Function at 0x140069f80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x412b0]
mov eax, 0x413b0
call fcn.140216080
sub rsp, rax
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x412a0], rax
mov rsi, r8
mov qword [rbp - 0x40], r8
mov rdi, rdx
mov qword [rbp - 0x20], rdx
mov r14, rcx
mov qword [rbp - 0x60], rcx
mov qword [rbp + 0x5b8], rdx
mov qword [rbp + 0x5c0], r8
xor ebx, ebx
mov r12d, ebx
mov dword [rbp - 0x64], ebx
xor edx, edx
mov r8d, 0x20000
lea rcx, [rbp + 0x212a0]
call fcn.140241ba0
xor edx, edx
mov r8d, 0x20000
lea rcx, [rbp + 0x12a0]
call fcn.140241ba0
mov eax, dword [r14 + 0x3e4]
mov ecx, 0x20119
mov edx, 0x20219
test eax, eax
cmove ecx, edx
mov dword [rbp - 0x68], ecx
mov ecx, ebx
setne cl
inc ecx
mov dword [rbp - 0x80], ecx
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fd3d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
lea rbx, [0x1402f2708]
mov r13, 0xffffffffffffffff
mov r15d, 0x10000
cmp rbx, r15
jae 0x14006a072
movzx edx, bx
lea rcx, [rbp - 0x78]
call fcn.14000d610
jmp 0x14006a08f
mov rax, r13
inc rax
cmp word [rbx + rax*2], 0
jne 0x14006a075
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.14000df90
nop
mov rdx, qword [rsi]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x78]
call fcn.1400157c0
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fd48
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rcx, [0x1402f2708]
cmp rcx, r15
jae 0x14006a0d9
movzx edx, bx
lea rcx, [rbp - 0x70]
call fcn.14000d610
jmp 0x14006a0fa
mov rax, r13
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14006a0e0
mov r8d, eax
mov rdx, rcx
lea rcx, [rbp - 0x70]
call fcn.14000df90
nop
mov rdx, qword [rdi]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x70]
call fcn.1400157c0
xor eax, eax
mov edi, eax
mov eax, 1
cmp dword [r14 + 0x440], edi
je 0x14006a124
cmp dword [r14 + 0x48], 2
cmove edi, eax
lea rcx, [rbp + 0x430]
call fcn.1400a64e0
nop
lea rdx, [r14 + 0x1c0]
lea rcx, [rbp + 0x430]
call fcn.1400a659c
mov ebx, 0x7ffffffe
cmp qword [rbp + 0x440], 0
jne 0x14006a15b
test edi, edi
je 0x14006f9d1
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x70], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
xor eax, eax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x78], rax
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0x98], xmm0
lea rcx, [rbp + 0x40]
call fcn.1400a64e0
nop
lea r8, str.WOW6432Node
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, [0x1402f1240]
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, [0x1402f1250]
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, str.Applications
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, [0x1402f1288]
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, [0x1402f1268]
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, str.Installer
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, str.Mime
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, str.SystemFileAssociations
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, str.Record
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, str.Media_Type
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, str.Local_Settings
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
lea r8, str.ActivatableClasses
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1400a6854
xor r10d, r10d
mov dword [rbp - 0x7c], r10d
mov word [rbp - 0x28], r10w
mov rax, qword [rbp - 0x78]
cmp dword [rax - 8], 1
jle 0x14006a2c1
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000dd30
xor r10d, r10d
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x78]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006a303
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006a303
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006a2e0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r10w
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop dword [rax]
cmp word [rax], 0
je 0x14006a330
add rax, 2
sub rdx, 1
jne 0x14006a320
test rdx, rdx
je 0x14006a397
mov r8, rbx
lea r9, [rbp - 0x28]
lea rcx, [rdx - 0x10000]
cmove rcx, r10
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r10
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006a388
test r8, r8
je 0x14006a388
movzx eax, word [r9]
test ax, ax
je 0x14006a388
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006a366
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r10w
mov rax, qword [rsi]
cmp dword [rax - 8], 1
jle 0x14006a3ae
mov edx, dword [rax - 0x10]
mov rcx, rsi
call fcn.14000dd30
xor r10d, r10d
mov r8, qword [rsi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006a3f3
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006a3f3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006a3d0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r10w
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop dword [rax]
cmp word [rax], 0
je 0x14006a420
add rax, 2
sub rdx, 1
jne 0x14006a410
test rdx, rdx
je 0x14006a487
mov r8, rbx
lea r9, [rbp - 0x28]
lea rcx, [rdx - 0x10000]
cmove rcx, r10
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r10
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006a478
test r8, r8
je 0x14006a478
movzx eax, word [r9]
test ax, ax
je 0x14006a478
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006a456
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r10w
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rbp + 0x740]
call fcn.14001fb40
nop
xor esi, esi
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov eax, 1
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x430]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rbp + 0x740]
call fcn.14001feb0
cmp qword [r14 + 0x68], rsi
je 0x14006a6d4
mov dword [rbp - 0x7c], esi
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rbp + 0x7b0]
call fcn.14001fb40
nop
lea rsi, [r14 + 0x58]
xor eax, eax
mov dword [rsp + 0x78], eax
mov ecx, 1
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rbp + 0x7b0]
call fcn.14001feb0
test edi, edi
je 0x14006a6d4
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rbp + 0x820]
call fcn.14001fb40
nop
mov ecx, 1
mov dword [rsp + 0x70], ecx
xor eax, eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rbp + 0x820]
call fcn.14001feb0
mov ebx, dword [r14 + 0x3e4]
mov rdi, qword [r14 + 0x3f0]
lea rcx, [rbp + 0x890]
call fcn.14001fb40
nop
lea rax, [r14 + 0x1e8]
xor ecx, ecx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], ecx
mov ecx, 1
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r14
call fcn.1400578a0
nop
lea rcx, [rbp + 0x890]
call fcn.14001feb0
lea rcx, [rbp + 0x4f0]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0x408]
call fcn.1400a64e0
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fd53
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x68], rax
mov rsi, qword [rbp + 0x78]
test rsi, rsi
je 0x14006aa0a
mov rdi, qword [rsi + 0x10]
mov rsi, qword [rsi]
lea rcx, [rdi + 0x10]
call fcn.140055e30
xor ebx, ebx
test al, al
mov eax, 1
cmovne ebx, eax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fd69
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x50], rax
lea edx, [rbx + 5]
lea r8, [rbp - 0x50]
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
lea rdx, str.Shell
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006a8f6
lea edx, [rbx + 7]
lea r8, [rbp - 0x50]
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
lea rdx, str.Command
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006a9df
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fd5e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x2c0], rax
lea edx, [rbx + 6]
lea r8, [rbp + 0x2c0]
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
lea rdx, str.Open
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006a8c8
lea edx, [rbx + 4]
lea r8, [rbp - 0x50]
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
mov rcx, qword [rbp - 0x50]
add rcx, 0xffffffffffffffe8
cmp dword [rcx + 8], 1
jg 0x14006a828
call fcn.14000de80
lea rcx, [rax + 0x18]
mov qword [rbp + 0x2b8], rcx
jmp 0x14006a86a
mov rcx, qword [rcx]
test rcx, rcx
je 0x14006a83b
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14006a84a
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, 1
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x2b8]
call fcn.140015720
mov rcx, qword [rbp + 0x2b8]
or r12d, 2
mov dword [rbp - 0x64], r12d
lea rdx, [0x1402ed7f4]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
setne bl
mov rdx, qword [rbp + 0x2b8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a8a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
test bl, bl
je 0x14006a8c8
lea r8, [rbp - 0x50]
mov rdx, qword [rbp + 0x418]
lea rcx, [rbp + 0x408]
call fcn.1400a67e0
mov dword [rbp - 0x64], r12d
mov rdx, qword [rbp + 0x2c0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a9df
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
jmp 0x14006a9df
lea rdx, str.defaultIcon
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006a9df
lea edx, [rbx + 4]
lea r8, [rbp - 0x50]
mov rcx, qword [rdi + 0x10]
call fcn.14002de30
mov rcx, qword [rbp - 0x50]
add rcx, 0xffffffffffffffe8
cmp dword [rcx + 8], 1
jg 0x14006a93f
call fcn.14000de80
lea rcx, [rax + 0x18]
mov qword [rbp + 0x2c8], rcx
jmp 0x14006a981
mov rcx, qword [rcx]
test rcx, rcx
je 0x14006a952
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14006a961
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, 1
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x2c8]
call fcn.140015720
mov rcx, qword [rbp + 0x2c8]
or r12d, 4
mov dword [rbp - 0x64], r12d
lea rdx, [0x1402ed7f4]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
setne bl
mov rdx, qword [rbp + 0x2c8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a9c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
test bl, bl
je 0x14006a9df
lea r8, [rbp - 0x50]
mov rdx, qword [rbp + 0x418]
lea rcx, [rbp + 0x408]
call fcn.1400a67e0
mov dword [rbp - 0x64], r12d
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a711
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
jmp 0x14006a711
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0xa8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
xor edi, edi
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xb0], rdi
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0xd0], xmm0
movaps xmm0, xmmword [0x1402f6330]
movaps xmmword [rbp + 0xee0], xmm0
movaps xmm1, xmmword [0x1402f6340]
movaps xmmword [rbp + 0xef0], xmm1
movaps xmm0, xmmword [0x1402f6350]
movaps xmmword [rbp + 0xf00], xmm0
movaps xmm1, xmmword [0x1402f6360]
movaps xmmword [rbp + 0xf10], xmm1
movaps xmm0, xmmword [0x1402f6370]
movaps xmmword [rbp + 0xf20], xmm0
movaps xmm1, xmmword [0x1402f6380]
movaps xmmword [rbp + 0xf30], xmm1
movaps xmm0, xmmword [0x1402f6390]
movaps xmmword [rbp + 0xf40], xmm0
movsd xmm1, qword [0x1402f63a0]
movsd qword [rbp + 0xf50], xmm1
movzx eax, word [0x1402f63a8]
mov word [rbp + 0xf58], ax
mov rax, qword [rbp - 0x70]
cmp dword [rax - 8], 1
jle 0x14006aad9
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000dd30
