Function at 0x14007f080
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230b0]
mov eax, 0x231b0
call fcn.140216080
sub rsp, rax
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x230a0], rax
mov esi, edx
mov dword [rbp - 0x68], edx
mov r14, rcx
mov qword [rbp - 0x60], rcx
xor r13d, r13d
mov dword [rbp - 0x80], r13d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x430], xmm0
movups xmmword [rbp + 0x440], xmm0
movups xmmword [rbp + 0x450], xmm0
movups xmmword [rbp + 0x460], xmm0
movups xmmword [rbp + 0x470], xmm0
movups xmmword [rbp + 0x480], xmm0
mov dword [rbp + 0x490], eax
lea r8, [rbp + 0x430]
mov rdx, qword [rcx + 0x3c0]
call fcn.14005f870
test eax, eax
je 0x1400813bc
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140081402
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x38]
call fcn.140032290
lea r12, [r13 - 1]
test eax, eax
jne 0x14007f1e3
lea rdx, [rbp + 0xd8]
call fcn.14005fc00
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14007f1c2
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x14007f1b4
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007f1b4
call fcn.14000de80
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14007f1aa
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x38], rax
jmp 0x14007f1c2
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x38]
call fcn.14000df90
nop
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007f1e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbp + 0x48], 0xffffffff80000001
movups xmm0, xmmword [str.REGISTRYHKEY_CURRENT_USER_]
movaps xmmword [rbp + 0x4a0], xmm0
movups xmm1, xmmword [0x1402f6b58]
movaps xmmword [rbp + 0x4b0], xmm1
movups xmm0, xmmword [0x1402f6b68]
movaps xmmword [rbp + 0x4c0], xmm0
movsd xmm1, qword [0x1402f6b78]
movsd qword [rbp + 0x4d0], xmm1
xor edx, edx
mov r8d, 0x3c8
lea rcx, [rbp + 0x4d8]
call fcn.140241ba0
lea rcx, [rbp + 0x270]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x14007f280
lea r8, [0x1402e82f0]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x4a0]
call fcn.140057530
mov rbx, 0xffffffff80000001
cmp eax, 1
cmove rbx, qword [rbp + 0x278]
mov qword [rbp + 0x48], rbx
mov ecx, r13d
mov dword [rbp - 4], ecx
mov edx, 0x20219
mov edi, 0x20119
test ecx, ecx
cmovne edi, edx
mov dword [rbp - 0x70], edi
mov eax, r13d
sete al
mov dword [rbp - 0xc], eax
mov eax, ecx
neg eax
sbb r13d, r13d
add r13d, 2
mov dword [rbp - 0x6c], r13d
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x1400813f7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x20], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x1400813ec
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x78], rbx
xor ecx, ecx
mov r15d, ecx
mov dword [rbp - 0x48], ecx
test r15d, r15d
jne 0x14007f314
lea r8d, [r15 + 0x4f]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products_
lea rcx, [rbp - 0x78]
call fcn.14000df90
jmp 0x14007f487
mov rdi, qword [rbp - 0x38]
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x14007f32c
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14007f33c
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x14008153a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x50], rax
or dword [rbp - 0x80], 1
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, 0x3d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData_
lea rcx, [rbp + 0x50]
call fcn.1400220f0
nop
mov rdi, qword [rbp + 0x50]
lea r14, [rdi - 0x18]
mov rcx, qword [r14]
test rcx, rcx
je 0x14007f396
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14007f3a6
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x14008152f
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x58], rax
or dword [rbp - 0x80], 2
mov dword [rsp + 0x20], 0xa
lea r9, str.Products_
mov r8d, dword [r14 + 8]
mov rdx, rdi
lea rcx, [rbp + 0x58]
call fcn.1400220f0
mov rdx, qword [rbp + 0x58]
lea rdi, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rdi, rbx
je 0x14007f445
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x14007f438
mov rax, qword [rbx]
cmp qword [rdi], rax
jne 0x14007f438
mov rcx, rdi
call fcn.14000de80
mov rsi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14007f42b
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x78], rax
mov esi, dword [rbp - 0x68]
jmp 0x14007f445
mov r8d, dword [rdi + 8]
lea rcx, [rbp - 0x78]
call fcn.14000df90
and dword [rbp - 0x80], 0xfffffffd
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x14007f462
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
and dword [rbp - 0x80], 0xfffffffe
mov eax, r12d
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x14007f480
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rbp - 0x70]
mov r14, qword [rbp - 0x60]
lea rcx, [rbp + 0x430]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007f491
mov r8d, eax
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x78]
call fcn.1400157c0
mov rbx, qword [rbp - 0x78]
test esi, esi
je 0x14007fd03
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007fd03
lea rsi, [rbx - 0x18]
mov rdi, qword [rbp - 0x20]
add rdi, 0xffffffffffffffe8
cmp rsi, rdi
je 0x14007f543
mov eax, dword [rdi + 0x10]
shr eax, 0x1f
test al, al
jne 0x14007f533
mov rax, qword [rdi]
cmp qword [rsi], rax
jne 0x14007f533
mov rcx, rsi
call fcn.14000de80
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14007f529
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x20], rax
jmp 0x14007f543
mov r8d, dword [rsi + 8]
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14000df90
lea r8, str.REGISTRYHKEY_LOCAL_MACHINE_
lea rcx, [rbp - 0x20]
call fcn.140021fb0
mov rdx, qword [rbp - 0x20]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14007f573
mov dword [rax + 0x20], r13d
mov dword [rax + 0x24], 1
mov rcx, rsi
call fcn.14000de80
add rax, 0x18
mov qword [rbp + 0x40], rax
mov r8d, FDICreate
lea rdx, str.InstallProperties
lea rcx, [rbp + 0x40]
call fcn.1400157c0
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x70]
xor r8d, r8d
mov rdx, qword [rbp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007f8c4
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x8a0]
call fcn.140241ba0
mov dword [rbp + 0x28], 0x800
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x8a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LocalPackage
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007f8c4
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140081423
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x18], rax
lea rax, [rbp + 0x8a0]
cmp rax, 0x10000
jae 0x14007f65a
lea rax, [rbp + 0x8a0]
movzx edx, ax
lea rcx, [rbp + 0x18]
call fcn.14000d610
jmp 0x14007f682
lea rcx, [rbp + 0x8a0]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007f664
mov r8d, eax
lea rdx, [rbp + 0x8a0]
lea rcx, [rbp + 0x18]
call fcn.14000df90
nop
xor esi, esi
mov dword [rbp - 0x18], esi
mov rbx, qword [rbp + 0x18]
lea rcx, [rbx - 0x18]
call fcn.14000de80
add rax, 0x18
mov qword [rbp + 0x60], rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x60]
call fcn.140034860
test eax, eax
je 0x14007f6d6
cmp dword [rbp - 0x18], esi
jne 0x14007f6ea
mov eax, r12d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14007f8c6
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14007f8c6
lea r8, [0x1402ee008]
lea rcx, [rbp + 0x18]
call fcn.140021fb0
mov rbx, qword [rbp + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007f701
test al, 0x10
mov edi, 1
je 0x14007f703
mov edi, esi
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007f71d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
je 0x14007f8c6
lea rdx, [r14 + 0x240]
lea r8, str.Installer_
lea rcx, [rbp - 0x28]
call fcn.140021ef0
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140081418
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea rax, [rbp + 0x8a0]
cmp rax, 0x10000
jae 0x14007f780
lea rax, [rbp + 0x8a0]
movzx edx, ax
lea rcx, [rbp]
call fcn.14000d610
jmp 0x14007f7ae
lea rcx, [rbp + 0x8a0]
mov rax, r12
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007f790
mov r8d, eax
lea rdx, [rbp + 0x8a0]
lea rcx, [rbp]
call fcn.14000df90
nop
mov rcx, qword [rbp - 0x28]
movsxd rbx, dword [rcx - 0x10]
test ebx, ebx
js 0x14008140d
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, ebx
or eax, edx
jge 0x14007f7de
mov edx, ebx
lea rcx, [rbp - 0x28]
call fcn.14000df10
mov rcx, qword [rbp - 0x28]
lea eax, [rbx + 1]
movsxd rdx, eax
call fcn.1402575d4
mov rax, qword [rbp - 0x28]
cmp ebx, dword [rax - 0xc]
jg 0x14008140d
mov dword [rax - 0x10], ebx
mov rax, qword [rbp - 0x28]
mov word [rax + rbx*2], si
mov rbx, qword [rbp]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x14008140d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14007f831
mov edx, edi
lea rcx, [rbp]
call fcn.14000df10
mov rbx, qword [rbp]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1402575d4
cmp edi, dword [rbx - 0xc]
jg 0x14008140d
mov dword [rbx - 0x10], edi
xor ecx, ecx
mov word [rbx + rdi*2], cx
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x14007f88a
cmp dword [rbx - 0x10], ecx
jl 0x14007f88a
mov rcx, rbx
call fcn.14024112c
test rax, rax
je 0x14007f88a
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14007f88a
xor r8d, r8d
lea rdx, [rbp + 0x8a0]
mov rcx, r14
call fcn.14005e2b0
nop
mov eax, r12d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14007f8a6
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007f8c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor esi, esi
mov r8d, 8
lea rdx, str.Patches
lea rcx, [rbp - 0x78]
call fcn.1400157c0
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x70]
xor r8d, r8d
mov rbx, qword [rbp - 0x78]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007fcd3
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x20a0]
call fcn.140241ba0
mov dword [rbp + 0x2c], 0x1000
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AllPatches
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007fcc9
lea rcx, [rbp + 0xe8]
call fcn.1400a64e0
nop
lea rdi, [rbp + 0x20a0]
nop dword [rax + rax]
mov rax, r12
inc rax
cmp word [rdi + rax*2], 0
jne 0x14007f973
test rax, rax
je 0x14007f998
mov r8, rdi
mov rdx, qword [rbp + 0xf8]
lea rcx, [rbp + 0xe8]
call fcn.1400a6854
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14007f9a0
inc eax
movsxd rcx, eax
lea rdi, [rdi + rcx*2]
lea esi, [rsi + rax*2]
add esi, 2
cmp esi, 0x800
jb 0x14007f970
xor eax, eax
mov r13d, eax
mov r12d, eax
cmp qword [rbp + 0xf8], rax
jle 0x14007fcb2
lea rax, [rbx - 0x18]
mov qword [rbp - 0x50], rax
xor r15d, r15d
mov rcx, rax
call fcn.14000de80
add rax, 0x18
mov qword [rbp - 0x40], rax
test r12, r12
js 0x140081455
cmp r12, qword [rbp + 0xf8]
jge 0x140081455
mov rax, qword [rbp + 0xf0]
mov rdx, qword [rax + r12*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x40]
call fcn.1400157c0
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov edi, dword [rbp - 0x70]
mov r9d, edi
xor r8d, r8d
mov rbx, qword [rbp - 0x40]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007fb25
mov edi, dword [rbx - 0x10]
mov esi, edi
test edi, edi
cmovns esi, r15d
add edi, 0x1c
js 0x14008144a
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14007fa81
mov edx, edi
lea rcx, [rbp - 0x40]
call fcn.14000df10
mov rbx, qword [rbp - 0x40]
mov eax, edi
sub eax, esi
sub eax, 0x1b
movsxd r8, eax
add r8, r8
movsxd rax, esi
lea rsi, [rbx + rax*2]
lea rcx, [rsi + 0x38]
je 0x14007fab5
test rcx, rcx
je 0x14008142e
test rsi, rsi
je 0x14008142e
mov rdx, rsi
call fcn.1402414f0
mov r9d, 0x38
lea r8, str.REGISTRYHKEY_LOCAL_MACHINE_
mov edx, r9d
mov rcx, rsi
call fcn.140007f60
test eax, eax
je 0x14007fae3
cmp eax, 0xc
je 0x140081444
cmp eax, 0x50
jne 0x140081455
cmp edi, dword [rbx - 0xc]
jg 0x14008144a
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], r15w
mov rdx, rbx
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14007fb18
mov ecx, dword [rbp - 0x6c]
mov dword [rax + 0x20], ecx
mov dword [rax + 0x24], 1
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [rbp - 0x70]
mov r8d, 0x23
lea rdx, str.SOFTWAREClassesInstallerPatches_
lea rcx, [rbp - 0x40]
call fcn.14000df90
cmp r12, qword [rbp + 0xf8]
jge 0x140081455
mov rax, qword [rbp + 0xf0]
mov rdx, qword [rax + r12*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x40]
call fcn.1400157c0
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rbx, qword [rbp - 0x40]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007fc78
movsxd r15, dword [rbx - 0x10]
mov esi, r15d
test r15d, r15d
mov ecx, 0
cmovns esi, ecx
mov r14d, r15d
mov edi, r15d
add r14d, 0x1c
js 0x14008144a
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14007fbcf
mov edx, r14d
lea rcx, [rbp - 0x40]
call fcn.14000df10
mov rbx, qword [rbp - 0x40]
sub edi, esi
inc edi
movsxd r8, edi
add r8, r8
movsxd rax, esi
lea rdi, [rbx + rax*2]
lea rcx, [rdi + 0x38]
je 0x14007fc00
test rcx, rcx
je 0x14008142e
test rdi, rdi
je 0x14008142e
mov rdx, rdi
call fcn.1402414f0
mov r9d, 0x38
lea r8, str.REGISTRYHKEY_LOCAL_MACHINE_
mov edx, r9d
mov rcx, rdi
call fcn.140007f60
test eax, eax
je 0x14007fc2e
cmp eax, 0xc
je 0x140081444
cmp eax, 0x50
jne 0x140081455
cmp r14d, dword [rbx - 0xc]
jg 0x14008144a
mov dword [rbx - 0x10], r14d
mov rax, r15
xor r15d, r15d
mov word [rbx + rax*2 + 0x38], r15w
mov rdx, rbx
mov r14, qword [rbp - 0x60]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14007fc6d
mov ecx, dword [rbp - 0x6c]
mov dword [rax + 0x20], ecx
mov dword [rax + 0x24], 1
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007fc94
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r13d
inc r12
movsxd rax, r13d
cmp rax, qword [rbp + 0xf8]
mov rax, qword [rbp - 0x50]
jl 0x14007f9e1
mov r15d, dword [rbp - 0x48]
lea rcx, [rbp + 0xe8]
call fcn.1400a6500
mov r12, 0xffffffffffffffff
mov r13d, dword [rbp - 0x6c]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007fcfc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, dword [rbp - 0x68]
mov rbx, qword [rbp - 0x78]
inc r15d
mov dword [rbp - 0x48], r15d
cmp r15d, 2
mov edi, dword [rbp - 0x70]
jl 0x14007f2f6
test esi, esi
je 0x14007fdc0
mov r8d, 0x24
lea rdx, str.SOFTWAREClassesInstallerProducts_
lea rcx, [rbp - 0x78]
call fcn.14000df90
lea rcx, [rbp + 0x430]
mov rax, r12
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007fd40
mov r8d, eax
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x78]
call fcn.1400157c0
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r15d, edi
mov r9d, edi
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007fdc3
lea r8, str.REGISTRYHKEY_LOCAL_MACHINE_
lea rcx, [rbp - 0x78]
call fcn.140021fb0
mov rdx, qword [rbp - 0x78]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14007fdb4
mov dword [rax + 0x20], r13d
mov dword [rax + 0x24], 1
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007fdc3
mov r15d, edi
mov r8d, 0x26
lea rdx, str.SoftwareMicrosoftInstallerProducts_
lea rcx, [rbp - 0x78]
call fcn.14000df90
lea rcx, [rbp + 0x430]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007fde3
mov r8d, eax
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x78]
call fcn.1400157c0
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
mov rbx, qword [rbp - 0x78]
mov rdx, rbx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007ff2f
mov esi, dword [rbx - 0x10]
mov r15d, esi
test esi, esi
mov eax, 0
cmovns r15d, eax
lea rax, [rbp + 0x4a0]
mov rdi, r12
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14007fe43
mov r14d, esi
test edi, edi
jle 0x14007fefb
add esi, edi
js 0x140081477
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x14007fe80
mov edx, esi
lea rcx, [rbp - 0x78]
call fcn.14000df10
mov rbx, qword [rbp - 0x78]
sub r14d, r15d
inc r14d
movsxd r8, r14d
add r8, r8
movsxd rax, r15d
lea r14, [rbx + rax*2]
movsxd rdi, edi
lea rax, [rdi + rax]
lea rcx, [rbx + rax*2]
je 0x14007feba
test rcx, rcx
je 0x14008145b
test r14, r14
je 0x14008145b
mov rdx, r14
call fcn.1402414f0
lea rdx, [rdi + rdi]
mov r9, rdx
lea r8, [rbp + 0x4a0]
mov rcx, r14
call fcn.140007f60
test eax, eax
je 0x14007fee6
cmp eax, 0xc
je 0x140081471
cmp eax, 0x50
jne 0x1400814af
cmp esi, dword [rbx - 0xc]
jg 0x140081477
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor ecx, ecx
mov word [rbx + rax*2], cx
mov rdx, rbx
mov r14, qword [rbp - 0x60]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14007ff1e
mov dword [rax + 0x20], r13d
mov dword [rax + 0x24], 1
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, dword [rbp - 0x70]
mov esi, dword [rbp - 0x68]
test esi, esi
je 0x14007ffdb
mov r8d, 0x24
lea rdx, str.SOFTWAREClassesInstallerFeatures_
lea rcx, [rbp - 0x78]
call fcn.14000df90
lea rcx, [rbp + 0x430]
mov rax, r12
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14007ff60
mov r8d, eax
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x78]
call fcn.1400157c0
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007ffdb
lea r8, str.REGISTRYHKEY_LOCAL_MACHINE_
lea rcx, [rbp - 0x78]
call fcn.140021fb0
mov rdx, qword [rbp - 0x78]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14007ffd1
mov dword [rax + 0x20], r13d
mov dword [rax + 0x24], 1
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x26
lea rdx, str.SoftwareMicrosoftInstallerFeatures_
lea rcx, [rbp - 0x78]
call fcn.14000df90
lea rcx, [rbp + 0x430]
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140080000
mov r8d, eax
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x78]
call fcn.1400157c0
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
mov rdi, qword [rbp - 0x78]
mov rdx, rdi
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008014c
mov esi, dword [rdi - 0x10]
mov r15d, esi
test esi, esi
mov eax, 0
cmovns r15d, eax
lea rax, [rbp + 0x4a0]
mov rbx, r12
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140080060
mov r14d, esi
test ebx, ebx
jle 0x140080118
add esi, ebx
js 0x140081477
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, ecx
jge 0x14008009d
mov edx, esi
lea rcx, [rbp - 0x78]
call fcn.14000df10
mov rdi, qword [rbp - 0x78]
sub r14d, r15d
inc r14d
movsxd r8, r14d
add r8, r8
movsxd rax, r15d
lea r14, [rdi + rax*2]
movsxd rbx, ebx
lea rax, [rbx + rax]
lea rcx, [rdi + rax*2]
je 0x1400800d7
test rcx, rcx
je 0x14008145b
test r14, r14
je 0x14008145b
mov rdx, r14
call fcn.1402414f0
lea rdx, [rbx + rbx]
mov r9, rdx
lea r8, [rbp + 0x4a0]
mov rcx, r14
call fcn.140007f60
test eax, eax
je 0x140080103
cmp eax, 0xc
je 0x140081471
cmp eax, 0x50
jne 0x1400814af
cmp esi, dword [rdi - 0xc]
jg 0x140081477
mov dword [rdi - 0x10], esi
movsxd rax, esi
xor ecx, ecx
mov word [rdi + rax*2], cx
mov rdx, rdi
mov r14, qword [rbp - 0x60]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14008013b
mov dword [rax + 0x20], r13d
mov dword [rax + 0x24], 1
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, dword [rbp - 0x70]
mov esi, dword [rbp - 0x68]
test esi, esi
je 0x14008063e
xor ebx, ebx
mov dword [rbp - 0x48], ebx
mov esi, ebx
mov qword [rbp - 0x50], rbx
cmp qword [r14 + 0x180], rbx
jle 0x14008063b
nop dword [rax]
mov r13d, ebx
test r13d, r13d
jne 0x140080191
lea r8d, [r13 + 0x51]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Components_
lea rcx, [rbp - 0x78]
call fcn.14000df90
jmp 0x140080304
mov rbx, qword [rbp - 0x38]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x1400801a9
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x1400801b9
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x1400814c0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x70], rax
or dword [rbp - 0x80], 8
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8d, 0x3d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData_
lea rcx, [rbp + 0x70]
call fcn.1400220f0
nop
mov rbx, qword [rbp + 0x70]
lea r14, [rbx - 0x18]
mov rcx, qword [r14]
test rcx, rcx
je 0x140080213
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140080223
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x1400814b5
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x78], rax
or dword [rbp - 0x80], 0x10
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r9, str.Components_
mov r8d, dword [r14 + 8]
mov rdx, rbx
lea rcx, [rbp + 0x78]
call fcn.1400220f0
mov rdx, qword [rbp + 0x78]
lea rbx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rbx, rdi
je 0x1400802c3
mov eax, dword [rdi + 0x10]
shr eax, 0x1f
test al, al
jne 0x1400802b6
mov rax, qword [rdi]
cmp qword [rbx], rax
jne 0x1400802b6
mov rcx, rbx
call fcn.14000de80
mov rsi, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400802a8
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x78], rax
mov rsi, qword [rbp - 0x50]
jmp 0x1400802c3
mov r8d, dword [rbx + 8]
lea rcx, [rbp - 0x78]
call fcn.14000df90
and dword [rbp - 0x80], 0xffffffef
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400802e0
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
and dword [rbp - 0x80], 0xfffffff7
mov eax, r12d
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x1400802fe
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor ebx, ebx
mov r14, qword [rbp - 0x60]
test rsi, rsi
js 0x1400814af
cmp rsi, qword [r14 + 0x180]
jge 0x1400814af
mov rax, qword [r14 + 0x178]
mov rdx, qword [rax + rsi*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x78]
call fcn.1400157c0
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
mov rdi, qword [rbp - 0x78]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008060f
mov dword [rbp - 0x14], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x14]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140080601
cmp dword [rbp - 0x14], 1
jne 0x14008048d
mov ebx, dword [rdi - 0x10]
mov esi, ebx
test ebx, ebx
mov eax, 0
cmovns esi, eax
add ebx, 0x1c
js 0x1400814a4
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x1400803e8
mov edx, ebx
lea rcx, [rbp - 0x78]
call fcn.14000df10
mov rdi, qword [rbp - 0x78]
mov eax, ebx
sub eax, esi
sub eax, 0x1b
movsxd r8, eax
add r8, r8
movsxd rax, esi
lea rsi, [rdi + rax*2]
lea rcx, [rsi + 0x38]
je 0x14008041c
test rcx, rcx
je 0x140081482
test rsi, rsi
je 0x140081482
mov rdx, rsi
call fcn.1402414f0
mov r9d, 0x38
lea r8, str.REGISTRYHKEY_LOCAL_MACHINE_
mov edx, r9d
mov rcx, rsi
call fcn.140007f60
test eax, eax
je 0x14008044a
cmp eax, 0xc
je 0x14008149e
cmp eax, 0x50
jne 0x140081498
cmp ebx, dword [rdi - 0xc]
jg 0x1400814a4
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
xor ebx, ebx
mov word [rdi + rax*2], bx
mov rdx, rdi
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
mov rsi, qword [rbp - 0x50]
test rax, rax
je 0x140080601
mov ecx, dword [rbp - 0x6c]
mov dword [rax + 0x20], ecx
mov dword [rax + 0x24], 1
jmp 0x140080601
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x10a0]
call fcn.140241ba0
mov dword [rbp - 0x10], 0x1000
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
xor r8d, r8d
lea rdx, [rbp + 0x430]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINE_
lea rcx, [rbp - 0x78]
call fcn.140021fb0
mov r15d, dword [rbp - 0x10]
mov r12d, dword [rbp + 0x30]
mov rdi, qword [rbp - 0x78]
mov rdx, rdi
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
mov rsi, rax
test rax, rax
je 0x1400805f2
mov eax, dword [rbp - 0x6c]
mov dword [rsi + 0x20], eax
mov rcx, qword [rsi + 0x28]
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x140080541
nop
mov r14, qword [rbx + 0x10]
mov rbx, qword [rbx]
lea rdx, [rbp + 0x430]
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008058a
test rbx, rbx
jne 0x140080520
cmp dword [rsi + 0x24], 4
je 0x1400805f0
mov ecx, 0x78
call fcn.140095d1c
mov qword [rbp + 0x160], rax
test rax, rax
je 0x14008089e
mov dword [rsp + 0x20], r15d
lea r9, [rbp + 0x10a0]
mov r8d, r12d
lea rdx, [rbp + 0x430]
mov rcx, rax
call fcn.140054020
xor ebx, ebx
jmp 0x1400808a2
mov ecx, dword [r14 + 0xc]
test ecx, ecx
je 0x1400805e8
sub ecx, 1
je 0x1400805e8
sub ecx, 1
je 0x1400805a9
cmp ecx, 1
jne 0x1400805f0
mov dword [r14 + 0xc], 2
mov dword [r14 + 0x18], r12d
mov r12, 0xffffffffffffffff
mov r8, r12
xor edx, edx
lea rcx, [r14 + 0x20]
call fcn.1400a7210
mov r8, r12
mov rdx, r15
lea rcx, [r14 + 0x20]
call fcn.1400a7210
mov r8, r15
lea rdx, [rbp + 0x10a0]
mov rcx, qword [r14 + 0x28]
call fcn.1402414f0
xor ebx, ebx
jmp 0x1400805f9
mov dword [r14 + 0xc], 5
xor ebx, ebx
mov r12, 0xffffffffffffffff
mov r15d, dword [rbp - 0x70]
mov rsi, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rbp - 0x60]
inc r13d
cmp r13d, 2
jl 0x140080173
mov ecx, dword [rbp - 0x48]
inc ecx
mov dword [rbp - 0x48], ecx
inc rsi
mov qword [rbp - 0x50], rsi
movsxd rax, ecx
cmp rax, qword [r14 + 0x180]
jl 0x140080170
mov esi, dword [rbp - 0x68]
lea rcx, [rbp + 0x138]
call fcn.1400a64e0
nop
lea r8, [rbp + 0x430]
mov rdx, qword [rbp + 0x148]
lea rcx, [rbp + 0x138]
call fcn.1400a6854
xor r13d, r13d
mov dword [rbp - 0x30], r13d
xor edx, edx
mov r8d, 0x20000
lea rcx, [rbp + 0x30a0]
call fcn.140241ba0
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0xa0], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xa8], r13
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp + 0xc8], xmm0
lea rcx, [rbp + 0x168]
call fcn.1400a64e0
nop
lea r8, [r14 + 0x3c0]
mov rdx, qword [rbp + 0x178]
lea rcx, [rbp + 0x168]
call fcn.1400a67e0
test esi, esi
je 0x1400808ba
mov edx, 0x10000
lea rcx, [rbp + 0x30a0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesInstallerUpgradeCodes
lea rax, [rbp + 0x30a0]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140080726
movzx eax, word [rcx + r8]
test ax, ax
je 0x140080726
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140080703
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r13w
lea rcx, [rbp + 0x350]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], r13d
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r12d
mov esi, dword [rbp - 0xc]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x138]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30a0]
lea r8, str.SOFTWAREClassesInstallerUpgradeCodes
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rbp + 0x350]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rbp + 0x30a0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUpgradeCodes
lea rax, [rbp + 0x30a0]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140080803
movzx eax, word [rcx + r8]
test ax, ax
je 0x140080803
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400807e0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r13w
lea rcx, [rbp + 0x3c0]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], r13d
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x138]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30a0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUpgradeCodes
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rbp + 0x3c0]
call fcn.14001feb0
jmp 0x1400808bd
xor ebx, ebx
mov eax, ebx
mov dword [rax + 0xc], 2
mov rdx, rax
mov rcx, qword [rsi + 0x28]
call fcn.1400a6c40
jmp 0x1400805f2
mov esi, dword [rbp - 0xc]
mov edx, 0x10000
lea rcx, [rbp + 0x30a0]
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftInstallerUpgradeCodes
lea rax, [rbp + 0x30a0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140080903
movzx eax, word [rcx + r8]
test ax, ax
je 0x140080903
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400808e0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r13w
mov rbx, 0xffffffff80000001
lea rcx, [rbp + 0x2e0]
call fcn.14001fb40
nop
cmp dword [r14 + 0x360], 0
jne 0x14008095a
lea r8, str.SOFTWAREMicrosoftInstallerUpgradeCodes
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x30a0]
call fcn.140057530
test eax, eax
je 0x14008095a
mov rbx, qword [rbp + 0x2e8]
test rbx, rbx
je 0x1400809c7
mov dword [rsp + 0x78], r13d
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x138]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30a0]
lea r8, str.SOFTWAREMicrosoftInstallerUpgradeCodes
mov rdx, rbx
mov rcx, r14
call fcn.1400584f0
nop
lea rcx, [rbp + 0x2e0]
call fcn.14001feb0
mov rsi, qword [rbp + 0xa8]
test rsi, rsi
je 0x140080a28
mov edi, dword [rbp - 0x6c]
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x140080a08
mov dword [rax + 0x20], edi
mov dword [rax + 0x24], 1
cmp dword [rbx + 0x30], 0
je 0x140080a17
mov rcx, qword [rbx + 0x28]
call fcn.140095d64
mov rcx, rbx
call fcn.14005dc90
test rsi, rsi
jne 0x1400809e2
mov rdi, qword [rbp - 0x78]
mov rcx, qword [r14 + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140081304
mov rbx, qword [rbp - 0x38]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140080a58
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140080a68
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x140081524
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x80], rax
or dword [rbp - 0x80], 0x20
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8d, 0x3d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData_
lea rcx, [rbp + 0x80]
call fcn.1400220f0
nop
mov rbx, qword [rbp + 0x80]
lea r14, [rbx - 0x18]
mov rcx, qword [r14]
test rcx, rcx
je 0x140080acb
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140080adb
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x140081519
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x88], rax
or dword [rbp - 0x80], 0x40
mov dword [rsp + 0x20], 0xa
lea r9, str.Products_
mov r8d, dword [r14 + 8]
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.1400220f0
mov rdx, qword [rbp + 0x88]
lea rbx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rbx, rdi
je 0x140080b80
mov eax, dword [rdi + 0x10]
shr eax, 0x1f
test al, al
jne 0x140080b73
mov rax, qword [rdi]
cmp qword [rbx], rax
jne 0x140080b73
mov rcx, rbx
call fcn.14000de80
mov rsi, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140080b69
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x78], rax
jmp 0x140080b80
mov r8d, dword [rbx + 8]
lea rcx, [rbp - 0x78]
call fcn.14000df90
and dword [rbp - 0x80], 0xffffffbf
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140080b9d
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
and dword [rbp - 0x80], 0xffffffdf
mov eax, r12d
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x140080bbb
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x430]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x140080bc5
mov r8d, eax
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x78]
call fcn.1400157c0
mov esi, dword [rbp - 0x68]
test esi, esi
je 0x140080c4f
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140080c4f
lea r8, str.REGISTRYHKEY_LOCAL_MACHINE_
lea rcx, [rbp - 0x78]
call fcn.140021fb0
mov rdx, qword [rbp - 0x78]
mov r14, qword [rbp - 0x60]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x140080c43
mov ecx, dword [rbp - 0x6c]
mov dword [rax + 0x20], ecx
mov dword [rax + 0x24], 1
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140080c53
mov r14, qword [rbp - 0x60]
lea rcx, [rbp + 0x110]
call fcn.1400a64e0
nop
lea rdx, [r14 + 0x198]
lea rcx, [rbp + 0x110]
call fcn.1400a659c
test esi, esi
je 0x14008120e
mov edx, 0x10000
lea rcx, [rbp + 0x30a0]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerFolders
lea rax, [rbp + 0x30a0]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x140080cc3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140080cc3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140080ca0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r13w
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x1400814e7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x20], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerFolders
lea rcx, [rbp + 0x20]
cmp rax, 0x10000
jae 0x140080d0e
movzx edx, ax
call fcn.14000d610
jmp 0x140080d1d
mov r8d, 0x3b
mov rdx, rax
call fcn.14000df90
nop
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x190]
call fcn.14001fc70
nop
mov r8d, r15d
mov rbx, qword [rbp + 0x20]
mov rdx, rbx
lea rcx, [rbp + 0x190]
call fcn.1400210b0
test eax, eax
je 0x140080f92
mov r13d, dword [rbp + 0x1d4]
xor edi, edi
mov r12d, edi
test r13d, r13d
jle 0x140080f8b
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x1400814dc
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x90], rax
mov eax, dword [rbp + 0x1e4]
mov dword [rbp - 0x44], eax
mov ecx, eax
call fcn.1400164e0
mov r15, rax
mov r8d, dword [rbp - 0x44]
xor edx, edx
mov rcx, rax
call fcn.140241ba0
mov dword [rbp + 0x34], r12d
lea rax, [rbp - 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 8]
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x34]
lea rcx, [rbp + 0x190]
call fcn.140020940
mov rbx, qword [rbp + 0x90]
test rbx, rbx
je 0x140080e35
mov esi, edi
mov rcx, qword [rbp + 0x120]
test rcx, rcx
jle 0x140080e33
nop
test rdi, rdi
js 0x1400814d6
cmp rdi, rcx
jge 0x1400814d6
mov rax, qword [rbp + 0x118]
mov rdx, qword [rax + rdi*8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1400810d3
inc esi
inc rdi
movsxd rax, esi
mov rcx, qword [rbp + 0x120]
cmp rax, rcx
jl 0x140080df0
xor edi, edi
mov esi, edi
mov rcx, qword [r14 + 0x68]
test rcx, rcx
jle 0x140080f4a
mov r14d, dword [rbp - 8]
nop dword [rax + rax]
test rdi, rdi
js 0x1400814d6
cmp rdi, rcx
jge 0x1400814d6
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx + 0x60]
mov rdx, qword [rax + rdi*8]
test rdx, rdx
je 0x140080f2d
cmp dword [rbx - 0x10], 0
jl 0x140080f2d
mov rcx, rbx
call fcn.14024112c
mov rdx, rax
test rax, rax
je 0x140080f2d
sub rdx, rbx
sar rdx, 1
cmp edx, 0xffffffff
je 0x140080f2d
mov rax, qword [rbp - 0x60]
cmp rdi, qword [rax + 0x68]
jge 0x1400814d6
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + rdi*8]
mov ecx, dword [rcx - 0x10]
add ecx, edx
lea eax, [rdx - 1]
test eax, eax
js 0x1400814cb
mov r8d, dword [rbx - 0x10]
cmp eax, r8d
jg 0x1400814cb
movsxd rax, edx
cmp word [rbx + rax*2 - 2], 0x5c
jne 0x140080f2d
test ecx, ecx
js 0x1400814cb
cmp ecx, r8d
jg 0x1400814cb
movsxd rax, ecx
cmp word [rbx + rax*2], 0x5c
jne 0x140080f2d
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r9d, r14d
mov r8, rbx
lea rdx, [rbp + 0x30a0]
mov rcx, qword [rbp - 0x60]
mov rcx, qword [rcx + 0x3f0]
call fcn.140055970
inc esi
inc rdi
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax + 0x68]
movsxd rax, esi
cmp rax, rcx
jl 0x140080e50
mov r14, qword [rbp - 0x60]
mov rcx, r15
call fcn.140095d64
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140080f6f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r12d
cmp r12d, r13d
mov edi, 0
jl 0x140080d64
mov rbx, qword [rbp + 0x20]
mov r15d, dword [rbp - 0x70]
mov esi, dword [rbp - 0x68]
xor r13d, r13d
lea r12, [r13 - 1]
lea rcx, [rbp + 0x190]
call fcn.14001feb0
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140080fb9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test esi, esi
je 0x14008120e
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x200]
call fcn.14001fc70
nop
mov r8d, r15d
lea rdx, str.SOFTWAREClassesInstallerAssemblies
lea rcx, [rbp + 0x200]
call fcn.1400210b0
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14008150e
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x10], rbx
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140081503
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x98], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x1400814f8
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp + 8], rdi
mov r12d, dword [rbp + 0x240]
mov r15d, r13d
test r12d, r12d
jle 0x14008119e
nop
lea r9, [rbp + 0x98]
lea r8, [rbp + 8]
mov edx, r15d
lea rcx, [rbp + 0x200]
call fcn.140020810
mov rdi, qword [rbp + 8]
lea rcx, [rdi - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140081115
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x140081105
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140081105
call fcn.14000de80
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400810c5
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp + 0x10], rax
mov rdi, qword [rbp + 8]
jmp 0x140081115
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r9d, dword [rbp - 8]
mov r8, rbx
lea rdx, [rbp + 0x30a0]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055970
jmp 0x140080f4a
mov r8d, dword [rcx + 8]
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.14000df90
lea r8, [0x1402ed690]
lea rdx, [0x1402f8f78]
lea rcx, [rbp + 0x10]
call fcn.14001ba70
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x14008118f
mov r14d, r13d
mov rsi, r13
mov rcx, qword [rbp + 0x120]
test rcx, rcx
jle 0x14008118b
test rsi, rsi
js 0x1400814f2
cmp rsi, rcx
jge 0x1400814f2
mov rax, qword [rbp + 0x118]
mov rdx, qword [rax + rsi*8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1400812c2
inc r14d
inc rsi
movsxd rax, r14d
mov rcx, qword [rbp + 0x120]
cmp rax, rcx
jl 0x140081147
mov r14, qword [rbp - 0x60]
inc r15d
cmp r15d, r12d
jl 0x140081060
mov esi, dword [rbp - 0x68]
lea rdx, [rdi - 0x18]
mov r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400811c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400811e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140081201
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x200]
call fcn.14001feb0
nop
lea rcx, [rbp + 0x110]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x168]
call fcn.1400a6500
nop
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0xa0], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xa8], r13
mov rcx, qword [rbp + 0xc8]
call fcn.1400ad45c
mov qword [rbp + 0xc8], r13
lea rcx, [rbp + 0x138]
call fcn.1400a6500
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008128e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400812ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rbp - 4]
inc ecx
mov dword [rbp - 4], ecx
cmp ecx, 2
jge 0x140081392
jmp 0x14007f286
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREClassesInstallerAssemblies_
lea rcx, [rbp + 8]
call fcn.140021fb0
mov rdi, qword [rbp + 8]
mov rdx, rdi
mov r14, qword [rbp - 0x60]
mov rcx, qword [r14 + 0x3f0]
call fcn.140055020
test rax, rax
je 0x14008118f
mov ecx, dword [rbp - 0x6c]
mov dword [rax + 0x20], ecx
mov dword [rax + 0x24], 1
jmp 0x14008118f
lea rcx, [rbp + 0x168]
call fcn.1400a6500
nop
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp + 0xa0], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xa8], r13
mov rcx, qword [rbp + 0xc8]
call fcn.1400ad45c
mov qword [rbp + 0xc8], r13
lea rcx, [rbp + 0x138]
call fcn.1400a6500
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140081373
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140081392
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x270]
call fcn.14001feb0
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x1400813bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x230a0]
xor rcx, rsp
call fcn.1402155d0
lea r11, [rsp + 0x231b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80070057
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.14024b680
mov dword [rax], reloc.Cabinet.dll_FDICopy
call fcn.14024b514
call fcn.1400a2cd8
int3
call fcn.1400a2cfc
int3
mov ecx, 0x80070057
call fcn.1400080b0
int3
call fcn.1400a2cd8
nop
call fcn.14024b680
mov dword [rax], reloc.Cabinet.dll_FDICopy
call fcn.14024b514
call fcn.1400a2cd8
int3
call fcn.1400a2cfc
int3
mov ecx, 0x80070057
call fcn.1400080b0
int3
call fcn.14024b680
mov dword [rax], reloc.Cabinet.dll_FDICopy
call fcn.14024b514
call fcn.1400a2cd8
int3
call fcn.1400a2cd8
int3
call fcn.1400a2cfc
int3
mov ecx, 0x80070057
call fcn.1400080b0
int3
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80070057
call fcn.1400080b0
int3
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.1400a2cd8
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
int3