Function at 0x14004de50
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movzx r15d, dl
mov byte [rbp - 0x39], dl
mov r13, rcx
mov qword [rbp + 0x2f], rcx
xor esi, esi
mov dword [rbp - 9], esi
mov eax, dword [0x1401dfdf8]
test al, 1
jne 0x14004ded0
or eax, 1
mov dword [0x1401dfdf8], eax
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401dfe00], rax
lea rcx, [0x14012ddf0]
call fcn.1400d79b0
nop
mov eax, dword [0x1401dfdf8]
test al, 2
jne 0x14004df0c
or eax, 2
mov dword [0x1401dfdf8], eax
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401dfdf0], rax
lea rcx, [0x14012ddb0]
call fcn.1400d79b0
nop
mov eax, dword [0x1401dfdf8]
test al, 4
jne 0x14004df48
or eax, 4
mov dword [0x1401dfdf8], eax
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401dfde8], rax
lea rcx, [0x14012dd70]
call fcn.1400d79b0
nop
mov eax, dword [0x1401dfdf8]
test al, 8
jne 0x14004df7e
or eax, 8
mov dword [0x1401dfdf8], eax
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401dfe08], rax
lea rcx, [0x14012dd30]
call fcn.1400d79b0
nop
mov rax, qword [0x1401dfdf0]
mov ecx, dword [rax - 0x10]
mov rax, qword [0x1401dfe08]
mov rdx, qword [0x1401df0c0]
test ecx, ecx
je 0x14004dfeb
mov ecx, esi
test rdx, rdx
setne cl
test ecx, ecx
jne 0x14004dfb1
mov ecx, 0x80004005
call fcn.140001920
int3
mov rcx, rax
mov r9, rdx
sub r9, rax
nop word [rax + rax]
movzx r8d, word [rcx]
cmp r8w, word [rcx + r9]
jne 0x14004dfd9
add rcx, 2
test r8w, r8w
jne 0x14004dfc0
mov ecx, esi
jmp 0x14004dfde
sbb ecx, ecx
or ecx, 1
test ecx, ecx
setne cl
test cl, cl
je 0x14004f091
lea rcx, [rdx - 0x18]
lea rbx, [rax - 0x18]
cmp rcx, rbx
je 0x14004e03f
cmp dword [rbx + 0x10], 0
jl 0x14004e02f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004e02f
call fcn.1400028c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004e022
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401dfe08], rax
jmp 0x14004e03f
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401dfe08]
call fcn.140002770
mov rax, qword [0x1401dfe00]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004e09d
cmp dword [rdx + 0x10], 0
jge 0x14004e079
cmp dword [rax - 0xc], 0
jge 0x14004e06a
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401dfe00]
mov word [rax], si
jmp 0x14004e09d
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004e089
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401dfe00], rax
mov rax, qword [0x1401dfdf0]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004e102
cmp dword [rdx + 0x10], 0
jge 0x14004e0de
cmp dword [rax - 0xc], 0
jge 0x14004e0c8
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401dfdf0]
mov dword [rax - 0x10], esi
mov rax, qword [0x1401dfdf0]
mov word [rax], si
jmp 0x14004e102
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004e0ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401dfdf0], rax
mov rax, qword [0x1401dfde8]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004e160
cmp dword [rdx + 0x10], 0
jge 0x14004e13c
cmp dword [rax - 0xc], 0
jge 0x14004e12d
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401dfde8]
mov word [rax], si
jmp 0x14004e160
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004e14c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401dfde8], rax
mov r12d, esi
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x21], rdi
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x31], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Volatile_Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004e51e
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004e4c1
mov dword [rbp - 0x35], 0x104
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004e228
mov edx, 0x82
lea rcx, [rbp - 0x21]
call fcn.140002860
mov rdi, qword [rbp - 0x21]
lea rax, [rbp - 0x35]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x19]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004e27d
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d7e8c
test eax, eax
js 0x14004e272
cmp eax, dword [rdi - 0xc]
jg 0x14004e272
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
jmp 0x14004e2ca
mov ecx, 0x80070057
call fcn.140001920
int3
lea rdx, [rdi - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004e2ca
cmp dword [rdx + 0x10], 0
jge 0x14004e2a9
cmp dword [rdi - 0xc], 0
jge 0x14004e2a1
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rdi - 0x10], esi
mov word [rdi], si
jmp 0x14004e2ca
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004e2b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x21], rdi
mov dword [rbp - 0x35], 0x104
mov rax, qword [0x1401dfe00]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x82
or ecx, edx
jge 0x14004e305
mov edx, 0x82
lea rcx, [0x1401dfe00]
call fcn.140002860
mov rax, qword [0x1401dfe00]
lea rcx, [rbp - 0x35]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x19]
xor r8d, r8d
lea rdx, str.Local_AppData
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004e370
mov rcx, qword [0x1401dfe00]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d7e8c
mov rcx, rax
test eax, eax
js 0x14004e365
mov rax, qword [0x1401dfe00]
cmp ecx, dword [rax - 0xc]
jg 0x14004e365
mov dword [rax - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [0x1401dfe00]
mov word [rax + rcx*2], si
jmp 0x14004e3d2
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401dfe00]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004e3d2
cmp dword [rdx + 0x10], 0
jge 0x14004e3aa
cmp dword [rax - 0xc], 0
jge 0x14004e39b
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401dfe00]
mov word [rax], si
jmp 0x14004e3d2
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004e3ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401dfe00], rax
mov rdi, qword [rbp - 0x21]
mov dword [rbp - 0x35], 0x104
mov rax, qword [rbp - 0x31]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004e3ff
mov edx, 0x82
lea rcx, [rbp - 0x31]
call fcn.140002860
lea rax, [rbp - 0x35]
mov qword [rsp + 0x28], rax
mov rbx, qword [rbp - 0x31]
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x19]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004e458
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d7e8c
test eax, eax
js 0x14004e44d
cmp eax, dword [rbx - 0xc]
jg 0x14004e44d
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
jmp 0x14004e4b5
mov ecx, 0x80070057
call fcn.140001920
int3
mov rdx, qword [0x1401dfe00]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x31]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004e4b5
cmp dword [rbx + 0x10], 0
jl 0x14004e4a8
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004e4a8
call fcn.1400028c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004e49a
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x31], rax
mov rdi, qword [rbp - 0x21]
jmp 0x14004e4b5
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x31]
call fcn.140002770
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004e51e
mov rdx, qword [0x1401dfe00]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x31]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004e51e
cmp dword [rbx + 0x10], 0
jl 0x14004e511
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004e511
call fcn.1400028c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004e503
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x31], rax
mov rdi, qword [rbp - 0x21]
jmp 0x14004e51e
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x31]
call fcn.140002770
call fcn.14004d860
test al, al
je 0x14004e8fd
mov r15b, 1
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004e773
mov esi, dword [0x1401ddd80]
lea ecx, [rsi + 1]
imul ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0x13
jne 0x14004e5dd
xor ecx, ecx
mov r8d, 0x98
mov r11d, ecx
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
nop word [rax + rax]
test ebx, ebx
jle 0x14004e5d5
mov eax, esi
cdq
and edx, 3
lea r9d, [rdx + rax]
sar r9d, 2
mov edx, ecx
mov r10, rbx
test r9d, r9d
jle 0x14004e5cb
mov eax, edx
mov rcx, r9
add r8d, eax
dec eax
dec rcx
jne 0x14004e5c1
add edx, r11d
dec r10
jne 0x14004e5b7
xor ecx, ecx
inc r11d
cmp r11d, r8d
jl 0x14004e5a0
mov dword [rbp - 0x35], 0x104
mov ecx, esi
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x11
jne 0x14004e65d
xor ecx, ecx
lea r8d, [rcx + 0x4f]
mov r11d, ecx
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
nop dword [rax]
test ebx, ebx
jle 0x14004e655
mov eax, esi
cdq
and edx, 3
lea r9d, [rdx + rax]
sar r9d, 2
mov edx, ecx
mov r10, rbx
test r9d, r9d
jle 0x14004e64b
mov eax, edx
mov rcx, r9
add r8d, eax
dec eax
dec rcx
jne 0x14004e641
add edx, r11d
dec r10
jne 0x14004e637
xor ecx, ecx
inc r11d
cmp r11d, r8d
jl 0x14004e620
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004e683
mov edx, 0x82
lea rcx, [rbp - 0x21]
call fcn.140002860
mov rdi, qword [rbp - 0x21]
lea rax, [rbp - 0x35]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x19]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004e704
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d7e8c
test eax, eax
js 0x14004e6f9
cmp eax, dword [rdi - 0xc]
jg 0x14004e6f9
mov dword [rdi - 0x10], eax
cdqe
xor esi, esi
mov word [rdi + rax*2], si
xor r15b, r15b
cmp dword [rdi - 0x10], esi
jl 0x14004e706
lea rdx, [0x1401653a8]
mov rcx, rdi
call fcn.1400d805c
test rax, rax
je 0x14004e706
sub rax, rdi
sar rax, 1
test eax, eax
jne 0x14004e706
lea r12d, [rsi + 1]
jmp 0x14004e706
mov ecx, 0x80070057
call fcn.140001920
int3
xor esi, esi
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x1401ddd80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0xb
jne 0x14004e76a
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test r15b, r15b
je 0x14004e916
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004e910
mov dword [rbp - 0x35], 0x104
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004e7ce
mov edx, 0x82
lea rcx, [rbp - 0x21]
call fcn.140002860
mov rdi, qword [rbp - 0x21]
lea rcx, [rbp - 0x35]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x19]
xor r8d, r8d
lea rdx, str.DefaultValue
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r9d, dword [0x1401ddd80]
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 5
jne 0x14004e8a7
test r9d, r9d
je 0x14004e8a7
mov eax, r9d
and eax, 0x80000001
jge 0x14004e846
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14004e85d
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
mov dword [0x1401ddd80], eax
jmp 0x14004e86c
lea r9d, [r9*2 + 1]
mov dword [0x1401ddd80], r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r9d
sub ecx, eax
je 0x14004e890
sub ecx, 2
je 0x14004e894
dec ecx
je 0x14004e897
jmp 0x14004e8a2
add r9d, 2
inc r9d
add r9d, 2
mov dword [0x1401ddd80], r9d
test r9d, r9d
jne 0x14004e835
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d7e8c
test eax, eax
js 0x14004e905
cmp eax, dword [rdi - 0xc]
jg 0x14004e905
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14004d630
cmp dword [rdi - 0x10], 0
jl 0x14004e916
lea rdx, str.PMIL
mov rcx, rdi
call fcn.1400d805c
test rax, rax
je 0x14004e916
sub rax, rdi
sar rax, 1
movzx r15d, byte [rbp - 0x39]
test eax, eax
jne 0x14004e91b
mov r12d, 1
jmp 0x14004e91b
mov ecx, 0x80070057
call fcn.140001920
int3
mov r12d, 1
movzx r15d, byte [rbp - 0x39]
cmp qword [0x1401d8d48], 0xffffffff80000002
jne 0x14004e9ec
mov rdx, qword [0x1401df0c0]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401dfdf0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004e98e
cmp dword [rbx + 0x10], 0
jl 0x14004e97e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004e97e
call fcn.1400028c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004e971
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401dfdf0], rax
jmp 0x14004e98e
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401dfdf0]
call fcn.140002770
mov rcx, qword [rbp - 0x31]
add rcx, 0xffffffffffffffe8
mov rbx, qword [0x1401dfe00]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004ecd1
cmp dword [rbx + 0x10], 0
jl 0x14004eb5a
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004eb5a
call fcn.1400028c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004e9dc
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401dfe00], rax
jmp 0x14004ecd1
test r12d, r12d
je 0x14004eb76
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x14004e92c
cmp byte [0x1401ddea4], 0
jne 0x14004e92c
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0xf], rbx
lea r12, [0x140165490]
test r12, 0xffffffffffff0000
jne 0x14004ea62
movzx edi, r12w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004ead1
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.140002a60
mov rbx, qword [rbp + 0xf]
jmp 0x14004ead1
mov esi, dword [rbx - 0x10]
mov rdi, r12
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 9
or eax, ecx
jge 0x14004ea92
mov edx, 9
lea rcx, [rbp + 0xf]
call fcn.140002860
mov rbx, qword [rbp + 0xf]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x12
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004eab2
lea r8, [rbx + rdi*2]
call fcn.1400d7ac4
jmp 0x14004eaba
mov r8, r12
call fcn.1400d7bc0
cmp dword [rbx - 0xc], 9
jl 0x14004eb4f
mov dword [rbx - 0x10], 9
xor eax, eax
mov word [rbx + 0x12], ax
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401dfdf0]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004eb33
cmp dword [rsi + 0x10], 0
jl 0x14004eb1f
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004eb1f
mov rcx, rdi
call fcn.1400028c0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14004eb12
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401dfdf0], rax
jmp 0x14004eb33
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401dfdf0]
call fcn.140002770
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004e98e
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004e98e
mov ecx, 0x80070057
call fcn.140001920
nop
mov rbx, qword [rbp - 0x31]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401dfe00]
call fcn.140002770
jmp 0x14004ecd1
call fcn.14004da30
test al, al
jne 0x14004eb98
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x1401dfe00]
call fcn.1400114a0
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 7], rbx
lea r12, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
test r12, 0xffffffffffff0000
jne 0x14004ebea
movzx edi, r12w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004ec5c
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.140002a60
mov rbx, qword [rbp + 7]
jmp 0x14004ec5c
mov esi, dword [rbx - 0x10]
mov rdi, r12
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7a
or eax, ecx
jge 0x14004ec1a
mov edx, 0x7a
lea rcx, [rbp + 7]
call fcn.140002860
mov rbx, qword [rbp + 7]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xf4
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004ec3a
lea r8, [rbx + rdi*2]
call fcn.1400d7ac4
jmp 0x14004ec42
mov r8, r12
call fcn.1400d7bc0
cmp dword [rbx - 0xc], 0x7a
jl 0x14004f0d5
mov dword [rbx - 0x10], 0x7a
xor eax, eax
mov word [rbx + 0xf4], ax
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401dfdf0]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004ecbe
cmp dword [rsi + 0x10], 0
jl 0x14004ecaa
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004ecaa
mov rcx, rdi
call fcn.1400028c0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14004ec9d
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401dfdf0], rax
jmp 0x14004ecbe
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401dfdf0]
call fcn.140002770
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004ecd1
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x1401dfdf0]
cmp dword [rcx - 0x10], 0
jl 0x14004ed6f
lea rdx, str.windows_ie_ac_001
call fcn.1400d805c
test rax, rax
je 0x14004ed6f
sub rax, qword [0x1401dfdf0]
sar rax, 1
test eax, eax
jle 0x14004ed6f
mov rdx, qword [0x1401df0c0]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401dfde8]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004efb3
cmp dword [rbx + 0x10], 0
jl 0x14004ed5a
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004ed5a
call fcn.1400028c0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004ed4a
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401dfde8], rax
jmp 0x14004efb3
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401dfde8]
call fcn.140002770
jmp 0x14004efb3
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x14004ee7a
cmp byte [0x1401ddea4], 0
jne 0x14004ee7a
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x11], rbx
lea r12, [0x140165818]
test r12, 0xffffffffffff0000
jne 0x14004eddc
movzx edi, r12w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004ee47
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.140002a60
mov rbx, qword [rbp - 0x11]
jmp 0x14004ee47
mov esi, dword [rbx - 0x10]
mov rdi, r12
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 9
or eax, ecx
jge 0x14004ee0c
mov edx, 9
lea rcx, [rbp - 0x11]
call fcn.140002860
mov rbx, qword [rbp - 0x11]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x12
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004ee2c
lea r8, [rbx + rdi*2]
call fcn.1400d7ac4
jmp 0x14004ee34
mov r8, r12
call fcn.1400d7bc0
cmp dword [rbx - 0xc], 9
jl 0x14004ee6f
mov dword [rbx - 0x10], 9
xor eax, eax
mov word [rbx + 0x12], ax
lea rdx, [rbp - 0x11]
lea rcx, [0x1401dfde8]
call fcn.1400026d0
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004efb3
mov rcx, qword [rdx]
jmp 0x14004efad
mov ecx, 0x80070057
call fcn.140001920
nop
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 1], rbx
lea r12, [0x140165590]
test r12, 0xffffffffffff0000
jne 0x14004eecc
movzx edi, r12w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004ef3e
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.140002a60
mov rbx, qword [rbp - 1]
jmp 0x14004ef3e
mov esi, dword [rbx - 0x10]
mov rdi, r12
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7a
or eax, ecx
jge 0x14004eefc
mov edx, 0x7a
lea rcx, [rbp - 1]
call fcn.140002860
mov rbx, qword [rbp - 1]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xf4
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14004ef1c
lea r8, [rbx + rdi*2]
call fcn.1400d7ac4
jmp 0x14004ef24
mov r8, r12
call fcn.1400d7bc0
cmp dword [rbx - 0xc], 0x7a
jl 0x14004f0ca
mov dword [rbx - 0x10], 0x7a
xor eax, eax
mov word [rbx + 0xf4], ax
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401dfde8]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004efa0
cmp dword [rsi + 0x10], 0
jl 0x14004ef8c
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004ef8c
mov rcx, rdi
call fcn.1400028c0
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14004ef7f
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401dfde8], rax
jmp 0x14004efa0
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401dfde8]
call fcn.140002770
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004efb3
mov rcx, qword [rdi]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x1401d8d48], 0xffffffff80000002
je 0x14004f039
cmp byte [0x1401d8c12], 0
je 0x14004f039
lea rcx, [rbp + 0x17]
call fcn.14004d6b0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401dfdf0]
call fcn.1400114a0
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004f003
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x1f]
call fcn.14004d6b0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401dfde8]
call fcn.1400114a0
nop
mov rdx, qword [rbp + 0x1f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004f039
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x1401d8d48]
lea rcx, [0x1401dfdf0]
call fcn.14004f110
mov rdx, qword [0x1401d8d48]
lea rcx, [0x1401dfde8]
call fcn.14004f110
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004f079
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004f091
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r15b, r15b
je 0x14004f0b0
mov rcx, qword [0x1401dfde8]
add rcx, 0xffffffffffffffe8
call fcn.1400028c0
add rax, 0x18
mov qword [r13], rax
jmp 0x14004f0e0
mov rcx, qword [0x1401dfdf0]
add rcx, 0xffffffffffffffe8
call fcn.1400028c0
add rax, 0x18
mov qword [r13], rax
jmp 0x14004f0e0
mov ecx, 0x80070057
call fcn.140001920
nop
mov ecx, 0x80070057
call fcn.140001920
nop
mov dword [rbp - 9], 1
mov rax, r13
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret