Function at 0x14009a440
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2f8
movaps xmmword [rsp + 0x2e0], xmm7
movaps xmmword [rsp + 0x2d0], xmm6
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x2c8], rax
lea rsi, [rdx + 8]
mov rdx, qword [rdx + 8]
mov rcx, rdi
call fcn.1400fc850
mov qword [rdi], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x40], rdi
movups xmmword [rdi + 8], xmm0
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x1c0], r12
movaps xmm6, xmmword [0x14026f080]
movaps xmmword [rsp + 0x1b0], xmm6
lea rax, [rsp + 0x252]
mov byte [rax + 0x15], 2
lea rcx, [0x140277960]
lea rsi, [rsp + 0x250]
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c89c
mov word [rsp + 0x250], 0x7670
mov byte [rsp + 0x252], 0
mov qword [rsp + 0x1f0], r12
movaps xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], 0
cmp byte [rbx + 0x5f], 0
js 0x14009a524
lea rdx, [rbx + 0x48]
jmp 0x14009a528
mov rdx, qword [rbx + 0x48]
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov qword [rsp + 0x38], rbx
jne 0x14009a5c4
mov dword [rsp + 0x1d0], 0
mov dword [rsp + 0x230], 0xaaaaaaaa
cmp byte [rsp + 0x267], 0
mov rdx, rsi
jns 0x14009a57f
mov rdx, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x1f0]
lea rdi, [rsp + 0x1d0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x230]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14009bb8e
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rsp + 0x267], 0
jns 0x14009a5db
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
movsx rax, byte [rsp + 0x1c7]
test rax, rax
jns 0x14009a5f1
mov rax, qword [rsp + 0x1b8]
test rax, rax
je 0x14009c67f
lea rdx, [rbx + 0x60]
mov rcx, rbx
call fcn.14009c8f0
test al, al
jne 0x14009a61e
lea rdx, [rbx + 0x78]
mov rcx, rbx
call fcn.14009c8f0
test al, al
je 0x14009b348
movabs rcx, 0x8000000000000000
movsx rdi, byte [rbx + 0xbf]
mov rsi, rdi
test rdi, rdi
jns 0x14009a63f
mov rsi, qword [rbx + 0xb0]
lea rbx, [rsi + 0xc]
lea rax, [rcx - 9]
mov qword [rsp + 0x1a0], r12
movaps xmmword [rsp + 0x190], xmm6
cmp rbx, rax
ja 0x14009c89f
cmp rbx, 0xa
mov qword [rsp + 0x80], rax
jbe 0x14009a76b
lea rax, [rcx - 4]
and rax, rbx
add rax, 4
mov r14, rbx
or r14, 3
cmp r14, 0xb
cmove r14, rax
inc r14
js 0x14009c8a8
mov r15, rcx
lea rcx, [r14 + r14]
call fcn.14018f5b8
or r14, r15
mov qword [rsp + 0x1a0], r14
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], rbx
mov rbx, qword [rsp + 0x38]
lea rcx, [rbx + 0xa8]
mov rdx, rcx
test dil, dil
jns 0x14009a6d3
mov rdx, qword [rcx]
mov qword [rsp + 0x70], rcx
lea rdi, [rax + rsi*2]
cmp rdx, rax
setb cl
cmp rdi, rdx
setbe r8b
or r8b, cl
je 0x14009c8a2
test rsi, rsi
je 0x14009a705
add rsi, rsi
mov rcx, rax
mov r8, rsi
call fcn.1401cd6f0
lea rax, [rdi + 0x18]
lea rcx, [0x14027796a]
cmp rdi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c8a5
movups xmm0, xmmword [0x14027796a]
movups xmmword [rdi], xmm0
movabs rax, 0x7400610064002e
mov qword [rdi + 0x10], rax
mov word [rdi + 0x18], 0
lea rcx, [rsp + 0xd0]
mov r8d, 0xc0
xor edx, edx
call fcn.1401cdd90
cmp byte [rsp + 0x1a7], 0
js 0x14009a789
lea r9, [rsp + 0x190]
jmp 0x14009a791
xorps xmm0, xmm0
lea rax, [rsp + 0x190]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov byte [rax + 0x17], bl
jmp 0x14009a6bc
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a79d
mov rdx, qword [rbx]
lea r8, str.Name
lea rcx, [rsp + 0x250]
call fcn.14009cfd0
cmp byte [rsp + 0xe7], 0
jns 0x14009a7c8
mov rcx, qword [rsp + 0xd0]
call fcn.14018f5b0
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0xe0], rax
movups xmm0, xmmword [rsp + 0x250]
movaps xmmword [rsp + 0xd0], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a7fc
lea r9, [rsp + 0x190]
jmp 0x14009a804
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a810
mov rdx, qword [rbx]
lea rsi, [rsp + 0xe8]
lea r8, [0x14027798e]
lea rcx, [rsp + 0x250]
call fcn.14009cfd0
cmp byte [rsi + 0x17], 0
jns 0x14009a83f
mov rcx, qword [rsp + 0xe8]
call fcn.14018f5b0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a86a
lea r9, [rsp + 0x190]
jmp 0x14009a872
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a87e
mov rdx, qword [rbx]
lea rsi, [rsp + 0x100]
lea r8, [0x14027799e]
lea rcx, [rsp + 0x250]
call fcn.14009cfd0
cmp byte [rsi + 0x17], 0
jns 0x14009a8ad
mov rcx, qword [rsp + 0x100]
call fcn.14018f5b0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a8d8
lea r9, [rsp + 0x190]
jmp 0x14009a8e0
mov r9, qword [rsp + 0x190]
mov qword [rsp + 0x78], rsi
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a8f1
mov rdx, qword [rbx]
lea rsi, [rsp + 0x118]
lea r8, str.URL1
lea rcx, [rsp + 0x250]
call fcn.14009cfd0
cmp byte [rsi + 0x17], 0
jns 0x14009a920
mov rcx, qword [rsp + 0x118]
call fcn.14018f5b0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a94b
lea r9, [rsp + 0x190]
jmp 0x14009a953
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a95f
mov rdx, qword [rbx]
lea rsi, [rsp + 0x130]
lea r8, [0x1402779b0]
lea rcx, [rsp + 0x250]
call fcn.14009cfd0
cmp byte [rsi + 0x17], 0
jns 0x14009a98e
mov rcx, qword [rsp + 0x130]
call fcn.14018f5b0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009a9b9
lea r9, [rsp + 0x190]
jmp 0x14009a9c1
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009a9cd
mov rdx, qword [rbx]
lea rsi, [rsp + 0x148]
lea r8, str.ServerFileName
lea rcx, [rsp + 0x250]
call fcn.14009cfd0
cmp byte [rsi + 0x17], 0
jns 0x14009a9fc
mov rcx, qword [rsp + 0x148]
call fcn.14018f5b0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x14009aa27
lea r9, [rsp + 0x190]
jmp 0x14009aa2f
mov r9, qword [rsp + 0x190]
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14009aa3b
mov rdx, qword [rbx]
lea rdi, [rsp + 0x160]
lea r8, str.UpdatedApplications
lea rcx, [rsp + 0x250]
call fcn.14009cfd0
cmp byte [rdi + 0x17], 0
jns 0x14009aa6a
mov rcx, qword [rsp + 0x160]
call fcn.14018f5b0
mov rax, qword [rsp + 0x260]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rdi], xmm0
lea rsi, [rsp + 0xb0]
mov qword [rsi + 0x10], r12
movaps xmmword [rsi], xmm6
mov rcx, rsi
mov qword [rsp + 0x68], rdi
mov rdx, rdi
mov r8b, 0x3b
call fcn.14009d160
mov rbx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x88], rax
cmp rbx, rax
je 0x14009aabf
xorps xmm7, xmm7
jmp 0x14009b7e9
movsx rax, byte [rsp + 0xe7]
test rax, rax
mov rdi, qword [rsp + 0x38]
jns 0x14009aada
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x14009b254
movsx rax, byte [rsp + 0xff]
test rax, rax
jns 0x14009aaf9
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x14009b254
movsx rax, byte [rsp + 0x117]
test rax, rax
jns 0x14009ab18
mov rax, qword [rsp + 0x108]
test rax, rax
je 0x14009b254
movsx rax, byte [rsp + 0x147]
test rax, rax
jns 0x14009ab37
mov rax, qword [rsp + 0x138]
test rax, rax
je 0x14009b254
movsx rax, byte [rsp + 0x15f]
test rax, rax
jns 0x14009ab56
mov rax, qword [rsp + 0x150]
test rax, rax
je 0x14009b254
movsx rax, byte [rsp + 0x177]
test rax, rax
jns 0x14009ab75
mov rax, qword [rsp + 0x168]
test rax, rax
je 0x14009b254
lea r12, [rsp + 0x1b0]
mov rcx, r12
call fcn.14009d6a0
mov rcx, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x180]
jmp 0x14009aba9
cmp r8, rax
jb 0x14009abc1
add rcx, 0x38
cmp rcx, rdx
je 0x14009adfc
mov r8, qword [rcx + 0x18]
cmp byte [rcx + 0x20], 1
jne 0x14009aba0
cmp r8, rax
ja 0x14009aba5
mov r8, qword [rcx + 0x28]
cmp byte [rcx + 0x30], 1
je 0x14009abd2
cmp r8, rax
jbe 0x14009aba5
jmp 0x14009abd7
cmp r8, rax
jb 0x14009aba5
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
call fcn.1400a2040
mov rsi, rax
mov dword [rdi + 0xc0], 0
mov rax, qword [rdi + 0xe0]
mov rcx, qword [rdi + 0xe8]
mov rdx, rcx
sub rdx, rax
dec rcx
cmp rdx, rcx
ja 0x14009c8b7
mov qword [rdi + 0xe8], rax
cmp byte [rsp + 0x117], 0
jns 0x14009ac3e
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x78], rax
mov rcx, rsi
mov edx, 0x2712
mov r8, qword [rsp + 0x78]
call fcn.1400a1ff0
mov rcx, rsi
mov edx, 0x40
xor r8d, r8d
call fcn.1400a1ff0
mov rcx, rsi
mov edx, 0x51
xor r8d, r8d
call fcn.1400a1ff0
lea r8, [0x14009d840]
mov rcx, rsi
mov edx, 0x4e2b
call fcn.1400a1ff0
mov rcx, rsi
mov edx, 0x2711
mov r8, rdi
call fcn.1400a1ff0
mov rcx, rsi
mov edx, Ordinal_14
mov r8d, 0xb4
call fcn.1400a1ff0
mov rcx, rsi
call fcn.1400a2150
mov qword [rsp + 0x250], rsi
test rsi, rsi
je 0x14009acc9
lea rcx, [rsp + 0x250]
call fcn.1400a9920
mov rdx, qword [rdi + 0xe0]
mov r8, qword [rdi + 0xe8]
cmp rdx, r8
je 0x14009c543
sub r8d, edx
lea rsi, [rsp + 0x1f0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm6
lea r15, [rsp + 0x250]
movaps xmmword [r15], xmm6
movaps xmmword [r15 + 0x40], xmm6
movaps xmmword [r15 + 0x50], xmm6
movups xmmword [r15 + 0x5c], xmm6
movaps xmmword [r15 + 0x30], xmm6
movaps xmmword [r15 + 0x20], xmm6
movaps xmmword [r15 + 0x10], xmm6
mov byte [r15], 0
mov qword [r15 + 0x44], 0
mov dword [r15 + 0x4c], 0x67452301
movabs rax, 0x98badcfeefcdab89
mov qword [r15 + 0x50], rax
mov dword [r15 + 0x58], 0x10325476
mov rcx, r15
call fcn.140094200
mov rcx, r15
call fcn.1400942c0
mov rcx, r15
mov rdx, rsi
call fcn.140094e00
mov bl, byte [rsi + 0x17]
test bl, bl
mov r8, qword [rsi + 8]
movzx eax, bl
mov rdx, rax
cmovs rdx, r8
movsx rcx, byte [rsp + 0x147]
mov r9, rcx
test rcx, rcx
jns 0x14009ad97
mov r9, qword [rsp + 0x138]
cmp rdx, r9
lea rsi, [rsp + 0x148]
lea rdx, [rsp + 0x130]
jne 0x14009c134
test cl, cl
jns 0x14009adbc
mov rdx, qword [rsp + 0x130]
test bl, bl
js 0x14009c11f
je 0x14009bcc3
xor ecx, ecx
mov r8b, byte [rsp + rcx + 0x1f0]
cmp r8b, byte [rdx + rcx]
jne 0x14009c134
inc rcx
cmp rax, rcx
jne 0x14009adcc
jmp 0x14009bcc3
mov qword [rax + 0x40], Ordinal_26
mov rax, qword [rax + 0x38]
jmp 0x14009ae97
lea r14, [rsp + 0x256]
mov byte [r14 + 0x11], 6
lea rax, str.status
lea r8, [rsp + 0x250]
cmp r8, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009c8ab
mov word [rsp + 0x254], 0x7375
mov dword [rsp + 0x250], 0x74617473
mov byte [rsp + 0x256], 0
lea rdi, [rsp + 0x1d0]
mov qword [rdi], r8
lea rbx, [rsp + 0x230]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275abb]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182960
mov rax, qword [rsi]
cmp byte [rax + 0x4f], 0
js 0x14009adeb
mov byte [rax + 0x4f], 0x13
add rax, 0x38
movups xmm0, xmmword [str.no_update_available]
movups xmmword [rax], xmm0
mov dword [rax + 0xf], 0x656c6261
mov byte [rax + 0x13], 0
cmp byte [rsp + 0x267], 0
lea r8, [rsp + 0x250]
jns 0x14009aed3
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
lea r8, [rsp + 0x250]
mov byte [rsp + 0x267], 6
lea rax, str.ver_pv
cmp r8, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009c8ae
mov word [rsp + 0x254], 0x7670
mov dword [rsp + 0x250], 0x5f726576
mov byte [rsp + 0x256], 0
mov qword [rsp + 0x1d0], r8
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275abb]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182960
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
cmp rcx, r12
je 0x14009af80
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x1c7]
js 0x14009c7b3
test r8b, r8b
js 0x14009b23a
mov rax, qword [rsp + 0x1c0]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009af97
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
lea rax, [rsp + 0x25e]
mov byte [rax + 9], reloc.WLDAP32.dll_Ordinal_14
lea rcx, str.verToBeUpdated
lea r8, [rsp + 0x250]
cmp r8, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c8b1
movabs rax, 0x6465746164705565
mov qword [rsp + 0x256], rax
movabs rax, 0x5565426f54726576
mov qword [rsp + 0x250], rax
mov byte [rsp + 0x25e], 0
mov qword [rsp + 0x1d0], r8
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275abb]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182960
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
lea rdx, [rsp + 0x160]
cmp rcx, rdx
je 0x14009b05e
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x177]
js 0x14009c794
test r8b, r8b
js 0x14009b220
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009b075
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
mov rsi, qword [rsp + 0xb0]
test rsi, rsi
je 0x14009b0b6
mov rdi, qword [rsp + 0xb8]
cmp rdi, rsi
je 0x14009b0ae
add rdi, 0xffffffffffffffe8
test rdi, rdi
je 0x14009c899
cmp byte [rdi + 0x17], 0
js 0x14009b0d9
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
jne 0x14009b093
mov rcx, rsi
call fcn.14018f5b0
mov rsi, qword [rsp + 0x178]
test rsi, rsi
je 0x14009b11d
mov rdi, qword [rsp + 0x180]
mov rcx, rsi
cmp rdi, rsi
je 0x14009b110
add rdi, 0xffffffffffffffc8
jmp 0x14009b0f7
mov rcx, qword [rdi]
call fcn.14018f5b0
jmp 0x14009b0a2
mov rcx, qword [rdi]
call fcn.14018f5b0
lea rax, [rdi - 0x38]
cmp rdi, rsi
mov rdi, rax
je 0x14009b108
test rdi, rdi
je 0x14009c87b
cmp byte [rdi + 0x17], 0
jns 0x14009b0eb
jmp 0x14009b0e3
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x180], rsi
call fcn.14018f5b0
cmp byte [rsp + 0x177], 0
jns 0x14009b134
mov rcx, qword [rsp + 0x160]
call fcn.14018f5b0
cmp byte [rsp + 0x15f], 0
jns 0x14009b14b
mov rcx, qword [rsp + 0x148]
call fcn.14018f5b0
cmp byte [rsp + 0x147], 0
jns 0x14009b162
mov rcx, qword [rsp + 0x130]
call fcn.14018f5b0
cmp byte [rsp + 0x12f], 0
jns 0x14009b179
mov rcx, qword [rsp + 0x118]
call fcn.14018f5b0
cmp byte [rsp + 0x117], 0
jns 0x14009b190
mov rcx, qword [rsp + 0x100]
call fcn.14018f5b0
cmp byte [rsp + 0xff], 0
jns 0x14009b1a7
mov rcx, qword [rsp + 0xe8]
call fcn.14018f5b0
cmp byte [rsp + 0xe7], 0
jns 0x14009b1be
mov rcx, qword [rsp + 0xd0]
call fcn.14018f5b0
cmp byte [rsp + 0x1a7], 0
jns 0x14009b1d5
mov rcx, qword [rsp + 0x190]
call fcn.14018f5b0
cmp byte [rsp + 0x1c7], 0
jns 0x14009b1ec
mov rcx, qword [rsp + 0x1b0]
call fcn.14018f5b0
mov rcx, qword [rsp + 0x2c8]
xor rcx, rsp
call fcn.140191d80
movaps xmm6, xmmword [rsp + 0x2d0]
movaps xmm7, xmmword [rsp + 0x2e0]
add rsp, 0x2f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
call fcn.14011d130
jmp 0x14009b05e
mov rdx, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1b8]
call fcn.14011d130
jmp 0x14009af80
mov dword [rdi + 0xc0], 0x67
lea rcx, [rsp + 0x250]
mov edx, 0x67
call fcn.1401f31c0
lea rax, [rsp + 0x1f5]
mov byte [rax + 0x12], 5
lea rcx, str.error
lea r8, [rsp + 0x1f0]
cmp r8, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c8b4
mov dword [rsp + 0x1f0], 0x6f727265
mov word [rsp + 0x1f4], Ordinal_117
lea rax, [rsp + 0x230]
mov qword [rax], r8
lea rcx, [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140275abb]
lea rsi, [rsp + 0x1d0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182960
mov rax, qword [rsi]
lea rsi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009b302
mov rcx, qword [rsi]
call fcn.14018f5b0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
xor eax, eax
mov byte [rsp + 0x267], al
mov byte [rsp + 0x250], al
cmp byte [rsp + 0x207], al
jns 0x14009b075
mov rcx, qword [rsp + 0x1f0]
call fcn.14018f5b0
jmp 0x14009b05e
mov edx, dword [rbx + 0xc0]
lea rcx, [rsp + 0xd0]
call fcn.1401f31c0
lea rax, [rsp + 0x255]
mov byte [rax + 0x12], 5
lea rcx, str.error
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c8c9
mov dword [rsp + 0x250], 0x6f727265
mov word [rsp + 0x254], Ordinal_117
lea rax, [rsp + 0x1d0]
mov qword [rax], rsi
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140275abb]
lea rdi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
mov r8, rsi
call fcn.140182960
mov rax, qword [rdi]
lea rsi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009b3e8
mov rcx, qword [rsi]
call fcn.14018f5b0
mov rax, qword [rsp + 0xe0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rsi], xmm0
xor eax, eax
mov byte [rsp + 0xe7], al
mov byte [rsp + 0xd0], al
cmp byte [rsp + 0x267], al
jns 0x14009b1d5
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
cmp byte [rsp + 0xe7], 0
jns 0x14009b1d5
mov rcx, qword [rsp + 0xd0]
jmp 0x14009b1d0
mov rcx, r15
mov rdx, qword [rsp + 0x48]
mov r8, rbp
call fcn.14011ed30
jmp 0x14009b516
xor esi, esi
jmp 0x14009b4da
mov r12, r14
mov rcx, qword [rsp + 0x178]
sub r15, rcx
sar r15, 3
movabs r8, 0x6db6db6db6db6db7
imul r15, r8
lea r14, [r15 + 1]
movabs rdx, 0x492492492492492
cmp r14, rdx
ja 0x14009c887
sub rax, rcx
sar rax, 3
imul rax, r8
lea rcx, [rax + rax]
cmp rcx, r14
cmova r14, rcx
movabs rcx, 0x249249249249249
cmp rax, rcx
cmovae r14, rdx
test r14, r14
mov qword [rsp + 0x48], rsi
je 0x14009b459
cmp r14, rdx
ja 0x14009c893
imul rcx, r14, 0x38
call fcn.14018f5b8
mov rsi, rax
imul r15, r15, 0x38
add r15, rsi
je 0x14009c88a
test dil, dil
js 0x14009b444
mov rax, qword [rsp + 0x48]
mov qword [r15], rax
mov qword [r15 + 8], rbp
mov eax, dword [rsp + 0x230]
mov ecx, dword [rsp + 0x233]
mov dword [r15 + 0x10], eax
mov dword [r15 + 0x13], ecx
mov byte [r15 + 0x17], dil
mov qword [r15 + 0x18], r13
mov rax, qword [rsp + 0x60]
mov byte [r15 + 0x20], al
mov eax, dword [rsp + 0x210]
mov ecx, dword [rsp + 0x213]
mov dword [r15 + 0x21], eax
mov dword [r15 + 0x24], ecx
mov qword [r15 + 0x28], r12
mov rax, qword [rsp + 0x58]
mov byte [r15 + 0x30], al
mov r12, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
mov rax, r12
sub rax, rbp
lea r13, [r15 + rax]
je 0x14009b66d
mov rax, r12
mov rcx, r13
test rcx, rcx
je 0x14009c875
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
movups xmm0, xmmword [rax + 0x18]
movups xmm1, xmmword [rax + 0x21]
movups xmmword [rcx + 0x21], xmm1
movups xmmword [rcx + 0x18], xmm0
add rax, 0x38
add rcx, 0x38
cmp rax, rbp
jne 0x14009b56c
jmp 0x14009b5c3
mov rcx, qword [r12]
call fcn.14018f5b0
add r12, 0x38
cmp r12, rbp
je 0x14009b665
test r12, r12
je 0x14009c872
cmp byte [r12 + 0x17], 0
jns 0x14009b5b6
jmp 0x14009b5ad
mov rcx, qword [r12]
call fcn.14018f5b0
jmp 0x14009b620
mov rcx, rsi
call fcn.14009d6a0
mov r13, rax
lea rcx, [rsi + 0x18]
call fcn.14009d6a0
jmp 0x14009b5fc
xor r13d, r13d
xor eax, eax
mov qword [rsp + 0x50], rax
test rsi, rsi
je 0x14009b635
cmp r12, rsi
je 0x14009b62d
add r12, 0xffffffffffffffe8
test r12, r12
je 0x14009c881
cmp byte [r12 + 0x17], 0
js 0x14009b5d6
lea rax, [r12 - 0x18]
cmp r12, rsi
mov r12, rax
jne 0x14009b60f
mov rcx, rsi
call fcn.14018f5b0
mov al, byte [rsp + 0x207]
movabs r12, 0xaaaaaaaaaaaaaaaa
mov rsi, qword [rsp + 0x48]
test al, al
jns 0x14009b6e5
mov rcx, qword [rsp + 0x1f0]
call fcn.14018f5b0
jmp 0x14009b6e5
mov r12, qword [rsp + 0x178]
imul rax, r14, 0x38
add rsi, rax
add r15, 0x38
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x188], rsi
test r12, r12
je 0x14009b69d
mov rcx, r12
call fcn.14018f5b0
movabs r12, 0xaaaaaaaaaaaaaaaa
mov rsi, qword [rsp + 0x48]
jmp 0x14009b7c2
mov rcx, r15
mov rdx, rsi
mov r8, rbp
call fcn.14011ed30
jmp 0x14009b78e
mov rcx, qword [r14]
call fcn.14018f5b0
jmp 0x14009b703
xor esi, esi
xor ebp, ebp
xor edi, edi
xor r13d, r13d
xor eax, eax
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
test r15, r15
je 0x14009b717
cmp r14, r15
je 0x14009b70f
add r14, 0xffffffffffffffe8
test r14, r14
je 0x14009c878
cmp byte [r14 + 0x17], 0
js 0x14009b6c4
lea rax, [r14 - 0x18]
cmp r14, r15
mov r14, rax
jne 0x14009b6f3
mov rcx, r15
call fcn.14018f5b0
mov r14, qword [rsp + 0x50]
test dil, dil
movzx eax, dil
cmovs rax, rbp
test r13, r13
je 0x14009b7ca
test rax, rax
je 0x14009b7ca
test r14, r14
je 0x14009b7ca
mov r15, qword [rsp + 0x180]
mov rax, qword [rsp + 0x188]
cmp r15, rax
jae 0x14009b45d
test r15, r15
je 0x14009c884
test dil, dil
js 0x14009b6b1
mov qword [r15], rsi
mov qword [r15 + 8], rbp
mov eax, dword [rsp + 0x230]
mov ecx, dword [rsp + 0x233]
mov dword [r15 + 0x10], eax
mov dword [r15 + 0x13], ecx
mov byte [r15 + 0x17], dil
mov qword [r15 + 0x18], r13
mov rax, qword [rsp + 0x60]
mov byte [r15 + 0x20], al
mov eax, dword [rsp + 0x210]
mov ecx, dword [rsp + 0x213]
mov dword [r15 + 0x21], eax
mov dword [r15 + 0x24], ecx
mov qword [r15 + 0x28], r14
mov rax, qword [rsp + 0x58]
mov byte [r15 + 0x30], al
add r15, 0x38
mov qword [rsp + 0x180], r15
test dil, dil
jns 0x14009b7d7
mov rcx, rsi
call fcn.14018f5b0
add rbx, 0x18
cmp rbx, qword [rsp + 0x88]
je 0x14009aabf
mov eax, 0xaaaaaaaa
mov dword [rsp + 0x213], eax
mov dword [rsp + 0x210], eax
xor eax, eax
mov dword [rsp + 0x230], eax
mov dword [rsp + 0x233], eax
movsx rax, byte [rbx + 0x17]
test rax, rax
jns 0x14009b81a
mov rax, qword [rbx + 8]
test rax, rax
je 0x14009b8aa
mov qword [rsp + 0x260], r12
movaps xmmword [rsp + 0x250], xmm6
lea rcx, [rsp + 0x250]
mov rdx, rbx
mov r8b, Ordinal_41
call fcn.14009d160
mov r15, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x258]
mov rax, rsi
sub rax, r15
cmp rax, 0x30
je 0x14009b8ea
lea rcx, [rsp + 0x1f0]
mov rdx, rbx
mov r8b, 0x5b
call fcn.14009d160
test r15, r15
jne 0x14009bb53
mov r15, qword [rsp + 0x1f0]
mov r14, qword [rsp + 0x1f8]
mov qword [rsp + 0x250], r15
mov qword [rsp + 0x258], r14
mov r13b, 1
mov rsi, r14
jmp 0x14009b8f0
xor esi, esi
xor ebp, ebp
xor edi, edi
xor r13d, r13d
xor eax, eax
mov qword [rsp + 0x60], rax
xor r14d, r14d
xor eax, eax
mov qword [rsp + 0x58], rax
jmp 0x14009b71c
mov rdx, qword [r15 + 0x18]
mov r8, qword [r15 + 0x20]
lea rcx, [rsp + 0x1f0]
call fcn.14011ed30
jmp 0x14009b934
cmp rdx, rcx
ja 0x14009b960
jmp 0x14009c87e
xor r13d, r13d
mov r14, rsi
sub rsi, r15
cmp rsi, 0x30
mov qword [rsp + 0x60], r13
jne 0x14009b6ce
mov qword [rsp + 0x200], r12
movaps xmmword [rsp + 0x1f0], xmm6
cmp byte [r15 + 0x2f], 0
js 0x14009b8c9
lea rax, [r15 + 0x18]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x200], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1f0], xmm0
movsx rax, byte [rsp + 0x207]
test rax, rax
mov rdx, qword [rsp + 0x1f8]
mov rcx, rax
cmovs rcx, rdx
dec rcx
test rax, rax
js 0x14009b8e0
cmp rcx, rax
jae 0x14009c87e
test al, al
mov r8, qword [rsp + 0x1f0]
lea r9, [rsp + 0x1f0]
cmovs r9, r8
movzx r9d, byte [r9 + rcx]
xor r10d, r10d
cmp r9d, 0x29
je 0x14009b9a9
cmp r9d, 0x5d
je 0x14009b9a6
xor ecx, ecx
mov qword [rsp + 0x58], rcx
xor esi, esi
xor ebp, ebp
xor edi, edi
xor r13d, r13d
xor ecx, ecx
mov qword [rsp + 0x50], rcx
jmp 0x14009b64b
mov r10b, 1
test al, al
jns 0x14009bb32
cmp rdx, rcx
jb 0x14009c890
mov qword [rsp + 0x1f8], rcx
mov byte [r8 + rcx], 0
cmp r14, r15
je 0x14009c88d
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x1e0], r12
movaps xmmword [rsp + 0x1d0], xmm6
cmp byte [r15 + 0x17], 0
js 0x14009bb16
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x1e0], rax
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x1d0], xmm0
lea rsi, [rsp + 0x1d0]
movsx rdi, byte [rsp + 0x1e7]
test rdi, rdi
mov rax, qword [rsp + 0x1d0]
mov rbp, qword [rsp + 0x1d8]
cmovs rsi, rax
mov r12, rdi
cmovs r12, rbp
test r12, r12
je 0x14009bb0c
xor edi, edi
movsx ecx, byte [rsi + rdi]
call fcn.14018fab4
mov byte [rsi + rdi], al
inc rdi
cmp r12, rdi
jne 0x14009ba42
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x1d8]
mov dil, byte [rsp + 0x1e7]
lea rcx, [rsp + 0x1e0]
mov eax, dword [rcx]
mov ecx, dword [rcx + 3]
mov dword [rsp + 0x233], ecx
mov dword [rsp + 0x230], eax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x1e0], rax
movaps xmmword [rsp + 0x1d0], xmm6
lea rcx, [rsp + 0x1d0]
lea rdx, [rsp + 0x1f0]
mov r8b, Ordinal_46
call fcn.14009d160
mov rsi, qword [rsp + 0x1d0]
mov r12, qword [rsp + 0x1d8]
mov rax, r12
sub rax, rsi
sar rax, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rax, rcx
cmp rax, 2
je 0x14009b5e1
cmp rax, 1
jne 0x14009b5f7
mov rcx, rsi
call fcn.14009d6a0
mov r13, rax
jmp 0x14009b5fc
mov qword [rsp + 0x48], rax
jmp 0x14009ba73
mov rdx, qword [r15]
mov r8, qword [r15 + 8]
lea rsi, [rsp + 0x1d0]
mov rcx, rsi
call fcn.14011ed30
jmp 0x14009ba10
cmp rcx, rax
ja 0x14009c890
mov eax, ecx
and al, 0x7f
mov byte [rsp + 0x207], al
lea r8, [rsp + 0x1f0]
jmp 0x14009b9c2
cmp rsi, r15
je 0x14009bb77
add rsi, 0xffffffffffffffe8
test rsi, rsi
je 0x14009c896
cmp byte [rsi + 0x17], 0
js 0x14009bb84
lea rax, [rsi - 0x18]
cmp rsi, r15
mov rsi, rax
jne 0x14009bb5c
mov rcx, r15
call fcn.14018f5b0
jmp 0x14009b882
mov rcx, qword [rsi]
call fcn.14018f5b0
jmp 0x14009bb6b
mov eax, dword [rsp + 0x230]
dec eax
cmp eax, 1
ja 0x14009a5b6
mov qword [rsp + 0xe0], r12
movaps xmmword [rsp + 0xd0], xmm6
mov ebx, dword [rsp + 0x1d0]
cmp rbx, 0x17
jae 0x14009c7d5
lea r14, [rsp + 0xd0]
mov byte [r14 + 0x17], bl
test rbx, rbx
je 0x14009bbdf
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.1401cdd90
mov byte [r14 + rbx], 0
cmp byte [rsp + 0xe7], 0
js 0x14009bbf8
lea rax, [rsp + 0xd0]
jmp 0x14009bc00
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x38]
cmp byte [rsp + 0x267], 0
js 0x14009bc19
lea rdx, [rsp + 0x250]
jmp 0x14009bc21
mov rdx, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x1f0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14009bc63
cmp byte [rsp + 0xe7], 0
jns 0x14009a5b6
mov rcx, qword [rsp + 0xd0]
call fcn.14018f5b0
jmp 0x14009a5b6
cmp byte [rsp + 0x1c7], 0
movzx r8d, byte [rsp + 0xe7]
js 0x14009c826
test r8b, r8b
js 0x14009bca4
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x1c0], rax
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x1b0], xmm0
jmp 0x14009a5b6
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xd8]
lea rcx, [rsp + 0x1b0]
call fcn.14011d130
jmp 0x14009bc43
lea rax, [rsp + 0x258]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rax + 8], rcx
movaps xmmword [rax - 8], xmm6
mov byte [rax + 0xf], 4
lea rcx, str..msi
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c8cf
movabs rax, 0x690073006d002e
mov qword [rsp + 0x250], rax
mov word [rsp + 0x258], 0
movsx rcx, byte [rsp + 0x15f]
mov rax, rsi
test rcx, rcx
mov rdi, qword [rsp + 0x38]
jns 0x14009bd3e
mov rax, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x150]
inc rcx
cmp rcx, 1
je 0x14009bd86
lea r8, [rcx - 1]
cmp byte [rax + rcx - 2], 0x2e
mov rcx, r8
jne 0x14009bd41
test r8, r8
je 0x14009bd86
lea rax, [rsp + 0x230]
mov qword [rsp + 0x20], rax
mov rdx, rsi
lea rsi, [rsp + 0x1d0]
mov rcx, rsi
mov r9, 0xffffffffffffffff
call fcn.140119de0
mov al, byte [rsi + 0x17]
jmp 0x14009bd96
xor eax, eax
mov byte [rsp + 0x1e7], al
mov byte [rsp + 0x1d0], al
test al, al
movzx r8d, al
lea rdx, [rsp + 0x1d0]
cmovs r8, qword [rdx + 8]
mov rcx, qword [rdx]
cmovs rdx, rcx
test r8, r8
js 0x14009c8d2
sete r9b
test rdx, rdx
setne r10b
or r10b, r9b
je 0x14009c8d5
cmp r8, 3
je 0x14009bdd7
xor esi, esi
jmp 0x14009bdf1
movzx r8d, word [rdx]
xor r8d, 0x7865
movzx edx, byte [rdx + 2]
xor edx, 0x65
or dx, r8w
sete sil
test al, al
jns 0x14009bdfa
call fcn.14018f5b0
test sil, sil
je 0x14009be5c
cmp byte [rsp + 0x267], 0
jns 0x14009be3e
mov qword [rsp + 0x258], 4
mov rax, qword [rsp + 0x250]
jmp 0x14009be49
xorps xmm0, xmm0
lea rax, [rsp + 0x210]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov byte [rax + 0x17], r14b
jmp 0x14009bf1f
mov byte [rsp + 0x267], 4
mov rax, r15
movabs rcx, 0x6500780065002e
mov qword [rax], rcx
mov word [rax + 8], 0
lea rsi, [rsp + 0x1d0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm6
lea r8, [rsp + 0x250]
mov rcx, rsi
mov rdx, rdi
call fcn.1401dc330
movsx rdi, byte [rdi + 0xbf]
mov rbx, rdi
test rdi, rdi
jns 0x14009bea4
mov rax, qword [rsp + 0x38]
mov rbx, qword [rax + 0xb0]
lea r14, [rbx + 1]
cmp r14, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
ja 0x14009c8d8
cmp r14, 0xa
jbe 0x14009be1f
movabs rbp, 0x8000000000000000
lea rax, [rbp - 4]
and rax, r14
add rax, 4
mov r13, r14
or r13, 3
cmp r13, 0xb
cmove r13, rax
inc r13
js 0x14009c8e1
lea rcx, [r13*2]
call fcn.14018f5b8
or rbp, r13
mov qword [rsp + 0x220], rbp
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r14
mov rdx, qword [rsp + 0x70]
test dil, dil
jns 0x14009bf27
mov rdx, qword [rdx]
lea rdi, [rax + rbx*2]
cmp rdx, rax
setb cl
cmp rdi, rdx
setbe r8b
or r8b, cl
je 0x14009c8db
test rbx, rbx
je 0x14009bf54
add rbx, rbx
mov rcx, rax
mov r8, rbx
call fcn.1401cd6f0
lea rax, [rdi + 2]
lea rcx, [0x14027793a]
cmp rdi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c8de
movsx r8, byte [rsp + 0x1e7]
test r8, r8
cmovs r8, qword [rsp + 0x1d8]
mov dword [rdi], 0x5c
cmovs rsi, qword [rsp + 0x1d0]
lea rbx, [rsp + 0x210]
mov rcx, rbx
mov rdx, rsi
call fcn.14016ee40
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x240], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x230], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
cmp byte [rbx + 0x17], 0
jns 0x14009bfe2
mov rcx, qword [rsp + 0x210]
call fcn.14018f5b0
cmp byte [rsp + 0x247], 0
mov rbx, qword [rsp + 0x38]
js 0x14009bffb
lea rcx, [rsp + 0x230]
jmp 0x14009c003
mov rcx, qword [rsp + 0x230]
lea rdx, [0x140274766]
call fcn.1401ada20
test rax, rax
setne dil
je 0x14009c0bb
mov rsi, rax
mov rcx, qword [rbx + 0xe0]
mov r8, qword [rbx + 0xe8]
sub r8, rcx
mov edx, 1
mov r9, rax
call fcn.1401b1230
mov rcx, rsi
call fcn.1401af6d4
cmp byte [rsp + 0xa7], 0
movzx r8d, byte [rsp + 0x247]
js 0x14009c84c
test r8b, r8b
js 0x14009c0de
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [rsp + 0x230]
movaps xmmword [rsp + 0x90], xmm0
cmp byte [rsp + 0x1e7], 0
jns 0x14009c098
mov rcx, qword [rsp + 0x1d0]
call fcn.14018f5b0
cmp byte [rsp + 0x267], 0
jns 0x14009c0af
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
mov bl, byte [rsp + 0x207]
jmp 0x14009c145
mov dword [rbx + 0xc0], 0x6b
cmp byte [rsp + 0x247], 0
jns 0x14009c081
mov rcx, qword [rsp + 0x230]
call fcn.14018f5b0
jmp 0x14009c081
mov rdx, qword [rsp + 0x230]
mov r8, qword [rsp + 0x238]
lea rcx, [rsp + 0x90]
call fcn.14000ae50
jmp 0x14009c0c5
test r8b, r8b
cmovs r8, qword [rsp + 0x1b8]
cmovs r12, qword [rsp + 0x1b0]
mov rdx, r12
call fcn.14011d220
jmp 0x14009c33d
mov rcx, qword [rsp + 0x1f0]
call fcn.1401cd540
test eax, eax
je 0x14009bcc3
mov rax, qword [rsp + 0x38]
mov dword [rax + 0xc0], 0x6a
xor edi, edi
test bl, bl
jns 0x14009c156
mov rcx, qword [rsp + 0x1f0]
call fcn.14018f5b0
test dil, dil
mov rax, qword [rsp + 0x38]
je 0x14009c53b
cmp byte [rsp + 0xa7], 0
js 0x14009c1a3
lea r8, [rsp + 0x90]
jmp 0x14009c1ab
mov rdx, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1b8]
call fcn.14011d130
jmp 0x14009c33d
mov qword [rax + 0x40], 0x10
mov rax, qword [rax + 0x38]
jmp 0x14009c268
mov r8, qword [rsp + 0x90]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.open
lea r9, [0x140277a30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea r14, [rsp + 0x256]
mov byte [r14 + 0x11], 6
lea rax, str.status
cmp r15, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009c8ba
mov word [rsp + 0x254], 0x7375
mov dword [rsp + 0x250], 0x74617473
mov byte [rsp + 0x256], 0
lea rdi, [rsp + 0x1d0]
mov qword [rdi], r15
lea rbx, [rsp + 0x230]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275abb]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182960
mov rax, qword [rsi]
cmp byte [rax + 0x4f], 0
js 0x14009c192
mov byte [rax + 0x4f], 0x10
add rax, 0x38
movups xmm0, xmmword [str.Update_initiated]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
cmp byte [rsp + 0x267], 0
jns 0x14009c28d
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
mov byte [rsp + 0x267], 6
lea rax, str.ver_pv
cmp r15, rax
seta cl
cmp r14, rax
setbe al
or al, cl
je 0x14009c8bd
mov word [rsp + 0x254], 0x7670
mov dword [rsp + 0x250], 0x5f726576
mov byte [rsp + 0x256], 0
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275abb]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182960
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
cmp rcx, r12
je 0x14009c33d
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x1c7]
js 0x14009c0fd
test r8b, r8b
js 0x14009c178
mov rax, qword [rsp + 0x1c0]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009c354
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
lea rax, [rsp + 0x25e]
mov byte [rax + 9], reloc.WLDAP32.dll_Ordinal_14
lea rcx, str.verToBeUpdated
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c8c0
movabs rax, 0x6465746164705565
mov qword [rsp + 0x256], rax
movabs rax, 0x5565426f54726576
mov qword [rsp + 0x250], rax
mov byte [rsp + 0x25e], 0
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275abb]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182960
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
lea rdx, [rsp + 0x160]
cmp rcx, rdx
je 0x14009c416
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0x177]
js 0x14009c656
test r8b, r8b
js 0x14009c50a
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009c42d
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
lea rax, [rsp + 0x261]
mov byte [rax + 6], 0x11
lea rcx, str.newVerToInstalled
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c8c3
movups xmm0, xmmword [str.newVerToInstalled]
movaps xmmword [rsp + 0x250], xmm0
mov word [rsp + 0x260], 0x64
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x140275abb]
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r15
call fcn.140182960
mov rax, qword [rsi]
lea rcx, [rax + 0x38]
lea rdx, [rsp + 0xe8]
cmp rcx, rdx
je 0x14009c4d8
cmp byte [rax + 0x4f], 0
movzx r8d, byte [rsp + 0xff]
js 0x14009c637
test r8b, r8b
js 0x14009c524
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
cmp byte [rsp + 0x267], 0
jns 0x14009c4ef
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
cmp byte [rsp + 0xa7], 0
jns 0x14009b075
mov rcx, qword [rsp + 0x90]
jmp 0x14009b070
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
call fcn.14011d130
jmp 0x14009c416
mov rdx, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xf0]
call fcn.14011d130
jmp 0x14009c4d8
mov edx, dword [rax + 0xc0]
jmp 0x14009c552
mov dword [rdi + 0xc0], 0x69
mov edx, 0x69
lea rcx, [rsp + 0x250]
call fcn.1401f31c0
lea rax, [rsp + 0x1f5]
mov byte [rax + 0x12], 5
lea rcx, str.error
lea r8, [rsp + 0x1f0]
cmp r8, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c8cc
mov dword [rsp + 0x1f0], 0x6f727265
mov word [rsp + 0x1f4], Ordinal_117
lea rax, [rsp + 0x230]
mov qword [rax], r8
lea rcx, [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140275abb]
lea rsi, [rsp + 0x1d0]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140182960
mov rax, qword [rsi]
lea rsi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009c5f1
mov rcx, qword [rsi]
call fcn.14018f5b0
mov rax, qword [rsp + 0x260]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmmword [rsi], xmm0
xor eax, eax
mov byte [rsp + 0x267], al
mov byte [rsp + 0x250], al
cmp byte [rsp + 0x207], al
jns 0x14009c4ef
mov rcx, qword [rsp + 0x1f0]
call fcn.14018f5b0
jmp 0x14009c4d8
test r8b, r8b
jns 0x14009c64c
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xe8]
call fcn.14011d220
jmp 0x14009c4d8
test r8b, r8b
jns 0x14009c670
mov r8, qword [rsp + 0x168]
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
call fcn.14011d220
jmp 0x14009c416
mov dword [rbx + 0xc0], Ordinal_117
lea rcx, [rsp + 0xd0]
mov edx, 0x6c
call fcn.1401f31c0
lea rax, [rsp + 0x255]
mov byte [rax + 0x12], 5
lea rcx, str.error
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14009c8c6
mov dword [rsp + 0x250], 0x6f727265
mov word [rsp + 0x254], Ordinal_117
lea rax, [rsp + 0x1d0]
mov qword [rax], rsi
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x140275abb]
lea rbx, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
mov r8, rsi
call fcn.140182960
mov rax, qword [rbx]
lea rdi, [rax + 0x38]
cmp byte [rax + 0x4f], 0
jns 0x14009c728
mov rcx, qword [rdi]
call fcn.14018f5b0
mov rax, qword [rsp + 0xe0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdi], xmm0
xor eax, eax
mov byte [rsp + 0xe7], al
mov byte [rsp + 0xd0], al
cmp byte [rsp + 0x267], al
js 0x14009c762
mov rbx, qword [rsp + 0x38]
jmp 0x14009a5fa
mov rcx, qword [rsp + 0x250]
call fcn.14018f5b0
cmp byte [rsp + 0xe7], 0
mov rbx, qword [rsp + 0x38]
jns 0x14009a5fa
mov rcx, qword [rsp + 0xd0]
call fcn.14018f5b0
jmp 0x14009a5fa
test r8b, r8b
jns 0x14009c7a9
mov r8, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x160]
call fcn.14011d220
jmp 0x14009b05e
test r8b, r8b
cmovs r8, qword [rsp + 0x1b8]
cmovs r12, qword [rsp + 0x1b0]
mov rdx, r12
call fcn.14011d220
jmp 0x14009af80
mov eax, ebx
and eax, 0xfffffff8
add rax, 8
mov r15, rbx
or r15, 7
cmp r15, 0x17
cmove r15, rax
lea rcx, [r15 + 1]
call fcn.14018f5b8
mov r14, rax
mov qword [rsp + 0xd0], rax
movabs rax, 0x8000000000000000
add rax, r15
inc rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xd8], rbx
jmp 0x14009bbd2
test r8b, r8b
lea rdx, [rsp + 0xd0]
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
lea rcx, [rsp + 0x1b0]
call fcn.14011d220
jmp 0x14009bc43
test r8b, r8b
lea rdx, [rsp + 0x230]
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
lea rcx, [rsp + 0x90]
call fcn.14000af50
jmp 0x14009c0c5
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3