Function at 0x140027c20
Capabilities:
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x10300
call fcn.14009a1c0
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x10330], rbx
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x102f0], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor ebp, ebp
mov dword [rsp + 0x48], ebp
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rbp
mov word [rcx + 8], bp
mov dword [rsp + 0x48], 1
mov qword [rsp + 0xd0], 7
mov qword [rsp + 0xc8], rbp
mov word [rsp + 0xb8], bp
mov word [rsp + 0x2f0], bp
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x2f2]
call fcn.1400719a0
mov dword [rsp + 0x30], 0x8000
lea rdx, str.LogonServerRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140027d19
mov r8d, 0x10000
lea rdx, [rsp + 0x2f0]
lea rcx, str.LogonServer
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.TempRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
je 0x140029aa6
lea rdx, str.TmpRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
je 0x140029aa6
lea rdx, str.ProgramFilesRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140027f7d
lea rax, [rsp + 0x30]
mov edi, 0xea
test rax, rax
je 0x140027e61
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027e61
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.ProgramFilesDir
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov edx, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test eax, eax
jne 0x140027e0f
cmp edx, 0x10000
jbe 0x140027dfb
mov esi, edi
jmp 0x140027e0f
cmp ecx, 1
je 0x140027e0f
cmp ecx, 2
je 0x140027e0f
cmp ecx, 7
je 0x140027e18
mov esi, 0x545
cmp ecx, 7
jne 0x140027e4e
test esi, esi
jne 0x140027e4e
test edx, edx
je 0x140027e4e
mov esi, 0x545
shr edx, 1
mov dword [rsp + 0x38], edx
mov ecx, ebp
dec edx
je 0x140027e4e
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x140027e40
cmp bp, word [rax + 2]
je 0x140027e4c
inc ecx
add rax, 2
cmp ecx, edx
jae 0x140027e4e
jmp 0x140027e35
mov esi, ebp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x140027f50
lea rax, [rsp + 0x30]
test rax, rax
je 0x140027f50
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027f50
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.ProgramFilesPath
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test eax, eax
jne 0x140027f0b
cmp edx, 0x10000
jbe 0x140027ef7
mov eax, edi
jmp 0x140027f0b
cmp ecx, 1
je 0x140027f0b
cmp ecx, 2
je 0x140027f0b
cmp ecx, 7
je 0x140027f14
mov eax, 0x545
cmp ecx, 7
jne 0x140027f45
test eax, eax
jne 0x140027f45
test edx, edx
je 0x140027f45
shr edx, 1
mov dword [rsp + 0x38], edx
mov ecx, ebp
dec edx
je 0x140027f45
lea rax, [rsp + 0x2f0]
nop dword [rax]
cmp bp, word [rax]
jne 0x140027f3b
cmp bp, word [rax + 2]
je 0x140027f45
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140027f30
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.ProgramsRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x1400280b3
lea rax, [rsp + 0x30]
test rax, rax
je 0x140028086
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028086
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Programs
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140028042
cmp eax, 0x10000
jbe 0x14002802e
mov edi, 0xea
jmp 0x140028042
cmp ecx, 1
je 0x140028042
cmp ecx, 2
je 0x140028042
cmp ecx, 7
je 0x14002804b
mov edi, 0x545
cmp ecx, 7
jne 0x14002807b
test edi, edi
jne 0x14002807b
test eax, eax
je 0x14002807b
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x14002807b
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x140028071
cmp bp, word [rax + 2]
je 0x14002807b
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140028066
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CommonFilesRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x1400281ed
lea rax, [rsp + 0x30]
test rax, rax
je 0x1400281c0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400281c0
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.CommonFilesDir
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140028178
cmp eax, 0x10000
jbe 0x140028164
mov edi, 0xea
jmp 0x140028178
cmp ecx, 1
je 0x140028178
cmp ecx, 2
je 0x140028178
cmp ecx, 7
je 0x140028181
mov edi, 0x545
cmp ecx, 7
jne 0x1400281b5
test edi, edi
jne 0x1400281b5
test eax, eax
je 0x1400281b5
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x1400281b5
lea rax, [rsp + 0x2f0]
nop dword [rax]
cmp bp, word [rax]
jne 0x1400281ab
cmp bp, word [rax + 2]
je 0x1400281b5
inc ecx
add rax, 2
cmp ecx, edx
jb 0x1400281a0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CacheRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028323
lea rax, [rsp + 0x30]
test rax, rax
je 0x1400282f6
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400282f6
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Cache
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x1400282b2
cmp eax, 0x10000
jbe 0x14002829e
mov edi, 0xea
jmp 0x1400282b2
cmp ecx, 1
je 0x1400282b2
cmp ecx, 2
je 0x1400282b2
cmp ecx, 7
je 0x1400282bb
mov edi, 0x545
cmp ecx, 7
jne 0x1400282eb
test edi, edi
jne 0x1400282eb
test eax, eax
je 0x1400282eb
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x1400282eb
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x1400282e1
cmp bp, word [rax + 2]
je 0x1400282eb
inc ecx
add rax, 2
cmp ecx, edx
jb 0x1400282d6
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.WindowsRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028343
mov rcx, rbx
call fcn.140029e60
jmp 0x140029b08
lea rdx, str.RecycledRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028480
mov rcx, rbx
call fcn.140029e60
test al, al
je 0x140029b08
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400ad338]
mov rcx, rbx
call fcn.1400127e0
cmp rax, 0xffffffffffffffff
je 0x140029b08
mov qword [rsp + 0xa8], 7
mov qword [rsp + 0xa0], rbp
mov word [rsp + 0x90], bp
lea rdx, [rax + 1]
mov rax, qword [rbx + 0x18]
cmp rdx, rax
ja 0x1400283c3
or r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.1400019e0
jmp 0x1400283d1
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.1400022f0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.140001500
mov r8d, 8
lea rdx, str.RECYCLED
lea rcx, [rsp + 0x88]
call fcn.14000a130
xor edx, edx
lea rcx, [rsp + 0x2f0]
call fcn.140067f44
cmp eax, 0xffffffff
jne 0x140028447
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.140001500
mov r8d, 8
lea rdx, str.RECYCLER
lea rcx, [rsp + 0x88]
call fcn.14000a130
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x88]
mov rcx, rbx
call fcn.140001500
nop
cmp qword [rsp + 0xa8], 8
jb 0x140029b08
mov rcx, qword [rsp + 0x90]
call fcn.140065920
jmp 0x140029b08
lea rdx, str.Root
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x1400284f6
mov rcx, rbx
call fcn.140029e60
test al, al
je 0x140029b08
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400ad338]
mov rcx, rbx
call fcn.1400127e0
cmp rax, 0xffffffffffffffff
je 0x140029b08
lea rdx, [rax + 1]
mov rax, qword [rbx + 0x18]
cmp rdx, rax
ja 0x1400284e3
or r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.1400019e0
jmp 0x140029b08
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.1400022f0
jmp 0x140029b08
lea rdx, [0x1400affa8]
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028516
mov rcx, rbx
call fcn.140029dc0
jmp 0x140029b08
lea rdx, str.StartUpRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x14002864d
lea rax, [rsp + 0x30]
test rax, rax
je 0x140028620
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028620
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.StartUp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x1400285db
cmp eax, 0x10000
jbe 0x1400285c7
mov edi, 0xea
jmp 0x1400285db
cmp ecx, 1
je 0x1400285db
cmp ecx, 2
je 0x1400285db
cmp ecx, 7
je 0x1400285e4
mov edi, 0x545
cmp ecx, 7
jne 0x140028615
test edi, edi
jne 0x140028615
test eax, eax
je 0x140028615
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x140028615
lea rax, [rsp + 0x2f0]
nop
cmp bp, word [rax]
jne 0x14002860b
cmp bp, word [rax + 2]
je 0x140028615
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140028600
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.StartMenuRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028783
lea rax, [rsp + 0x30]
test rax, rax
je 0x140028756
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028756
mov dword [rsp + 0x38], 0x8000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Start_Menu
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140028712
cmp eax, 0x8000
jbe 0x1400286fe
mov edi, 0xea
jmp 0x140028712
cmp ecx, 1
je 0x140028712
cmp ecx, 2
je 0x140028712
cmp ecx, 7
je 0x14002871b
mov edi, 0x545
cmp ecx, 7
jne 0x14002874b
test edi, edi
jne 0x14002874b
test eax, eax
je 0x14002874b
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x14002874b
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x140028741
cmp bp, word [rax + 2]
je 0x14002874b
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140028736
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.DriversRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x1400287cf
mov rcx, rbx
call fcn.140029dc0
test al, al
je 0x140029b08
lea rdx, [0x1400ad338]
mov rcx, rbx
call fcn.140011dd0
mov r8d, 7
lea rdx, str.drivers
mov rcx, rbx
call fcn.14000a130
jmp 0x140029b08
lea rdx, str.FavoritesRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028905
lea rax, [rsp + 0x30]
test rax, rax
je 0x1400288d8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400288d8
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Favorites
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140028894
cmp eax, 0x10000
jbe 0x140028880
mov edi, 0xea
jmp 0x140028894
cmp ecx, 1
je 0x140028894
cmp ecx, 2
je 0x140028894
cmp ecx, 7
je 0x14002889d
mov edi, 0x545
cmp ecx, 7
jne 0x1400288cd
test edi, edi
jne 0x1400288cd
test eax, eax
je 0x1400288cd
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x1400288cd
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x1400288c3
cmp bp, word [rax + 2]
je 0x1400288cd
inc ecx
add rax, 2
cmp ecx, edx
jb 0x1400288b8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.MyDocumentsRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028a80
lea rax, [rsp + 0x30]
test rax, rax
je 0x140029b08
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029b08
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Personal
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x1400289ca
cmp eax, 0x10000
jbe 0x1400289b6
mov edi, 0xea
jmp 0x1400289ca
cmp ecx, 1
je 0x1400289ca
cmp ecx, 2
je 0x1400289ca
cmp ecx, 7
je 0x1400289d3
mov edi, 0x545
cmp ecx, 7
jne 0x140028a0c
test edi, edi
jne 0x140028a0c
test eax, eax
je 0x140028a0c
mov edi, 0x545
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x140028a0c
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x1400289fe
cmp bp, word [rax + 2]
je 0x140028a0a
inc ecx
add rax, 2
cmp ecx, edx
jae 0x140028a0c
jmp 0x1400289f3
mov edi, ebp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140029b08
lea rcx, [rsp + 0x2f0]
call fcn.140067e30
mov rdi, rax
test rax, rax
je 0x140028a53
mov r8d, 0x8000
lea rdx, [rsp + 0x2f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
call fcn.14006664c
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.UserProfileRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028b25
lea r8, [0x1400ad838]
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call fcn.140065de0
mov r8, rdi
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call fcn.140065928
lea r8, [0x1400ad838]
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call fcn.140065928
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0xe0]
call fcn.140057b20
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.DesktopRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028c5d
lea rax, [rsp + 0x30]
test rax, rax
je 0x140028c30
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028c30
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.DESKTOP
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140028bea
cmp eax, 0x10000
jbe 0x140028bd6
mov edi, 0xea
jmp 0x140028bea
cmp ecx, 1
je 0x140028bea
cmp ecx, 2
je 0x140028bea
cmp ecx, 7
je 0x140028bf3
mov edi, 0x545
cmp ecx, 7
jne 0x140028c25
test edi, edi
jne 0x140028c25
test eax, eax
je 0x140028c25
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x140028c25
lea rax, [rsp + 0x2f0]
nop
cmp bp, word [rax]
jne 0x140028c1b
cmp bp, word [rax + 2]
je 0x140028c25
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140028c10
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.AppdataRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028d93
lea rax, [rsp + 0x30]
test rax, rax
je 0x140028d66
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028d66
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140028d22
cmp eax, 0x10000
jbe 0x140028d0e
mov edi, 0xea
jmp 0x140028d22
cmp ecx, 1
je 0x140028d22
cmp ecx, 2
je 0x140028d22
cmp ecx, 7
je 0x140028d2b
mov edi, 0x545
cmp ecx, 7
jne 0x140028d5b
test edi, edi
jne 0x140028d5b
test eax, eax
je 0x140028d5b
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x140028d5b
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x140028d51
cmp bp, word [rax + 2]
je 0x140028d5b
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140028d46
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CommonAppdataRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140028ecd
lea rax, [rsp + 0x30]
test rax, rax
je 0x140028ea0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028ea0
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Common_AppData
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140028e58
cmp eax, 0x10000
jbe 0x140028e44
mov edi, 0xea
jmp 0x140028e58
cmp ecx, 1
je 0x140028e58
cmp ecx, 2
je 0x140028e58
cmp ecx, 7
je 0x140028e61
mov edi, 0x545
cmp ecx, 7
jne 0x140028e95
test edi, edi
jne 0x140028e95
test eax, eax
je 0x140028e95
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x140028e95
lea rax, [rsp + 0x2f0]
nop dword [rax]
cmp bp, word [rax]
jne 0x140028e8b
cmp bp, word [rax + 2]
je 0x140028e95
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140028e80
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CommonDesktopRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140029003
lea rax, [rsp + 0x30]
test rax, rax
je 0x140028fd6
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028fd6
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Common_DESKTOP
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140028f92
cmp eax, 0x10000
jbe 0x140028f7e
mov edi, 0xea
jmp 0x140028f92
cmp ecx, 1
je 0x140028f92
cmp ecx, 2
je 0x140028f92
cmp ecx, 7
je 0x140028f9b
mov edi, 0x545
cmp ecx, 7
jne 0x140028fcb
test edi, edi
jne 0x140028fcb
test eax, eax
je 0x140028fcb
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x140028fcb
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x140028fc1
cmp bp, word [rax + 2]
je 0x140028fcb
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140028fb6
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CommonDocumentsRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x14002913d
lea rax, [rsp + 0x30]
test rax, rax
je 0x140029110
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029110
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Common_Documents
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x1400290c8
cmp eax, 0x10000
jbe 0x1400290b4
mov edi, 0xea
jmp 0x1400290c8
cmp ecx, 1
je 0x1400290c8
cmp ecx, 2
je 0x1400290c8
cmp ecx, 7
je 0x1400290d1
mov edi, 0x545
cmp ecx, 7
jne 0x140029105
test edi, edi
jne 0x140029105
test eax, eax
je 0x140029105
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x140029105
lea rax, [rsp + 0x2f0]
nop dword [rax]
cmp bp, word [rax]
jne 0x1400290fb
cmp bp, word [rax + 2]
je 0x140029105
inc ecx
add rax, 2
cmp ecx, edx
jb 0x1400290f0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CommonFavoritesRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140029273
lea rax, [rsp + 0x30]
test rax, rax
je 0x140029246
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029246
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Common_Favorites
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140029202
cmp eax, 0x10000
jbe 0x1400291ee
mov edi, 0xea
jmp 0x140029202
cmp ecx, 1
je 0x140029202
cmp ecx, 2
je 0x140029202
cmp ecx, 7
je 0x14002920b
mov edi, 0x545
cmp ecx, 7
jne 0x14002923b
test edi, edi
jne 0x14002923b
test eax, eax
je 0x14002923b
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x14002923b
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x140029231
cmp bp, word [rax + 2]
je 0x14002923b
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140029226
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CommonProgramsRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x1400293ad
lea rax, [rsp + 0x30]
test rax, rax
je 0x140029380
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029380
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Common_Programs
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140029338
cmp eax, 0x10000
jbe 0x140029324
mov edi, 0xea
jmp 0x140029338
cmp ecx, 1
je 0x140029338
cmp ecx, 2
je 0x140029338
cmp ecx, 7
je 0x140029341
mov edi, 0x545
cmp ecx, 7
jne 0x140029375
test edi, edi
jne 0x140029375
test eax, eax
je 0x140029375
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x140029375
lea rax, [rsp + 0x2f0]
nop dword [rax]
cmp bp, word [rax]
jne 0x14002936b
cmp bp, word [rax + 2]
je 0x140029375
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140029360
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CommonStartMenuRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x1400294e3
lea rax, [rsp + 0x30]
test rax, rax
je 0x1400294b6
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400294b6
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Common_Start_Menu
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140029472
cmp eax, 0x10000
jbe 0x14002945e
mov edi, 0xea
jmp 0x140029472
cmp ecx, 1
je 0x140029472
cmp ecx, 2
je 0x140029472
cmp ecx, 7
je 0x14002947b
mov edi, 0x545
cmp ecx, 7
jne 0x1400294ab
test edi, edi
jne 0x1400294ab
test eax, eax
je 0x1400294ab
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x1400294ab
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x1400294a1
cmp bp, word [rax + 2]
je 0x1400294ab
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140029496
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CommonStartUpRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x14002961d
lea rax, [rsp + 0x30]
test rax, rax
je 0x1400295f0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400295f0
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Common_Startup
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x1400295a8
cmp eax, 0x10000
jbe 0x140029594
mov edi, 0xea
jmp 0x1400295a8
cmp ecx, 1
je 0x1400295a8
cmp ecx, 2
je 0x1400295a8
cmp ecx, 7
je 0x1400295b1
mov edi, 0x545
cmp ecx, 7
jne 0x1400295e5
test edi, edi
jne 0x1400295e5
test eax, eax
je 0x1400295e5
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x1400295e5
lea rax, [rsp + 0x2f0]
nop dword [rax]
cmp bp, word [rax]
jne 0x1400295db
cmp bp, word [rax + 2]
je 0x1400295e5
inc ecx
add rax, 2
cmp ecx, edx
jb 0x1400295d0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CommonMyDocumentsRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140029753
lea rax, [rsp + 0x30]
test rax, rax
je 0x140029726
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029726
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Personal
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x1400296e2
cmp eax, 0x10000
jbe 0x1400296ce
mov edi, 0xea
jmp 0x1400296e2
cmp ecx, 1
je 0x1400296e2
cmp ecx, 2
je 0x1400296e2
cmp ecx, 7
je 0x1400296eb
mov edi, 0x545
cmp ecx, 7
jne 0x14002971b
test edi, edi
jne 0x14002971b
test eax, eax
je 0x14002971b
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x14002971b
lea rax, [rsp + 0x2f0]
cmp bp, word [rax]
jne 0x140029711
cmp bp, word [rax + 2]
je 0x14002971b
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140029706
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.CommonMyQuickLaunchRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x14002988d
lea rax, [rsp + 0x30]
test rax, rax
je 0x140029860
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029860
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Common_AppData
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140029818
cmp eax, 0x10000
jbe 0x140029804
mov edi, 0xea
jmp 0x140029818
cmp ecx, 1
je 0x140029818
cmp ecx, 2
je 0x140029818
cmp ecx, 7
je 0x140029821
mov edi, 0x545
cmp ecx, 7
jne 0x140029855
test edi, edi
jne 0x140029855
test eax, eax
je 0x140029855
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x140029855
lea rax, [rsp + 0x2f0]
nop dword [rax]
cmp bp, word [rax]
jne 0x14002984b
cmp bp, word [rax + 2]
je 0x140029855
inc ecx
add rax, 2
cmp ecx, edx
jb 0x140029840
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
jmp 0x140029b08
lea rdx, str.MyQuickLaunchRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x1400299fd
lea rax, [rsp + 0x30]
test rax, rax
je 0x140029b08
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029b08
mov dword [rsp + 0x38], 0x10000
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
test edi, edi
jne 0x140029952
cmp eax, 0x10000
jbe 0x14002993e
mov edi, 0xea
jmp 0x140029952
cmp ecx, 1
je 0x140029952
cmp ecx, 2
je 0x140029952
cmp ecx, 7
je 0x14002995b
mov edi, 0x545
cmp ecx, 7
jne 0x140029999
test edi, edi
jne 0x140029999
test eax, eax
je 0x140029999
mov edi, 0x545
shr eax, 1
mov dword [rsp + 0x38], eax
mov ecx, ebp
lea edx, [rax - 1]
test edx, edx
je 0x140029999
lea rax, [rsp + 0x2f0]
nop dword [rax + rax]
cmp bp, word [rax]
jne 0x14002998b
cmp bp, word [rax + 2]
je 0x140029997
inc ecx
add rax, 2
cmp ecx, edx
jae 0x140029999
jmp 0x140029980
mov edi, ebp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140029b08
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
lea rdx, [0x1400ad338]
mov rcx, rbx
call fcn.140011dd0
mov r8d, 0x29
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
mov rcx, rbx
call fcn.14000a130
jmp 0x140029b08
lea rdx, str.invSystemRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140029a89
mov rcx, rbx
call fcn.140029dc0
test al, al
je 0x140029b08
mov r9d, 1
or r8, 0xffffffffffffffff
lea rdx, [0x1400ad928]
mov rcx, rbx
call fcn.14000a520
mov rcx, qword [rbx + 0x18]
inc rax
cmp rcx, rax
jne 0x140029a72
lea rdx, [rcx - 2]
cmp rdx, rcx
ja 0x140029a5f
or r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.1400019e0
jmp 0x140029b08
xor r8d, r8d
sub rdx, rcx
mov rcx, rbx
call fcn.1400022f0
jmp 0x140029b08
mov r8d, 2
lea rdx, [0x1400b0434]
mov rcx, rbx
call fcn.14000a130
jmp 0x140029b08
lea rdx, str.InstallShieldRoot
mov rcx, rdi
call fcn.1400668a8
test eax, eax
jne 0x140029b08
mov rcx, rbx
call fcn.14002a2b0
jmp 0x140029b08
mov r8d, 0x10000
lea rdx, [rsp + 0x2f0]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140029ae0
mov r8d, 0x10000
lea rdx, [rsp + 0x2f0]
lea rcx, [0x1400afd90]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2f0]
mov rcx, rbx
call fcn.140001870
mov qword [rsp + 0xa8], 7
mov qword [rsp + 0xa0], rbp
mov word [rsp + 0x90], bp
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.140001500
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x60]
call fcn.140003d00
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140001500
nop
cmp qword [rsp + 0x80], 8
jb 0x140029b77
mov rcx, qword [rsp + 0x68]
call fcn.140065920
nop
cmp qword [rsp + 0xd0], 8
jb 0x140029b94
mov rcx, qword [rsp + 0xb8]
call fcn.140065920
mov rax, rbx
jmp 0x140029b97
mov rax, rbx
mov rcx, qword [rsp + 0x102f0]
xor rcx, rsp
call fcn.140064b70
mov rbx, qword [rsp + 0x10330]
add rsp, 0x10300
pop rdi
pop rsi
pop rbp
ret