Function at 0x1400034d0
Capabilities:
Accept command line arguments
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x6a0]
sub rsp, 0x7a0
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x208
call fcn.1400045b0
lea rcx, [rbp + 0x50]
call fcn.140002f60
test al, al
jne 0x14000350f
mov rax, 0xffffffffffffffff
add rsp, 0x7a0
pop rbp
ret
mov qword [rsp + 0x798], rbx
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x790], rsi
xor edx, edx
xor esi, esi
mov qword [rsp + 0x788], rdi
mov r8d, 0x100
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x780], r14
mov qword [rsp + 0x30], 0x11c
call fcn.1400045b0
xor eax, eax
mov word [rbp + 0x44], si
mov r8b, 3
mov dword [rbp + 0x46], eax
lea edx, [rsi + 2]
mov word [rbp + 0x4a], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rsi + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rsi + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea edx, [rsi + 0x23]
mov dword [rsp + 0x34], 6
mov r8, rax
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0x30]
mov word [rbp + 0x44], si
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x140003685
lea rdi, str.SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS_1.1Client
lea r14, str.LDLS4.SplashWindow
nop dword [rax]
mov rdx, qword [rdi]
lea r8, [rbp + 0x6c8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400037bc
mov rdx, qword [rdi + 8]
lea rax, [rbp + 0x6b8]
mov rcx, qword [rbp + 0x6c8]
lea r9, [rbp + 0x6b0]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x6c0]
mov dword [rbp + 0x6b0], esi
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x6c0], esi
mov dword [rbp + 0x6b8], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x6c8]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400037bc
cmp dword [rbp + 0x6b0], 4
jne 0x1400037bc
cmp dword [rbp + 0x6b8], 4
jne 0x1400037bc
mov eax, dword [rdi + 0x10]
cmp dword [rbp + 0x6c0], eax
jne 0x1400037bc
add rdi, 0x18
cmp rdi, r14
jne 0x1400035d0
mov edx, 0x104
lea rcx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140003821
lea rax, str.LavasoftTcpService64.dll
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 0x30]
lea rax, str.ASProxy64.dll
mov qword [rsp + 0x38], rax
lea rax, str.CatWSPrx64.dll
mov qword [rsp + 0x40], rax
lea rax, str.ColorMedia64.dll
mov qword [rsp + 0x48], rax
lea rax, str.CovenantEyesProxy64.dll
mov qword [rsp + 0x50], rax
lea rax, str.ecSyvY64.dll
mov qword [rsp + 0x58], rax
lea rax, str.Gambali64.dll
mov qword [rsp + 0x60], rax
lea rax, str.C:ProgramDataTrusteerRapport_storeextsRapportCerberus_baselinex64RapportGH_x64.DLL
mov qword [rsp + 0x68], rax
lea rax, str.gfore64.dll
mov qword [rsp + 0x70], rax
lea rax, str.gipoaurex64.dll
mov qword [rsp + 0x78], rax
lea rax, str.MyOSProtect64.dll
mov qword [rbp - 0x80], rax
lea rax, str.N1Service64.dll
mov qword [rbp - 0x78], rax
lea rax, str.PCProtect64.dll
mov qword [rbp - 0x70], rax
lea rax, str.qproxy64.dll
mov qword [rbp - 0x68], rax
lea rax, str.C:Program_Files__x86_RivaTuner_Statistics_ServerRTSSHooks64.dll
mov qword [rbp - 0x60], rax
lea rax, str.scxy64.dll
mov qword [rbp - 0x58], rax
lea rax, str.VOTPrx64
mov qword [rbp - 0x50], rax
lea rax, str.WeWatcherLSP64.dll
mov qword [rbp - 0x48], rax
lea rax, str.WebWatcherLSP64.dll
mov qword [rbp - 0x40], rax
nop
mov r8, qword [rbx]
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x470]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x1400037ad
lea rcx, [rbp + 0x470]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400037c5
add rbx, 8
lea rax, [rbp - 0x38]
cmp rbx, rax
jne 0x140003780
jmp 0x140003821
lea rcx, str._tls12
jmp 0x14000381c
lea rcx, [rbp + 0x50]
mov dword [rbp + 0x6b0], esi
mov dword [rbp + 0x6b8], esi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r9d, r9d
lea rcx, [rbp + 0x50]
mov edx, eax
xor r8d, r8d
lea rax, [rbp + 0x6b8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6b0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSCGetApplicationCategory]
test eax, eax
jne 0x140003815
test dword [rbp + 0x6b0], 0x7fffffbb
je 0x140003821
lea rcx, str._lsp
call fcn.140003410
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r14, qword [rsp + 0x780]
mov rdi, qword [rsp + 0x788]
mov rsi, qword [rsp + 0x790]
movzx ecx, word [rax]
mov rbx, qword [rsp + 0x798]
cmp cx, 0x22
jne 0x1400038a9
movzx edx, word [rax + 2]
add rax, 2
test dx, dx
je 0x140003896
movzx ecx, dx
movzx edx, cx
cmp cx, 0x22
je 0x140003896
cmp cx, 0x5c
jne 0x140003886
movzx edx, word [rax + 2]
lea rcx, [rax + 2]
cmp dx, 0x5c
je 0x140003883
cmp dx, 0x22
jne 0x140003886
mov rax, rcx
movzx edx, word [rax + 2]
add rax, 2
movzx ecx, dx
test dx, dx
jne 0x140003860
lea rcx, [rax + 2]
test dx, dx
cmove rcx, rax
mov rax, rcx
movzx ecx, word [rcx]
jmp 0x1400038ca
test cx, cx
je 0x1400038ca
movzx edx, cx
movzx ecx, dx
cmp dx, 0x20
je 0x1400038ca
movzx ecx, word [rax + 2]
add rax, 2
movzx edx, cx
test cx, cx
jne 0x1400038b1
cmp cx, 0x20
lea rdx, [rax + 2]
lea rcx, [rbp + 0x50]
cmovne rdx, rax
call fcn.1400038f0
add rsp, 0x7a0
pop rbp
ret