Function at 0x140099008
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x168]
sub rsp, 0x268
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1401080e0]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov qword [rbp - 0x78], r9
mov rbx, r8
mov qword [rbp - 0x40], rbx
mov rax, rdx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x78], rcx
mov qword [rbp + 0x58], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
xor edx, edx
mov qword [rbp + 0x10], rdx
mov qword [rbp - 0x80], rdx
test rax, rax
jne 0x14009933d
lea r8d, [rax + 0x13]
lea rdx, [rbp + 0x20]
mov rcx, rbx
call fcn.14006a764
lea rdx, str.HKEY_LOCAL_MACHINE_
mov rcx, qword [rax]
call qword [sym.imp.MSVCR120.dll_wcscmp]
test eax, eax
sete dil
mov rcx, qword [rbp + 0x20]
add rcx, 0xfffffffffffffff4
or rsi, 0xffffffffffffffff
cmp rcx, qword [0x140108010]
je 0x1400990c0
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x1400990c0
mov rcx, qword [rbp + 0x20]
add rcx, 0xfffffffffffffff4
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
test dil, dil
mov edi, send
je 0x1400990d4
mov qword [rbp - 0x80], 0xffffffff80000002
jmp 0x140099139
mov r8d, edi
lea rdx, [rbp + 0x38]
mov rcx, rbx
call fcn.14006a764
lea rdx, str.HKEY_CURRENT_USER_
mov rcx, qword [rax]
call qword [sym.imp.MSVCR120.dll_wcscmp]
test eax, eax
sete dil
mov rcx, qword [rbp + 0x38]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x140099123
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x140099123
mov rcx, qword [rbp + 0x38]
add rcx, 0xfffffffffffffff4
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
test dil, dil
je 0x140099301
mov qword [rbp - 0x80], 0xffffffff80000001
mov edi, send
mov r9d, edi
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.14006a918
nop
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp]
call fcn.14006ce24
mov qword [rsp + 0x68], rax
lea r8d, [rdi + 1]
lea rdx, [rbp + 0x28]
mov rcx, rbx
call fcn.14006a8f0
nop
mov rdx, rax
mov rcx, rbx
call fcn.140068904
nop
mov rcx, qword [rbp + 0x28]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x1400991a5
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x1400991a5
mov rcx, qword [rbp + 0x28]
add rcx, 0xfffffffffffffff4
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rdx, qword [rsp + 0x68]
mov rdi, qword [rbp - 0x78]
mov rcx, rdi
call fcn.140021304
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x1400991d7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x1400991d7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
jne 0x14009924a
mov ecx, 0x90
call sub.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rbp - 0x70], rax
xor ecx, ecx
test rax, rax
je 0x140099205
lea rdx, [0x1400cc3f8]
mov rcx, rax
call fcn.140021590
mov rbx, rax
jmp 0x140099208
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
call fcn.140020fcc
xor edi, edi
test rbx, rbx
je 0x140099233
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x140099233
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x140099236
mov rax, rdi
mov r8, qword [rsp + 0x68]
lea rdx, str.name
mov rcx, rax
call fcn.140021930
lea rax, [rbp - 0x30]
mov qword [rbp - 0x70], rax
mov rcx, qword [rbp - 0x40]
mov rdi, qword [rcx]
xor ecx, ecx
cmp dword [rdi - 0xc], ecx
jl 0x14009926a
mov qword [rbp - 0x30], rdi
lock inc dword [rdi - 0xc]
jmp 0x140099296
mov rax, qword [0x140108018]
mov qword [rbp - 0x30], rax
test rdi, rdi
jne 0x14009927e
mov eax, ecx
jmp 0x140099287
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rdi
mov edx, eax
lea rcx, [rbp - 0x30]
call fcn.140067304
nop
xor edi, edi
test rbx, rbx
je 0x1400992b6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x1400992b6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x1400992b9
mov rax, rdi
mov r9, rax
lea r8, [rbp - 0x30]
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x78]
call fcn.140099008
nop
mov rcx, qword [rbp - 0x10]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x140099d29
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x140099d29
mov rcx, qword [rbp - 0x10]
add rcx, 0xfffffffffffffff4
jmp 0x140099d23
lea rcx, [rbp]
call fcn.140068890
nop
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x140099333
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x140099333
mov rcx, qword [rbx]
sub rcx, 0xc
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, 1
jmp 0x140099d61
mov rcx, qword [r8]
or rsi, 0xffffffffffffffff
cmp dword [rcx - 8], edx
jle 0x14009935c
lea edx, [rsi + 0x5d]
call qword [sym.imp.MSVCR120.dll_wcschr]
mov rdi, rax
xor edx, edx
test rax, rax
jne 0x140099360
mov edi, esi
jmp 0x140099366
sub rdi, qword [rbx]
sar rdi, 1
mov rbx, qword [rbx]
cmp dword [rbx - 0xc], edx
jl 0x140099378
mov qword [rbp - 0x48], rbx
lock inc dword [rbx - 0xc]
jmp 0x1400993a4
mov rax, qword [0x140108018]
mov qword [rbp - 0x48], rax
test rbx, rbx
jne 0x14009938c
mov eax, edx
jmp 0x140099395
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rbp - 0x48]
call fcn.140067304
nop
test edi, edi
jle 0x1400993f3
mov r9d, edi
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp - 0x40]
call fcn.14006a918
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140068904
nop
mov rcx, qword [rbp + 0x30]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x1400993f3
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x1400993f3
mov rcx, qword [rbp + 0x30]
add rcx, 0xfffffffffffffff4
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp]
call fcn.14006ce24
mov qword [rsp + 0x68], rax
mov rdx, rax
mov rcx, qword [rbp - 0x78]
call fcn.140021304
mov rbx, rax
mov qword [rbp - 0x28], rax
xor eax, eax
test rbx, rbx
je 0x140099436
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x28]
test rax, rax
je 0x140099436
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
jne 0x1400994a9
mov ecx, 0x90
call sub.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rbp - 0x70], rax
xor ecx, ecx
test rax, rax
je 0x140099464
lea rdx, [0x1400cc3f8]
mov rcx, rax
call fcn.140021590
mov rbx, rax
jmp 0x140099467
mov rbx, rcx
mov qword [rbp - 0x28], rbx
mov rdx, rbx
mov rcx, qword [rbp - 0x78]
call fcn.140020fcc
xor eax, eax
test rbx, rbx
je 0x140099495
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x140099495
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov r8, qword [rsp + 0x68]
lea rdx, str.name
mov rcx, rax
call fcn.140021930
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x80000000
xor r8d, r8d
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140099c88
test edi, edi
jle 0x1400995a8
lea r8d, [rdi + 1]
lea rdx, [rbp + 0x18]
mov rdi, qword [rbp - 0x40]
mov rcx, rdi
call fcn.14006a8f0
nop
mov rdx, rax
mov rcx, rdi
call fcn.140068904
nop
mov rcx, qword [rbp + 0x18]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x140099525
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x140099525
mov rcx, qword [rbp + 0x18]
add rcx, 0xfffffffffffffff4
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
lea rax, [rbp - 0x38]
mov qword [rbp - 0x70], rax
mov rdi, qword [rdi]
xor eax, eax
cmp dword [rdi - 0xc], eax
jl 0x140099541
mov qword [rbp - 0x38], rdi
lock inc dword [rdi - 0xc]
jmp 0x14009956b
mov rax, qword [0x140108018]
mov qword [rbp - 0x38], rax
xor eax, eax
test rdi, rdi
je 0x14009955c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rdi
mov edx, eax
lea rcx, [rbp - 0x38]
call fcn.140067304
nop
xor edi, edi
test rbx, rbx
je 0x14009958b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x14009958b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x14009958e
mov rax, rdi
mov r9, rax
lea r8, [rbp - 0x38]
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x78]
call fcn.140099008
jmp 0x140099c7c
xor edi, edi
mov dword [rbp - 0x5c], edi
mov dword [rbp - 0x4c], edi
mov dword [rbp - 0x64], edi
mov dword [rbp - 0x58], edi
mov dword [rbp - 0x60], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x64]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140099c7c
xor eax, eax
cmp dword [rbp - 0x5c], eax
jle 0x1400996d2
mov ecx, dword [rbp - 0x4c]
inc ecx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400befcc
mov qword [rsp + 0x68], rax
mov ecx, dword [rbp - 0x4c]
inc ecx
mov dword [rbp - 8], ecx
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 8]
mov r8, rax
mov edx, edi
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400996bb
lea rax, [rbp + 0x40]
mov qword [rbp - 0x70], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp + 0x40]
call fcn.14006874c
mov qword [rbp - 0x78], rax
xor eax, eax
test rbx, rbx
je 0x1400996a6
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x28]
test rax, rax
je 0x1400996a6
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x28]
nop
mov r9, rax
mov r8, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x78]
call fcn.140099008
mov rcx, qword [rsp + 0x68]
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
inc edi
cmp edi, dword [rbp - 0x5c]
jl 0x14009961a
xor eax, eax
mov edi, eax
mov dword [rbp - 0x50], eax
cmp dword [rbp - 0x64], eax
jle 0x140099c7c
mov ecx, dword [rbp - 0x58]
inc ecx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400befcc
mov qword [rbp - 0x78], rax
mov ecx, dword [rbp - 0x60]
call fcn.1400befcc
mov qword [rsp + 0x78], rax
mov ecx, dword [rbp - 0x58]
inc ecx
mov dword [rbp - 0x18], ecx
mov ecx, dword [rbp - 0x60]
mov dword [rbp - 0x68], ecx
xor edx, edx
mov dword [rbp - 0x54], edx
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x18]
mov r8, qword [rbp - 0x78]
mov edx, edi
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor edi, edi
test eax, eax
jne 0x140099c56
test rbx, rbx
je 0x140099776
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test rax, rax
je 0x140099776
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov rdi, rax
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp]
call fcn.14006ce24
mov rdx, rax
mov rcx, rdi
call fcn.140021304
mov rdi, rax
mov qword [rsp + 0x68], rax
xor eax, eax
test rdi, rdi
je 0x1400997b4
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
je 0x1400997b4
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
jne 0x14009981a
mov ecx, 0x90
call sub.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rbp - 0x70], rax
xor ecx, ecx
test rax, rax
je 0x1400997e4
lea rdx, [0x1400cc3fc]
mov rcx, rax
call fcn.140021590
mov rdi, rax
xor ecx, ecx
jmp 0x1400997e7
mov rdi, rcx
mov qword [rsp + 0x68], rdi
test rbx, rbx
je 0x14009980c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
xor ecx, ecx
test rax, rax
je 0x14009980c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x14009980f
mov rax, rcx
mov rdx, rdi
mov rcx, rax
call fcn.140020fcc
xor eax, eax
test rdi, rdi
je 0x140099838
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
je 0x140099838
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov qword [rsp + 0x60], rax
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp]
call fcn.14006ce24
mov r8, rax
lea rdx, str.name
mov rcx, qword [rsp + 0x60]
call fcn.140021930
xor eax, eax
mov byte [rbp + 0xd0], al
xor edx, edx
lea r8d, [rax + 0x7f]
lea rcx, [rbp + 0xd1]
call sub.MSVCR120.dll_memset
mov r9d, dword [rbp - 0x54]
cmp r9d, 3
jne 0x14009988b
lea rax, str.REG_BINARY
jmp 0x1400998f6
cmp r9d, 4
jne 0x14009989a
lea rax, str.REG_DWORD
jmp 0x1400998f6
cmp r9d, 2
jne 0x1400998a9
lea rax, str.REG_EXPAND_SZ
jmp 0x1400998f6
cmp r9d, 7
jne 0x1400998b8
lea rax, str.REG_MULTI_SZ
jmp 0x1400998f6
cmp r9d, 0xb
jne 0x1400998c7
lea rax, str.REG_QWORD
jmp 0x1400998f6
cmp r9d, 1
jne 0x1400998d6
lea rax, str.REG_SZ
jmp 0x1400998f6
lea r8, str.Unknown_type__0x_08x_
mov edx, 0x80
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCR120.dll_sprintf_s]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x60], rax
xor eax, eax
test rdi, rdi
je 0x140099919
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
je 0x140099919
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov r8, qword [rsp + 0x60]
lea rdx, str.type
mov rcx, rax
call fcn.140021930
mov ecx, dword [rbp - 0x54]
cmp ecx, 3
jne 0x140099a4c
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
xor eax, eax
mov qword [rbp + 0x70], rax
mov byte [rbp + 0x60], al
mov dword [rsp + 0x70], eax
cmp dword [rbp - 0x68], eax
jle 0x1400999f7
mov rbx, qword [rsp + 0x78]
mov esi, eax
xor edi, edi
movzx r9d, byte [rbx]
lea r8, [0x1400cc478]
mov edx, 0xa
lea rcx, [rbp + 0x80]
call qword [sym.imp.MSVCR120.dll_sprintf_s]
cmp byte [rbp + 0x80], dil
jne 0x14009998b
mov rax, rdi
jmp 0x140099997
lea rcx, [rbp + 0x80]
call sub.MSVCR120.dll_strlen
mov r8, rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x60]
call fcn.14006d718
mov eax, dword [rbp - 0x68]
cmp esi, eax
jge 0x1400999d3
lea rcx, [0x1400e7110]
call sub.MSVCR120.dll_strlen
mov r8, rax
lea rdx, [0x1400e7110]
lea rcx, [rbp + 0x60]
call fcn.14006d718
mov eax, dword [rbp - 0x68]
inc esi
inc rbx
cmp esi, eax
jl 0x140099960
cmp qword [rbp + 0x78], 0x10
mov rbx, qword [rbp - 0x28]
mov rdi, qword [rsp + 0x68]
mov rsi, 0xffffffffffffffff
mov rax, qword [rbp + 0x60]
jae 0x1400999fb
lea rax, [rbp + 0x60]
mov qword [rsp + 0x68], rax
xor eax, eax
test rdi, rdi
je 0x140099a1e
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
je 0x140099a1e
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov r8, qword [rsp + 0x68]
lea rdx, str.value
mov rcx, rax
call fcn.140021930
nop
cmp qword [rbp + 0x78], 0x10
jb 0x140099c56
mov rcx, qword [rbp + 0x60]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140099c56
cmp ecx, 4
jne 0x140099abb
xor eax, eax
mov byte [rbp + 0x90], al
xor edx, edx
lea r8d, [rcx + 0x3b]
lea rcx, [rbp + 0x91]
call sub.MSVCR120.dll_memset
mov rdx, qword [rsp + 0x78]
mov r9d, dword [rdx]
mov dword [rsp + 0x20], r9d
lea r8, str.0x_08x___lu_
mov edx, reloc.OLEAUT32.dll_VarI4FromDisp
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCR120.dll_sprintf_s]
xor eax, eax
test rdi, rdi
je 0x140099aaf
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test rax, rax
je 0x140099aaf
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
lea r8, [rbp + 0x90]
jmp 0x140099c47
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140099c13
cmp ecx, 7
jne 0x140099c56
xor r8d, r8d
mov edx, r8d
mov ecx, r8d
mov r9, qword [rsp + 0x78]
mov rax, r9
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], ecx
cmp word [rax], r8w
jne 0x140099c08
mov r8d, ecx
sub r8d, edx
movsxd rax, edx
lea rdx, [r9 + rax*2]
lea rcx, [rbp + 0x48]
call fcn.140072dd8
nop
mov rsi, qword [rbp + 0x48]
mov rdx, rsi
lea rcx, [rbp]
call fcn.14006ce24
mov qword [rbp - 0x70], rax
mov ecx, 0x90
call sub.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x60], rax
xor ecx, ecx
test rax, rax
je 0x140099b4d
lea rdx, [0x1400cc490]
mov rcx, rax
call fcn.140021590
mov qword [rsp + 0x60], rax
xor ecx, ecx
jmp 0x140099b52
mov qword [rsp + 0x60], rcx
test rdi, rdi
je 0x140099b72
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
xor ecx, ecx
test rax, rax
je 0x140099b72
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
jmp 0x140099b75
mov rax, rcx
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call fcn.140020fcc
mov rcx, qword [rsp + 0x60]
xor eax, eax
test rcx, rcx
je 0x140099ba4
mov rax, qword [rcx]
call qword [rax + 0x28]
test rax, rax
je 0x140099ba4
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov r8, qword [rbp - 0x70]
lea rdx, str.value
mov rcx, rax
call fcn.140021930
mov edx, dword [rsp + 0x70]
inc edx
mov dword [rsp + 0x60], edx
lea rcx, [rsi - 0xc]
or rsi, 0xffffffffffffffff
xor r8d, r8d
cmp rcx, qword [0x140108010]
je 0x140099bed
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x140099bed
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov edx, dword [rsp + 0x60]
xor r8d, r8d
mov rax, qword [rsp + 0x68]
cmp word [rax], r8w
jne 0x140099bff
cmp word [rax + 2], r8w
je 0x140099c56
mov r9, qword [rsp + 0x78]
mov ecx, dword [rsp + 0x70]
inc ecx
add rax, 2
jmp 0x140099ae1
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp]
call fcn.14006ce24
mov qword [rbp - 0x70], rax
xor eax, eax
test rdi, rdi
je 0x140099c43
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x28]
test rax, rax
je 0x140099c43
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x28]
mov r8, qword [rbp - 0x70]
lea rdx, str.value
mov rcx, rax
call fcn.140021930
mov rcx, qword [rbp - 0x78]
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, dword [rbp - 0x50]
inc eax
mov dword [rbp - 0x50], eax
cmp eax, dword [rbp - 0x64]
mov edi, eax
jl 0x1400996e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140099d06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.140069538
nop
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp]
call fcn.14006ce24
mov rdi, rax
xor eax, eax
test rbx, rbx
je 0x140099cc8
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x28]
test rax, rax
je 0x140099cc8
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x28]
mov r8, rdi
lea rdx, str.error
mov rcx, rax
call fcn.140021930
nop
mov rcx, qword [rbp - 0x20]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x140099d06
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x140099d06
mov rcx, qword [rbp - 0x20]
add rcx, 0xfffffffffffffff4
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
nop
mov rcx, qword [rbp - 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x140099d29
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x140099d29
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
nop
lea rcx, [rbp]
call fcn.140068890
nop
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rcx]
add rdx, 0xfffffffffffffff4
cmp rdx, qword [0x140108010]
je 0x140099d5f
mov eax, esi
lock xadd dword [rdx], eax
add eax, esi
test eax, eax
jg 0x140099d5f
mov rcx, qword [rcx]
sub rcx, 0xc
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1400bf530
add rsp, 0x268
pop rdi
pop rsi
pop rbx
pop rbp
ret