Function at 0x140038cd0
Capabilities:
Get graphical window text
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xaa8]
sub rsp, 0xba8
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rbp + 0xa90], rax
mov qword [rsp + 0x58], r9
mov rbx, r8
mov rdi, rdx
mov r12, rcx
xor sil, sil
mov byte [rsp + 0x40], sil
xor r13d, r13d
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], 7
mov word [rbp], r13w
lea rdx, str.winword
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea r14d, [r13 + 0xa]
test eax, eax
jne 0x140038d4c
lea r8d, [r13 + 4]
lea rdx, str.Word
jmp 0x140038d8b
lea rdx, str.excel
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140038d6d
lea r8d, [rax + 5]
lea rdx, str.Excel
jmp 0x140038d8b
lea rdx, str.powerpnt
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140038d94
mov r8, r14
lea rdx, str.PowerPoint
lea rcx, [rbp]
call fcn.14000a2d0
cmp qword [rbp + 0x10], 0
je 0x140039cbb
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140038dc0
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14000a2d0
nop
lea r11, [rbp - 0x40]
mov r14, qword [rbp - 0x40]
mov r15, qword [rbp - 0x28]
cmp r15, 8
cmovae r11, r14
lea rbx, [0x140095318]
mov rdi, qword [rbp - 0x30]
cmp rdi, 1
jb 0x140038e9d
lea r10, [r11 + rdi*2]
mov rdx, r11
nop dword [rax + rax]
mov rax, r10
sub rax, rdx
sar rax, 1
je 0x140038e9d
cmp word [rdx], 0x2e
je 0x140038e2f
add rdx, 2
sub rax, 1
jmp 0x140038e19
mov r8d, 1
mov rcx, rbx
mov r9, rdx
sub r9, rbx
nop
movzx eax, word [rcx]
cmp word [r9 + rcx], ax
jne 0x140038e7c
add rcx, 2
sub r8, 1
jne 0x140038e40
sub rdx, r11
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x140038e9d
cmp rdx, rdi
ja 0x140038e82
mov qword [rbp - 0x30], rdx
lea rax, [rbp - 0x40]
cmp r15, 8
cmovae rax, r14
mov word [rax + rdx*2], r13w
jmp 0x140038e91
add rdx, 2
jmp 0x140038e10
xor r8d, r8d
sub rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.14003ad90
mov r14, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x28]
mov r8, rsi
lea rdx, [0x1400ae83c]
lea rcx, [rbp - 0x40]
call fcn.14003b570
cmp rax, 0xffffffffffffffff
je 0x140038eec
lea rcx, [rbp - 0x40]
cmp rax, rdi
ja 0x140038ed2
mov qword [rbp - 0x30], rax
cmp r15, 8
cmovae rcx, r14
mov word [rcx + rax*2], r13w
jmp 0x140038ee0
xor r8d, r8d
sub rax, rdi
mov rdx, rax
call fcn.14003ad90
mov r14, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x28]
mov esi, r13d
lea rbx, [rbp - 0x40]
cmp r15, 8
cmovae rbx, r14
movabs r13, 0x7ffffffffffffffe
test rdi, rdi
je 0x14003912d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x40]
call fcn.140067170
lea rcx, str.Office
lea r8, [0x1400972c4]
mov edx, 0x100
movzx eax, word [rcx]
cmp ax, dx
jae 0x140038f82
movzx eax, al
mov byte [rbp + rax + 0x40], 1
add rcx, 2
cmp rcx, r8
jne 0x140038f32
lea rcx, [rdi - 1]
mov r9, 0xffffffffffffffff
mov rax, r9
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rbx + rax*2]
movzx eax, word [rcx]
cmp ax, dx
jae 0x140038f73
cmp byte [rbp + rax + 0x40], sil
jne 0x140038fd0
cmp rcx, rbx
je 0x14003912d
sub rcx, 2
jmp 0x140038f64
lea rcx, [rdi - 1]
mov r9, 0xffffffffffffffff
mov rax, r9
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rbx + rax*2]
nop dword [rax + rax]
mov edx, 6
lea rax, str.Office
movzx r8d, word [rcx]
cmp word [rax], r8w
je 0x140038fd0
add rax, 2
sub rdx, 1
jne 0x140038fb0
cmp rcx, rbx
je 0x140038fcb
sub rcx, 2
jmp 0x140038fa0
mov rcx, r9
jmp 0x140038fd6
sub rcx, rbx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x14003912d
inc rcx
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], ax
cmp rdi, rcx
jb 0x140039d24
sub rdi, rcx
mov rsi, r9
cmp rdi, 0xffffffffffffffff
cmovb rsi, rdi
lea rax, [rbp - 0x40]
cmp r15, 8
cmovae rax, r14
lea r14, [rax + rcx*2]
cmp rsi, 7
ja 0x140039048
mov qword [rbp - 0x50], rsi
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x60]
call fcn.140066d60
xor r15d, r15d
mov word [rbp + rbx - 0x60], r15w
lea r13d, [r15 + 0xa]
jmp 0x1400390ac
cmp rsi, r13
ja 0x140039d2a
mov rbx, rsi
or rbx, 7
cmp rbx, r13
jbe 0x140039068
mov rbx, r13
mov r13d, 0xa
jmp 0x140039076
cmp rbx, 0xa
mov r13d, 0xa
cmovb rbx, r13
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x60]
call fcn.14000a470
mov rdi, rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.140066d60
xor r15d, r15d
mov word [rbx + rdi], r15w
mov qword [rbp - 0x60], rdi
call fcn.140071580
mov rdi, rax
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rbx, qword [rbp - 0x60]
mov dword [rax], r15d
mov r8d, r13d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140072778
mov esi, eax
cmp rbx, qword [rsp + 0x48]
je 0x140039d30
cmp dword [rdi], 0x22
je 0x140039d43
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140039130
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039126
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039d3d
call fcn.140064808
jmp 0x140039130
xor r15d, r15d
lea r9, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r9, qword [rbp]
mov r8d, esi
lea rdx, str.SoftwareMicrosoftOffice_d.0_sUser_MRU
lea rcx, [rbp + 0x880]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x50], r15
mov r9d, 0xf003f
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x880]
mov rcx, 0xffffffff80000001
call fcn.14004fc40
test eax, eax
jne 0x140039c76
mov dword [rsp + 0x44], 0x208
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x44]
lea r8, [rbp + 0x460]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140039c6a
mov qword [rsp + 0x48], r15
lea rdx, str.File_MRU
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9d, 0xf003f
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x460]
mov rcx, qword [rsp + 0x50]
call fcn.14004fc40
test eax, eax
jne 0x140039c6a
mov qword [rbp - 0x70], r15
mov r13d, 7
mov qword [rbp - 0x68], r13
mov word [rbp - 0x80], r15w
mov r8d, 0x104
lea rdx, [rbp + 0x670]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r13
mov word [rbp - 0x60], r15w
lea rax, [rbp + 0x670]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140039240
lea rdx, [rbp + 0x670]
lea rcx, [rbp - 0x60]
call fcn.14000a2d0
nop
lea r10, [rbp - 0x60]
mov rbx, qword [rbp - 0x60]
mov r14, qword [rbp - 0x48]
cmp r14, 8
cmovae r10, rbx
mov r12, qword [rbp - 0x50]
cmp r12, 1
jb 0x1400395c1
lea r9, [r10 + r12*2]
mov rdi, r10
nop word [rax + rax]
mov rax, r9
sub rax, rdi
sar rax, 1
je 0x1400395c1
cmp word [rdi], 0x2e
je 0x1400392af
add rdi, 2
sub rax, 1
jmp 0x140039299
mov edx, 1
lea rax, [0x140095318]
mov rcx, rax
mov r8, rdi
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140039332
add rcx, 2
sub rdx, 1
jne 0x1400392c4
sub rdi, r10
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x1400395c1
lea r15, [rbp - 0x60]
cmp r14, 8
cmovae r15, rbx
cmp r12, 7
ja 0x14003933b
mov qword [rbp - 0x70], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140066d60
xor r15d, r15d
mov word [rbp + rbx - 0x80], r15w
mov rsi, qword [rbp - 0x68]
mov r12, qword [rbp - 0x70]
mov r14, qword [rbp - 0x80]
movabs r13, 0x7ffffffffffffffe
jmp 0x1400393a2
add rdi, 2
jmp 0x140039290
movabs r13, 0x7ffffffffffffffe
cmp r12, r13
ja 0x140039d5c
mov rsi, r12
or rsi, 7
cmp rsi, r13
jbe 0x14003935f
mov rsi, r13
jmp 0x14003936c
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x80]
call fcn.14000a470
mov r14, rax
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rsi
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.140066d60
xor r15d, r15d
mov word [rbx + r14], r15w
mov qword [rbp - 0x80], r14
lea rbx, [rdi + 1]
cmp rbx, r12
ja 0x1400393c2
mov qword [rbp - 0x70], rbx
lea rax, [rbp - 0x80]
cmp rsi, 8
cmovae rax, r14
mov word [rax + rbx*2], r15w
jmp 0x1400393d4
xor r8d, r8d
mov rdx, rbx
sub rdx, r12
lea rcx, [rbp - 0x80]
call fcn.14003ad90
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rax, qword [rbp - 0x50]
cmp rax, rbx
jb 0x140039d50
sub rax, rbx
mov rdi, 0xffffffffffffffff
cmp rax, rdi
cmovb rdi, rax
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rax, qword [rbp - 0x60]
lea rsi, [rax + rbx*2]
cmp rdi, 7
ja 0x140039444
mov qword [rsp + 0x70], rdi
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140066d60
mov word [rsp + rbx + 0x60], r15w
mov r14, qword [rsp + 0x60]
jmp 0x1400394a2
cmp rdi, r13
ja 0x140039d5c
mov rbx, rdi
or rbx, 7
cmp rbx, r13
jbe 0x14003945e
mov rbx, r13
jmp 0x14003946b
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x60]
call fcn.14000a470
mov r14, rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140066d60
mov word [r14 + rbx], r15w
mov qword [rsp + 0x60], r14
lea r10, [rsp + 0x60]
mov r11, qword [rsp + 0x78]
cmp r11, 8
cmovae r10, r14
mov rbx, qword [rsp + 0x70]
cmp rbx, 1
jb 0x14003957d
lea rdi, [r10 + rbx*2]
mov rdx, r10
lea rsi, [0x1400aed00]
mov rax, rdi
sub rax, rdx
sar rax, 1
je 0x14003957d
cmp word [rdx], 0x20
je 0x1400394f0
add rdx, 2
sub rax, 1
jmp 0x1400394da
mov r8d, 1
mov rcx, rsi
mov r9, rdx
sub r9, rsi
nop
movzx eax, word [rcx]
cmp word [rcx + r9], ax
jne 0x14003953e
add rcx, 2
sub r8, 1
jne 0x140039500
sub rdx, r10
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x14003957d
cmp rdx, rbx
ja 0x140039544
mov qword [rsp + 0x70], rdx
lea rax, [rsp + 0x60]
cmp r11, 8
cmovae rax, r14
mov word [rax + rdx*2], r15w
jmp 0x140039554
add rdx, 2
jmp 0x1400394d1
xor r8d, r8d
sub rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003ad90
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.14000baf0
mov r11, qword [rsp + 0x78]
mov r14, qword [rsp + 0x60]
cmp r11, 8
jb 0x1400396cc
lea rdx, [r11*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400395b4
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039d56
mov rcx, r14
call fcn.140064808
jmp 0x1400396cc
xor r8d, r8d
lea rdx, [0x1400aecf8]
lea rcx, [rbp - 0x60]
call fcn.14003b410
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140039b68
lea r15, [rbp - 0x60]
cmp r14, 8
cmovae r15, rbx
cmp r12, 7
ja 0x140039621
mov qword [rbp - 0x70], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140066d60
xor r15d, r15d
mov word [rbp + rbx - 0x80], r15w
mov rdi, qword [rbp - 0x68]
mov r12, qword [rbp - 0x70]
mov r14, qword [rbp - 0x80]
jmp 0x140039688
movabs rax, 0x7ffffffffffffffe
cmp r12, rax
ja 0x140039d62
mov rdi, r12
or rdi, 7
cmp rdi, rax
jbe 0x140039645
mov rdi, rax
jmp 0x140039652
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x80]
call fcn.14000a470
mov r14, rax
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rdi
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.140066d60
xor r15d, r15d
mov word [rbx + r14], r15w
mov qword [rbp - 0x80], r14
cmp rsi, r12
ja 0x1400396a4
mov qword [rbp - 0x70], rsi
lea rax, [rbp - 0x80]
cmp rdi, 8
cmovae rax, r14
mov word [rax + rsi*2], r15w
jmp 0x1400396b6
xor r8d, r8d
sub rsi, r12
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.14003ad90
mov r8d, 1
lea rdx, [0x140095318]
lea rcx, [rbp - 0x80]
call fcn.14000baf0
mov rsi, qword [rbp - 0x70]
test rsi, rsi
je 0x140039b64
mov r12d, 1
mov r8d, r12d
lea rdx, str.Item__d
lea rcx, [rbp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x250]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r13, qword [rbp - 0x68]
test eax, eax
jne 0x140039bce
lea rbx, [r12 - 2]
nop word [rax + rax]
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r15w
lea rax, [rbp + 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140039760
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.14000a2d0
nop
lea r10, [rbp - 0x80]
cmp r13, 8
cmovae r10, qword [rbp - 0x80]
lea rdi, [rbp - 0x20]
mov r11, qword [rbp - 0x20]
mov r14, qword [rbp - 8]
cmp r14, 8
cmovae rdi, r11
mov r15, qword [rbp - 0x10]
cmp rsi, r15
ja 0x1400397dc
mov rbx, r15
sub rbx, rsi
inc rbx
lea rbx, [rdi + rbx*2]
mov rdx, rdi
mov rax, rbx
sub rax, rdx
sar rax, 1
je 0x1400397d5
movzx ecx, word [r10]
cmp word [rdx], cx
je 0x140039884
add rdx, 2
sub rax, 1
jne 0x1400397c2
mov rbx, 0xffffffffffffffff
mov rdx, rbx
cmp rdx, 0xffffffffffffffff
jne 0x1400398c4
inc r12d
cmp r14, 8
jb 0x140039827
lea rdx, [r14*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x14003981f
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039d80
mov rcx, r11
call fcn.140064808
mov r8d, r12d
lea rdx, str.Item__d
lea rcx, [rbp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x250]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov r15d, 0
je 0x140039740
jmp 0x140039bce
mov r8, rsi
mov rcx, r10
test rsi, rsi
je 0x1400398a9
mov r9, rdx
sub r9, r10
movzx eax, word [rcx]
cmp word [rcx + r9], ax
jne 0x1400398bb
add rcx, 2
sub r8, 1
jne 0x140039895
sub rdx, rdi
sar rdx, 1
mov rbx, 0xffffffffffffffff
jmp 0x1400397df
add rdx, 2
jmp 0x1400397b3
lea r9, [rbp - 0x20]
cmp r14, 8
cmovae r9, r11
cmp r15, 1
jb 0x140039936
lea r10, [r9 + r15*2]
mov rbx, r9
lea r11, [0x140097350]
mov rax, r10
sub rax, rbx
sar rax, 1
je 0x140039936
cmp word [rbx], 0x2a
je 0x1400398ff
add rbx, 2
sub rax, 1
jmp 0x1400398ed
mov edx, 1
mov rcx, r11
mov r8, rbx
sub r8, r11
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140039930
add rcx, 2
sub rdx, 1
jne 0x140039910
sub rbx, r9
sar rbx, 1
lea r15, [rdx - 1]
jmp 0x140039940
add rbx, 2
jmp 0x1400398e4
mov r15, 0xffffffffffffffff
mov rbx, r15
xor r12d, r12d
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r12w
lea r8d, [r12 + 1]
lea rdx, [0x1400957f0]
lea rcx, [rbp + 0x20]
call fcn.14000a2d0
nop
inc rbx
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
mov rax, qword [rbp - 0x10]
cmp rax, rbx
jb 0x140039d68
sub rax, rbx
cmp rax, 0xffffffffffffffff
cmovb r15, rax
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
lea rsi, [rax + rbx*2]
cmp r15, 7
ja 0x1400399e1
mov qword [rsp + 0x70], r15
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140066d60
mov word [rsp + rbx + 0x60], r12w
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x60]
jmp 0x140039a47
movabs r14, 0x7ffffffffffffffe
cmp r15, r14
ja 0x140039d6e
mov rax, r15
or rax, 7
cmp rax, r14
ja 0x140039a10
mov r14, rax
cmp rax, 0xa
mov eax, 0xa
cmovb r14, rax
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x60]
call fcn.14000a470
mov rdi, rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r14
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140066d60
mov word [rdi + rbx], r12w
mov qword [rsp + 0x60], rdi
lea rdx, [rsp + 0x60]
cmp r14, 8
cmovae rdx, rdi
mov r8, r15
lea rcx, [rbp + 0x20]
call fcn.14000baf0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140039aa3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039a9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039d74
call fcn.140064808
mov r8d, 1
lea rdx, [0x1400957f0]
lea rcx, [rbp + 0x20]
call fcn.14000baf0
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r8, qword [rbp + 0x20]
mov rdx, qword [rbp + 0xb10]
mov rcx, qword [rsp + 0x58]
call fcn.140004cd0
mov byte [rsp + 0x40], 1
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x140039b1e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039b18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039d7a
call fcn.140064808
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140039bd1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039b5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039d80
call fcn.140064808
jmp 0x140039bd1
mov r13, qword [rbp - 0x68]
mov rcx, qword [rbp + 0xb10]
shr rcx, 1
lea rax, [rcx - 1]
mov edx, 0x7ffffffe
cmp rax, rdx
ja 0x140039bc0
sub rdx, rcx
lea r8, [0x140093fc8]
mov r9, qword [rsp + 0x58]
sub r8, r9
lea rax, [rdx + rcx]
test rax, rax
je 0x140039bb3
movzx eax, word [r8 + r9]
test ax, ax
je 0x140039bb3
mov word [r9], ax
add r9, 2
sub rcx, 1
jne 0x140039b92
lea rax, [r9 - 2]
test rcx, rcx
cmovne rax, r9
jmp 0x140039bca
test rcx, rcx
je 0x140039bce
mov rax, qword [rsp + 0x58]
mov word [rax], r15w
xor r12d, r12d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140039c1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039c18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039d86
call fcn.140064808
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
cmp r13, 8
jb 0x140039c6a
lea rdx, [r13*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039c65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039d8c
call fcn.140064808
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140039cb6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039cb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039d92
call fcn.140064808
movzx esi, byte [rsp + 0x40]
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x140039cf7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039cf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039d1e
call fcn.140064808
movzx eax, sil
mov rcx, qword [rbp + 0xa90]
xor rcx, rsp
call fcn.140064920
add rsp, 0xba8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14006b51c
nop
call fcn.14000bbd0
nop
call fcn.140004b60
nop
lea rcx, str.invalid_stoi_argument
call fcn.14006344c
nop
call fcn.14006b51c
nop
lea rcx, str.stoi_argument_out_of_range
call fcn.140063494
nop
call fcn.14000bbd0
int3
call fcn.14006b51c
int3
call fcn.140004b60
int3
call fcn.140004b60
nop
call fcn.14000bbd0
int3
call fcn.140004b60
int3
call fcn.14006b51c
nop
call fcn.14006b51c
nop
call fcn.14006b51c
nop
call fcn.14006b51c
nop
call fcn.14006b51c
nop
call fcn.14006b51c
int3