Function at 0x1400488e0
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
movzx r13d, dl
mov r12, rcx
xor edi, edi
mov dword [rbp - 0x31], edi
mov eax, dword [0x1401c8068]
test al, 1
jne 0x14004895b
or eax, 1
mov dword [0x1401c8068], eax
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401c8070], rax
lea rcx, [0x140118ec0]
call fcn.1400ccfc0
nop
mov eax, dword [0x1401c8068]
test al, 2
jne 0x140048997
or eax, 2
mov dword [0x1401c8068], eax
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401c8060], rax
lea rcx, [0x140118e80]
call fcn.1400ccfc0
nop
mov eax, dword [0x1401c8068]
test al, 4
jne 0x1400489d3
or eax, 4
mov dword [0x1401c8068], eax
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401c8058], rax
lea rcx, [0x140118e40]
call fcn.1400ccfc0
nop
mov eax, dword [0x1401c8068]
test al, 8
jne 0x140048a09
or eax, 8
mov dword [0x1401c8068], eax
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401c8078], rax
lea rcx, [0x140118e00]
call fcn.1400ccfc0
nop
mov rax, qword [0x1401c8060]
mov ecx, dword [rax - 0x10]
mov rax, qword [0x1401c8078]
mov rdx, qword [0x1401c78d0]
test ecx, ecx
je 0x140048a70
mov ecx, edi
test rdx, rdx
setne cl
test ecx, ecx
jne 0x140048a3c
mov ecx, 0x80004005
call fcn.140001920
int3
mov rcx, rax
mov r9, rdx
sub r9, rax
movzx r8d, word [rcx]
cmp r8w, word [rcx + r9]
jne 0x140048a5e
add rcx, 2
test r8w, r8w
jne 0x140048a45
mov ecx, edi
jmp 0x140048a63
sbb ecx, ecx
or ecx, 1
test ecx, ecx
setne cl
test cl, cl
je 0x140049ac8
lea rcx, [rdx - 0x18]
lea rbx, [rax - 0x18]
or rsi, 0xffffffffffffffff
cmp rcx, rbx
je 0x140048ac9
cmp dword [rbx + 0x10], 0
jl 0x140048ab9
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140048ab9
call fcn.140002540
mov rdi, rax
lock add dword [rbx + 0x10], esi
jg 0x140048aaa
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401c8078], rax
xor edi, edi
jmp 0x140048ac9
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401c8078]
call fcn.1400023f0
mov rax, qword [0x1401c8070]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140048b27
cmp dword [rdx + 0x10], 0
jge 0x140048b03
cmp dword [rax - 0xc], 0
jge 0x140048af4
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], edi
mov rax, qword [0x1401c8070]
mov word [rax], di
jmp 0x140048b27
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140048b13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401c8070], rax
mov rax, qword [0x1401c8060]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140048b8c
cmp dword [rdx + 0x10], 0
jge 0x140048b68
cmp dword [rax - 0xc], 0
jge 0x140048b52
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401c8060]
mov dword [rax - 0x10], edi
mov rax, qword [0x1401c8060]
mov word [rax], di
jmp 0x140048b8c
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140048b78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401c8060], rax
mov rax, qword [0x1401c8058]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140048bea
cmp dword [rdx + 0x10], 0
jge 0x140048bc6
cmp dword [rax - 0xc], 0
jge 0x140048bb7
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], edi
mov rax, qword [0x1401c8058]
mov word [rax], di
jmp 0x140048bea
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140048bd6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401c8058], rax
mov r15d, edi
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x39], rbx
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x14014f000]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, 0x104
test eax, eax
jne 0x140048faa
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140048f4d
mov dword [rbp + 0x77], r14d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140048cb5
mov edx, 0x82
lea rcx, [rbp - 0x39]
call fcn.1400024e0
mov rbx, qword [rbp - 0x39]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, [0x14014ef48]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140048d0a
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400cd52c
test eax, eax
js 0x140048cff
cmp eax, dword [rbx - 0xc]
jg 0x140048cff
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
jmp 0x140048d5b
mov ecx, 0x80070057
call fcn.140001920
int3
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140048d59
cmp dword [rdx + 0x10], 0
jge 0x140048d38
cmp dword [rbx - 0xc], 0
jge 0x140048d2e
mov ecx, 0x80070057
call fcn.140001920
int3
xor edi, edi
mov dword [rbx - 0x10], edi
mov word [rbx], di
jmp 0x140048d5b
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140048d48
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x39], rbx
xor edi, edi
mov dword [rbp + 0x77], r14d
mov rax, qword [0x1401c8070]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x82
or ecx, edx
jge 0x140048d93
mov edx, 0x82
lea rcx, [0x1401c8070]
call fcn.1400024e0
mov rax, qword [0x1401c8070]
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, [0x14014ef28]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140048dfb
mov rcx, qword [0x1401c8070]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400cd52c
test eax, eax
js 0x140048df0
mov rcx, qword [0x1401c8070]
cmp eax, dword [rcx - 0xc]
jg 0x140048df0
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [0x1401c8070]
mov word [rax + rcx*2], di
jmp 0x140048e5f
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401c8070]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140048e5f
cmp dword [rdx + 0x10], 0
jge 0x140048e37
cmp dword [rax - 0xc], 0
jge 0x140048e26
mov ecx, 0x80070057
call fcn.140001920
int3
xor ecx, ecx
mov dword [rax - 0x10], ecx
mov rax, qword [0x1401c8070]
mov word [rax], cx
jmp 0x140048e5f
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140048e47
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401c8070], rax
mov rbx, qword [rbp - 0x39]
mov dword [rbp + 0x77], r14d
mov rax, qword [rbp - 0x49]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140048e89
mov edx, 0x82
lea rcx, [rbp - 0x49]
call fcn.1400024e0
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbp - 0x49]
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140048ee4
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400cd52c
test eax, eax
js 0x140048ed9
cmp eax, dword [rdi - 0xc]
jg 0x140048ed9
mov dword [rdi - 0x10], eax
cdqe
xor ecx, ecx
mov word [rdi + rax*2], cx
jmp 0x140048f41
mov ecx, 0x80070057
call fcn.140001920
int3
mov rdx, qword [0x1401c8070]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp - 0x49]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140048f41
cmp dword [rdi + 0x10], 0
jl 0x140048f34
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140048f34
call fcn.140002540
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140048f26
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x49], rax
mov rbx, qword [rbp - 0x39]
jmp 0x140048f41
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x49]
call fcn.1400023f0
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140048faa
mov rdx, qword [0x1401c8070]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp - 0x49]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140048faa
cmp dword [rdi + 0x10], 0
jl 0x140048f9d
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140048f9d
call fcn.140002540
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140048f8f
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x49], rax
mov rbx, qword [rbp - 0x39]
jmp 0x140048faa
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x49]
call fcn.1400023f0
call fcn.1400485b0
test al, al
je 0x14004933c
mov dil, 1
mov eax, dword [0x1401c6d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x10
jne 0x140048ff8
xor eax, eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140049149
mov dword [rbp + 0x77], r14d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140049050
mov edx, 0x82
lea rcx, [rbp - 0x39]
call fcn.1400024e0
mov rbx, qword [rbp - 0x39]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400490d1
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400cd52c
test eax, eax
js 0x1400490c6
cmp eax, dword [rbx - 0xc]
jg 0x1400490c6
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
xor dil, dil
cmp dword [rbx - 0x10], ecx
jl 0x1400490d1
lea rdx, [0x14014f038]
mov rcx, rbx
call fcn.1400cd6fc
test rax, rax
je 0x1400490d1
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x1400490d1
lea r15d, [rax + 1]
jmp 0x1400490d1
mov ecx, 0x80070057
call fcn.140001920
int3
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [0x1401c6d80]
mov eax, edx
imul eax, edx
and eax, 0x8000000f
jge 0x1400490f4
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xa
jne 0x140049140
mov rax, qword [str.0j7atdRO]
mov qword [rbp - 9], rax
movzx eax, byte [0x14014f200]
mov byte [rbp - 1], al
lea rax, [rbp - 9]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140049115
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400cbef8
mov rcx, rax
call fcn.1400cd9ec
mov edx, dword [0x1401c6d80]
test dil, dil
je 0x1400492f1
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400492e5
mov dword [rbp + 0x77], r14d
mov r8d, dword [0x1401c6d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x11
jne 0x1400491e4
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400cbef8
mov rcx, rax
call fcn.1400cd9ec
mov r14d, dword [rbp + 0x77]
shr r14d, 1
jns 0x1400491f4
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140049216
mov edx, r14d
lea rcx, [rbp - 0x39]
call fcn.1400024e0
mov rbx, qword [rbp - 0x39]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, [0x14014f130]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x1401c6d80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
xor edi, edi
cmp ecx, 8
jne 0x14004928c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400cd52c
test eax, eax
js 0x1400492da
cmp eax, dword [rbx - 0xc]
jg 0x1400492da
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx - 0x10], 0
jl 0x1400492eb
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400cd6fc
test rax, rax
je 0x1400492eb
sub rax, rbx
sar rax, 1
test eax, eax
je 0x1400492e5
jmp 0x1400492eb
mov ecx, 0x80070057
call fcn.140001920
int3
mov r15d, 1
mov edx, dword [0x1401c6d80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 8
jne 0x140049342
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
jne 0x140049342
mov dword [0x1401c6d80], 7
jmp 0x140049342
mov r15d, 1
cmp qword [0x1401c1d58], 0xffffffff80000002
jne 0x140049413
mov rdx, qword [0x1401c78d0]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401c8060]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400493b5
cmp dword [rbx + 0x10], 0
jl 0x1400493a5
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400493a5
call fcn.140002540
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140049398
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401c8060], rax
jmp 0x1400493b5
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401c8060]
call fcn.1400023f0
mov rcx, qword [rbp - 0x49]
add rcx, 0xffffffffffffffe8
mov rbx, qword [0x1401c8070]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140049703
cmp dword [rbx + 0x10], 0
jl 0x140049589
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140049589
call fcn.140002540
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140049403
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401c8070], rax
jmp 0x140049703
test r15d, r15d
je 0x1400495a5
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb al
test al, al
je 0x140049353
cmp byte [0x1401c6ea4], 0
jne 0x140049353
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x21], rbx
lea r15, [0x14014f248]
test r15, 0xffffffffffff0000
jne 0x14004948e
movzx edi, r15w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x1400494fe
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.1400026e0
mov rbx, qword [rbp - 0x21]
jmp 0x1400494fe
mov r14d, dword [rbx - 0x10]
mov rdi, r15
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 9
or eax, ecx
jge 0x1400494bf
mov edx, 9
lea rcx, [rbp - 0x21]
call fcn.1400024e0
mov rbx, qword [rbp - 0x21]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x12
mov rcx, rbx
add rdx, rdx
cmp rdi, r14
ja 0x1400494df
lea r8, [rbx + rdi*2]
call fcn.1400cd0d4
jmp 0x1400494e7
mov r8, r15
call fcn.1400cd294
cmp dword [rbx - 0xc], 9
jl 0x14004957e
mov dword [rbx - 0x10], 9
xor eax, eax
mov word [rbx + 0x12], ax
lea rdi, [rbx - 0x18]
mov r14, qword [0x1401c8060]
add r14, 0xffffffffffffffe8
cmp rdi, r14
je 0x140049562
cmp dword [r14 + 0x10], 0
jl 0x14004954e
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x14004954e
mov rcx, rdi
call fcn.140002540
mov rbx, rax
lock add dword [r14 + 0x10], 0xffffffff
jg 0x140049541
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401c8060], rax
jmp 0x140049562
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401c8060]
call fcn.1400023f0
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x1400493b5
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400493b5
mov ecx, 0x80070057
call fcn.140001920
nop
mov rdi, qword [rbp - 0x49]
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [0x1401c8070]
call fcn.1400023f0
jmp 0x140049703
call fcn.140048680
test al, al
jne 0x1400495c7
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x1401c8070]
call fcn.140010000
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x11], rbx
lea r15, [0x14014f260]
test r15, 0xffffffffffff0000
jne 0x140049619
movzx edi, r15w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004968c
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.1400026e0
mov rbx, qword [rbp - 0x11]
jmp 0x14004968c
mov r14d, dword [rbx - 0x10]
mov rdi, r15
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7a
or eax, ecx
jge 0x14004964a
mov edx, 0x7a
lea rcx, [rbp - 0x11]
call fcn.1400024e0
mov rbx, qword [rbp - 0x11]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xf4
mov rcx, rbx
add rdx, rdx
cmp rdi, r14
ja 0x14004966a
lea r8, [rbx + rdi*2]
call fcn.1400cd0d4
jmp 0x140049672
mov r8, r15
call fcn.1400cd294
cmp dword [rbx - 0xc], 0x7a
jl 0x140049b0c
mov dword [rbx - 0x10], 0x7a
xor eax, eax
mov word [rbx + 0xf4], ax
lea rdi, [rbx - 0x18]
mov r14, qword [0x1401c8060]
add r14, 0xffffffffffffffe8
cmp rdi, r14
je 0x1400496f0
cmp dword [r14 + 0x10], 0
jl 0x1400496dc
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x1400496dc
mov rcx, rdi
call fcn.140002540
mov rbx, rax
lock add dword [r14 + 0x10], 0xffffffff
jg 0x1400496cf
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401c8060], rax
jmp 0x1400496f0
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401c8060]
call fcn.1400023f0
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140049703
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x1401c8060]
cmp dword [rcx - 0x10], 0
jl 0x1400497a1
lea rdx, str.windows_ie_ac_001
call fcn.1400cd6fc
test rax, rax
je 0x1400497a1
sub rax, qword [0x1401c8060]
sar rax, 1
test eax, eax
jle 0x1400497a1
mov rdx, qword [0x1401c78d0]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401c8058]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400499ee
cmp dword [rbx + 0x10], 0
jl 0x14004978c
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004978c
call fcn.140002540
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004977c
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401c8058], rax
jmp 0x1400499ee
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401c8058]
call fcn.1400023f0
jmp 0x1400499ee
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb al
test al, al
je 0x1400498b2
cmp byte [0x1401c6ea4], 0
jne 0x1400498b2
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x29], rbx
lea r15, [0x14014f358]
test r15, 0xffffffffffff0000
jne 0x140049813
movzx edi, r15w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004987f
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.1400026e0
mov rbx, qword [rbp - 0x29]
jmp 0x14004987f
mov r14d, dword [rbx - 0x10]
mov rdi, r15
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 9
or eax, ecx
jge 0x140049844
mov edx, 9
lea rcx, [rbp - 0x29]
call fcn.1400024e0
mov rbx, qword [rbp - 0x29]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x12
mov rcx, rbx
add rdx, rdx
cmp rdi, r14
ja 0x140049864
lea r8, [rbx + rdi*2]
call fcn.1400cd0d4
jmp 0x14004986c
mov r8, r15
call fcn.1400cd294
cmp dword [rbx - 0xc], 9
jl 0x1400498a7
mov dword [rbx - 0x10], 9
xor eax, eax
mov word [rbx + 0x12], ax
lea rdx, [rbp - 0x29]
lea rcx, [0x1401c8058]
call fcn.140002360
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400499ee
mov rcx, qword [rdx]
jmp 0x1400499e8
mov ecx, 0x80070057
call fcn.140001920
nop
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x19], rbx
lea r15, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
test r15, 0xffffffffffff0000
jne 0x140049904
movzx edi, r15w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140049977
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.1400026e0
mov rbx, qword [rbp - 0x19]
jmp 0x140049977
mov r14d, dword [rbx - 0x10]
mov rdi, r15
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x7a
or eax, ecx
jge 0x140049935
mov edx, 0x7a
lea rcx, [rbp - 0x19]
call fcn.1400024e0
mov rbx, qword [rbp - 0x19]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xf4
mov rcx, rbx
add rdx, rdx
cmp rdi, r14
ja 0x140049955
lea r8, [rbx + rdi*2]
call fcn.1400cd0d4
jmp 0x14004995d
mov r8, r15
call fcn.1400cd294
cmp dword [rbx - 0xc], 0x7a
jl 0x140049b01
mov dword [rbx - 0x10], 0x7a
xor eax, eax
mov word [rbx + 0xf4], ax
lea rdi, [rbx - 0x18]
mov r14, qword [0x1401c8058]
add r14, 0xffffffffffffffe8
cmp rdi, r14
je 0x1400499db
cmp dword [r14 + 0x10], 0
jl 0x1400499c7
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x1400499c7
mov rcx, rdi
call fcn.140002540
mov rbx, rax
lock add dword [r14 + 0x10], 0xffffffff
jg 0x1400499ba
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401c8058], rax
jmp 0x1400499db
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401c8058]
call fcn.1400023f0
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x1400499ee
mov rcx, qword [rdi]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x1401c1d58], 0xffffffff80000002
je 0x140049a70
cmp byte [0x1401c1c22], 0
je 0x140049a70
lea rcx, [rbp + 7]
call fcn.140048440
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401c8060]
call fcn.140010000
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140049a3a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0xf]
call fcn.140048440
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401c8058]
call fcn.140010000
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140049a70
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x1401c1d58]
lea rcx, [0x1401c8060]
call fcn.140049b40
mov rdx, qword [0x1401c1d58]
lea rcx, [0x1401c8058]
call fcn.140049b40
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140049ab0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140049ac8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r13b, r13b
je 0x140049ae7
mov rcx, qword [0x1401c8058]
add rcx, 0xffffffffffffffe8
call fcn.140002540
add rax, 0x18
mov qword [r12], rax
jmp 0x140049b17
mov rcx, qword [0x1401c8060]
add rcx, 0xffffffffffffffe8
call fcn.140002540
add rax, 0x18
mov qword [r12], rax
jmp 0x140049b17
mov ecx, 0x80070057
call fcn.140001920
nop
mov ecx, 0x80070057
call fcn.140001920
nop
mov dword [rbp - 0x31], 1
mov rax, r12
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret