Function at 0x14001acb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb38]
sub rsp, 0xc10
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword [0x1401bc300]
xor rax, rsp
mov qword [rbp + 0xaa0], rax
xor ebx, ebx
mov qword [rbp + 0x790], rbx
mov dword [rbp + 0x818], 0x100
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x8a0]
call sub.VCRUNTIME140.dll_memset
movabs rax, 0x2b19db59b9d9db4
mov qword [rsp + 0x50], rax
movabs rax, 0x18b6f02f6b2388f5
mov qword [rsp + 0x58], rax
movabs rax, 0x176e383a183a472c
mov qword [rsp + 0x60], rax
movabs rax, 0x15d9b2bf6c3014e4
mov qword [rsp + 0x68], rax
movabs rax, 0x946383a22322448
mov qword [rsp + 0x70], rax
movabs rax, 0x8dc71f4f5b8b0c9
mov qword [rsp + 0x78], rax
movabs rax, 0x44a29452df5ca90
mov qword [rbp - 0x80], rax
movabs rax, 0x1fb3bfc97a0b776e
mov qword [rbp - 0x78], rax
movabs rcx, 0x1fffffffe0000000
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], rcx
movabs rax, 0x2e59de69bc49de7
mov qword [rbp - 0x10], rax
movabs rax, 0x18f5f0736b6e88b0
mov qword [rbp - 8], rax
movabs rax, 0x170b384818484759
mov qword [rbp], rax
movabs rax, 0x15b6b2fc6c44148a
mov qword [rbp + 8], rax
movabs rax, 0x929384822462426
mov qword [rbp + 0x10], rax
movabs rax, 0x8a87191f5ebb0a5
mov qword [rbp + 0x18], rax
movabs rax, 0x424292a2db6cacc
mov qword [rbp + 0x20], rax
movabs rax, 0x1fdfbfa67a79771a
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rcx
xorps xmm7, xmm7
xorps xmm8, xmm8
xorps xmm9, xmm9
xorps xmm10, xmm10
xorps xmm11, xmm11
lea rax, [rbp + 0x370]
mov r13d, 0xa
mov ecx, r13d
mov qword [rax], rbx
mov qword [rax + 8], rbx
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14001ae50
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp]
movdqa xmmword [rbp + 0x380], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x390], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x3a0], xmm1
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x3b0], xmm0
movdqa xmmword [rbp + 0x3c0], xmm7
movdqa xmmword [rbp + 0x3d0], xmm8
movdqa xmmword [rbp + 0x3e0], xmm9
movdqa xmmword [rbp + 0x3f0], xmm10
movdqa xmmword [rbp + 0x400], xmm11
lea rax, [rsp + 0x50]
lea rcx, [rbp + 0x370]
mov r12d, 8
mov edx, r12d
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x14001af00
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
lea r8, [rbp + 0x790]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyW]
test eax, eax
jne 0x14001b174
movabs rax, 0x1a3232e1e67159a0
mov qword [rsp + 0x50], rax
movabs rax, 0x10722357d0acc26d
mov qword [rsp + 0x58], rax
movabs rax, 0x1cc22412041145e0
mov qword [rsp + 0x60], rax
movabs rax, 0x1412f4c64ed195bb
mov qword [rsp + 0x68], rax
movabs rax, 0x1d2b1e8d0
mov qword [rsp + 0x70], rax
movabs rcx, 0x4fd02b753ca
mov qword [rsp + 0x78], rcx
movabs rax, 0x1a5f3293e61859e6
mov qword [rbp - 0x50], rax
movabs rax, 0x10172325d0cdc21a
mov qword [rbp - 0x48], rax
movabs rax, 0x1cb6247d047e45a2
mov qword [rbp - 0x40], rax
movabs rax, 0x147bf4b04eb495ff
mov qword [rbp - 0x38], rax
movabs rax, 0x1d2d4e8b3
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rcx
xorps xmm5, xmm5
xorps xmm6, xmm6
xorps xmm7, xmm7
lea rax, [rbp + 0x370]
mov r14d, 6
mov ecx, r14d
nop
mov qword [rax], rbx
mov qword [rax + 8], rbx
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14001b040
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x380], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x390], xmm0
movdqa xmmword [rbp + 0x3a0], xmm5
movdqa xmmword [rbp + 0x3b0], xmm6
movdqa xmmword [rbp + 0x3c0], xmm7