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x70]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006ab14
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006ab14
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006aaf1
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop dword [rax]
cmp word [rax], 0
je 0x14006ab40
add rax, 2
sub rdx, 1
jne 0x14006ab30
test rdx, rdx
je 0x14006abb0
mov r8d, 0x7ffffffe
lea r9, [rbp + 0xee0]
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006aba2
nop dword [rax]
test r8, r8
je 0x14006aba2
movzx eax, word [r9]
test ax, ax
je 0x14006aba2
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006ab80
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov rbx, qword [rbp - 0x20]
mov rax, qword [rbx]
cmp dword [rax - 8], 1
jle 0x14006abc8
mov edx, dword [rax - 0x10]
mov rcx, rbx
call fcn.14000dd30
mov r8, qword [rbx]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006ac03
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14006ac03
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006abe0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006ac30
add rax, 2
sub rdx, 1
jne 0x14006ac20
test rdx, rdx
je 0x14006aca0
mov r8d, 0x7ffffffe
lea r9, [rbp + 0xee0]
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006ac92
nop dword [rax]
test r8, r8
je 0x14006ac92
movzx eax, word [r9]
test ax, ax
je 0x14006ac92
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006ac70
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
cmp qword [rbp + 0x418], 0
jle 0x14006ad42
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rbp + 0x900]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], edi
mov esi, 1
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], ebx
lea rax, [rbp + 0x4f0]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x408]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rbp + 0x900]
call fcn.14001feb0
jmp 0x14006ad47
mov esi, 1
cmp qword [r14 + 0x68], 0
jle 0x14006addc
mov ebx, dword [r14 + 0x3e4]
lea rcx, [rbp + 0x970]
call fcn.14001fb40
nop
lea rax, [r14 + 0x58]
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x4f0]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xa8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rbp + 0x970]
call fcn.14001feb0
mov r14, qword [rbp + 0xb0]
test r14, r14
je 0x14006b0e3
nop dword [rax]
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fd8a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x140], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fd7f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x1f8], rax
mov rdi, qword [r14 + 0x10]
mov r14, qword [r14]
lea rcx, [rdi + 0x10]
call fcn.140055e30
xor ecx, ecx
mov ebx, ecx
test al, al
mov eax, 1
cmovne ebx, eax
mov rdx, 0xffffffff80000003
lea rcx, [rbp + 0x480]
call fcn.14001fc70
nop
lea edx, [rbx + 0xa]
lea r8, [rbp + 0x1f8]
mov rcx, qword [rdi + 0x10]
call fcn.14002f3b0
lea rdx, [rbp + 0x140]
mov rcx, qword [rbp + 0x1f8]
call fcn.140030c60
mov r8d, dword [rbp - 0x68]
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x480]
call fcn.1400210b0
test eax, eax
je 0x14006b068
lea rdx, str.OpenWithProgids
mov rcx, qword [rdi + 8]
call fcn.14024bf20
test eax, eax
jne 0x14006af82
cmp dword [rbp + 0x4c0], 1
jne 0x14006af82
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fd74
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x138], rax
lea rax, str.REGISTRYHKEY_USERS_
lea rcx, [rbp + 0x138]
cmp rax, r15
jae 0x14006af0f
movzx edx, ax
call fcn.14000d610
jmp 0x14006af1e
mov r8d, reloc.Cabinet.dll_FDIIsCabinet
mov rdx, rax
call fcn.14000df90
nop
mov rdx, qword [rbp + 0x140]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x138]
call fcn.1400157c0
mov rbx, qword [rbp + 0x138]
mov rdx, rbx
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006af62
mov ecx, dword [rbp - 0x80]
mov dword [rax + 0x20], ecx
mov ecx, 1
mov dword [rax + 0x24], ecx
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006afb5
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
jmp 0x14006afb5
mov edx, dword [rbp - 0x80]
mov dword [rsp + 0x48], edx
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x28], eax
mov rcx, qword [rdi + 0x28]
mov qword [rsp + 0x20], rcx
mov rax, qword [rbp - 0x60]
mov r9d, dword [rdi + 0x20]
mov r8, qword [rdi + 0x18]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rax + 0x3f0]
call fcn.140055970
mov rcx, qword [rbp + 0x488]
test rcx, rcx
je 0x14006afd2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rbp + 0x488], rbx
jmp 0x14006afd4
xor ebx, ebx
cmp qword [rbp + 0x490], 0
je 0x14006b068
cmp dword [rbp + 0x498], 0
jne 0x14006b068
mov qword [rbp + 0x490], rbx
lea rcx, [rbp + 0x4a0]
call fcn.14000e0b0
lea rcx, [rbp + 0x4a8]
call fcn.14000e0b0
lea rcx, [rbp + 0x4b0]
call fcn.14000e0b0
lea rcx, [rbp + 0x4b8]
call fcn.14000e0b0
mov qword [rbp + 0x488], rbx
mov dword [rbp + 0x498], ebx
mov qword [rbp + 0x4c0], 0
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4d0], 0
mov qword [rbp + 0x4d8], 0
mov dword [rbp + 0x4e0], ebx
mov qword [rbp + 0x490], rbx
cmp dword [rdi + 0x30], 0
je 0x14006b077
mov rcx, qword [rdi + 0x28]
call fcn.140095d64
mov rcx, rdi
call fcn.14005dc90
nop
lea rcx, [rbp + 0x480]
call fcn.14001feb0
nop
mov rdx, qword [rbp + 0x1f8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006b0b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0x140]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006b0d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
test r14, r14
jne 0x14006adf0
xor edi, edi
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x10], rdi
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x1d0]
call fcn.1400a64e0
nop
mov r14, qword [rbp + 0x78]
test r14, r14
je 0x14006b55a
nop word [rax + rax]
mov r15, qword [r14 + 0x10]
mov r14, qword [r14]
mov qword [rbp + 0x298], r14
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fdd8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
lea rcx, [r15 + 0x10]
call fcn.140055e30
mov ebx, edi
test al, al
mov eax, 1
cmovne ebx, eax
lea r12d, [rbx + 5]
lea r8, [rbp - 0x38]
mov edx, r12d
mov rcx, qword [r15 + 0x10]
call fcn.14002de30
lea rdx, str.Shell
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006b3e7
lea r8, [rbp - 0x38]
lea edx, [rbx + 7]
mov rcx, qword [r15 + 0x10]
call fcn.14002de30
lea rdx, str.Command
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006b3ae
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fdbc
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x210], rax
lea edx, [rbx + 6]
lea r8, [rbp + 0x210]
mov rcx, qword [r15 + 0x10]
call fcn.14002de30
lea rdx, str.Open
mov rcx, qword [rbp + 0x210]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006b2fb
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fda6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x200], rax
lea r8, [rbp + 0x200]
mov edx, r12d
mov rcx, qword [r15 + 0x10]
call fcn.14002f3b0
mov rdx, qword [rbp + 0x200]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006b278
mov ecx, dword [rbp - 0x80]
mov dword [rax + 0x20], ecx
mov ecx, 1
mov dword [rax + 0x24], ecx
lea edx, [rbx + 4]
lea r8, [rbp - 0x38]
mov rcx, qword [r15 + 0x10]
call fcn.14002de30
mov rsi, qword [rbp - 0x38]
mov rdx, qword [rbp + 0x1e0]
test rsi, rsi
je 0x14006b2e1
xor eax, eax
mov edi, eax
mov ebx, eax
test rdx, rdx
jle 0x14006b2e1
test rbx, rbx
js 0x14006fda0
cmp rbx, rdx
jge 0x14006fda0
mov rax, qword [rbp + 0x1d8]
mov rdx, qword [rax + rbx*8]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14006b2f2
inc edi
inc rbx
movsxd rax, edi
mov rdx, qword [rbp + 0x1e0]
cmp rax, rdx
jl 0x14006b2a3
lea r8, [rbp - 0x38]
lea rcx, [rbp + 0x1d0]
call fcn.1400a67e0
nop
mov rdx, qword [rbp + 0x200]
jmp 0x14006b361
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fdb1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x208], rax
lea r8, [rbp + 0x208]
lea edx, [rbx + 7]
mov rcx, qword [r15 + 0x10]
call fcn.14002f3b0
mov rdx, qword [rbp + 0x208]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006b35a
mov ecx, dword [rbp - 0x80]
mov dword [rax + 0x20], ecx
mov ecx, 1
mov dword [rax + 0x24], ecx
mov rdx, qword [rbp + 0x208]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006b380
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0x210]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006b50a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
jmp 0x14006b50a
mov eax, dword [r15 + 0x30]
mov rcx, qword [r15 + 0x28]
mov edx, dword [rbp - 0x80]
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, dword [r15 + 0x20]
mov r8, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x10]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x3f0]
call fcn.140055970
jmp 0x14006b50a
lea rdx, str.defaultIcon
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006b869
lea edx, [rbx + 4]
lea r8, [rbp - 0x38]
mov rcx, qword [r15 + 0x10]
call fcn.14002de30
mov r14, qword [rbp - 0x38]
mov rdx, qword [rbp + 0x1e0]
test r14, r14
je 0x14006b46e
xor eax, eax
mov ebx, eax
test rdx, rdx
jle 0x14006b46e
nop dword [rax]
test rbx, rbx
js 0x14006fdd2
cmp rbx, rdx
jge 0x14006fdd2
mov rax, qword [rbp + 0x1d8]
mov rdx, qword [rax + rbx*8]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14006b47f
inc edi
inc rbx
movsxd rax, edi
mov rdx, qword [rbp + 0x1e0]
cmp rax, rdx
jl 0x14006b430
lea r8, [rbp - 0x38]
lea rcx, [rbp + 0x1d0]
call fcn.1400a67e0
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fdc7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x218], rax
lea r8, [rbp + 0x218]
mov edx, r12d
mov rcx, qword [r15 + 0x10]
call fcn.14002f3b0
mov rdx, qword [rbp + 0x218]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006b4de
mov ecx, dword [rbp - 0x80]
mov dword [rax + 0x20], ecx
mov ecx, 1
mov dword [rax + 0x24], ecx
mov rdx, qword [rbp + 0x218]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006b503
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
mov r14, qword [rbp + 0x298]
xor edi, edi
cmp dword [r15 + 0x30], 0
je 0x14006b51c
mov rcx, qword [r15 + 0x28]
call fcn.140095d64
mov rcx, r15
call fcn.14005dc90
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006b547
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
test r14, r14
jne 0x14006b130
mov r12d, dword [rbp - 0x64]
mov r15d, 0x10000
lea rbx, [0x1402e82f0]
lea r14, [0x1402ed690]
cmp qword [rbp + 0x1e0], 0
jle 0x14006bba6
mov rax, qword [rbp - 0x78]
cmp dword [rax - 8], 1
jle 0x14006b58c
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000dd30
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x78]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006b5c7
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006b5c7
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006b5a4
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop
cmp word [rax], 0
je 0x14006b5f0
add rax, 2
sub rdx, 1
jne 0x14006b5e0
test rdx, rdx
je 0x14006b658
mov r8d, 0x7ffffffe
mov r9, rbx
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006b64a
test r8, r8
je 0x14006b64a
movzx eax, word [r9]
test ax, ax
je 0x14006b64a
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006b628
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov rsi, qword [rbp - 0x40]
mov rax, qword [rsi]
cmp dword [rax - 8], 1
jle 0x14006b670
mov edx, dword [rax - 0x10]
mov rcx, rsi
call fcn.14000dd30
mov r8, qword [rsi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006b6b3
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006b6b3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006b690
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006b6e0
add rax, 2
sub rdx, 1
jne 0x14006b6d0
test rdx, rdx
je 0x14006b748
mov r8d, 0x7ffffffe
mov r9, rbx
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006b73a
test r8, r8
je 0x14006b73a
movzx eax, word [r9]
test ax, ax
je 0x14006b73a
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006b718
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov rdx, 0xffffffff80000003
lea rcx, [rbp + 0x660]
call fcn.14001fc70
nop
mov edi, dword [rbp - 0x68]
mov r8d, edi
lea rdx, [rbp + 0x12a0]
lea rcx, [rbp + 0x660]
call fcn.1400210b0
mov r15d, dword [rbp + 0x6a0]
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fd95
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x18], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fde3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x238], rax
mov rcx, qword [rsi]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rbp + 0xf0], rax
mov rax, r13
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x14006b7e0
mov r8d, eax
mov rdx, r14
lea rcx, [rbp + 0xf0]
call fcn.1400157c0
xor eax, eax
mov r14d, eax
test r15d, r15d
jle 0x14006bb2b
mov rsi, qword [rbp - 0x60]
nop
mov rcx, qword [rsi + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14006bec2
lea r9, [rbp + 0x238]
lea r8, [rbp - 0x18]
mov edx, r14d
lea rcx, [rbp + 0x660]
call fcn.140020810
mov rcx, qword [rbp - 0x18]
add rcx, 0xffffffffffffffe8
cmp dword [rcx + 8], 1
jg 0x14006b977
call fcn.14000de80
lea rcx, [rax + 0x18]
mov qword [rbp + 0x220], rcx
jmp 0x14006b9b9
mov ecx, 0x38
call fcn.140095d1c
mov qword [rbp + 0x298], rax
test rax, rax
je 0x14006b88c
mov rcx, rax
call fcn.140055c20
mov rbx, rax
jmp 0x14006b88f
mov rbx, rdi
lea rdx, [r15 + 8]
lea rcx, [rbx + 8]
call fcn.14000d7c0
lea rcx, [rbx + 0x10]
lea rdx, [r15 + 0x10]
call fcn.14000d7c0
lea rdx, [r15 + 0x18]
lea rcx, [rbx + 0x18]
call fcn.14000d7c0
mov eax, dword [r15 + 0x20]
mov dword [rbx + 0x20], eax
mov ecx, dword [r15 + 0x30]
call fcn.1400164e0
mov qword [rbx + 0x28], rax
mov r8d, dword [r15 + 0x30]
mov rdx, qword [r15 + 0x28]
mov rcx, rax
call fcn.1402414f0
mov eax, dword [r15 + 0x30]
mov dword [rbx + 0x30], eax
mov rdi, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x28]
test rcx, rcx
jne 0x14006b93d
lea r8d, [rcx + 0x18]
mov rdx, qword [rbp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.1400ad424
mov rdx, qword [rbp + 0x38]
lea r8, [rdx - 1]
lea r8, [rdx + r8*2]
lea r8, [rax + r8*8]
sub rdx, 1
mov rcx, qword [rbp + 0x28]
js 0x14006b934
nop dword [rax]
mov qword [r8], rcx
mov rcx, r8
mov qword [rbp + 0x28], rcx
sub r8, 0x18
sub rdx, 1
jns 0x14006b920
test rcx, rcx
je 0x14006fdd2
mov rax, qword [rcx]
mov qword [rbp + 0x28], rax
mov qword [rcx + 8], rdi
xor edi, edi
mov qword [rcx], rdi
inc qword [rbp + 0x20]
mov qword [rcx + 0x10], rbx
mov rax, qword [rbp + 0x18]
test rax, rax
je 0x14006b96a
mov qword [rax], rcx
mov qword [rbp + 0x18], rcx
jmp 0x14006b50c
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rcx
jmp 0x14006b50c
mov rcx, qword [rcx]
test rcx, rcx
je 0x14006b98a
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14006b999
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, 1
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x220]
call fcn.140015720
mov rcx, qword [rbp + 0x220]
or r12d, 8
lea rdx, [0x1402ed7f4]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x220]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006b9f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
test bl, bl
je 0x14006bb1b
mov rdx, 0xffffffff80000003
lea rcx, [rbp + 0x5f0]
call fcn.14001fc70
nop
mov r8, qword [rbp + 0xf0]
lea rcx, [rbp - 0x18]
call fcn.140021fb0
mov r8d, edi
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x5f0]
call fcn.1400210b0
test eax, eax
je 0x14006bb0f
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe15
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x5f0]
mov r9, qword [rax + 0xb8]
lea r8, [rbp + 0x230]
xor edx, edx
lea rcx, [rbp + 0x5f0]
call r9
mov rsi, qword [rbp + 0x230]
test rsi, rsi
je 0x14006beb9
xor eax, eax
mov edi, eax
mov ebx, eax
mov rcx, qword [rbp + 0x1e0]
test rcx, rcx
jle 0x14006bae2
test rbx, rbx
js 0x14006fe0f
cmp rbx, rcx
jge 0x14006fe0f
mov rax, qword [rbp + 0x1d8]
mov rdx, qword [rax + rbx*8]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14006bc1e
inc edi
inc rbx
movsxd rax, edi
mov rcx, qword [rbp + 0x1e0]
cmp rax, rcx
jl 0x14006baa0
mov rsi, qword [rbp - 0x60]
mov edi, dword [rbp - 0x68]
mov rdx, qword [rbp + 0x230]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bb0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
lea rcx, [rbp + 0x5f0]
call fcn.14001feb0
inc r14d
cmp r14d, r15d
jl 0x14006b810
mov dword [rbp - 0x64], r12d
mov rdx, qword [rbp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bb51
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0x238]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bb77
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bb9a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
lea rcx, [rbp + 0x660]
call fcn.14001feb0
mov r12, qword [rbp + 0x10]
test r12, r12
je 0x14006c60e
mov rbx, qword [r12 + 0x10]
mov r12, qword [r12]
lea rcx, [rbx + 0x10]
call fcn.140055e30
xor r15d, r15d
mov esi, r15d
test al, al
mov edi, 1
cmovne esi, edi
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe78
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf8], rax
lea rax, [0x1402ed690]
lea rcx, [rbp + 0xf8]
cmp rax, 0x10000
jae 0x14006c0a1
movzx edx, ax
call fcn.14000d610
jmp 0x14006c0ad
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe04
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xe8], rax
mov edi, 0x10000
lea rax, [0x1402f2708]
lea rcx, [rbp + 0xe8]
cmp rax, rdi
jae 0x14006bc62
movzx edx, ax
call fcn.14000d610
jmp 0x14006bc71
mov r8d, reloc.Cabinet.dll_FDICreate
mov rdx, rax
call fcn.14000df90
nop
mov rdx, qword [rbp - 0x18]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xe8]
call fcn.1400157c0
mov rdx, qword [rbp + 0xe8]
mov rsi, qword [rbp - 0x60]
mov rcx, qword [rsi + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006bcaf
mov ecx, dword [rbp - 0x80]
mov dword [rax + 0x20], ecx
mov ecx, 1
mov dword [rax + 0x24], ecx
cmp dword [rsi + 0x48], 2
jne 0x14006be8b
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fdf9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x228], rax
mov rax, qword [rbp + 0x5f0]
mov r9, qword [rax + 0xb8]
lea r8, [rbp + 0x228]
lea rdx, str.Content_Type
lea rcx, [rbp + 0x5f0]
call r9
test eax, eax
je 0x14006be65
mov rdx, 0xffffffff80000003
lea rcx, [rbp + 0x6d0]
call fcn.14001fc70
nop
mov rcx, qword [rbp + 0xf0]
add rcx, 0xffffffffffffffe8
call fcn.14000de80
add rax, 0x18
mov qword [rbp + 0xe0], rax
mov r8d, 0x1b
lea rdx, str.MIMEDatabaseContent_Type_
lea rcx, [rbp + 0xe0]
call fcn.1400157c0
mov rdx, qword [rbp + 0x228]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xe0]
call fcn.1400157c0
mov r8d, dword [rbp - 0x68]
mov rbx, qword [rbp + 0xe0]
mov rdx, rbx
lea rcx, [rbp + 0x6d0]
call fcn.1400210b0
test eax, eax
je 0x14006be39
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fdee
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x148], rax
lea rax, [0x1402f2708]
lea rcx, [rbp + 0x148]
cmp rax, rdi
jae 0x14006bdc9
movzx edx, ax
call fcn.14000d610
jmp 0x14006bdd8
mov r8d, reloc.Cabinet.dll_FDICreate
mov rdx, rax
call fcn.14000df90
nop
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x148]
call fcn.1400157c0
mov rbx, qword [rbp + 0x148]
mov rdx, rbx
mov rcx, qword [rsi + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006be14
mov ecx, dword [rbp - 0x80]
mov dword [rax + 0x20], ecx
mov ecx, 1
mov dword [rax + 0x24], ecx
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006be32
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
mov rbx, qword [rbp + 0xe0]
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006be58
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
lea rcx, [rbp + 0x6d0]
call fcn.14001feb0
nop
mov rdx, qword [rbp + 0x228]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006be8b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bae6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
jmp 0x14006bae6
mov rsi, qword [rbp - 0x60]
jmp 0x14006bae9
mov rdx, qword [rbp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bee8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0x238]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bf0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bf31
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
lea rcx, [rbp + 0x660]
call fcn.14001feb0
nop
lea rcx, [rbp + 0x1d0]
call fcn.1400a6500
nop
lea rdi, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 8], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
xor ebx, ebx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x10], rbx
mov rcx, qword [rbp + 0x30]
call fcn.1400ad45c
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0xa8], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0xb0], rbx
mov rcx, qword [rbp + 0xd0]
call fcn.1400ad45c
mov qword [rbp + 0xd0], rbx
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bfcb
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
lea rcx, [rbp + 0x408]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x4f0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x40]
call fcn.1400a6500
nop
mov qword [rbp + 0x70], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x78], rbx
mov rcx, qword [rbp + 0x98]
call fcn.1400ad45c
mov qword [rbp + 0x98], rbx
lea rcx, [rbp + 0x430]
call fcn.1400a6500
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006c04c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006c06f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdi, qword [rbp - 0x20]
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006c095
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax]
jmp 0x14006f786
mov r8d, edi
mov rdx, rax
call fcn.14000df90
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe6d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x150], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe62
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x258], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe57
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x250], rax
lea edx, [rsi + 4]
lea r8, [rbp + 0x150]
mov rcx, qword [rbx + 0x10]
call fcn.14002de30
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xf8]
call fcn.1400157c0
mov rdx, qword [rbp + 0xf8]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x3f0]
call fcn.1400554e0
mov rdi, rax
lea rax, vtable.CRegistry.0
mov qword [rbp + 0x310], rax
call fcn.1400a2364
nop
test rax, rax
je 0x14006fe4c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x330], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe41
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x338], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe36
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x340], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe2b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x348], rax
lea rcx, [rbp + 0x330]
call fcn.14000e0b0
lea rcx, [rbp + 0x338]
call fcn.14000e0b0
lea rcx, [rbp + 0x340]
call fcn.14000e0b0
lea rcx, [rbp + 0x348]
call fcn.14000e0b0
mov qword [rbp + 0x318], r15
mov dword [rbp + 0x328], r15d
mov qword [rbp + 0x350], r15
mov qword [rbp + 0x358], r15
mov qword [rbp + 0x360], r15
mov qword [rbp + 0x368], r15
mov dword [rbp + 0x370], r15d
mov qword [rbp + 0x320], 0xffffffff80000003
mov r8d, 0xa
lea rdx, str.HKEY_USERS
lea rcx, [rbp + 0x348]
call fcn.14000df90
nop
lea r15d, [rsi + 5]
lea r8, [rbp + 0x258]
mov edx, r15d
mov rcx, qword [rbx + 0x10]
call fcn.14002f3b0
lea rdx, [rbp + 0x250]
mov rcx, qword [rbp + 0x258]
call fcn.140030c60
mov r8d, dword [rbp - 0x68]
mov rdx, qword [rbp + 0x250]
lea rcx, [rbp + 0x310]
call fcn.1400210b0
test eax, eax
je 0x14006c511
mov rcx, qword [rbp + 0x150]
add rcx, 0xffffffffffffffe8
cmp dword [rcx + 8], 1
jg 0x14006c2dd
call fcn.14000de80
lea rcx, [rax + 0x18]
mov qword [rbp + 0x240], rcx
jmp 0x14006c322
mov rcx, qword [rcx]
test rcx, rcx
je 0x14006c2f0
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14006c2ff
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, 1
mov rdx, qword [rbp + 0x150]
lea rcx, [rbp + 0x240]
call fcn.140015720
mov rcx, qword [rbp + 0x240]
mov eax, dword [rbp - 0x64]
or eax, 0x11
mov dword [rbp - 0x64], eax
lea rdx, [0x1402ed7f4]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006c349
cmp dword [rbp + 0x350], eax
jne 0x14006c349
mov sil, 1
jmp 0x14006c34c
xor sil, sil
and dword [rbp - 0x64], 0xfffffffe
mov rdx, qword [rbp + 0x240]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006c375
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
test sil, sil
je 0x14006c420
test rdi, rdi
je 0x14006c39a
cmp dword [rdi + 0x24], 1
je 0x14006c458
mov eax, 1
mov dword [rdi + 0x24], eax
jmp 0x14006c458
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe20
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x248], rax
lea r8, [rbp + 0x248]
mov edx, r15d
mov rcx, qword [rbx + 0x10]
call fcn.14002f3b0
mov rdx, qword [rbp + 0x248]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006c3f9
mov ecx, dword [rbp - 0x80]
mov dword [rax + 0x20], ecx
mov ecx, 1
mov dword [rax + 0x24], ecx
mov rdx, qword [rbp + 0x248]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006c458
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
jmp 0x14006c458
test rdi, rdi
jne 0x14006c458
mov eax, dword [rbx + 0x30]
mov rcx, qword [rbx + 0x28]
mov edx, dword [rbp - 0x80]
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbx + 0x20]
mov r8, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x3f0]
call fcn.140055970
mov rcx, qword [rbp + 0x318]
test rcx, rcx
je 0x14006c475
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov qword [rbp + 0x318], rdi
jmp 0x14006c477
xor edi, edi
cmp qword [rbp + 0x320], 0
je 0x14006c549
cmp dword [rbp + 0x328], 0
jne 0x14006c549
mov qword [rbp + 0x320], rdi
lea rcx, [rbp + 0x330]
call fcn.14000e0b0
lea rcx, [rbp + 0x338]
call fcn.14000e0b0
lea rcx, [rbp + 0x340]
call fcn.14000e0b0
lea rcx, [rbp + 0x348]
call fcn.14000e0b0
mov qword [rbp + 0x318], rdi
mov dword [rbp + 0x328], edi
mov qword [rbp + 0x350], 0
mov qword [rbp + 0x358], 0
mov qword [rbp + 0x360], 0
mov qword [rbp + 0x368], 0
mov dword [rbp + 0x370], edi
mov qword [rbp + 0x320], rdi
jmp 0x14006c549
test rdi, rdi
jne 0x14006c549
mov eax, dword [rbx + 0x30]
mov rcx, qword [rbx + 0x28]
mov edx, dword [rbp - 0x80]
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbx + 0x20]
mov r8, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x3f0]
call fcn.140055970
cmp dword [rbx + 0x30], 0
je 0x14006c558
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov rcx, rbx
call fcn.14005dc90
nop
lea rcx, [rbp + 0x310]
call fcn.14001feb0
nop
mov rdx, qword [rbp + 0x250]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006c594
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0x258]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006c5ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0x150]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006c5e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bbaa
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
jmp 0x14006bbaa
lea rcx, [rbp + 0x3a8]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0x518]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0x590]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0x380]
call fcn.1400a64e0
nop
lea rcx, [rbp + 0x568]
call fcn.1400a64e0
nop
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x100], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x118], xmm0
xor edi, edi
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x108], rdi
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0x128], xmm0
movsd xmm0, qword [str.CLSID]
movsd qword [rbp + 0xeb0], xmm0
mov eax, dword [0x1402f63f0]
mov dword [rbp + 0xeb8], eax
movzx eax, word [0x1402f63f4]
mov word [rbp + 0xebc], ax
mov rax, qword [rbp - 0x78]
cmp dword [rax - 8], 1
jle 0x14006c6c8
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000dd30
mov ebx, 0x10000
mov edx, ebx
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x78]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006c707
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006c707
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006c6e4
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, rbx
lea rax, [rbp + 0x212a0]
nop
cmp word [rax], 0
je 0x14006c730
add rax, 2
sub rdx, 1
jne 0x14006c720
test rdx, rdx
je 0x14006c7a0
mov r8d, 0x7ffffffe
lea r9, [rbp + 0xeb0]
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, rbx
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, rbx
je 0x14006c792
nop dword [rax]
test r8, r8
je 0x14006c792
movzx eax, word [r9]
test ax, ax
je 0x14006c792
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006c770
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov rsi, qword [rbp - 0x40]
mov rax, qword [rsi]
cmp dword [rax - 8], 1
jle 0x14006c7b8
mov edx, dword [rax - 0x10]
mov rcx, rsi
call fcn.14000dd30
mov r8, qword [rsi]
mov rdx, rbx
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006c7f3
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006c7f3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006c7d0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, rbx
lea rax, [rbp + 0x12a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006c820
add rax, 2
sub rdx, 1
jne 0x14006c810
test rdx, rdx
je 0x14006c890
mov r8d, 0x7ffffffe
lea r9, [rbp + 0xeb0]
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, rbx
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, rbx
je 0x14006c882
nop dword [rax]
test r8, r8
je 0x14006c882
movzx eax, word [r9]
test ax, ax
je 0x14006c882
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006c860
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov dword [rbp - 0x7c], edi
mov r12, qword [rbp - 0x60]
mov ebx, dword [r12 + 0x3e4]
lea rcx, [rbp + 0x9e0]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], edi
mov r14d, 1
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x430]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1400584f0
nop
lea rcx, [rbp + 0x9e0]
call fcn.14001feb0
mov r15, qword [rbp + 0x108]
test r15, r15
je 0x14006d525
nop dword [rax]
mov r14, qword [r15 + 0x10]
mov r15, qword [r15]
lea rcx, [r14 + 0x10]
call fcn.140055e30
xor ecx, ecx
mov ebx, ecx
test al, al
mov eax, 1
cmovne ebx, eax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006feaf
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
lea r8, [rbp - 0x58]
lea edx, [rbx + 6]
mov rcx, qword [r14 + 0x10]
call fcn.14002de30
lea rdx, str.InprocServer32
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14006cb6a
lea rdx, str.InprocServer
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14006cb6a
lea rdx, str.LocalServer
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14006cb6a
lea rdx, str.InprocHandler32
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14006cb6a
lea rdx, str.LocalServer32
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14006cb6a
lea rdx, str.Shell
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006cb1b
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe8e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x268], rax
lea r8, [rbp + 0x268]
lea edx, [rbx + 8]
mov rcx, qword [r14 + 0x10]
call fcn.14002de30
lea rdx, str.Command
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006caf6
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe83
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x260], rax
lea r8, [rbp + 0x260]
lea edx, [rbx + 8]
mov rcx, qword [r14 + 0x10]
call fcn.14002f3b0
mov rdx, qword [rbp + 0x260]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006cad0
mov ecx, dword [rbp - 0x80]
mov dword [rax + 0x20], ecx
mov ecx, 1
mov dword [rax + 0x24], ecx
mov rdx, qword [rbp + 0x260]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006caf6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0x268]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006cb1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
lea rdx, str.DefaultIcon
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14006d4d7
mov eax, dword [r14 + 0x30]
mov rcx, qword [r14 + 0x28]
mov esi, dword [rbp - 0x80]
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, dword [r14 + 0x20]
mov r8, qword [r14 + 0x18]
mov rdx, qword [r14 + 0x10]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055970
jmp 0x14006d4d7
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fea4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x280], rax
lea r8, [rbp + 0x280]
lea edx, [rbx + 6]
mov rcx, qword [r14 + 0x10]
call fcn.14002f3b0
mov rdx, qword [rbp + 0x280]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055020
mov esi, dword [rbp - 0x80]
test rax, rax
je 0x14006cbc6
mov dword [rax + 0x20], esi
mov ecx, 1
mov dword [rax + 0x24], ecx
lea edx, [rbx + 5]
lea r8, [rbp - 0x58]
mov rcx, qword [r14 + 0x10]
call fcn.14002de30
lea r8, [rbp - 0x58]
mov rdx, qword [rbp + 0x3b8]
lea rcx, [rbp + 0x3a8]
call fcn.1400a67e0
mov rbx, qword [rbp - 0x40]
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rbp + 0x278], rax
mov r8d, 7
lea rdx, str.CLSID_
lea rcx, [rbp + 0x278]
call fcn.1400157c0
mov r8, qword [rbp + 0x278]
lea rcx, [rbp - 0x58]
call fcn.140021fb0
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fe99
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov edi, dword [rbp - 0x68]
mov r9d, edi
xor r8d, r8d
mov rdx, qword [rbp - 0x58]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006ce18
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0xf60]
call fcn.140241ba0
mov dword [rbp + 0x2a0], 0xc8
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1402f1268]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006ce0e
lea rcx, [rbp + 0xf60]
mov rax, r13
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14006cce0
test rax, rax
je 0x14006ce0e
lea r8, [rbp + 0xf60]
mov rdx, qword [rbp + 0x528]
lea rcx, [rbp + 0x518]
call fcn.1400a6854
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rbp + 0x270], rax
mov r8d, 7
lea rdx, str.AppID_
lea rcx, [rbp + 0x270]
call fcn.1400157c0
lea rcx, [rbp + 0xf60]
mov rax, r13
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14006cd50
mov r8d, eax
lea rdx, [rbp + 0xf60]
lea rcx, [rbp + 0x270]
call fcn.1400157c0
lea rax, [rbp + 0x458]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rbx, qword [rbp + 0x270]
mov rdx, rbx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006cdf0
lea r8d, [rax + 0x14]
lea rdx, [0x1402f2708]
lea rcx, [rbp - 0x48]
call fcn.14000df90
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.1400157c0
mov rdx, qword [rbp - 0x48]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006cde2
mov dword [rax + 0x20], esi
mov ecx, 1
mov dword [rax + 0x24], ecx
mov rcx, qword [rbp + 0x458]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006ce0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x58]
add rcx, 0xffffffffffffffe8
call fcn.14000de80
add rax, 0x18
mov qword [rbp - 8], rax
mov r8d, 7
lea rdx, str.ProgID
lea rcx, [rbp - 8]
call fcn.1400157c0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rbx, qword [rbp - 8]
mov rdx, rbx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006d028
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x1030]
call fcn.140241ba0
mov dword [rbp + 0x2a4], 0xc8
lea rax, [rbp + 0x2a4]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1030]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006d01e
lea rcx, [rbp + 0x1030]
mov rax, r13
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14006ced0
test rax, rax
je 0x14006d01e
lea r8, [rbp + 0x1030]
mov rdx, qword [rbp + 0x5a0]
lea rcx, [rbp + 0x590]
call fcn.1400a6854
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14006cf65
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x14006cf58
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14006cf58
call fcn.14000de80
mov rdi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14006cf4b
mov r9, qword [rbx]
mov rcx, qword [r9]
mov r8, qword [rcx + 8]
mov rdx, rbx
mov rcx, r9
call r8
lea rax, [rdi + 0x18]
mov qword [rbp - 8], rax
mov edi, dword [rbp - 0x68]
jmp 0x14006cf65
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 8]
call fcn.14000df90
mov r8d, 1
lea rdx, [0x1402ed690]
lea rcx, [rbp - 8]
call fcn.1400157c0
lea rcx, [rbp + 0x1030]
mov rax, r13
inc rax
cmp word [rcx + rax*2], 0
jne 0x14006cf85
mov r8d, eax
lea rdx, [rbp + 0x1030]
lea rcx, [rbp - 8]
call fcn.1400157c0
lea rax, [rbp + 0x460]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rbx, qword [rbp - 8]
mov rdx, rbx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006d01e
lea r8d, [rax + 0x14]
lea rdx, [0x1402f2708]
lea rcx, [rbp - 0x48]
call fcn.14000df90
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.1400157c0
mov rdx, qword [rbp - 0x48]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006d011
mov dword [rax + 0x20], esi
mov ecx, 1
mov dword [rax + 0x24], ecx
mov rcx, qword [rbp + 0x460]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x58]
add rcx, 0xffffffffffffffe8
call fcn.14000de80
add rax, 0x18
mov qword [rbp - 0x10], rax
mov r8d, 0x19
lea rdx, str.VersionIndependentProgID
lea rcx, [rbp - 0x10]
call fcn.1400157c0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rbx, qword [rbp - 0x10]
mov rdx, rbx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006d213
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x1100]
call fcn.140241ba0
mov dword [rbp + 0x2a8], 0xc8
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006d209
lea r8, [rbp + 0x1100]
mov rdx, qword [rbp + 0x578]
lea rcx, [rbp + 0x568]
call fcn.1400a6854
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14006d150
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x14006d143
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14006d143
call fcn.14000de80
mov rdi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14006d136
mov r9, qword [rbx]
mov rcx, qword [r9]
mov r8, qword [rcx + 8]
mov rdx, rbx
mov rcx, r9
call r8
lea rax, [rdi + 0x18]
mov qword [rbp - 0x10], rax
mov edi, dword [rbp - 0x68]
jmp 0x14006d150
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x10]
call fcn.14000df90
mov r8d, 1
lea rdx, [0x1402ed690]
lea rcx, [rbp - 0x10]
call fcn.1400157c0
lea rcx, [rbp + 0x1100]
mov rax, r13
inc rax
cmp word [rcx + rax*2], 0
jne 0x14006d170
mov r8d, eax
lea rdx, [rbp + 0x1100]
lea rcx, [rbp - 0x10]
call fcn.1400157c0
lea rax, [rbp + 0x468]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rbx, qword [rbp - 0x10]
mov rdx, rbx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006d209
lea r8d, [rax + 0x14]
lea rdx, [0x1402f2708]
lea rcx, [rbp - 0x48]
call fcn.14000df90
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.1400157c0
mov rdx, qword [rbp - 0x48]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006d1fc
mov dword [rax + 0x20], esi
mov ecx, 1
mov dword [rax + 0x24], ecx
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x58]
add rcx, 0xffffffffffffffe8
call fcn.14000de80
add rax, 0x18
mov qword [rbp], rax
mov r8d, 8
lea rdx, str.TypeLib
lea rcx, [rbp]
call fcn.1400157c0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rbx, qword [rbp]
mov rdx, rbx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006d404
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x11d0]
call fcn.140241ba0
mov dword [rbp + 0x2ac], 0xc8
lea rax, [rbp + 0x2ac]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x11d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006d3f9
lea r8, [rbp + 0x11d0]
mov rdx, qword [rbp + 0x390]
lea rcx, [rbp + 0x380]
call fcn.1400a6854
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14006d33b
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x14006d32e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14006d32e
call fcn.14000de80
mov rdi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14006d321
mov r9, qword [rbx]
mov rcx, qword [r9]
mov r8, qword [rcx + 8]
mov rdx, rbx
mov rcx, r9
call r8
lea rax, [rdi + 0x18]
mov qword [rbp], rax
mov edi, dword [rbp - 0x68]
jmp 0x14006d33b
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp]
call fcn.14000df90
mov r8d, 1
lea rdx, [0x1402ed690]
lea rcx, [rbp]
call fcn.1400157c0
lea rcx, [rbp + 0x11d0]
mov rax, r13
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14006d360
mov r8d, eax
lea rdx, [rbp + 0x11d0]
lea rcx, [rbp]
call fcn.1400157c0
lea rax, [rbp + 0x470]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rbx, qword [rbp]
mov rdx, rbx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006d3f9
lea r8d, [rax + 0x14]
lea rdx, [0x1402f2708]
lea rcx, [rbp - 0x48]
call fcn.14000df90
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.1400157c0
mov rdx, qword [rbp - 0x48]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006d3ec
mov dword [rax + 0x20], esi
mov ecx, 1
mov dword [rax + 0x24], ecx
mov rcx, qword [rbp + 0x470]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006d423
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006d446
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006d469
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006d48c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0x278]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006d4b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0x280]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006d4d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
cmp dword [r14 + 0x30], 0
je 0x14006d4e7
mov rcx, qword [r14 + 0x28]
call fcn.140095d64
mov rcx, r14
call fcn.14005dc90
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006d512
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
test r15, r15
jne 0x14006c940
mov rsi, qword [rbp - 0x40]
xor edi, edi
lea r14d, [r15 + 1]
mov rcx, qword [r12 + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14006d693
lea rbx, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x100], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x108], rdi
mov rcx, qword [rbp + 0x128]
call fcn.1400ad45c
mov qword [rbp + 0x128], rdi
lea rcx, [rbp + 0x568]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x380]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x590]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x518]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x3a8]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x1d0]
call fcn.1400a6500
nop
mov qword [rbp + 8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x10], rdi
mov rcx, qword [rbp + 0x30]
call fcn.1400ad45c
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0xa8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xb0], rdi
mov rcx, qword [rbp + 0xd0]
call fcn.1400ad45c
mov qword [rbp + 0xd0], rdi
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006d63d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
lea rcx, [rbp + 0x408]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x4f0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x40]
call fcn.1400a6500
nop
mov qword [rbp + 0x70], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x78], rdi
mov rcx, qword [rbp + 0x98]
call fcn.1400ad45c
mov qword [rbp + 0x98], rdi
jmp 0x14006f70a
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x198], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1a8], rdi
mov qword [rbp + 0x1a0], rdi
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x540]
call fcn.1400a64e0
nop
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x540]
call fcn.1400a6620
lea rdx, [rbp + 0x540]
call fcn.14008e7e0
movups xmm0, xmmword [str.TypeLib]
movups xmmword [rbp + 0xec0], xmm0
movzx eax, word [0x1402f6628]
mov word [rbp + 0xed0], ax
mov rax, qword [rbp - 0x78]
cmp dword [rax - 8], 1
jle 0x14006d728
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000dd30
mov r15d, 0x10000
mov edx, r15d
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x78]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006d773
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14006d773
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006d750
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006d7a0
add rax, 2
sub rdx, 1
jne 0x14006d790
test rdx, rdx
je 0x14006d810
mov r8d, 0x7ffffffe
lea r9, [rbp + 0xec0]
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006d802
nop dword [rax]
test r8, r8
je 0x14006d802
movzx eax, word [r9]
test ax, ax
je 0x14006d802
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006d7e0
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov rax, qword [rsi]
cmp dword [rax - 8], 1
jle 0x14006d824
mov edx, dword [rax - 0x10]
mov rcx, rsi
call fcn.14000dd30
mov r8, qword [rsi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006d863
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14006d863
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006d840
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006d890
add rax, 2
sub rdx, 1
jne 0x14006d880
test rdx, rdx
je 0x14006d900
mov r8d, 0x7ffffffe
lea r9, [rbp + 0xec0]
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006d8f2
nop dword [rax]
test r8, r8
je 0x14006d8f2
movzx eax, word [r9]
test ax, ax
je 0x14006d8f2
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006d8d0
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov dword [rbp - 0x7c], edi
mov ebx, dword [r12 + 0x3e4]
lea rcx, [rbp + 0xa50]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x198]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x540]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1400584f0
nop
lea rcx, [rbp + 0xa50]
call fcn.14001feb0
mov r14, qword [rbp + 0x1a0]
test r14, r14
je 0x14006db45
nop
mov rsi, qword [r14 + 0x10]
mov r14, qword [r14]
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fed6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x158], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fecb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x288], rax
lea rcx, [rsi + 0x10]
call fcn.140055e30
mov r15d, edi
test al, al
mov eax, 1
cmovne r15d, eax
lea edx, [r15 + 5]
lea r8, [rbp + 0x158]
mov rcx, qword [rsi + 0x10]
call fcn.14002de30
mov rdx, qword [rbp + 0x390]
mov rdi, rdx
xor eax, eax
mov ebx, eax
test rdx, rdx
jle 0x14006da75
nop dword [rax]
test rbx, rbx
js 0x14006fec5
cmp rbx, rdx
jge 0x14006fec5
mov rax, qword [rbp + 0x388]
mov rdx, qword [rax + rbx*8]
test rdx, rdx
je 0x14006feba
mov rcx, qword [rbp + 0x158]
call fcn.14024bf20
test eax, eax
je 0x14006dac9
inc rbx
mov rdx, qword [rbp + 0x390]
cmp rbx, rdi
jl 0x14006da30
lea r8, [rbp + 0x158]
lea rcx, [rbp + 0x380]
call fcn.1400a67e0
lea edx, [r15 + 6]
lea r8, [rbp + 0x288]
mov rcx, qword [rsi + 0x10]
call fcn.14002f3b0
mov rdx, qword [rbp + 0x288]
mov r12, qword [rbp - 0x60]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006dacd
mov ecx, dword [rbp - 0x80]
mov dword [rax + 0x20], ecx
mov ecx, 1
mov dword [rax + 0x24], ecx
jmp 0x14006dacd
mov r12, qword [rbp - 0x60]
cmp dword [rsi + 0x30], 0
je 0x14006dadc
mov rcx, qword [rsi + 0x28]
call fcn.140095d64
mov rcx, rsi
call fcn.14005dc90
nop
mov rdx, qword [rbp + 0x288]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006db0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp + 0x158]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006db30
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
xor edi, edi
test r14, r14
jne 0x14006d9a0
mov r15d, 0x10000
mov rsi, qword [rbp - 0x40]
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x160], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x168], rdi
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0x188], xmm0
mov rax, qword [rbp - 0x78]
cmp dword [rax - 8], 1
jle 0x14006db92
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000dd30
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x78]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006dbd3
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006dbd3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006dbb0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006dc00
add rax, 2
sub rdx, 1
jne 0x14006dbf0
mov r14d, 0x7ffffffe
lea rbx, [0x1402e82f0]
test rdx, rdx
je 0x14006dc72
mov r8d, r14d
mov r9, rbx
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006dc64
test r8, r8
je 0x14006dc64
movzx eax, word [r9]
test ax, ax
je 0x14006dc64
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006dc42
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov rax, qword [rsi]
cmp dword [rax - 8], 1
jle 0x14006dc86
mov edx, dword [rax - 0x10]
mov rcx, rsi
call fcn.14000dd30
mov r8, qword [rsi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006dcc3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14006dcc3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006dca0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006dcf0
add rax, 2
sub rdx, 1
jne 0x14006dce0
test rdx, rdx
je 0x14006dd51
mov r8, r14
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006dd43
test r8, r8
je 0x14006dd43
movzx eax, word [rbx]
test ax, ax
je 0x14006dd43
add rbx, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006dd22
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov ebx, dword [r12 + 0x3e4]
lea rcx, [rbp + 0xac0]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], edi
mov eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1400584f0
nop
lea rcx, [rbp + 0xac0]
call fcn.14001feb0
mov rax, qword [rbp - 0x70]
cmp dword [rax - 8], 1
jle 0x14006ddfa
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000dd30
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x70]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006de35
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006de35
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006de12
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop dword [rax]
cmp word [rax], 0
je 0x14006de60
add rax, 2
sub rdx, 1
jne 0x14006de50
lea rbx, [0x1402f65a0]
test rdx, rdx
je 0x14006ded0
mov r8, r14
mov r9, rbx
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006dec2
nop dword [rax]
test r8, r8
je 0x14006dec2
movzx eax, word [r9]
test ax, ax
je 0x14006dec2
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006dea0
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov rdi, qword [rbp - 0x20]
mov rax, qword [rdi]
cmp dword [rax - 8], 1
jle 0x14006dee8
mov edx, dword [rax - 0x10]
mov rcx, rdi
call fcn.14000dd30
mov r8, qword [rdi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006df23
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006df23
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006df00
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor r9d, r9d
mov word [rax], r9w
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop
cmp word [rax], r9w
je 0x14006df50
add rax, 2
sub rdx, 1
jne 0x14006df40
test rdx, rdx
je 0x14006dfb2
mov r8, r14
lea rcx, [rdx - 0x10000]
cmove rcx, r9
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r9
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006dfa3
test r8, r8
je 0x14006dfa3
movzx eax, word [rbx]
test ax, ax
je 0x14006dfa3
add rbx, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006df82
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r9w
mov ebx, dword [r12 + 0x3e4]
lea rcx, [rbp + 0xb30]
call fcn.14001fb40
nop
xor eax, eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], eax
mov eax, 1
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1400584f0
nop
lea rcx, [rbp + 0xb30]
call fcn.14001feb0
mov rax, qword [rbp - 0x70]
cmp dword [rax - 8], 1
jle 0x14006e05d
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000dd30
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x70]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006e0a3
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006e0a3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006e080
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor r10d, r10d
mov word [rax], r10w
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop
cmp word [rax], r10w
je 0x14006e0d0
add rax, 2
sub rdx, 1
jne 0x14006e0c0
lea rbx, [0x1402f6530]
test rdx, rdx
je 0x14006e141
mov r8, r14
mov r9, rbx
lea rcx, [rdx - 0x10000]
cmove rcx, r10
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r10
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006e132
nop dword [rax]
test r8, r8
je 0x14006e132
movzx eax, word [r9]
test ax, ax
je 0x14006e132
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006e110
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r10w
mov rax, qword [rdi]
cmp dword [rax - 8], 1
jle 0x14006e158
mov edx, dword [rax - 0x10]
mov rcx, rdi
call fcn.14000dd30
xor r10d, r10d
mov r8, qword [rdi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006e193
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006e193
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006e170
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r10w
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop dword [rax]
cmp word [rax], 0
je 0x14006e1c0
add rax, 2
sub rdx, 1
jne 0x14006e1b0
test rdx, rdx
je 0x14006e222
mov r8, r14
lea rcx, [rdx - 0x10000]
cmove rcx, r10
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r10
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006e213
test r8, r8
je 0x14006e213
movzx eax, word [rbx]
test ax, ax
je 0x14006e213
add rbx, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006e1f2
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r10w
mov ebx, dword [r12 + 0x3e4]
lea rcx, [rbp + 0xba0]
call fcn.14001fb40
nop
xor eax, eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], eax
mov ecx, 1
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1400584f0
nop
lea rcx, [rbp + 0xba0]
call fcn.14001feb0
mov rax, qword [rbp - 0x70]
cmp dword [rax - 8], 1
jle 0x14006e2c9
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000dd30
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x70]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006e304
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006e304
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006e2e1
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor r10d, r10d
mov word [rax], r10w
mov rdx, r15
lea rax, [rbp + 0x212a0]
cmp word [rax], r10w
je 0x14006e330
add rax, 2
sub rdx, 1
jne 0x14006e320
lea rbx, [0x1402f6720]
test rdx, rdx
je 0x14006e3a1
mov r8, r14
mov r9, rbx
lea rcx, [rdx - 0x10000]
cmove rcx, r10
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r10
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006e392
nop dword [rax]
test r8, r8
je 0x14006e392
movzx eax, word [r9]
test ax, ax
je 0x14006e392
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006e370
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r10w
mov rax, qword [rdi]
cmp dword [rax - 8], 1
jle 0x14006e3b8
mov edx, dword [rax - 0x10]
mov rcx, rdi
call fcn.14000dd30
xor r10d, r10d
mov r8, qword [rdi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006e3f3
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006e3f3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006e3d0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r10w
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop dword [rax]
cmp word [rax], 0
je 0x14006e420
add rax, 2
sub rdx, 1
jne 0x14006e410
test rdx, rdx
je 0x14006e482
mov r8, r14
lea rcx, [rdx - 0x10000]
cmove rcx, r10
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r10
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006e473
test r8, r8
je 0x14006e473
movzx eax, word [rbx]
test ax, ax
je 0x14006e473
add rbx, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006e452
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r10w
mov ebx, dword [r12 + 0x3e4]
lea rcx, [rbp + 0xc10]
call fcn.14001fb40
nop
xor eax, eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], eax
mov eax, 1
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1400584f0
nop
lea rcx, [rbp + 0xc10]
call fcn.14001feb0
mov rdi, qword [rbp + 0x168]
test rdi, rdi
je 0x14006e57a
mov r13d, dword [rbp - 0x80]
lea esi, [rbx + 1]
nop dword [rax + rax]
mov rbx, qword [rdi + 0x10]
mov rdi, qword [rdi]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006e554
mov dword [rax + 0x20], r13d
mov dword [rax + 0x24], esi
cmp dword [rbx + 0x30], 0
je 0x14006e563
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov rcx, rbx
call fcn.14005dc90
test rdi, rdi
jne 0x14006e530
lea r13, [rdi - 1]
mov rsi, qword [rbp - 0x40]
xor ebx, ebx
mov rcx, qword [r12 + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14006e75b
lea rdi, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x160], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x170], rbx
mov qword [rbp + 0x168], rbx
mov rcx, qword [rbp + 0x188]
call fcn.1400ad45c
mov qword [rbp + 0x188], rbx
lea rcx, [rbp + 0x540]
call fcn.1400a6500
nop
mov qword [rbp + 0x198], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1a8], rbx
mov qword [rbp + 0x1a0], rbx
mov rcx, qword [rbp + 0x1c0]
call fcn.1400ad45c
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x100], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x108], rbx
mov rcx, qword [rbp + 0x128]
call fcn.1400ad45c
mov qword [rbp + 0x128], rbx
lea rcx, [rbp + 0x568]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x380]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x590]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x518]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x3a8]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x1d0]
call fcn.1400a6500
nop
mov qword [rbp + 8], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x10], rbx
mov rcx, qword [rbp + 0x30]
call fcn.1400ad45c
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0xa8], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0xb0], rbx
mov rcx, qword [rbp + 0xd0]
call fcn.1400ad45c
mov qword [rbp + 0xd0], rbx
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e705
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
lea rcx, [rbp + 0x408]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x4f0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x40]
call fcn.1400a6500
nop
mov qword [rbp + 0x70], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x78], rbx
mov rcx, qword [rbp + 0x98]
call fcn.1400ad45c
mov qword [rbp + 0x98], rbx
jmp 0x14006f70a
mov rax, qword [rbp - 0x70]
cmp dword [rax - 8], 1
jle 0x14006e771
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000dd30
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x70]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006e7b3
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006e7b3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006e790
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], bx
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006e7e0
add rax, 2
sub rdx, 1
jne 0x14006e7d0
lea rbx, [0x1402f66a0]
test rdx, rdx
je 0x14006e853
mov r8, r14
mov r9, rbx
lea rcx, [rdx - 0x10000]
mov r10d, 0
cmove rcx, r10
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r10
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006e844
test r8, r8
je 0x14006e844
movzx eax, word [r9]
test ax, ax
je 0x14006e844
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006e822
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r10w
mov rdi, qword [rbp - 0x20]
mov rax, qword [rdi]
cmp dword [rax - 8], 1
jle 0x14006e86b
mov edx, dword [rax - 0x10]
mov rcx, rdi
call fcn.14000dd30
mov r8, qword [rdi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006e8a5
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006e8a5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006e882
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor r9d, r9d
mov word [rax], r9w
mov rdx, r15
lea rax, [rbp + 0x12a0]
cmp word [rax], r9w
je 0x14006e8d1
add rax, 2
sub rdx, 1
jne 0x14006e8c1
test rdx, rdx
je 0x14006e933
mov r8, r14
lea rcx, [rdx - 0x10000]
cmove rcx, r9
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r9
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006e924
test r8, r8
je 0x14006e924
movzx eax, word [rbx]
test ax, ax
je 0x14006e924
add rbx, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006e903
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r9w
mov ebx, dword [r12 + 0x3e4]
mov rdi, qword [r12 + 0x3f0]
lea rcx, [rbp + 0xc80]
call fcn.14001fb40
nop
mov eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rbp + 0x3a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1400578a0
nop
lea rcx, [rbp + 0xc80]
call fcn.14001feb0
mov rax, qword [rbp - 0x70]
cmp dword [rax - 8], 1
jle 0x14006e9d7
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000dd30
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x70]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006ea13
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006ea13
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006e9f0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor r10d, r10d
mov word [rax], r10w
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop
cmp word [rax], r10w
je 0x14006ea40
add rax, 2
sub rdx, 1
jne 0x14006ea30
lea rbx, [0x1402f6640]
test rdx, rdx
je 0x14006eab1
mov r8, r14
mov r9, rbx
lea rcx, [rdx - 0x10000]
cmove rcx, r10
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r10
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006eaa2
nop dword [rax]
test r8, r8
je 0x14006eaa2
movzx eax, word [r9]
test ax, ax
je 0x14006eaa2
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006ea80
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r10w
mov rdi, qword [rbp - 0x20]
mov rax, qword [rdi]
cmp dword [rax - 8], 1
jle 0x14006eacc
mov edx, dword [rax - 0x10]
mov rcx, rdi
call fcn.14000dd30
xor r10d, r10d
mov r8, qword [rdi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006eb06
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14006eb06
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006eae3
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r10w
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop
cmp word [rax], 0
je 0x14006eb30
add rax, 2
sub rdx, 1
jne 0x14006eb20
test rdx, rdx
je 0x14006eb92
mov r8, r14
lea rcx, [rdx - 0x10000]
cmove rcx, r10
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r10
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006eb83
test r8, r8
je 0x14006eb83
movzx eax, word [rbx]
test ax, ax
je 0x14006eb83
add rbx, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006eb62
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r10w
mov ebx, dword [r12 + 0x3e4]
mov rdi, qword [r12 + 0x3f0]
lea rcx, [rbp + 0xcf0]
call fcn.14001fb40
nop
mov eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rbp + 0x3a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1400578a0
nop
lea rcx, [rbp + 0xcf0]
call fcn.14001feb0
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x2d0], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2e8], xmm0
xor edi, edi
mov qword [rbp + 0x2e0], rdi
mov qword [rbp + 0x2d8], rdi
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0x2f8], xmm0
mov rax, qword [rbp - 0x78]
cmp dword [rax - 8], 1
jle 0x14006ec6f
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000dd30
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x78]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006ecb3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14006ecb3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006ec90
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006ece0
add rax, 2
sub rdx, 1
jne 0x14006ecd0
lea rbx, str.AppID
test rdx, rdx
je 0x14006ed50
mov r8, r14
mov r9, rbx
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006ed42
nop dword [rax]
test r8, r8
je 0x14006ed42
movzx eax, word [r9]
test ax, ax
je 0x14006ed42
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006ed20
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov rax, qword [rsi]
cmp dword [rax - 8], 1
jle 0x14006ed64
mov edx, dword [rax - 0x10]
mov rcx, rsi
call fcn.14000dd30
mov r8, qword [rsi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006eda3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14006eda3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006ed80
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006edd0
add rax, 2
sub rdx, 1
jne 0x14006edc0
test rdx, rdx
je 0x14006ee31
mov r8, r14
lea rcx, [rdx - 0x10000]
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006ee23
test r8, r8
je 0x14006ee23
movzx eax, word [rbx]
test ax, ax
je 0x14006ee23
add rbx, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006ee02
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
mov ebx, dword [r12 + 0x3e4]
lea rcx, [rbp + 0xd60]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], edi
mov eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x518]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1400584f0
nop
lea rcx, [rbp + 0xd60]
call fcn.14001feb0
mov rdi, qword [rbp + 0x2d8]
test rdi, rdi
je 0x14006ef1f
mov r13d, dword [rbp - 0x80]
lea esi, [rbx + 1]
mov rbx, qword [rdi + 0x10]
mov rdi, qword [rdi]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006eef9
mov dword [rax + 0x20], r13d
mov dword [rax + 0x24], esi
cmp dword [rbx + 0x30], 0
je 0x14006ef08
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov rcx, rbx
call fcn.14005dc90
test rdi, rdi
jne 0x14006eed5
lea r13, [rdi - 1]
mov rsi, qword [rbp - 0x40]
xor ebx, ebx
mov rcx, qword [r12 + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14006f133
lea rdi, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x2d0], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2e8], xmm0
mov qword [rbp + 0x2e0], rbx
mov qword [rbp + 0x2d8], rbx
mov rcx, qword [rbp + 0x2f8]
call fcn.1400ad45c
mov qword [rbp + 0x2f8], rbx
mov qword [rbp + 0x160], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x170], rbx
mov qword [rbp + 0x168], rbx
mov rcx, qword [rbp + 0x188]
call fcn.1400ad45c
mov qword [rbp + 0x188], rbx
lea rcx, [rbp + 0x540]
call fcn.1400a6500
nop
mov qword [rbp + 0x198], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1a8], rbx
mov qword [rbp + 0x1a0], rbx
mov rcx, qword [rbp + 0x1c0]
call fcn.1400ad45c
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x100], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x108], rbx
mov rcx, qword [rbp + 0x128]
call fcn.1400ad45c
mov qword [rbp + 0x128], rbx
lea rcx, [rbp + 0x568]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x380]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x590]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x518]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x3a8]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x1d0]
call fcn.1400a6500
nop
mov qword [rbp + 8], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x10], rbx
mov rcx, qword [rbp + 0x30]
call fcn.1400ad45c
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0xa8], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0xb0], rbx
mov rcx, qword [rbp + 0xd0]
call fcn.1400ad45c
mov qword [rbp + 0xd0], rbx
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f0dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
lea rcx, [rbp + 0x408]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x4f0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x40]
call fcn.1400a6500
nop
mov qword [rbp + 0x70], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x78], rbx
mov rcx, qword [rbp + 0x98]
call fcn.1400ad45c
mov qword [rbp + 0x98], rbx
jmp 0x14006f70a
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x3d0], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3e8], xmm0
mov qword [rbp + 0x3e0], rbx
mov qword [rbp + 0x3d8], rbx
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0x3f8], xmm0
lea rdx, [rbp + 0x3a8]
lea rcx, [rbp + 0x380]
call fcn.1400a659c
mov rax, qword [rbp - 0x78]
cmp dword [rax - 8], 1
jle 0x14006f193
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000dd30
mov rdx, r15
lea rcx, [rbp + 0x212a0]
lea rax, [rbp + 0x212a0]
mov r8, qword [rbp - 0x78]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006f1d3
movzx eax, word [rcx + r8]
test ax, ax
je 0x14006f1d3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006f1b0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], bx
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006f200
add rax, 2
sub rdx, 1
jne 0x14006f1f0
lea rbx, str.Interface
test rdx, rdx
je 0x14006f273
mov r8, r14
mov r9, rbx
lea rcx, [rdx - 0x10000]
mov edi, 0
cmove rcx, rdi
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, rdi
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006f263
test r8, r8
je 0x14006f263
movzx eax, word [r9]
test ax, ax
je 0x14006f263
add r9, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006f241
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], di
jmp 0x14006f275
xor edi, edi
mov rax, qword [rsi]
cmp dword [rax - 8], 1
jle 0x14006f289
mov edx, dword [rax - 0x10]
mov rcx, rsi
call fcn.14000dd30
mov r8, qword [rsi]
mov rdx, r15
lea rcx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14006f2c3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14006f2c3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14006f2a0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
mov rdx, r15
lea rax, [rbp + 0x12a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006f2f0
add rax, 2
sub rdx, 1
jne 0x14006f2e0
test rdx, rdx
je 0x14006f35a
mov r8, r14
lea rcx, [rdx - 0x10000]
mov r14d, 0
cmove rcx, r14
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r14
lea rdx, [rbp + 0x12a0]
add rdx, rax
add rcx, r15
je 0x14006f349
test r8, r8
je 0x14006f349
movzx eax, word [rbx]
test ax, ax
je 0x14006f349
add rbx, 2
mov word [rdx], ax
add rdx, 2
dec r8
sub rcx, 1
jne 0x14006f328
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r14w
jmp 0x14006f35d
xor r14d, r14d
mov ebx, dword [r12 + 0x3e4]
lea rcx, [rbp + 0xdd0]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], r14d
mov eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], 0x1e
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x380]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x212a0]
lea r8, [rbp + 0x12a0]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1400584f0
nop
lea rcx, [rbp + 0xdd0]
call fcn.14001feb0
mov rdi, qword [rbp + 0x3d8]
test rdi, rdi
je 0x14006f4c7
nop
mov rbx, qword [rdi + 0x10]
mov rdi, qword [rdi]
lea rcx, [rbx + 0x10]
call fcn.140055e30
xor ecx, ecx
mov esi, ecx
test al, al
mov eax, 1
cmovne esi, eax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006fd32
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x290], rax
lea edx, [rsi + 6]
lea r8, [rbp + 0x290]
mov rcx, qword [rbx + 0x10]
call fcn.14002f3b0
mov rdx, qword [rbp + 0x290]
mov rcx, qword [r12 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14006f47a
mov ecx, dword [rbp - 0x80]
mov dword [rax + 0x20], ecx
mov ecx, 1
mov dword [rax + 0x24], ecx
cmp dword [rbx + 0x30], 0
je 0x14006f489
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov rcx, rbx
call fcn.14005dc90
nop
mov rdx, qword [rbp + 0x290]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f4b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
test rdi, rdi
jne 0x14006f400
mov rsi, qword [rbp - 0x40]
xor r14d, r14d
mov rcx, qword [r12 + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
test eax, eax
jne 0x14006f7a6
lea rbx, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x3d0], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3e8], xmm0
mov qword [rbp + 0x3e0], r14
mov qword [rbp + 0x3d8], r14
mov rcx, qword [rbp + 0x3f8]
call fcn.1400ad45c
mov qword [rbp + 0x3f8], r14
mov qword [rbp + 0x2d0], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2e8], xmm0
mov qword [rbp + 0x2e0], r14
mov qword [rbp + 0x2d8], r14
mov rcx, qword [rbp + 0x2f8]
call fcn.1400ad45c
mov qword [rbp + 0x2f8], r14
mov qword [rbp + 0x160], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x168], r14
mov rcx, qword [rbp + 0x188]
call fcn.1400ad45c
mov qword [rbp + 0x188], r14
lea rcx, [rbp + 0x540]
call fcn.1400a6500
nop
mov qword [rbp + 0x198], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1a8], r14
mov qword [rbp + 0x1a0], r14
mov rcx, qword [rbp + 0x1c0]
call fcn.1400ad45c
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x100], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x108], r14
mov rcx, qword [rbp + 0x128]
call fcn.1400ad45c
mov qword [rbp + 0x128], r14
lea rcx, [rbp + 0x568]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x380]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x590]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x518]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x3a8]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x1d0]
call fcn.1400a6500
nop
mov qword [rbp + 8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x10], r14
mov rcx, qword [rbp + 0x30]
call fcn.1400ad45c
mov qword [rbp + 0x30], r14
mov qword [rbp + 0xa8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xb8], r14
mov qword [rbp + 0xb0], r14
mov rcx, qword [rbp + 0xd0]
call fcn.1400ad45c
mov qword [rbp + 0xd0], r14
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f6b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
lea rcx, [rbp + 0x408]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x4f0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x40]
call fcn.1400a6500
nop
mov qword [rbp + 0x70], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x78], r14
mov rcx, qword [rbp + 0x98]
call fcn.1400ad45c
mov qword [rbp + 0x98], r14
lea rcx, [rbp + 0x430]
call fcn.1400a6500
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f73a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f75d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdi, qword [rbp - 0x20]
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f783
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14006f79f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14006fd08
lea rbx, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0x3d0], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3e8], xmm0
mov qword [rbp + 0x3e0], r14
mov qword [rbp + 0x3d8], r14
mov rcx, qword [rbp + 0x3f8]
call fcn.1400ad45c
mov qword [rbp + 0x3f8], r14
mov qword [rbp + 0x2d0], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2e8], xmm0
mov qword [rbp + 0x2e0], r14
mov qword [rbp + 0x2d8], r14
mov rcx, qword [rbp + 0x2f8]
call fcn.1400ad45c
mov qword [rbp + 0x2f8], r14
mov qword [rbp + 0x160], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x168], r14
mov rcx, qword [rbp + 0x188]
call fcn.1400ad45c
mov qword [rbp + 0x188], r14
lea rcx, [rbp + 0x540]
call fcn.1400a6500
nop
mov qword [rbp + 0x198], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1a8], r14
mov qword [rbp + 0x1a0], r14
mov rcx, qword [rbp + 0x1c0]
call fcn.1400ad45c
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x100], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x108], r14
mov rcx, qword [rbp + 0x128]
call fcn.1400ad45c
mov qword [rbp + 0x128], r14
lea rcx, [rbp + 0x568]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x380]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x590]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x518]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x3a8]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x1d0]
call fcn.1400a6500
nop
mov qword [rbp + 8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x10], r14
mov rcx, qword [rbp + 0x30]
call fcn.1400ad45c
mov qword [rbp + 0x30], r14
mov qword [rbp + 0xa8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xb8], r14
mov qword [rbp + 0xb0], r14
mov rcx, qword [rbp + 0xd0]
call fcn.1400ad45c
mov qword [rbp + 0xd0], r14
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f97e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
call r8
nop
lea rcx, [rbp + 0x408]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x4f0]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x40]
call fcn.1400a6500
nop
mov qword [rbp + 0x70], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x78], r14
mov rcx, qword [rbp + 0x98]
call fcn.1400ad45c
mov qword [rbp + 0x98], r14
jmp 0x14006f9d8
mov r12, qword [rbp - 0x60]
xor r14d, r14d
lea rcx, [rbp + 0x5c8]
call fcn.1400a64e0
nop
mov dword [rbp + 0x2b0], r14d
lea rdx, [r12 + 0x198]
lea rcx, [rbp + 0x5c8]
call fcn.1400a659c
mov rax, qword [rbp - 0x78]
cmp dword [rax - 8], 1
jle 0x14006fa1a
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000dd30
mov rax, qword [rbp - 0x78]
mov r8, r15
lea rdx, [rbp + 0x212a0]
lea rcx, [rbp + 0x212a0]
sub rax, rcx
nop
lea rcx, [r8 + 0x7ffefffe]
test rcx, rcx
je 0x14006fa52
movzx ecx, word [rdx + rax]
test cx, cx
je 0x14006fa52
mov word [rdx], cx
add rdx, 2
sub r8, 1
jne 0x14006fa30
lea rax, [rdx - 2]
test r8, r8
cmovne rax, rdx
mov word [rax], r14w
mov rdx, r15
lea rax, [rbp + 0x212a0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14006fa80
add rax, 2
sub rdx, 1
jne 0x14006fa70
lea rbx, str.Local_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov edi, 0x7ffffffe
test rdx, rdx
je 0x14006faf2
mov r8d, edi
mov r9, rbx
lea rcx, [rdx - 0x10000]
cmove rcx, r14
mov rax, r15
sub rax, rdx
add rax, rax
test rdx, rdx
cmove rax, r14
lea rdx, [rbp + 0x212a0]
add rdx, rax
add rcx, r15
je 0x14006fae3
mov rax, qword [rsi]
cmp dword [rax - 8], 1
jle 0x14006fb06
mov rcx, qword [rbp + 0x412a0]
xor rcx, rsp
call fcn.1402155d0
mov rbx, qword [rsp + 0x41408]
add rsp, 0x413b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
int3
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
int3
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
int3