Function at 0x140009400
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r15, r9
mov qword [rbp - 0x70], r9
mov r12, r8
mov qword [rbp + 0x58], r8
movzx ebx, byte [rbp + 0x180]
xor edi, edi
mov r14d, edi
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rax
test bl, bl
je 0x14000946e
lea r8, str.SystemCurrentControlSetControlSession_Manager
jmp 0x1400094e7
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x14000a4a7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.SystemCurrentControlSetControlSession_Manager
lea rcx, [rsp + 0x40]
call fcn.1400062d0
test al, al
jne 0x1400094bb
mov r8d, 0x30
lea rdx, str.SystemCurrentControlSetControlSession_Manager
lea rcx, [rsp + 0x40]
call fcn.1400068f0
nop
mov dword [rsp + 0x30], 1
lea r8, str.AutorunsDisabled
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x38]
call fcn.140006020
nop
mov r14d, 3
mov dword [rsp + 0x30], r14d
mov r8, qword [rax]
mov rdx, 0xffffffff80000002
mov r9d, 1
lea rcx, [rbp + 0xf0]
call fcn.140027410
nop
mov r13, 0xffffffffffffffff
test r14b, 2
je 0x14000953a
and r14d, 0xfffffffd
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009535
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r14d, dword [rsp + 0x30]
test r14b, 1
je 0x14000956d
and r14d, 0xfffffffe
mov dword [rsp + 0x30], r14d
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009568
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r14d, dword [rsp + 0x30]
test bl, bl
je 0x1400099b7
mov ecx, 0x148
call fcn.14009bfa8
mov rsi, rax
mov qword [rbp - 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_struct_AutorunsEntry_.0
mov qword [rsi], rax
lea rbx, [rsi + 0x10]
xor edx, edx
mov r8d, 0x138
mov rcx, rbx
call fcn.14009e880
mov rcx, rbx
call fcn.140007090
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
bts r14d, 7
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], rsi
mov dword [rbx + 0x118], 0x1080
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], 1
mov qword [rbp + 0x30], 7
mov eax, dword [0x1400eff20]
mov word [rbp + 0x18], ax
mov word [rbp + 0x1a], di
mov r9d, 4
lea r8, str.HKLM
lea rcx, [rbp + 0x18]
call fcn.140006ee0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
bts r14d, 8
mov r8d, 0x30
lea rdx, str.SystemCurrentControlSetControlSession_Manager
lea rcx, [rbp - 0x48]
call fcn.140006fe0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
bts r14d, 9
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rdx
lea rcx, [rsp + 0x48]
cmp rax, 1
jb 0x1400096e2
lea rax, [rdx + 1]
mov qword [rsp + 0x58], rax
cmp r8, 8
cmovae rcx, qword [rsp + 0x48]
mov eax, dword [0x1400eff20]
mov word [rcx + rdx*2], ax
mov word [rcx + rdx*2 + 2], di
lea rax, [rsp + 0x48]
jmp 0x140009702
mov qword [rsp + 0x20], 1
lea r9, [0x1400eff20]
movzx r8d, byte [rsp + 0x38]
mov edx, 1
call fcn.140007950
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
bts r14d, 0xa
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [r12 + r8*2], 0
jne 0x140009740
mov rdx, r12
lea rcx, [rbp - 0x28]
call fcn.140006fe0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
bts r14d, 0xb
mov dword [rsp + 0x30], r14d
lea rdx, [rbp + 0x60]
mov rcx, rbx
call fcn.140005f80
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x1400097cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400097c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4b2
call fcn.14009bfe4
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14000980c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009807
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4b8
call fcn.14009bfe4
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], di
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000985e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009859
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4be
call fcn.14009bfe4
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1400098b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400098ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4c4
call fcn.14009bfe4
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], di
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x140009901
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400098fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4ca
call fcn.14009bfe4
mov rdi, qword [rbp + 0xf0]
test rdi, rdi
je 0x14000991c
mov rcx, rdi
call fcn.14002d4a0
mov qword [rbx + 0xa0], rax
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x140009940
mov qword [rdx], rbx
mov qword [rdx + 8], rsi
xor eax, eax
mov r9d, eax
mov qword [rbp + 0xd0], rax
add qword [r15 + 8], 0x10
jmp 0x140009956
lea r8, [rbp + 0xc8]
mov rcx, r15
call fcn.1400071a0
mov r9, qword [rbp + 0xd0]
mov r8, qword [r15 + 8]
sub r8, qword [r15]
sar r8, 4
mov edx, 0x30
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov qword [rdx + rcx], r8
test r9, r9
je 0x1400099be
mov eax, r13d
lock xadd dword [r9 + 8], eax
cmp eax, 1
jne 0x1400099b2
mov rbx, qword [rbp + 0xd0]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400099b2
mov rcx, qword [rbp + 0xd0]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r14d, dword [rsp + 0x30]
mov rdi, qword [rbp + 0xf0]
test rdi, rdi
jne 0x1400099ca
xor bl, bl
jmp 0x14000a456
xor ecx, ecx
mov dword [rbp + 0x80], ecx
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0xe4]
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a3f6
cmp dword [rbp + 0xe4], 7
jne 0x14000a3f6
mov esi, dword [rbp + 0x80]
shr esi, 1
je 0x14000a3f6
mov ecx, esi
mov eax, 2
mul rcx
mov rbx, rax
cmovo rbx, r13
mov rcx, rbx
call fcn.14009c638
mov r15, rax
mov qword [rbp - 0x50], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14009e880
mov qword [rbp + 0x108], r15
bts r14d, 0x10
cmp esi, 2
jb 0x140009ac9
lea edx, [rsi + rsi]
mov dword [rbp + 0x84], edx
xor eax, eax
mov esi, eax
lea rax, [rbp + 0x84]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xe0]
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009ac9
cmp dword [rbp + 0xe0], 7
jne 0x140009ac9
mov ecx, dword [rbp + 0x84]
test cl, 1
jne 0x140009ac9
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x140009ac9
shr rcx, 1
cmp word [r15 + rcx*2 - 2], si
jne 0x140009ac9
cmp eax, 1
jbe 0x140009ac7
cmp word [r15 + rcx*2 - 4], si
jne 0x140009ac9
mov esi, eax
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x14000a4d0
mov rax, qword [rax]
mov r8d, 2
mov edx, esi
call qword [rax]
test rax, rax
je 0x14000a4db
lea rbx, [rax + 0x18]
mov qword [rbp + 0xe8], rbx
lea rdi, [rbx - 0x18]
mov qword [rsp + 0x68], rdi
cmp esi, dword [rdi + 0xc]
jg 0x14000a49c
mov dword [rdi + 8], esi
mov eax, esi
lea r8, [rax + rax]
xor r12d, r12d
mov word [rbx + r8], r12w
test esi, esi
je 0x140009b45
test rbx, rbx
jne 0x140009b39
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x140009b45
mov rdx, r15
mov rcx, rbx
call fcn.14009d3c0
nop
mov rcx, rdi
call fcn.140006780
add rax, 0x18
mov qword [rbp + 0xc0], rax
xor r15b, r15b
movsxd rdi, dword [rax - 0x10]
mov ecx, r12d
test edi, edi
jle 0x140009bd8
mov r8d, 0x3b
nop dword [rax]
movsxd rcx, ecx
lea rsi, [rcx + rcx]
cmp word [rsi + rax], 0
jne 0x140009bb7
test r15b, r15b
jne 0x140009bb2
mov r15b, 1
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x140009bb2
mov edx, edi
lea rcx, [rbp + 0xc0]
call fcn.140006870
mov rax, qword [rbp + 0xc0]
mov r8d, 0x3b
mov word [rsi + rax], r8w
lea rcx, [rsi + 2]
sar rcx, 1
cmp ecx, edi
jl 0x140009b70
test r15b, r15b
je 0x140009bd8
cmp edi, dword [rax - 0xc]
jg 0x14000a4e1
mov dword [rax - 0x10], edi
mov word [rax + rdi*2], r12w
xor eax, eax
mov qword [rbp + 0x88], rax
movzx edi, byte [rsp + 0x38]
nop word [rax + rax]
mov eax, r12d
lea rsi, [rbx + rax*2]
mov rax, qword [rsp + 0x68]
movsxd rax, dword [rax + 8]
lea rbx, [rbx + rax*2]
cmp rsi, rbx
jae 0x140009c65
lea rdx, [0x1400f008c]
mov rcx, rsi
call fcn.1400a32a8
mov r15, rax
movsxd rcx, eax
lea rcx, [rsi + rcx*2]
cmp rcx, rbx
jae 0x140009c65
lea rdx, [0x1400f008c]
call fcn.1400a3268
lea r8d, [r15 + r12]
lea ecx, [rax + 1]
add ecx, r8d
mov dword [rsp + 0x3c], ecx
mov r9d, eax
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0xe8]
call fcn.14000a580
mov rbx, qword [rbp + 0x88]
mov rsi, qword [rsp + 0x68]
jmp 0x140009cae
mov dword [rsp + 0x3c], r13d
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsi]
test rcx, rcx
je 0x140009c82
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140009c91
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x14000a491
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x88], rbx
or r14d, 0x20
mov dword [rsp + 0x30], r14d
lea r12, [rbx - 0x18]
mov qword [rbp + 0x50], r12
mov eax, dword [r12 + 8]
test eax, eax
je 0x14000a380
jle 0x140009e29
mov edx, 0x20
mov rcx, rbx
call fcn.14009ec30
mov rsi, rax
test rax, rax
je 0x140009e29
sub rsi, rbx
sar rsi, 1
test esi, esi
js 0x140009e29
lea r15d, [rsi + 1]
cmp r15d, dword [r12 + 8]
jge 0x140009d47
movsxd rax, esi
inc rax
lea rcx, [rbx + rax*2]
mov edx, 0x20
call fcn.14009ec30
test rax, rax
je 0x140009d47
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140009d47
sub eax, esi
lea r9d, [rax - 1]
mov r8d, r15d
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x88]
call fcn.14000a580
nop
or r14d, 8
jmp 0x140009d6f
mov r9d, dword [r12 + 8]
sub r9d, r15d
mov r8d, r15d
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x88]
call fcn.14000a580
bts r14d, 0xc
lea rax, [rbp - 0x58]
or r14d, 4
mov dword [rsp + 0x30], r14d
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.140006780
add rax, 0x18
mov qword [rbp + 0xd8], rax
test r14b, 8
je 0x140009dc4
and r14d, 0xfffffff7
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009db8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r14d, dword [rsp + 0x30]
mov rbx, qword [rbp + 0x88]
test r14b, 4
je 0x140009dfd
and r14d, 0xfffffffb
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009df1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r14d, dword [rsp + 0x30]
mov rbx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
mov qword [rbp + 0x48], rdx
cmp dword [rdx + 8], 0
jne 0x140009e6d
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009e29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov eax, r13d
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x140009e45
mov rcx, qword [r12]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
mov qword [rbp + 0x88], rax
mov r12d, dword [rsp + 0x3c]
test r12d, r12d
js 0x14000a50a
mov rbx, qword [rbp + 0xe8]
mov r14d, dword [rsp + 0x30]
jmp 0x140009bf0
call fcn.140008370
mov r15, rax
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x30], rcx
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14000a504
cmp qword [r15 + 0x18], 8
jb 0x140009ea2
mov r15, qword [r15]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
lea r13, [rcx + 1]
mov esi, 7
lea r12, [rsp + 0x70]
cmp r13, rsi
jbe 0x140009f0e
mov rsi, r13
or rsi, 7
cmp rsi, rdx
jbe 0x140009ed8
mov rsi, rdx
jmp 0x140009ee5
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
mov rdx, rsi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400037f0
mov r12, rax
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x30]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], rsi
lea rsi, [rcx + rcx]
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.14009d3c0
mov ecx, dword [0x1400eff20]
mov word [rsi + r12], cx
xor r15d, r15d
mov word [r12 + r13*2], r15w
bts r14d, 0xd
mov rax, qword [rbp + 0xd8]
mov r13, 0xffffffffffffffff
mov r8, r13
inc r8
cmp word [rax + r8*2], 0
jne 0x140009f51
mov rdx, qword [rbp + 0xd8]
lea rcx, [rsp + 0x70]
call fcn.140006fe0
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
bts r14d, 0xe
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140009ff0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009feb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4ec
call fcn.14009bfe4
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
mov rdx, qword [rbp + 0xa0]
cmp rdx, 5
jb 0x14000a08d
lea rcx, [rdx - 4]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r15
cmp rdx, rcx
jb 0x14000a4f2
sub rdx, rcx
mov r8, r13
cmp rdx, r13
cmovb r8, rdx
lea rax, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rax, qword [rbp + 0x90]
lea rdx, [rax + rcx*2]
lea rcx, [rbp - 8]
call fcn.140003860
or r14d, 0x20010
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rcx, qword [rbp - 8]
lea rdx, [0x1400f0090]
call fcn.1400b0f10
mov rdx, qword [rbp + 0xa0]
test eax, eax
jne 0x14000a08d
xor sil, sil
jmp 0x14000a090
mov sil, 1
test r14b, 0x10
je 0x14000a0e1
and r14d, 0xffffffef
mov rax, qword [rbp + 0x10]
cmp rax, 8
jb 0x14000a0e1
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a0d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4f8
call fcn.14009bfe4
mov rdx, qword [rbp + 0xa0]
test sil, sil
je 0x14000a148
mov r8, qword [rbp + 0xa8]
mov rax, r8
sub rax, rdx
lea rcx, [rbp + 0x90]
cmp rax, 4
jb 0x14000a12a
lea rax, [rdx + 4]
mov qword [rbp + 0xa0], rax
cmp r8, 8
cmovae rcx, qword [rbp + 0x90]
mov rax, qword [0x1400f0090]
mov qword [rcx + rdx*2], rax
mov word [rcx + rdx*2 + 8], r15w
jmp 0x14000a148
mov qword [rsp + 0x20], 4
lea r9, [0x1400f0090]
movzx r8d, dil
mov edx, 4
call fcn.140007950
mov ecx, 0x148
call fcn.14009bfa8
mov r15, rax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_struct_AutorunsEntry_.0
mov qword [r15], rax
lea rsi, [r15 + 0x10]
xor edx, edx
mov r8d, 0x138
mov rcx, rsi
call fcn.14009e880
mov rcx, rsi
call fcn.140007090
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
bts r14d, 0xf
mov dword [rsp + 0x30], r14d
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], r15
mov r8, r13
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14000a1c0
mov rdx, rbx
mov rcx, rsi
call fcn.140003510
movzx eax, byte [rbp + 0x180]
xor eax, 1
add eax, eax
bts eax, 0x12
mov dword [rsi + 0x118], eax
lea rcx, [rsi + 0x60]
lea rax, [rbp + 0x90]
cmp rcx, rax
je 0x14000a21f
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0xa0]
call fcn.140003510
lea rcx, [rsi + 0x80]
mov r8, r13
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14000a230
mov rdx, rbx
call fcn.140003510
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
lock inc dword [r15 + 8]
mov rbx, qword [rbp + 0xb0]
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], r15
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.1400263f0
mov rax, qword [rbp - 0x70]
mov rdx, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
je 0x14000a294
mov qword [rdx], rbx
mov qword [rdx + 8], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
add qword [rax + 8], 0x10
jmp 0x14000a2a4
lea r8, [rbp + 0xb0]
mov rcx, rax
call fcn.1400071a0
nop
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x14000a2e7
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000a2e7
mov rbx, qword [rbp + 0xb8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000a2e7
mov rcx, qword [rbp + 0xb8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x14000a32d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a328
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4fe
call fcn.14009bfe4
xor eax, eax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], ax
mov eax, r13d
mov rdx, qword [rbp + 0x48]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a363
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov eax, r13d
mov rdx, qword [rbp + 0x50]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009e45
mov rcx, qword [rdx]
jmp 0x140009e3f
mov eax, r13d
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x14000a39d
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a3bf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
lock xadd dword [rsi + 0x10], r13d
sub r13d, 1
jg 0x14000a3de
mov rax, qword [rsi]
mov rdx, qword [rax]
mov rax, qword [rdx + 8]
mov rdx, rsi
mov rcx, qword [rsi]
call rax
nop
mov rcx, qword [rbp - 0x50]
call fcn.14009bfe4
mov rdi, qword [rbp + 0xf0]
mov r15, qword [rbp - 0x70]
mov r12, qword [rbp + 0x58]
cmp byte [rbp + 0x180], 0
je 0x14000a454
mov byte [rsp + 0x20], 0
mov r9, r15
mov r8, r12
lea rdx, str.SystemCurrentControlSetControlSession_Manager
mov rcx, 0xffffffff80000002
call fcn.140009400
mov rdx, qword [r15 + 8]
mov r8d, 0x30
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rcx, qword [r8 + rcx]
shl rcx, 4
add rcx, qword [r15]
mov r8, rdx
sub r8, rcx
sar r8, 4
lea r9, [0x140023240]
call fcn.14000a910
mov bl, 1
test rdi, rdi
je 0x14000a464
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.14009c570
mov rbx, qword [rsp + 0x260]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
mov ecx, 0x80004005
call fcn.140007f00
int3
call fcn.1400068e0
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
call fcn.1400a3080
int3
call fcn.140007070
int3
call fcn.1400a3080
nop
call fcn.1400a3080
int3
call fcn.140003690
nop
mov ecx, 0x80070057
call fcn.140007f00
int3