Function at 0x14003d860
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x410
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rsp + 0x400], rax
mov byte [rsp + 0x40], r9b
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x78], rcx
mov rdx, qword [rsp + 0x460]
mov rbx, qword [rsp + 0x468]
xor edi, edi
mov dword [rsp + 0x280], edi
test rdx, rdx
je 0x14003f974
mov qword [rsp + 0x390], rdi
mov qword [rsp + 0x3a0], rdi
mov qword [rsp + 0x3a8], 7
mov word [rsp + 0x390], di
mov r14, 0xffffffffffffffff
mov r8, r14
nop
inc r8
cmp word [rdx + r8*2], di
jne 0x14003d8f0
lea rcx, [rsp + 0x390]
call fcn.140002760
nop
mov qword [rsp + 0x288], rdi
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x2a0], 7
mov word [rsp + 0x288], di
test rbx, rbx
je 0x14003d94f
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x14003d934
mov rdx, rbx
lea rcx, [rsp + 0x288]
call fcn.140002760
lea rcx, [rsp + 0x390]
mov rax, qword [rsp + 0x3a0]
cmp qword [rsp + 0x3a8], 8
jb 0x14003d978
mov rdx, qword [rsp + 0x390]
lea r8, [rdx + rax*2]
jmp 0x14003d984
lea r8, [rcx + rax*2]
lea rdx, [rsp + 0x390]
mov qword [rsp + 0x300], rdi
mov qword [rsp + 0x310], rdi
mov qword [rsp + 0x318], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x300], 0
lea rcx, [rsp + 0x300]
call fcn.14001f290
nop
lea rcx, [rsp + 0x288]
mov rax, qword [rsp + 0x298]
cmp qword [rsp + 0x2a0], 8
jb 0x14003d9df
mov rdx, qword [rsp + 0x288]
lea r8, [rdx + rax*2]
jmp 0x14003d9eb
lea r8, [rcx + rax*2]
lea rdx, [rsp + 0x288]
mov qword [rsp + 0x370], rdi
mov qword [rsp + 0x380], rdi
mov qword [rsp + 0x388], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x370], 0
lea rcx, [rsp + 0x370]
call fcn.14001f290
nop
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400a8798], eax
jle 0x14003daa8
lea rcx, [0x1400a8798]
call fcn.140047980
cmp dword [0x1400a8798], 0xffffffff
jne 0x14003daa8
mov qword [0x1400a8768], 0xffffffff80000003
lea rax, [0x140094d4c]
mov qword [0x1400a8770], rax
lea rax, str.REGISTRYUSER
mov qword [0x1400a8778], rax
mov qword [0x1400a8780], 0xffffffff80000002
lea rax, str.HKLM
mov qword [0x1400a8788], rax
lea rax, str.REGISTRYMACHINE
mov qword [0x1400a8790], rax
lea rcx, [0x1400a8798]
call fcn.140047920
cmp qword [rsp + 0x318], 0x10
setae r13b
lea rsi, [0x1400a8778]
mov r15, qword [rsp + 0x310]
mov r12, qword [rsp + 0x300]
nop dword [rax]
mov rdi, qword [rsi - 8]
mov rbx, qword [rsi]
mov rax, r14
nop word [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x14003dae0
lea rcx, [rsp + 0x300]
test r13b, r13b
cmovne rcx, r12
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rdx, r15
call fcn.140040130
test rax, rax
je 0x14003db23
add rsi, 0x18
lea rax, [rsi - 0x10]
lea rcx, [0x1400a8798]
cmp rax, rcx
jne 0x14003dad0
jmp 0x14003db7a
mov rax, r14
inc rax
cmp byte [rbx + rax], 0
jne 0x14003db26
cmp r15, rax
cmovb rax, r15
lea rcx, [rsp + 0x300]
test r13b, r13b
cmovne rcx, r12
sub r15, rax
mov qword [rsp + 0x310], r15
lea r8, [r15 + 1]
lea rdx, [rcx + rax]
call fcn.140049c10
mov r9, r14
inc r9
cmp byte [rdi + r9], 0
jne 0x14003db60
mov r8, rdi
lea rcx, [rsp + 0x300]
call fcn.140012e70
mov rsi, qword [rsp + 0x88]
lea rdi, [rsi + 0x28]
mov qword [rsp + 0x90], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x320], xmm0
movups xmmword [rsp + 0x330], xmm0
movups xmmword [rsp + 0x340], xmm0
xor r15d, r15d
mov qword [rsp + 0x320], r15
mov qword [rsp + 0x328], r15
lea ecx, [r15 + 0x48]
call fcn.140047d0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x330], r15
mov qword [rsp + 0x340], r15
mov qword [rsp + 0x348], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x330], r15b
movzx ecx, byte [rsp + 0x40]
sub ecx, 0x20
je 0x14003f5ec
sub ecx, 2
je 0x14003f2b9
sub ecx, 2
je 0x14003e2b9
cmp ecx, 1
jne 0x14003f925
lea r14, [rsi + 0x50]
lea r8, [rsp + 0x300]
lea rdx, [rsp + 0x2a8]
mov rcx, r14
call fcn.140007ea0
mov rbx, qword [rsp + 0x2b8]
cmp byte [rbx + 0x19], r15b
jne 0x14003deed
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x300]
call fcn.140007f60
test al, al
jne 0x14003deed
cmp rbx, qword [r14]
je 0x14003deed
mov rax, qword [rbx + 0x40]
cmp dword [rax], 5
jne 0x14003deed
lea rdx, [rsp + 0x300]
mov rcx, r14
call fcn.14003ae60
mov rsi, rax
mov qword [rsp + 0x350], r15
mov qword [rsp + 0x360], r15
mov qword [rsp + 0x368], reloc.WS2_32.dll_ntohs
lea r8d, [r15 + 7]
lea rdx, str.deleted
lea rcx, [rsp + 0x350]
call fcn.140006ac0
lea r8, [rsp + 0x350]
lea rdx, [rsp + 0x2a8]
mov rcx, rsi
call fcn.140007ea0
mov rbx, qword [rsp + 0x2b8]
cmp byte [rbx + 0x19], r15b
jne 0x14003dd26
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x350]
call fcn.140007f60
test al, al
jne 0x14003dd26
cmp rbx, qword [rsi]
je 0x14003dd26
mov rax, qword [rbx + 0x40]
cmp dword [rax], 4
jne 0x14003dd26
mov bl, 1
jmp 0x14003dd28
xor bl, bl
mov rdx, qword [rsp + 0x368]
cmp rdx, 0x10
jb 0x14003dd6b
inc rdx
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dd66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f9a7
call fcn.1400477f0
test bl, bl
je 0x14003f925
mov qword [rsp + 0x350], r15
mov qword [rsp + 0x360], r15
mov qword [rsp + 0x368], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x350], 0
mov r8d, 7
lea rdx, str.deleted
lea rcx, [rsp + 0x350]
call fcn.140006ac0
nop
lea rdx, [rsp + 0x350]
mov rcx, rsi
call fcn.14003af90
mov rbx, rax
mov dword [rsp + 0x228], 6
lea rcx, [rsp + 0x228]
call fcn.140008f70
mov esi, 1
mov dword [rsp + 0x228], esi
lea ecx, [rsi + 0x1f]
call fcn.140047d0c
mov qword [rax], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x370]
cmp rax, rcx
je 0x14003de40
lea rdx, [rsp + 0x370]
cmp qword [rsp + 0x388], 0x10
cmovae rdx, qword [rsp + 0x370]
mov r8, qword [rsp + 0x380]
mov rcx, rax
call fcn.140006ac0
nop
mov ecx, 0x10
call fcn.140047d0c
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rsp + 0x228]
mov rcx, rax
call fcn.14000b360
nop
mov qword [rsp + 0x88], rax
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14003de82
mov qword [rdx], rax
add qword [rbx + 8], 8
jmp 0x14003de93
lea r8, [rsp + 0x88]
mov rcx, rbx
call fcn.14000f860
nop
lea rcx, [rsp + 0x228]
call fcn.140008f70
nop
mov rdx, qword [rsp + 0x368]
cmp rdx, 0x10
jb 0x14003f925
inc rdx
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dee3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f9a7
call fcn.1400477f0
jmp 0x14003f925
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2e8], xmm1
mov qword [rsp + 0x2f8], r15
mov dword [rsp + 0x228], 6
lea rcx, [rsp + 0x228]
call fcn.140008f70
mov esi, 1
mov dword [rsp + 0x228], esi
lea ecx, [rsi + 0x1f]
call fcn.140047d0c
mov qword [rax], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x370]
cmp rax, rcx
je 0x14003df7c
lea rdx, [rsp + 0x370]
cmp qword [rsp + 0x388], 0x10
cmovae rdx, qword [rsp + 0x370]
mov r8, qword [rsp + 0x380]
mov rcx, rax
call fcn.140006ac0
nop
mov ecx, 0x10
call fcn.140047d0c
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rsp + 0x228]
mov rcx, rax
call fcn.14000b360
nop
mov qword [rsp + 0x88], rax
lea r8, [rsp + 0x88]
xor edx, edx
lea rcx, [rsp + 0x2e8]
call fcn.14000f860
nop
lea rcx, [rsp + 0x228]
call fcn.140008f70
mov dword [rsp + 0x228], 6
lea rdx, [rsp + 0x2e8]
lea rcx, [rsp + 0x228]
call fcn.1400080f0
nop
mov qword [rsp + 0x250], r15
mov qword [rsp + 0x260], r15
mov qword [rsp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x250], 0
mov r8d, 7
lea rdx, str.deleted
lea rcx, [rsp + 0x250]
call fcn.140006ac0
nop
lea rax, [rsp + 0x330]
cmp qword [rsp + 0x348], 0x10
cmovae rax, qword [rsp + 0x330]
mov qword [rsp + 0x340], r15
mov byte [rax], 0
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x2a8]
lea rcx, [rsp + 0x320]
call fcn.140007ea0
mov rbx, qword [rsp + 0x2b8]
cmp byte [rbx + 0x19], 0
jne 0x14003e09e
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x250]
call fcn.140007f60
test al, al
jne 0x14003e09e
mov rax, qword [rsp + 0x320]
jmp 0x14003e0a9
mov rax, qword [rsp + 0x320]
mov rbx, rax
cmp rbx, rax
je 0x14003e0cc
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x14003e0cc
mov rcx, rbx
call fcn.1400080e0
mov edx, 0x10
mov rcx, rbx
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rsp + 0x228]
mov rcx, rax
call fcn.14000b360
mov rbx, rax
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x320]
call fcn.14000c600
mov qword [rax], rbx
mov rdx, qword [rsp + 0x268]
cmp rdx, 0x10
jb 0x14003e14f
inc rdx
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e14a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f9a1
call fcn.1400477f0
mov qword [rsp + 0x260], r15
mov qword [rsp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x250], 0
lea rcx, [rsp + 0x228]
call fcn.140008f70
mov dword [rsp + 0x228], 6
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x228]
call fcn.140008170
nop
lea rcx, [r14 + 0x10]
cmp qword [r14 + 0x28], 0x10
jb 0x14003e1a8
mov rcx, qword [r14 + 0x10]
mov qword [r14 + 0x20], r15
mov byte [rcx], 0
lea r8, [rsp + 0x300]
lea rdx, [rsp + 0x2a8]
mov rcx, r14
call fcn.140007ea0
mov rbx, qword [rsp + 0x2b8]
cmp byte [rbx + 0x19], 0
jne 0x14003e20d
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x300]
call fcn.140007f60
test al, al
jne 0x14003e20d
cmp rbx, qword [r14]
je 0x14003e20d
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x14003e20d
mov rcx, rbx
call fcn.1400080e0
mov edx, 0x10
mov rcx, rbx
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rsp + 0x228]
mov rcx, rax
call fcn.14000b360
mov rbx, rax
lea rdx, [rsp + 0x300]
mov rcx, r14
call fcn.14000c600
mov qword [rax], rbx
lea rcx, [rsp + 0x228]
call fcn.140008f70
nop
lea rcx, [rsp + 0x2e8]
call fcn.14000b270
mov rcx, qword [rsp + 0x2e8]
test rcx, rcx
je 0x14003f925
mov rax, qword [rsp + 0x2f8]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dee3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f9a7
jmp 0x14003dee3
mov qword [rsp + 0x2e0], r15
mov qword [rsp + 0x350], r15
mov qword [rsp + 0x360], r15
mov qword [rsp + 0x368], 7
mov word [rsp + 0x350], r15w
lea rcx, [rsp + 0x390]
mov rax, qword [rsp + 0x3a0]
cmp qword [rsp + 0x3a8], 8
jb 0x14003e30f
mov rdx, qword [rsp + 0x390]
lea r8, [rdx + rax*2]
jmp 0x14003e31b
lea r8, [rcx + rax*2]
lea rdx, [rsp + 0x390]
mov qword [rsp + 0x3b0], r15
mov qword [rsp + 0x3c0], r15
mov qword [rsp + 0x3c8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x3b0], 0
lea rcx, [rsp + 0x3b0]
call fcn.14001f290
nop
lea rsi, [0x1400a8768]
cmp qword [rsp + 0x3c8], 0x10
setae dl
mov byte [rsp + 0x40], dl
mov r12, qword [rsp + 0x3c0]
mov r15, qword [rsp + 0x3b0]
nop dword [rax]
nop dword [rax + rax]
mov r13, qword [rsi]
mov rbx, qword [rsi + 0x10]
mov rax, r14
nop word [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x14003e390
lea rcx, [rsp + 0x3b0]
test dl, dl
cmovne rcx, r15
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rdx, r12
call fcn.140040130
test rax, rax
je 0x14003e3db
add rsi, 0x18
lea rax, [0x1400a8798]
cmp rsi, rax
movzx edx, byte [rsp + 0x40]
jne 0x14003e380
mov rsi, qword [rsp + 0x2e0]
jmp 0x14003e41f
mov rsi, r13
lea rax, [rsp + 0x3b0]
cmp byte [rsp + 0x40], 0
je 0x14003e3f3
lea r8, [r15 + r12]
jmp 0x14003e400
lea r8, [rax + r12]
lea r15, [rsp + 0x3b0]
nop
lea r14, [r14 + 1]
cmp byte [rbx + r14], 0
jne 0x14003e400
lea rdx, [r14 + 1]
add rdx, r15
lea rcx, [rsp + 0x350]
call fcn.14003c9a0
xor r15d, r15d
mov qword [rsp + 0x2c0], r15
mov qword [rsp + 0x2d0], r15
mov qword [rsp + 0x2d8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x2c0], r15b
mov qword [rsp + 0x2e0], r15
mov qword [rsp + 0x248], r15
lea rdx, [rsp + 0x350]
cmp qword [rsp + 0x368], 8
cmovae rdx, qword [rsp + 0x350]
lea rax, [rsp + 0x248]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003f9ad
mov rsi, qword [rsp + 0x248]
mov qword [rsp + 0x2e0], rsi
mov dword [rsp + 0x248], r15d
lea rdx, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 8
cmovae rdx, qword [rsp + 0x288]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x248]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003f9d7
mov qword [rsp + 0x250], r15
mov qword [rsp + 0x260], r15
mov qword [rsp + 0x268], 7
mov word [rsp + 0x250], r15w
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2e8], xmm1
mov qword [rsp + 0x2f8], r15
movdqu xmmword [rsp + 0x2a8], xmm1
mov qword [rsp + 0x2b8], r15
mov eax, dword [rsp + 0x248]
dec eax
cmp eax, 0xa
ja case.0x14003e55c.5
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x3fb84]
add rcx, rdx
jmp rcx
mov dword [rsp + 0x280], r15d
mov dword [rsp + 0x248], 4
lea r8, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 8
cmovae r8, qword [rsp + 0x288]
lea rax, [rsp + 0x248]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x280]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor edx, edx
lea r9d, [rdx + 0x10]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003fa02
lea r9, [rsp + 0x23d]
mov r8d, dword [rsp + 0x280]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x14003e5d1
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
lea rax, [rsp + 0x23d]
cmp r9, rax
je 0x14003e633
lea r8, [rsp + 0x23d]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140006ac0
mov rdx, qword [rsp + 0x2d8]
cmp rdx, 0x10
jb 0x14003e676
inc rdx
mov rcx, qword [rsp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e671
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fa56
call fcn.1400477f0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x2c0], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x2d0], xmm1
jmp case.0x14003e55c.5
mov qword [rsp + 0x248], r15
mov dword [rsp + 0x280], 8
lea r8, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 8
cmovae r8, qword [rsp + 0x288]
lea rax, [rsp + 0x280]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor edx, edx
lea r9d, [rdx + 0x40]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003fa2c
lea r9, [rsp + 0x23d]
mov r8, qword [rsp + 0x248]
movabs r10, 0xcccccccccccccccd
nop dword [rax]
nop word [rax + rax]
dec r9
mov rax, r10
mul r8
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8, rdx
test rdx, rdx
jne 0x14003e720
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
lea rax, [rsp + 0x23d]
cmp r9, rax
je 0x14003e782
lea r8, [rsp + 0x23d]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140006ac0
mov rdx, qword [rsp + 0x2d8]
cmp rdx, 0x10
jb 0x14003e676
inc rdx
mov rcx, qword [rsp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e671
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fa56
jmp 0x14003e671
mov dword [rsp + 0x248], r15d
lea r8, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 8
cmovae r8, qword [rsp + 0x288]
lea rax, [rsp + 0x248]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003fa5c
mov edx, dword [rsp + 0x248]
shr rdx, 1
mov qword [rsp + 0x228], r15
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x240], 7
mov word [rsp + 0x228], r15w
mov r8d, 0x20
lea rcx, [rsp + 0x228]
call fcn.140040350
mov dword [rsp + 0x280], 0x10
lea rax, [rsp + 0x228]
cmp qword [rsp + 0x240], 8
cmovae rax, qword [rsp + 0x228]
lea r8, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 8
cmovae r8, qword [rsp + 0x288]
lea rcx, [rsp + 0x248]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003fa86
xor r8d, r8d
mov edx, dword [rsp + 0x248]
shr rdx, 1
dec rdx
lea rcx, [rsp + 0x228]
call fcn.140022120
mov rdx, qword [rsp + 0x268]
cmp rdx, 8
jb 0x14003e931
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e92c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fab0
call fcn.1400477f0
movups xmm0, xmmword [rsp + 0x228]
movups xmmword [rsp + 0x250], xmm0
movups xmm1, xmmword [rsp + 0x238]
movups xmmword [rsp + 0x260], xmm1
lea rcx, [rsp + 0x250]
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 8
mov rax, qword [rsp + 0x238]
jb 0x14003e97f
mov rdx, qword [rsp + 0x228]
lea r8, [rdx + rax*2]
jmp 0x14003e98b
lea r8, [rcx + rax*2]
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x2c0]
call fcn.14003b2e0
jmp case.0x14003e55c.5
mov dword [rsp + 0x248], r15d
lea r8, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 8
cmovae r8, qword [rsp + 0x288]
lea rax, [rsp + 0x248]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor edx, edx
mov r9d, 0x10000004
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003fab6
mov edx, dword [rsp + 0x248]
shr rdx, 1
mov qword [rsp + 0x228], r15
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x240], 7
mov word [rsp + 0x228], r15w
mov r8d, 0x20
lea rcx, [rsp + 0x228]
call fcn.140040350
mov dword [rsp + 0x280], 0x20
lea rax, [rsp + 0x228]
cmp qword [rsp + 0x240], 8
cmovae rax, qword [rsp + 0x228]
lea r8, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 8
cmovae r8, qword [rsp + 0x288]
lea rcx, [rsp + 0x248]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor edx, edx
mov r9d, 0x10000004
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003fae0
xor r8d, r8d
mov edx, dword [rsp + 0x248]
shr rdx, 1
dec rdx
lea rcx, [rsp + 0x228]
call fcn.140022120
mov rdx, qword [rsp + 0x268]
cmp rdx, 8
jb 0x14003eb05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003eb00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fb0a
call fcn.1400477f0
movups xmm0, xmmword [rsp + 0x228]
movups xmmword [rsp + 0x250], xmm0
movups xmm1, xmmword [rsp + 0x238]
movups xmmword [rsp + 0x260], xmm1
jmp 0x14003e951
lea r8, [rsp + 0x288]
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x2e0]
call fcn.14003ccc0
mov rsi, rax
lea rax, [rsp + 0x2e8]
cmp rax, rsi
je 0x14003eb94
lea rcx, [rsp + 0x2e8]
call fcn.140017c80
mov rbx, qword [rsi]
mov qword [rsp + 0x2e8], rbx
mov r14, qword [rsi + 8]
mov qword [rsp + 0x2f0], r14
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x2f8], rax
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
jmp 0x14003eba4
mov r14, qword [rsp + 0x2f0]
mov rbx, qword [rsp + 0x2e8]
lea rcx, [rsp + 0x228]
call fcn.140017c80
mov esi, 1
cmp rbx, r14
je 0x14003eca8
cmp qword [rbx + 0x18], 8
jb 0x14003ebd3
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx]
lea r8, [rax + rcx*2]
jmp 0x14003ebe0
mov rax, qword [rbx + 0x10]
lea r8, [rbx + rax*2]
mov rdx, rbx
jb 0x14003ebe3
mov rdx, qword [rbx]
mov qword [rsp + 0x228], r15
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x240], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x228], 0
lea rcx, [rsp + 0x228]
call fcn.14001f290
nop
lea rdx, [rsp + 0x228]
cmp qword [rsp + 0x240], 0x10
cmovae rdx, qword [rsp + 0x228]
mov r8, qword [rsp + 0x238]
lea rcx, [rsp + 0x2c0]
call fcn.140006c20
nop
mov rdx, qword [rsp + 0x240]
cmp rdx, 0x10
jb 0x14003ec88
inc rdx
mov rcx, qword [rsp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ec83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fb10
call fcn.1400477f0
mov r8, rsi
lea rdx, [0x140094d90]
lea rcx, [rsp + 0x2c0]
call fcn.140006c20
add rbx, 0x20
jmp 0x14003ebb6
lea rax, [rsp + 0x2c0]
mov r8, qword [rsp + 0x2d0]
cmp qword [rsp + 0x2d8], 0x10
jb 0x14003ecd1
lea rdx, [r8 - 1]
mov rcx, qword [rsp + 0x2c0]
jmp 0x14003eceb
lea rdx, [rax - 1]
add rdx, r8
lea rax, [rsp + 0x2c0]
sub rdx, rax
lea rcx, [rsp + 0x2c0]
mov rax, r8
sub rax, rdx
cmp rax, 1
cmovb rsi, rax
add rcx, rdx
sub r8, rsi
mov qword [rsp + 0x2d0], r8
sub r8, rdx
inc r8
lea rdx, [rcx + rsi]
call fcn.140049c10
jmp case.0x14003e55c.5
mov dword [rsp + 0x248], r15d
lea r8, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 8
cmovae r8, qword [rsp + 0x288]
lea rax, [rsp + 0x248]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor edx, edx
lea r9d, [rdx + 8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003fb16
xorps xmm0, xmm0
mov ebx, dword [rsp + 0x248]
movdqu xmmword [rsp + 0x228], xmm0
mov qword [rsp + 0x238], r15
test rbx, rbx
je 0x14003edba
mov edx, ebx
lea rcx, [rsp + 0x228]
call fcn.140021650
mov rcx, qword [rsp + 0x228]
add rbx, rcx
mov r8, rbx
sub r8, rcx
xor edx, edx
call fcn.14004a2e0
mov qword [rsp + 0x230], rbx
mov dword [rsp + 0x280], 0x40
lea rcx, [rsp + 0x288]
call fcn.140002490
lea rcx, [rsp + 0x248]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x228]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
mov r9d, 8
mov r8, rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003fb40
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x2a8]
call fcn.14003fc00
nop
lea rcx, [rsp + 0x228]
call fcn.140001c50
mov rbx, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b0]
cmp rbx, rsi
je 0x14003ee9b
mov byte [rsp + 0x228], 4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x229], xmm0
mov word [rsp + 0x239], ax
mov byte [rsp + 0x23b], al
movzx r8d, byte [rbx]
lea rdx, str._02X
lea rcx, [rsp + 0x228]
call fcn.14003c2e0
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x2c0]
call fcn.1400066b0
inc rbx
jmp 0x14003ee40
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x2c0]
call fcn.14001eed0
mov r8d, 1
lea rdx, [rsp + 0x248]
mov rcx, rax
call fcn.14003fbb0
mov r8, qword [rax]
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x2c0]
call fcn.14003fdc0
nop
lea rcx, [rsp + 0x2a8]
call fcn.140001c50
nop
lea rcx, [rsp + 0x2e8]
call fcn.140017c80
nop
lea rcx, [rsp + 0x250]
call fcn.140001140
nop
lea rcx, [rsp + 0x2e0]
call fcn.14003cc10
nop
mov rbx, qword [rsp + 0x88]
jmp 0x14003ef2e
lea rcx, [rsp + 0x3d0]
call fcn.140004820
lea rcx, [rsp + 0x3d0]
call fcn.140008bd0
nop
lea rcx, [rsp + 0x228]
call fcn.140040040
nop
lea rdx, [0x140094d9c]
lea rcx, [rsp + 0x48]
call fcn.140006750
nop
lea r8, [rsp + 0x228]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3d0]
call fcn.14000adb0
nop
lea rcx, [rsp + 0x48]
call fcn.1400066f0
nop
lea rcx, [rsp + 0x228]
call fcn.140008f70
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x228]
call fcn.140021970
nop
lea rdx, str.become
lea rcx, [rsp + 0x48]
call fcn.140006750
nop
lea r8, [rsp + 0x228]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3d0]
call fcn.14000adb0
nop
lea rcx, [rsp + 0x48]
call fcn.1400066f0
nop
lea rcx, [rsp + 0x228]
call fcn.140008f70
add rbx, 0x50
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.14003bb00
test al, al
je 0x14003f17b
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.14003ae60
mov rsi, rax
lea rdx, str.changed
lea rcx, [rsp + 0x48]
call fcn.140006750
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.14003bb00
movzx ebx, al
lea rcx, [rsp + 0x48]
call fcn.1400066f0
test bl, bl
je 0x14003f0c3
lea rdx, str.changed
lea rcx, [rsp + 0x48]
call fcn.140006750
nop
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.14003ae60
mov rbx, rax
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x228]
call fcn.14000ecb0
nop
lea r8, [rsp + 0x228]
lea rdx, [rsp + 0x370]
mov rcx, rbx
call fcn.14000adb0
nop
lea rcx, [rsp + 0x228]
call fcn.140008f70
nop
lea rcx, [rsp + 0x48]
call fcn.1400066f0
jmp 0x14003f27d
lea rcx, [rsp + 0x250]
call fcn.140004820
lea rcx, [rsp + 0x250]
call fcn.140008bd0
nop
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x228]
call fcn.14000ecb0
nop
lea r8, [rsp + 0x228]
lea rdx, [rsp + 0x370]
lea rcx, [rsp + 0x250]
call fcn.14000adb0
nop
lea rcx, [rsp + 0x228]
call fcn.140008f70
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x228]
call fcn.14000ecb0
nop
lea rdx, str.changed
lea rcx, [rsp + 0x48]
call fcn.140006750
nop
lea r8, [rsp + 0x228]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.14000adb0
nop
lea rcx, [rsp + 0x48]
call fcn.1400066f0
nop
lea rcx, [rsp + 0x228]
call fcn.140008f70
nop
jmp 0x14003f26f
lea rcx, [rsp + 0x250]
call fcn.140004820
lea rcx, [rsp + 0x250]
call fcn.140008bd0
nop
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x228]
call fcn.14000ecb0
nop
lea r8, [rsp + 0x228]
lea rdx, [rsp + 0x370]
lea rcx, [rsp + 0x250]
call fcn.14000adb0
nop
lea rcx, [rsp + 0x228]
call fcn.140008f70
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x228]
call fcn.14000ecb0
nop
lea rdx, str.changed
lea rcx, [rsp + 0x48]
call fcn.140006750
nop
lea r8, [rsp + 0x228]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x320]
call fcn.14000adb0
nop
lea rcx, [rsp + 0x48]
call fcn.1400066f0
nop
lea rcx, [rsp + 0x228]
call fcn.140008f70
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x228]
call fcn.14000ecb0
nop
lea r8, [rsp + 0x228]
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.14000adb0
nop
lea rcx, [rsp + 0x228]
call fcn.140008f70
nop
lea rcx, [rsp + 0x250]
call fcn.140008c60
nop
lea rcx, [rsp + 0x3d0]
call fcn.140008c60
nop
lea rcx, [rsp + 0x2c0]
call fcn.1400066f0
nop
lea rcx, [rsp + 0x3b0]
call fcn.1400066f0
nop
lea rcx, [rsp + 0x350]
call fcn.140001140
jmp 0x14003f925
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov ecx, 0x48
call fcn.140047d0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
mov dword [rsp + 0x78], 6
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.140008170
nop
mov qword [rsp + 0x250], r15
mov qword [rsp + 0x260], r15
mov qword [rsp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x250], 0
mov r8d, 7
lea rdx, str.deleted
lea rcx, [rsp + 0x250]
call fcn.140006ac0
nop
lea rax, [rsp + 0x330]
cmp qword [rsp + 0x348], 0x10
cmovae rax, qword [rsp + 0x330]
mov qword [rsp + 0x340], r15
mov byte [rax], 0
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x2a8]
lea rcx, [rsp + 0x320]
call fcn.140007ea0
mov rbx, qword [rsp + 0x2b8]
cmp byte [rbx + 0x19], 0
jne 0x14003f3c1
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x250]
call fcn.140007f60
test al, al
jne 0x14003f3c1
mov rax, qword [rsp + 0x320]
jmp 0x14003f3cc
mov rax, qword [rsp + 0x320]
mov rbx, rax
cmp rbx, rax
je 0x14003f3ef
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x14003f3ef
mov rcx, rbx
call fcn.1400080e0
mov edx, 0x10
mov rcx, rbx
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rsp + 0x228], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.14000b360
mov rbx, rax
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x320]
call fcn.14000c600
mov qword [rax], rbx
mov rdx, qword [rsp + 0x268]
cmp rdx, 0x10
jb 0x14003f472
inc rdx
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f46d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fb6b
call fcn.1400477f0
mov qword [rsp + 0x260], r15
mov qword [rsp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x250], 0
lea rcx, [rsp + 0x78]
call fcn.140008f70
nop
lea rcx, [rsp + 0x48]
call fcn.14000b010
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14003f4e0
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f4db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fb71
call fcn.1400477f0
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
mov r8, qword [rsp + 0x48]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.14000f950
mov edx, 0x48
mov rcx, qword [rsp + 0x48]
call fcn.1400477f0
mov dword [rsp + 0x78], 6
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x78]
call fcn.140008170
nop
lea rcx, [rsi + 0x60]
cmp qword [rsi + 0x78], 0x10
jb 0x14003f544
mov rcx, qword [rsi + 0x60]
mov qword [rsi + 0x70], r15
mov byte [rcx], 0
lea r8, [rsp + 0x300]
lea rdx, [rsp + 0x2a8]
lea rcx, [rsi + 0x50]
call fcn.140007ea0
mov rbx, qword [rsp + 0x2b8]
cmp byte [rbx + 0x19], 0
jne 0x14003f5ab
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x300]
call fcn.140007f60
test al, al
jne 0x14003f5ab
cmp rbx, qword [rsi + 0x50]
je 0x14003f5ab
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x14003f5ab
mov rcx, rbx
call fcn.1400080e0
mov edx, 0x10
mov rcx, rbx
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rsp + 0x228], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.14000b360
mov rbx, rax
lea rdx, [rsp + 0x300]
lea rcx, [rsi + 0x50]
call fcn.14000c600
mov qword [rax], rbx
jmp 0x14003f91a
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov ecx, 0x48
call fcn.140047d0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
mov dword [rsp + 0x78], 6
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.140008170
nop
mov qword [rsp + 0x250], r15
mov qword [rsp + 0x260], r15
mov qword [rsp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x250], 0
mov r8d, 7
lea rdx, str.created
lea rcx, [rsp + 0x250]
call fcn.140006ac0
nop
lea rax, [rsp + 0x330]
cmp qword [rsp + 0x348], 0x10
cmovae rax, qword [rsp + 0x330]
mov qword [rsp + 0x340], r15
mov byte [rax], 0
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x2a8]
lea rcx, [rsp + 0x320]
call fcn.140007ea0
mov rbx, qword [rsp + 0x2b8]
cmp byte [rbx + 0x19], 0
jne 0x14003f6f4
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x250]
call fcn.140007f60
test al, al
jne 0x14003f6f4
mov rax, qword [rsp + 0x320]
jmp 0x14003f6ff
mov rax, qword [rsp + 0x320]
mov rbx, rax
cmp rbx, rax
je 0x14003f722
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x14003f722
mov rcx, rbx
call fcn.1400080e0
mov edx, 0x10
mov rcx, rbx
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rsp + 0x228], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.14000b360
mov rbx, rax
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x320]
call fcn.14000c600
mov qword [rax], rbx
mov rdx, qword [rsp + 0x268]
cmp rdx, 0x10
jb 0x14003f7a5
inc rdx
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f7a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fb77
call fcn.1400477f0
mov qword [rsp + 0x260], r15
mov qword [rsp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x250], 0
lea rcx, [rsp + 0x78]
call fcn.140008f70
nop
lea rcx, [rsp + 0x48]
call fcn.14000b010
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14003f813
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f80e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fb7d
call fcn.1400477f0
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
mov r8, qword [rsp + 0x48]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.14000f950
mov edx, 0x48
mov rcx, qword [rsp + 0x48]
call fcn.1400477f0
mov dword [rsp + 0x78], 6
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x78]
call fcn.140008170
nop
lea rcx, [rsi + 0x60]
cmp qword [rsi + 0x78], 0x10
jb 0x14003f877
mov rcx, qword [rsi + 0x60]
mov qword [rsi + 0x70], r15
mov byte [rcx], 0
lea r8, [rsp + 0x300]
lea rdx, [rsp + 0x2a8]
lea rcx, [rsi + 0x50]
call fcn.140007ea0
mov rbx, qword [rsp + 0x2b8]
cmp byte [rbx + 0x19], 0
jne 0x14003f8de
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x300]
call fcn.140007f60
test al, al
jne 0x14003f8de
cmp rbx, qword [rsi + 0x50]
je 0x14003f8de
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x14003f8de
mov rcx, rbx
call fcn.1400080e0
mov edx, 0x10
mov rcx, rbx
call fcn.1400477f0
mov ecx, 0x10
call fcn.140047d0c
mov qword [rsp + 0x228], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.14000b360
mov rbx, rax
lea rdx, [rsp + 0x300]
lea rcx, [rsi + 0x50]
call fcn.14000c600
mov qword [rax], rbx
lea rcx, [rsp + 0x78]
call fcn.140008f70
nop
lea rcx, [rsp + 0x320]
call fcn.140008c60
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x370]
call fcn.1400066f0
nop
lea rcx, [rsp + 0x300]
call fcn.1400066f0
nop
lea rcx, [rsp + 0x288]
call fcn.140001140
nop
lea rcx, [rsp + 0x390]
call fcn.140001140
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.1400477d0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14004e14c
nop
call fcn.14004e14c
nop
lea r8, str.RegOpenKeyEx_failed.
mov edx, eax
lea rcx, [rsp + 0x98]
call fcn.14003cff0
lea rdx, [0x1400a16c8]
lea rcx, [rsp + 0x98]
call fcn.140049b34
lea r8, str.Cannot_get_the_value_type:_RegQueryValueEx_failed.
mov edx, eax
lea rcx, [rsp + 0xc0]
call fcn.14003cff0
lea rdx, [0x1400a16c8]
lea rcx, [rsp + 0xc0]
call fcn.140049b34
nop
lea r8, str.Cannot_get_DWORD_value:_RegGetValue_failed.
mov edx, eax
lea rcx, [rsp + 0xe8]
call fcn.14003cff0
lea rdx, [0x1400a16c8]
lea rcx, [rsp + 0xe8]
call fcn.140049b34
lea r8, str.Cannot_get_QWORD_value:_RegGetValue_failed.
mov edx, eax
lea rcx, [rsp + 0x110]
call fcn.14003cff0
lea rdx, [0x1400a16c8]
lea rcx, [rsp + 0x110]
call fcn.140049b34
call fcn.14004e14c
nop
lea r8, str.Cannot_get_size_of_string_value:_RegGetValue_failed.
mov edx, eax
lea rcx, [rsp + 0x138]
call fcn.14003cff0
lea rdx, [0x1400a16c8]
lea rcx, [rsp + 0x138]
call fcn.140049b34
lea r8, str.Cannot_get_string_value:_RegGetValue_failed.
mov edx, eax
lea rcx, [rsp + 0x160]
call fcn.14003cff0
lea rdx, [0x1400a16c8]
lea rcx, [rsp + 0x160]
call fcn.140049b34
call fcn.14004e14c
nop
lea r8, str.Cannot_get_size_of_expand_string_value:_RegGetValue_failed.
mov edx, eax
lea rcx, [rsp + 0x188]
call fcn.14003cff0
lea rdx, [0x1400a16c8]
lea rcx, [rsp + 0x188]
call fcn.140049b34
lea r8, str.Cannot_get_expand_string_value:_RegGetValue_failed.
mov edx, eax
lea rcx, [rsp + 0x1b0]
call fcn.14003cff0
lea rdx, [0x1400a16c8]
lea rcx, [rsp + 0x1b0]
call fcn.140049b34
call fcn.14004e14c
nop
call fcn.14004e14c
nop
lea r8, str.Cannot_get_size_of_binary_data:_RegGetValue_failed.
mov edx, eax
lea rcx, [rsp + 0x1d8]
call fcn.14003cff0
lea rdx, [0x1400a16c8]
lea rcx, [rsp + 0x1d8]
call fcn.140049b34
lea r8, str.Cannot_get_binary_data:_RegGetValue_failed.
mov edx, eax
lea rcx, [rsp + 0x200]
call fcn.14003cff0
lea rdx, [0x1400a16c8]
lea rcx, [rsp + 0x200]
call fcn.140049b34
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
int3