Function at 0x1401010d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
call fcn.140109600
sub eax, 3
je 0x1401010ed
sub eax, 1
je 0x1401010ed
cmp eax, 1
jne 0x140101121
mov rcx, qword [str.0cg_]
lea rax, str.0cg_
cmp rcx, rax
je 0x140101121
test byte [rcx + 0x1c], 1
je 0x140101121
cmp byte [rcx + 0x19], 2
jb 0x140101121
mov rcx, qword [rcx + 0x10]
lea r8, [0x1405f92a0]
mov edx, 0x12
call fcn.14007d150
movzx ecx, bl
mov byte [0x140686d5a], 0
call fcn.1401026a0
call fcn.140108460
movzx r8d, bl
mov ecx, 0x947770fe
call fcn.140104da0
movzx r8d, bl
mov ecx, 0x70c5021d
call fcn.140104da0
movzx r8d, bl
lea rdx, str.Office
lea rcx, str..pdf
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Office
lea rcx, str..doc
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Office
lea rcx, str..xls
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Office
lea rcx, str..ppt
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Office
lea rcx, str..vsd
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Office
lea rcx, str..mdb
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Office
lea rcx, str..rtf
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Media
lea rcx, str..wmv
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Media
lea rcx, str..wma
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Media
lea rcx, str..asf
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Media
lea rcx, str..swf
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Media
lea rcx, str..mov
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Other
lea rcx, str.callto
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Other
lea rcx, str.skype.callto
call fcn.1401053b0
movzx r8d, bl
lea rdx, str.Other
lea rcx, str.skype
call fcn.1401053b0
movzx ecx, bl
add rsp, 0x20
pop rbx
jmp 0x140106a90
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
movzx r12d, cl
mov byte [rsp + 0x30], cl
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x138], xmm1
xor r14d, r14d
mov qword [rbp + 0x148], r14
lea rax, vtable.AutoLock.0
mov qword [rbp - 0x60], rax
lea rsi, [0x140686c78]
mov qword [rbp - 0x58], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8, qword [0x140687dc0]
mov rdx, qword [0x140687db8]
lea rcx, [rbp + 0x138]
call fcn.1400eeb30
mov rdi, qword [rbp + 0x140]
mov rbx, qword [rbp + 0x138]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, rbx
je 0x140107ecc
mov r15, qword [rbp + 0x138]
mov r13, qword [rbp + 0x140]
mov qword [rbp - 0x28], r13
cmp r15, r13
mov qword [rbp - 0x30], r15
je 0x140107ecc
mov edi, 0x5c
mov qword [rbp + 0x118], r14
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], 7
mov word [rbp + 0x118], r14w
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r14w
lea r8d, [rdi - 0x55]
lea rdx, str.Classes
lea rcx, [rbp - 0x50]
call fcn.1400739a0
nop
mov qword [rbp + 0xb8], r14
mov rcx, r14
mov qword [rbp + 0xc8], rcx
mov edx, 7
mov qword [rbp + 0xd0], rdx
mov word [rbp + 0xb8], r14w
cmp qword [r15 + 0x18], 0
jbe 0x140106ca0
lea r9, [r15 + 8]
mov rbx, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 8
jb 0x140106bf0
mov r9, qword [r9]
lea rcx, [rbp + 0xb8]
cmp rbx, 7
ja 0x140106c1b
mov qword [rbp + 0xc8], rbx
lea r8, [rbx + rbx]
mov rdx, r9
call fcn.14035bc80
mov word [rbp + rbx*2 + 0xb8], r14w
jmp 0x140106c2b
lfence
mov qword [rsp + 0x20], rbx
mov rdx, rbx
call fcn.1400735a0
mov rdx, qword [rbp + 0xc8]
mov r8, qword [rbp + 0xd0]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x140106c6e
lea rcx, [rdx + 1]
mov qword [rbp + 0xc8], rcx
lea rax, [rbp + 0xb8]
cmp r8, 8
cmovae rax, qword [rbp + 0xb8]
mov word [rax + rdx*2], di
mov word [rax + rcx*2], r14w
jmp 0x140106c92
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1405e45bc]
mov edx, 1
lea rcx, [rbp + 0xb8]
call fcn.1400735a0
mov rcx, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xd0]
lea r9, [rbp - 0x50]
mov rsi, qword [rbp - 0x50]
mov r14, qword [rbp - 0x38]
cmp r14, 8
cmovae r9, rsi
mov rax, rdx
sub rax, rcx
mov r8, qword [rbp - 0x40]
cmp r8, rax
ja 0x140106cf8
lea rdi, [r8 + rcx]
mov qword [rbp + 0xc8], rdi
lea rbx, [rbp + 0xb8]
cmp rdx, 8
cmovae rbx, qword [rbp + 0xb8]
lea rcx, [rbx + rcx*2]
add r8, r8
mov rdx, r9
call fcn.14035bc80
xor eax, eax
mov word [rbx + rdi*2], ax
jmp 0x140106d18
lfence
mov rdx, qword [rbp - 0x40]
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0xb8]
call fcn.1400735a0
mov r14, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x50]
lea rdx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 8
cmovae rdx, qword [rbp + 0xb8]
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete bl
mov rdx, qword [rbp + 0xd0]
cmp rdx, 8
jb 0x140106d95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140106d90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140107f0e
call fcn.140359090
xor eax, eax
mov word [rbp + 0xb8], ax
cmp r14, 8
jb 0x140106dd9
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140106dd1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140107f14
mov rcx, rsi
call fcn.140359090
xor r14d, r14d
mov word [rbp - 0x50], r14w
test bl, bl
je 0x140107e81
mov dword [rbp + 0x70], 0x208
lea r9, [rbp + 0x70]
lea r8, [rbp + 0x1b0]
lea rdx, str..jar
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x140107743
lea rax, [rbp + 0x1b0]
mov r13, 0xffffffffffffffff
mov r8, r13
inc r8
cmp word [rax + r8*2], r14w
jne 0x140106e25
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x118]
call fcn.1400739a0
mov rcx, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x130]
mov rax, rdx
sub rax, rcx
cmp rax, 0x13
jb 0x140106e97
lea rdi, [rcx + 0x13]
mov qword [rbp + 0x128], rdi
lea rbx, [rbp + 0x118]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x118]
lea rcx, [rbx + rcx*2]
mov r8d, 0x26
lea rdx, str._shellopencommand
call fcn.14035bc80
mov word [rbx + rdi*2], r14w
jmp 0x140106ebb
lfence
mov qword [rsp + 0x20], 0x13
lea r9, str._shellopencommand
mov edx, 0x13
lea rcx, [rbp + 0x118]
call fcn.1400735a0
mov dword [rbp + 0x70], 0x208
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 8
cmovae rdx, qword [rbp + 0x118]
lea r9, [rbp + 0x70]
lea r8, [rbp + 0x1b0]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x140107743
cmp dword [rbp + 0x70], 2
jle 0x140107743
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r14w
lea rax, [rbp + 0x1b0]
mov r8, r13
inc r8
cmp word [rax + r8*2], r14w
jne 0x140106f23
lea rdx, [rbp + 0x1b0]
lea rcx, [rsp + 0x38]
call fcn.1400739a0
nop
mov rbx, qword [rsp + 0x48]
mov qword [rbp - 0x60], rbx
test rbx, rbx
jne 0x140106f89
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
cmovae rax, rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
mov rdi, r14
mov qword [rbp + 0xe8], r14
mov ebx, 7
mov qword [rbp + 0xf0], rbx
jmp 0x14010752b
lea rsi, [rbx + 1]
mov eax, 0x104
cmp rsi, rax
cmovb rsi, rax
mov qword [rsp + 0x78], rsi
mov eax, 2
mul rsi
cmovo rax, r13
mov rcx, rax
call fcn.140368330
mov r14, rax
test rax, rax
jne 0x140107088
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rax
mov rdi, qword [rsp + 0x48]
mov rbx, rdi
lea rsi, [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
cmovae rsi, rcx
movabs r15, 0x7ffffffffffffffe
movabs r13, 0x7fffffffffffffff
cmp rdi, 8
jae 0x14010702e
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], rdi
mov ebx, 7
mov qword [rbp + 0xf0], rbx
jmp 0x14010753f
or rbx, 7
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, r13
ja 0x140107f1a
lfence
add rcx, rcx
call fcn.140073800
