Function at 0x140001000
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
mov eax, 0x2ec0
call fcn.140007010
sub rsp, 0x2ec0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x2e60], r15
mov qword [rbp + 0x2e58], r14
mov qword [rbp + 0x2e50], r13
mov qword [rbp + 0x2e48], r12
mov qword [rbp + 0x2e40], rdi
mov qword [rbp + 0x2e38], rsi
mov qword [rbp + 0x2e30], rbx
mov r12, rdx
movsxd r14, ecx
mov r8, qword [0x14000bb88]
mov qword [rbp + 0x2e70], r8
mov eax, 0x3f0
sub rsp, rax
lea rax, [rsp + 0x40]
mov r15, rax
xor eax, eax
mov dword [rbp + 0x10], eax
xor r13d, r13d
xor ebx, ebx
xor edi, edi
mov esi, 1
cmp r14, 1
jle 0x140001127
mov rcx, qword [r12 + rsi*8]
lea rdx, [0x1400082f0]
call qword [sym.imp.MSVCR80.dll_strstr]
mov rcx, qword [r12 + rsi*8]
mov r8d, 1
cmp rax, 0
cmovne edi, r8d
lea rdx, [0x1400082f4]
call qword [sym.imp.MSVCR80.dll_strstr]
mov rcx, qword [r12 + rsi*8]
test rax, rax
lea rdx, [0x1400082f8]
je 0x1400010cd
mov r13d, 2
call qword [sym.imp.MSVCR80.dll_strstr]
mov rcx, qword [r12 + rsi*8]
mov r8d, 1
cmp rax, 0
cmovne r13d, r8d
lea rdx, [0x1400082fc]
call qword [sym.imp.MSVCR80.dll_strstr]
mov rcx, qword [r12 + rsi*8]
mov r8d, 1
cmp rax, 0
cmovne ebx, r8d
lea rdx, [0x1400082f0]
call qword [sym.imp.MSVCR80.dll_strstr]
test rax, rax
je 0x1400022f2
add rsi, 1
cmp rsi, r14
jl 0x140001087
mov esi, dword [0x14000bbbc]
mov rdx, qword [0x14000bba0]
mov r8d, dword [0x14000b004]
mov r9, qword [0x14000bbb0]
xor eax, eax
lea rcx, [0x14000cd00]
mov dword [0x14000cd00], eax
mov byte [0x14000cd32], al
mov dword [rsp + 0x20], esi
call fcn.140003484
movsxd rcx, eax
mov qword [0x14000cde0], rcx
call qword [sym.imp.MSVCR80.dll_malloc]
mov edx, dword [section..data]
mov r8, qword [0x14000bbb0]
mov r9d, dword [0x14000bbbc]
mov qword [0x14000cde8], rax
xor eax, eax
mov dword [0x14000cd00], eax
mov byte [0x14000cd32], al
lea rcx, [0x14000cd00]
call fcn.140003e62
mov qword [0x14000cdf0], rax
mov rcx, rax
call qword [sym.imp.MSVCR80.dll_malloc]
mov qword [0x14000bba0], rax
test rax, rax
je 0x1400022a6
mov r8, qword [0x14000cdf0]
mov rcx, rax
xor edx, edx
call fcn.140004bcc
lea rax, [0x14000bbb8]
mov qword [0x14000bba8], rax
lea rdx, [0x1400026ba]
mov qword [0x14000ce00], rdx
mov qword [0x14000ce08], rdx
call fcn.140004718
test eax, eax
je 0x1400013b9
mov rsi, qword [0x14000bbb0]
mov r10d, dword [0x14000bbbc]
mov rdx, qword [0x14000bba0]
mov r9, qword [0x14000bba8]
xor eax, eax
lea rcx, [0x14000cd00]
mov dword [0x14000cd00], eax
mov byte [0x14000cd32], al
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], r10d
lea r8, [0x14000ce00]
call fcn.1400044b8
mov dword [0x14000cec0], eax
cmp eax, 1
je 0x1400012ad
call qword [sym.imp.MSVCR80.dll___iob_func]
add rax, 0x60
mov rcx, rax
lea rdx, str._cannot_initialize_cluster_interface_n
call qword [sym.imp.MSVCR80.dll_fprintf]
mov esi, dword [0x14000cd00]
call qword [sym.imp.MSVCR80.dll___iob_func]
add rax, 0x60
lea r10, [0x14000cd25]
mov qword [rsp + 0x20], r10
mov rcx, rax
lea rdx, str.skgxn_error_number__d_n__operation__s_n__location__s_n
mov r8d, esi
lea r9, [0x14000cd04]
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x1400013b9
mov rdx, qword [0x14000bba0]
mov r8, qword [0x14000bbb0]
mov r9d, 0x80000
xor eax, eax
lea rcx, [0x14000cd00]
mov dword [0x14000cd00], eax
mov byte [0x14000cd32], al
call fcn.140004690
mov esi, dword [0x14000bbbc]
mov rdx, qword [0x14000bba0]
mov r9, qword [0x14000bbb0]
mov dword [0x14000cec0], eax
xor eax, eax
mov dword [0x14000cd00], eax
mov byte [0x14000cd32], al
mov dword [rsp + 0x20], esi
lea rcx, [0x14000cd00]
lea r8, [0x14000cec4]
call fcn.140003914
mov dword [0x14000cec0], eax
cmp eax, 1
je 0x1400013de
call qword [sym.imp.MSVCR80.dll___iob_func]
add rax, 0x60
mov rcx, rax
lea rdx, str.cannot_get_local_node_number_n
call qword [sym.imp.MSVCR80.dll_fprintf]
mov esi, dword [0x14000cd00]
call qword [sym.imp.MSVCR80.dll___iob_func]
add rax, 0x60
lea r10, [0x14000cd25]
mov qword [rsp + 0x20], r10
mov rcx, rax
lea rdx, str.skgxn_error_number__d_n__operation__s_n__location__s_n
mov r8d, esi
lea r9, [0x14000cd04]
call qword [sym.imp.MSVCR80.dll_fprintf]
mov rdx, qword [0x14000bba0]
mov r8, qword [0x14000bbb0]
mov r9d, dword [0x14000bbbc]
xor eax, eax
lea rcx, [0x14000cd00]
mov dword [0x14000cd00], eax
mov byte [0x14000cd32], al
call fcn.140004358
mov dword [0x14000cec0], eax
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
call qword [sym.imp.MSVCR80.dll___iob_func]
add rax, 0x60
mov rcx, rax
lea rdx, str.Could_not_initialize_cluster_n
call qword [sym.imp.MSVCR80.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov dword [rbp + 0x2be8], eax
mov byte [rbp + 0x2c1a], al
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call fcn.140003e62
mov r14, rax
test r14, r14
jne 0x14000143c
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_struct_size_0_n
call qword [sym.imp.MSVCR80.dll_fprintf]
test ebx, ebx
jne 0x14000226b
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
mov rcx, r14
call qword [sym.imp.MSVCR80.dll_malloc]
mov rsi, rax
test rsi, rsi
je 0x140002222
mov rcx, rsi
xor edx, edx
mov r8, r14
call fcn.140004bcc
mov dword [rbp + 0x2d0c], ebx
lea rcx, [rbp + 0x2be8]
lea r8, [rbp + 0x2d60]
lea rax, [0x1400026ba]
xor r10d, r10d
mov qword [rbp + 0x2d60], rax
mov rdx, rsi
mov qword [rbp + 0x2d68], rax
mov dword [rbp + 0x2be8], r10d
xor r11d, r11d
mov byte [rbp + 0x2c1a], r10b
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r11
lea r9, [rbp + 0x2d0c]
call fcn.1400044b8
mov r14d, eax
cmp r14d, 1
je 0x1400014f1
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_cannot_initialize_cluster_interface._skgxn_error_code:__d_n
mov r9d, r14d
call qword [sym.imp.MSVCR80.dll_fprintf]
test ebx, ebx
jne 0x140001cf1
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
mov qword [rsp + 0x20], 0
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov rdx, rsi
mov dword [rbp + 0x2be8], eax
mov byte [rbp + 0x2c1a], al
lea r8, [rbp + 0x2e68]
xor r9d, r9d
call fcn.140003914
mov r14d, eax
cmp r14d, 1
je 0x140001584
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_cannot_get_local_node_number._skgxn_error_code:__d_n
mov r9d, r14d
call qword [sym.imp.MSVCR80.dll_fprintf]
test ebx, ebx
jne 0x140001d2d
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
mov byte [rbp + 0x2c1a], al
call fcn.140004358
mov r14d, eax
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
test r13d, r13d
je 0x140001946
cmp r13d, 1
jne 0x1400016b2
mov r8d, dword [rbp + 0x2e68]
mov dword [rsp + 0x20], 0x3e8
xor eax, eax
xor r10d, r10d
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
mov byte [rbp + 0x2c1a], al
lea rbx, [rbp + 0x2e28]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], r10
lea rcx, [rbp + 0x2be8]
lea r9, [rbp + 0x2800]
call fcn.1400033a8
cmp eax, 1
je 0x140001675
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_no_name_for_node__d_n
mov r9d, 0xffffffff
call qword [sym.imp.MSVCR80.dll_fprintf]
mov r12d, dword [rbp + 0x2be8]
call qword [sym.imp.MSVCR80.dll___iob_func]
lea rbx, [rbp + 0x2c0d]
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x2bec]
add rax, 0x60
mov rcx, rax
lea rdx, str.skgxn_error_number__d_n__operation__s_n__location__s_n
mov r8d, r12d
call qword [sym.imp.MSVCR80.dll_fprintf]
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
mov byte [rbp + 0x2c1a], al
call fcn.140004358
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
test edi, edi
je 0x140001699
mov r8d, dword [rbp + 0x2e68]
lea rdx, [rbp + 0x2800]
lea rcx, str._s_t_d_n
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x140001c79
lea rdx, [rbp + 0x2800]
lea rcx, [0x140008490]
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x140001c79
cmp r13d, 2
jne 0x140001c79
lea rbx, [0x14000827c]
mov rax, qword [rbx]
mov qword [rbp + 0x2ce0], rax
mov rdx, qword [rbx + 8]
mov qword [rbp + 0x2ce8], rdx
movzx ecx, word [rbx + 0x10]
mov word [rbp + 0x2cf0], cx
movzx edi, byte [rbx + 0x12]
mov byte [rbp + 0x2cf2], dil
lea rbx, str.SOFTWAREORACLEosd9icm
mov rax, qword [rbx]
mov qword [rbp + 0x2cc0], rax
mov rdx, qword [rbx + 8]
mov qword [rbp + 0x2cc8], rdx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x2cd0], rcx
movzx edi, byte [rbx + 0x18]
mov byte [rbp + 0x2cd8], dil
lea rdx, str.ClusterName
mov rax, qword [rdx]
mov qword [rbp + 0x2d00], rax
mov ecx, dword [rdx + 8]
mov dword [rbp + 0x2d08], ecx
mov qword [rbp + 0x2e18], 0
xor r13d, r13d
xor edi, edi
xor ebx, ebx
lea rcx, [rbp + 0x2d38]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x140001791
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_error_initializing_security_descriptor._native_return_code:__d_n
mov r9d, r14d
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001894
lea rcx, [rbp + 0x2ce0]
lea rdx, str.HKEY_LOCAL_MACHINE
call qword [sym.imp.MSVCR80.dll__stricmp]
test eax, eax
jne 0x1400017b5
movabs r13, 0xffffffff80000002
jmp 0x14000181f
lea rcx, [rbp + 0x2ce0]
lea rdx, str.HKEY_CURRENT_USER
call qword [sym.imp.MSVCR80.dll__stricmp]
test eax, eax
jne 0x1400017d9
movabs r13, 0xffffffff80000001
jmp 0x14000181f
lea rcx, [rbp + 0x2ce0]
lea rdx, str.HKEY_USERS
call qword [sym.imp.MSVCR80.dll__stricmp]
test eax, eax
jne 0x1400017fd
movabs r13, 0xffffffff80000003
jmp 0x14000181f
lea rcx, [rbp + 0x2ce0]
lea rdx, str.HKEY_CLASSES_ROOT
call qword [sym.imp.MSVCR80.dll__stricmp]
test eax, eax
jne 0x140001824
movabs r13, 0xffffffff80000000
xor r14d, r14d
jmp 0x14000182a
mov r14d, 0x3c
test r14d, r14d
je 0x140001852
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_invalid_registry_key._native_return_code:__d_n
mov r9d, r14d
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001894
lea rax, [rbp + 0x2e18]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x2cc0]
mov rcx, r13
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x140001885
xor edi, edi
mov ebx, 1
jmp 0x140001894
mov edx, 1
xor edi, edi
cmp eax, 0
cmove edi, edx
mov ebx, edi
mov rcx, qword [rbp + 0x2e18]
test rcx, rcx
je 0x1400018a6
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
test r13, r13
je 0x1400018bd
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x2e18]
test rcx, rcx
je 0x1400018cf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140001d69
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_CM_registry_key_lookup_failed_n
call qword [sym.imp.MSVCR80.dll_fprintf]
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_cluster_name_not_found_n
call qword [sym.imp.MSVCR80.dll_fprintf]
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
mov byte [rbp + 0x2c1a], al
call fcn.140004358
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
jmp 0x140001c79
mov qword [rsp + 0x20], 0
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov rdx, rsi
mov dword [rbp + 0x2be8], eax
mov byte [rbp + 0x2c1a], al
mov r8d, 3
xor r9d, r9d
call fcn.140003484
movsxd r15, eax
cmp r14d, 0xffffffff
je 0x140002194
mov rcx, r15
shl rcx, 2
call qword [sym.imp.MSVCR80.dll_malloc]
mov r13, rax
test r13, r13
je 0x14000214d
lea r10, [rbp + 0x2e20]
mov qword [rsp + 0x20], r10
lea rcx, [rbp + 0x2be8]
xor eax, eax
xor r11d, r11d
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
mov byte [rbp + 0x2c1a], al
mov qword [rsp + 0x28], r11
mov r8, r13
mov qword [rsp + 0x30], r11
mov r9, r15
call fcn.1400032d8
mov r14d, eax
cmp r14d, 1
je 0x140001a37
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_cannot_get_node_numbers._skgxn_error_code:__d_n
mov r9d, r14d
call qword [sym.imp.MSVCR80.dll_fprintf]
test ebx, ebx
jne 0x140002096
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
mov byte [rbp + 0x2c1a], al
call fcn.140004358
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
mov rax, qword [rbp + 0x2e20]
xor r14d, r14d
test rax, rax
jbe 0x140001b61
mov edx, dword [rbp + 0x10]
mov dword [rbp], ebx
mov ebx, dword [r13 + r14*4]
cmp ebx, dword [rbp + 0x2e68]
jne 0x140001b4e
mov dword [rsp + 0x20], 0x3e8
lea r10, [rbp + 0x2e28]
xor eax, eax
xor r11d, r11d
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
mov byte [rbp + 0x2c1a], al
mov qword [rsp + 0x28], r10
mov r8d, ebx
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], r11
lea rcx, [rbp + 0x2be8]
lea r9, [rbp + 0x2800]
call fcn.1400033a8
mov r15d, eax
cmp r15d, 1
je 0x140001b11
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
mov dword [rsp + 0x20], r15d
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_no_name_for_node__d._skgxn_error_code:__d_n
mov r9d, ebx
call qword [sym.imp.MSVCR80.dll_fprintf]
mov eax, dword [rbp]
test eax, eax
jne 0x1400020d2
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
mov byte [rbp + 0x2c1a], al
call fcn.140004358
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
test edi, edi
je 0x140001b2e
lea rdx, [rbp + 0x2800]
lea rcx, str._s_t_d_n
mov r8d, ebx
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x140001b42
lea rdx, [rbp + 0x2800]
lea rcx, [0x140008490]
call qword [sym.imp.MSVCR80.dll_printf]
mov rax, qword [rbp + 0x2e20]
mov edx, 1
add r14d, 1
cmp rax, r14
ja 0x140001a50
mov ebx, dword [rbp]
mov dword [rbp + 0x10], edx
xor r14d, r14d
test rax, rax
jbe 0x140001c79
mov r15d, dword [rbp + 0x10]
mov qword [rbp + 8], r12
mov r12d, dword [r13 + r14*4]
cmp r12d, dword [rbp + 0x2e68]
jne 0x140001b8d
cmp r15d, 1
je 0x140001c6c
mov dword [rsp + 0x20], 0x3e8
lea r10, [rbp + 0x2e28]
xor eax, eax
xor r11d, r11d
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
mov byte [rbp + 0x2c1a], al
mov qword [rsp + 0x28], r10
mov r8d, r12d
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], r11
lea rcx, [rbp + 0x2be8]
lea r9, [rbp + 0x2800]
call fcn.1400033a8
cmp eax, 1
je 0x140001c34
call qword [sym.imp.MSVCR80.dll___iob_func]
add rax, 0x60
mov rcx, rax
mov rax, qword [rbp + 8]
mov r8, qword [rax]
lea rdx, str._s:_no_name_for_node__d_n
mov r9d, r12d
call qword [sym.imp.MSVCR80.dll_fprintf]
test ebx, ebx
jne 0x14000210e
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
mov byte [rbp + 0x2c1a], al
call fcn.140004358
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
test edi, edi
je 0x140001c51
lea rdx, [rbp + 0x2800]
lea rcx, str._s_t_d_n
mov r8d, r12d
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x140001c65
lea rdx, [rbp + 0x2800]
lea rcx, [0x140008490]
call qword [sym.imp.MSVCR80.dll_printf]
mov rax, qword [rbp + 0x2e20]
add r14d, 1
cmp rax, r14
ja 0x140001b75
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
mov byte [rbp + 0x2c1a], al
call fcn.140004358
xor ecx, ecx
call qword [sym.imp.MSVCR80.dll_exit]
add rsp, 0x3f0
mov rcx, qword [rbp + 0x2e70]
call fcn.140006fe0
mov rbx, qword [rbp + 0x2e30]
mov rsi, qword [rbp + 0x2e38]
mov rdi, qword [rbp + 0x2e40]
mov r12, qword [rbp + 0x2e48]
mov r13, qword [rbp + 0x2e50]
mov r14, qword [rbp + 0x2e58]
mov r15, qword [rbp + 0x2e60]
lea rsp, [rbp + 0x2e80]
pop rbp
ret
mov r14d, dword [rbp + 0x2be8]
call qword [sym.imp.MSVCR80.dll___iob_func]
lea r10, [rbp + 0x2c0d]
mov qword [rsp + 0x20], r10
lea r9, [rbp + 0x2bec]
add rax, 0x60
mov rcx, rax
lea rdx, str.skgxn_error_number__d_n__operation__s_n__location__s_n
mov r8d, r14d
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x1400014e6
mov r14d, dword [rbp + 0x2be8]
call qword [sym.imp.MSVCR80.dll___iob_func]
lea r10, [rbp + 0x2c0d]
mov qword [rsp + 0x20], r10
lea r9, [rbp + 0x2bec]
add rax, 0x60
mov rcx, rax
lea rdx, str.skgxn_error_number__d_n__operation__s_n__location__s_n
mov r8d, r14d
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001553
test edi, edi
je 0x140002050
mov qword [rbp + 0x2cf8], 0
xor edi, edi
xor ebx, ebx
mov dword [rbp + 0x2cdc], 0x2800
lea rcx, [rbp + 0x2d10]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x140001dcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
lea rdx, str._s:_error_initializing_security_descriptor._native_return_code:__d_n
mov rcx, rax
mov r9d, r13d
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001f90
call qword [sym.imp.MSVCR80.dll___iob_func]
mov rcx, rax
call qword [sym.imp.MSVCR80.dll_fflush]
lea rcx, [rbp + 0x2ce0]
lea rdx, str.HKEY_LOCAL_MACHINE
call qword [sym.imp.MSVCR80.dll__stricmp]
test eax, eax
jne 0x140001e02
movabs rdi, 0xffffffff80000002
jmp 0x140001e6c
lea rcx, [rbp + 0x2ce0]
lea rdx, str.HKEY_CURRENT_USER
call qword [sym.imp.MSVCR80.dll__stricmp]
test eax, eax
jne 0x140001e26
movabs rdi, 0xffffffff80000001
jmp 0x140001e6c
lea rcx, [rbp + 0x2ce0]
lea rdx, str.HKEY_USERS
call qword [sym.imp.MSVCR80.dll__stricmp]
test eax, eax
jne 0x140001e4a
movabs rdi, 0xffffffff80000003
jmp 0x140001e6c
lea rcx, [rbp + 0x2ce0]
lea rdx, str.HKEY_CLASSES_ROOT
call qword [sym.imp.MSVCR80.dll__stricmp]
test eax, eax
jne 0x140001e71
movabs rdi, 0xffffffff80000000
xor r13d, r13d
jmp 0x140001e77
mov r13d, 0x3c
test r13d, r13d
je 0x140001ea2
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
lea rdx, str._s:_invalid_registry_key._native_return_code:__d_n
mov rcx, rax
mov r9d, r13d
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001f90
lea rax, [rbp + 0x2cf8]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x2cc0]
mov rcx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r13d, eax
test r13d, r13d
je 0x140001ef5
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
lea rdx, str._s:_could_not_open_the_registry_key._native_return_code:__d_n
mov rcx, rax
mov r9d, r13d
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001f90
mov rcx, qword [rbp + 0x2cf8]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rbp + 0x2cf8]
lea r9, [rbp + 0x2cf4]
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea r10, [rbp + 0x2cdc]
mov qword [rsp + 0x28], r10
lea rdx, [rbp + 0x2d00]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r13d, eax
test r13d, r13d
jne 0x140001f6f
mov eax, dword [rbp + 0x2cf4]
cmp eax, 1
jne 0x140001f4f
mov ebx, 1
jmp 0x140001f90
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
lea rdx, str._s:_invalid_data_type_found_for_the_registry_value._string_expected._n
mov rcx, rax
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001f90
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
lea rdx, str._s:_failed_to_query_registry_key._native_return_code:__d_n
mov rcx, rax
mov r9d, r13d
call qword [sym.imp.MSVCR80.dll_fprintf]
mov rcx, qword [rbp + 0x2cf8]
test rcx, rcx
je 0x140001fa2
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
test rdi, rdi
je 0x140001fb9
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x2cf8]
test rcx, rcx
je 0x140001fcb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140002073
lea rbx, [rbp]
mov rcx, rbx
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x140001ff5
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140001fdc
add rax, 0xffffffffffffffff
cmp rax, 0x3f0
jb 0x140002021
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
lea rdx, str._s:_warning:_cluster_name_will_be_truncated_to__d_characters._n
mov rcx, rax
mov r9d, 0x3ef
call qword [sym.imp.MSVCR80.dll_fprintf]
mov rcx, r15
mov rdx, rbx
mov r8d, 0x3ef
call qword [sym.imp.MSVCR80.dll_strncpy]
mov byte [r15 + 0x3ef], 0
lea rcx, [0x140008490]
mov rdx, r15
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x140001c79
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
lea rdx, str._s:_CM_registry_key_does_not_exists_n
mov rcx, rax
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x1400018f5
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
lea rdx, str._s:_CM_registry_query_failed_n
mov rcx, rax
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x1400018f5
mov r14d, dword [rbp + 0x2be8]
call qword [sym.imp.MSVCR80.dll___iob_func]
lea r10, [rbp + 0x2c0d]
mov qword [rsp + 0x20], r10
lea r9, [rbp + 0x2bec]
add rax, 0x60
mov rcx, rax
lea rdx, str.skgxn_error_number__d_n__operation__s_n__location__s_n
mov r8d, r14d
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001a09
mov r15d, dword [rbp + 0x2be8]
call qword [sym.imp.MSVCR80.dll___iob_func]
lea r10, [rbp + 0x2c0d]
mov qword [rsp + 0x20], r10
lea r9, [rbp + 0x2bec]
add rax, 0x60
mov rcx, rax
lea rdx, str.skgxn_error_number__d_n__operation__s_n__location__s_n
mov r8d, r15d
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001ae3
mov eax, dword [rbp + 0x2be8]
mov dword [rbp], eax
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8d, dword [rbp]
lea r10, [rbp + 0x2c0d]
mov qword [rsp + 0x20], r10
add rax, 0x60
mov rcx, rax
lea r9, [rbp + 0x2bec]
lea rdx, str.skgxn_error_number__d_n__operation__s_n__location__s_n
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001c06
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r14, rax
call qword [sym.imp.MSVCR80.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR80.dll_strerror]
mov r8, qword [r12]
mov qword [rsp + 0x20], rax
add r14, 0x60
mov rcx, r14
lea rdx, str._s:_cannot_allocate_memory_for__d_nodes.__s_n
mov r9, r15
call qword [sym.imp.MSVCR80.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
jmp 0x14000199b
call qword [sym.imp.MSVCR80.dll___iob_func]
mov r8, qword [r12]
add rax, 0x60
mov rcx, rax
lea rdx, str._s:_cannot_get_max_nodes_n
call qword [sym.imp.MSVCR80.dll_fprintf]
test ebx, ebx
jne 0x1400021e9
lea rcx, [rbp + 0x2be8]
xor eax, eax
mov dword [rbp + 0x2be8], eax
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
mov byte [rbp + 0x2c1a], al
call fcn.140004358
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
jmp 0x140001982
mov r13d, dword [rbp + 0x2be8]
call qword [sym.imp.MSVCR80.dll___iob_func]
lea r10, [rbp + 0x2c0d]
mov qword [rsp + 0x20], r10
lea r9, [rbp + 0x2bec]
add rax, 0x60
mov rcx, rax
lea rdx, str.skgxn_error_number__d_n__operation__s_n__location__s_n
mov r8d, r13d
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x1400021b6
call qword [sym.imp.MSVCR80.dll___iob_func]
mov qword [rbp], rax
call qword [sym.imp.MSVCR80.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR80.dll_strerror]
mov rcx, qword [rbp]
mov r8, qword [r12]
mov qword [rsp + 0x20], rax
add rcx, 0x60
lea rdx, str._s:_cannot_allocate_memory_of_size__d.__s__n
mov r9, r14
call qword [sym.imp.MSVCR80.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
jmp 0x140001451
mov esi, dword [rbp + 0x2be8]
call qword [sym.imp.MSVCR80.dll___iob_func]
lea r10, [rbp + 0x2c0d]
mov qword [rsp + 0x20], r10
lea r9, [rbp + 0x2bec]
add rax, 0x60
mov rcx, rax
lea rdx, str.skgxn_error_number__d_n__operation__s_n__location__s_n
mov r8d, esi
call qword [sym.imp.MSVCR80.dll_fprintf]
jmp 0x140001431
call qword [sym.imp.MSVCR80.dll___iob_func]
mov rsi, rax
call qword [sym.imp.MSVCR80.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR80.dll_strerror]
mov r8, qword [0x14000cdf0]
add rsi, 0x60
mov rcx, rsi
lea rdx, str.:_cannot_allocate__d_bytes_of_memory.__s_n
mov r9, rax
call qword [sym.imp.MSVCR80.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
mov rax, qword [0x14000bba0]
jmp 0x1400011c5
mov rcx, qword [r12 + rsi*8]
lea rdx, [0x1400082f4]
call qword [sym.imp.MSVCR80.dll_strstr]
test rax, rax
jne 0x14000111a
mov rcx, qword [r12 + rsi*8]
lea rdx, [0x1400082f8]
call qword [sym.imp.MSVCR80.dll_strstr]
test rax, rax
jne 0x14000111a
mov rcx, qword [r12 + rsi*8]
lea rdx, [0x1400082fc]
call qword [sym.imp.MSVCR80.dll_strstr]
test rax, rax
jne 0x14000111a
mov rcx, qword [r12]
call fcn.1400027f4
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
jmp 0x14000111a