Function at 0x140022660
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
movaps xmmword [rsp + 0x100], xmm6
mov rdi, r9
mov r14, r8
mov r13d, edx
mov esi, ecx
mov rax, qword [0x140114040]
xor rax, rsp
mov qword [rsp + 0xf8], rax
test r8, r8
je 0x1400226b6
mov edx, 0x100
mov rcx, r14
call fcn.140092db0
cmp rax, 0x100
je 0x140022d13
mov qword [rsp + 0x50], rdi
cmp byte [0x140125bd4], 0
je 0x1400227da
xor ebp, ebp
cmp byte [0x140125bd5], 1
adc ebp, 1
test esi, esi
cmovne ebp, esi
movabs rbx, 0x7fffffffffffffff
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x58], 0xffffffffffffffff
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
test r14, r14
mov dword [rsp + 0x30], r13d
je 0x1400229eb
lea r15, [rsp + 0x60]
mov rcx, r15
mov rdx, r14
call fcn.140017fa0
mov cl, byte [r15 + 0x17]
test cl, cl
mov rax, qword [r15]
mov rdx, qword [r15 + 8]
movzx r12d, cl
mov r9, r12
cmovs r9, rdx
mov r14, r15
cmovs r14, rax
add r9, r9
test r9, r9
je 0x14002288b
lea r8, [r9 - 2]
cmp word [r14 + r9 - 2], 0x5c
mov r9, r8
je 0x14002275d
cmp r8, 0xfffffffffffffffe
je 0x14002288b
sar r8, 1
lea r13, [r8 + 1]
test cl, cl
jns 0x140022803
cmp rdx, r8
jbe 0x1400227ec
mov qword [rsp + 0x68], r13
lea rax, [rax + r13*2]
mov word [rax], 0
mov cl, byte [rsp + 0x77]
test cl, cl
js 0x1400227f5
movzx ecx, cl
lea rdx, [rsp + 0x60]
xor eax, eax
mov r8, 0xffffffffffffffff
test rcx, rcx
mov r13d, dword [rsp + 0x30]
je 0x14002282a
add rcx, rcx
xor r9d, r9d
cmp word [rdx + r9], 0x5c
jne 0x140022824
add r9, 2
cmp rcx, r9
jne 0x1400227c7
jmp 0x14002282a
call fcn.1400236e0
test al, al
jne 0x1400226c8
jmp 0x140022d13
sub r13, rdx
jne 0x1400233fd
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov al, 1
jmp 0x1400227b0
cmp r8, r12
jae 0x1400233ed
mov byte [rsp + 0x77], r13b
mov rax, r15
jmp 0x140022795
cmp r8, 0xffffffffffffffff
jne 0x140022838
jmp 0x14002364e
sar r9, 1
mov r8, r9
test al, al
je 0x140022819
cmp r8, 0xffffffffffffffff
je 0x140023659
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.14006ae00
lea r14, [rsp + 0x60]
movzx eax, byte [r14 + 0x17]
test al, al
cmovs rax, qword [r14 + 8]
mov rcx, qword [r14]
cmovns rcx, r14
test rax, rax
je 0x1400228b0
add rax, rax
xor edi, edi
cmp word [rcx + rdi], 0x5c
je 0x140022878
add rdi, 2
cmp rax, rdi
jne 0x140022866
jmp 0x1400228b0
cmp rax, rdi
je 0x1400228b0
cmp rdi, 0xfffffffffffffffe
je 0x1400228b0
sar rdi, 1
jmp 0x14002334c
test cl, cl
js 0x1400228a2
mov word [rsp + 0x60], 0
mov byte [rsp + 0x77], 0
xor eax, eax
movzx eax, al
jmp 0x1400228bd
mov word [rax], 0
mov qword [rsp + 0x68], 0
mov al, byte [rsp + 0x77]
test al, al
jns 0x14002289d
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400229eb
bt r13d, 8
jae 0x1400228db
mov eax, r13d
and eax, 0x200
jne 0x1400229eb
cmp ebp, 2
lea rax, [0x140125be0]
lea rcx, [0x140125de0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x1400229eb
xorps xmm0, xmm0
lea r14, [rsp + 0xc0]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x1400229eb
cmp byte [0x1401261e0], 0
setne al
bt r13d, 8
jb 0x1400229eb
mov ecx, r13d
shr ecx, 9
and ecx, 1
or cl, al
je 0x1400229eb
cmp ebp, 2
lea rax, str.SOFTWAREClasses
lea rdi, str.SOFTWARE
cmove rdi, rax
movzx r15d, byte [rsp + 0x77]
test r15b, r15b
jns 0x140023516
mov rcx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
mov r8d, 1
xor r14d, r14d
xor eax, eax
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0
mov rbx, r8
mov r13, qword [rdi + 8]
mov r12, r15
sub r12, r13
jb 0x1400229c2
mov rdx, qword [rdi]
mov rsi, rcx
mov r8, r13
call fcn.140092d68
mov rcx, rsi
test eax, eax
je 0x140023520
add rdi, 0x28
inc r14
mov r8, rbx
cmp r14, r8
mov r13d, dword [rsp + 0x30]
movabs rbx, 0x7fffffffffffffff
jb 0x14002299a
cmp dword [rsp + 0x3c], 0
jne 0x140023680
cmp ebp, 2
jne 0x1400229fe
cmp word [0x140125be0], 0
jne 0x1400235ab
cmp ebp, 1
jne 0x140022a11
cmp word [0x140125de0], 0
jne 0x1400235e4
cmp ebp, 2
lea rax, [0x140125fe0]
lea r15, str.RegistryMachine_
cmove r15, rax
mov rcx, r15
call fcn.140092644
mov r14, rax
lea rax, [rbx - 8]
cmp r14, rax
ja 0x14002350d
cmp r14, 0xb
jae 0x140022a58
lea r12, [rsp + 0xc0]
mov byte [r12 + 0x17], r14b
test r14, r14
jne 0x140022aa6
jmp 0x140022ab7
lea rax, [rbx - 3]
and rax, r14
add rax, 4
mov rsi, r14
or rsi, 3
cmp rsi, 0xb
cmove rsi, rax
inc rsi
js 0x140023513
lea rcx, [rsi + rsi]
call fcn.14009208c
mov r12, rax
mov qword [rsp + 0xc0], rax
lea rax, [rbx + 1]
or rax, rsi
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc8], r14
mov r8, r14
add r8, r14
mov rcx, r12
mov rdx, r15
call fcn.1400c3c30
mov word [r12 + r14*2], 0
lea r15, [rsp + 0xc0]
movzx edi, byte [r15 + 0x17]
test dil, dil
cmovs rdi, qword [r15 + 8]
cmovs r15, qword [r15]
movzx eax, byte [rsp + 0x77]
mov rcx, qword [rsp + 0x70]
and rcx, rbx
dec rcx
test al, al
mov r14, rax
cmovs r14, qword [rsp + 0x68]
mov esi, 0xa
cmovs rsi, rcx
mov rcx, rsi
sub rcx, r14
cmp rcx, rdi
jae 0x140022b35
lea rbp, [r14 + rdi]
mov rcx, rbp
sub rcx, rsi
mov rdx, rbx
sub rdx, rsi
add rdx, 0xfffffffffffffff7
cmp rdx, rcx
jb 0x140023510
test al, al
js 0x140022bb2
lea r12, [rsp + 0x60]
jmp 0x140022bb7
test rdi, rdi
je 0x140022c83
test al, al
js 0x140022b49
lea r12, [rsp + 0x60]
jmp 0x140022b4e
mov r12, qword [rsp + 0x60]
test r14, r14
je 0x140022b80
lea rax, [r12 + r14*2]
xor ecx, ecx
cmp rax, r15
mov eax, 0
cmova rax, rdi
cmp r12, r15
cmova rax, rcx
lea r15, [r15 + rax*2]
lea rcx, [r12 + rdi*2]
lea r8, [r14 + r14]
mov rdx, r12
call fcn.1400c3c30
lea r8, [rdi + rdi]
mov rcx, r12
mov rdx, r15
call fcn.1400c3c30
add r14, rdi
cmp byte [rsp + 0x77], 0
js 0x140022bab
mov eax, r14d
and al, 0x7f
mov byte [rsp + 0x77], al
lea rax, [r12 + r14*2]
jmp 0x140022c7e
mov qword [rsp + 0x68], r14
jmp 0x140022ba2
mov r12, qword [rsp + 0x60]
movabs rax, 0x3fffffffffffffff
add rax, 0xfffffffffffffff4
cmp rsi, rax
jae 0x140022c04
lea rax, [rsi + rsi]
cmp rbp, rax
cmova rax, rbp
mov ebx, 0xb
cmp rax, 0xb
jb 0x140022c08
mov rcx, rax
and rcx, 0xfffffffffffffffc
add rcx, 4
or rax, 3
cmp rax, 0xb
cmove rax, rcx
inc rax
mov rbx, rax
jns 0x140022c08
jmp 0x14002364b
add rbx, 0xfffffffffffffff8
lea rcx, [rbx + rbx]
call fcn.14009208c
mov r13, rax
lea r8, [rdi + rdi]
mov rcx, rax
mov rdx, r15
call fcn.1400c3c30
test r14, r14
je 0x140022c41
lea rcx, [rdi*2]
add rcx, r13
add r14, r14
mov rdx, r12
mov r8, r14
call fcn.1400c3c30
cmp rsi, 0xa
je 0x140022c4f
mov rcx, r12
call fcn.140092084
mov qword [rsp + 0x60], r13
movabs rax, 0x7fffffffffffffff
inc rax
or rbx, rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbp
lea rax, [rbp*2]
add rax, r13
mov r13d, dword [rsp + 0x30]
mov word [rax], 0
cmp byte [rsp + 0xd7], 0
jns 0x140022c9a
mov rcx, qword [rsp + 0xc0]
call fcn.140092084
or r13d, 1
cmp byte [rsp + 0x77], 0
jns 0x140022cac
mov rdx, qword [rsp + 0x60]
jmp 0x140022cb1
lea rdx, [rsp + 0x60]
lea r14, [rsp + 0xb0]
mov rcx, r14
call sub.ntdll.dll_RtlInitUnicodeString
lea r8, [rsp + 0x80]
mov dword [r8], 0x30
mov qword [r8 + 8], 0
mov dword [r8 + 0x18], 0x40
mov qword [r8 + 0x10], r14
xorps xmm0, xmm0
movaps xmmword [r8 + 0x20], xmm0
lea rcx, [rsp + 0x58]
mov edx, r13d
xor r9d, r9d
call sub.ntdll.dll_NtOpenKeyEx
mov ebx, eax
cmp byte [rsp + 0x77], 0
jns 0x140022d0f
mov rcx, qword [rsp + 0x60]
call fcn.140092084
test ebx, ebx
jns 0x140022d43
xor ebx, ebx
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400941a0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x118
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [rsp + 0x58]
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
cmp byte [0x140125bd4], 0
jne 0x140022d78
call fcn.1400236e0
test al, al
jne 0x140022d78
xor ebx, ebx
jmp 0x1400230f9
lea rbx, [rsp + 0x80]
movaps xmmword [rbx], xmm6
mov rcx, rbx
mov rdx, qword [rsp + 0x50]
call sub.ntdll.dll_RtlInitUnicodeString
mov esi, 0x18
lea rbp, [rsp + 0x60]
mov dword [rbp], esi
mov ecx, 0x18
call fcn.14009208c
mov rdi, rax
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], esi
mov rcx, r13
mov rdx, rbx
mov r8d, 1
mov r9, rax
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
je 0x140022de4
cmp eax, 0x80000005
jne 0x140022faf
mov esi, dword [rsp + 0x60]
cmp rsi, 0x18
jbe 0x140022e49
lea rbx, [rsi - 0x18]
cmp rsi, 0x31
mov r14d, 0x30
cmovae r14, rsi
mov rcx, r14
call fcn.14009208c
mov r12, rax
lea rcx, [rax + 0x18]
add r14, rax
mov r15, rsi
add r15, rax
xor edx, edx
mov r8, rbx
call fcn.1400c42d0
movups xmm0, xmmword [rdi]
movups xmmword [r12], xmm0
mov rax, qword [rdi + 0x10]
mov qword [r12 + 0x10], rax
test rdi, rdi
je 0x140022e44
mov rcx, rdi
call fcn.140092084
mov esi, dword [rsp + 0x60]
mov rdi, r12
jmp 0x140022e5a
lea r14, [rdi + 0x18]
mov r15, rsi
add r15, rdi
cmp esi, 0x18
cmove r15, r14
movabs rbx, 0x7fffffffffffffff
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], esi
lea rdx, [rsp + 0x80]
mov rcx, r13
mov r8d, 1
mov r9, rdi
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
je 0x140022e98
cmp eax, 0x80000005
jne 0x140022faf
mov qword [rsp + 0x30], r13
mov r12d, dword [rsp + 0x60]