mov qword [rbp + 0xd8], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.14035bc80
mov qword [rbp + 0xe8], rdi
mov qword [rbp + 0xf0], rbx
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
jmp 0x14010753f
lea r13, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
jb 0x14010709f
mov r13, qword [rsp + 0x38]
test r13, r13
je 0x1401070d3
cmp word [r13], 0x22
jne 0x1401070d3
lea rdi, [r13 + 2]
mov edx, 0x22
mov rcx, rdi
call fcn.14035b3bc
test rax, rax
je 0x14010719b
sub rax, rdi
sar rax, 1
lea rbx, [rax + rax]
mov rdx, rdi
jmp 0x1401071af
mov r12, r13
test r13, r13
je 0x140107195
mov ecx, 0x2e
call fcn.140383514
movzx edi, ax
mov word [rsp + 0x32], ax
mov ecx, 0x2e
call fcn.140375d24
mov word [rsp + 0x34], ax
movzx ecx, word [r13]
test cx, cx
je 0x140107195
lea r15, [r13 + 2]
cmp cx, di
je 0x14010711c
cmp cx, ax
jne 0x14010717a
lea rdi, [0x140607b3a]
test r15, r15
je 0x140107175
mov rsi, r15
nop dword [rax + rax]
cmp word [rsi], 0
je 0x140107166
test rdi, rdi
je 0x140107166
movzx ecx, word [rdi]
test cx, cx
je 0x140107264
call fcn.140383514
movzx ebx, ax
movzx ecx, word [rsi]
call fcn.140383514
cmp ax, bx
jne 0x140107166
add rdi, 2
add rsi, 2
jne 0x140107130
cmp word [rdi], 0
je 0x140107264
movzx eax, word [rsp + 0x34]
movzx edi, word [rsp + 0x32]
add r12, 2
add r15, 2
movzx ecx, word [r12]
test cx, cx
jne 0x140107112
mov rbx, qword [rbp - 0x60]
mov rsi, qword [rsp + 0x78]
movzx r12d, byte [rsp + 0x30]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
add rbx, rbx
mov r8, rbx
mov rcx, r14
call fcn.14035bc80
xor r15d, r15d
mov word [rbx + r14], r15w
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x90], 7
mov word [rbp + 0x78], r15w
lea r13, [r15 - 1]
cmp word [r14], 0x25
jne 0x140107332
lea rax, str._ProgramFiles_
mov qword [rbp + 0x170], rax
lea rax, str._ProgramW6432_
mov qword [rbp + 0x178], rax
lea rax, str._CommonProgramFiles_
mov qword [rbp + 0x180], rax
lea rax, str._CommonProgramW6432_
mov qword [rbp + 0x188], rax
lea rdi, [rbp + 0x170]
nop dword [rax + rax]
mov rdx, qword [rdi]
mov rbx, r13
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140107236
mov r8, rbx
mov rcx, r14
call fcn.14036ef28
test eax, eax
je 0x140107276
add rdi, 0x10
lea rax, [rbp + 0x190]
cmp rdi, rax
jne 0x140107230
jmp 0x140107327
mov rbx, r12
sub rbx, r13
sar rbx, 1
add rbx, 4
jmp 0x140107190
mov rdx, qword [rdi + 8]
mov r8, r13
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140107280
lea rcx, [rbp + 0x78]
call fcn.1400739a0
lea r9, [r14 + rbx*2]
mov rdx, r13
nop dword [rax + rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1401072a0
mov rcx, qword [rbp + 0x88]
mov rax, qword [rbp + 0x90]
sub rax, rcx
lfence
cmp rdx, rax
ja 0x1401072fd
mov rdi, qword [rbp + 0x88]
add rdi, rdx
mov qword [rbp + 0x88], rdi
lea rbx, [rbp + 0x78]
cmp qword [rbp + 0x90], 8
cmovae rbx, qword [rbp + 0x78]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call fcn.14035bc80
mov word [rbx + rdi*2], r15w
jmp 0x14010730b
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x78]
call fcn.1400735a0
lea r8, [rbp + 0x78]
cmp qword [rbp + 0x90], 8
cmovae r8, qword [rbp + 0x78]
mov rdx, rsi
mov rcx, r14
call fcn.140368338
mov edx, esi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
mov rax, r13
inc rax
cmp word [r14 + rax*2], 0
jne 0x140107335
cmp rax, 1
jbe 0x140107394
lfence
nop dword [rax]
movzx ecx, word [r14 + rax*2 - 2]
cmp cx, 0x20
jne 0x140107366
dec rax
mov word [r14 + rax*2], r15w
jmp 0x14010738e
cmp cx, 0x22
jne 0x140107394
mov word [r14 + rax*2 - 2], r15w
mov edx, 0x22
mov rcx, r14
call fcn.14035b2dc
test rax, rax
je 0x140107394
mov word [rax], r15w
sub rax, r14
sar rax, 1
cmp rax, 1
ja 0x140107350
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x1401073a0
mov rdx, r14
lea rcx, [rbp + 0x78]
call fcn.1400739a0
mov rcx, r14
call fcn.1403683a0
lea rcx, [rbp + 0x78]
call fcn.1401d4ac0
test al, al
je 0x14010745f
lea rcx, [rbp + 0x78]
cmp qword [rbp + 0x90], 8
cmovae rcx, qword [rbp + 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov edi, eax
test eax, eax
je 0x14010745f
lfence
mov eax, 2
mul rdi
cmovo rax, r13
mov rcx, rax
call fcn.140368330
mov rbx, rax
test rax, rax
je 0x14010745f
lfence
lea rcx, [rbp + 0x78]
cmp qword [rbp + 0x90], 8
cmovae rcx, qword [rbp + 0x78]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x140107457
lfence
mov r8, r13
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140107440
mov rdx, rbx
lea rcx, [rbp + 0x78]
call fcn.1400739a0
mov rcx, rbx
call fcn.1403683a0
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 8
cmovae rdx, qword [rbp + 0x78]
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r14w
mov r8, qword [rbp + 0x88]
lea rcx, [rbp - 0x20]
call fcn.1400739a0
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.1401d7750
nop
mov rdx, rax
lea rcx, [rbp + 0xd8]
call fcn.1400733c0
nop
lea rcx, [rbp + 0x20]
call fcn.140073b90
nop
lea rcx, [rbp - 0x20]
call fcn.140073b90
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 8
jb 0x14010750e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140107509
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140107f20
call fcn.140359090
mov word [rbp + 0x78], r14w
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rbp + 0xf0]
mov rdi, qword [rbp + 0xe8]
movabs r13, 0x7fffffffffffffff
movabs r15, 0x7ffffffffffffffe
cmp rdx, 8
jb 0x140107577
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140107572
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140107f26
call fcn.140359090
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r14w
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
lea rsi, [rbp + 0xd8]
cmp rbx, 8
cmovae rsi, qword [rbp + 0xd8]
cmp rdi, 8
jae 0x1401075c9
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
lea rcx, [rbp - 0x80]
jmp 0x140107626
or rdi, 7
cmp rdi, r15
cmova rdi, r15
lea rcx, [rdi + 1]
cmp rcx, r13
ja 0x140107f38
lfence
add rcx, rcx
call fcn.140073800
mov qword [rbp - 0x80], rax
mov rbx, qword [rbp + 0xe8]
lea r8, [rbx*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.14035bc80
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rdi
lea rcx, [rbp - 0x80]
cmp rdi, 8
cmovae rcx, qword [rbp - 0x80]
mov rbx, qword [rbp + 0xf0]
mov edx, dword [rbp + 0xe8]
call qword [sym.imp.USER32.dll_CharLowerBuffW]
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rbp + 0x160], xmm1
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
lea rcx, [rbp - 0x80]
call fcn.140073b90
nop
lea rcx, [rbp + 0x150]
cmp qword [rbp + 0x168], 8
cmovae rcx, qword [rbp + 0x150]
lea rdx, str.java
call fcn.14035b7a0
test rax, rax
je 0x14010769c
movzx edx, r12b
lea rcx, [rbp + 0x150]
call fcn.140107f50
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 8
jb 0x1401076e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401076dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140107f2c
call fcn.140359090
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x168], 7
mov word [rbp + 0x150], r14w
cmp rbx, 8
jb 0x14010773b
lea rdx, [rbx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140107736
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140107f32
call fcn.140359090
mov word [rbp + 0xd8], r14w
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.CLSID5852F5ED_8BF4_11D4_A245_0080C6F74284
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140107e6f
mov dword [rbp + 0x70], 0x208
lea r9, [rbp + 0x70]
lea r8, [rbp + 0x1b0]
lea rdx, str.InprocServer32
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x140107e65
cmp dword [rbp + 0x70], 2
jle 0x140107e65
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
lea rax, [rbp + 0x1b0]
mov r12, 0xffffffffffffffff
mov r8, r12
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1401077d0
lea rdx, [rbp + 0x1b0]
lea rcx, [rsp + 0x58]
call fcn.1400739a0
nop
mov rbx, qword [rsp + 0x68]
mov qword [rbp - 0x60], rbx
test rbx, rbx
jne 0x140107845
mov qword [rbp + 0xf8], r14
mov qword [rbp + 0x108], r14
mov qword [rbp + 0x110], r14
lea rax, [rsp + 0x58]
mov r8, qword [rsp + 0x70]
cmp r8, 8
cmovae rax, qword [rsp + 0x58]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], r14
mov qword [rbp + 0x110], 7
jmp 0x140107df7
lea rsi, [rbx + 1]
mov eax, 0x104
cmp rsi, rax
cmovb rsi, rax
mov qword [rsp + 0x78], rsi
mov eax, 2
mul rsi
cmovo rax, r12
mov rcx, rax
call fcn.140368330
mov r14, rax
test rax, rax
jne 0x140107936
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
mov rdi, qword [rsp + 0x68]
lea rsi, [rsp + 0x58]
mov r8, qword [rsp + 0x70]
cmp r8, 8
cmovae rsi, qword [rsp + 0x58]
cmp rdi, 8
jae 0x1401078cf
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], rdi
mov qword [rbp + 0x110], 7
jmp 0x140107df7
mov rbx, rdi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140107f3e
lfence
add rcx, rcx
call fcn.140073800
mov qword [rbp + 0xf8], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.14035bc80
mov qword [rbp + 0x108], rdi
mov qword [rbp + 0x110], rbx
jmp 0x140107df2
lea r13, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
jb 0x14010794d
mov r13, qword [rsp + 0x58]
test r13, r13
je 0x140107981
cmp word [r13], 0x22
jne 0x140107981
lea rdi, [r13 + 2]
mov edx, 0x22
mov rcx, rdi
call fcn.14035b3bc
test rax, rax
je 0x140107a4c
sub rax, rdi
sar rax, 1
lea rbx, [rax + rax]
mov rdx, rdi
jmp 0x140107a60
mov r12, r13
test r13, r13
je 0x140107a45
mov ecx, 0x2e
call fcn.140383514
movzx edi, ax
mov word [rsp + 0x32], ax
mov ecx, 0x2e
call fcn.140375d24
mov word [rsp + 0x34], ax
movzx ecx, word [r13]
test cx, cx
je 0x140107a45
lea r15, [r13 + 2]
cmp cx, di
je 0x1401079ca
cmp cx, ax
jne 0x140107a2a
lea rdi, [0x140607b3a]
test r15, r15
je 0x140107a25
mov rsi, r15
nop dword [rax]
cmp word [rsi], 0
je 0x140107a16
test rdi, rdi
je 0x140107a16
movzx ecx, word [rdi]
test cx, cx
je 0x140107b14
call fcn.140383514
movzx ebx, ax
movzx ecx, word [rsi]
call fcn.140383514
cmp ax, bx
jne 0x140107a16
add rdi, 2
add rsi, 2
jne 0x1401079e0
cmp word [rdi], 0
je 0x140107b14
movzx eax, word [rsp + 0x34]
movzx edi, word [rsp + 0x32]
add r12, 2
add r15, 2
movzx ecx, word [r12]
test cx, cx
jne 0x1401079c0
mov rbx, qword [rbp - 0x60]
mov rsi, qword [rsp + 0x78]
mov r12, 0xffffffffffffffff
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
add rbx, rbx
mov r8, rbx
mov rcx, r14
call fcn.14035bc80
xor r15d, r15d
mov word [r14 + rbx], r15w
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xb0], 7
mov word [rbp + 0x98], r15w
cmp word [r14], 0x25
jne 0x140107bf1
lea rax, str._ProgramFiles_
mov qword [rbp + 0x190], rax
lea rax, str._ProgramW6432_
mov qword [rbp + 0x198], rax
lea rax, str._CommonProgramFiles_
mov qword [rbp + 0x1a0], rax
lea rax, str._CommonProgramW6432_
mov qword [rbp + 0x1a8], rax
lea rdi, [rbp + 0x190]
nop
mov rdx, qword [rdi]
mov rbx, r12
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140107ae6
mov r8, rbx
mov rcx, r14
call fcn.14036ef28
test eax, eax
je 0x140107b26
add rdi, 0x10
lea rax, [rbp + 0x1b0]
cmp rdi, rax
jne 0x140107ae0
jmp 0x140107be6
mov rbx, r12
sub rbx, r13
sar rbx, 1
add rbx, 4
jmp 0x140107a40
mov rdx, qword [rdi + 8]
mov r8, r12
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140107b30
lea rcx, [rbp + 0x98]
call fcn.1400739a0
lea r9, [r14 + rbx*2]
mov rdx, r12
nop
