Function at 0x14003d510
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x800
mov rax, qword [0x140309918]
xor rax, rsp
mov qword [rsp + 0x7f0], rax
xor r13d, r13d
mov qword [r11 - 0x570], r13
movdqa xmm0, xmmword [0x1402c4550]
movdqu xmmword [rsp + 0x2b8], xmm0
mov word [r11 - 0x570], r13w
mov byte [rsp + 0x2a0], r13b
lea rdx, str.srl::Applications::Detect
lea rcx, [r11 - 0x570]
call fcn.140009b0c
nop
call fcn.14001ff60
cmp dword [rax + 8], 4
jl 0x14003d59a
lea rcx, [rsp + 0x2a0]
call fcn.140015b00
nop
lea rsi, vtable.srl::Exists.0
mov qword [rsp + 0x118], rsi
mov byte [rsp + 0x120], 0
mov edx, 0x116f3
lea rcx, [rsp + 0x458]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x118]
mov rdx, rax
call fcn.14004db00
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x458], rdi
mov rdx, qword [rsp + 0x478]
cmp rdx, 8
jb 0x14003d630
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x460]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d62a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ecb9
call fcn.14000410c
nop
mov qword [rsp + 0x128], rsi
mov byte [rsp + 0x130], 0
mov edx, 0x116f5
lea rcx, [rsp + 0x488]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x488], rdi
mov rdx, qword [rsp + 0x4a8]
cmp rdx, 8
jb 0x14003d6b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d6b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ecbf
call fcn.14000410c
nop
mov qword [rsp + 0x138], rsi
mov byte [rsp + 0x140], 0
mov edx, 0x116f7
lea rcx, [rsp + 0x4b8]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x4b8], rdi
mov rdx, qword [rsp + 0x4d8]
cmp rdx, 8
jb 0x14003d740
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d73a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ecc5
call fcn.14000410c
nop
mov qword [rsp + 0x148], rsi
mov byte [rsp + 0x150], 0
mov edx, 0x116f9
lea rcx, [rsp + 0x4e8]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x4e8], rdi
mov rdx, qword [rsp + 0x508]
cmp rdx, 8
jb 0x14003d7c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d7c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003eccb
call fcn.14000410c
nop
mov qword [rsp + 0x158], rsi
mov byte [rsp + 0x160], 0
mov edx, 0x116fb
lea rcx, [rsp + 0x518]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x518], rdi
mov rdx, qword [rsp + 0x538]
cmp rdx, 8
jb 0x14003d850
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x520]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d84a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ecd1
call fcn.14000410c
nop
mov qword [rsp + 0x168], rsi
mov byte [rsp + 0x170], 0
mov edx, 0x11702
lea rcx, [rsp + 0x548]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x548], rdi
mov rdx, qword [rsp + 0x568]
cmp rdx, 8
jb 0x14003d8d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x550]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d8d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ecd7
call fcn.14000410c
nop
mov qword [rsp + 0x100], r13
mov dword [rsp + 0x108], r13d
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMacromediaFlashPlayer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003d99a
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x100], rcx
mov dword [rsp + 0x108], r13d
mov dword [rsp + 0x48], 0x28
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6f8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.CurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003d99a
mov eax, dword [rsp + 0x50]
dec eax
cmp eax, 1
ja 0x14003d99a
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14003da4a
test al, 1
jne 0x14003d99a
shr rax, 1
cmp word [rsp + rax*2 + 0x6f6], 0
je 0x14003da53
mov r15, 0xffffffffffffffff
lea r12, vtable.srl::Version.0
mov qword [rsp + 0x1e0], r13
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1f8], 7
mov word [rsp + 0x1e0], r13w
lea rdx, str.wmplayer.exe
lea rcx, [rsp + 0x2c8]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2c8]
call fcn.14003ca70
movzx ebx, al
mov rdx, qword [rsp + 0x2e0]
cmp rdx, 8
jb 0x14003dc06
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dc01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ecdd
jmp 0x14003dc01
mov word [rsp + 0x6f8], r13w
mov qword [rsp + 0x178], rsi
mov byte [rsp + 0x180], 1
mov edx, 0x116f1
lea rcx, [rsp + 0x578]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x178]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x578], rdi
mov rdx, qword [rsp + 0x598]
cmp rdx, 8
jb 0x14003dadb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x580]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dad5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ece3
call fcn.14000410c
nop
lea r12, vtable.srl::Version.0
mov qword [rsp + 0x78], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ece9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x6f8]
mov r15, 0xffffffffffffffff
mov rax, r15
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003db20
mov r8d, eax
lea rdx, [rsp + 0x6f8]
lea rcx, [rsp + 0x80]
call fcn.140002aa8
nop
mov edx, 0x116f2
lea rcx, [rsp + 0x368]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x368], rdi
mov rdx, qword [rsp + 0x388]
cmp rdx, 8
jb 0x14003dbb7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dbb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ecf4
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c4550]
movdqu xmmword [rsp + 0x380], xmm0
mov word [rsp + 0x370], r13w
mov qword [rsp + 0x78], r12
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003d9a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003d9a8
call fcn.14000410c
test bl, bl
je 0x14003de4f
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x230], r13
mov qword [rsp + 0x238], 7
mov word [rsp + 0x220], r13w
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x1e0]
call fcn.14003c8b0
test al, al
je 0x14003de07
mov qword [rsp + 0x188], rsi
mov byte [rsp + 0x190], 1
mov edx, 0x116f3
lea rcx, [rsp + 0x5a8]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x188]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x5a8], rdi
mov rdx, qword [rsp + 0x5c8]
cmp rdx, 8
jb 0x14003dcd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dcd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ecfa
call fcn.14000410c
nop
mov qword [rsp + 0x88], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ed00
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
jb 0x14003dd28
mov rdx, qword [rsp + 0x220]
test rdx, rdx
jne 0x14003dd28
mov eax, r13d
jmp 0x14003dd3a
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003dd30
mov r8d, eax
lea rcx, [rsp + 0x90]
call fcn.140002aa8
nop
mov edx, 0x11611
lea rcx, [rsp + 0x398]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x88]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x398], rdi
mov rdx, qword [rsp + 0x3b8]
cmp rdx, 8
jb 0x14003ddc2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ddbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed0b
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c4550]
movdqu xmmword [rsp + 0x3b0], xmm0
mov word [rsp + 0x3a0], r13w
mov qword [rsp + 0x88], r12
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003de07
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x238]
cmp rdx, 8
jb 0x14003de4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003de4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed68
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.AcroRd32.exe
lea rcx, [rsp + 0x2e8]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2e8]
call fcn.14003ca70
movzx ebx, al
mov rdx, qword [rsp + 0x300]
cmp rdx, 8
jb 0x14003deea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dee5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed11
call fcn.14000410c
test bl, bl
je 0x14003e12f
mov qword [rsp + 0x240], r13
mov qword [rsp + 0x250], r13
mov qword [rsp + 0x258], 7
mov word [rsp + 0x240], r13w
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x1e0]
call fcn.14003c8b0
test al, al
je 0x14003e0e7
mov qword [rsp + 0x198], rsi
mov byte [rsp + 0x1a0], 1
mov edx, 0x116f5
lea rcx, [rsp + 0x5d8]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x198]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x5d8], rdi
mov rdx, qword [rsp + 0x5f8]
cmp rdx, 8
jb 0x14003dfbc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dfb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed17
call fcn.14000410c
nop
mov qword [rsp + 0x98], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ed1d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x240]
cmp qword [rsp + 0x258], 8
jb 0x14003e00c
mov rdx, qword [rsp + 0x240]
test rdx, rdx
jne 0x14003e00c
mov eax, r13d
jmp 0x14003e01a
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003e010
mov r8d, eax
lea rcx, [rsp + 0xa0]
call fcn.140002aa8
nop
mov edx, 0x116f6
lea rcx, [rsp + 0x3c8]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x98]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x3c8], rdi
mov rdx, qword [rsp + 0x3e8]
cmp rdx, 8
jb 0x14003e0a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e09d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed28
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c4550]
movdqu xmmword [rsp + 0x3e0], xmm0
mov word [rsp + 0x3d0], r13w
mov qword [rsp + 0x98], r12
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003e0e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x258]
cmp rdx, 8
jb 0x14003e12f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e12a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed68
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.QuickTimePlayer.exe
lea rcx, [rsp + 0x308]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x308]
call fcn.14003ca70
movzx ebx, al
mov rdx, qword [rsp + 0x320]
cmp rdx, 8
jb 0x14003e1ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e1c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed2e
call fcn.14000410c
test bl, bl
je 0x14003e40f
mov qword [rsp + 0x260], r13
mov qword [rsp + 0x270], r13
mov qword [rsp + 0x278], 7
mov word [rsp + 0x260], r13w
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x1e0]
call fcn.14003c8b0
test al, al
je 0x14003e3c7
mov qword [rsp + 0x1a8], rsi
mov byte [rsp + 0x1b0], 1
mov edx, 0x116f7
lea rcx, [rsp + 0x608]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x1a8]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x608], rdi
mov rdx, qword [rsp + 0x628]
cmp rdx, 8
jb 0x14003e29c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x610]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e296
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed34
call fcn.14000410c
nop
mov qword [rsp + 0xa8], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ed3a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
jb 0x14003e2ec
mov rdx, qword [rsp + 0x260]
test rdx, rdx
jne 0x14003e2ec
mov eax, r13d
jmp 0x14003e2fa
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003e2f0
mov r8d, eax
lea rcx, [rsp + 0xb0]
call fcn.140002aa8
nop
mov edx, 0x116f8
lea rcx, [rsp + 0x3f8]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x3f8], rdi
mov rdx, qword [rsp + 0x418]
cmp rdx, 8
jb 0x14003e382
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e37d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed45
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c4550]
movdqu xmmword [rsp + 0x410], xmm0
mov word [rsp + 0x400], r13w
mov qword [rsp + 0xa8], r12
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003e3c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x278]
cmp rdx, 8
jb 0x14003e40f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e40a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed68
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.Winword.exe
lea rcx, [rsp + 0x328]
call fcn.140009744
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x328]
call fcn.14003ca70
movzx ebx, al
mov rdx, qword [rsp + 0x340]
cmp rdx, 8
jb 0x14003e4aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e4a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed4b
call fcn.14000410c
test bl, bl
je 0x14003e6ef
mov qword [rsp + 0x280], r13
mov qword [rsp + 0x290], r13
mov qword [rsp + 0x298], 7
mov word [rsp + 0x280], r13w
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x1e0]
call fcn.14003c8b0
test al, al
je 0x14003e6a7
mov qword [rsp + 0x1b8], rsi
mov byte [rsp + 0x1c0], 1
mov edx, 0x116f9
lea rcx, [rsp + 0x638]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x1b8]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x638], rdi
mov rdx, qword [rsp + 0x658]
cmp rdx, 8
jb 0x14003e57c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x640]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e576
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed51
call fcn.14000410c
nop
mov qword [rsp + 0xb8], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ed57
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x280]
cmp qword [rsp + 0x298], 8
jb 0x14003e5cc
mov rdx, qword [rsp + 0x280]
test rdx, rdx
jne 0x14003e5cc
mov eax, r13d
jmp 0x14003e5da
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003e5d0
mov r8d, eax
lea rcx, [rsp + 0xc0]
call fcn.140002aa8
nop
mov edx, 0x116fa
lea rcx, [rsp + 0x428]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0xb8]
mov rdx, rax
call fcn.14004db00
nop
mov qword [rsp + 0x428], rdi
mov rdx, qword [rsp + 0x448]
cmp rdx, 8
jb 0x14003e662
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x430]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e65d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed62
call fcn.14000410c
movdqa xmm0, xmmword [0x1402c4550]
movdqu xmmword [rsp + 0x440], xmm0
mov word [rsp + 0x430], r13w
mov qword [rsp + 0xb8], r12
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003e6a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x298]
cmp rdx, 8
jb 0x14003e6ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e6ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed68
call fcn.14000410c
mov qword [rsp + 0x200], r13
mov qword [rsp + 0x210], r13
mov qword [rsp + 0x218], 7
mov word [rsp + 0x200], r13w
lea rdx, str.3F0FC462_CDC1_4CD9_8E84_84D89B914EAA
lea rcx, [rsp + 0x348]
call fcn.140009744
nop
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x348]
call fcn.14003ce30
movzx ebx, al
mov rdx, qword [rsp + 0x360]
cmp rdx, 8
jb 0x14003e789
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x348]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e784
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed6e
call fcn.14000410c
test bl, bl
je 0x14003e8aa
mov qword [rsp + 0x1c8], rsi
mov byte [rsp + 0x1d0], 1
mov edx, 0x11702
lea rcx, [rsp + 0x668]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0x1c8]
mov rdx, rax
call fcn.14004db00
nop
lea rcx, [rsp + 0x668]
call fcn.1400218f0
nop
mov qword [rsp + 0xc8], r12
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ed74
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0x200]
cmp qword [rsp + 0x218], 8
jb 0x14003e826
mov rdx, qword [rsp + 0x200]
test rdx, rdx
jne 0x14003e826
mov eax, r13d
jmp 0x14003e83a
mov rax, r15
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003e830
mov r8d, eax
lea rcx, [rsp + 0xd0]
call fcn.140002aa8
nop
mov edx, 0x11703
lea rcx, [rsp + 0x698]
call fcn.140021760
nop
xor r9d, r9d
lea r8, [rsp + 0xc8]
mov rdx, rax
call fcn.14004db00
nop
lea rcx, [rsp + 0x698]
call fcn.1400218f0
nop
mov qword [rsp + 0xc8], r12
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003e8aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, r13
mov qword [rsp + 0xd8], r13
mov dword [rsp + 0xe0], r13d
mov qword [rsp + 0xe8], r13
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREJavaSoftJava_Runtime_Environment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003e911
mov eax, r13d
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], r13d
test eax, eax
je 0x14003e976
mov qword [rsp + 0x68], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SOFTWAREJavaSoftJava_Runtime_Environment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003eb8b
mov eax, r13d
test rdi, rdi
je 0x14003e956
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x68]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], 0x200
test eax, eax
jne 0x14003eb8b
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003ed7f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [0x1402b8b40]
cmp rdx, 0x10000
jae 0x14003e9b5
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.140010ac0
jmp 0x14003e9d8
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003e9c0
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140002aa8
nop
xor r14b, r14b
mov esi, r13d
mov dword [rsp + 0x4c], 0x64
test r14b, r14b
jne 0x14003ea86
mov dword [rsp + 0x4c], 0x64
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x720]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x14003ea37
mov r14b, 1
jmp 0x14003e9e6
mov rax, qword [rsp + 0x40]
mov ebx, dword [rax - 0x10]
lea rcx, [rsp + 0x720]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jle 0x14003ea7f
lea rcx, [rsp + 0x720]
mov rax, r15
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003ea60
mov r8d, eax
lea rdx, [rsp + 0x720]
lea rcx, [rsp + 0x40]
call fcn.140002aa8
inc esi
jmp 0x14003e9e6
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
jle 0x14003eb65
mov edx, 0x5f
lea rcx, [rsp + 0x40]
call fcn.14003eda0
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax - 0x10]
add r9d, 0xfffffffe
mov r8d, 2
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1400128a0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call fcn.140069b50
mov rbx, rax
mov edx, 0x1171e
lea rcx, [rsp + 0x6c8]
call fcn.140021760
nop
xor r9d, r9d
mov r8, rbx
mov rdx, rax
call fcn.14004db00
nop
lea rcx, [rsp + 0x6c8]
call fcn.1400218f0
nop
mov qword [rsp + 0xf0], r12
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003eb36
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, vtable.srl::Value.0
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003eb65
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14003eb83
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0xd8]
test rdi, rdi
je 0x14003eb9a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 8
jb 0x14003ebe2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ebdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed8a
call fcn.14000410c
mov qword [rsp + 0x210], r13
mov qword [rsp + 0x218], 7
mov word [rsp + 0x200], r13w
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 8
jb 0x14003ec47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ec42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ed90
call fcn.14000410c
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1f8], 7
mov word [rsp + 0x1e0], r13w
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x14003ec78
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x2a0]
call fcn.140017420
mov al, 1
mov rcx, qword [rsp + 0x7f0]
xor rcx, rsp
call fcn.1402113c0
lea r11, [rsp + 0x800]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
int3
mov ecx, 0x80004005
call fcn.140002d2c
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
int3