Function at 0x1401d9680
Capabilities:
Check if file exists
Delete registry value
Move file
Persist via lnk shortcut
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f8]
sub rsp, 0x5c0
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov rsi, rdx
mov r12, rcx
call fcn.140243a84
mov ebx, 3
cmp dword [rax], 0x3e8
ja 0x1401d97d1
mov rax, qword [rdx]
mov rdx, qword [rax + 0x20]
lea rax, [rbp + 0x398]
mov qword [rbp + 0x390], rax
mov r8d, ebx
lea rcx, [rbp + 0x390]
call fcn.140008c4c
nop
mov rax, qword [rsi]
mov rdx, qword [rax + 0x28]
lea rax, [rbp + 0x308]
mov qword [rbp + 0x300], rax
mov r8d, ebx
lea rcx, [rbp + 0x300]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0x208]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
lea rdx, str._DEBUG_
call fcn.14000b410
mov rcx, rax
lea rdx, str.Startup___Enable_item
call fcn.14000b410
mov rcx, rax
lea rdx, [0x14035f1a4]
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x300]
call fcn.14000b410
mov rcx, rax
lea rdx, [0x14035f1a4]
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x390]
call fcn.14000b410
nop
lea rcx, [rbp + 0x208]
call fcn.14000aec4
nop
lea rax, [rbp + 0x308]
mov rcx, qword [rbp + 0x300]
cmp rcx, rax
je 0x1401d97b9
call fcn.1400be914
nop
lea rax, [rbp + 0x398]
mov rcx, qword [rbp + 0x390]
cmp rcx, rax
je 0x1401d97d1
call fcn.1400be914
mov edi, 0xd
call fcn.14023dfbc
or r13d, 0xffffffff
xor r15d, r15d
test al, al
je 0x1401d9afb
mov r13d, r15d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartupApproved
lea rcx, [rsp + 0x48]
call fcn.14000cb18
nop
mov rax, qword [rsi]
mov r14d, 0x1000
test dword [rax + 4], r14d
je 0x1401d98ba
lea rdx, str.Run
lea rcx, [rsp + 0x68]
call fcn.14000cb18
nop
mov rdx, qword [rsi]
cmp dword [rdx + 0x40], r15d
je 0x1401d9882
test byte [rdx + 4], 0x40
je 0x1401d9882
add rdx, 0x30
lea rcx, [rbp + 0x30]
call fcn.14022a660
nop
mov rbx, qword [rbp + 0x30]
mov rcx, rbx
call fcn.140229e90
test al, al
jne 0x1401d9867
lea r8d, [rdi - 7]
lea rdx, str.Run32
lea rcx, [rsp + 0x68]
call fcn.14000c9f8
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401d9882
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x68]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.14000c0c4
mov r13d, r14d
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401d98de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1401d98de
mov ebx, 0x2000
test dword [rax + 4], ebx
je 0x1401d98de
mov r8d, 0xe
lea rdx, str.StartupFolder
lea rcx, [rsp + 0x48]
call fcn.14000c0c4
mov r13d, ebx
mov rax, qword [rsi]
mov ecx, dword [rax + 4]
call fcn.14021eb6c
mov qword [rsp + 0x78], rax
cmp qword [r12 + 0x98], r15
jne 0x1401d9983
mov ecx, 0x50
call fcn.1400be454
mov qword [rbp - 0x28], rax
test rax, rax
je 0x1401d9919
mov rcx, rax
call fcn.1402df3f8
jmp 0x1401d991c
mov rax, r15
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400059d0
mov rdx, qword [rax]
mov rcx, qword [r12 + 0x98]
mov qword [rax], rcx
mov qword [r12 + 0x98], rdx
mov rdx, qword [r12 + 0xa0]
mov rcx, qword [rax + 8]
mov qword [r12 + 0xa0], rcx
mov qword [rax + 8], rdx
mov rbx, qword [rbp + 0xe8]
test rbx, rbx
je 0x1401d9983
lock dec dword [rbx + 8]
jne 0x1401d9983
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1401d9983
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [r12 + 0x98]
mov rdx, qword [rsi]
mov rax, qword [rcx]
add rdx, 0x38
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x78]
call qword [rax + 0x78]
mov edi, eax
test eax, eax
jne 0x1401d9acd
mov qword [rbp + 0x80], r15
mov dword [rbp + 0x88], r15d
mov qword [rbp + 0x90], r15
lea rcx, vtable.Piriform::Registry::CRegKeyEx.0
mov qword [rbp + 0x78], rcx
or ecx, 0xffffffff
mov dword [rbp + 0x98], ecx
mov dword [rbp + 0x9c], ecx
mov dword [rbp + 0xa0], r15d