mov r13, r15
sub r13, rdi
mov rbp, r12
sub rbp, r13
jbe 0x140023119
mov rax, r14
sub rax, r15
cmp rax, rbp
jae 0x140022f49
sub r14, rdi
lea rax, [r14 + r14]
cmp rax, r12
cmovbe rax, r12
movabs rcx, 0x3fffffffffffffff
cmp r14, rcx
mov r14, rax
cmovae r14, rbx
mov rcx, r14
call fcn.14009208c
mov rbx, rax
lea rsi, [rax + r13]
mov rcx, rsi
xor edx, edx
mov r8, rbp
call fcn.1400c42d0
cmp r15, rdi
je 0x140022f17
mov rcx, rbx
mov rdx, rdi
mov r8, r13
call fcn.1400c3c30
mov rsi, rbx
mov r13, rsi
add r14, rbx
add r12, rbx
test rdi, rdi
mov rsi, qword [rsp + 0x30]
lea r15, [rsp + 0x60]
je 0x140022f37
mov rcx, rdi
call fcn.140092084
mov rdi, r13
movabs rbx, 0x7fffffffffffffff
jmp 0x140023131
lea r12, [r15 + rbp]
mov rcx, r15
xor edx, edx
mov r8, rbp
call fcn.1400c42d0
jmp 0x140023127
mov bl, 1
jmp 0x1400230cc
mov rcx, rdi
call fcn.140092084
mov rdi, r12
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x80]
mov rcx, rsi
mov r8d, 1
mov r9, rdi
call sub.ntdll.dll_NtQueryValueKey
mov bl, 1
cmp eax, 0x80000005
je 0x1400230cc
cmp eax, 0xc0000023
je 0x1400230cc
test eax, eax
js 0x140022f5f
mov ebp, dword [rdi + 4]
mov ebx, dword [rdi + 0xc]
mov r14, qword [rsp + 0xc0]
test rbx, rbx
je 0x1400230bb
mov r15d, dword [rdi + 8]
add r15, rdi
mov rax, qword [rsp + 0xd0]
mov rcx, rax
sub rcx, r14
cmp rcx, rbx
jb 0x14002303e
mov rsi, qword [rsp + 0xc8]
mov r8, rsi
sub r8, r14
cmp r8, rbx
jb 0x14002300a
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.1400c3c30
jmp 0x1400230b8
add rbx, r15
lea r12, [r15 + r8]
cmp rsi, r14
je 0x140023316
mov rcx, r14
mov rdx, r15
call fcn.1400c3c30
sub rbx, r12
mov rcx, rsi
mov rdx, r12
mov r8, rbx
call fcn.1400c3c30
add rbx, rsi
mov r14, rbx
jmp 0x1400230bb
test r14, r14
je 0x140023055
mov qword [rsp + 0xc8], r14
mov rcx, r14
call fcn.140092084
xor eax, eax
lea rcx, [rax + rax]
cmp rcx, rbx
cmovbe rcx, rbx
movabs rdx, 0x3fffffffffffffff
cmp rax, rdx
movabs rsi, 0x7fffffffffffffff
cmovb rsi, rcx
test rsi, rsi
js 0x1400236d5
mov rcx, rsi
call fcn.14009208c
mov r14, rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
add rsi, rax
mov qword [rsp + 0xd0], rsi
mov rcx, rax
mov rdx, r15
mov r8, rbx
call fcn.1400c3c30
add r14, rbx
mov qword [rsp + 0xc8], r14
add ebp, 0xfffffffd
cmp ebp, 0xfffffffe
setb bl
test rdi, rdi
je 0x1400230d9
mov rcx, rdi
call fcn.140092084
test bl, bl
je 0x1400233b5
xor bl, 1
mov rsi, qword [rsp + 0xc0]
test rsi, rsi
je 0x1400230f9
mov rcx, rsi
call fcn.140092084
mov rsi, qword [rsp + 0x58]
cmp byte [0x140125bd4], 0
jne 0x14002310c
call fcn.1400236e0
mov rcx, rsi
call sub.ntdll.dll_NtClose
jmp 0x140022d15
lea rax, [rdi + r12]
cmp r12, r13
cmovb r15, rax
mov r12, r15
mov rsi, qword [rsp + 0x30]
lea r15, [rsp + 0x60]
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x80]
mov rcx, rsi
mov r8d, 1
mov r9, rdi
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
je 0x140023169
cmp eax, 0x80000005
jne 0x140022faf
mov r15d, dword [rsp + 0x60]
mov r13, r12
sub r13, rdi
mov rbp, r15
sub rbp, r13
jbe 0x140023229
mov rax, r14
sub rax, r12
cmp rax, rbp
jb 0x1400231a1
lea r15, [r12 + rbp]
mov rcx, r12
xor edx, edx
mov r8, rbp
call fcn.1400c42d0
jmp 0x140023237
sub r14, rdi
lea rax, [r14 + r14]
cmp rax, r15
cmovbe rax, r15
movabs rcx, 0x3fffffffffffffff
cmp r14, rcx
mov r14, rax
cmovae r14, rbx
mov rcx, r14
call fcn.14009208c
mov rsi, rax
add r13, rax
mov rcx, r13
xor edx, edx
mov r8, rbp
call fcn.1400c42d0
mov rdx, rsi
cmp r12, rdi
mov rsi, qword [rsp + 0x30]
lea rbp, [rsp + 0x60]
je 0x140023211
mov rax, rdi
not rax
add rax, r12
add rax, rdx
mov cl, byte [r12 - 1]
dec r12
mov byte [rax], cl
dec rax
cmp r12, rdi
jne 0x1400231fc
mov r13, rdx
add r14, rdx
add r15, rdx
test rdi, rdi
je 0x140023224
mov rcx, rdi
call fcn.140092084
mov rdi, r13
jmp 0x140023241
lea rax, [rdi + r15]
cmp r15, r13
cmovb r12, rax
mov r15, r12
mov rsi, qword [rsp + 0x30]
lea rbp, [rsp + 0x60]
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x80]
mov rcx, rsi
mov r8d, 1
mov r9, rdi
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
je 0x140023279
cmp eax, 0x80000005
jne 0x140022faf
mov ecx, dword [rsp + 0x60]
mov r12, r15
sub r12, rdi
mov r13, rcx
sub r13, r12
jbe 0x140022f71
mov rax, r14
sub rax, r15
cmp rax, r13
jb 0x1400232ac
mov rcx, r15
xor edx, edx
mov r8, r13
call fcn.1400c42d0
jmp 0x140022f71
sub r14, rdi
lea rax, [r14 + r14]
cmp rax, rcx
cmova rcx, rax
movabs rax, 0x3fffffffffffffff
cmp r14, rax
cmovae rcx, rbx
call fcn.14009208c
mov r14, rax
add r12, rax
mov rcx, r12
xor edx, edx
mov r8, r13
call fcn.1400c42d0
cmp r15, rdi
je 0x140023308
mov rax, rdi
not rax
add rax, r15
add rax, r14
mov cl, byte [r15 - 1]
dec r15
mov byte [rax], cl
dec rax
cmp r15, rdi
jne 0x1400232f4
mov r12, r14
test rdi, rdi
jne 0x140022f66
jmp 0x140022f6e
mov rsi, r14
jmp 0x140023025
mov rcx, qword [rsp + 0x60]
cmp word [rcx + rdi*2 + 2], 0x5c
jne 0x14002337e
cmp rax, rdi
jbe 0x1400236d2
mov r8d, 1
mov rcx, r14
call fcn.14006ae00
cmp rdi, 0xffffffffffffffff
je 0x1400228b0
movzx ecx, byte [rsp + 0x77]
test cl, cl
mov rax, qword [rsp + 0x68]
mov rdx, rcx
cmovs rdx, rax
cmp rdx, rdi
jbe 0x1400235a8
lea rdx, [rdi + 1]
test cl, cl
js 0x14002331e
cmp word [rsp + rdi*2 + 0x62], 0x5c
mov rax, rcx
mov rcx, r14
je 0x14002332b
cmp rax, rdx
jbe 0x1400228b0
lea rdi, [rdi*2 + 2]
add rax, rax
cmp word [rcx + rdi], 0x5c
je 0x1400233a7
add rdi, 2
cmp rax, rdi
jne 0x140023392
jmp 0x1400228b0
cmp rax, rdi
je 0x1400228b0
sar rdi, 1
jmp 0x140023342
mov rdi, qword [rsp + 0x180]
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.1400c58d0
mov rsi, qword [rsi]
mov rcx, rdi
mov rdx, rsi
call fcn.140017fa0
mov bl, 1
jmp 0x1400230ec
mov eax, r12d
and al, 0x7f
mov byte [rsp + 0x77], al
jmp 0x14002344a
sub r13, r12
je 0x1400227a6
mov edi, 0xa
jmp 0x140023412
mov rcx, qword [rsp + 0x70]
mov rdi, rcx
and rdi, rbx
dec rdi
shr rcx, 0x38
mov r12, rdx
mov rdx, rdi
sub rdx, r12
cmp rdx, r13
jb 0x140023453
test cl, cl
lea r15, [rsp + 0x60]
cmovs r15, rax
lea rcx, [r15 + r12*2]
lea r8, [r13*2]
xor edx, edx
call fcn.1400c42d0
add r12, r13
cmp byte [rsp + 0x77], 0
jns 0x1400233e2
mov qword [rsp + 0x68], r12
lea rax, [r15 + r12*2]
jmp 0x140022799
mov rax, r13
sub rax, rdi
add rax, r12
mov rcx, rbx
sub rcx, rdi
add rcx, 0xfffffffffffffff8
cmp rcx, rax
jb 0x1400236d8
movabs rax, 0x3fffffffffffffff
add rax, 0xfffffffffffffff4
cmp rdi, rax
jae 0x1400234c0
lea rax, [rdi + rdi]
lea rcx, [r12 + r13]
cmp rcx, rax
cmova rax, rcx
mov esi, 0xb
cmp rax, 0xb
jb 0x1400234c4
mov rcx, rax
and rcx, 0xfffffffffffffffc
add rcx, 4
or rax, 3
cmp rax, 0xb
cmove rax, rcx
inc rax
mov rsi, rax
jns 0x1400234c4
jmp 0x1400236db
lea rsi, [rbx - 8]
lea rcx, [rsi + rsi]
call fcn.14009208c
mov r15, rax
test r12, r12
je 0x1400234e4
lea r8, [r12 + r12]
mov rcx, r15
mov rdx, r14
call fcn.1400c3c30
cmp rdi, 0xa
je 0x1400234f2
mov rcx, r14
call fcn.140092084
mov qword [rsp + 0x60], r15
lea rax, [rbx + 1]
or rsi, rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], r12
jmp 0x140023428
int3
int3
int3
lea rcx, [rsp + 0x60]
jmp 0x14002297b
movzx r8d, word [rcx + r13*2]
cmp r8d, 0x5c
je 0x140023534
test r8d, r8d
jne 0x1400229c2
lea rax, [rcx + r13*2]
mov edx, dword [rdi + 0x10]
mov dword [rsp + 0x3c], edx
cmp edx, 1
je 0x140023561
cmp dword [rsp + 0x3c], 2
jne 0x140023572
lea rdx, str.WOW6432Node
mov qword [rsp + 0x48], rdx
mov rdx, rax
mov qword [rsp + 0x40], rax
jmp 0x140023572
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rsi
cmp r8w, 0x5c
jne 0x14002358f
lea rcx, [rax + 2]
dec r12
cmp word [rax + 2], 0x5c
mov rdx, rcx
mov rax, rcx
je 0x140023579
jmp 0x140023592
mov rdx, rax
mov r8, qword [rdi + 0x20]
mov rdi, qword [rdi + 0x18]
xor r14d, r14d
mov r15, r12
mov rcx, rdx
jmp 0x1400229cc
int3
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0xc0]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x1400f3bf0]
movaps xmmword [r14], xmm0
lea rdx, [0x140125fe0]
mov rcx, r14
call fcn.140043d30
lea r15, [0x140125be0]
jmp 0x14002361b
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0xc0]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x1400f3bf0]
movaps xmmword [r14], xmm0
lea rdx, [0x140125fe0]
mov rcx, r14
call fcn.140043d30
lea r15, [0x140125de0]
mov rcx, r15
call fcn.140092644
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.140045c90
lea rdx, [0x140105d4c]
mov r8d, 1
mov rcx, r14
call fcn.140045c90
jmp 0x140022abe
int3
lea rax, [rsp + 0x60]
mov byte [rax + 0x17], 0
jmp 0x140023667
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], 0
mov word [rax], 0
movabs rbx, 0x7fffffffffffffff
mov r13d, dword [rsp + 0x30]
jmp 0x140022844
lea r12, [rsp + 0x60]
cmp byte [r12 + 0x17], 0
mov rax, r12
jns 0x140023695
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x40]
sub rdi, rax
sar rdi, 1
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
call fcn.140092644
mov rcx, r12
mov rdx, rdi
mov r8, rsi
mov r9, rax
call fcn.140045b70
movabs rbx, 0x7fffffffffffffff
mov r13d, dword [rsp + 0x30]
jmp 0x1400229eb
int3
int3
int3
int3