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140107b50
mov rcx, qword [rbp + 0xa8]
mov rax, qword [rbp + 0xb0]
sub rax, rcx
lfence
cmp rdx, rax
ja 0x140107bb3
mov rdi, qword [rbp + 0xa8]
add rdi, rdx
mov qword [rbp + 0xa8], rdi
lea rbx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 8
cmovae rbx, qword [rbp + 0x98]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call fcn.14035bc80
mov word [rbx + rdi*2], r15w
jmp 0x140107bc4
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x98]
call fcn.1400735a0
lea r8, [rbp + 0x98]
cmp qword [rbp + 0xb0], 8
cmovae r8, qword [rbp + 0x98]
mov rdx, rsi
mov rcx, r14
call fcn.140368338
mov edx, esi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
mov rax, r12
inc rax
cmp word [r14 + rax*2], 0
jne 0x140107bf4
cmp rax, 1
jbe 0x140107c54
lfence
nop dword [rax + rax]
movzx ecx, word [r14 + rax*2 - 2]
cmp cx, 0x20
jne 0x140107c26
dec rax
mov word [r14 + rax*2], r15w
jmp 0x140107c4e
cmp cx, 0x22
jne 0x140107c54
mov word [r14 + rax*2 - 2], r15w
mov edx, 0x22
mov rcx, r14
call fcn.14035b2dc
test rax, rax
je 0x140107c54
mov word [rax], r15w
sub rax, r14
sar rax, 1
cmp rax, 1
ja 0x140107c10
mov r8, r12
nop word [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x140107c60
mov rdx, r14
lea rcx, [rbp + 0x98]
call fcn.1400739a0
mov rcx, r14
call fcn.1403683a0
lea rcx, [rbp + 0x98]
call fcn.1401d4ac0
test al, al
je 0x140107d32
lea rcx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 8
cmovae rcx, qword [rbp + 0x98]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov edi, eax
test eax, eax
je 0x140107d32
lfence
mov eax, 2
mul rdi
cmovo rax, r12
mov rcx, rax
call fcn.140368330
mov rbx, rax
test rax, rax
je 0x140107d32
lfence
lea rcx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 8
cmovae rcx, qword [rbp + 0x98]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x140107d2a
lfence
mov r8, r12
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140107d10
mov rdx, rbx
lea rcx, [rbp + 0x98]
call fcn.1400739a0
mov rcx, rbx
call fcn.1403683a0
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 8
cmovae rdx, qword [rbp + 0x98]
xor r14d, r14d
mov qword [rbp], r14
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], 7
mov word [rbp], r14w
mov r8, qword [rbp + 0xa8]
lea rcx, [rbp]
call fcn.1400739a0
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp]
call fcn.1401d7750
nop
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.1400733c0
nop
lea rcx, [rbp + 0x40]
call fcn.140073b90
nop
lea rcx, [rbp]
call fcn.140073b90
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 8
jb 0x140107dea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140107de5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140107f44
call fcn.140359090
mov word [rbp + 0x98], r14w
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x140107e0f
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.140073b50
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
movzx r12d, byte [rsp + 0x30]
movzx edx, r12b
lea rcx, [rbp + 0xf8]
call fcn.140107f50
nop
mov r8, qword [rbp + 0x110]
cmp r8, 8
jb 0x140107e5d
inc r8
mov rdx, qword [rbp + 0xf8]
lea rcx, [rbp + 0xf8]
call fcn.140073b50
mov word [rbp + 0xf8], r14w
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rbp - 0x30]
mov r13, qword [rbp - 0x28]
mov rdx, qword [rbp + 0x130]
cmp rdx, 8
jb 0x140107ec3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140107ebe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140107f08
call fcn.140359090
add r15, 0x48
jmp 0x140106b51
lea rcx, [rbp + 0x138]
call fcn.14006ead0
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140073980
int3
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140073980
nop
call fcn.140073980
int3
call fcn.140368068
int3