Function at 0x14005dd20
Capabilities:
Delete registry key
Disable device guard features via registry on windows
Disable system features via registry on windows
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x1400f80c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
movdqa xmm1, xmmword [0x1400e4600]
movdqu xmmword [rbp + 0x3f], xmm1
mov byte [rbp + 0x2f], 0
mov rbx, qword [rcx + 0x18]
lea rdx, str.TotalVisibleMemorySize
lea rcx, [rbp - 0x39]
call fcn.14005bf70
nop
lea rdx, str.SELECT_TotalVisibleMemorySize_FROM_Win32_OperatingSystem
lea rcx, [rbp - 0x19]
call fcn.14005bf70
nop
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x19]
lea rdx, [rbp + 0xf]
mov rcx, rbx
call fcn.140061030
nop
mov rdx, qword [rbp - 1]
cmp rdx, 7
jbe 0x14005dde0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005dddb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005dddb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e45f0]
movdqu xmmword [rbp - 9], xmm0
xor esi, esi
mov word [rbp - 0x19], si
mov rdx, qword [rbp - 0x21]
cmp rdx, 7
jbe 0x14005de36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005de31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005de31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
cmp word [rbp + 0xf], 8
jne 0x14005de67
mov rdx, qword [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14005bf70
nop
lea rcx, [rbp - 0x19]
call fcn.14005d650
add eax, 0xfa000
mov dword [rbp + 0x2b], eax
lea rcx, [rbp - 0x19]
call fcn.140002990
jmp 0x14005de6a
mov dword [rbp + 0x2b], esi
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [rbp + 0x27], esi
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.EnableVirtualizationBasedSecurity
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, Ordinal_46
lea rdx, str.SystemControlSet001ControlPriorityControl
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005df42
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005df80
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005df7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005df7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005dfcf
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005dfca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005dfca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.DisableTaskOffload
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_50
lea rdx, str.SystemCurrentControlSetServicesTcpipParameters
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005e09a
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005e0d8
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e0d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e0d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005e127
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e122
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e122
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, Ordinal_33
lea rdx, str.HypervisorEnforcedCodeIntegrity
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, gethostname
lea rdx, str.SystemCurrentControlSetControlDeviceGuardScenarios
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005e1f2
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005e230
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e22b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e22b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005e27f
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e27a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e27a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_30
lea rdx, str.TreatAbsolutePointerAsAbsolute
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, gethostname
lea rdx, str.SystemCurrentControlSetServicesmouclassParameters
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005e351
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005e38f
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e38a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e38a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005e3de
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e3d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e3d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], esi
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.TreatAbsoluteAsRelative
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, 0x33
lea rdx, str.SystemCurrentControlSetServicesmouhidParameters
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005e4ac
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005e4ea
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e4e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e4e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005e539
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e534
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e534
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, 6
lea rdx, str.Status
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, gethostname
lea rdx, str.SystemCurrentControlSetServiceskbdclassParameters
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005e604
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005e642
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e63d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e63d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005e691
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e68c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e68c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, 6
lea rdx, str.Status
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, 0x3d
lea rdx, str.SystemCurrentControlSetServiceslfsvcServiceConfiguration
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005e75c
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005e79a
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e795
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e795
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005e7e9
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e7e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e7e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], 4
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, 5
lea rdx, str.Start
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_46
lea rdx, str.SystemCurrentControlSetServicesGpuEnergyDrv
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005e8bb
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005e8f9
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e8f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e8f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005e948
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e943
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e943
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, Ordinal_30
lea rdx, str.SvcHostSplitThresholdInKB
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.SystemCurrentControlSetControl
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005ea13
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x2b]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005ea51
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ea4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ea4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005eaa0
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ea9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ea9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, Ordinal_30
lea rdx, str.GlobalTimerResolutionRequests
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, Ordinal_60
lea rdx, str.SystemCurrentControlSetControlSession_Managerkernel
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005eb72
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005ebb0
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ebab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ebab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005ebff
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ebfa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ebfa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.LargeSystemCache
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, 0x42
lea rdx, str.SystemCurrentControlSetControlSession_ManagerMemory_Management
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005ecca
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005ed08
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ed03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ed03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005ed57
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ed52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ed52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], esi
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.HiberbootEnabled
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, gethostname
lea rdx, str.SystemCurrentControlSetControlSession_ManagerPower
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005ee25
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005ee63
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ee5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ee5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005eeb2
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eead
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005eead
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], 0x40000
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_30
lea rdx, str.HeapDeCommitFreeBlockThreshold
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, Ordinal_50
lea rdx, str.SystemCurrentControlSetControlSession_Manager
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005ef84
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005efc2
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005efbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005efbd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005f011
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f00c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f00c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], esi
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.LongPathsEnabled
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, Ordinal_46
lea rdx, str.SystemCurrentControlSetControlFileSystem
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005f0df
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005f11d
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f118
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f118
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005f16c
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f167
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f167
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.EnablePreemption
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, Ordinal_60
lea rdx, str.SystemCurrentControlSetControlGraphicsDriversScheduler
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005f237
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005f275
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f270
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f270
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005f2c4
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f2bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f2bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], esi
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.PlatformSupportMiracast
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, Ordinal_50
lea rdx, str.SystemCurrentControlSetControlGraphicsDrivers
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005f392
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005f3d0
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f3cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f3cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005f41f
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f41a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f41a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.PowerThrottlingOff
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, gethostname
lea rdx, str.SystemCurrentControlSetControlPowerPowerThrottling
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005f4f1
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005f52f
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f52a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f52a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005f57e
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f579
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f579
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.DisplayParameters
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_45
lea rdx, str.SystemCurrentControlSetControlCrashControl
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005f650
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005f68e
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f689
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f689
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005f6dd
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f6d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f6d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, 9
lea rdx, str.AITEnable
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_45
lea rdx, str.SoftwarePoliciesMicrosoftWindowsAppCompat
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005f7a8
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005f7e6
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f7e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f7e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005f835
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f830
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f830
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.DpiMapIommuContiguous
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, Ordinal_50
lea rdx, str.SystemCurrentControlSetControlGraphicsDrivers
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005f907
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005f945
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f940
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f940
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005f994
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f98f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f98f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.DisablePagingExecutive
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, 0x42
lea rdx, str.SystemCurrentControlSetControlSession_ManagerMemory_Management
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005fa5f
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005fa9d
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fa98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005fa98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005faec
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fae7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005fae7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.LargeSystemCache
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, 0x42
lea rdx, str.SystemCurrentControlSetControlSession_ManagerMemory_Management
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005fbbe
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005fbfc
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fbf7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005fbf7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005fc4b
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fc46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005fc46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.EnableActivityFeed
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, Ordinal_46
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005fd16
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005fd54
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fd4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005fd4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005fda3
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fd9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005fd9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov dword [rbp + 0x27], esi
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.PublishUserActivities
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, Ordinal_46
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005fe71
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14005feaf
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005feaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005feaa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14005fefe
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fef9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005fef9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.UploadUserActivities
lea rcx, [rbp - 0x19]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, Ordinal_46
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
lea rcx, [rbp - 0x39]
call fcn.14000c490
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005ffc9
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x140060007
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060002
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140060002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
movdqa xmm0, xmmword [0x1400e4600]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140060056
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060051
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140060051
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.AllowTelemetry
lea rcx, [rbp - 0x39]
call fcn.14000c490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_50
lea rdx, str.SoftwarePoliciesMicrosoftWindowsDataCollection
lea rcx, [rbp - 0x19]
call fcn.14000c490
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.DisableSoftLanding
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwarePoliciesMicrosoftWindowsCloudContent
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.TimeStampInterval
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionReliability
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.SensorPermissionState
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionSensorOverridesBFA794E4_F964_4FDB_90F6_51056BFE4B44
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
mov dword [rbp + 0x27], 4
lea rdx, str.CpuPriorityClass
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionscsrss.exePerfOptions
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
mov dword [rbp + 0x27], 3
lea rdx, str.IoPriority
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionscsrss.exePerfOptions
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
mov dword [rbp + 0x27], 1
lea rdx, str.NoLazyMode
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.AlwaysOn
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.SystemResponsiveness
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.GPU_Priority
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksGames
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
mov dword [rbp + 0x27], 6
lea rdx, str.Priority
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksGames
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
mov dword [rbp + 0x27], esi
lea rdx, str.Enabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftFTH
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.DisableExternalDMAUnderLock
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftFVE
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.EnableVirtualizationBasedSecurity
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsDeviceGuard
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.HVCIMATRequired
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsDeviceGuard
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.4096
lea rcx, [rbp + 0x2f]
call fcn.140052fe0
mov edi, dword [rbp + 0x3f]
inc edi
lea rcx, [rbp + 0x2f]
call fcn.1400066d0
mov rbx, rax
lea rdx, str.Max_Cached_Icons
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 1
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.Deny
lea rcx, [rbp + 0x2f]
call fcn.140052fe0
mov edi, dword [rbp + 0x3f]
inc edi
lea rcx, [rbp + 0x2f]
call fcn.1400066d0
mov rbx, rax
lea rdx, str.Value
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocation
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 1
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.High
lea rcx, [rbp + 0x2f]
call fcn.140052fe0
mov edi, dword [rbp + 0x3f]
inc edi
lea rcx, [rbp + 0x2f]
call fcn.1400066d0
mov rbx, rax
lea rdx, str.Scheduling_Category
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksGames
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000002
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 1
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
mov dword [rbp + 0x27], esi
lea rdx, str.ContentDeliveryAllowed
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.ContentDeliveryAllowed
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.OemPreInstalledAppsEnabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.PreInstalledAppsEnabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.PreInstalledAppsEverEnabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.SilentInstalledAppsEnabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.SubscribedContent_338387Enabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.SubscribedContent_338388Enabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.SubscribedContent_338389Enabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.SubscribedContent_353698Enabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.SystemPaneSuggestionsEnabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
mov dword [rbp + 0x27], 1
lea rdx, str.AllowAutoGameMode
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftGameBar
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.AutoGameModeEnabled
lea rcx, [rbp - 0x39]
call fcn.140006740
nop
lea rdx, str.SoftwareMicrosoftGameBar
lea rcx, [rbp - 0x19]
call fcn.140006740
mov qword [rsp + 0x30], 0xffffffff80000001
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.1400050a0
lea rcx, [rbp - 0x19]
call fcn.1400066e0
nop
lea rcx, [rbp - 0x39]
call fcn.1400066e0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerDesktopNameSpacee88865ea_0e1c_4e20_9aa6_edcd0212c87c
lea rcx, [rbp - 0x39]
call fcn.140006740
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140060d22
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
xor r9d, r9d
mov rcx, 0xffffffff80000002
mov r8d, 0x100
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x140060d61
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060d5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140060d5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 0xf
jbe 0x140060d9f
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060d9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140060d9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6110
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400c60f0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret