Function at 0x1400467f0
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
movzx r12d, dl
mov r15, rcx
xor r13d, r13d
mov dword [rbp - 0x21], r13d
mov eax, dword [0x1401bf638]
test al, 1
jne 0x14004686d
or eax, 1
mov dword [0x1401bf638], eax
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401bf640], rax
lea rcx, [0x14011b0b0]
call fcn.1400cc1f0
nop
mov eax, dword [0x1401bf638]
test al, 2
jne 0x1400468a9
or eax, 2
mov dword [0x1401bf638], eax
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401bf630], rax
lea rcx, [0x14011b070]
call fcn.1400cc1f0
nop
mov eax, dword [0x1401bf638]
test al, 4
jne 0x1400468e5
or eax, 4
mov dword [0x1401bf638], eax
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401bf628], rax
lea rcx, [0x14011b030]
call fcn.1400cc1f0
nop
mov eax, dword [0x1401bf638]
test al, 8
jne 0x14004691b
or eax, 8
mov dword [0x1401bf638], eax
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401bf648], rax
lea rcx, [0x14011aff0]
call fcn.1400cc1f0
nop
mov rax, qword [0x1401bf630]
mov ecx, dword [rax - 0x10]
mov ebx, 1
mov rax, qword [0x1401bf648]
mov rdx, qword [0x1401bec88]
test ecx, ecx
je 0x14004698b
mov ecx, r13d
test rdx, rdx
setne cl
test ecx, ecx
jne 0x140046954
mov ecx, 0x80004005
call fcn.140001920
int3
mov rcx, rax
mov r9, rdx
sub r9, rax
nop dword [rax]
movzx r8d, word [rcx]
cmp r8w, word [rcx + r9]
jne 0x14004697a
add rcx, 2
test r8w, r8w
jne 0x140046960
mov ecx, r13d
jmp 0x14004697e
sbb ecx, ecx
or ecx, ebx
test ecx, ecx
setne cl
test cl, cl
je 0x140047757
lea rcx, [rdx - 0x18]
lea rbx, [rax - 0x18]
cmp rcx, rbx
je 0x1400469df
cmp dword [rbx + 0x10], 0
jl 0x1400469cf
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400469cf
call fcn.1400024f0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x1400469c2
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401bf648], rax
jmp 0x1400469df
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401bf648]
call fcn.1400023a0
mov rax, qword [0x1401bf640]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140046a3f
cmp dword [rdx + 0x10], 0
jge 0x140046a1b
cmp dword [rax - 0xc], 0
jge 0x140046a0a
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], r13d
mov rax, qword [0x1401bf640]
mov word [rax], r13w
jmp 0x140046a3f
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140046a2b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401bf640], rax
mov rax, qword [0x1401bf630]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140046aa6
cmp dword [rdx + 0x10], 0
jge 0x140046a82
cmp dword [rax - 0xc], 0
jge 0x140046a6a
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401bf630]
mov dword [rax - 0x10], r13d
mov rax, qword [0x1401bf630]
mov word [rax], r13w
jmp 0x140046aa6
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140046a92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401bf630], rax
mov rax, qword [0x1401bf628]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140046b06
cmp dword [rdx + 0x10], 0
jge 0x140046ae2
cmp dword [rax - 0xc], 0
jge 0x140046ad1
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], r13d
mov rax, qword [0x1401bf628]
mov word [rax], r13w
jmp 0x140046b06
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140046af2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401bf628], rax
mov esi, r13d
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x29], rbx
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Volatile_Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140046ec8
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140046e6b
mov dword [rbp + 0x77], 0x104
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140046bce
mov edx, 0x82
lea rcx, [rbp - 0x29]
call fcn.140002490
mov rbx, qword [rbp - 0x29]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140046c24
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400cc6d4
test eax, eax
js 0x140046c19
cmp eax, dword [rbx - 0xc]
jg 0x140046c19
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
jmp 0x140046c73
mov ecx, 0x80070057
call fcn.140001920
int3
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140046c73
cmp dword [rdx + 0x10], 0
jge 0x140046c52
cmp dword [rbx - 0xc], 0
jge 0x140046c48
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x140046c73
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140046c62
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x29], rbx
mov dword [rbp + 0x77], 0x104
mov rax, qword [0x1401bf640]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x82
or ecx, edx
jge 0x140046cae
mov edx, 0x82
lea rcx, [0x1401bf640]
call fcn.140002490
mov rax, qword [0x1401bf640]
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.Local_AppData
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140046d17
mov rcx, qword [0x1401bf640]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400cc6d4
test eax, eax
js 0x140046d0c
mov rcx, qword [0x1401bf640]
cmp eax, dword [rcx - 0xc]
jg 0x140046d0c
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [0x1401bf640]
mov word [rax + rcx*2], r13w
jmp 0x140046d7b
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401bf640]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140046d7b
cmp dword [rdx + 0x10], 0
jge 0x140046d53
cmp dword [rax - 0xc], 0
jge 0x140046d42
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], r13d
mov rax, qword [0x1401bf640]
mov word [rax], r13w
jmp 0x140046d7b
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140046d63
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401bf640], rax
mov rbx, qword [rbp - 0x29]
mov dword [rbp + 0x77], 0x104
mov rax, qword [rbp - 0x39]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140046da8
mov edx, 0x82
lea rcx, [rbp - 0x39]
call fcn.140002490
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbp - 0x39]
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140046e02
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400cc6d4
test eax, eax
js 0x140046df7
cmp eax, dword [rdi - 0xc]
jg 0x140046df7
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r13w
jmp 0x140046e5f
mov ecx, 0x80070057
call fcn.140001920
int3
mov rdx, qword [0x1401bf640]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp - 0x39]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140046e5f
cmp dword [rdi + 0x10], 0
jl 0x140046e52
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140046e52
call fcn.1400024f0
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140046e44
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x39], rax
mov rbx, qword [rbp - 0x29]
jmp 0x140046e5f
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x39]
call fcn.1400023a0
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140046ec8
mov rdx, qword [0x1401bf640]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp - 0x39]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140046ec8
cmp dword [rdi + 0x10], 0
jl 0x140046ebb
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140046ebb
call fcn.1400024f0
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140046ead
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x39], rax
mov rbx, qword [rbp - 0x29]
jmp 0x140046ec8
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x39]
call fcn.1400023a0
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr ax, 8
movzx edx, al
cmp ecx, 6
ja 0x140046eec
jne 0x140047185
cmp edx, 1
jbe 0x140047185
mov ecx, dword [0x1401bdd80]
imul ecx, ecx
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0x14
jne 0x140046f27
mov edx, 0xe2
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400cc3f4
mov dil, 1
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400470a6
mov dword [rbp + 0x77], 0x104
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140046f85
mov edx, 0x82
lea rcx, [rbp - 0x29]
call fcn.140002490
mov rbx, qword [rbp - 0x29]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140047093
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400cc6d4
test eax, eax
js 0x140047088
cmp eax, dword [rbx - 0xc]
jg 0x140047088
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
xor dil, dil
cmp dword [rbx - 0x10], 0
jl 0x140047007
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400cc8a4
test rax, rax
je 0x140047007
sub rax, rbx
sar rax, 1
test eax, eax
mov eax, 1
cmove esi, eax
call fcn.140046430
test al, al
jne 0x140047093
mov ecx, dword [0x1401bdd80]
test ecx, ecx
je 0x140047093
nop
mov eax, ecx
and eax, 0x80000001
jge 0x140047030
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140047045
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401bdd80], eax
jmp 0x140047052
lea ecx, [rcx*2 + 1]
mov dword [0x1401bdd80], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x140047074
sub edx, 2
je 0x140047077
dec edx
je 0x140047079
jmp 0x140047082
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401bdd80], ecx
test ecx, ecx
jne 0x140047020
jmp 0x140047093
mov ecx, 0x80070057
call fcn.140001920
int3
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
je 0x14004718a
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140047185
mov dword [rbp + 0x77], 0x104
mov edi, 1
mov ecx, edi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140047103
mov edx, 0x82
lea rcx, [rbp - 0x29]
call fcn.140002490
mov rbx, qword [rbp - 0x29]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.DefaultValue
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400cc6d4
test eax, eax
js 0x14004717a
cmp eax, dword [rbx - 0xc]
jg 0x14004717a
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx - 0x10], 0
jl 0x14004718a
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400cc8a4
test rax, rax
je 0x14004718a
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x14004718a
mov esi, edi
jmp 0x14004718a
mov ecx, 0x80070057
call fcn.140001920
int3
mov esi, 1
lea r13, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
cmp qword [0x1401b8d58], 0xffffffff80000002
jne 0x140047262
mov rdx, qword [0x1401bec88]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401bf630]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140047204
cmp dword [rbx + 0x10], 0
jl 0x1400471f4
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400471f4
call fcn.1400024f0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x1400471e7
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401bf630], rax
jmp 0x140047204
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401bf630]
call fcn.1400023a0
mov rcx, qword [rbp - 0x39]
add rcx, 0xffffffffffffffe8
mov rbx, qword [0x1401bf640]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140047427
cmp dword [rbx + 0x10], 0
jl 0x14004731b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004731b
call fcn.1400024f0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140047252
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401bf640], rax
jmp 0x140047427
test esi, esi
je 0x140047337
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb al
test al, al
je 0x1400471a2
cmp byte [0x1401bdea4], 0
jne 0x1400471a2
lea rdx, str.Software_
lea rcx, [rbp - 1]
call fcn.1400021f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401bf630]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400472fa
cmp dword [rbx + 0x10], 0
jl 0x1400472e9
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400472e9
call fcn.1400024f0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x1400472dc
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401bf630], rax
jmp 0x1400472fa
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401bf630]
call fcn.1400023a0
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140047204
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140047204
mov rdi, qword [rbp - 0x39]
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [0x1401bf640]
call fcn.1400023a0
jmp 0x140047427
call fcn.140046620
test al, al
jne 0x140047359
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x1401bf640]
call fcn.140010970
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x11], rbx
test r13, 0xffffffffffff0000
jne 0x14004739c
movzx edi, r13w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x1400473b2
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.140002690
jmp 0x1400473ae
mov r8d, 0x7a
mov rdx, r13
lea rcx, [rbp - 0x11]
call fcn.1400023a0
mov rbx, qword [rbp - 0x11]
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401bf630]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x140047414
cmp dword [rsi + 0x10], 0
jl 0x140047400
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x140047400
mov rcx, rdi
call fcn.1400024f0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x1400473f3
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401bf630], rax
jmp 0x140047414
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401bf630]
call fcn.1400023a0
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140047427
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x1401bf630]
cmp dword [rcx - 0x10], 0
jl 0x1400474c5
lea rdx, str.windows_ie_ac_001
call fcn.1400cc8a4
test rax, rax
je 0x1400474c5
sub rax, qword [0x1401bf630]
sar rax, 1
test eax, eax
jle 0x1400474c5
mov rdx, qword [0x1401bec88]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401bf628]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140047678
cmp dword [rbx + 0x10], 0
jl 0x1400474b0
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400474b0
call fcn.1400024f0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x1400474a0
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401bf628], rax
jmp 0x140047678
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401bf628]
call fcn.1400023a0
jmp 0x140047678
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb al
test al, al
je 0x1400475aa
cmp byte [0x1401bdea4], 0
jne 0x1400475aa
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x19], rbx
lea rax, str.Software_
test rax, 0xffffffffffff0000
jne 0x14004752d
movzx edi, ax
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140047543
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.140002690
jmp 0x14004753f
mov r8d, 9
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.1400023a0
mov rbx, qword [rbp - 0x19]
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401bf628]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x1400475a5
cmp dword [rsi + 0x10], 0
jl 0x140047591
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x140047591
mov rcx, rdi
call fcn.1400024f0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x140047584
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401bf628], rax
jmp 0x1400475a5
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401bf628]
call fcn.1400023a0
nop
jmp 0x140047665
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 9], rbx
test r13, 0xffffffffffff0000
jne 0x1400475ed
movzx edi, r13w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140047603
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.140002690
jmp 0x1400475ff
mov r8d, 0x7a
mov rdx, r13
lea rcx, [rbp - 9]
call fcn.1400023a0
mov rbx, qword [rbp - 9]
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401bf628]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x140047665
cmp dword [rsi + 0x10], 0
jl 0x140047651
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x140047651
mov rcx, rdi
call fcn.1400024f0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x140047644
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401bf628], rax
jmp 0x140047665
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401bf628]
call fcn.1400023a0
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140047678
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x1401b8d58], 0xffffffff80000002
je 0x1400476fa
cmp byte [0x1401b8c22], 0
je 0x1400476fa
lea rcx, [rbp + 0xf]
call fcn.1400464b0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401bf630]
call fcn.140010970
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400476c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 7]
call fcn.1400464b0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401bf628]
call fcn.140010970
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400476fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x1401b8d58]
lea rcx, [0x1401bf630]
call fcn.1400477b0
mov rdx, qword [0x1401b8d58]
lea rcx, [0x1401bf628]
call fcn.1400477b0
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004773a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140047752
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, 1
test r12b, r12b
je 0x140047775
mov rcx, qword [0x1401bf628]
add rcx, 0xffffffffffffffe8
call fcn.1400024f0
add rax, 0x18
mov qword [r15], rax
jmp 0x14004778c
mov rcx, qword [0x1401bf630]
add rcx, 0xffffffffffffffe8
call fcn.1400024f0
add rax, 0x18
mov qword [r15], rax
mov dword [rbp - 0x21], ebx
mov rax, r15
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret