Function at 0x14004b2c0
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
movzx r13d, dl
mov r12, rcx
xor esi, esi
mov dword [rbp - 0x21], esi
mov eax, dword [0x1401d8a98]
test al, 1
jne 0x14004b33b
or eax, 1
mov dword [0x1401d8a98], eax
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d8aa0], rax
lea rcx, [0x140128930]
call fcn.1400d5510
nop
mov eax, dword [0x1401d8a98]
test al, 2
jne 0x14004b377
or eax, 2
mov dword [0x1401d8a98], eax
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d8a90], rax
lea rcx, [0x1401288f0]
call fcn.1400d5510
nop
mov eax, dword [0x1401d8a98]
test al, 4
jne 0x14004b3b3
or eax, 4
mov dword [0x1401d8a98], eax
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d8a88], rax
lea rcx, [0x1401288b0]
call fcn.1400d5510
nop
mov eax, dword [0x1401d8a98]
test al, 8
jne 0x14004b3e9
or eax, 8
mov dword [0x1401d8a98], eax
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d8aa8], rax
lea rcx, [0x140128870]
call fcn.1400d5510
nop
mov rax, qword [0x1401d8a90]
mov ecx, dword [rax - 0x10]
or r14, 0xffffffffffffffff
mov rax, qword [0x1401d8aa8]
mov rdx, qword [0x1401d7ec8]
test ecx, ecx
je 0x14004b45b
mov ecx, esi
test rdx, rdx
setne cl
test ecx, ecx
jne 0x14004b420
mov ecx, 0x80004005
call fcn.140001920
int3
mov rcx, rax
mov r9, rdx
sub r9, rax
nop dword [rax]
movzx r8d, word [rcx]
cmp r8w, word [rcx + r9]
jne 0x14004b449
add rcx, 2
test r8w, r8w
jne 0x14004b430
mov ecx, esi
jmp 0x14004b44e
sbb ecx, ecx
or ecx, 1
test ecx, ecx
setne cl
test cl, cl
je 0x14004c52e
lea rcx, [rdx - 0x18]
lea rbx, [rax - 0x18]
cmp rcx, rbx
je 0x14004b4af
cmp dword [rbx + 0x10], 0
jl 0x14004b49f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004b49f
call fcn.1400027c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004b492
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401d8aa8], rax
jmp 0x14004b4af
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d8aa8]
call fcn.140002670
mov rax, qword [0x1401d8aa0]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004b50d
cmp dword [rdx + 0x10], 0
jge 0x14004b4e9
cmp dword [rax - 0xc], 0
jge 0x14004b4da
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401d8aa0]
mov word [rax], si
jmp 0x14004b50d
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b4f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d8aa0], rax
mov rax, qword [0x1401d8a90]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004b572
cmp dword [rdx + 0x10], 0
jge 0x14004b54e
cmp dword [rax - 0xc], 0
jge 0x14004b538
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401d8a90]
mov dword [rax - 0x10], esi
mov rax, qword [0x1401d8a90]
mov word [rax], si
jmp 0x14004b572
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b55e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d8a90], rax
mov rax, qword [0x1401d8a88]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004b5d0
cmp dword [rdx + 0x10], 0
jge 0x14004b5ac
cmp dword [rax - 0xc], 0
jge 0x14004b59d
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401d8a88]
mov word [rax], si
jmp 0x14004b5d0
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b5bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d8a88], rax
mov r15d, esi
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x29], rdi
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x14015ed70]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004b98b
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004b92e
mov dword [rbp + 0x77], 0x104
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004b698
mov edx, 0x82
lea rcx, [rbp - 0x29]
call fcn.140002760
mov rdi, qword [rbp - 0x29]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004b6ed
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d5a84
test eax, eax
js 0x14004b6e2
cmp eax, dword [rdi - 0xc]
jg 0x14004b6e2
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
jmp 0x14004b73a
mov ecx, 0x80070057
call fcn.140001920
int3
lea rdx, [rdi - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004b73a
cmp dword [rdx + 0x10], 0
jge 0x14004b719
cmp dword [rdi - 0xc], 0
jge 0x14004b711
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rdi - 0x10], esi
mov word [rdi], si
jmp 0x14004b73a
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b729
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x29], rdi
mov dword [rbp + 0x77], 0x104
mov rax, qword [0x1401d8aa0]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x82
or ecx, edx
jge 0x14004b775
mov edx, 0x82
lea rcx, [0x1401d8aa0]
call fcn.140002760
mov rax, qword [0x1401d8aa0]
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.Local_AppData
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004b7dd
mov rcx, qword [0x1401d8aa0]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d5a84
test eax, eax
js 0x14004b7d2
mov rcx, qword [0x1401d8aa0]
cmp eax, dword [rcx - 0xc]
jg 0x14004b7d2
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [0x1401d8aa0]
mov word [rax + rcx*2], si
jmp 0x14004b83f
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401d8aa0]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004b83f
cmp dword [rdx + 0x10], 0
jge 0x14004b817
cmp dword [rax - 0xc], 0
jge 0x14004b808
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401d8aa0]
mov word [rax], si
jmp 0x14004b83f
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b827
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401d8aa0], rax
mov rdi, qword [rbp - 0x29]
mov dword [rbp + 0x77], 0x104
mov rax, qword [rbp - 0x39]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004b86c
mov edx, 0x82
lea rcx, [rbp - 0x39]
call fcn.140002760
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov rbx, qword [rbp - 0x39]
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004b8c5
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d5a84
test eax, eax
js 0x14004b8ba
cmp eax, dword [rbx - 0xc]
jg 0x14004b8ba
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
jmp 0x14004b922
mov ecx, 0x80070057
call fcn.140001920
int3
mov rdx, qword [0x1401d8aa0]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x39]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004b922
cmp dword [rbx + 0x10], 0
jl 0x14004b915
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004b915
call fcn.1400027c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004b907
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x39], rax
mov rdi, qword [rbp - 0x29]
jmp 0x14004b922
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x39]
call fcn.140002670
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004b98b
mov rdx, qword [0x1401d8aa0]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x39]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004b98b
cmp dword [rbx + 0x10], 0
jl 0x14004b97e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004b97e
call fcn.1400027c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004b970
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x39], rax
mov rdi, qword [rbp - 0x29]
jmp 0x14004b98b
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x39]
call fcn.140002670
mov eax, dword [0x1401d6d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 3
jne 0x14004b9ba
dec dword [0x1401d7ee8]
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr ax, 8
movzx edx, al
cmp ecx, 6
ja 0x14004b9e1
jne 0x14004b9d6
cmp edx, 1
ja 0x14004b9e1
mov r15d, 1
jmp 0x14004bc84
mov r14b, 1
mov eax, dword [0x1401d6d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 7
jne 0x14004ba36
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov eax, 0xcccccccd
mul r9d
shr edx, 6
lea r8d, [rdx + rdx*4]
shl r8d, 4
sub r9d, r8d
lea eax, [r9 + 1]
mov dword [0x1401d6d80], eax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004bb98
mov dword [rbp + 0x77], 0x104
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004ba91
mov edx, 0x82
lea rcx, [rbp - 0x29]
call fcn.140002760
mov rdi, qword [rbp - 0x29]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004bb11
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d5a84
test eax, eax
js 0x14004bb06
cmp eax, dword [rdi - 0xc]
jg 0x14004bb06
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
xor r14b, r14b
cmp dword [rdi - 0x10], 0
jl 0x14004bb11
lea rdx, str.PMIL
mov rcx, rdi
call fcn.1400d5c54
test rax, rax
je 0x14004bb11
sub rax, rdi
sar rax, 1
test eax, eax
jne 0x14004bb11
lea r15d, [rax + 1]
jmp 0x14004bb11
mov ecx, 0x80070057
call fcn.140001920
int3
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [0x1401d6d80]
lea ecx, [rsi + 1]
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x14004bb8d
xor ecx, ecx
lea r8d, [rcx + 0x2b]
mov r11d, ecx
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
test ebx, ebx
jle 0x14004bb85
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
mov r9d, ecx
mov r10, rbx
test eax, eax
jle 0x14004bb7b
mov ecx, r9d
mov edx, eax
add r8d, ecx
dec ecx
dec rdx
jne 0x14004bb71
add r9d, r11d
dec r10
jne 0x14004bb68
xor ecx, ecx
inc r11d
cmp r11d, r8d
jl 0x14004bb53
test r14b, r14b
je 0x14004bc80
xor esi, esi
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004bc7a
mov dword [rbp + 0x77], 0x104
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004bbf3
mov edx, 0x82
lea rcx, [rbp - 0x29]
call fcn.140002760
mov rdi, qword [rbp - 0x29]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.DefaultValue
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d5a84
test eax, eax
js 0x14004bc6f
cmp eax, dword [rdi - 0xc]
jg 0x14004bc6f
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rdi - 0x10], 0
jl 0x14004bc80
lea rdx, [0x14015f128]
mov rcx, rdi
call fcn.1400d5c54
test rax, rax
je 0x14004bc80
sub rax, rdi
sar rax, 1
or r14, 0xffffffffffffffff
test eax, eax
jne 0x14004bc84
lea r15d, [r14 + 2]
jmp 0x14004bc84
mov ecx, 0x80070057
call fcn.140001920
int3
mov r15d, 1
or r14, 0xffffffffffffffff
cmp qword [0x1401d1d58], 0xffffffff80000002
jne 0x14004bd73
mov rdx, qword [0x1401d7ec8]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401d8a90]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004bcfc
cmp dword [rbx + 0x10], 0
jl 0x14004bcec
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004bcec
call fcn.1400027c0
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
jg 0x14004bcdf
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401d8a90], rax
jmp 0x14004bcfc
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d8a90]
call fcn.140002670
mov rcx, qword [rbp - 0x39]
add rcx, 0xffffffffffffffe8
mov rbx, qword [0x1401d8aa0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004c141
cmp dword [rbx + 0x10], 0
jl 0x14004bd57
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004bd57
call fcn.1400027c0
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
jg 0x14004bd47
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401d8aa0], rax
jmp 0x14004c141
mov rbx, qword [rbp - 0x39]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401d8aa0]
call fcn.140002670
jmp 0x14004c141
test r15d, r15d
je 0x14004bfd1
call fcn.14004af50
test al, al
je 0x14004bef0
cmp byte [0x1401d6ea4], 0
jne 0x14004bef0
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x11], rbx
lea r14, [0x14015f0b8]
test r14, 0xffffffffffff0000
jne 0x14004bde8
movzx edi, r14w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004be5b
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.140002960
mov rbx, qword [rbp - 0x11]
jmp 0x14004be5b
mov esi, dword [rbx - 0x10]
mov rdi, r14
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 9
or eax, ecx
jge 0x14004be18
mov edx, 9
lea rcx, [rbp - 0x11]
call fcn.140002760
mov rbx, qword [rbp - 0x11]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x12
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004be38
lea r8, [rbx + rdi*2]
call fcn.1400d562c
jmp 0x14004be40
mov r8, r14
call fcn.1400d57ec
cmp dword [rbx - 0xc], 9
jl 0x14004bee5
mov dword [rbx - 0x10], 9
xor r15d, r15d
mov word [rbx + 0x12], r15w
jmp 0x14004be5e
xor r15d, r15d
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401d8a90]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004bec3
cmp dword [rsi + 0x10], 0
jl 0x14004beb0
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004beb0
mov rcx, rdi
call fcn.1400027c0
mov rbx, rax
or r14, 0xffffffffffffffff
lock add dword [rsi + 0x10], r14d
jg 0x14004bea3
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401d8a90], rax
jmp 0x14004bec7
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401d8a90]
call fcn.140002670
or r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
dec eax
jg 0x14004bf5a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004bf5a
mov ecx, 0x80070057
call fcn.140001920
nop
mov rdx, qword [0x1401d7ec8]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401d8a90]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004bf57
cmp dword [rbx + 0x10], 0
jl 0x14004bf47
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004bf47
call fcn.1400027c0
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
jg 0x14004bf3a
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401d8a90], rax
jmp 0x14004bf57
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d8a90]
call fcn.140002670
xor r15d, r15d
mov rcx, qword [rbp - 0x39]
add rcx, 0xffffffffffffffe8
mov rbx, qword [0x1401d8aa0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004c144
cmp dword [rbx + 0x10], 0
jl 0x14004bfb5
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004bfb5
call fcn.1400027c0
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
jg 0x14004bfa5
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401d8aa0], rax
jmp 0x14004c144
mov rbx, qword [rbp - 0x39]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401d8aa0]
call fcn.140002670
jmp 0x14004c144
call fcn.14004afe0
test al, al
jne 0x14004bff3
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x1401d8aa0]
call fcn.140010c10
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 9], rbx
lea r14, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
test r14, 0xffffffffffff0000
jne 0x14004c045
movzx edi, r14w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004c0bb
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.140002960
mov rbx, qword [rbp - 9]
jmp 0x14004c0bb
mov esi, dword [rbx - 0x10]
mov rdi, r14
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7a
or eax, ecx
jge 0x14004c075
mov edx, 0x7a
lea rcx, [rbp - 9]
call fcn.140002760
mov rbx, qword [rbp - 9]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xf4
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004c095
lea r8, [rbx + rdi*2]
call fcn.1400d562c
jmp 0x14004c09d
mov r8, r14
call fcn.1400d57ec
cmp dword [rbx - 0xc], 0x7a
jl 0x14004c5dc
mov dword [rbx - 0x10], 0x7a
xor r15d, r15d
mov word [rbx + 0xf4], r15w
jmp 0x14004c0be
xor r15d, r15d
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401d8a90]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004c123
cmp dword [rsi + 0x10], 0
jl 0x14004c110
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004c110
mov rcx, rdi
call fcn.1400027c0
mov rbx, rax
or r14, 0xffffffffffffffff
lock add dword [rsi + 0x10], r14d
jg 0x14004c103
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401d8a90], rax
jmp 0x14004c127
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401d8a90]
call fcn.140002670
or r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
dec eax
jg 0x14004c144
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004c144
xor r15d, r15d
mov rcx, qword [0x1401d8a90]
cmp dword [rcx - 0x10], 0
jl 0x14004c1eb
lea rdx, str.windows_ie_ac_001
call fcn.1400d5c54
test rax, rax
je 0x14004c1eb
sub rax, qword [0x1401d8a90]
sar rax, 1
test eax, eax
jle 0x14004c1eb
mov rdx, qword [0x1401d7ec8]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401d8a88]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004c43c
cmp dword [rbx + 0x10], 0
jl 0x14004c1d6
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004c1d6
call fcn.1400027c0
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
jg 0x14004c1c6
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401d8a88], rax
jmp 0x14004c43c
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d8a88]
call fcn.140002670
jmp 0x14004c43c
call fcn.14004af50
test al, al
je 0x14004c2f8
cmp byte [0x1401d6ea4], 0
jne 0x14004c2f8
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x19], rbx
lea r14, [0x14015f158]
test r14, 0xffffffffffff0000
jne 0x14004c257
movzx edi, r14w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004c2c1
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.140002960
mov rbx, qword [rbp - 0x19]
jmp 0x14004c2c1
mov esi, dword [rbx - 0x10]
mov rdi, r14
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 9
or eax, ecx
jge 0x14004c287
mov edx, 9
lea rcx, [rbp - 0x19]
call fcn.140002760
mov rbx, qword [rbp - 0x19]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x12
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004c2a7
lea r8, [rbx + rdi*2]
call fcn.1400d562c
jmp 0x14004c2af
mov r8, r14
call fcn.1400d57ec
cmp dword [rbx - 0xc], 9
jl 0x14004c2ed
mov dword [rbx - 0x10], 9
mov word [rbx + 0x12], r15w
lea rdx, [rbp - 0x19]
lea rcx, [0x1401d8a88]
call fcn.1400025c0
nop
lea rdx, [rbx - 0x18]
or r14, 0xffffffffffffffff
lock add dword [rdx + 0x10], r14d
jg 0x14004c43c
mov rcx, qword [rdx]
jmp 0x14004c436
mov ecx, 0x80070057
call fcn.140001920
nop
lea rcx, str.D_r_
mov rax, qword [str.D_r_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 1], rbx
lea r14, [0x14015f170]
test r14, 0xffffffffffff0000
jne 0x14004c34a
movzx edi, r14w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004c3bb
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.140002960
mov rbx, qword [rbp - 1]
jmp 0x14004c3bb
mov esi, dword [rbx - 0x10]
mov rdi, r14
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7a
or eax, ecx
jge 0x14004c37a
mov edx, 0x7a
lea rcx, [rbp - 1]
call fcn.140002760
mov rbx, qword [rbp - 1]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xf4
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004c39a
lea r8, [rbx + rdi*2]
call fcn.1400d562c
jmp 0x14004c3a2
mov r8, r14
call fcn.1400d57ec
cmp dword [rbx - 0xc], 0x7a
jl 0x14004c5d1
mov dword [rbx - 0x10], 0x7a
mov word [rbx + 0xf4], r15w
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401d8a88]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004c420
cmp dword [rsi + 0x10], 0
jl 0x14004c40d
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004c40d
mov rcx, rdi
call fcn.1400027c0
mov rbx, rax
or r14, 0xffffffffffffffff
lock add dword [rsi + 0x10], r14d
jg 0x14004c400
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401d8a88], rax
jmp 0x14004c424
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401d8a88]
call fcn.140002670
or r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
dec eax
jg 0x14004c43c
mov rcx, qword [rdi]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x1401d1d58], 0xffffffff80000002
je 0x14004c4cc
cmp byte [0x1401d1c22], 0
je 0x14004c4cc
lea rcx, [rbp + 7]
call fcn.14004ade0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d8a90]
call fcn.140010c10
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14004c491
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0xf]
call fcn.14004ade0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401d8a88]
call fcn.140010c10
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14004c4cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x1401d1d58]
lea rcx, [0x1401d8a90]
call fcn.14004c610
mov rdx, qword [0x1401d1d58]
lea rcx, [0x1401d8a88]
call fcn.14004c610
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14004c511
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14004c52e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r13b, r13b
je 0x14004c5b7
mov r8d, dword [0x1401d6d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0xa
jne 0x14004c59d
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400d4448
mov rcx, rax
call fcn.1400d5528
mov rcx, qword [0x1401d8a88]
add rcx, 0xffffffffffffffe8
call fcn.1400027c0
add rax, 0x18
mov qword [r12], rax
jmp 0x14004c5e7
mov rcx, qword [0x1401d8a90]
add rcx, 0xffffffffffffffe8
call fcn.1400027c0
add rax, 0x18
mov qword [r12], rax
jmp 0x14004c5e7
mov ecx, 0x80070057
call fcn.140001920
nop
mov ecx, 0x80070057
call fcn.140001920
nop
mov dword [rbp - 0x21], 1
mov rax, r12
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret