Function at 0x1400bd970
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xae8]
sub rsp, 0xbc0
mov qword [rbp + 0x240], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0xab0], rax
mov r13, rcx
mov qword [rbp + 0xa0], rcx
xor r12d, r12d
mov qword [rbp + 0x10], r12
mov r14d, r12d
mov dword [rsp + 0x50], r12d
mov r15d, r12d
mov dword [rsp + 0x40], r12d
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareExplorerTabs
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400bf061
xor r9d, r9d
lea r8, [0x14010a54c]
mov edx, 0x80
lea rcx, [rbp + 0x9b0]
call section..text
lea r11, [rsp + 0x38]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x9b0]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400bf057
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14010a558]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400bdaaf
mov ecx, dword [rsp + 0x54]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rsi, rax
mov qword [rbp + 0x10], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xc8]
xor r8d, r8d
lea rdx, str.Directory
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x314]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ViewMode
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SortMode
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x318]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SortAscending
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x31c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ShowInGroups
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x32c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ApplyFilter
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x330]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FilterCaseSensitive
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x320]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ShowHidden
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x324]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AutoArrange
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x328]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ShowGridlines
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 0x200
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x34c]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xc]
xor r8d, r8d
lea rdx, [0x14010a688]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x1400bdd02
cmp dword [rbp + 0xc], 1
jne 0x1400bdd02
lea eax, [r11 - 1]
cmp word [rbp + rax*2 + 0x34c], 0
je 0x1400bdd0a
mov eax, 0x200
cmp r11d, eax
cmovb eax, r11d
mov word [rbp + rax*2 + 0x34c], r12w
jmp 0x1400bdd0a
mov word [rbp + 0x34c], r12w
mov eax, dword [r13 + 0xed78]
mov dword [rbp + 0x334], eax
mov eax, dword [r13 + 0xed7c]
mov dword [rbp + 0x338], eax
mov qword [rsp + 0x60], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400bf01b
mov qword [rsp + 0x58], rax
mov qword [rax], rax
mov rax, qword [rsp + 0x58]
mov qword [rax + 8], rax
mov qword [rbp - 0x28], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400befdf
mov qword [rbp - 0x30], rax
mov qword [rax], rax
mov rax, qword [rbp - 0x30]
mov qword [rax + 8], rax
mov qword [rbp - 0x10], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400befa3
mov qword [rbp - 0x18], rax
mov qword [rax], rax
mov rax, qword [rbp - 0x18]
mov qword [rax + 8], rax
mov qword [rbp - 0x40], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400bef67
mov qword [rbp - 0x48], rax
mov qword [rax], rax
mov rax, qword [rbp - 0x48]
mov qword [rax + 8], rax
mov qword [rbp - 0x70], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400bef2b
mov qword [rbp - 0x78], rax
mov qword [rax], rax
mov rax, qword [rbp - 0x78]
mov qword [rax + 8], rax
mov qword [rsp + 0x78], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400beeef
mov qword [rsp + 0x70], rax
mov qword [rax], rax
mov rax, qword [rsp + 0x70]
mov qword [rax + 8], rax
mov qword [rbp - 0x58], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400beeb3
mov qword [rbp - 0x60], rax
mov qword [rax], rax
mov rax, qword [rbp - 0x60]
mov qword [rax + 8], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Columns
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400be3e9
lea r8, [rbp - 0x18]
lea rdx, [0x14010a6a8]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc120
lea r8, [rbp - 0x30]
lea rdx, [0x14010a6d0]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc120
lea r8, [rsp + 0x58]
lea rdx, [0x14010a6f8]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc120
lea r8, [rbp - 0x48]
lea rdx, [0x14010a720]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc120
lea r8, [rbp - 0x78]
lea rdx, [0x14010a748]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc120
lea r8, [rsp + 0x70]
lea rdx, [0x14010a768]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc120
lea r8, [rbp - 0x60]
lea rdx, [0x14010a788]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc120
mov qword [rbp + 0x128], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400bee1c
mov qword [rbp + 0x120], rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x158], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400bede0
mov qword [rbp + 0x150], rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x110], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400beda4
mov qword [rbp + 0x108], rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x140], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400bed68
mov qword [rbp + 0x138], rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x170], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400bed2c
mov qword [rbp + 0x168], rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x1a0], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400becf0
mov qword [rbp + 0x198], rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x188], r12
mov ecx, 0x20
call fcn.14004b164
test rax, rax
je 0x1400becb4
mov qword [rbp + 0x180], rax
mov qword [rax], rax
mov qword [rax + 8], rax
lea r8, [rbp + 0x108]
lea rdx, [0x14010a7b8]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc250
lea r8, [rbp + 0x150]
lea rdx, [0x14010a7f0]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc250
lea r8, [rbp + 0x120]
lea rdx, [0x14010a820]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc250
lea r8, [rbp + 0x138]
lea rdx, [0x14010a850]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc250
lea r8, [rbp + 0x168]
lea rdx, [0x14010a880]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc250
lea r8, [rbp + 0x198]
lea rdx, [0x14010a8a8]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc250
lea r8, [rbp + 0x180]
lea rdx, [0x14010a8d0]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc250
mov r9, qword [rbp + 0x108]
mov rcx, qword [r9]
cmp rcx, r9
je 0x1400be102
mov rdx, qword [rbp - 0x18]
nop dword [rax]
mov rax, qword [rdx]
cmp rax, rdx
je 0x1400be0fa
mov r8d, dword [rcx + 0x10]
nop dword [rax]
cmp dword [rax + 0x10], r8d
je 0x1400be0f0
mov rax, qword [rax]
cmp rax, rdx
jne 0x1400be0e0
jmp 0x1400be0fa
mov edx, dword [rcx + 0x18]
mov dword [rax + 0x18], edx
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rcx]
cmp rcx, r9
jne 0x1400be0d0
mov r15, qword [rbp + 0x150]
mov rcx, qword [r15]
cmp rcx, r15
je 0x1400be143
mov rdx, qword [rbp - 0x30]
mov rax, qword [rdx]
cmp rax, rdx
je 0x1400be13b
mov r8d, dword [rcx + 0x10]
cmp dword [rax + 0x10], r8d
je 0x1400be131
mov rax, qword [rax]
cmp rax, rdx
jne 0x1400be121
jmp 0x1400be13b
mov edx, dword [rcx + 0x18]
mov dword [rax + 0x18], edx
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rcx]
cmp rcx, r15
jne 0x1400be115
mov r14, qword [rbp + 0x120]
mov rcx, qword [r14]
cmp rcx, r14
je 0x1400be186
mov rdx, qword [rsp + 0x58]
mov rax, qword [rdx]
cmp rax, rdx
je 0x1400be17e
mov r8d, dword [rcx + 0x10]
cmp dword [rax + 0x10], r8d
je 0x1400be173
mov rax, qword [rax]
cmp rax, rdx
jne 0x1400be163
jmp 0x1400be17e
mov edx, dword [rcx + 0x18]
mov dword [rax + 0x18], edx
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rcx]
cmp rcx, r14
jne 0x1400be157
mov r13, qword [rbp + 0x138]
mov rcx, qword [r13]
cmp rcx, r13
je 0x1400be1d2
mov rdx, qword [rbp - 0x48]
nop word [rax + rax]
mov rax, qword [rdx]
cmp rax, rdx
je 0x1400be1ca
mov r8d, dword [rcx + 0x10]
nop dword [rax]
cmp dword [rax + 0x10], r8d
je 0x1400be1c0
mov rax, qword [rax]
cmp rax, rdx
jne 0x1400be1b0
jmp 0x1400be1ca
mov edx, dword [rcx + 0x18]
mov dword [rax + 0x18], edx
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rcx]
cmp rcx, r13
jne 0x1400be1a0
mov r12, qword [rbp + 0x168]
mov rcx, qword [r12]
cmp rcx, r12
je 0x1400be214
mov rdx, qword [rbp - 0x78]
mov rax, qword [rdx]
cmp rax, rdx
je 0x1400be20c
mov r8d, dword [rcx + 0x10]
cmp dword [rax + 0x10], r8d
je 0x1400be202
mov rax, qword [rax]
cmp rax, rdx
jne 0x1400be1f2
jmp 0x1400be20c
mov edx, dword [rcx + 0x18]
mov dword [rax + 0x18], edx
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rcx]
cmp rcx, r12
jne 0x1400be1e6
mov rsi, qword [rbp + 0x198]
mov rcx, qword [rsi]
cmp rcx, rsi
je 0x1400be257
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx]
cmp rax, rdx
je 0x1400be24f
mov r8d, dword [rcx + 0x10]
cmp dword [rax + 0x10], r8d
je 0x1400be244
mov rax, qword [rax]
cmp rax, rdx
jne 0x1400be234
jmp 0x1400be24f
mov edx, dword [rcx + 0x18]
mov dword [rax + 0x18], edx
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rcx]
cmp rcx, rsi
jne 0x1400be228
mov rdi, qword [rbp + 0x180]
mov rcx, qword [rdi]
cmp rcx, rdi
je 0x1400be2a2
mov rdx, qword [rbp - 0x60]
nop word [rax + rax]
mov rax, qword [rdx]
cmp rax, rdx
je 0x1400be29a
mov r8d, dword [rcx + 0x10]
nop dword [rax]
cmp dword [rax + 0x10], r8d
je 0x1400be290
mov rax, qword [rax]
cmp rax, rdx
jne 0x1400be280
jmp 0x1400be29a
mov edx, dword [rcx + 0x18]
mov dword [rax + 0x18], edx
mov rdx, qword [rbp - 0x60]
mov rcx, qword [rcx]
cmp rcx, rdi
jne 0x1400be270
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
cmp rcx, rdi
je 0x1400be2d0
nop dword [rax]
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
cmp rbx, rdi
jne 0x1400be2c0
mov rcx, rdi
call fcn.14004b088
nop
mov rcx, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rcx, rsi
je 0x1400be2f8
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
cmp rbx, rsi
jne 0x1400be2e8
mov rcx, rsi
call fcn.14004b088
nop
mov rcx, qword [r12]
mov qword [r12], r12
mov qword [r12 + 8], r12
cmp rcx, r12
je 0x1400be323
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
cmp rbx, r12
jne 0x1400be313
mov rcx, r12
call fcn.14004b088
nop
mov rcx, qword [r13]
mov qword [r13], r13
mov qword [r13 + 8], r13
cmp rcx, r13
je 0x1400be350
nop dword [rax]
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
cmp rbx, r13
jne 0x1400be340
mov rcx, r13
call fcn.14004b088
nop
mov rdi, qword [rbp + 0x108]
mov rcx, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
cmp rcx, rdi
je 0x1400be380
nop
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
cmp rbx, rdi
jne 0x1400be370
mov rcx, rdi
call fcn.14004b088
nop
mov rcx, qword [r15]
mov qword [r15], r15
mov qword [r15 + 8], r15
cmp rcx, r15
je 0x1400be3a8
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
cmp rbx, r15
jne 0x1400be398
mov rcx, r15
call fcn.14004b088
nop
mov rcx, qword [r14]
mov qword [r14], r14
mov qword [r14 + 8], r14
cmp rcx, r14
je 0x1400be3d0
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
cmp rbx, r14
jne 0x1400be3c0
mov rcx, r14
call fcn.14004b088
mov r13, qword [rbp + 0xa0]
mov r14d, dword [rsp + 0x50]
mov r15d, dword [rsp + 0x40]
mov ecx, 0xcc
call fcn.14004af90
mov r12, rax
xor edx, edx
mov r8d, 0xcc
mov rcx, rax
call fcn.140051eb0
xor esi, esi
lea rdi, [0x14013ea80]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rbx]
cmp rcx, rbx
je 0x1400be42d
mov eax, dword [rdi]
nop
cmp dword [rcx + 0x10], eax
je 0x1400be483
mov rcx, qword [rcx]
cmp rcx, rbx
jne 0x1400be420
mov eax, dword [rdi]
mov dword [rbp + 0x48], eax
mov eax, dword [rdi + 4]
mov dword [rbp + 0x4c], eax
mov dword [rbp + 0x50], ILGetSize
lea r8, [rbp + 0x48]
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.140017f40
movabs rcx, 0x1555555555555554
mov rdx, qword [rsp + 0x60]
sub rcx, rdx
cmp rcx, 1
jb 0x1400beea6
inc rdx
mov qword [rsp + 0x60], rdx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rbx, qword [rsp + 0x58]
inc esi
add rdi, 0xc
cmp esi, 0x33
jb 0x1400be414
mov rcx, r12
call fcn.14004b048
mov ecx, 8
call fcn.14004af90
mov r12, rax
mov qword [rax], 0
xor esi, esi
lea rdi, [0x14013ece8]
mov rbx, qword [rbp - 0x18]
mov rcx, qword [rbx]
cmp rcx, rbx
je 0x1400be4ce
mov edx, dword [rdi]
cmp dword [rcx + 0x10], edx
je 0x1400be521
mov rcx, qword [rcx]
cmp rcx, rbx
jne 0x1400be4c1
mov eax, dword [rdi]
mov dword [rbp + 0x58], eax
mov eax, dword [rdi + 4]
mov dword [rbp + 0x5c], eax
mov dword [rbp + 0x60], ILGetSize
lea r8, [rbp + 0x58]
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.140017f40
movabs rcx, 0x1555555555555554
mov rdx, qword [rbp - 0x10]
sub rcx, rdx
cmp rcx, 1
jb 0x1400bee99
inc rdx
mov qword [rbp - 0x10], rdx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rbx, qword [rbp - 0x18]
inc esi
add rdi, 0xc
cmp esi, 2
jb 0x1400be4b7
mov rcx, r12
call fcn.14004b048
mov ecx, ILCombine
call fcn.14004af90
mov r12, rax
xor eax, eax
mov qword [r12], rax
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], rax
mov esi, eax
lea rdi, [0x14013ed00]
mov rbx, qword [rbp - 0x30]
nop
mov rcx, qword [rbx]
cmp rcx, rbx
je 0x1400be57d
mov eax, dword [rdi]
nop word [rax + rax]
cmp dword [rcx + 0x10], eax
je 0x1400be5d0
mov rcx, qword [rcx]
cmp rcx, rbx
jne 0x1400be570
mov eax, dword [rdi]
mov dword [rbp + 0x28], eax
mov eax, dword [rdi + 4]
mov dword [rbp + 0x2c], eax
mov dword [rbp + 0x30], ILGetSize
lea r8, [rbp + 0x28]
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.140017f40
movabs rcx, 0x1555555555555554
mov rdx, qword [rbp - 0x28]
sub rcx, rdx
cmp rcx, 1
jb 0x1400bee8c
inc rdx
mov qword [rbp - 0x28], rdx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rbx, qword [rbp - 0x30]
inc esi
add rdi, 0xc
cmp esi, 6
jb 0x1400be560
mov rcx, r12
call fcn.14004b048
mov ecx, ILCombine
call fcn.14004af90
mov r12, rax
xor eax, eax
mov qword [r12], rax
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], rax
mov esi, eax
lea rdi, [0x14013ed60]
mov rbx, qword [rbp - 0x48]
nop dword [rax]
mov rcx, qword [rbx]
cmp rcx, rbx
je 0x1400be62d
mov eax, dword [rdi]
nop word [rax + rax]
cmp dword [rcx + 0x10], eax
je 0x1400be680
mov rcx, qword [rcx]
cmp rcx, rbx
jne 0x1400be620
mov eax, dword [rdi]
mov dword [rbp + 0x38], eax
mov eax, dword [rdi + 4]
mov dword [rbp + 0x3c], eax
mov dword [rbp + 0x40], ILGetSize
lea r8, [rbp + 0x38]
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.140017f40
movabs rcx, 0x1555555555555554
mov rdx, qword [rbp - 0x40]
sub rcx, rdx
cmp rcx, 1
jb 0x1400bee7f
inc rdx
mov qword [rbp - 0x40], rdx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rbx, qword [rbp - 0x48]
inc esi
add rdi, 0xc
cmp esi, 6
jb 0x1400be610
mov rcx, r12
call fcn.14004b048
mov ecx, ILCombine
call fcn.14004af90
mov r12, rax
xor eax, eax
mov qword [r12], rax
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], rax
mov esi, eax
lea rdi, [0x14013edc0]
mov rbx, qword [rbp - 0x78]
nop dword [rax]
mov rcx, qword [rbx]
cmp rcx, rbx
je 0x1400be6dd
mov eax, dword [rdi]
nop word [rax + rax]
cmp dword [rcx + 0x10], eax
je 0x1400be733
mov rcx, qword [rcx]
cmp rcx, rbx
jne 0x1400be6d0
mov eax, dword [rdi]
mov dword [rbp + 0x78], eax
mov eax, dword [rdi + 4]
mov dword [rbp + 0x7c], eax
mov dword [rbp + 0x80], ILGetSize
lea r8, [rbp + 0x78]
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.140017f40
movabs rcx, 0x1555555555555554
mov rdx, qword [rbp - 0x70]
sub rcx, rdx
cmp rcx, 1
jb 0x1400bee72
inc rdx
mov qword [rbp - 0x70], rdx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rbx, qword [rbp - 0x78]
inc esi
add rdi, 0xc
cmp esi, 6
jb 0x1400be6c0
mov rcx, r12
call fcn.14004b048
mov ecx, reloc.SHELL32.dll_ILFindLastID
call fcn.14004af90
mov r12, rax
xor eax, eax
mov qword [r12], rax
mov qword [r12 + 8], rax
mov esi, eax
lea rdi, [0x14013ee08]
mov rbx, qword [rsp + 0x70]
nop dword [rax]
mov rcx, qword [rbx]
cmp rcx, rbx
je 0x1400be78d
mov eax, dword [rdi]
nop word [rax + rax]
cmp dword [rcx + 0x10], eax
je 0x1400be7e3
mov rcx, qword [rcx]
cmp rcx, rbx
jne 0x1400be780
mov eax, dword [rdi]
mov dword [rbp + 0x18], eax
mov eax, dword [rdi + 4]
mov dword [rbp + 0x1c], eax
mov dword [rbp + 0x20], ILGetSize
lea r8, [rbp + 0x18]
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.140017f40
movabs rcx, 0x1555555555555554
mov rdx, qword [rsp + 0x78]
sub rcx, rdx
cmp rcx, 1
jb 0x1400bee65
inc rdx
mov qword [rsp + 0x78], rdx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rbx, qword [rsp + 0x70]
inc esi
add rdi, 0xc
cmp esi, 4
jb 0x1400be770
mov rcx, r12
call fcn.14004b048
mov ecx, 8
call fcn.14004af90
mov r12, rax
mov qword [rax], 0
xor esi, esi
lea rdi, [0x14013ed48]
mov rbx, qword [rbp - 0x60]
mov rcx, qword [rbx]
cmp rcx, rbx
je 0x1400be82e
mov edx, dword [rdi]
cmp dword [rcx + 0x10], edx
je 0x1400be881
mov rcx, qword [rcx]
cmp rcx, rbx
jne 0x1400be821
mov eax, dword [rdi]
mov dword [rbp + 0x68], eax
mov eax, dword [rdi + 4]
mov dword [rbp + 0x6c], eax
mov dword [rbp + 0x70], ILGetSize
lea r8, [rbp + 0x68]
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.140017f40
movabs rcx, 0x1555555555555554
mov rdx, qword [rbp - 0x58]
sub rcx, rdx
cmp rcx, 1
jb 0x1400bee58
inc rdx
mov qword [rbp - 0x58], rdx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rbx, qword [rbp - 0x60]
inc esi
add rdi, 0xc
cmp esi, 2
jb 0x1400be817
mov rcx, r12
call fcn.14004b048
lea r11, [rbp - 0x18]
mov qword [rbp + 0x760], r11
lea rax, [rbp - 0x30]
mov qword [rbp + 0x758], rax
lea rax, [rbp - 0x60]
mov qword [rbp + 0x780], rax
lea rax, [rsp + 0x70]
mov qword [rbp + 0x778], rax
lea rax, [rbp - 0x78]
mov qword [rbp + 0x770], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x750], rax
lea rax, [rbp - 0x48]
mov qword [rbp + 0x768], rax
xor r12d, r12d
mov qword [rbp + 0x790], r12
mov dword [rbp + 0x798], r12d
mov edx, 0x104
lea rcx, [rbp + 0x79c]
lea r8, [0x140104b04]
lea rax, [rbp + 0x79c]
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400be935
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400be935
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400be911
jmp 0x1400be93a
test rdx, rdx
jne 0x1400be93e
sub rcx, 2
mov word [rcx], r12w
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x790]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Locked
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x794]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AddressLocked
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x798]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UseCustomName
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x79c]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 8]
xor r8d, r8d
lea rdx, str.CustomName
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x1400bea51
cmp dword [rbp + 8], 1
jne 0x1400bea51
lea eax, [r11 - 1]
cmp word [rbp + rax*2 + 0x79c], r12w
je 0x1400bea59
mov eax, 0x104
cmp r11d, eax
cmovb eax, r11d
mov word [rbp + rax*2 + 0x79c], r12w
jmp 0x1400bea59
mov word [rbp + 0x79c], r12w
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0x790]
lea r8, [rbp + 0x310]
mov rsi, qword [rbp + 0x10]
mov rdx, rsi
mov rcx, r13
call fcn.1400aaf90
test eax, eax
jne 0x1400bea8f
inc r14d
mov dword [rsp + 0x50], r14d
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r15d
mov dword [rsp + 0x40], r15d
mov r9d, r15d
lea r8, [0x14010a970]
mov edx, 0x80
lea rcx, [rbp + 0x9b0]
call section..text
lea r11, [rsp + 0x38]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x9b0]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov rdx, qword [rbp - 0x60]
mov rcx, qword [rdx]
mov qword [rdx], rdx
mov rdx, qword [rbp - 0x60]
mov qword [rdx + 8], rdx
mov qword [rbp - 0x58], r12
mov rdx, qword [rbp - 0x60]
cmp rcx, rdx
je 0x1400beb24
nop dword [rax + rax]
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
mov rdx, qword [rbp - 0x60]
cmp rbx, rdx
jne 0x1400beb10
mov rcx, rdx
call fcn.14004b088
nop
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x70]
mov qword [rax + 8], rax
mov qword [rsp + 0x78], r12
mov rax, qword [rsp + 0x70]
cmp rcx, rax
je 0x1400beb65
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
mov rax, qword [rsp + 0x70]
cmp rbx, rax
jne 0x1400beb50
mov rcx, rax
call fcn.14004b088
nop
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rbp - 0x78]
mov qword [rax + 8], rax
mov qword [rbp - 0x70], r12
mov rax, qword [rbp - 0x78]
cmp rcx, rax
je 0x1400beba4
nop dword [rax]
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
mov rax, qword [rbp - 0x78]
cmp rbx, rax
jne 0x1400beb90
mov rcx, rax
call fcn.14004b088
nop
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rbp - 0x48]
mov qword [rax + 8], rax
mov qword [rbp - 0x40], r12
mov rax, qword [rbp - 0x48]
cmp rcx, rax
je 0x1400bebe4
nop dword [rax]
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
mov rax, qword [rbp - 0x48]
cmp rbx, rax
jne 0x1400bebd0
mov rcx, rax
call fcn.14004b088
nop
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rbp - 0x18]
mov qword [rax + 8], rax
mov qword [rbp - 0x10], r12
mov rax, qword [rbp - 0x18]
cmp rcx, rax
je 0x1400bec24
nop dword [rax]
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
mov rax, qword [rbp - 0x18]
cmp rbx, rax
jne 0x1400bec10
mov rcx, rax
call fcn.14004b088
nop
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rbp - 0x30]
mov qword [rax + 8], rax
mov qword [rbp - 0x28], r12
mov rax, qword [rbp - 0x30]
cmp rcx, rax
je 0x1400bec64
nop dword [rax]
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
mov rax, qword [rbp - 0x30]
cmp rbx, rax
jne 0x1400bec50
mov rcx, rax
call fcn.14004b088
nop
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x58]
mov qword [rax + 8], rax
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0x58]
cmp rcx, rax
je 0x1400beca5
mov rbx, qword [rcx]
call fcn.14004b088
mov rcx, rbx
mov rax, qword [rsp + 0x58]
cmp rbx, rax
jne 0x1400bec90
mov rcx, rax
call fcn.14004b088
test edi, edi
jmp 0x1400bda42
mov qword [rbp + 0xb0], r12
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x1e0]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x1e0], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x1e0]
call fcn.14004d894
nop
mov qword [rbp + 0xc0], r12
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x290]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x290], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x290]
call fcn.14004d894
nop
mov qword [rbp + 0xd0], r12
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x210]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x210], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x210]
call fcn.14004d894
nop
mov qword [rbp + 0xe0], r12
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x2f0]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x2f0], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x2f0]
call fcn.14004d894
nop
mov qword [rbp + 0xf0], r12
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x1b0]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x1b0], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x1b0]
call fcn.14004d894
nop
mov qword [rbp + 0x100], r12
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x2c0]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x2c0], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x2c0]
call fcn.14004d894
nop
mov qword [rbp + 0xd8], r12
lea rdx, [rbp + 0xd8]
lea rcx, [rbp + 0x260]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x260], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x260]
call fcn.14004d894
int3
lea rcx, str.list_T__too_long
call fcn.14002ba2c
int3
lea rcx, str.list_T__too_long
call fcn.14002ba2c
int3
lea rcx, str.list_T__too_long
call fcn.14002ba2c
int3
lea rcx, str.list_T__too_long
call fcn.14002ba2c
int3
lea rcx, str.list_T__too_long
call fcn.14002ba2c
int3
lea rcx, str.list_T__too_long
call fcn.14002ba2c
int3
lea rcx, str.list_T__too_long
call fcn.14002ba2c
nop
mov qword [rbp + 0x88], r12
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x2d8]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x2d8], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x2d8]
call fcn.14004d894
nop
mov qword [rbp + 0xb8], r12
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x1c8]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x1c8], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x1c8]
call fcn.14004d894
nop
mov qword [rbp + 0xe8], r12
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x1f8]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x1f8], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x1f8]
call fcn.14004d894
nop
mov qword [rbp + 0xa8], r12
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x228]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x228], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x228]
call fcn.14004d894
nop
mov qword [rbp + 0xf8], r12
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x248]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x248], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x248]
call fcn.14004d894
nop
mov qword [rbp + 0x90], r12
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x278]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x278], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x278]
call fcn.14004d894
nop
mov qword [rbp + 0x98], r12
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x2a8]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x2a8], r11
lea rdx, [0x140132320]
lea rcx, [rbp + 0x2a8]
call fcn.14004d894
int3
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r14d
mov rcx, qword [rbp + 0xab0]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0xbc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rcx + 0x10]
jmp 0x1400bd970