Function at 0x40d6c0
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0xb88
mov rax, qword [0x0042baf8]
mov qword [rsp + 0xb30], rax
mov rax, qword [rsp + 0xbb0]
mov r9, qword [rsp + 0xbc8]
mov r10, qword [rsp + 0xbd0]
movsd qword [rsp + 0x1e0], xmm3
mov qword [rsp + 0x1f8], rax
mov qword [r11 - 8], rbx
mov rbx, qword [rsp + 0xbe8]
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov rsi, qword [rsp + 0xbf8]
mov qword [r11 - 0x20], rdi
mov rdi, qword [rsp + 0xbf0]
mov qword [r11 - 0x28], r12
mov r12, qword [rsp + 0xbb8]
mov qword [r11 - 0x30], r13
mov r13, qword [rsp + 0xc00]
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], r15
mov r11, qword [rsp + 0xbd8]
mov dword [rsp + 0x2d0], r8d
mov r15, rcx
mov rcx, qword [rsp + 0xbc0]
test rcx, rcx
mov r14d, edx
mov rdx, qword [rsp + 0xbe0]
lea rax, [rsp + 0x64]
cmovne rax, rcx
xor ebp, ebp
test r9, r9
mov qword [rsp + 0x78], rax
mov dword [rax], ebp
lea rax, [rsp + 0x68]
cmovne rax, r9
test r10, r10
mov qword [rsp + 0x80], rax
mov dword [rax], ebp
lea rax, [0x00404780]
cmove r10, rax
test r11, r11
lea rax, [0x00404780]
cmove r11, rax
test rdx, rdx
lea rax, [0x00404780]
cmove rdx, rax
test rbx, rbx
lea rax, [0x0040d6b0]
cmove rbx, rax
test rdi, rdi
lea rax, [0x00404780]
cmove rdi, rax
test rsi, rsi
lea rax, [0x0040d6a0]
cmove rsi, rax
test r13, r13
mov qword [rsp + 0x2f0], r10
mov qword [rsp + 0x2f8], r11
mov qword [rsp + 0x300], rdx
mov qword [rsp + 0x308], rbx
mov qword [rsp + 0x318], rsi
mov qword [rsp + 0x310], rdi
je 0x40d834
cmp qword [r13], rbp
je 0x40d834
mov qword [rsp + 0x320], r13
jmp 0x40d843
lea rax, str.Looking_for_perfect_fit__I64d__I64d_
mov qword [rsp + 0x320], rax
test r12, r12
mov qword [rsp + 0x200], rbp
mov r13d, ebp
je 0x40d934
cmp qword [r12], rbp
je 0x40d934
mov rsi, r12
nop
nop
nop
mov rcx, qword [r12]
lea rdx, str.DisableDefaults
call fcn.00410100
test eax, eax
jne 0x40d895
mov rdi, qword [rsp + 0x200]
lea r13d, [rax + 1]
jmp 0x40d916
mov r12, qword [r12]
test r12, r12
jne 0x40d8a8
mov rdi, qword [rsp + 0x200]
jmp 0x40d90e
mov rcx, qword [rsp + 0x200]
test rcx, rcx
jne 0x40d8d3
mov ecx, 0x10
call fcn.00410900
mov rcx, r12
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40d90e
mov eax, ebp
mov rbx, rbp
cmp qword [rcx], rax
je 0x40d8eb
nop
inc rbx
inc eax
cmp qword [rcx + rbx*8], rbp
jne 0x40d8e0
add eax, 2
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
mov rcx, r12
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
mov qword [rsp + 0x200], rdi
add rsi, 8
mov r12, rsi
cmp qword [rsi], rbp
jne 0x40d870
test r13d, r13d
jne 0x40f300
test rdi, rdi
jne 0x40d956
mov ecx, 0x10
call fcn.00410900
lea rcx, str._:Archivos_de_programaInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40d998
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40d96b
mov rax, rdi
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40d960
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:Archivos_de_programaInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40d9c5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:Arquivos_de_programasInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40da08
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40d9db
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40d9d0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:Arquivos_de_programasInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40da35
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:OhjelmatiedostotInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40da78
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40da4b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40da40
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:OhjelmatiedostotInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40daa5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:Program_FilesInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40dae8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40dabb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40dab0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:Program_FilesInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40db15
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:ProgramInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40db58
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40db2b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40db20
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:ProgramInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40db85
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:ProgramasInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40dbc8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40db9b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40db90
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:ProgramasInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40dbf5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:ProgramFilerInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40dc38
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40dc0b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40dc00
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:ProgramFilerInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40dc65
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:ProgrammeInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40dca8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40dc7b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40dc70
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:ProgrammeInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40dcd5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:ProgrammerInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40dd18
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40dceb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40dce0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:ProgrammerInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40dd45
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:ProgrammesInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40dd88
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40dd5b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40dd50
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:ProgrammesInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ddb5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:ProgrammiInstallshield_Installation_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ddf8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40ddcb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40ddc0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:ProgrammiInstallshield_Installation_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40de25
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:RECYCLER
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40de68
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40de3b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40de30
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:RECYCLER
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40de95
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:RECYCLED
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ded8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40deab
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40dea0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:RECYCLED
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40df05
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:_RECYCLE.BIN
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40df48
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40df1b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40df10
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:_RECYCLE.BIN
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40df75
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:System_Volume_Information
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40dfb8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40df8b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40df80
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:System_Volume_Information
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40dfe5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWS_
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e028
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40dffb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40dff0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWS_
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e055
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSI386
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e098
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e06b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e060
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSI386
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e0c5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSie7updates
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e108
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e0db
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e0d0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSie7updates
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e135
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSInstaller
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e178
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e14b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e140
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSInstaller
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e1a5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSServicePackFiles
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e1e8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e1bb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e1b0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSServicePackFiles
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e215
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSSoftwareDistribution
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e258
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e22b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e220
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSSoftwareDistribution
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e285
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSDownloaded_Installations
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e2c8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e29b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e290
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSDownloaded_Installations
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e2f5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSEhome
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e338
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e30b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e300
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSEhome
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e365
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSFonts
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e3a8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e37b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e370
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSFonts
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e3d5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSHelp
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e418
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e3eb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e3e0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSHelp
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e445
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSIME
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e488
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e45b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e450
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSIME
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e4b5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSSpeech
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e4f8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e4cb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e4c0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSSpeech
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e525
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWSSymbols
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e568
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e53b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e530
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWSSymbols
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e595
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINDOWS_system32dllcache
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e5d8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e5ab
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e5a0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINDOWS_system32dllcache
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e605
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINNT_
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e648
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e61b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e610
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINNT_
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e675
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINNTI386
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e6b8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e68b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e680
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINNTI386
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e6e5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINNTie7updates
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e728
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e6fb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e6f0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINNTie7updates
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e755
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINNTInstaller
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e798
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e76b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e760
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINNTInstaller
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e7c5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINNTServicePackFiles
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e808
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e7db
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e7d0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINNTServicePackFiles
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e835
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINNTSoftwareDistribution
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e878
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e84b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e840
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINNTSoftwareDistribution
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e8a5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:WINNTDownloaded_Installations
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e8e8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e8bb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e8b0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:WINNTDownloaded_Installations
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e915
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str._:I386
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e958
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e92b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e920
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str._:I386
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e985
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..7z
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40e9c8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40e99b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40e990
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..7z
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40e9f5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..arj
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ea38
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40ea0b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40ea00
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..arj
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ea65
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..avi
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40eaa8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40ea7b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40ea70
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..avi
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ead5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..bak
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40eb18
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40eaeb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40eae0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..bak
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40eb45
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..bup
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40eb88
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40eb5b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40eb50
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..bup
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ebb5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..bz2
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ebf8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40ebcb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40ebc0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..bz2
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ec25
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..cab
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ec68
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40ec3b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40ec30
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..cab
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ec95
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..chm
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ecd8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40ecab
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40eca0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..chm
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ed05
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..gz
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ed48
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40ed1b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40ed10
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..gz
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ed75
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..ifo
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40edb8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40ed8b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40ed80
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..ifo
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ede5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..log
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ee28
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40edfb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40edf0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..log
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ee55
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..lzh
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ee98
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40ee6b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40ee60
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..lzh
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40eec5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..mp3
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ef08
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40eedb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40eed0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..mp3
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40ef35
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..msi
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40ef78
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40ef4b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40ef40
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..msi
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40efa5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..old
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40efe8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40efbb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40efb0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..old
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40f015
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..pdf
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40f058
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40f02b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40f020
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..pdf
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40f085
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..rar
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40f0c8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40f09b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40f090
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..rar
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40f0f5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..rpm
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40f138
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40f10b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40f100
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..rpm
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40f165
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..tar
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40f1a8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40f17b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40f170
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..tar
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40f1d5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..vob
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40f218
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40f1eb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40f1e0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..vob
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40f245
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, [0x004227a8]
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40f288
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40f25b
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40f250
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, [0x004227a8]
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
test rdi, rdi
mov qword [rsp + 0x200], rdi
jne 0x40f2b5
lea ecx, [rdi + 0x10]
call fcn.00410900
lea rcx, str..zip
mov rdi, rax
call fcn.00410890
mov qword [rdi + 8], rbp
mov qword [rdi], rax
jmp 0x40f2f8
mov ebx, ebp
cmp qword [rdi], rbx
je 0x40f2cb
mov rax, rdi
nop
add rax, 8
inc ebx
cmp qword [rax], rbp
jne 0x40f2c0
lea eax, [rbx + 2]
mov rcx, rdi
movsxd rdx, eax
shl rdx, 3
call fcn.004107e0
lea rcx, str..zip
movsxd rbx, ebx
mov rdi, rax
call fcn.00410890
mov qword [rdi + rbx*8 + 8], rbp
mov qword [rdi + rbx*8], rax
mov qword [rsp + 0x200], rdi
lea rax, [rsp + 0x60]
lea rdx, str.SYSTEMCurrentControlSetControlFileSystem
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x88], 1
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r13, qword [rsp + 0xb58]
mov r12, qword [rsp + 0xb60]
test eax, eax
mov rsi, qword [rsp + 0xb70]
jne 0x40f3bf
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
lea rdx, str.NtfsDisableLastAccessUpdate
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x54], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f3b4
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x50], 1
cmove eax, ebp
mov dword [rsp + 0x88], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x88], 1
jne 0x40f3de
xor edx, edx
lea r8, str.NtfsDisableLastAccessUpdate_is_inactive__using_LastAccessTime_for_SpaceHogs.
lea ecx, [rdx + 1]
call qword [rsp + 0x308]
jmp 0x40f3f1
xor edx, edx
lea r8, str.NtfsDisableLastAccessUpdate_is_active__ignoring_LastAccessTime_for_SpaceHogs.
lea ecx, [rdx + 1]
call qword [rsp + 0x308]
test r15, r15
je 0x40f411
cmp word [r15], bp
je 0x40f411
lea rcx, [rsp + 0x70]
mov r8d, r14d
mov rdx, r15
call fcn.0040c7b0
jmp 0x40f575
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
lea ecx, [rax + 1]
add rcx, rcx
call fcn.00410900
test rax, rax
mov rdi, rax
je 0x40f55f
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x40f51e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov ebx, eax
lea rax, [rsp + 0x330]
xor edx, edx
mov ecx, 0x3000
mov r8d, ebx
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea rcx, [rsp + 0x330]
xor edx, edx
call fcn.004107b0
lea rcx, [rsp + 0x330]
cmp rax, rcx
je 0x40f4d0
nop
nop
movzx ecx, word [rax - 2]
sub rax, 2
cmp cx, 0x20
je 0x40f4c0
cmp cx, 9
je 0x40f4c0
cmp cx, 0xa
je 0x40f4c0
cmp cx, 0xd
jne 0x40f4d0
lea rcx, [rsp + 0x330]
mov word [rax], bp
cmp rax, rcx
jne 0x40f4a0
lea rax, [rsp + 0x330]
lea r8, str.__lu___s
lea rcx, [rsp + 0x730]
mov r9d, ebx
mov edx, 0x200
mov qword [rsp + 0x20], rax
call fcn.0040f7a0
mov r8, qword [rsp + 0x320]
xor edx, edx
mov r8, qword [r8 + 0x138]
lea r9, [rsp + 0x730]
lea ecx, [rdx + 1]
call qword [rsp + 0x308]
jmp 0x40f557
cmp word [rdi], bp
mov rbx, rdi
je 0x40f557
nop
nop
nop
lea rcx, [rsp + 0x70]
mov r8d, r14d
mov rdx, rbx
call fcn.0040d2f0
cmp word [rbx], bp
je 0x40f54e
add rbx, 2
cmp word [rbx], bp
jne 0x40f545
add rbx, 2
cmp word [rbx], bp
jne 0x40f530
mov rcx, rdi
call fcn.004109b0
mov rcx, qword [rsp + 0x320]
mov rcx, qword [rcx + 0x130]
call qword [rsp + 0x318]
mov rcx, qword [rsp + 0x200]
mov r15, qword [rsp + 0xb48]
mov r14, qword [rsp + 0xb50]
test rcx, rcx
mov rdi, qword [rsp + 0xb68]
mov rbx, qword [rsp + 0xb80]
je 0x40f5d4
cmp qword [rcx], rbp
je 0x40f5cf
mov rax, rcx
nop
nop
mov rcx, qword [rax]
call fcn.004109b0
mov rcx, qword [rsp + 0x200]
add rbp, 8
cmp qword [rcx + rbp], 0
lea rax, [rcx + rbp]
jne 0x40f5b0
call fcn.004109b0
mov rax, qword [rsp + 0x78]
mov rbp, qword [rsp + 0xb78]
mov dword [rax], 2
mov rcx, qword [rsp + 0xb30]
call fcn.0041e010
add rsp, 0xb88
ret