Function at 0x140004310
Capabilities:
Get file size
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xd08]
sub rsp, 0xde0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xc70], rax
xor r14d, r14d
mov qword [rbp + 0x968], r14
mov dword [rbp + 0x9c8], pe_nt_image_headers64
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xa70]
call fcn.14001eee0
movabs rax, 0x19d111e40172b1e1
mov qword [rsp + 0x60], rax
movabs rax, 0x610bc955d2d55bb
mov qword [rsp + 0x68], rax
movabs rax, 0x91279ba79bdf5f
mov qword [rsp + 0x70], rax
movabs rax, 0x5ab108eaa62b4d9
mov qword [rsp + 0x78], rax
movabs rax, 0xfd4679bb775e7e3
mov qword [rbp - 0x80], rax
movabs rax, 0x4bb5102b72c4fcd
mov qword [rbp - 0x78], rax
movabs rax, 0x7e72fd2d3123937
mov qword [rbp - 0x70], rax
movabs rax, 0x3dfe4de970ec04e
mov qword [rbp - 0x68], rax
movabs rdx, 0x1fffffffe0000000
mov qword [rbp - 0x60], rdx
movabs rcx, 0xe000000020001b88
mov qword [rbp - 0x58], rcx
movabs rax, 0x198511b7012bb1b2
mov qword [rbp], rax
movabs rax, 0x653bcc95d6055fe
mov qword [rbp + 8], rax
movabs rax, 0xf427e9a7e9df2a
mov qword [rbp + 0x10], rax
movabs rax, 0x5c410cdaa16b4b7
mov qword [rbp + 0x18], rax
movabs rax, 0xfbb67e9b701e78d
mov qword [rbp + 0x20], rax
movabs rax, 0x4cf5167b77f4fa1
mov qword [rbp + 0x28], rax
movabs rax, 0x7892fbdd351396b
mov qword [rbp + 0x30], rax
movabs rax, 0x3b3e4b1977cc03a
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x48], rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
xorps xmm5, xmm5
xorps xmm6, xmm6
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x490], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x4a0], xmm0
movdqa xmmword [rbp + 0x4b0], xmm2
movdqa xmmword [rbp + 0x4c0], xmm3
movdqa xmmword [rbp + 0x4d0], xmm4
movdqa xmmword [rbp + 0x4e0], xmm5
movdqa xmmword [rbp + 0x4f0], xmm6
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
mov r12d, 8
mov edx, r12d
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140004540
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
lea r8, [rbp + 0x968]
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004796
movabs rax, 0xdc65491cebb7f26
mov qword [rsp + 0x60], rax
movabs rax, 0x5f19ce1b339138
mov qword [rsp + 0x68], rax
movabs rax, 0x416dd4add49a01c
mov qword [rsp + 0x70], rax
movabs rax, 0xd37077901513810
mov qword [rsp + 0x78], rax
movabs rax, 0x2efb2e02b
mov qword [rbp - 0x80], rax
movabs rcx, 0x4fd885d9526
mov qword [rbp - 0x78], rcx
movabs rax, 0xdab54e3ced27f60
mov qword [rbp - 0x40], rax
movabs rax, 0x3a19bc1b52914f
mov qword [rbp - 0x38], rax
movabs rax, 0x462dd25dd26a05e
mov qword [rbp - 0x30], rax
movabs rax, 0xd5e070f01343854
mov qword [rbp - 0x28], rax
movabs rax, 0x2efd7e048
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmmword [rbp + 0x490], xmm2
movdqa xmmword [rbp + 0x4a0], xmm3
movdqa xmmword [rbp + 0x4b0], xmm4
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
mov edi, 4
mov edx, edi
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x1400046d0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
lea rax, [rbp + 0x9c8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 2
lea r8, [rsp + 0x60]
mov rcx, qword [rbp + 0x968]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400047e6
mov rcx, qword [rbp + 0x968]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rbp + 0xc70]
xor rcx, rsp
call fcn.140007b20