mov r9d, 0xf013f
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp + 0x80]
call fcn.140010dd0
mov edi, eax
test eax, eax
jne 0x1401d9ac3
mov dword [rsp + 0x50], r15d
mov rax, qword [rsi]
lea r8, [rsp + 0x50]
mov rdx, qword [rax + 0x50]
lea rcx, [rbp + 0x78]
call fcn.140223da8
mov rbx, rax
mov qword [rbp - 0x40], rax
mov edi, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
cmp dword [rsp + 0x50], r15d
jne 0x1401d9a50
mov edx, edi
lea rcx, [rbp - 0x40]
call fcn.140063c00
xor r11d, r11d
mov rbx, qword [rbp - 0x40]
mov qword [rbx], r11
mov dword [rbx + 8], r11d
jmp 0x1401d9a58
xor eax, eax
mov qword [rbx], rax
mov dword [rbx + 8], eax
mov rax, qword [rsp + 0x78]
cmp rax, 0xffffffff80000001
je 0x1401d9a75
cmp rax, 0xffffffff80000003
je 0x1401d9a75
cmp rax, 0xffffffff80000002
jne 0x1401d9a78
mov byte [rbx], 2
mov rax, qword [rsi]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax + 0x50]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x1401d9aba
mov rax, qword [rsi]
mov byte [rax + 0x18], 1
mov rcx, qword [rsi]
not r13d
mov eax, dword [rcx + 4]
and eax, r13d
mov dword [rcx + 4], eax
mov rcx, rbx
call fcn.1400bee7c
nop
lea rcx, [rbp + 0x78]
call fcn.140224148
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or r13d, 0xffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da3b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1401da3b6
mov rax, qword [rsi]
mov r14d, 0x1000
test dword [rax + 4], r14d
je 0x1401d9f11
mov qword [rbp - 0x10], r15
mov dword [rbp - 8], r15d
mov qword [rbp], r15
lea rcx, vtable.Piriform::Registry::CRegKeyEx.0
mov qword [rbp - 0x18], rcx
or ecx, 0xffffffff
mov dword [rbp + 8], ecx
mov dword [rbp + 0xc], ecx
mov dword [rbp + 0x10], r15d
mov ebx, dword [rax + 0x40]
mov r14d, 0xf003f
or ebx, r14d
mov edx, dword [rax + 4]
lea rcx, [rbp + 0x48]
call fcn.14021ef2c
nop
lea r8, [0x140352420]
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.14001c3e0
nop
mov r8, qword [rsi]
add r8, 0x50
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140004278
mov r8, qword [rax]
mov rax, qword [rsi]
mov ecx, dword [rax + 4]
call fcn.14021eb6c
mov rdx, rax
mov r9d, ebx
lea rcx, [rbp - 0x10]
call fcn.1400114d4
mov edi, eax
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401d9bb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401d9bd3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401d9bf3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
jne 0x1401d9f08
lea rbx, [0x140330de8]
mov r9, rbx
lea r8, str.hkey
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x18]
call fcn.140224ba8
nop
mov r9, rbx
lea r8, [0x140374330]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x18]
call fcn.140224ba8
nop
mov r9, rbx
lea r8, str.command
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x18]
call fcn.140224ba8
nop
mov rax, qword [rsi]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
mov ecx, dword [rax + 4]
call fcn.1401d5450
mov r15d, eax
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.14021ec6c
mov dword [rbp - 0x28], eax
mov r13d, eax
or r13d, r14d
call fcn.1400046d0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rax + 4], 6
jne 0x1401d9ca7
call fcn.14023dffc
test al, al
jne 0x1401d9ca7
lea rcx, [rbp - 0x80]
call fcn.14023dc9c
cmp dword [rbp - 0x80], edi
cmove r13d, r14d
lea rcx, [rsp + 0x70]
call fcn.140223f08
mov qword [rbp - 0x30], rax
xor r14d, r14d
cmp qword [r12 + 0x98], r14
jne 0x1401d9d4f
lea ecx, [r14 + 0x50]
call fcn.1400be454
mov qword [rbp + 0x108], rax
test rax, rax
je 0x1401d9ce5
mov rcx, rax
call fcn.1402df3f8
jmp 0x1401d9ce8
mov rax, r14
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.1400059d0
mov rdx, qword [rax]
mov rcx, qword [r12 + 0x98]
mov qword [rax], rcx
mov qword [r12 + 0x98], rdx
mov rdx, qword [r12 + 0xa0]
mov rcx, qword [rax + 8]
mov qword [r12 + 0xa0], rcx
mov qword [rax + 8], rdx
mov rbx, qword [rbp + 0x100]
test rbx, rbx
je 0x1401d9d4f
lock dec dword [rbx + 8]
jne 0x1401d9d4f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1401d9d4f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [r12 + 0x98]
mov rdx, qword [rsi]
mov rax, qword [rcx]
add rdx, 0x38
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x30]
call qword [rax + 0x78]
mov edi, eax
test eax, eax
jne 0x1401d9e9e
mov qword [rbp + 0xa8], r14
mov dword [rbp + 0xb0], r14d
mov qword [rbp + 0xb8], r14
mov r9d, r13d
mov r8, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0xa8]
call fcn.1400114d4
mov edi, eax
mov rbx, qword [rbp + 0xa8]
test eax, eax
jne 0x1401d9e8f
cmp dword [r12 + 0x78], r14d
je 0x1401d9dec
lea r8, str._programFiles_
lea rdx, str._ProgramFiles_
lea rcx, [rsp + 0x38]
call fcn.14000b658
lea r8, str._Commonprogramfiles_
lea rdx, str._commonprogramfiles_
lea rcx, [rsp + 0x38]
call fcn.14000b658
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsi]
mov r13, qword [rax + 0x50]
mov eax, r14d
test rdi, rdi
setne al
test eax, eax
jne 0x1401d9e0d
lea edi, [rax + 0xd]
jmp 0x1401d9e8f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x1401d9e8f
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1401d9e53
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x10], r14
mov dword [rbp - 8], r14d
mov rdx, rsi
mov rcx, r12
call fcn.1401d5630
mov edi, eax
test eax, eax
mov rax, qword [rsi]
jne 0x1401d9e81
mov dword [rax + 4], r15d
mov rax, qword [rsi]
mov byte [rax + 0x18], 1
mov rax, qword [rsi]
mov ecx, dword [rbp - 0x28]
mov dword [rax + 0x40], ecx
jmp 0x1401d9e8f
mov rdx, qword [rax + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
test rbx, rbx
je 0x1401d9e9e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or r13d, 0xffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401d9ec4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401d9ee6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401d9f08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x18]
jmp 0x1401da3b1
mov ebx, 0x2000
test dword [rax + 4], ebx
je 0x1401da3be
mov qword [rbp - 0x68], r15
mov dword [rbp - 0x60], r15d
mov qword [rbp - 0x58], r15
lea rcx, vtable.Piriform::Registry::CRegKeyEx.0
mov qword [rbp - 0x70], rcx
or ecx, 0xffffffff
mov dword [rbp - 0x50], ecx
mov dword [rbp - 0x4c], ecx
mov dword [rbp - 0x48], r15d
mov ebx, dword [rax + 0x40]
mov r14d, 0xf003f
or ebx, r14d
mov edx, dword [rax + 4]
lea rcx, [rbp + 0x40]
call fcn.14021ef2c
nop
lea r8, [0x140352420]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.14001c3e0
nop
mov r8, qword [rsi]
add r8, 0x50
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140004278
mov r8, qword [rax]
mov rax, qword [rsi]
mov ecx, dword [rax + 4]
call fcn.14021eb6c
mov rdx, rax
mov r9d, ebx
lea rcx, [rbp - 0x68]
call fcn.1400114d4
mov edi, eax
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401d9fc3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401d9fe4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da004
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
jne 0x1401da3ad
lea rbx, [0x140330de8]
mov r9, rbx
lea r8, [0x140369ea8]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.140224ba8
nop
mov r9, rbx
lea r8, str.backup
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x70]
call fcn.140224ba8
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r9, rbx
lea rcx, [rbp - 0x70]
cmp byte [r12 + 0x74], r15b
je 0x1401da0f1
lea r8, str.backupExtension
lea rdx, [rbp + 0x58]
call fcn.140224ba8
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000c244