lea rax, [rsp + 0x50]
lea rcx, [rbp + 0x370]
mov edx, 4
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x14001b0b0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
lea rax, [rbp + 0x818]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x8a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9d, [rdx + 2]
lea r8, [rsp + 0x50]
mov rcx, qword [rbp + 0x790]
call qword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
je 0x14001b17b
mov rcx, qword [rbp + 0x790]
call qword [sym.imp.advapi32.dll_RegCloseKey]
xor al, al
jmp 0x14001bf3b
movabs rax, 0x264346bd46c8263
mov qword [rsp + 0x50], rax
movabs rax, 0x5510beda9dcc2e7
mov qword [rsp + 0x58], rax
movabs rax, 0x2c0516fd4103e35
mov qword [rsp + 0x60], rax
movabs rax, 0x412109eae532d44
mov qword [rsp + 0x68], rax
movabs rax, 0x1adebddb44a9ee16
mov qword [rsp + 0x70], rax
movabs rax, 0x508bedbc864cf02
mov qword [rsp + 0x78], rax
movabs rax, 0x2383454d453823f
mov qword [rbp - 0x50], rax
movabs rax, 0x5130ba2a990c2a0
mov qword [rbp - 0x48], rax
movabs rax, 0x28f513dd45c3e74
mov qword [rbp - 0x40], rax
movabs rax, 0x45310c2ae072d0b
mov qword [rbp - 0x38], rax
movabs rax, 0x1abfbd9544caee64
mov qword [rbp - 0x30], rax
movabs rax, 0x508be87c801cf6f
mov qword [rbp - 0x28], rax
xorps xmm5, xmm5
xorps xmm6, xmm6
xorps xmm7, xmm7
lea rax, [rbp + 0x370]
mov rcx, r14
nop dword [rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14001b240
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [rbp - 0x40]
xorps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x380], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x390], xmm0
movdqa xmmword [rbp + 0x3a0], xmm5
movdqa xmmword [rbp + 0x3b0], xmm6
movdqa xmmword [rbp + 0x3c0], xmm7
lea rax, [rsp + 0x50]
lea rcx, [rbp + 0x370]
mov rdx, r14
nop
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x14001b2b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x7f8], xmm0
mov qword [rbp + 0x808], rbx
mov qword [rbp + 0x810], rbx
lea rax, [rsp + 0x50]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x14001b330
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x7f8]
call fcn.14000b1a0
nop
lea rax, [rbp + 0x8a0]
mov rsi, rdi
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14001b356
mov r15, qword [rbp + 0x808]
mov rcx, qword [rbp + 0x810]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x14001b3b9
lea rax, [rsi + r15]
mov qword [rbp + 0x808], rax
lea rbx, [rbp + 0x7f8]
cmp rcx, 7
cmova rbx, qword [rbp + 0x7f8]
lea rcx, [rbx + r15*2]
lea r8, [rsi + rsi]
lea rdx, [rbp + 0x8a0]
call sub.VCRUNTIME140.dll_memcpy_1
lea rax, [r15 + rsi]
xor ecx, ecx
mov word [rbx + rax*2], cx
xor ebx, ebx
jmp 0x14001b3da
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x8a0]
movzx r8d, byte [rsp + 0x40]
mov rdx, rsi
lea rcx, [rbp + 0x7f8]
call fcn.14001aad0
movabs rax, 0x258f3c8eeeede91
mov qword [rsp + 0x50], rax
movabs rax, 0x272e3ee684e6bd
mov qword [rsp + 0x58], rax
movabs rax, 0x1acd8e37dacd895b
mov qword [rsp + 0x60], rax
movabs rax, 0xbaa59e3ff0af742
mov qword [rsp + 0x68], rax
movabs rax, 0x1e93b3127acd7acb
mov qword [rsp + 0x70], rax
movabs rax, 0x91c5ee23f0407b4
mov qword [rsp + 0x78], rax
movabs rax, 0x1f4af3128e37ca41
mov qword [rbp - 0x80], rax
movabs rax, 0x1c42e239566e372e
mov qword [rbp - 0x78], rax
movabs rax, 0x211f38eeeabdecd
mov qword [rbp - 0x30], rax
movabs rax, 0x442e57e6c9e6e1
mov qword [rbp - 0x28], rax
movabs rax, 0x1aa28e44daa28929
mov qword [rbp - 0x20], rax
movabs rax, 0xbe859bfff7ef724
mov qword [rbp - 0x18], rax
movabs rax, 0x1ecfb3667aa27aa4
mov qword [rbp - 0x10], rax
movabs rax, 0x9685e8f3f6107d9
mov qword [rbp - 8], rax
movabs rax, 0x1f64f3668e44ca24
mov qword [rbp], rax
movabs rax, 0x1c42e2505608374b
mov qword [rbp + 8], rax
xorps xmm6, xmm6
xorps xmm7, xmm7
xorps xmm8, xmm8
xorps xmm9, xmm9
lea rax, [rbp + 0x370]
mov rcx, r12
nop dword [rax + rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14001b4e0
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x380], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x390], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp]
movdqa xmmword [rbp + 0x3a0], xmm1
movdqa xmmword [rbp + 0x3b0], xmm6
movdqa xmmword [rbp + 0x3c0], xmm7
movdqa xmmword [rbp + 0x3d0], xmm8
movdqa xmmword [rbp + 0x3e0], xmm9
lea rax, [rsp + 0x50]
lea rcx, [rbp + 0x370]
mov rdx, r12
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x14001b570
lea rax, [rsp + 0x50]
mov rsi, rdi
nop word [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14001b5d0
mov r15, qword [rbp + 0x808]
mov rcx, qword [rbp + 0x810]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x14001b631
lea rax, [r15 + rsi]
mov qword [rbp + 0x808], rax
lea rbx, [rbp + 0x7f8]
cmp rcx, 7
cmova rbx, qword [rbp + 0x7f8]
lea rcx, [rbx + r15*2]
lea r8, [rsi + rsi]
lea rdx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r15 + rsi]
xor ecx, ecx
mov word [rbx + rax*2], cx
xor ebx, ebx
jmp 0x14001b650
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
movzx r8d, byte [rsp + 0x40]
mov rdx, rsi
lea rcx, [rbp + 0x7f8]
call fcn.14001aad0
movabs rax, 0x180f2d588d59380e
mov qword [rsp + 0x50], rax
movabs rax, 0x129a14d8f2cb74b3
mov qword [rsp + 0x58], rax
movabs rax, 0x19e1083a4b8736e8
mov qword [rsp + 0x60], rax
movabs rax, 0xb4c5c2a4231d1
mov qword [rsp + 0x68], rax
movabs rax, 0xff9f518b98ba149
mov qword [rsp + 0x70], rax
movabs rax, 0x12f5897255d47e86
mov qword [rsp + 0x78], rax
movabs rax, 0x18532d678d663852
mov qword [rbp - 0x50], rax
movabs rax, 0x12d81497f28774f4
mov qword [rbp - 0x48], rax
movabs rax, 0x19ae08684bcb36a9
mov qword [rbp - 0x40], rax
movabs rax, 0x4a4c002a16319e
mov qword [rbp - 0x38], rax
movabs rax, 0xf98f556b9e8a13b
mov qword [rbp - 0x30], rax
movabs rax, 0x12f5892e55b17eeb
mov qword [rbp - 0x28], rax
xorps xmm5, xmm5
xorps xmm6, xmm6
xorps xmm7, xmm7
lea rax, [rbp + 0x370]
mov rcx, r14
mov qword [rax], rbx
mov qword [rax + 8], rbx
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14001b711
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x380], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x390], xmm0
movdqa xmmword [rbp + 0x3a0], xmm5
movdqa xmmword [rbp + 0x3b0], xmm6
movdqa xmmword [rbp + 0x3c0], xmm7
lea rax, [rsp + 0x50]
lea rcx, [rbp + 0x370]
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub r14, 1
jne 0x14001b780
xorps xmm0, xmm0
movups xmmword [rbp + 0x7d8], xmm0
mov qword [rbp + 0x7e8], rbx
mov qword [rbp + 0x7f0], rbx
lea rax, [rsp + 0x50]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x14001b7f2
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x7d8]
call fcn.14000b1a0
nop
lea rax, [rbp + 0x8a0]
mov rsi, rdi
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14001b820
mov r14, qword [rbp + 0x7e8]
mov rcx, qword [rbp + 0x7f0]
mov rax, rcx
sub rax, r14
cmp rsi, rax
ja 0x14001b883
lea rax, [rsi + r14]
mov qword [rbp + 0x7e8], rax
lea rbx, [rbp + 0x7d8]
cmp rcx, 7
cmova rbx, qword [rbp + 0x7d8]
lea rcx, [rbx + r14*2]
lea r8, [rsi + rsi]
lea rdx, [rbp + 0x8a0]
call sub.VCRUNTIME140.dll_memcpy_1
lea rax, [r14 + rsi]
xor ecx, ecx
mov word [rbx + rax*2], cx
xor ebx, ebx
jmp 0x14001b8a4
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x8a0]
movzx r8d, byte [rsp + 0x40]
mov rdx, rsi
lea rcx, [rbp + 0x7d8]
call fcn.14001aad0
movabs rax, 0x1a6f2c3267741498
mov qword [rsp + 0x50], rax
movabs rax, 0xee4fc177476125a
mov qword [rsp + 0x58], rax
movabs rax, 0xec541c08ec53cff
mov qword [rsp + 0x60], rax
movabs rax, 0x1bc8aaed4f74a6f1
mov qword [rsp + 0x68], rax
movabs rax, 0x149aa67f6ec52ec3
mov qword [rsp + 0x70], rax
movabs rax, 0x16256f354e91b67d
mov qword [rsp + 0x78], rax
movabs rax, 0x14bc040f08ce2545
mov qword [rbp - 0x80], rax
movabs rax, 0x37ca3dc2403c3a2
mov qword [rbp - 0x78], rax
movabs rdx, 0x1fffffffe0000000
mov qword [rbp - 0x70], rdx
movabs rcx, 0xe000000020000254
mov qword [rbp - 0x68], rcx
movabs rax, 0x1a262c74673114c4
mov qword [rbp - 0x10], rax
movabs rax, 0xe87fc7e743b1206
mov qword [rbp - 8], rax
movabs rax, 0xeaa41b38eaa3c8d
mov qword [rbp], rax
movabs rax, 0x1b8aaab14f00a697
mov qword [rbp + 8], rax
movabs rax, 0x14c6a60b6eaa2eac
mov qword [rbp + 0x10], rax
movabs rax, 0x16516f5a4efeb61f
mov qword [rbp + 0x18], rax
movabs rax, 0x14cb046908a92528
mov qword [rbp + 0x20], rax
movabs rax, 0x315a3ba2466c38c
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x38], rcx
xorps xmm7, xmm7
xorps xmm8, xmm8
xorps xmm9, xmm9
xorps xmm10, xmm10
xorps xmm11, xmm11
lea rax, [rbp + 0x370]
nop dword [rax + rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
lea rax, [rax + 0x10]
sub r13, 1
jne 0x14001b9d0
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp]
movdqa xmmword [rbp + 0x380], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x390], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x3a0], xmm1
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x3b0], xmm0
movdqa xmmword [rbp + 0x3c0], xmm7
movdqa xmmword [rbp + 0x3d0], xmm8
movdqa xmmword [rbp + 0x3e0], xmm9
movdqa xmmword [rbp + 0x3f0], xmm10
movdqa xmmword [rbp + 0x400], xmm11
lea rax, [rsp + 0x50]
lea rcx, [rbp + 0x370]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub r12, 1
jne 0x14001ba71
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
lea rax, [rsp + 0x50]
mov rsi, rdi
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14001bae0
mov r14, qword [rbp + 0x7e8]
mov rcx, qword [rbp + 0x7f0]
mov rax, rcx
sub rax, r14
cmp rsi, rax
ja 0x14001bb41
lea rax, [rsi + r14]
mov qword [rbp + 0x7e8], rax
lea rbx, [rbp + 0x7d8]
cmp rcx, 7
cmova rbx, qword [rbp + 0x7d8]
lea rcx, [rbx + r14*2]
lea r8, [rsi + rsi]
lea rdx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rsi]
xor ecx, ecx
mov word [rbx + rax*2], cx
xor ebx, ebx
jmp 0x14001bb60
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
movzx r8d, byte [rsp + 0x40]
mov rdx, rsi
lea rcx, [rbp + 0x7d8]
call fcn.14001aad0
mov qword [rbp + 0x798], rdi
mov qword [rbp + 0x7a0], rdi
mov dword [rbp + 0x824], ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0x840], xmm0
mov dword [rbp + 0x7ac], ebx
mov dword [rbp + 0x7c4], ebx
movups xmmword [rbp + 0x830], xmm0
lea rcx, [rbp + 0x7f8]
mov esi, 0xfffc
cmp qword [rbp + 0x810], 7
jbe 0x14001bbbb
mov rcx, qword [rbp + 0x7f8]
test rcx, rcx
jne 0x14001bbbb
mov dword [rbp + 0x820], ecx
jmp 0x14001bbe6
mov rax, rdi
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14001bbc0
add rax, rax
cmp rax, rsi
cmova rax, rsi
mov word [rbp + 0x820], ax
add ax, 2
mov word [rbp + 0x822], ax
mov qword [rbp + 0x828], rcx
mov dword [rbp + 0x7a8], 0x30
mov qword [rbp + 0x7b0], rbx
mov dword [rbp + 0x7c0], 0x40
lea rax, [rbp + 0x820]
mov qword [rbp + 0x7b8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x7c8], xmm0
mov dword [rsp + 0x28], 0x4462
mov dword [rsp + 0x20], 3
lea r9, [rbp + 0x830]
lea r8, [rbp + 0x7a8]
mov edx, 0x12019f
lea rcx, [rbp + 0x798]
call fcn.14008ab71
test eax, eax
jns 0x14001bc68
mov rcx, qword [rbp + 0x790]
call qword [sym.imp.advapi32.dll_RegCloseKey]
xor bl, bl
jmp 0x14001be8b
lea rax, [rbp + 0x7d8]
cmp qword [rbp + 0x7f0], 7
jbe 0x14001bc85
mov rax, qword [rbp + 0x7d8]
test rax, rax
je 0x14001bcab
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14001bc85
add rdi, rdi
cmp rdi, rsi
cmova rdi, rsi
mov word [rbp + 0x840], di
add di, 2
mov word [rbp + 0x842], di
mov qword [rbp + 0x848], rax
mov dword [rbp + 0x7a8], 0x30
mov qword [rbp + 0x7b0], rbx
mov dword [rbp + 0x7c0], 0x40
lea rax, [rbp + 0x840]
mov qword [rbp + 0x7b8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x7c8], xmm0
mov dword [rsp + 0x28], 0x4462
mov dword [rsp + 0x20], 3
lea r9, [rbp + 0x830]
lea r8, [rbp + 0x7a8]
mov edx, 0x12019f
lea rcx, [rbp + 0x7a0]
call fcn.14008ab71
test eax, eax
jns 0x14001bd3a
mov rcx, qword [rbp + 0x790]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x798]
call qword [sym.imp.kernel32.dll_CloseHandle]
xor bl, bl
jmp 0x14001be8b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x878], xmm0
movups xmmword [rbp + 0x888], xmm0
mov qword [rbp + 0x898], rax
mov dword [rsp + 0x20], 4
lea r9d, [rax + 0x28]
lea r8, [rbp + 0x878]
lea rdx, [rbp + 0x830]
mov rcx, qword [rbp + 0x798]
call fcn.14008ab5b
test eax, eax
js 0x14001be37
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x850], xmm0
movups xmmword [rbp + 0x860], xmm0
mov qword [rbp + 0x870], rax
mov dword [rsp + 0x20], 4
lea r9d, [rax + 0x28]
lea r8, [rbp + 0x850]
lea rdx, [rbp + 0x830]
mov rcx, qword [rbp + 0x7a0]
call fcn.14008ab5b
test eax, eax
js 0x14001be37
mov rax, qword [rbp + 0x878]
cmp qword [rbp + 0x850], rax
je 0x14001be62
mov qword [rbp + 0x850], rax
mov rax, qword [rbp + 0x890]
mov qword [rbp + 0x868], rax
mov rax, qword [rbp + 0x880]
mov qword [rbp + 0x858], rax
mov rax, qword [rbp + 0x888]
mov qword [rbp + 0x860], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rbp + 0x850]
lea rdx, [rbp + 0x830]
mov rcx, qword [rbp + 0x7a0]
call fcn.14008ab66
test eax, eax
jns 0x14001be62
mov rcx, qword [rbp + 0x790]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x798]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x7a0]
call qword [sym.imp.kernel32.dll_CloseHandle]
xor bl, bl
jmp 0x14001be8b
mov rcx, qword [rbp + 0x790]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x798]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x7a0]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp + 0x7f0]
cmp rdx, 7
jbe 0x14001bed4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x7d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001becf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001becf
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2e38
xor ecx, ecx
mov qword [rbp + 0x7e8], rcx
mov qword [rbp + 0x7f0], 7
mov word [rbp + 0x7d8], cx
mov rdx, qword [rbp + 0x810]
cmp rdx, 7
jbe 0x14001bf38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x7f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bf33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bf33
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f2e38
movzx eax, bl
mov rcx, qword [rbp + 0xaa0]
xor rcx, rsp
call fcn.1400f3250
lea r11, [rsp + 0xc10]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret