Function at 0x140040cf0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x800
mov rax, qword [0x140313918]
xor rax, rsp
mov qword [rsp + 0x7f0], rax
xor r13d, r13d
mov qword [r11 - 0x570], r13
movdqa xmm0, xmmword [0x1402cd3d0]
movdqu xmmword [rsp + 0x2b8], xmm0
mov word [r11 - 0x570], r13w
mov byte [rsp + 0x2a0], r13b
lea rdx, str.srl::Applications::Detect
lea rcx, [r11 - 0x570]
call fcn.140009b0c
nop
call fcn.14001fce0
cmp dword [rax + 8], 4
jl 0x140040d7a
lea rcx, [rsp + 0x2a0]
call fcn.140015ae0
nop
lea rsi, vtable.srl::Exists.0
mov qword [rsp + 0x118], rsi
mov byte [rsp + 0x120], 0
mov edx, 0x116f3
lea rcx, [rsp + 0x458]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x118]
mov rdx, rax
call fcn.14004fb30
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x458], rdi
mov rdx, qword [rsp + 0x478]
cmp rdx, 8
jb 0x140040e10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x460]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040e0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042499
call fcn.14000410c
nop
mov qword [rsp + 0x128], rsi
mov byte [rsp + 0x130], 0
mov edx, 0x116f5
lea rcx, [rsp + 0x488]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x488], rdi
mov rdx, qword [rsp + 0x4a8]
cmp rdx, 8
jb 0x140040e98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040e92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004249f
call fcn.14000410c
nop
mov qword [rsp + 0x138], rsi
mov byte [rsp + 0x140], 0
mov edx, 0x116f7
lea rcx, [rsp + 0x4b8]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x4b8], rdi
mov rdx, qword [rsp + 0x4d8]
cmp rdx, 8
jb 0x140040f20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040f1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424a5
call fcn.14000410c
nop
mov qword [rsp + 0x148], rsi
mov byte [rsp + 0x150], 0
mov edx, 0x116f9
lea rcx, [rsp + 0x4e8]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x4e8], rdi
mov rdx, qword [rsp + 0x508]
cmp rdx, 8
jb 0x140040fa8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040fa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424ab
call fcn.14000410c
nop
mov qword [rsp + 0x158], rsi
mov byte [rsp + 0x160], 0
mov edx, 0x116fb
lea rcx, [rsp + 0x518]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x518], rdi
mov rdx, qword [rsp + 0x538]
cmp rdx, 8
jb 0x140041030
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x520]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004102a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424b1
call fcn.14000410c
nop
mov qword [rsp + 0x168], rsi
mov byte [rsp + 0x170], 0
mov edx, 0x11702
lea rcx, [rsp + 0x548]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x548], rdi
mov rdx, qword [rsp + 0x568]
cmp rdx, 8
jb 0x1400410b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x550]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400410b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424b7
call fcn.14000410c
nop
mov qword [rsp + 0x100], r13
mov dword [rsp + 0x108], r13d
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMacromediaFlashPlayer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004117a
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x100], rcx
mov dword [rsp + 0x108], r13d
mov dword [rsp + 0x48], 0x28
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6f8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.CurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004117a
mov eax, dword [rsp + 0x50]
dec eax
cmp eax, 1
ja 0x14004117a
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14004122a
test al, 1
jne 0x14004117a
shr rax, 1
cmp word [rsp + rax*2 + 0x6f6], 0
je 0x140041233
mov r15, 0xffffffffffffffff
lea r12, vtable.srl::Version.0
mov qword [rsp + 0x1e0], r13
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1f8], 7
mov word [rsp + 0x1e0], r13w
lea rdx, str.wmplayer.exe
lea rcx, [rsp + 0x2c8]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2c8]
call fcn.140040250
movzx ebx, al
mov rdx, qword [rsp + 0x2e0]
cmp rdx, 8
jb 0x1400413e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400413e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424bd
jmp 0x1400413e1
mov word [rsp + 0x6f8], r13w
mov qword [rsp + 0x178], rsi
mov byte [rsp + 0x180], 1
mov edx, 0x116f1
lea rcx, [rsp + 0x578]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x178]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x578], rdi
mov rdx, qword [rsp + 0x598]
cmp rdx, 8
jb 0x1400412bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x580]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400412b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424c3
call fcn.14000410c
nop
lea r12, vtable.srl::Version.0
mov qword [rsp + 0x78], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x1400424c9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x6f8]
mov r15, 0xffffffffffffffff
mov rax, r15
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140041300
mov r8d, eax
lea rdx, [rsp + 0x6f8]
lea rcx, [rsp + 0x80]
call fcn.140002aa8
nop
mov edx, 0x116f2
lea rcx, [rsp + 0x368]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x368], rdi
mov rdx, qword [rsp + 0x388]
cmp rdx, 8
jb 0x140041397
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041392
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424d4
call fcn.14000410c
movdqa xmm0, xmmword [0x1402cd3d0]
movdqu xmmword [rsp + 0x380], xmm0
mov word [rsp + 0x370], r13w
mov qword [rsp + 0x78], r12
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041188
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140041188
call fcn.14000410c
test bl, bl
je 0x14004162f
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x230], r13
mov qword [rsp + 0x238], 7
mov word [rsp + 0x220], r13w
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x1e0]
call fcn.140040090
test al, al
je 0x1400415e7
mov qword [rsp + 0x188], rsi
mov byte [rsp + 0x190], 1
mov edx, 0x116f3
lea rcx, [rsp + 0x5a8]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x188]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x5a8], rdi
mov rdx, qword [rsp + 0x5c8]
cmp rdx, 8
jb 0x1400414b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400414b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424da
call fcn.14000410c
nop
mov qword [rsp + 0x88], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x1400424e0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
jb 0x140041508
mov rdx, qword [rsp + 0x220]
test rdx, rdx
jne 0x140041508
mov eax, r13d
jmp 0x14004151a
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140041510
mov r8d, eax
lea rcx, [rsp + 0x90]
call fcn.140002aa8
nop
mov edx, 0x11611
lea rcx, [rsp + 0x398]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x88]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x398], rdi
mov rdx, qword [rsp + 0x3b8]
cmp rdx, 8
jb 0x1400415a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004159d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424eb
call fcn.14000410c
movdqa xmm0, xmmword [0x1402cd3d0]
movdqu xmmword [rsp + 0x3b0], xmm0
mov word [rsp + 0x3a0], r13w
mov qword [rsp + 0x88], r12
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400415e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x238]
cmp rdx, 8
jb 0x14004162f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004162a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042548
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.AcroRd32.exe
lea rcx, [rsp + 0x2e8]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2e8]
call fcn.140040250
movzx ebx, al
mov rdx, qword [rsp + 0x300]
cmp rdx, 8
jb 0x1400416ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400416c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424f1
call fcn.14000410c
test bl, bl
je 0x14004190f
mov qword [rsp + 0x240], r13
mov qword [rsp + 0x250], r13
mov qword [rsp + 0x258], 7
mov word [rsp + 0x240], r13w
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x1e0]
call fcn.140040090
test al, al
je 0x1400418c7
mov qword [rsp + 0x198], rsi
mov byte [rsp + 0x1a0], 1
mov edx, 0x116f5
lea rcx, [rsp + 0x5d8]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x198]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x5d8], rdi
mov rdx, qword [rsp + 0x5f8]
cmp rdx, 8
jb 0x14004179c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041796
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400424f7
call fcn.14000410c
nop
mov qword [rsp + 0x98], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x1400424fd
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x240]
cmp qword [rsp + 0x258], 8
jb 0x1400417ec
mov rdx, qword [rsp + 0x240]
test rdx, rdx
jne 0x1400417ec
mov eax, r13d
jmp 0x1400417fa
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400417f0
mov r8d, eax
lea rcx, [rsp + 0xa0]
call fcn.140002aa8
nop
mov edx, 0x116f6
lea rcx, [rsp + 0x3c8]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x98]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x3c8], rdi
mov rdx, qword [rsp + 0x3e8]
cmp rdx, 8
jb 0x140041882
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004187d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042508
call fcn.14000410c
movdqa xmm0, xmmword [0x1402cd3d0]
movdqu xmmword [rsp + 0x3e0], xmm0
mov word [rsp + 0x3d0], r13w
mov qword [rsp + 0x98], r12
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400418c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x258]
cmp rdx, 8
jb 0x14004190f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004190a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042548
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.QuickTimePlayer.exe
lea rcx, [rsp + 0x308]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x308]
call fcn.140040250
movzx ebx, al
mov rdx, qword [rsp + 0x320]
cmp rdx, 8
jb 0x1400419aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400419a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004250e
call fcn.14000410c
test bl, bl
je 0x140041bef
mov qword [rsp + 0x260], r13
mov qword [rsp + 0x270], r13
mov qword [rsp + 0x278], 7
mov word [rsp + 0x260], r13w
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x1e0]
call fcn.140040090
test al, al
je 0x140041ba7
mov qword [rsp + 0x1a8], rsi
mov byte [rsp + 0x1b0], 1
mov edx, 0x116f7
lea rcx, [rsp + 0x608]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x1a8]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x608], rdi
mov rdx, qword [rsp + 0x628]
cmp rdx, 8
jb 0x140041a7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x610]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041a76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042514
call fcn.14000410c
nop
mov qword [rsp + 0xa8], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14004251a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
jb 0x140041acc
mov rdx, qword [rsp + 0x260]
test rdx, rdx
jne 0x140041acc
mov eax, r13d
jmp 0x140041ada
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140041ad0
mov r8d, eax
lea rcx, [rsp + 0xb0]
call fcn.140002aa8
nop
mov edx, 0x116f8
lea rcx, [rsp + 0x3f8]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x3f8], rdi
mov rdx, qword [rsp + 0x418]
cmp rdx, 8
jb 0x140041b62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041b5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042525
call fcn.14000410c
movdqa xmm0, xmmword [0x1402cd3d0]
movdqu xmmword [rsp + 0x410], xmm0
mov word [rsp + 0x400], r13w
mov qword [rsp + 0xa8], r12
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041ba7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x278]
cmp rdx, 8
jb 0x140041bef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041bea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042548
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.Winword.exe
lea rcx, [rsp + 0x328]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x328]
call fcn.140040250
movzx ebx, al
mov rdx, qword [rsp + 0x340]
cmp rdx, 8
jb 0x140041c8a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041c85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004252b
call fcn.14000410c
test bl, bl
je 0x140041ecf
mov qword [rsp + 0x280], r13
mov qword [rsp + 0x290], r13
mov qword [rsp + 0x298], 7
mov word [rsp + 0x280], r13w
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x1e0]
call fcn.140040090
test al, al
je 0x140041e87
mov qword [rsp + 0x1b8], rsi
mov byte [rsp + 0x1c0], 1
mov edx, 0x116f9
lea rcx, [rsp + 0x638]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x1b8]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x638], rdi
mov rdx, qword [rsp + 0x658]
cmp rdx, 8
jb 0x140041d5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x640]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041d56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042531
call fcn.14000410c
nop
mov qword [rsp + 0xb8], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x140042537
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x280]
cmp qword [rsp + 0x298], 8
jb 0x140041dac
mov rdx, qword [rsp + 0x280]
test rdx, rdx
jne 0x140041dac
mov eax, r13d
jmp 0x140041dba
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140041db0
mov r8d, eax
lea rcx, [rsp + 0xc0]
call fcn.140002aa8
nop
mov edx, 0x116fa
lea rcx, [rsp + 0x428]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0xb8]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x428], rdi
mov rdx, qword [rsp + 0x448]
cmp rdx, 8
jb 0x140041e42
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x430]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041e3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042542
call fcn.14000410c
movdqa xmm0, xmmword [0x1402cd3d0]
movdqu xmmword [rsp + 0x440], xmm0
mov word [rsp + 0x430], r13w
mov qword [rsp + 0xb8], r12
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041e87
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x298]
cmp rdx, 8
jb 0x140041ecf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041eca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042548
call fcn.14000410c
mov qword [rsp + 0x200], r13
mov qword [rsp + 0x210], r13
mov qword [rsp + 0x218], 7
mov word [rsp + 0x200], r13w
lea rdx, str.3F0FC462_CDC1_4CD9_8E84_84D89B914EAA
lea rcx, [rsp + 0x348]
call fcn.140009744
nop
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x348]
call fcn.140040610
movzx ebx, al
mov rdx, qword [rsp + 0x360]
cmp rdx, 8
jb 0x140041f69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x348]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041f64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004254e
call fcn.14000410c
test bl, bl
je 0x14004208a
mov qword [rsp + 0x1c8], rsi
mov byte [rsp + 0x1d0], 1
mov edx, 0x11702
lea rcx, [rsp + 0x668]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x1c8]
mov rdx, rax
call fcn.14004fb30
nop
lea rcx, [rsp + 0x668]
call fcn.140021670
nop
mov qword [rsp + 0xc8], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x140042554
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0x200]
cmp qword [rsp + 0x218], 8
jb 0x140042006
mov rdx, qword [rsp + 0x200]
test rdx, rdx
jne 0x140042006
mov eax, r13d
jmp 0x14004201a
mov rax, r15
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140042010
mov r8d, eax
lea rcx, [rsp + 0xd0]
call fcn.140002aa8
nop
mov edx, 0x11703
lea rcx, [rsp + 0x698]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0xc8]
mov rdx, rax
call fcn.14004fb30
nop
lea rcx, [rsp + 0x698]
call fcn.140021670
nop
mov qword [rsp + 0xc8], r12
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004208a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, r13
mov qword [rsp + 0xd8], r13
mov dword [rsp + 0xe0], r13d
mov qword [rsp + 0xe8], r13
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREJavaSoftJava_Runtime_Environment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400420f1
mov eax, r13d
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], r13d
test eax, eax
je 0x140042156
mov qword [rsp + 0x68], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SOFTWAREJavaSoftJava_Runtime_Environment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004236b
mov eax, r13d
test rdi, rdi
je 0x140042136
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x68]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], 0x200
test eax, eax
jne 0x14004236b
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14004255f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [0x1402c1640]
cmp rdx, 0x10000
jae 0x140042195
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.140010ac0
jmp 0x1400421b8
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400421a0
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140002aa8
nop
xor r14b, r14b
mov esi, r13d
mov dword [rsp + 0x4c], 0x64
test r14b, r14b
jne 0x140042266
mov dword [rsp + 0x4c], 0x64
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x720]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x140042217
mov r14b, 1
jmp 0x1400421c6
mov rax, qword [rsp + 0x40]
mov ebx, dword [rax - 0x10]
lea rcx, [rsp + 0x720]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jle 0x14004225f
lea rcx, [rsp + 0x720]
mov rax, r15
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140042240
mov r8d, eax
lea rdx, [rsp + 0x720]
lea rcx, [rsp + 0x40]
call fcn.140002aa8
inc esi
jmp 0x1400421c6
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
jle 0x140042345
mov edx, 0x5f
lea rcx, [rsp + 0x40]
call fcn.140042580
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax - 0x10]
add r9d, 0xfffffffe
mov r8d, 2
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140012880
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call fcn.14006e990
mov rbx, rax
mov edx, 0x1171e
lea rcx, [rsp + 0x6c8]
call fcn.1400214e0
nop
xor r9d, r9d
mov r8, rbx
mov rdx, rax
call fcn.14004fb30
nop
lea rcx, [rsp + 0x6c8]
call fcn.140021670
nop
mov qword [rsp + 0xf0], r12
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042316
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, vtable.srl::Value.0
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042345
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140042363
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0xd8]
test rdi, rdi
je 0x14004237a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 8
jb 0x1400423c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400423bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004256a
call fcn.14000410c
mov qword [rsp + 0x210], r13
mov qword [rsp + 0x218], 7
mov word [rsp + 0x200], r13w
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 8
jb 0x140042427
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042422
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042570
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1f8], 7
mov word [rsp + 0x1e0], r13w
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x140042458
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x2a0]
call fcn.140017400
mov al, 1
mov rcx, qword [rsp + 0x7f0]
xor rcx, rsp
call fcn.140215e10
lea r11, [rsp + 0x800]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
int3
mov ecx, 0x80004005
call fcn.140002d2c
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021f028
nop
call fcn.14021f028
int3