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da0c5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9, rbx
lea r8, str.location
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.140224ba8
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14000c244
nop
mov rdx, qword [rbp + 0x50]
jmp 0x1401da154
lea r8, str.location
lea rdx, [rbp + 0x20]
call fcn.140224ba8
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000c244
nop
mov rdx, qword [rbp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da130
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
lea rcx, [rbp + 0x28]
call fcn.1401d4b90
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14000c244
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da170
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x58]
call fcn.140222df8
mov edi, eax
test eax, eax
jne 0x1401da326
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1401da2a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 2
jne 0x1401da29a
lea rdx, [0x140369320]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1401da326
mov r9, rbx
lea r8, str.command
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x70]
call fcn.140224ba8
nop
mov r9, rbx
lea r8, str.item
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.140224ba8
nop
lea rcx, [rbp + 0xc0]
call fcn.140234fbc
nop
mov r9, qword [rsp + 0x30]
mov r8, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp + 0xc0]
call fcn.1402355ec
test eax, eax
cmovns edi, r15d
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1401da234
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x1401da246
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x1401da259
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da27a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da29a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
jne 0x1401da326
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1401da2b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x68], r15
mov dword [rbp - 0x60], r15d
mov rdx, rsi
mov rcx, r12
call fcn.1401d5630
mov edi, eax
test eax, eax
jne 0x1401da316
mov rbx, qword [rsi]
lea rcx, [rsp + 0x60]
call fcn.14021ebfc
mov dword [rbx + 4], eax
mov rcx, qword [rsi]
add rcx, 0x50
lea r8, [0x140352420]
lea rdx, [0x1403743dc]
call fcn.14000b658
mov rcx, qword [rsi]
add rcx, 0x58
lea rdx, [rsp + 0x30]
call fcn.14000c244
mov r11, qword [rsi]
mov byte [r11 + 0x18], 1
mov rax, qword [rsi]
mov dword [rax + 0x40], r15d
jmp 0x1401da326
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da348
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da36a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da38b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da3ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.140224148
test edi, edi
je 0x1401da4a2
call fcn.140243a84
cmp dword [rax], 0x3e8
ja 0x1401da4a2
mov edx, edi
lea rcx, [rbp + 0x38]
call fcn.14023e59c
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x428]
mov qword [rbp + 0x420], rax
mov r8d, 3
lea rcx, [rbp + 0x420]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0x110]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
lea rdx, str._DEBUG_
call fcn.14000b410
mov rcx, rax
lea rdx, str.Startup___Enable_item_error:
call fcn.14000b410
mov rcx, rax
mov edx, edi
call fcn.14004c8c4
mov rcx, rax
lea rdx, [0x1403590a8]
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x420]
call fcn.14000b410
nop
lea rcx, [rbp + 0x110]
call fcn.14000aec4
nop
lea rax, [rbp + 0x428]
mov rcx, qword [rbp + 0x420]
cmp rcx, rax
je 0x1401da482
call fcn.1400be914
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401da4a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x610]
add rsp, 0x5c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret