Function at 0x140034dd0
Capabilities:
Delete registry key
Delete registry value
Persist via default file association registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x598]
sub rsp, 0x698
mov r14, r9
movzx r12d, r8b
mov rdi, rdx
mov r13, rcx
xor r15d, r15d
mov dword [rbp + 0x5f0], r15d
mov rbx, qword [rdx]
lea esi, [r15 - 1]
cmp dword [rbx - 0x10], r15d
jle 0x140034e88
lea rdx, [0x1400c90a0]
mov rcx, rbx
call fcn.14008f9a4
test rax, rax
je 0x140034e88
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140034e88
mov r8d, eax
lea rdx, [rbp + 0x130]
mov rcx, rdi
call fcn.140011e80
nop
mov rdx, rax
mov rcx, rdi
call fcn.1400103b0
nop
mov rdx, qword [rbp + 0x130]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140034e88
mov eax, dword [rdx + 0x10]
cmp eax, esi
je 0x140034e7e
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140034e88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
call fcn.140002000
mov rcx, rax
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
jg 0x140034ea1
mov rdx, qword [rcx]
call qword [rdx + 0x30]
jmp 0x140034ed7
mov eax, dword [rax - 8]
mov rdx, qword [rdi]
cmp eax, 0xffffffff
jne 0x140034eca
mov rax, qword [rcx]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, esi
mov r8d, dword [rdx - 0x10]
call qword [rax + 0x28]
jmp 0x140034ed7
cmp rcx, qword [rdx - 0x18]
jne 0x140034eac
lock inc dword [rdx - 8]
mov rax, qword [rdi]
mov qword [rbp - 0x60], rax
lea r8, str._shellopencommand_
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x58]
call fcn.140017010
nop
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, esi
mov r8d, esi
lea rdx, str.URL:
mov rcx, rax
call qword [r10 + 0x28]
mov qword [rbp + 0xd0], rax
mov r8, rdi
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x138]
call fcn.140016f20
nop
lea r8, [0x1400ca620]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140017010
nop
mov rdx, qword [rbp + 0x138]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140034f80
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140034f76
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140034f80
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140034fb3
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140034fa9
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140034fb3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, esi
mov r8d, esi
lea rdx, [0x1400c5494]
mov rcx, rax
call qword [r10 + 0x28]
mov qword [rsp + 0x78], rax
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, esi
mov r8d, esi
lea rdx, [0x1400c551c]
mov rcx, rax
call qword [r10 + 0x28]
mov qword [rbp + 0x78], rax
mov rax, qword [r13 + 0x10]
mov ebx, 0x10
mov ecx, 0x20
cmp dword [rax - 0x10], 0
cmovle ebx, ecx
call fcn.140002000
mov r10, rax
mov rax, qword [rbx + r13]
cmp dword [rax - 0x10], 0
jg 0x140035044
mov rdx, qword [r10]
mov rcx, r10
call qword [rdx + 0x30]
jmp 0x140035082
mov eax, dword [rax - 8]
mov rcx, qword [rbx + r13]
cmp eax, 0xffffffff
jne 0x140035074
mov rax, qword [r10]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, esi
mov r8d, dword [rcx - 0x10]
mov rdx, rcx
mov rcx, r10
call qword [rax + 0x28]
jmp 0x140035082
cmp r10, qword [rcx - 0x18]
jne 0x140035050
lock inc dword [rcx - 8]
mov rax, qword [rbx + r13]
mov qword [rbp - 0x20], rax
mov dword [rbp + 0x5f0], 8
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x150]
call fcn.140016f20
nop
lea r8, [0x1400c9d2c]
mov rdx, rax
lea rcx, [rbp + 0x148]
call fcn.140017010
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140016f20
nop
lea r8, str.___L_
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140017010
nop
mov rdx, qword [rbp + 0x140]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035116
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003510c
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035116
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035149
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003513f
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035149
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x150]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x14003517c
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035172
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003517c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400351ac
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400351a2
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400351ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400351dc
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400351d2
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400351dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x58], r15d
xor r8d, r8d
mov rdx, qword [rbp - 0x60]
mov rcx, 0xffffffff80000000
test r12b, r12b
je 0x140035250
mov qword [rbp + 0x80], r15
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140035294
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140035247
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp + 0x80]
jmp 0x14003528a
mov qword [rbp + 0x88], r15
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140035294
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140035283
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp + 0x88]
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
xor r8d, r8d
mov rdx, qword [rbp + 0x58]
mov rcx, 0xffffffff80000000
test r12b, r12b
je 0x140035308
mov qword [rbp + 0xc8], r15
lea rax, [rbp + 0xfc]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003534c
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400352ff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp + 0xc8]
jmp 0x140035342
mov qword [rbp + 0x90], r15
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003534c
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14003533b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp + 0x90]
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x60], rax
mov r14, qword [rbp - 0x50]
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400354ab
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x18]
xor r8d, r8d
lea rdx, str.URL_Protocol
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400354ab
cmp dword [rbp + 0x18], 1
jne 0x1400354ab
lea r9, [0x1400c5494]
lea r8, [0x1400c5494]
lea rdx, [rbp + 0x168]
lea rcx, [rsp + 0x50]
call fcn.140029c70
nop
mov dword [rbp + 0x5f0], 9
mov r15, qword [rax]
cmp r15, r14
je 0x1400353f5
lea rbx, [0x1400c5494]
test r14, r14
cmovne rbx, r14
call fcn.140002000
mov rcx, rax
mov r8, rbx
mov rdx, r15
call fcn.140001f10
test eax, eax
jne 0x1400354ab
lea r9, [0x1400c5494]
lea r8, str.URL_Protocol
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x50]
call fcn.140029c70
nop
mov dword [rbp + 0x5f0], 0xb
mov r15, qword [rax]
cmp r15, rdi
je 0x14003544c
lea rbx, [0x1400c5494]
test rdi, rdi
cmovne rbx, rdi
call fcn.140002000
mov rcx, rax
mov r8, rbx
mov rdx, r15
call fcn.140001f10
test eax, eax
jne 0x1400354ab
lea r9, [0x1400c5494]
lea r8, [0x1400c5494]
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x60]
call fcn.140029c70
nop
mov dword [rbp + 0x5f0], 0xf
mov rcx, qword [rbp - 0x28]
mov r15, qword [rax]
cmp r15, rcx
je 0x1400354a7
lea rbx, [0x1400c5494]
test rcx, rcx
cmovne rbx, rcx
call fcn.140002000
mov rcx, rax
mov r8, rbx
mov rdx, r15
call fcn.140001f10
test eax, eax
jne 0x1400354ab
mov bl, 1
jmp 0x1400354ad
xor bl, bl
mov eax, dword [rbp + 0x5f0]
test al, 4
je 0x1400354fa
and dword [rbp + 0x5f0], 0xfffffffb
mov rdx, qword [rbp + 0x158]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400354f1
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400354e7
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400354f1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov r14, qword [rbp - 0x50]
mov rdi, qword [rsp + 0x78]
mov eax, dword [rbp + 0x5f0]
test al, 2
je 0x140035547
and dword [rbp + 0x5f0], 0xfffffffd
mov rdx, qword [rbp + 0x160]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x14003553e
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035534
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003553e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov r14, qword [rbp - 0x50]
mov rdi, qword [rsp + 0x78]
mov eax, dword [rbp + 0x5f0]
test al, 1
je 0x140035594
and dword [rbp + 0x5f0], 0xfffffffe
mov rdx, qword [rbp + 0x168]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x14003558b
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035581
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003558b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov r14, qword [rbp - 0x50]
mov rdi, qword [rsp + 0x78]
test r12b, r12b
je 0x140035f60
test bl, bl
jne 0x140035c59
mov rcx, qword [rsp + 0x50]
xor r15d, r15d
test rcx, rcx
je 0x14003585b
lea rax, [rbp + 0x104]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x1c]
xor r8d, r8d
lea rdx, [0x1400c5494]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140035801
cmp dword [rbp + 0x1c], 1
jne 0x140035801
lea r9, [0x1400c5494]
lea r8, [0x1400c5494]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140029c70
nop
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], r15b
mov byte [rsp + 0x20], r15b
mov r9d, esi
mov r8d, esi
mov rdx, r14
mov rcx, rax
call qword [r10 + 0x28]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
jne 0x140035648
test rax, rax
je 0x140035644
cmp word [rax], cx
jne 0x14003569f
mov bl, 1
jmp 0x14003569f
test rax, rax
jne 0x140035652
cmp word [rcx], ax
jmp 0x14003569c
movzx edx, word [rcx]
cmp dx, word [rax]
jne 0x14003569f
mov r10d, r15d
cmp dx, r10w
je 0x14003568b
mov r9, r15
mov r8, r15
nop dword [rax]
cmp dx, word [r8 + rax]
jne 0x14003568b
inc r10d
inc r9
lea r8, [r9 + r9]
movzx edx, word [r8 + rcx]
test dx, dx
jne 0x140035670
movsxd rdx, r10d
lea r8, [rdx + rdx]
movzx edx, word [r8 + rax]
cmp word [r8 + rcx], dx
sete bl
lea rdx, [rax - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400356cb
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400356c1
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400356cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
test bl, bl
je 0x140035709
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400356ff
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400356f5
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400356ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdi, qword [rsp + 0x78]
jmp 0x14003585b
lea r8, [0x1400c5494]
lea rdx, [rbp + 0x68]
mov rcx, r13
call fcn.1400311c0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140035798
lea rax, [rbp + 0x108]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140035752
cmp dword [rbp + 0x20], 1
je 0x140035798
mov rbx, qword [rbp + 0x10]
mov rdi, qword [rbp + 0x68]
cmp qword [rsp + 0x50], 0
je 0x140035798
test rbx, rbx
je 0x140035798
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400357c8
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400357be
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400357c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400357f8
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400357ee
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400357f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov r14, qword [rbp - 0x50]
mov rdi, qword [rsp + 0x78]
test r14, r14
jne 0x14003581f
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14003585b
lea rdx, [0x1400c5494]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14003585b
cmp qword [rsp + 0x50], 0
je 0x14003585b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400c5494]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140035b02
lea rax, [rbp + 0x120]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x24]
xor r8d, r8d
lea rdx, str.URL_Protocol
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140035aa8
cmp dword [rbp + 0x24], 1
jne 0x140035aa8
lea r9, [0x1400c5494]
lea r8, str.URL_Protocol
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x50]
call fcn.140029c70
nop
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, esi
mov r8d, esi
mov rdx, rdi
mov rcx, rax
call qword [r10 + 0x28]
xor bl, bl
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jne 0x1400358fd
test rax, rax
je 0x1400358f9
cmp word [rax], cx
jne 0x14003594f
mov bl, 1
jmp 0x14003594f
test rax, rax
jne 0x140035907
cmp word [rcx], ax
jmp 0x14003594c
movzx edx, word [rcx]
cmp dx, word [rax]
jne 0x14003594f
mov r10d, r15d
cmp dx, 0
je 0x14003593b
mov r9, r15
mov r8, r15
nop
cmp dx, word [r8 + rax]
jne 0x14003593b
inc r10d
inc r9
lea r8, [r9 + r9]
movzx edx, word [r8 + rcx]
test dx, dx
jne 0x140035920
movsxd rdx, r10d
lea r8, [rdx + rdx]
movzx edx, word [r8 + rax]
cmp word [r8 + rcx], dx
sete bl
lea rdx, [rax - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x14003597b
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035971
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003597b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
test bl, bl
je 0x1400359b4
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400359af
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400359a5
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400359af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x140035b02
lea r8, str.URL_Protocol
lea rdx, [rbp + 0x70]
mov rcx, r13
call fcn.1400311c0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140035a43
lea rax, [rbp + 0x10c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x28]
xor r8d, r8d
mov rdx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400359fd
cmp dword [rbp + 0x28], 1
je 0x140035a43
mov rbx, qword [rbp - 0x18]
mov rdi, qword [rbp + 0x70]
cmp qword [rsp + 0x50], 0
je 0x140035a43
test rbx, rbx
je 0x140035a43
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035a73
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035a69
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035a73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035aa3
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035a99
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035aa3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdi, qword [rsp + 0x78]
test rdi, rdi
jne 0x140035ac6
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140035b02
lea rdx, str.URL_Protocol
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140035b02
cmp qword [rsp + 0x50], 0
je 0x140035b02
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.URL_Protocol
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140035c59
lea rax, [rbp + 0x184]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x2c]
xor r8d, r8d
lea rdx, [0x1400c5494]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140035ef0
cmp dword [rbp + 0x2c], 1
jne 0x140035ef0
lea r9, [0x1400c5494]
lea r8, [0x1400c5494]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140029c70
nop
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, esi
mov r8d, esi
mov rdx, qword [rbp - 0x28]
mov rcx, rax
call qword [r10 + 0x28]
xor bl, bl
mov rcx, qword [rbp - 0x10]
test rcx, rcx
jne 0x140035ba5
test rax, rax
je 0x140035ba1
cmp word [rax], cx
jne 0x140035bf5
mov bl, 1
jmp 0x140035bf5
test rax, rax
jne 0x140035baf
cmp word [rcx], ax
jmp 0x140035bf2
movzx edx, word [rcx]
cmp dx, word [rax]
jne 0x140035bf5
mov r10d, r15d
cmp dx, 0
je 0x140035be1
mov r9, r15
mov r8, r15
cmp dx, word [rax + r8]
jne 0x140035be1
inc r10d
inc r9
lea r8, [r9 + r9]
movzx edx, word [rcx + r8]
test dx, dx
jne 0x140035bc6
movsxd rdx, r10d
lea r8, [rdx + rdx]
movzx edx, word [rax + r8]
cmp word [r8 + rcx], dx
sete bl
lea rdx, [rax - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035c21
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035c17
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035c21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
test bl, bl
je 0x140035e01
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035c59
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035c4f
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035c59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
xor r12d, r12d
mov r15, qword [rbp + 0x5e8]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140035c78
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140035c92
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], r12d
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035cc7
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035cbd
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035cc7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035cf8
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035cee
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035cf8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035d28
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035d1e
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035d28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035d58
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035d4e
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035d58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035d88
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035d7e
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035d88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035db7
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035dad
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035db7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x5f8]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035deb
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035de1
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140035deb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov al, 1
add rsp, 0x698
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea r8, [0x1400c5494]
lea rdx, [rbp + 0x60]
mov rcx, r13
call fcn.1400311c0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140035e90
lea rax, [rbp + 0x180]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rdx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140035e4a
cmp dword [rbp + 0x30], 1
je 0x140035e90
mov rbx, qword [rbp - 0x10]
mov rdi, qword [rbp + 0x60]
cmp qword [rsp + 0x60], 0
je 0x140035e90
test rbx, rbx
je 0x140035e90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035ec0
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035eb6
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035ec0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140035ef0
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140035ee6
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035ef0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
cmp qword [rbp - 0x28], 0
jne 0x140035f17
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140035c59
lea rdx, [0x1400c5494]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140035c59
cmp qword [rsp + 0x60], 0
je 0x140035c59
mov rbx, qword [rbp - 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400c5494]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140035c59
test bl, bl
je 0x140035c59
cmp qword [rsp + 0x50], 0
je 0x1400365f0
lea r8, [0x1400c5494]
lea rdx, [rbp - 8]
mov rcx, r13
call fcn.1400311c0
nop
mov rcx, qword [rsp + 0x50]
xor r15d, r15d
test rcx, rcx
je 0x140036280
lea rax, [rbp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x34]
xor r8d, r8d
mov rdx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140036268
cmp dword [rbp + 0x34], 1
jne 0x140036268
mov r14, qword [rbp - 8]
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], r15b
mov byte [rsp + 0x20], r15b
mov r9d, esi
mov r8d, esi
lea rdx, [0x1400c5494]
mov rcx, rax
call qword [r10 + 0x28]
mov rbx, rax
mov qword [rbp - 0x58], rax
or dword [rbp + 0x5f0], 0x100
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400361db
mov dword [rbp - 0x7c], 1
mov dword [rbp - 0x80], r15d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x7c]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400361db
mov ecx, dword [rbp - 0x7c]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140036155
cmp ecx, 4
jne 0x1400361db
mov dword [rbp + 0x5e0], r15d
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140036137
mov dword [rbp + 0x38], 4
mov dword [rbp - 0x38], 0xffffffff
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x5e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400360b9
mov dword [rbp + 0x5e0], r15d
jmp 0x140036137
mov eax, dword [rbp - 0x38]
cmp eax, 4
je 0x140036137
mov dword [rbp + 0x5e0], r15d
cmp eax, 1
jne 0x140036137
lea r9, [0x1400c5494]
mov r8, r14
lea rdx, [rbp + 0x98]
lea rcx, [rsp + 0x50]
call fcn.140029c70
nop
mov rax, qword [rbp + 0x98]
cmp dword [rax - 0x10], 0
jle 0x14003610b
mov rcx, rax
call fcn.140017960
mov dword [rbp + 0x5e0], eax
mov rax, qword [rbp + 0x98]
lea rdx, [rax - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140036137
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003612d
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036137
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
movsxd rdx, dword [rbp + 0x5e0]
mov r9d, 0xa
xor r8d, r8d
lea rcx, [rbp - 0x58]
call fcn.140013580
jmp 0x1400361d7
mov edi, dword [rbp - 0x80]
inc rdi
shr rdi, 1
lea edx, [rdi + 1]
mov r9b, 1
xor r8d, r8d
lea rcx, [rbp - 0x58]
call fcn.140010590
mov rbx, rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x7c]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rcx, edi
mov word [rbx + rcx*2], r15w
mov rax, qword [rbp - 0x58]
test rax, rax
jne 0x1400361ac
mov edx, r15d
jmp 0x1400361c4
mov rdx, rax
nop
movzx ecx, word [rdx]
add rdx, 2
test cx, cx
jne 0x1400361b0
sub rdx, rax
sar rdx, 1
dec edx
mov dword [rax - 0x10], edx
mov ecx, dword [rax - 8]
cmp ecx, 0xffffffff
jne 0x1400361d7
mov ecx, 1
xchg dword [rax - 8], ecx
mov rbx, qword [rbp - 0x58]
cmp qword [rsp + 0x50], 0
je 0x140036230
test rbx, rbx
je 0x14003621c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400c5494]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140036230
mov rdx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
and dword [rbp + 0x5f0], 0xfffffeff
lea rdx, [rbx - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140036266
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003625c
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036266
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x140036280
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140036280
lea rdx, [0x1400c5494]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400362b0
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400362a6
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400362b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
cmp qword [rsp + 0x50], 0
je 0x1400365f0
lea r8, str.URL_Protocol
lea rdx, [rbp + 8]
mov rcx, r13
call fcn.1400311c0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400365c0
lea rax, [rbp + 0x128]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x3c]
xor r8d, r8d
mov rdx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400365a8
cmp dword [rbp + 0x3c], 1
jne 0x1400365a8
mov r14, qword [rbp + 8]
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, esi
mov r8d, esi
lea rdx, [0x1400c5494]
mov rcx, rax
call qword [r10 + 0x28]
mov rbx, rax
mov qword [rbp - 0x40], rax
or dword [rbp + 0x5f0], 0x200
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14003651b
mov dword [rbp - 0x74], 1
mov dword [rbp - 0x78], r15d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x74]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003651b
mov ecx, dword [rbp - 0x74]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x14003648e
cmp ecx, 4
jne 0x14003651b
mov dword [rsp + 0x70], r15d
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140036472
mov dword [rbp + 0x40], 4
mov dword [rbp - 0x34], 0xffffffff
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x34]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400363f8
mov dword [rsp + 0x70], r15d
jmp 0x140036472
mov eax, dword [rbp - 0x34]
cmp eax, 4
je 0x140036472
mov dword [rsp + 0x70], r15d
cmp eax, 1
jne 0x140036472
lea r9, [0x1400c5494]
mov r8, r14
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.140029c70
nop
mov rax, qword [rbp + 0xa0]
cmp dword [rax - 0x10], 0
jle 0x140036446
mov rcx, rax
call fcn.140017960
mov dword [rsp + 0x70], eax
mov rax, qword [rbp + 0xa0]
lea rdx, [rax - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140036472
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140036468
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036472
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
movsxd rdx, dword [rsp + 0x70]
mov r9d, 0xa
xor r8d, r8d
lea rcx, [rbp - 0x40]
call fcn.140013580
jmp 0x140036517
mov edi, dword [rbp - 0x78]
inc rdi
shr rdi, 1
lea edx, [rdi + 1]
mov r9b, 1
xor r8d, r8d
lea rcx, [rbp - 0x40]
call fcn.140010590
mov rbx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x74]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rcx, edi
mov word [rbx + rcx*2], r15w
mov rax, qword [rbp - 0x40]
test rax, rax
jne 0x1400364e5
mov edx, r15d
jmp 0x140036504
mov rdx, rax
nop dword [rax + rax]
movzx ecx, word [rdx]
add rdx, 2
test cx, cx
jne 0x1400364f0
sub rdx, rax
sar rdx, 1
dec edx
mov dword [rax - 0x10], edx
mov ecx, dword [rax - 8]
cmp ecx, 0xffffffff
jne 0x140036517
mov ecx, 1
xchg dword [rax - 8], ecx
mov rbx, qword [rbp - 0x40]
cmp qword [rsp + 0x50], 0
je 0x140036570
test rbx, rbx
je 0x14003655c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.URL_Protocol
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140036570
mov rdx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
and dword [rbp + 0x5f0], 0xfffffdff
lea rdx, [rbx - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400365a6
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003659c
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400365a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x1400365c0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400365c0
lea rdx, str.URL_Protocol
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400365f0
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400365e6
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400365f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
cmp qword [rsp + 0x60], 0
je 0x140036ab2
lea r8, [0x1400c5494]
lea rdx, [rbp]
mov rcx, r13
call fcn.1400311c0
nop
mov rcx, qword [rsp + 0x60]
xor r12d, r12d
test rcx, rcx
je 0x1400368f7
lea rax, [rbp + 0x11c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x44]
xor r8d, r8d
mov rdx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400368df
cmp dword [rbp + 0x44], 1
jne 0x1400368df
mov r14, qword [rbp]
call fcn.140002000
mov r10, qword [rax]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], r12b
mov r9d, esi
mov r8d, esi
lea rdx, [0x1400c5494]
mov rcx, rax
call qword [r10 + 0x28]
mov rbx, rax
mov qword [rbp - 0x48], rax
or dword [rbp + 0x5f0], 0x400
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14003685b
mov dword [rbp - 0x6c], 1
mov dword [rbp - 0x70], r12d
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x6c]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003685b
mov ecx, dword [rbp - 0x6c]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x1400367d1
cmp ecx, 4
jne 0x14003685b
mov dword [rsp + 0x74], r12d
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400367b5
mov dword [rbp + 0x48], 4
mov dword [rbp - 0x30], 0xffffffff
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14003673b
mov dword [rsp + 0x74], r12d
jmp 0x1400367b5
mov eax, dword [rbp - 0x30]
cmp eax, 4
je 0x1400367b5
mov dword [rsp + 0x74], r12d
cmp eax, 1
jne 0x1400367b5
lea r9, [0x1400c5494]
mov r8, r14
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x60]
call fcn.140029c70
nop
mov rax, qword [rbp + 0xa8]
cmp dword [rax - 0x10], 0
jle 0x140036789
mov rcx, rax
call fcn.140017960
mov dword [rsp + 0x74], eax
mov rax, qword [rbp + 0xa8]
lea rdx, [rax - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400367b5
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400367ab
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400367b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
movsxd rdx, dword [rsp + 0x74]
mov r9d, 0xa
xor r8d, r8d
lea rcx, [rbp - 0x48]
call fcn.140013580
jmp 0x140036857
mov edi, dword [rbp - 0x70]
inc rdi
shr rdi, 1
lea edx, [rdi + 1]
mov r9b, 1
xor r8d, r8d
lea rcx, [rbp - 0x48]
call fcn.140010590
mov rbx, rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x6c]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rcx, edi
mov word [rbx + rcx*2], r12w
mov rax, qword [rbp - 0x48]
test rax, rax
jne 0x140036828
mov edx, r12d
jmp 0x140036844
mov rdx, rax
nop dword [rax + rax]
movzx ecx, word [rdx]
add rdx, 2
test cx, cx
jne 0x140036830
sub rdx, rax
sar rdx, 1
dec edx
mov dword [rax - 0x10], edx
mov ecx, dword [rax - 8]
cmp ecx, 0xffffffff
jne 0x140036857
mov ecx, 1
xchg dword [rax - 8], ecx
mov rbx, qword [rbp - 0x48]
cmp qword [rsp + 0x60], 0
je 0x1400368b1
test rbx, rbx
je 0x14003689c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400c5494]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400368b1
mov rdx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
lea rdx, [rbx - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x1400368dd
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x1400368d3
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400368dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x1400368f7
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400368f7
lea rdx, [0x1400c5494]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140036927
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x14003691d
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036927
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140036964
lea rax, [rbp + 0x118]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x4c]
xor r8d, r8d
lea rdx, [0x1400c5494]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140036964
cmp dword [rbp + 0x4c], 1
je 0x140035c5c
cmp qword [rsp + 0x60], 0
je 0x140036ab2
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140035c5c
mov qword [rbp + 0xd8], r12
mov edi, dword [rsp + 0x58]
or edi, 0x2001f
mov qword [rbp + 0xb0], r12
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.shell
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140036ab5
mov rbx, qword [rbp + 0xb0]
mov qword [rbp + 0xd8], rbx
and edi, 0x300
mov dword [rbp + 0xe0], edi
mov dword [rbp - 0x68], 0x100
lea rax, [rbp + 0x170]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x68]
lea r8, [rbp + 0x190]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140036a73
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0xd8]
call fcn.140030240
test eax, eax
jne 0x140036aa2
mov dword [rbp - 0x68], 0x100
lea rax, [rbp + 0x170]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x68]
lea r8, [rbp + 0x190]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140036a20
test rbx, rbx
je 0x140036a8b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rbp + 0xd8], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140036aa2
lea rdx, str.shell
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test rbx, rbx
je 0x140036ab5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140036ab5
xor r12d, r12d
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140035c5c
lea rax, [rbp + 0x114]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x50]
xor r8d, r8d
lea rdx, [0x1400c5494]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140036af6
cmp dword [rbp + 0x50], 1
je 0x140035c5c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140036b33
lea rax, [rbp + 0x124]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x54]
xor r8d, r8d
lea rdx, str.URL_Protocol
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140036b33
cmp dword [rbp + 0x54], 1
je 0x140035c5c
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], r12d
mov qword [rbp + 0xb8], r12
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140036b92
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140036b7c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x50], rax
mov edi, r12d
mov dword [rsp + 0x58], r12d
jmp 0x140036b96
mov edi, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140035c5c
mov r15, qword [rbp + 0x5e8]
mov r14, qword [r15]
mov qword [rbp + 0xe8], r12
or edi, 0x2001f
mov qword [rbp + 0xc0], r12
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140035c63
mov rbx, qword [rbp + 0xc0]
mov qword [rbp + 0xe8], rbx
and edi, 0x300
mov dword [rbp + 0xf0], edi
mov dword [rbp - 0x64], 0x100
lea rax, [rbp + 0x178]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x64]
lea r8, [rbp + 0x390]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140036c93
nop dword [rax + rax]
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0xe8]
call fcn.140030240
test eax, eax
jne 0x140036cbe
mov dword [rbp - 0x64], 0x100
lea rax, [rbp + 0x178]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x64]
lea r8, [rbp + 0x390]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140036c40
test rbx, rbx
je 0x140036cab
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rbp + 0xe8], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140036cbe
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test rbx, rbx
je 0x140035c63
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140035c63