Function at 0x14001b1d0
Capabilities:
Delete registry key
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x1400a3758]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r12, r8
mov r13, rdx
xor r15d, r15d
mov dword [rsp + 0x70], r15d
lea ecx, [r15 + 0x18]
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x18], rax
test rax, rax
je 0x14001b24a
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14001b24d
test r13, r13
jne 0x14001cc00
jmp 0x14001b24d
mov rbx, r15
mov qword [rbp - 0x18], rbx
test rbx, rbx
je 0x14001cce7
mov ecx, 0x18
call fcn.14004bd50
mov rdi, rax
mov qword [rbp + 8], rax
test rax, rax
je 0x14001b296
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.System32_ntdll.dll
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001cc0b
jmp 0x14001b299
mov rdi, r15
mov qword [rbp + 0x10], rdi
test rdi, rdi
je 0x14001ccf2
mov qword [rbp - 8], rbx
lock inc dword [rbx + 0x10]
mov dword [rsp + 0x70], 1
mov ecx, 0x18
call fcn.14004bd50
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001b2df
lea r8, [rbp + 0x10]
lea rdx, [rbp - 8]
mov rcx, rax
call fcn.140006f00
mov r14, rax
jmp 0x14001b2e2
mov r14, r15
test r14, r14
je 0x14001ccfd
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001b32c
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001b30d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001b31f
call fcn.14004bd8c
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
mov qword [rbp - 8], r14
mov rcx, qword [r14]
call fcn.14002ce40
mov r15d, eax
mov ecx, esi
lock xadd dword [r14 + 0x10], ecx
cmp ecx, 1
jne 0x14001b381
mov rcx, qword [r14]
test rcx, rcx
je 0x14001b35d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14001b373
call fcn.14004bd8c
mov qword [r14 + 8], 0
mov edx, 0x18
mov rcx, r14
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001b3c6
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001b3a2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001b3b8
call fcn.14004bd8c
mov qword [rdi + 8], 0
mov edx, 0x18
mov rcx, rdi
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001b40a
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001b3e7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001b3fd
call fcn.14004bd8c
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
cmp r15d, 0xffffffff
jne 0x14001b46e
mov ecx, 2
call fcn.14005a668
lea rcx, str.The_specified_directory_is_not_a_Windows_system_root
mov rdx, rax
call fcn.14005c5c0
mov ecx, 2
call fcn.14005a668
mov rdx, rax
lea rcx, [0x140081de4]
call fcn.14005c5c0
xor eax, eax
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.14004bd30
mov rbx, qword [rsp + 0x400]
add rsp, 0x3c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.SeRestorePrivilege
call fcn.140017320
lea rcx, str.SeBackupPrivilege
call fcn.140017320
mov ecx, 0x18
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x40], rax
xor r15d, r15d
test rax, rax
je 0x14001b4c6
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14001b4c9
test r13, r13
jne 0x14001cc16
jmp 0x14001b4c9
mov rbx, r15
mov qword [rbp + 0x80], rbx
test rbx, rbx
je 0x14001cce7
mov ecx, 0x18
call fcn.14004bd50
mov rdi, rax
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14001b515
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str._system32config_system
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001cc21
jmp 0x14001b518
mov rdi, r15
mov qword [rbp + 0x18], rdi
test rdi, rdi
je 0x14001cd08
mov qword [rbp - 0x40], rbx
lock inc dword [rbx + 0x10]
mov dword [rsp + 0x70], 2
mov ecx, 0x18
call fcn.14004bd50
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001b55e
lea r8, [rbp + 0x18]
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.140006f00
mov r14, rax
jmp 0x14001b561
mov r14, r15
test r14, r14
je 0x14001cd13
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001b5a6
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001b587
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001b599
call fcn.14004bd8c
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
mov r8, qword [r14]
lea rdx, str.autoruns.system
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov r15d, eax
mov ecx, esi
lock xadd dword [r14 + 0x10], ecx
cmp ecx, 1
jne 0x14001b606
mov rcx, qword [r14]
test rcx, rcx
je 0x14001b5e2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14001b5f8
call fcn.14004bd8c
mov qword [r14 + 8], 0
mov edx, 0x18
mov rcx, r14
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001b64b
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001b627
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001b63d
call fcn.14004bd8c
mov qword [rdi + 8], 0
mov edx, 0x18
mov rcx, rdi
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001b68f
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001b66c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001b682
call fcn.14004bd8c
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
cmp r15d, 0x522
jne 0x14001b6ae
mov ecx, 2
call fcn.14005a668
lea rcx, str.Autoruns_requires_Administrator_privilege_to_analyze_an_offline_system
jmp 0x14001b421
test r15d, r15d
je 0x14001b6c9
mov ecx, 2
call fcn.14005a668
lea rcx, str.Cannot_load_registry_hive_system_of_the_selected_system_root
jmp 0x14001b421
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.autoruns.system
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001b709
mov ecx, 2
call fcn.14005a668
lea rcx, str.Cannot_open_system_registry_key_of_the_selected_system_root
jmp 0x14001b421
mov ecx, 0x18
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x30], rax
xor r15d, r15d
test rax, rax
je 0x14001b749
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14001b74c
test r13, r13
jne 0x14001cc2c
jmp 0x14001b74c
mov rbx, r15
mov qword [rbp + 0x88], rbx
test rbx, rbx
je 0x14001cce7
mov ecx, 0x18
call fcn.14004bd50
mov rdi, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14001b798
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str._system32config_software
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001cc37
jmp 0x14001b79b
mov rdi, r15
mov qword [rbp + 0x20], rdi
test rdi, rdi
je 0x14001cd1e
mov qword [rbp - 0x30], rbx
lock inc dword [rbx + 0x10]
mov dword [rsp + 0x70], 4
mov ecx, 0x18
call fcn.14004bd50
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001b7e1
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.140006f00
mov r14, rax
jmp 0x14001b7e4
mov r14, r15
test r14, r14
je 0x14001cd29
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001b829
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001b80a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001b81c
call fcn.14004bd8c
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
mov r8, qword [r14]
lea rdx, str.autoruns.software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov r15d, eax
mov ecx, esi
lock xadd dword [r14 + 0x10], ecx
cmp ecx, 1
jne 0x14001b889
mov rcx, qword [r14]
test rcx, rcx
je 0x14001b865
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14001b87b
call fcn.14004bd8c
mov qword [r14 + 8], 0
mov edx, 0x18
mov rcx, r14
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001b8ce
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001b8aa
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001b8c0
call fcn.14004bd8c
mov qword [rdi + 8], 0
mov edx, 0x18
mov rcx, rdi
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001b912
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001b8ef
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001b905
call fcn.14004bd8c
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
test r15d, r15d
je 0x14001b92d
mov ecx, 2
call fcn.14005a668
lea rcx, str.Cannot_load_registry_hive_software_of_the_selected_system_root
jmp 0x14001b421
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.autoruns.software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b6f3
lea ecx, [rax + 0x18]
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14001b99d
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14001b998
test r12, r12
jne 0x14001cd34
xor r12d, r12d
jmp 0x14001b9a3
xor r12d, r12d
mov ebx, r12d
mov qword [rbp + 0x90], rbx
test rbx, rbx
je 0x14001cce7
mov ecx, 0x18
call fcn.14004bd50
mov rdi, rax
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14001b9ef
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str._ntuser.dat
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001cc42
jmp 0x14001b9f2
mov rdi, r12
mov qword [rbp + 0x28], rdi
test rdi, rdi
je 0x14001cd3f
mov qword [rbp - 0x20], rbx
lock inc dword [rbx + 0x10]
mov dword [rsp + 0x70], 8
mov ecx, 0x18
call fcn.14004bd50
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001ba38
lea r8, [rbp + 0x28]
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.140006f00
mov r14, rax
jmp 0x14001ba3b
mov r14, r12
test r14, r14
je 0x14001cd4a
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001ba80
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001ba61
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001ba73
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
mov r8, qword [r14]
lea rdx, str.autoruns.user
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov r15d, eax
mov ecx, esi
lock xadd dword [r14 + 0x10], ecx
cmp ecx, 1
jne 0x14001bad8
mov rcx, qword [r14]
test rcx, rcx
je 0x14001bab8
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r12
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14001baca
call fcn.14004bd8c
mov qword [r14 + 8], r12
mov edx, 0x18
mov rcx, r14
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001bb15
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001baf5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001bb07
call fcn.14004bd8c
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001bb51
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001bb32
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001bb44
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
test r15d, r15d
je 0x14001bb6c
mov ecx, 2
call fcn.14005a668
lea rcx, str.Cannot_load_user_registry_hive_of_the_offline_system
jmp 0x14001b421
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.autoruns.user
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b6f3
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.MicrosoftWindowsCurrentVersion
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x60], 0x208
mov word [0x1400a5560], r12w
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rbx, [0x1400a5560]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProgramFilesDir
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x60], 0x208
mov word [0x1400a5770], r12w
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdi, [0x1400a5770]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProgramFilesDir__x86_
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [0x1400a5770], 0
jne 0x14001bc59
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call fcn.140059bc8
mov rdx, rbx
lea rcx, str.PROGRAMFILES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rbx
lea rcx, str.ProgramW6432
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
lea rcx, str.PROGRAMFILES_X86_
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, 2
call fcn.140059d40
mov qword [rsp + 0x68], rax
mov word [rax], r12w
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CommonFilesDir
mov rcx, qword [rsp + 0x58]
call fcn.14002d4d0
mov rdx, qword [rsp + 0x68]
lea rcx, str.CommonProgramFiles
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rbx, qword [rsp + 0x68]
lea r15, [0x14007a7c4]
mov rcx, r15
call fcn.140059d48
mov qword [rsp + 0x68], rax
mov rcx, rbx
call fcn.140059d2c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CommonFilesDir__x86_
mov rcx, qword [rsp + 0x58]
call fcn.14002d4d0
mov rdx, qword [rsp + 0x68]
lea rcx, str.CommonProgramFiles_x86_
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rbx, qword [rsp + 0x68]
mov rcx, r15
call fcn.140059d48
mov qword [rsp + 0x68], rax
mov rcx, rbx
call fcn.140059d2c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CommonW6432Dir
mov rcx, qword [rsp + 0x58]
call fcn.14002d4d0
mov rdx, qword [rsp + 0x68]
lea rcx, str.CommonProgramW6432
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.MicrosoftWindows_NTCurrentVersion
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x60], 0x208
mov word [0x1400a5350], r12w
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdi, [0x1400a5350]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SystemRoot
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, rdi
lea rcx, str.SystemRoot
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
lea rcx, str.WinDir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x18
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14001be45
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14001cc4d
jmp 0x14001be48
mov rbx, r12
mov qword [rbp + 0x98], rbx
test rbx, rbx
je 0x14001cbf5
mov ecx, 0x18
call fcn.14004bd50
mov rdi, rax
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14001be94
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.System32
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001cc58
jmp 0x14001be97
mov rdi, r12
mov qword [rbp + 0x30], rdi
test rdi, rdi
je 0x14001cd55
mov qword [rbp - 0x10], rbx
lock inc dword [rbx + 0x10]
mov dword [rsp + 0x70], 0x10
mov ecx, 0x18
call fcn.14004bd50
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001bedd
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.140006f00
mov r14, rax
jmp 0x14001bee0
mov r14, r12
test r14, r14
je 0x14001cd60
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001bf25
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001bf06
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001bf18
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
mov rcx, qword [r14]
lea rdx, [0x1400a5c20]
nop
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x14001bf30
mov eax, esi
lock xadd dword [r14 + 0x10], eax
cmp eax, 1
jne 0x14001bf81
mov rcx, qword [r14]
test rcx, rcx
je 0x14001bf61
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r12
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14001bf73
call fcn.14004bd8c
mov qword [r14 + 8], r12
mov edx, 0x18
mov rcx, r14
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001bfbe
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001bf9e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001bfb0
call fcn.14004bd8c
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001bffa
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001bfdb
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001bfed
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
mov ecx, 0x18
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x14001c036
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x1400a5350]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14001cc63
jmp 0x14001c039
mov rbx, r12
mov qword [rbp + 0x78], rbx
test rbx, rbx
je 0x14001cbf5
mov ecx, 0x18
call fcn.14004bd50
mov rdi, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x14001c082
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.SysWow64
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001cc6e
jmp 0x14001c085
mov rdi, r12
mov qword [rbp + 0x58], rdi
test rdi, rdi
je 0x14001cd6b
mov qword [rbp - 0x58], rbx
lock inc dword [rbx + 0x10]
mov dword [rsp + 0x70], 0x20
mov ecx, 0x18
call fcn.14004bd50
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001c0cb
lea r8, [rbp + 0x58]
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.140006f00
mov r14, rax
jmp 0x14001c0ce
mov r14, r12
test r14, r14
je 0x14001cd76
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001c113
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001c0f4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001c106
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
mov rcx, qword [r14]
lea rdx, [0x1400a5e30]
nop dword [rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x14001c120
mov eax, esi
lock xadd dword [r14 + 0x10], eax
cmp eax, 1
jne 0x14001c171
mov rcx, qword [r14]
test rcx, rcx
je 0x14001c151
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r12
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14001c163
call fcn.14004bd8c
mov qword [r14 + 8], r12
mov edx, 0x18
mov rcx, r14
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001c1ae
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001c18e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001c1a0
call fcn.14004bd8c
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001c1ea
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001c1cb
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001c1dd
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
lea rbx, [0x1400a5e30]
mov rcx, rbx
call fcn.14002ce40
cmp eax, 0xffffffff
jne 0x14001c221
mov rcx, r12
lea rdx, [0x1400a5c20]
nop dword [rax + rax]
movzx eax, word [rcx + rdx]
mov word [rcx + rbx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14001c210
mov ecx, 0x18
call fcn.14004bd50
mov rdi, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14001c25d
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.autoruns.system
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001cc79
jmp 0x14001c260
mov rdi, r12
mov qword [rbp + 0x38], rdi
test rdi, rdi
je 0x14001cbf5
mov ecx, 0x18
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14001c2a9
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.SYSTEM
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14001cc84
jmp 0x14001c2ac
mov rbx, r12
mov qword [rbp - 0x50], rbx
test rbx, rbx
je 0x14001cd81
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, 0xffffffff80000002
lea r8, [rbp - 0x50]
mov rdx, r9
lea rcx, [0x1400a65b0]
call fcn.140014800
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001c31a
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001c2fa
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001c30c
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001c356
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001c337
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001c349
call fcn.14004bd8c
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.14004bd8c
mov ecx, 0x18
call fcn.14004bd50
mov rdi, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14001c392
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.autoruns.software
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001cc8f
jmp 0x14001c395
mov rdi, r12
mov qword [rbp + 0x48], rdi
test rdi, rdi
je 0x14001cbf5
mov ecx, 0x18
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14001c3de
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.SOFTWARE
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14001cc9a
jmp 0x14001c3e1
mov rbx, r12
mov qword [rbp - 0x60], rbx
test rbx, rbx
je 0x14001cd8c
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, 0xffffffff80000002
lea r8, [rbp - 0x60]
mov rdx, r9
lea rcx, [0x1400a65b0]
call fcn.140014800
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001c44f
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001c42f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001c441
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001c48b
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001c46c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001c47e
call fcn.14004bd8c
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.14004bd8c
mov ecx, 0x18
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x14001c4c7
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.autoruns.user_
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14001cca5
jmp 0x14001c4ca
mov rbx, r12
mov qword [rbp + 0x70], rbx
test rbx, rbx
je 0x14001cbf5
mov ecx, 0x18
call fcn.14004bd50
mov rdi, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x14001c50f
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001ccb0
jmp 0x14001c512
mov rdi, r12
mov qword [rbp - 0x48], rdi
test rdi, rdi
je 0x14001cd97
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, 0xffffffff80000002
lea r8, [rbp - 0x48]
lea rdx, [r9 - 1]
lea rcx, [0x1400a65b0]
call fcn.140014800
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001c581
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001c561
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001c573
call fcn.14004bd8c
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001c5bd
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001c59e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001c5b0
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
mov ecx, 0x18
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x38], rax
test rax, rax
je 0x14001c5f9
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.autoruns.softwareClasses_
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14001ccbb
jmp 0x14001c5fc
mov rbx, r12
mov qword [rbp + 0x40], rbx
test rbx, rbx
je 0x14001cbf5
mov ecx, 0x18
call fcn.14004bd50
mov rdi, rax
mov qword [rbp - 0x38], rax
test rax, rax
je 0x14001c641
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001ccc6
jmp 0x14001c644
mov rdi, r12
mov qword [rbp - 0x38], rdi
test rdi, rdi
je 0x14001cda2
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9, 0xffffffff80000002
lea r8, [rbp - 0x38]
lea rdx, [r9 - 2]
lea rcx, [0x1400a65b0]
call fcn.140014800
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001c6b3
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001c693
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001c6a5
call fcn.14004bd8c
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.14004bd8c
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001c6ef
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001c6d0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001c6e2
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
lea rcx, [0x1400a5350]
call fcn.140059d48
mov rdi, rax
mov qword [rbp + 0x68], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov rcx, r15
test r13, r13
cmovne rcx, r13
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x60], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov edx, 0x5c
mov rcx, rdi
call fcn.14004fa80
mov word [rax], r12w
mov edx, 0x5c
mov rcx, rbx
call fcn.14004fa80
mov word [rax], r12w
mov ecx, 0x18
call fcn.14004bd50
mov r14, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14001c787
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
test rax, rax
jne 0x14001c78a
test rbx, rbx
jne 0x14001ccd1
jmp 0x14001c78a
mov r14, r12
mov qword [rbp + 0x50], r14
test r14, r14
je 0x14001cdad
mov ecx, 0x18
call fcn.14004bd50
mov rbx, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14001c7d4
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14001c7d7
test rdi, rdi
jne 0x14001ccdc
jmp 0x14001c7d7
mov rbx, r12
mov qword [rbp - 0x28], rbx
test rbx, rbx
je 0x14001cdb8
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x28]
xor edx, edx
lea rcx, [0x1400a65b0]
call fcn.140014800
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14001c840
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001c820
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001c832
call fcn.14004bd8c
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14004bd8c
nop
lock xadd dword [r14 + 0x10], esi
cmp esi, 1
jne 0x14001c87c
mov rcx, qword [r14]
test rcx, rcx
je 0x14001c85c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r12
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14001c86e
call fcn.14004bd8c
mov qword [r14 + 8], r12
mov edx, 0x18
mov rcx, r14
call fcn.14004bd8c
nop
mov rcx, qword [rbp + 0x60]
call fcn.140059d2c
nop
mov rcx, qword [rbp + 0x68]
call fcn.140059d2c
mov qword [rsp + 0x58], r12
mov dword [rbp - 0x80], 0xffffffff
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Select
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x60], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Default
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rbp - 0x80]
lea rdx, str.RegistryMachine_autoruns.systemControlSet_03d
lea rcx, [rbp + 0xa0]
call fcn.140005340
mov rdi, qword [rbp - 0x78]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 8]
call fcn.1400070d0
mov rbx, rax
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x70], r12d
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CurrentControlSet
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rax, qword [rbx]
test rax, rax
je 0x14001c99f
mov rcx, qword [rax]
test rcx, rcx
je 0x14001c98f
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, eax
mov rax, qword [rbx]
jmp 0x14001c992
mov ecx, r12d
lea edx, [rcx + rcx]
test rax, rax
je 0x14001c9a2
mov rcx, qword [rax]
jmp 0x14001c9a5
mov edx, r12d
mov rcx, r12
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov r9d, 6
xor r8d, r8d
lea rdx, str.SymbolicLinkValue
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001c9dd
lea rdx, str.CurrentControlSet
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.1400053c0
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.CurrentControlSetControlSession_ManagerEnvironment
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, qword [0x1400a6048]
mov rcx, r15
call fcn.140059d48
mov qword [0x1400a6048], rax
mov rcx, rbx
call fcn.140059d2c
lea r14, [0x1400a6048]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x58]
call fcn.14002d4d0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Environment
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, qword [rsp + 0x68]
mov rcx, r15
call fcn.140059d48
mov qword [rsp + 0x68], rax
mov rcx, rbx
call fcn.140059d2c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x58]
call fcn.14002d4d0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x140082b98]
call fcn.140059d48
mov rbx, rax
xor ecx, ecx
call fcn.140059d2c
mov rax, qword [0x1400a6048]
mov rcx, r15
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rsp + 0x78], rax
xor ecx, ecx
call fcn.140059d2c
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140014250
mov rcx, rbx
call fcn.140059d2c
mov rsi, qword [rsp + 0x78]
mov rcx, r15
test rsi, rsi
cmovne rcx, rsi
call fcn.140059d48
mov qword [rsp + 0x78], rax
xor ecx, ecx
call fcn.140059d2c
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.140014250
mov rdi, qword [rsp + 0x78]
mov rbx, qword [0x1400a6048]
test rdi, rdi
cmovne r15, rdi
mov rcx, r15
call fcn.140059d48
mov qword [0x1400a6048], rax
mov rcx, rbx
call fcn.140059d2c
mov rcx, rdi
call fcn.140059d2c
mov rcx, rsi
call fcn.140059d2c
mov rdx, qword [0x1400a6048]
lea rcx, [rbp - 0x18]
call fcn.14002cd00
mov rdx, rax
mov rcx, r14
call fcn.1400140f0
mov rcx, qword [rbp - 0x18]
call fcn.140059d2c
mov rdx, qword [0x1400a6048]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x68]
call fcn.140059d2c
mov eax, 1
jmp 0x14001b444
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
nop
mov ecx, 0x8007000e
call fcn.14004dd40
int3