Function at 0x140060e10
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x41cb0
call fcn.140216080
sub rsp, rax
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rsp + 0x41ca0], rax
mov r13d, edx
mov dword [rsp + 0x84], edx
mov r14, rcx
lea rcx, [rsp + 0xa8]
call fcn.1400a64e0
nop
lea rcx, [rsp + 0x238]
call fcn.1400a64e0
nop
lea rdx, [r14 + 0x1c0]
lea rcx, [rsp + 0xa8]
call fcn.1400a659c
xor esi, esi
mov eax, esi
mov dword [rsp + 0x8c], eax
cmp dword [r14 + 0x3e4], eax
je 0x140060eb4
cmp dword [r14 + 0x440], eax
je 0x140060eb4
mov r12d, 1
cmp dword [r14 + 0x48], 2
cmove eax, r12d
mov dword [rsp + 0x8c], eax
jmp 0x140060eba
mov r12d, 1
cmp qword [r14 + 0x68], rsi
je 0x140063ef5
xor edx, edx
mov r8d, 0x20000
lea rcx, [rsp + 0x1ca0]
call fcn.140241ba0
mov dword [rsp + 0x80], esi
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xe8], rsi
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rsp + 0x108], xmm0
lea rcx, [rsp + 0x148]
call fcn.1400a64e0
nop
lea r8, str.Uninstall
mov rdx, qword [rsp + 0x158]
lea rcx, [rsp + 0x148]
call fcn.1400a6854
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r15, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rax, [rsp + 0x1ca0]
sub r15, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140060f93
movzx eax, word [rcx + r15]
test ax, ax
je 0x140060f93
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140060f70
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov edi, dword [r14 + 0x3e4]
mov rax, 0xffffffff80000001
mov qword [rsp + 0x90], rax
mov rbx, rax
lea rcx, [rsp + 0x490]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140061009
lea r8, [0x1402eddb0]
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140061009
mov rbx, qword [rsp + 0x498]
test rbx, rbx
jne 0x140061009
lea rsi, [r14 + 0x58]
lea r12, [rbx - 1]
jmp 0x140061085
lea rsi, [r14 + 0x58]
xor eax, eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], r12d
mov r12, 0xffffffffffffffff
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x148]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402eddb0]
mov rdx, rbx
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x490]
call fcn.14001feb0
cmp r13d, 1
lea r13, [0x1402f3770]
jne 0x140061197
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
mov r8, r13
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400610e3
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400610e3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400610c0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor edi, edi
mov word [rax], di
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rsp + 0x14c0]
call fcn.14001fb40
nop
lea rax, [r14 + 0x58]
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402eddb0]
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x14c0]
call fcn.14001feb0
jmp 0x140061199
xor edi, edi
lea r12, str.REGISTRYHKEY_CURRENT_USERSOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
cmp dword [rsp + 0x8c], 0
je 0x1400613fa
cmp qword [rsp + 0xf8], 0
jne 0x1400613fa
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
mov r8, r12
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140061203
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140061203
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400611e0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov edi, dword [r14 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x500]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140061264
lea r8, [0x1402f3a70]
lea rdx, [rsp + 0x500]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140061264
mov rbx, qword [rsp + 0x508]
test rbx, rbx
je 0x1400612e1
xor eax, eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x148]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402f3a70]
mov rdx, rbx
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x500]
call fcn.14001feb0
cmp dword [rsp + 0x84], 1
jne 0x1400613fa
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140061343
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140061343
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140061320
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor edi, edi
mov word [rax], di
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rsp + 0x1530]
call fcn.14001fb40
nop
lea rax, [r14 + 0x58]
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402f3a70]
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x1530]
call fcn.14001feb0
jmp 0x1400613fc
xor edi, edi
cmp dword [r14 + 0x440], 0
je 0x140061b3d
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140061443
movzx eax, word [r15 + rcx]
test ax, ax
je 0x140061443
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140061420
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov edi, dword [r14 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x570]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x1400614a4
lea r8, [0x1402eddb0]
lea rdx, [rsp + 0x570]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x1400614a4
mov rbx, qword [rsp + 0x578]
test rbx, rbx
je 0x140061511
xor eax, eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402eddb0]
mov rdx, rbx
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x570]
call fcn.14001feb0
mov edi, dword [r14 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x5e0]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x14006157d
lea r8, [0x1402eddb0]
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x14006157d
mov rbx, qword [rsp + 0x5e8]
test rbx, rbx
jne 0x14006157d
lea rsi, [r14 + 0x1e8]
jmp 0x1400615fd
lea rsi, [r14 + 0x1e8]
xor eax, eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x148]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402eddb0]
mov rdx, rbx
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x5e0]
call fcn.14001feb0
cmp dword [rsp + 0x84], 1
jne 0x1400617a2
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
mov r8, r13
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140061656
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140061656
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140061633
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rsp + 0xdc0]
call fcn.14001fb40
nop
lea rax, [r14 + 0x58]
xor ecx, ecx
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], 1
mov rdi, 0xffffffffffffffff
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402eddb0]
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0xdc0]
call fcn.14001feb0
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rsp + 0xe30]
call fcn.14001fb40
nop
lea rax, [r14 + 0x1e8]
xor ecx, ecx
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402eddb0]
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0xe30]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
mov r8, r12
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400617e3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400617e3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400617c0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov edi, dword [r14 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x650]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140061846
lea r8, [0x1402f3a70]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140061846
mov rbx, qword [rsp + 0x658]
test rbx, rbx
je 0x1400618b7
lea rax, [r14 + 0x58]
xor ecx, ecx
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402f3a70]
mov rdx, rbx
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x650]
call fcn.14001feb0
mov edi, dword [r14 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x6c0]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140061917
lea r8, [0x1402f3a70]
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140061917
mov rbx, qword [rsp + 0x6c8]
test rbx, rbx
je 0x140061990
xor eax, eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x148]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402f3a70]
mov rdx, rbx
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x6c0]
call fcn.14001feb0
cmp dword [rsp + 0x84], 1
jne 0x140061b3d
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400619f3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400619f3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400619d0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor edi, edi
mov word [rax], di
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rsp + 0xea0]
call fcn.14001fb40
nop
lea rax, [r14 + 0x58]
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], 1
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402f3a70]
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0xea0]
call fcn.14001feb0
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rsp + 0xf10]
call fcn.14001fb40
nop
lea rax, [r14 + 0x1e8]
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402f3a70]
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0xf10]
call fcn.14001feb0
jmp 0x140061b43
xor edi, edi
lea rsi, [rdi - 1]
cmp qword [rsp + 0xf8], 0
jne 0x140061f9d
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140061b83
movzx eax, word [r15 + rcx]
test ax, ax
je 0x140061b83
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140061b60
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov edi, dword [r14 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x730]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140061bea
lea r8, [0x1402eddb0]
lea rdx, [rsp + 0x730]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140061bea
mov rbx, qword [rsp + 0x738]
test rbx, rbx
jne 0x140061bea
lea r15d, [rbx + 1]
jmp 0x140061c5f
mov r15d, 1
mov dword [rsp + 0x78], r15d
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402eddb0]
mov rdx, rbx
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x730]
call fcn.14001feb0
cmp dword [rsp + 0x84], 1
jne 0x140061d5f
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea rax, [rsp + 0x1ca0]
sub r13, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140061cb5
movzx eax, word [rcx + r13]
test ax, ax
je 0x140061cb5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140061c92
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor r13d, r13d
mov word [rax], r13w
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rsp + 0xf80]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], r15d
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402eddb0]
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0xf80]
call fcn.14001feb0
jmp 0x140061d62
xor r13d, r13d
cmp dword [rsp + 0x8c], 0
je 0x140061f9d
cmp qword [rsp + 0xf8], 0
jne 0x140061f9d
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea rax, [rsp + 0x1ca0]
sub r12, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140061dc3
movzx eax, word [r12 + rcx]
test ax, ax
je 0x140061dc3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140061da0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r13w
mov edi, dword [r14 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x7a0]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140061e25
lea r8, [0x1402f3a70]
lea rdx, [rsp + 0x7a0]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140061e25
mov rbx, qword [rsp + 0x7a8]
test rbx, rbx
je 0x140061e95
mov dword [rsp + 0x78], r15d
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402f3a70]
mov rdx, rbx
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x7a0]
call fcn.14001feb0
mov r12d, dword [rsp + 0x84]
cmp r12d, 1
jne 0x140061fa5
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140061ef6
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140061ef6
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140061ed3
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r13w
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rsp + 0xff0]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], r15d
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, [0x1402f3a70]
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0xff0]
call fcn.14001feb0
jmp 0x140061fa5
mov r12d, dword [rsp + 0x84]
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_Menu2Programs
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140061fe7
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140061fe7
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140061fc4
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov edi, dword [r14 + 0x3e4]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x810]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140062056
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_Menu2Programs
lea rdx, [rsp + 0x810]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140062056
mov rbx, qword [rsp + 0x818]
test rbx, rbx
jne 0x140062056
lea r13, [r14 + 0x58]
xor edi, edi
lea r15d, [rbx + 1]
jmp 0x1400620ca
lea r13, [r14 + 0x58]
xor eax, eax
mov dword [rsp + 0x78], eax
mov r15d, 1
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x1ca0]
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_Menu2Programs
mov rdx, rbx
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x810]
call fcn.14001feb0
cmp r12d, 1
jne 0x1400628ce
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_ManagementARPCache
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062123
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140062123
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062100
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rsp + 0x1060]
call fcn.14001fb40
nop
lea r12, [r14 + 0x58]
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_ManagementARPCache
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x1060]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWARERegisteredApplications
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062203
