
jne 0x140040bab
mov eax, r14d
jmp 0x140040bba
mov rax, rdi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140040bb0
mov r8d, eax
lea rcx, [rsp + 0x58]
call fcn.140002a88
nop
mov edx, 0x11611
lea rcx, [rsp + 0x330]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x330], r15
mov rdx, qword [rsp + 0x350]
cmp rdx, 8
jb 0x140040c3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x338]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040c37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041865
call fcn.140004104
movdqa xmm0, xmmword [0x1402c6510]
movdqu xmmword [rsp + 0x348], xmm0
mov word [rsp + 0x338], r14w
mov qword [rsp + 0x50], rsi
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040c7a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x1d0]
cmp rdx, 8
jb 0x140040cc2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040cbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400418d3
call fcn.140004104
mov qword [rsp + 0x188], r14
lea rax, [rsp + 0x178]
cmp qword [rsp + 0x190], 8
cmovae rax, qword [rsp + 0x178]
mov word [rax], r14w
lea rdx, str.AcroRd32.exe
lea rcx, [rsp + 0x280]
call fcn.14000957c
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x280]
call fcn.14003f910
movzx ebx, al
mov rdx, qword [rsp + 0x298]
cmp rdx, 8
jb 0x140040d5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004186b
call fcn.140004104
test bl, bl
je 0x140040f92
mov qword [rsp + 0x1d8], r14
mov qword [rsp + 0x1e8], r14
mov qword [rsp + 0x1f0], 7
mov word [rsp + 0x1d8], r14w
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x178]
call fcn.14003f750
test al, al
je 0x140040f4a
mov qword [rsp + 0x138], r12
mov byte [rsp + 0x140], 1
mov edx, 0x116f5
lea rcx, [rsp + 0x570]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x570], r15
mov rdx, qword [rsp + 0x590]
cmp rdx, 8
jb 0x140040e2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x578]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040e29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041871
call fcn.140004104
nop
mov qword [rsp + 0x60], rsi
call fcn.140010400
mov rcx, rax
test rax, rax
je 0x140041877
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x1d8]
cmp qword [rsp + 0x1f0], 8
jb 0x140040e79
mov rdx, qword [rsp + 0x1d8]
test rdx, rdx
jne 0x140040e79
mov eax, r14d
jmp 0x140040e8a
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140040e80
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.140002a88
nop
mov edx, 0x116f6
lea rcx, [rsp + 0x360]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x360], r15
mov rdx, qword [rsp + 0x380]
cmp rdx, 8
jb 0x140040f0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x368]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040f07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041882
call fcn.140004104
movdqa xmm0, xmmword [0x1402c6510]
movdqu xmmword [rsp + 0x378], xmm0
mov word [rsp + 0x368], r14w
mov qword [rsp + 0x60], rsi
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040f4a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x1f0]
cmp rdx, 8
jb 0x140040f92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040f8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400418d3
call fcn.140004104
mov qword [rsp + 0x188], r14
lea rax, [rsp + 0x178]
cmp qword [rsp + 0x190], 8
cmovae rax, qword [rsp + 0x178]
mov word [rax], r14w
lea rdx, str.QuickTimePlayer.exe
lea rcx, [rsp + 0x2a0]
call fcn.14000957c
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x2a0]
call fcn.14003f910
movzx ebx, al
mov rdx, qword [rsp + 0x2b8]
cmp rdx, 8
jb 0x14004102d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041028
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041888
call fcn.140004104
test bl, bl
je 0x140041262
mov qword [rsp + 0x1f8], r14
mov qword [rsp + 0x208], r14
mov qword [rsp + 0x210], 7
mov word [rsp + 0x1f8], r14w
lea rdx, [rsp + 0x1f8]
lea rcx, [rsp + 0x178]
call fcn.14003f750
test al, al
je 0x14004121a
mov qword [rsp + 0x148], r12
mov byte [rsp + 0x150], 1
mov edx, 0x116f7
lea rcx, [rsp + 0x5a0]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x5a0], r15
mov rdx, qword [rsp + 0x5c0]
cmp rdx, 8
jb 0x1400410ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400410f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004188e
call fcn.140004104
nop
mov qword [rsp + 0x70], rsi
call fcn.140010400
mov rcx, rax
test rax, rax
je 0x140041894
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x1f8]
cmp qword [rsp + 0x210], 8
jb 0x140041149
mov rdx, qword [rsp + 0x1f8]
test rdx, rdx
jne 0x140041149
mov eax, r14d
jmp 0x14004115a
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140041150
mov r8d, eax
lea rcx, [rsp + 0x78]
call fcn.140002a88
nop
mov edx, 0x116f8
lea rcx, [rsp + 0x390]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x70]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x390], r15
mov rdx, qword [rsp + 0x3b0]
cmp rdx, 8
jb 0x1400411dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x398]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400411d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004189f
call fcn.140004104
movdqa xmm0, xmmword [0x1402c6510]
movdqu xmmword [rsp + 0x3a8], xmm0
mov word [rsp + 0x398], r14w
mov qword [rsp + 0x70], rsi
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004121a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x210]
cmp rdx, 8
jb 0x140041262
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004125d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400418d3
call fcn.140004104
mov qword [rsp + 0x188], r14
lea rax, [rsp + 0x178]
cmp qword [rsp + 0x190], 8
cmovae rax, qword [rsp + 0x178]
mov word [rax], r14w
lea rdx, str.Winword.exe
lea rcx, [rsp + 0x2c0]
call fcn.14000957c
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x2c0]
call fcn.14003f910
movzx ebx, al
mov rdx, qword [rsp + 0x2d8]
cmp rdx, 8
jb 0x1400412fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400412f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400418a5
call fcn.140004104
test bl, bl
je 0x140041540
mov qword [rsp + 0x218], r14
mov qword [rsp + 0x228], r14
mov qword [rsp + 0x230], 7
mov word [rsp + 0x218], r14w
lea rdx, [rsp + 0x218]
lea rcx, [rsp + 0x178]
call fcn.14003f750
test al, al
je 0x1400414f8
mov qword [rsp + 0x158], r12
mov byte [rsp + 0x160], 1
mov edx, 0x116f9
lea rcx, [rsp + 0x5d0]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x5d0], r15
mov rdx, qword [rsp + 0x5f0]
cmp rdx, 8
jb 0x1400413cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400413c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400418ab
call fcn.140004104
nop
mov qword [rsp + 0x80], rsi
call fcn.140010400
mov rcx, rax
test rax, rax
je 0x1400418b1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x218]
cmp qword [rsp + 0x230], 8
jb 0x14004141f
mov rdx, qword [rsp + 0x218]
test rdx, rdx
jne 0x14004141f
mov eax, r14d
jmp 0x14004142c
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140041422
mov r8d, eax
lea rcx, [rsp + 0x88]
call fcn.140002a88
nop
mov edx, 0x116fa
lea rcx, [rsp + 0x3c0]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x80]
mov rdx, rax
call fcn.14004e8b0
nop
mov qword [rsp + 0x3c0], r15
mov rdx, qword [rsp + 0x3e0]
cmp rdx, 8
jb 0x1400414b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400414af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400418bc
call fcn.140004104
movdqa xmm0, xmmword [0x1402c6510]
movdqu xmmword [rsp + 0x3d8], xmm0
mov word [rsp + 0x3c8], r14w
mov qword [rsp + 0x80], rsi
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400414f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x230]
cmp rdx, 8
jb 0x140041540
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004153b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400418d3
call fcn.140004104
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x1a8], r14
mov qword [rsp + 0x1b0], 7
mov word [rsp + 0x198], r14w
lea rdx, str.3F0FC462_CDC1_4CD9_8E84_84D89B914EAA
lea rcx, [rsp + 0x2e0]
call fcn.14000957c
nop
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x2e0]
call fcn.14003fcc0
movzx ebx, al
mov rdx, qword [rsp + 0x2f8]
cmp rdx, 8
jb 0x1400415da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400415d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400418c2
call fcn.140004104
test bl, bl
je 0x1400416f8
mov qword [rsp + 0x168], r12
mov byte [rsp + 0x170], 1
mov edx, 0x11702
lea rcx, [rsp + 0x600]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.14004e8b0
nop
lea rcx, [rsp + 0x600]
call fcn.140021810
nop
mov qword [rsp + 0x90], rsi
call fcn.140010400
mov rcx, rax
test rax, rax
je 0x1400418c8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x198]
cmp qword [rsp + 0x1b0], 8
jb 0x140041677
mov rdx, qword [rsp + 0x198]
test rdx, rdx
jne 0x140041677
mov eax, r14d
jmp 0x14004168a
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140041680
mov r8d, eax
lea rcx, [rsp + 0x98]
call fcn.140002a88
nop
mov edx, 0x11703
lea rcx, [rsp + 0x630]
call fcn.140021680
nop
xor r9d, r9d
lea r8, [rsp + 0x90]
mov rdx, rax
call fcn.14004e8b0
nop
lea rcx, [rsp + 0x630]
call fcn.140021810
nop
mov qword [rsp + 0x90], rsi
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400416f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x1b0]
cmp rdx, 8
jb 0x140041740
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004173b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400418d3
call fcn.140004104
mov qword [rsp + 0x1a8], r14
mov qword [rsp + 0x1b0], 7
mov word [rsp + 0x198], r14w
mov rdx, qword [rsp + 0x190]
cmp rdx, 8
jb 0x1400417a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400417a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400418d9
call fcn.140004104
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], 7
mov word [rsp + 0x178], r14w
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x1400417d6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x238]
call fcn.140017560
mov al, 1
mov rcx, qword [rsp + 0x688]
xor rcx, rsp
call fcn.140212a70
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.14021b87c
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
mov ecx, 0x80004005
call fcn.140002d08
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
mov ecx, 0x80004005
call fcn.140002d08
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
mov ecx, 0x80004005
call fcn.140002d08
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
mov ecx, 0x80004005
call fcn.140002d08
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
call fcn.14021b87c
nop
mov ecx, 0x80004005
call fcn.140002d08
nop
call fcn.14021b87c
nop
call fcn.14021b87c
int3
mov ecx, 0x80004005
call fcn.140002d08
nop
call fcn.14021b87c
nop
call fcn.14021b87c
int3