lea r11, [rsp + 0xde0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movabs rax, 0x1720dc037c04771f
mov qword [rsp + 0x60], rax
movabs rax, 0x16d6592237100fc1
mov qword [rsp + 0x68], rax
movabs rax, 0x14e82b929e3ceb1e
mov qword [rsp + 0x70], rax
movabs rax, 0x4bd74dd0b26fa68
mov qword [rsp + 0x78], rax
movabs rax, 0x1ce88d5a4c061d58
mov qword [rbp - 0x80], rax
movabs rax, 0x1af65d11bffc93a0
mov qword [rbp - 0x78], rax
movabs rax, 0x177cdc3c7c3b7743
mov qword [rbp - 0x40], rax
movabs rax, 0x1694596d375c0f86
mov qword [rbp - 0x38], rax
movabs rax, 0x14a72bc09e70eb5f
mov qword [rbp - 0x30], rax
movabs rax, 0x4fc74810b72fa27
mov qword [rbp - 0x28], rax
movabs rax, 0x1c898d144c651d2a
mov qword [rbp - 0x20], rax
movabs rax, 0x1af65d4dbf9993cd
mov qword [rbp - 0x18], rax
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmmword [rbp + 0x490], xmm2
movdqa xmmword [rbp + 0x4a0], xmm3
movdqa xmmword [rbp + 0x4b0], xmm4
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
mov edx, 6
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140004900
xorps xmm0, xmm0
movups xmmword [rbp + 0x9a8], xmm0
mov qword [rbp + 0x9b8], r14
mov qword [rbp + 0x9c0], r14
lea rax, [rsp + 0x60]
mov rsi, 0xffffffffffffffff
mov rbx, rsi
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x140004980
movabs r13, 0x7ffffffffffffffe
cmp rbx, r13
ja 0x140006171
mov r15d, 0xa
cmp rbx, 7
ja 0x1400049e0
mov qword [rbp + 0x9b8], rbx
mov qword [rbp + 0x9c0], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x9a8]
call fcn.14001f2a0
mov word [rbp + rbx + 0x9a8], r14w
jmp 0x140004a8e
mov rax, rbx
or rax, 7
cmp rax, r13
jbe 0x1400049fc
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140004a22
cmp rax, r15
cmovb rax, r15
mov r13, rax
lea rcx, [rax + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000616b
add rcx, rcx
je 0x140004a5f
cmp rcx, 0x1000
jb 0x140004a57
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000616b
mov rcx, rax
call fcn.140007de8
test rax, rax
je 0x140006165
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140004a5f
call fcn.140007de8
mov r14, rax
mov qword [rbp + 0x9a8], r14
mov qword [rbp + 0x9b8], rbx
mov qword [rbp + 0x9c0], r13
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.14001f2a0
xor eax, eax
mov word [r14 + rbx], ax
lea rax, [rbp + 0xa70]
mov r14, rsi
nop dword [rax + rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x140004aa0
mov r13, qword [rbp + 0x9b8]
mov rcx, qword [rbp + 0x9c0]
mov rax, rcx
sub rax, r13
cmp r14, rax
ja 0x140004b04
lea rax, [r14 + r13]
mov qword [rbp + 0x9b8], rax
lea rbx, [rbp + 0x9a8]
cmp rcx, 7
cmova rbx, qword [rbp + 0x9a8]
lea rcx, [rbx + r13*2]
lea r8, [r14 + r14]
lea rdx, [rbp + 0xa70]
call fcn.14001f2a0
lea rax, [r14 + r13]
xor r13d, r13d
mov word [rbx + rax*2], r13w
jmp 0x140004b22
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0xa70]
mov rdx, r14
lea rcx, [rbp + 0x9a8]
call fcn.1400074d0
xor r13d, r13d
lea rdx, [rbp + 0x9a8]
lea rcx, [rbp + 0xa10]
call fcn.1400073a0
nop
movabs rax, 0x1b21a4f99d97c771
mov qword [rsp + 0x60], rax
movabs rax, 0x101ad9b6d0820084
mov qword [rsp + 0x68], rax
movabs rax, 0x13c6b150f3c6a9eb
mov qword [rsp + 0x70], rax
movabs rax, 0x1ec35385f26c1f17
mov qword [rsp + 0x78], rax
movabs rax, 0x774d8b393c693c3
mov qword [rbp - 0x80], rax
movabs rax, 0x1dd51a88f2934b02
mov qword [rbp - 0x78], rax
movabs rax, 0xedb514e98b184fe
mov qword [rbp - 0x70], rax
movabs rax, 0x12e57a5f3bfef8f4
mov qword [rbp - 0x68], rax
movabs rdx, 0x1fffffffe0000000
mov qword [rbp - 0x60], rdx
movabs rcx, 0xe000000020001f44
mov qword [rbp - 0x58], rcx
movabs rax, 0x1b68a4bf9dd2c72d
mov qword [rbp], rax
movabs rax, 0x1079d9dfd0cf00d8
mov qword [rbp + 8], rax
movabs rax, 0x13a9b123f3a9a999
mov qword [rbp + 0x10], rax
movabs rax, 0x1e8153d9f2181f71
mov qword [rbp + 0x18], rax
movabs rax, 0x728d8c793a993ac
mov qword [rbp + 0x20], rax
movabs rax, 0x1da11ae7f2fc4b60
mov qword [rbp + 0x28], rax
movabs rax, 0xeac512898d68493
mov qword [rbp + 0x30], rax
movabs rax, 0x128c7a393b9bf8da
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x48], rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
xorps xmm5, xmm5
xorps xmm6, xmm6
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x490], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x4a0], xmm0
movdqa xmmword [rbp + 0x4b0], xmm2
movdqa xmmword [rbp + 0x4c0], xmm3
movdqa xmmword [rbp + 0x4d0], xmm4
movdqa xmmword [rbp + 0x4e0], xmm5
movdqa xmmword [rbp + 0x4f0], xmm6
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub r12, 1
jne 0x140004ce0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
lea rax, [rsp + 0x60]
mov r14, rsi
nop dword [rax + rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x140004d50
mov r12, qword [rbp + 0xa20]
mov rcx, qword [rbp + 0xa28]
mov rax, rcx
sub rax, r12
cmp r14, rax
ja 0x140004daf
lea rax, [r12 + r14]
mov qword [rbp + 0xa20], rax
lea rbx, [rbp + 0xa10]
cmp rcx, 7
cmova rbx, qword [rbp + 0xa10]
lea rcx, [rbx + r12*2]
lea r8, [r14 + r14]
lea rdx, [rsp + 0x60]
call fcn.14001f2a0
lea rax, [r12 + r14]
mov word [rbx + rax*2], r13w
jmp 0x140004dc8
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x60]
mov rdx, r14
lea rcx, [rbp + 0xa10]
call fcn.1400074d0
lea rdx, [rbp + 0x9a8]
lea rcx, [rbp + 0x9f0]
call fcn.1400073a0
nop
movabs rax, 0xfcbda1b12e0f928
mov qword [rsp + 0x60], rax
movabs rax, 0x1b8124b45b6cd394
mov qword [rsp + 0x68], rax
movabs rax, 0x28a5f75a28a5837
mov qword [rsp + 0x70], rax
movabs rax, 0x23e16c3b5815dc3
mov qword [rsp + 0x78], rax
movabs rax, 0x192bc6b0828a4287
mov qword [rbp - 0x80], rax
movabs rax, 0xb01dc7f5b689c3
mov qword [rbp - 0x78], rax
movabs rax, 0x1c61017808b33411
mov qword [rbp - 0x70], rax
movabs rax, 0x16cf3da8bf4d3cd7
mov qword [rbp - 0x68], rax
movabs rax, 0xbc75d51848b0c94
mov qword [rbp - 0x60], rax
movabs rax, 0x134fe0df42eb5a6f
mov qword [rbp - 0x58], rax
xorps xmm10, xmm10
movabs rax, 0xf82da5d12a5f974
mov qword [rbp], rax
movabs rax, 0x1be224dd5b21d3c8
mov qword [rbp + 8], rax
movabs rax, 0x2e55f06a2e55845
mov qword [rbp + 0x10], rax
movabs rax, 0x27c169fb5f55da5
mov qword [rbp + 0x18], rax
movabs rax, 0x1977c6c482e542e8
mov qword [rbp + 0x20], rax
movabs rax, 0xc41da8f5d989a1
mov qword [rbp + 0x28], rax
movabs rax, 0x1c16011e08d4347c
mov qword [rbp + 0x30], rax
movabs rax, 0x16a63dcebf283cf9
mov qword [rbp + 0x38], rax
movabs rax, 0xba45d3084e90cba
mov qword [rbp + 0x40], rax
movabs rax, 0x134fe0af429e5a04
mov qword [rbp + 0x48], rax
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
xorps xmm6, xmm6
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x490], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x4a0], xmm0
movdqa xmmword [rbp + 0x4b0], xmm2
movdqa xmmword [rbp + 0x4c0], xmm3
movdqa xmmword [rbp + 0x4d0], xmm4
movdqa xmmword [rbp + 0x4e0], xmm10
movdqa xmmword [rbp + 0x4f0], xmm6
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub r15, 1
jne 0x140004fa0
lea rax, [rsp + 0x60]
mov r14, rsi
nop word [rax + rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x140005000
mov r15, qword [rbp + 0xa00]
mov rcx, qword [rbp + 0xa08]
mov rax, rcx
sub rax, r15
cmp r14, rax
ja 0x14000505f
lea rax, [r15 + r14]
mov qword [rbp + 0xa00], rax
lea rbx, [rbp + 0x9f0]
cmp rcx, 7
cmova rbx, qword [rbp + 0x9f0]
lea rcx, [rbx + r15*2]
lea r8, [r14 + r14]
lea rdx, [rsp + 0x60]
call fcn.14001f2a0
lea rax, [r15 + r14]
mov word [rbx + rax*2], r13w
jmp 0x140005078
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x60]
mov rdx, r14
lea rcx, [rbp + 0x9f0]
call fcn.1400074d0
mov qword [rbp + 0x960], rsi
mov qword [rbp + 0x970], rsi
mov dword [rbp + 0x9d4], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0xa38], xmm0
mov dword [rbp + 0x97c], r13d
mov dword [rbp + 0x994], r13d
movups xmmword [rbp + 0x9e0], xmm0
lea rcx, [rbp + 0xa10]
mov r15d, 0xfffc
cmp qword [rbp + 0xa28], 7
jbe 0x1400050d7
mov rcx, qword [rbp + 0xa10]
test rcx, rcx
jne 0x1400050d7
mov dword [rbp + 0x9d0], ecx
jmp 0x140005106
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400050e0
add rax, rax
cmp rax, r15
cmova rax, r15
mov word [rbp + 0x9d0], ax
add ax, 2
mov word [rbp + 0x9d2], ax
mov qword [rbp + 0x9d8], rcx
mov dword [rbp + 0x978], 0x30
mov qword [rbp + 0x980], r13
mov dword [rbp + 0x990], 0x40
lea rax, [rbp + 0x9d0]
mov qword [rbp + 0x988], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x998], xmm0
mov dword [rsp + 0x28], 0x4462
mov dword [rsp + 0x20], 3
lea r9, [rbp + 0x9e0]
lea r8, [rbp + 0x978]
mov edx, 0x12019f
lea rcx, [rbp + 0x960]
call fcn.1400079dc
test eax, eax
jns 0x1400052a3
mov rcx, qword [rbp + 0x968]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0xc8689fa70c2a227
mov qword [rsp + 0x60], rax
movabs rax, 0xae395bd227ee02e
mov qword [rsp + 0x68], rax
movabs rax, 0x1d842fe23aabe3e
mov qword [rsp + 0x70], rax
movabs rax, 0x4a33cb370a4c183c
mov qword [rsp + 0x78], rax
movabs rax, 0x62e3f9b5509f8f7c
mov qword [rbp - 0x60], rax
movabs rax, 0x6b80fcc94b0ca30e
mov qword [rbp - 0x58], rax
movabs rax, 0x44f827924aec9e52
mov qword [rbp - 0x50], rax
movabs rax, 0x4a39ea1678236a4e
mov qword [rbp - 0x48], rax
xorps xmm2, xmm2
xorps xmm3, xmm3
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmmword [rbp + 0x480], xmm2
movdqa xmmword [rbp + 0x490], xmm3
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
nop
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdi, 1
jne 0x140005240
lea rcx, [rsp + 0x60]
call fcn.140001010
xor bl, bl
jmp 0x14000605b
xor edx, edx
mov rcx, qword [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov rcx, qword [rbp + 0x960]
test eax, eax
jne 0x1400053f3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x968]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0x137c35e44f30efef
mov qword [rsp + 0x60], rax
movabs rax, 0x89004ff9f32e711
mov qword [rsp + 0x68], rax
movabs rax, 0x9b476e3086e7429
mov qword [rsp + 0x70], rax
movabs rax, 0x4190e8f598f9fd3c
mov qword [rsp + 0x78], rax
movabs rax, 0x671547a76f6dc2b4
mov qword [rbp - 0x60], rax
movabs rax, 0x64f942dff3538478
mov qword [rbp - 0x58], rax
movabs rax, 0x4c941399613d544c
mov qword [rbp - 0x50], rax
movabs rax, 0x419ac9d4ea968f4e
mov qword [rbp - 0x48], rax
xorps xmm2, xmm2
xorps xmm3, xmm3
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmmword [rbp + 0x480], xmm2
movdqa xmmword [rbp + 0x490], xmm3
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdi, 1
jne 0x140005390
lea rcx, [rsp + 0x60]
call fcn.140001010
xor bl, bl
jmp 0x14000605b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xa48], xmm0
movups xmmword [rbp + 0xa58], xmm0
mov qword [rbp + 0xa68], rax
mov dword [rbp + 0xa68], 0x80
mov dword [rsp + 0x20], edi
mov r9d, 0x28
lea r8, [rbp + 0xa48]
lea rdx, [rbp + 0x9e0]
call fcn.1400079d1
test eax, eax
jns 0x1400055e1
mov rcx, qword [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x968]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0x42e49f6b38778eb
mov qword [rsp + 0x60], rax
movabs rax, 0xdfb525c29c7af41
mov qword [rsp + 0x68], rax
movabs rax, 0xcee5aa7b689962d
mov qword [rsp + 0x70], rax
movabs rax, 0xef26e3d13390fe3
mov qword [rsp + 0x78], rax
movabs rax, 0x1fffffffe36d75ca
mov qword [rbp - 0x80], rax
movabs rcx, 0xd15c16fa6
mov qword [rbp - 0x78], rcx
movabs rax, 0x70473bb593da55b0
mov qword [rbp - 0x40], rax
movabs rax, 0x6192147c45a6cc28
mov qword [rbp - 0x38], rax
movabs rax, 0x6e8728d3c2c8b648
mov qword [rbp - 0x30], rax
movabs rax, 0x7c9d1c4f56197b96
mov qword [rbp - 0x28], rax
movabs rax, 0x1fffffffe36754eb
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmmword [rbp + 0x490], xmm2
movdqa xmmword [rbp + 0x4a0], xmm3
movdqa xmmword [rbp + 0x4b0], xmm4
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdi, 1
jne 0x140005560
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
lea rcx, [rsp + 0x60]
call fcn.140001010
xor bl, bl
jmp 0x14000605b
lea ecx, [rbx + 0x100]
call fcn.140007e2c
mov r14, rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x9e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x960]
call fcn.1400079e7
test eax, eax
jns 0x1400057a7
mov rcx, qword [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x968]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0xc4070d7bca40248
mov qword [rsp + 0x60], rax
movabs rax, 0x1a0e8953070788d3
mov qword [rsp + 0x68], rax
movabs rax, 0xb1cffd9abd71d07
mov qword [rsp + 0x70], rax
movabs rax, 0x27930b55e7dc5c7b
mov qword [rsp + 0x78], rax
movabs rax, 0x81264a730ced
mov qword [rbp - 0x80], rax
movabs rcx, 0x12f83a3c1a81ca25
mov qword [rbp - 0x78], rcx
movabs rax, 0x782902949cf92f13
mov qword [rbp - 0x40], rax
movabs rax, 0x7667cf736b66ebba
mov qword [rbp - 0x38], rax
movabs rax, 0x493c9bb8ce853d62
mov qword [rbp - 0x30], rax
movabs rax, 0x55d62b2592b73f1a
mov qword [rbp - 0x28], rax
movabs rax, 0x8b076b01639f
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmmword [rbp + 0x490], xmm2
movdqa xmmword [rbp + 0x4a0], xmm3
movdqa xmmword [rbp + 0x4b0], xmm4
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdi, 1
jne 0x140005750
jmp 0x140005ff2
mov qword [rbp + 0xa30], r13
lea rax, [rbp + 0x9f0]
cmp qword [rbp + 0xa08], 7
jbe 0x1400057d0
mov rax, qword [rbp + 0x9f0]
test rax, rax
je 0x1400057f6
nop dword [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400057d0
add rsi, rsi
cmp rsi, r15
cmova rsi, r15
mov word [rbp + 0xa38], si
add si, 2
mov word [rbp + 0xa3a], si
mov qword [rbp + 0xa40], rax
mov dword [rbp + 0x978], 0x30
mov qword [rbp + 0x980], r13
mov dword [rbp + 0x990], 0x40
lea rax, [rbp + 0xa38]
mov qword [rbp + 0x988], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x998], xmm0
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x4462
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x9e0]
lea r8, [rbp + 0x978]
mov edx, 0x12019f
lea rcx, [rbp + 0x970]
call fcn.1400079bb
mov esi, eax
test eax, eax
jns 0x140005a29
mov rcx, qword [rbp + 0x968]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xc0000035
je 0x140005c10
movabs rax, 0x1fd41c73e446ff98
mov qword [rsp + 0x60], rax
movabs rax, 0x43176b9df03ee1d
mov qword [rsp + 0x68], rax
movabs rax, 0xe12ac2a7c741110
mov qword [rsp + 0x70], rax
movabs rax, 0x56393592e434f3ee
mov qword [rsp + 0x78], rax
movabs rax, 0xde50964c2a97f84
mov qword [rbp - 0x80], rax
movabs rcx, 0x1d20d40281d287c6
mov qword [rbp - 0x78], rcx
movabs rax, 0x6bbd6e30c41bd2c3
mov qword [rbp - 0x40], rax
movabs rax, 0x68583099b3628d74
mov qword [rbp - 0x38], rax
movabs rax, 0x6b66cd4f0e373175
mov qword [rbp - 0x30], rax
movabs rax, 0x764940f98755b1ce
mov qword [rbp - 0x28], rax
movabs rax, 0x7c42816addb0dc1
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmmword [rbp + 0x490], xmm2
movdqa xmmword [rbp + 0x4a0], xmm3
movdqa xmmword [rbp + 0x4b0], xmm4
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
mov edx, 5
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x1400059c0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x60]
call fcn.140001010
xor bl, bl
jmp 0x140006052
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0xa30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x9e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x970]
call fcn.1400079f2
test eax, eax
jns 0x140005c03
mov rcx, qword [rbp + 0x968]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x1f135eceaca92e3f
mov qword [rsp + 0x60], rax
movabs rax, 0x1eaceb47004083f7
mov qword [rsp + 0x68], rax
movabs rax, 0x17bc3f135990d720
mov qword [rsp + 0x70], rax
movabs rax, 0x7682e054c62beca6
mov qword [rsp + 0x78], rax
movabs rax, 0xd8d533f7a1a9d85
mov qword [rbp - 0x80], rax
movabs rcx, 0x2e3d056ca37e59c
mov qword [rbp - 0x78], rcx
movabs rax, 0x6b7a2c8d8cf40364
mov qword [rbp - 0x40], rax
movabs rax, 0x72c5ad676c21e09e
mov qword [rbp - 0x38], rax
movabs rax, 0x37d94b7a2bc7f745
mov qword [rbp - 0x30], rax
movabs rax, 0x33a29021ad488de4
mov qword [rbp - 0x28], rax
movabs rax, 0xd87721e0875eff7
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmmword [rbp + 0x490], xmm2
movdqa xmmword [rbp + 0x4a0], xmm3
movdqa xmmword [rbp + 0x4b0], xmm4
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
mov edx, 5
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140005ba0
lea rcx, [rsp + 0x60]
call fcn.140001010
xor bl, bl
jmp 0x140006052
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x978], 0x30
mov qword [rbp + 0x980], r13
mov dword [rbp + 0x990], 0x40
lea rax, [rbp + 0x9d0]
mov qword [rbp + 0x988], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x998], xmm0
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x4462
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x9e0]
lea r8, [rbp + 0x978]
mov edx, 0x12019f
lea rcx, [rbp + 0x960]
call fcn.1400079bb
test eax, eax
jns 0x140005e33
mov rcx, qword [rbp + 0x968]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0x754711f26a9d25f
mov qword [rsp + 0x60], rax
movabs rax, 0x1a6e075de6772b11
mov qword [rsp + 0x68], rax
movabs rax, 0x102f99a9d11f5db9
mov qword [rsp + 0x70], rax
movabs rax, 0x2687c8e2069cbcce
mov qword [rsp + 0x78], rax
movabs rax, 0x1ddbe937d3c4bb4b
mov qword [rbp - 0x80], rax
movabs rcx, 0xa6dffe0460f0c01
mov qword [rbp - 0x78], rcx
movabs rax, 0x733d035c06f4ff04
mov qword [rbp - 0x40], rax
movabs rax, 0x7607417d8a164878
mov qword [rbp - 0x38], rax
movabs rax, 0x755bf8cca35c7ddc
mov qword [rbp - 0x30], rax
movabs rax, 0x63a7ac8e6fe9feee
mov qword [rbp - 0x28], rax
movabs rax, 0x1dd1c816a1abc939
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmmword [rbp + 0x490], xmm2
movdqa xmmword [rbp + 0x4a0], xmm3
movdqa xmmword [rbp + 0x4b0], xmm4
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
mov edx, 5
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140005dd0
lea rcx, [rsp + 0x60]
call fcn.140001010
xor bl, bl
jmp 0x140006052
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0xa30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x18400
lea rax, [0x14002da70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x9e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x960]
call fcn.1400079f2
test eax, eax
jns 0x140006036
mov rcx, qword [rbp + 0x968]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x660bc25098ba5ef
mov qword [rsp + 0x60], rax
movabs rax, 0xfe2a9b9efc3f311
mov qword [rsp + 0x68], rax
movabs rax, 0x1f5be660d0d9be29
mov qword [rsp + 0x70], rax
movabs rax, 0x43f44733bfcba20c
mov qword [rsp + 0x78], rax
movabs rax, 0x1ab18ea430efcb
mov qword [rbp - 0x80], rax
movabs rcx, 0x12b55d9a02156731
mov qword [rbp - 0x78], rcx
movabs rax, 0x7209ce6629d688b4
mov qword [rbp - 0x40], rax
movabs rax, 0x638bef9983a29078
mov qword [rbp - 0x38], rax
movabs rax, 0x3f3e9209a28e9e4c
mov qword [rbp - 0x30], rax
movabs rax, 0x31b16757d3a2d74e
mov qword [rbp - 0x28], rax
movabs rax, 0x1abbaf854280b9
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm4, xmm4
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x470], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x480], xmm0
movdqa xmmword [rbp + 0x490], xmm2
movdqa xmmword [rbp + 0x4a0], xmm3
movdqa xmmword [rbp + 0x4b0], xmm4
lea rax, [rsp + 0x60]
lea rcx, [rbp + 0x460]
nop
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdi, 1
jne 0x140005fa0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140001010
xor bl, bl
jmp 0x140006052
mov rcx, qword [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rcx, r14
call fcn.140007b40
nop
mov rdx, qword [rbp + 0xa08]
cmp rdx, 7
jbe 0x1400060a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x9f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000609c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006177
call fcn.140007b40
mov qword [rbp + 0xa00], r13
mov qword [rbp + 0xa08], 7
mov word [rbp + 0x9f0], r13w
mov rdx, qword [rbp + 0xa28]
cmp rdx, 7
jbe 0x140006101
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000617d
call fcn.140007b40
mov qword [rbp + 0xa20], r13
mov qword [rbp + 0xa28], 7
mov word [rbp + 0xa10], r13w
mov rdx, qword [rbp + 0x9c0]
cmp rdx, 7
jbe 0x14000615d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x9a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006158
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006165
call fcn.140007b40
movzx eax, bl
jmp 0x140004798
call fcn.14000fb10
int3
call fcn.140001160
int3
call fcn.140001200
nop
call fcn.14000fb10
nop
call fcn.14000fb10
int3