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140062203
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400621e0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x10d0]
call fcn.14001fb40
nop
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWARERegisteredApplications
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x10d0]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClients
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400622e3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400622e3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400622c0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1140]
call fcn.14001fb40
nop
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREClients
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1140]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea rsi, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionPrintPrinters
lea rax, [rsp + 0x1ca0]
sub rsi, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400623c2
movzx eax, word [rsi + rcx]
test ax, ax
je 0x1400623c2
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400623a0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x11b0]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], r15d
xor ecx, ecx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r15d
mov rax, 0xffffffffffffffff
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPrintPrinters
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x11b0]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r15, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionPrintPrinters
lea rax, [rsp + 0x1ca0]
sub r15, rax
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400624a3
movzx eax, word [r15 + rcx]
test ax, ax
je 0x1400624a3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062480
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1220]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], 1
xor ecx, ecx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], 1
mov rax, 0xffffffffffffffff
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionPrintPrinters
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1220]
call fcn.14001feb0
cmp dword [rsp + 0x8c], 0
jne 0x140062559
cmp dword [r14 + 0x48], 2
jne 0x1400628db
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeRegisteredApplications
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400625a3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400625a3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062580
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1290]
call fcn.14001fb40
nop
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREWOW6432NodeRegisteredApplications
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1290]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeClients
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062687
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140062687
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062664
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1300]
call fcn.14001fb40
nop
xor ecx, ecx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], 1
mov rax, 0xffffffffffffffff
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREWOW6432NodeClients
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1300]
call fcn.14001feb0
cmp dword [rsp + 0x8c], 0
je 0x1400628db
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062762
movzx eax, word [rsi + rcx]
test ax, ax
je 0x140062762
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062740
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1370]
call fcn.14001fb40
nop
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], 1
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPrintPrinters
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1370]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062833
movzx eax, word [r15 + rcx]
test ax, ax
je 0x140062833
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062810
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x13e0]
call fcn.14001fb40
nop
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov r15d, 1
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionPrintPrinters
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x13e0]
call fcn.14001feb0
jmp 0x1400628e8
mov rsi, 0xffffffffffffffff
lea r15d, [rsi + 2]
jmp 0x1400628f0
mov r15d, 1
mov rsi, 0xffffffffffffffff
mov r12d, dword [rsp + 0x84]
cmp dword [r14 + 0x48], 2
jne 0x140062b35
cmp r12d, 1
jne 0x1400629da
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftShared_ToolsMSConfig_startupreg
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062947
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140062947
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062924
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor r12d, r12d
mov word [rax], r12w
mov rbx, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1450]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREMicrosoftShared_ToolsMSConfig_startupreg
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1450]
call fcn.14001feb0
jmp 0x1400629dd
xor r12d, r12d
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x238]
call fcn.1400a659c
mov rdx, r13
lea rcx, [rsp + 0x238]
call fcn.1400a659c
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsage
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062a44
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140062a44
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062a21
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x3b0]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140062abf
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsage
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140062abf
mov rbx, qword [rsp + 0x3b8]
test rbx, rbx
jne 0x140062abf
lea rcx, [rsp + 0x3b0]
call fcn.14001feb0
jmp 0x140062b38
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x238]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsage
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x3b0]
call fcn.14001feb0
jmp 0x140062b38
xor r12d, r12d
lea r8, str.REGISTRYHKEY_CURRENT_USERSoftwareMicrosoftTracing
lea rax, [rsp + 0x1ca0]
sub r8, rax
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
cmp qword [r14 + 0x220], 0
jle 0x140062e60
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062b93
movzx eax, word [rcx + r8]
test ax, ax
je 0x140062b93
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062b70
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x260]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140062c09
lea r8, str.SoftwareMicrosoftTracing
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140062c09
mov rbx, qword [rsp + 0x268]
test rbx, rbx
jne 0x140062c09
lea r15, [r14 + 0x210]
lea r12, [rbx - 1]
jmp 0x140062c75
lea r15, [r14 + 0x210]
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], 1
mov r12, 0xffffffffffffffff
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], edi
xor eax, eax
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x1ca0]
lea r8, str.SoftwareMicrosoftTracing
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x260]
call fcn.14001feb0
mov r13d, dword [rsp + 0x84]
cmp r13d, 1
jne 0x140063216
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESoftwareMicrosoftTracing
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062cd6
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140062cd6
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062cb3
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor esi, esi
mov word [rax], si
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0xce0]
call fcn.14001fb40
nop
lea rax, [r14 + 0x210]
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, str.SoftwareMicrosoftTracing
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0xce0]
call fcn.14001feb0
cmp dword [rsp + 0x8c], esi
je 0x140062e50
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, [0x1402f4650]
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062dc3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140062dc3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062da0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov rbx, qword [r14 + 0x3f0]
lea rcx, [rsp + 0xd50]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x1ca0]
lea r8, str.SoftwareWOW6432NodeMicrosoftTracing
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0xd50]
call fcn.14001feb0
mov r15d, 1
jmp 0x140063131
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062e83
movzx eax, word [rcx + r8]
test ax, ax
je 0x140062e83
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062e60
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x260]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140062ef4
lea r8, str.SoftwareMicrosoftTracing
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140062ef4
mov rbx, qword [rsp + 0x268]
test rbx, rbx
jne 0x140062ef4
xor edi, edi
lea r12, [rbx - 1]
jmp 0x140062f56
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r15d
mov r12, 0xffffffffffffffff
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], edi
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x1ca0]
lea r8, str.SoftwareMicrosoftTracing
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x260]
call fcn.14001feb0
mov r13d, dword [rsp + 0x84]
cmp r13d, 1
jne 0x140063216
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESoftwareMicrosoftTracing
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140062fb7
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140062fb7
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140062f94
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0xd50]
call fcn.14001fb40
nop
lea rsi, [r14 + 0x58]
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1ca0]
lea r8, str.SoftwareMicrosoftTracing
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0xd50]
call fcn.14001feb0
cmp dword [rsp + 0x8c], 0
je 0x14006312f
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESoftwareWOW6432NodeMicrosoftTracing
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400630a3
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400630a3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140063080
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor edi, edi
mov word [rax], di
mov rbx, qword [r14 + 0x3f0]
lea rcx, [rsp + 0xce0]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1ca0]
lea r8, str.SoftwareWOW6432NodeMicrosoftTracing
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0xce0]
call fcn.14001feb0
xor esi, esi
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140063173
movzx eax, word [rcx + r8]
test ax, ax
je 0x140063173
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140063150
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rsp + 0x15a0]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x15a0]
call fcn.14001feb0
jmp 0x14006321c
xor esi, esi
lea r15d, [rsi + 1]
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140065ae5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0xd8]
call fcn.140032290
test eax, eax
jne 0x1400632f1
lea rdx, [rsp + 0x170]
call fcn.14005fc00
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0xd8]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400632ce
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x1400632bc
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400632bc
call fcn.14000de80
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400632ae
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0xd8], rax
jmp 0x1400632ce
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0xd8]
call fcn.14000df90
nop
mov rdx, qword [rsp + 0x170]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400632f1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140065af0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa0], rax
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov rbx, qword [rsp + 0xd8]
mov r8, rbx
lea rdx, str.REGISTRYHKEY_USERS_s_s
lea rcx, [rsp + 0xa0]
call fcn.14000e180
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea rax, [rsp + 0x1ca0]
mov r8, qword [rsp + 0xa0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140063383
movzx eax, word [rcx + r8]
test ax, ax
je 0x140063383
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140063360
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov r8, rbx
lea rdx, str._s_s
lea rcx, [rsp + 0xa0]
call fcn.14000e180
mov edi, dword [r14 + 0x3e4]
lea rcx, [rsp + 0x1610]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
mov r8, qword [rsp + 0xa0]
mov rdx, 0xffffffff80000003
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x1610]
call fcn.14001feb0
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140065afb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x98], rax
lea rdx, [0x1402f2708]
cmp rdx, 0x10000
jae 0x14006348a
movzx edx, dx
lea rcx, [rsp + 0x98]
call fcn.14000d610
jmp 0x1400634ab
mov rax, r12
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140063490
mov r8d, eax
lea rcx, [rsp + 0x98]
call fcn.14000df90
nop
lea rax, [rbx - 0x18]
mov qword [rsp + 0x118], rax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x98]
call fcn.1400157c0
lea rdx, str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
mov rax, r12
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400634d5
mov r8d, eax
lea rcx, [rsp + 0x98]
call fcn.1400157c0
mov rsi, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0x98]
test rsi, rsi
je 0x1400635e1
nop dword [rax + rax]
mov rdi, qword [rsi + 0x10]
mov rsi, qword [rsi]
lea rdx, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1400635c1
lea rdx, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1400635c1
mov rdx, rbx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1400635c1
mov rcx, qword [r14 + 0x3f0]
mov rdx, qword [rdi + 0x10]
cmp dword [r14 + 0x3e4], 0
je 0x140063581
call fcn.140055020
mov rcx, rax
test rax, rax
je 0x1400635c1
mov dword [rax + 0x20], 2
jmp 0x140063592
call fcn.140055020
mov rcx, rax
test rax, rax
je 0x1400635c1
mov dword [rax + 0x20], r15d
mov eax, dword [rax + 0x24]
test eax, eax
je 0x1400635a7
cmp eax, 2
jne 0x1400635bd
mov dword [rcx + 0x24], 5
jmp 0x1400635bd
mov rax, qword [rcx + 0x28]
cmp qword [rax + 0x18], 0
jne 0x1400635bd
cmp qword [rcx + 8], 0
jne 0x1400635bd
mov dword [rcx + 0x24], r15d
mov dword [rcx + 0x24], r15d
cmp dword [rdi + 0x30], 0
je 0x1400635d0
mov rcx, qword [rdi + 0x28]
call fcn.140095d64
mov rcx, rdi
call fcn.14005dc90
test rsi, rsi
jne 0x140063510
mov edi, dword [r14 + 0x3e4]
test edi, edi
je 0x1400637c5
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rsp + 0x1c8], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1e0], xmm0
xor eax, eax
mov qword [rsp + 0x1d8], rax
mov esi, eax
mov qword [rsp + 0x1d0], rax
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rsp + 0x1f0], xmm0
cmp r13d, 1
jne 0x140063727
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionApp_Paths
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140063683
movzx eax, word [rcx + r8]
test ax, ax
je 0x140063683
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140063660
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor esi, esi
mov word [rax], si
lea rcx, [rsp + 0x1680]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionApp_Paths
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x1680]
call fcn.14001feb0
mov rsi, qword [rsp + 0x1d0]
test rsi, rsi
je 0x140063788
nop dword [rax]
mov rdi, qword [rsi + 0x10]
mov rsi, qword [rsi]
lea rdx, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionApp_Paths
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14006376c
mov rdx, qword [rdi + 0x10]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006376c
mov dword [rax + 0x20], 2
mov dword [rax + 0x24], r15d
cmp dword [rdi + 0x30], 0
je 0x14006377b
mov rcx, qword [rdi + 0x28]
call fcn.140095d64
mov rcx, rdi
call fcn.14005dc90
test rsi, rsi
jne 0x140063730
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rsp + 0x1c8], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1e0], xmm0
xor edi, edi
mov qword [rsp + 0x1d8], rdi
mov qword [rsp + 0x1d0], rdi
mov rcx, qword [rsp + 0x1f0]
call fcn.1400ad45c
nop
jmp 0x1400637c7
xor edi, edi
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140063813
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140063813
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400637f0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov esi, dword [r14 + 0x3e4]
mov r15, qword [r14 + 0x3f0]
mov rdi, 0xffffffff80000001
lea rcx, [rsp + 0x880]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x14006387b
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x14006387b
mov rdi, qword [rsp + 0x888]
test rdi, rdi
je 0x1400638dd
lea rax, [r14 + 0x58]
xor ecx, ecx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rdx, rdi
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x880]
call fcn.14001feb0
cmp r13d, 1
jne 0x140063ace
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
lea rax, [rsp + 0x1ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140063936
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140063936
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140063913
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor r13d, r13d
mov word [rax], r13w
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x16f0]
call fcn.14001fb40
nop
lea r15, [r14 + 0x58]
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x16f0]
call fcn.14001feb0
cmp dword [rsp + 0x8c], r13d
je 0x140063ace
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140063a33
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140063a33
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140063a10
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r13w
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1760]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1760]
call fcn.14001feb0
lea rcx, [rsp + 0x178]
call fcn.1400a64e0
nop
lea rcx, [r14 + 0x370]
call fcn.140029e80
mov r12, qword [r14 + 0x370]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [r12 + rax*2], 0
jne 0x140063b00
cmp dword [r14 + 0x440], 0
je 0x140063b8f
cmp rax, 3
jae 0x140063b95
lea r15, [0x14034e770]
lea rsi, [0x14034df00]
lea rcx, [r14 + 0x380]
call fcn.140029e80
lea r8, [r14 + 0x380]
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x178]
call fcn.1400a67e0
lea rcx, [r14 + 0x430]
call fcn.140029e80
mov rdi, qword [r14 + 0x430]
mov r13, 0xffffffffffffffff
mov rax, r13
nop
inc rax
cmp word [rdi + rax*2], 0
jne 0x140063b70
cmp dword [r14 + 0x440], 0
je 0x140063bee
cmp rax, 3
jae 0x140063bf4
jmp 0x140063c35
cmp rax, 4
jb 0x140063b1b
inc dword [0x14034dd58]
lea rsi, [0x14034df00]
mov rdi, rsi
lea r15, [0x14034e770]
nop dword [rax]
mov rdx, qword [rdi]
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x140063b29
add rdi, 8
cmp rdi, r15
jl 0x140063bb0
lea r8, [r14 + 0x370]
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x178]
call fcn.1400a67e0
jmp 0x140063b29
cmp rax, 4
jb 0x140063c35
inc dword [0x14034dd58]
nop word [rax + rax]
mov rdx, qword [rsi]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x140063c35
add rsi, 8
cmp rsi, r15
jl 0x140063c00
lea r8, [r14 + 0x430]
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x178]
call fcn.1400a67e0
mov edx, 0x10000
lea rcx, [rsp + 0x1ca0]
lea r12, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
mov r8, r12
lea rax, [rsp + 0x1ca0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140063c83
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140063c83
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140063c60
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov esi, dword [r14 + 0x3e4]
mov r15, qword [r14 + 0x3f0]
mov rdi, 0xffffffff80000001
lea rcx, [rsp + 0x420]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140063cfe
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
lea rdx, [rsp + 0x420]
lea rcx, [rsp + 0x1ca0]
call fcn.140057530
test eax, eax
je 0x140063cfe
mov rdi, qword [rsp + 0x428]
test rdi, rdi
jne 0x140063cfe
lea rcx, [rsp + 0x420]
call fcn.14001feb0
xor esi, esi
jmp 0x140063d73
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], esi
xor esi, esi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x178]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ca0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
mov rdx, rdi
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x420]
call fcn.14001feb0
mov rcx, qword [r14 + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rcx, [rsp + 0x178]
test eax, eax
jne 0x140063e49
call fcn.1400a6500
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140063db5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140063dd8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x118]
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x140063df6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x148]
call fcn.1400a6500
nop
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xe8], rsi
mov rcx, qword [rsp + 0x108]
call fcn.1400ad45c
mov qword [rsp + 0x108], rsi
jmp 0x140065a9b
call fcn.1400a6500
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140063e6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140063e8d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r13d
mov rdx, qword [rsp + 0x118]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140063eac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x148]
call fcn.1400a6500
nop
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xe8], rsi
mov rcx, qword [rsp + 0x108]
call fcn.1400ad45c
nop
jmp 0x140063f08
mov qword [rsp + 0x90], 0xffffffff80000001
lea r12, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
lea r13, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
lea r15, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
lea rbx, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun
cmp qword [rsp + 0xb8], 0
je 0x140065a9b
xor edx, edx
mov r8d, 0x20000
lea rcx, [rsp + 0x21ca0]
call fcn.140241ba0
mov dword [rsp + 0x88], esi
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea rax, [rsp + 0x21ca0]
sub rbx, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140063f82
movzx eax, word [rbx + rcx]
test ax, ax
je 0x140063f82
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140063f60
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x8f0]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140063fea
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rdx, [rsp + 0x8f0]
lea rcx, [rsp + 0x21ca0]
call fcn.140057530
test eax, eax
je 0x140063fea
mov rbx, qword [rsp + 0x8f8]
test rbx, rbx
je 0x140064053
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x8f0]
call fcn.14001feb0
cmp dword [rsp + 0x84], 1
jne 0x140064245
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea rax, [rsp + 0x21ca0]
sub r15, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400640b3
movzx eax, word [r15 + rcx]
test ax, ax
je 0x1400640b3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064090
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor esi, esi
mov word [rax], si
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x17d0]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov r15, 0xffffffffffffffff
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x17d0]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicy
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400641a3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400641a3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064180
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1840]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicy
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1840]
call fcn.14001feb0
jmp 0x14006424b
xor esi, esi
lea r15, [rsi - 1]
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunServices
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140064293
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140064293
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064270
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x960]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x1400642fb
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
lea rdx, [rsp + 0x960]
lea rcx, [rsp + 0x21ca0]
call fcn.140057530
test eax, eax
je 0x1400642fb
mov rbx, qword [rsp + 0x968]
test rbx, rbx
je 0x140064361
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x960]
call fcn.14001feb0
cmp dword [rsp + 0x84], 1
jne 0x140064466
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400643c3
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400643c3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400643a0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor esi, esi
mov word [rax], si
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x18b0]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x18b0]
call fcn.14001feb0
jmp 0x140064468
xor esi, esi
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400644b3
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400644b3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064490
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0x9d0]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x14006451b
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
lea rdx, [rsp + 0x9d0]
lea rcx, [rsp + 0x21ca0]
call fcn.140057530
test eax, eax
je 0x14006451b
mov rbx, qword [rsp + 0x9d8]
test rbx, rbx
je 0x140064581
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x9d0]
call fcn.14001feb0
cmp dword [rsp + 0x84], 1
jne 0x140064686
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400645e3
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400645e3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400645c0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor esi, esi
mov word [rax], si
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1920]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1920]
call fcn.14001feb0
jmp 0x140064688
xor esi, esi
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400646d3
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400646d3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400646b0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0xa40]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x14006473b
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
lea rdx, [rsp + 0xa40]
lea rcx, [rsp + 0x21ca0]
call fcn.140057530
test eax, eax
je 0x14006473b
mov rbx, qword [rsp + 0xa48]
test rbx, rbx
je 0x1400647a1
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0xa40]
call fcn.14001feb0
cmp dword [rsp + 0x84], 1
jne 0x1400648a6
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140064803
movzx eax, word [rcx + r8]
test ax, ax
je 0x140064803
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400647e0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor esi, esi
mov word [rax], si
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1990]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1990]
call fcn.14001feb0
jmp 0x1400648a8
xor esi, esi
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSoftwareMicrosoftWindowsShellNoRoamMUICache
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400648f3
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400648f3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400648d0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0xab0]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x14006495b
lea r8, str.SoftwareMicrosoftWindowsShellNoRoamMUICache
lea rdx, [rsp + 0xab0]
lea rcx, [rsp + 0x21ca0]
call fcn.140057530
test eax, eax
je 0x14006495b
mov rbx, qword [rsp + 0xab8]
test rbx, rbx
je 0x1400649c1
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SoftwareMicrosoftWindowsShellNoRoamMUICache
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0xab0]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsHTML_Help
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140064a13
movzx eax, word [rcx + r8]
test ax, ax
je 0x140064a13
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400649f0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0xb20]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140064a7d
lea r8, str.SOFTWAREMicrosoftWindowsHTML_Help
lea rdx, [rsp + 0xb20]
lea rcx, [rsp + 0x21ca0]
call fcn.140057530
test eax, eax
je 0x140064a7d
mov rbx, qword [rsp + 0xb28]
test rbx, rbx
je 0x140064ae7
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsHTML_Help
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0xb20]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlags
lea rax, [rsp + 0x21ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140064b36
movzx eax, word [rcx + r8]
test ax, ax
je 0x140064b36
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064b13
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0xb90]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140064ba0
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlags
lea rdx, [rsp + 0xb90]
lea rcx, [rsp + 0x21ca0]
call fcn.140057530
test eax, eax
je 0x140064ba0
mov rbx, qword [rsp + 0xb98]
test rbx, rbx
je 0x140064c06
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlags
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0xb90]
call fcn.14001feb0
cmp dword [rsp + 0x84], 1
jne 0x140064d06
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
lea rax, [rsp + 0x21ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140064c63
movzx eax, word [rcx + r8]
test ax, ax
je 0x140064c63
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064c40
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor esi, esi
mov word [rax], si
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1a00]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1a00]
call fcn.14001feb0
jmp 0x140064d08
xor esi, esi
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea rax, [rsp + 0x21ca0]
sub r12, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140064d43
movzx eax, word [rcx + r12]
test ax, ax
je 0x140064d43
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064d20
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov edi, dword [r14 + 0x3e4]
mov rsi, qword [r14 + 0x3f0]
mov rbx, 0xffffffff80000001
lea rcx, [rsp + 0xc00]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140064dab
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
lea rdx, [rsp + 0xc00]
lea rcx, [rsp + 0x21ca0]
call fcn.140057530
test eax, eax
je 0x140064dab
mov rbx, qword [rsp + 0xc08]
test rbx, rbx
je 0x140064e15
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov r12d, 1
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
mov rdx, rbx
mov rcx, r14
call fcn.1400578a0
jmp 0x140064e1b
mov r12d, 1
lea rcx, [rsp + 0xc00]
call fcn.14001feb0
mov esi, dword [rsp + 0x84]
cmp esi, 1
jne 0x140064f23
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUFHSHC
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140064e83
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140064e83
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064e60
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1a70]
call fcn.14001fb40
nop
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionUFHSHC
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1a70]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionUFHSHC
lea rax, [rsp + 0x21ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140064f65
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140064f65
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064f42
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0xc70]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x140064fd0
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionUFHSHC
lea rdx, [rsp + 0xc70]
lea rcx, [rsp + 0x21ca0]
call fcn.140057530
test eax, eax
je 0x140064fd0
mov r8, qword [rsp + 0xc78]
mov qword [rsp + 0x90], r8
test r8, r8
je 0x140065038
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionUFHSHC
mov rdx, qword [rsp + 0x90]
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0xc70]
call fcn.14001feb0
cmp esi, 1
jne 0x140065133
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUFHARP
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140065093
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140065093
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140065070
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1ae0]
call fcn.14001fb40
nop
xor eax, eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionUFHARP
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1ae0]
call fcn.14001feb0
cmp dword [r14 + 0x48], 2
jne 0x1400652ff
lea rbx, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rsp + 0x200], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x218], xmm0
xor ebx, ebx
mov qword [rsp + 0x210], rbx
mov edi, ebx
mov qword [rsp + 0x208], rbx
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rsp + 0x228], xmm0
mov dword [rsp + 0x88], ebx
cmp esi, 1
jne 0x140065276
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea rax, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftShared_ToolsMSConfig_startupreg
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400651d3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400651d3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400651b0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], bx
lea rcx, [rsp + 0x1b50]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREMicrosoftShared_ToolsMSConfig_startupreg
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rsp + 0x1b50]
call fcn.14001feb0
mov rdi, qword [rsp + 0x208]
test rdi, rdi
je 0x1400652bb
mov rbx, qword [rdi + 0x10]
mov rdi, qword [rdi]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x1400652a2
mov dword [rax + 0x20], 2
mov dword [rax + 0x24], r12d
cmp dword [rbx + 0x30], 0
je 0x1400652b1
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov rcx, rbx
call fcn.14005dc90
jmp 0x140065276
mov rcx, r14
call fcn.140093090
nop
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rsp + 0x200], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x218], xmm0
xor eax, eax
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x208], rax
mov rcx, qword [rsp + 0x228]
call fcn.1400ad45c
nop
cmp dword [rsp + 0x8c], 0
je 0x1400654d1
cmp esi, 1
jne 0x1400654d1
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea rax, [rsp + 0x21ca0]
sub r13, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140065353
movzx eax, word [rcx + r13]
test ax, ax
je 0x140065353
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140065330
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor esi, esi
mov word [rax], si
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1bc0]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1bc0]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionRunServices
lea rax, [rsp + 0x21ca0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140065433
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140065433
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140065410
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rsp + 0x1c30]
call fcn.14001fb40
nop
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x21ca0]
lea r8, str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionRunServices
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rsp + 0x1c30]
call fcn.14001feb0
jmp 0x1400654d3
xor esi, esi
lea rcx, [rsp + 0x1a0]
call fcn.1400a64e0
nop
lea rdx, [r14 + 0x198]
lea rcx, [rsp + 0x1a0]
call fcn.1400a659c
mov eax, dword [r14 + 0x3e4]
mov ebx, 0x20119
mov ecx, 0x20219
test eax, eax
cmove ebx, ecx
mov dword [rsp + 0x118], ebx
mov ecx, esi
setne cl
inc ecx
mov dword [rsp + 0xd0], ecx
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140065563
movzx eax, word [rcx + r8]
test ax, ax
je 0x140065563
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140065540
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140065b06
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
cmp rdx, 0x10000
jae 0x1400655b6
movzx edx, dx
lea rcx, [rsp + 0x90]
call fcn.14000d610
jmp 0x1400655db
mov rax, r15
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400655c0
mov r8d, eax
lea rcx, [rsp + 0x90]
call fcn.14000df90
nop
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x340]
call fcn.14001fc70
nop
mov r8d, ebx
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x340]
call fcn.1400210b0
test eax, eax
je 0x140065791
mov r13d, dword [rsp + 0x384]
mov r12d, esi
nop dword [rax + rax]
cmp r12d, r13d
jge 0x14006578a
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140065b11
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x138], rax
mov eax, dword [rsp + 0x394]
mov dword [rsp + 0x8c], eax
mov ecx, eax
call fcn.1400164e0
mov r15, rax
mov r8d, dword [rsp + 0x8c]
xor edx, edx
mov rcx, rax
call fcn.140241ba0
mov dword [rsp + 0x128], r12d
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x12c]
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x340]
call fcn.140020940
mov rbx, qword [rsp + 0x138]
test rbx, rbx
je 0x140065716
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
jle 0x140065714
xor eax, eax
mov edi, eax
test rdi, rdi
js 0x140065b1c
cmp rdi, rcx
jge 0x140065b1c
mov rax, qword [rsp + 0x1a8]
mov rdx, qword [rax + rdi*8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140065748
inc esi
inc rdi
movsxd rax, esi
mov rcx, qword [rsp + 0x1b0]
cmp rax, rcx
jl 0x1400656d3
xor esi, esi
mov rcx, r15
call fcn.140095d64
nop
lea rdx, [rbx - 0x18]
mov r15, 0xffffffffffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140065740
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r12d
jmp 0x140065620
cmp byte [r15], 1
jne 0x140065714
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x12c]
mov r8, rbx
lea rdx, [rsp + 0x21ca0]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055970
jmp 0x140065714
mov ebx, dword [rsp + 0x118]
cmp dword [r14 + 0x3e4], 0
je 0x140065a3b
mov edx, 0x10000
lea rcx, [rsp + 0x21ca0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionSharedDLLs
lea rax, [rsp + 0x21ca0]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x1400657e3
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400657e3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400657c0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140065b22
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x120], rax
lea rdx, str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionSharedDLLs
cmp rdx, 0x10000
jae 0x140065836
movzx edx, dx
lea rcx, [rsp + 0x120]
call fcn.14000d610
jmp 0x14006585b
mov rax, r15
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140065840
mov r8d, eax
lea rcx, [rsp + 0x120]
call fcn.14000df90
nop
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x2d0]
call fcn.14001fc70
nop
mov r8d, ebx
mov rdx, qword [rsp + 0x120]
lea rcx, [rsp + 0x2d0]
call fcn.1400210b0
test eax, eax
je 0x140065a0a
mov r13d, dword [rsp + 0x314]
mov r12d, esi
nop dword [rax + rax]
cmp r12d, r13d
jge 0x140065a0a
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140065b2d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x140], rax
mov eax, dword [rsp + 0x324]
mov dword [rsp + 0x84], eax
mov ecx, eax
call fcn.1400164e0
mov r15, rax
mov r8d, dword [rsp + 0x84]
xor edx, edx
mov rcx, rax
call fcn.140241ba0
mov dword [rsp + 0x130], r12d
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x134]
lea r8, [rsp + 0x140]
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x2d0]
call fcn.140020940
mov rbx, qword [rsp + 0x140]
test rbx, rbx
je 0x140065996
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
jle 0x140065994
xor eax, eax
mov edi, eax
test rdi, rdi
js 0x140065b38
cmp rdi, rcx
jge 0x140065b38
mov rax, qword [rsp + 0x1a8]
mov rdx, qword [rax + rdi*8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1400659c8
inc esi
inc rdi
movsxd rax, esi
mov rcx, qword [rsp + 0x1b0]
cmp rax, rcx
jl 0x140065953
xor esi, esi
mov rcx, r15
call fcn.140095d64
nop
lea rdx, [rbx - 0x18]
mov r15, 0xffffffffffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400659c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r12d
jmp 0x1400658a0
cmp byte [r15], 1
jne 0x140065994
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x134]
mov r8, rbx
lea rdx, [rsp + 0x21ca0]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055970
jmp 0x140065994
lea rcx, [rsp + 0x2d0]
call fcn.14001feb0
nop
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140065a3b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x340]
call fcn.14001feb0
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140065a6b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x1a0]
call fcn.1400a6500
nop
lea rcx, [rsp + 0x238]
call fcn.1400a6500
nop
lea rcx, [rsp + 0xa8]
call fcn.1400a6500
mov eax, 1
jmp 0x140065ab8
lea rcx, [rsp + 0x238]
call fcn.1400a6500
nop
lea rcx, [rsp + 0xa8]
call fcn.1400a6500
xor eax, eax
mov rcx, qword [rsp + 0x41ca0]
xor rcx, rsp
call fcn.1402155d0
lea r11, [rsp + 0x41cb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.1400a2cd8
int3